RCMP can spy on your cellphone, court records reveal

The RCMP cansecretly target and intercept Canadians' mobile phones, and they've used these covert surveillance techniques in a variety of major crime investigations across the country, court documents show.

A judge today lifted a publication ban on details surrounding the shooting death of Salvatore (Sal the Ironworker) Montagna, a high-ranking member of a New York crime family killed outside Montreal in 2011.

Court records in the Montreal-area case show that Mounties used wireless signal catchers to target suspects' BlackBerrys. They used that information to intercept and unscramble BlackBerry PIN-to-PIN messages as part of a huge organized crime investigation that this spring resulted in the conviction of alleged mobsters in a murder conspiracy.

The media can now report that the RCMP has a "Covert Intercept Unit" that has been relying on "mobile device interceptors" to identify smartphones, the court records state.

Many Canadian civil rights advocacy groups have expressed concerns about such devices, known as "Stingrays" or IMSI catchers, and have tried to find out whether Canadian police forces are using them.

The devices, which mimic cellphone towers, trick nearby phones into connecting. Once connected, the Stingray operator can collect information transmitted by the phone which, depending on the model, can include location, data transmissions, texts, emails and voice conversations.

However, in the Montreal case, police say the devices were only used to single out suspects' phones, and not in an attempt to locate or eavesdrop.

Stingrays are widely used by U.S. authorities, but Canadian police forces have, until now, refused to say whether they're used here.

• Stingray surveillance device questions prompt federal privacy complaint

The newly disclosed court records show that the RCMP also developed customized software and obtained court authorizations to target the suspects' phones.

Lawyer Christian LeBlanc represented CBC and other media organizations at today's hearing to argue for the publication ban to be lifted.

"I think it's of public interest to know the kind of techniques police forces are using to get that information," he said.

Earlier this year, the Crown launched an appeal to prevent the defence and the public from learning more.

"Disclosure would tend to identify which devices are used by the RCMP and would allow ill-intended cellphone users to circumvent the police techniques," the Crown argued in papers filed in January at Quebec's Court of Appeal.

But the fight which promised to be very public was dropped suddenly in late March when six of the men accused in the killing struck a deal to plead guilty to conspiracy to murder. A seventh man pleaded guilty to a lesser charge of being an accessory after the fact.

Unanswered questions

However, many questions remain unanswered such as the make of the device that was used to capture the men's cell signals, how and where police intercepted their messages and whether BlackBerry played a role in helping to decrypt the communications.

Veteran defence lawyer Alan Gold told CBC News: "Everyone knows that they [RCMP] use these fake cell towers."

He's not involved in the Montreal-area case but has been watching closely, interested in the technology police rely on in their investigations.

"It's hard to think of a clearer invasion of privacy," Gold said. "It's like the police reaching into your pocket and examining your wallet, [except instead] they've reached into your cellphone by tricking it into communicating with the police equipment instead of a real cell tower."

The RCMP testified during the case that they are using the technology in various ongoing investigations across Canada, including probes of murders, organized crime and drugs.

OpenMedia is a Vancouver-based group that filed a federal privacy complaint in Marchdemanding that the RCMP disclose whether it uses Stingrays.

The new revelation raises a number of questions and concerns, said Laura Tribe, the group's digital rights specialist.

"Our biggest concern with Stingrays is there's really no regulation or oversight as to how they're being used," she told CBC News. "We right now, as the Canadian public, have no idea where they're being used, when, what the requirements are for these technologies being used and what's happening to the data of everyone being caught up in their sweep."

"The privacy concerns are huge," she added, given that the technology can't target individuals and captures information about all cellphone users in a given area.

The court documents in the Montagna case suggest the RCMP used them to intercept the communications of everyone within a two-kilometre radius, she noted.

"If you put a two-kilometre radius in the middle of downtown Toronto, that's an incredible number of people they can capture when you're going both out and up through all of the towers."

Police 'decrypt'BlackBerry

The lifting of the publication ban in the Montagna case now allows the media to report on a second police technique the RCMP's ability to decrypt scrambled BlackBerry PIN-to-PIN messages.

The company has long marketed the security and privacy of its messaging services.

During the court proceedings, Alan Treddenick, BlackBerry's national security and law enforcement liaison, provided an affidavit seeking to ensure the encryption key itself was never released to the public.

"Disclosure of the global encryption key which is used to scramble BlackBerry's consumer-level BBM and PIN-to-PIN messaging service could negatively impact BlackBerry's commercial reputation and adversely affect global business, resulting in significant economic damage," Treddenick said.

"The 'Global Key' is the same for all devices," according to a 2014 report written by Staff Sgt. Mark Flynn on the RCMP's intercept system in the Project Clemenza organized crime investigation. "[The company] programs this key into all BlackBerry devices."

The key itself was not disclosed, but it appears the RCMP has access to it.

Sgt. Patrick Boismenu provided an expert report to the court in November 2015 outlining how the RCMP scooped up the scrambled messages and then put them through police computers to decipher them.

"The RCMP server performs the decryption of the message using the appropriate decryption key," he said.

Both BlackBerry and the RCMP have refused to comment on how the RCMP obtained access to the key, or on whether BlackBerry assisted.

CBC News this week revealed the Waterloo, Ont., smartphone maker has for years assisted police around the world in hundreds of investigation, helping to both intercept and descramble BBM and PIN messages.

The company says it co-operates with law enforcement if police obtain a judge's order or authorization.

• BlackBerry hands over user data to help police 'kick ass,' insider says