The Royal Canadian Mounted Police (RCMP) should be required by law to assess the privacy impact of spyware before it’s used, says privacy commissioner Philippe Dufresne.
Updated yesterday at 18:09.
Joël-Denis Bellavance La Presse
Such a commitment would ensure Canadians do not lose confidence in their institutions, Mr Dufresne argued before a parliamentary committee on Monday.
But senior RCMP officers later argued before the same committee that such spyware was used as a last resort and very rarely, often in investigations of serious crimes such as terrorism or murder.
For his part, the Minister of Public Safety, Marco Mendicino, clarified that law enforcement agencies do not use Pegasus software, which has been banned on United States territory by the United States Congress. The minister even said he was ready to officially ban the use of this spyware in Canada. Developed by NSO Group, an Israeli company, this software was used to spy on political leaders, activists and journalists – including the Saudi Jamal Khashoggi, who was assassinated in 2018.
PHOTO SARAH MONGEAU-BIRKETT, LA PRESSE ARCHIVE
Marco Mendicino, Canada’s Minister for Public Safety
“These technologies will be used in accordance with, among other things, the Charter of Rights and Freedoms and data protection laws,” stressed Minister Mendicino.
The Commissioner was not consulted
The House of Commons Standing Committee on Access to Information, Privacy and Ethics has been convened for a special business meeting after the RCMP admitted using spyware to secretly obtain data from phones or computers. However, the police did not consult the Office of the Data Protection Commissioner beforehand.
And Commissioner Philippe Dufresne believes that this must not happen again.
“Privacy is a fundamental right. This means that all institutions, including the RCMP, should consider privacy as a key consideration when developing and deciding to use technology that could negatively impact Canadian privacy,” he argued during his testimony.
“By anticipating the privacy implications and consulting with our office, organizations can prevent data breaches from occurring and improve the tools used to advance the public interest,” whether in crime prevention, protecting national security or public health Strengthen Canada’s competitiveness,” he said.
A surprise
Mr Dufresne did not hide his surprise when he learned through the media of the methods used by the RCMP to obtain information as part of the investigations he was conducting. He said the RCMP had until the end of August to explain to him the details of their practices for using this software. He pointed out that it would have been far better for the police to notify the Office of the Privacy Commissioner “upstream” so as not to alarm the Canadian public.
According to the commissioner, although the RCMP has obtained court approval before proceeding with the use of this software in its investigations, this does not take into account the criteria aimed at respecting people’s privacy, a fundamental right.
Created in 2016, the program is administered by the RCMP’s Secret Access and Intercept Team (EASI). This department is equipped with “on-device discovery tools”. Installed on “a specific computing device,” these tools “enable the gathering of electronic evidence from the […] secretly and remotely.
The RCMP confirmed the use of these methods in documents submitted to the House of Commons ahead of the June adjournment. However, she did not want to specify which software was used. At the beginning of this controversy, the RCMP claimed to have used these methods on a dozen occasions.
However, RCMP Commissioner Brenda Lucki said in a letter to MPs who are members of the parliamentary committee that spyware has been used in 32 investigations involving 49 devices since 2017.
This information shocked MPs, who accused the RCMP of a lack of transparency. “It’s a question of trust. […]. The RCMP refuses to say if it uses this type of spyware on Parliament Hill against MPs, political staff and public servants,” ranted Conservative MP James Bezan.