Cellphone surveillance technology being used by local police across Canada

At least six police forces across Canada are now using cellphone surveillance technology, but several of them won't say whether they use the devices to eavesdrop on phone calls and text messages.

Calgary police, Ontario Provincial Police and Winnipeg police all confirmed to CBC News they own the devices known as IMSI catchers, cell site simulators or mobile device identifiers (MDIs) joining the RCMP, which has used the technology for its own investigations and to assist Toronto and Vancouver police.

While Ontario and Winnipeg police refused to say whether they use the technology to intercept private communications, Calgary police and the RCMP insist they only deploy their IMSI catchers to identify and occasionally, in the RCMP's case, track cellular devices.

• RCMPreveals use of secretivecellphonesurveillance technology for the first time

Police have described the surveillance devices as a "vital tool" used under warrant to help pinpoint suspects, and as a first step toward applying for wiretaps in serious criminal and national security investigations.

But Micheal Vonn, policy director of the B.C. Civil Liberties Associationand a legal expert on privacy, says she's concerned there isn't a warrant process specific toIMSI catchers that establishes strict limits on how the technology is used given its potential for mass surveillance.

"It's nothing but a policy choice for some law enforcement not to use the content interception capabilities," said Vonn,referring to features someIMSIcatchers have to eavesdrop on anycellphonewithin a radius of several blocks. It's hard to believe "the tantalizing availability of such technology is not going to be exploited," she said. "It will."

In an unprecedented briefing with reporters last week, the RCMP insisted that its IMSI catchers cannot currently intercept calls, text messages and other private communication.

After a decade of silence, the RCMP revealed it owns 10 IMSI catchers, which were used in 19 criminal investigations last year and another 24 in 2015 including emergency cases such as kidnappings or imminent threats to public safety.

Survey of police forces

CBC News has since contacted 30 provincial and municipal police forces across Canada to ask how many IMSI catchers they own, the number of operators trained to use them, and how many times the technology was used in 2015 and 2016.

Only Calgary police answered in full.

Ryan Jepson, the head of Calgary police's technical operations section, said his force has owned one IMSI catcher since 2015. It was used in six investigations that year, and eight more in 2016.

He says the device is only deployed by "a very small group of trained operators" within his unit, and is only used to identify suspects' devices not track their location or collect the content of their communications.

"It's the same as the RCMP. We don't intercept private communications," Jepson said.

Ontario Provincial Police and Winnipeg police each possess at least one IMSI catcher, but declined to discuss:

• Whether their technology is used to capture the contents of communications.
• How many technicians are trained to operate the technology.
• The number of investigations in which the device was used in 2015 and 2016.

Both forces said revealing more information could jeopardize ongoing investigations, court proceedings, and public and officer safety. But Jepson in Calgary disagrees.

"I have no issues with being transparent about it. It was never the intent to be secretive," he said. "It was about being able to protect certain techniques."

Others deny use

Several police forces told CBC News they neither own nor use IMSI catcher technology, including Charlottetown police; the forces in Thunder Bay, Sudbury, Halton, Hamilton, Kingston, and London, Ont.; and in Quebec City, Laval andGatineau, and the Quebec Provincial Police.

Police in Montreal, Regina, Halifax, Ottawa, Niagara and Windsor, Ont., declined to comment, citing policies not to discuss investigative techniques.

• Hamilton police say they don't own or use cellphone surveillance technology
• CBC INVESTIGATES|Someone is spying oncellphonesin the nation's capital

And police from York Region, Peel Region, and Waterloo in Ontario, as well as Victoria and the Royal Newfoundland Constabulary either didn't respond in time forpublication, or ignored CBC'srequests completely.

Durham Regional Police east of Toronto also ignored repeated requests from CBC to discuss IMSI catcher use, despite applying for a broad federal licence last summer that would allow the forceto purchase such a device.

RCMPhelps other forces

It's still not clear whether police in Toronto and Vancouver also own and operate their own IMSI catchers, but CBC News has learned that the RCMP has used the technology on behalf of both forces in the past.

Edmonton police said they don't own an IMSI catcher, but declined to say how many times they've used the technology during the past two years or whether another police force helped them to do so.

The technique has been used in multiple Toronto police investigations, but in Vancouver it may have only been deployed once in an emergency situation involving a missing person in 2007.

"The Device was used in an attempt to locate or verify the presence of a specific and known cellular phone," wrote Darrin Hurwitz, legal counsel for Vancouver police's access and privacy section, in a response last summer to a July 2015Freedom of Information request from PIVOT Legal Society. "VPD does not own and has never owned this Device."

Vancouver police didn'trespond to multiple requests for comment, including about whether the forcereceived additional RCMP assistance or obtained its own device since answering PIVOT's request.

Toronto police spokesperson Mark Pugash wrote in an email that they "do not discuss investigative techniques."

Calls for rules

Watchdog groups have called for specialized warrants and better public reporting of how the devices are being used.

"We want the police to have the appropriate tools," said Vonn of the B.C. Civil Liberties Association. "That they don't have the appropriate oversight and that those tools have the potential for abuse [] the public cares very much about that."

• RCMP, CSIS launch investigations into phone spying on Parliament Hill

The Office of the Privacy Commissioner of Canada isinvestigating the RCMP's use of IMSI catchers, following a complaint filed last year.

"What I can tell you is that we are looking at what type of information the IMSI devices and associated software used by the RCMP are capable of capturing," spokesperson Tobi Cohen wrote in an email. "For instance, can and do they only capture the unique identifiers associated with a mobile device or are they also capable of capturing private voice, text and email communications."

Her office called the lack of transparency "a concern," and supports regular public reporting on the use and effectiveness of new technological powers something the RCMP has said it could support.