Canadian court gives limited OK to warrantless Stingrays

It's fine to spy on a suspect's mobile devices, just don't listen

Canada's domestic spy agency has won permission to continue using IMSI-catchers, in some cases without warrants, following a decision by the country's federal court.

The legality of these so-called Stingray devices was challenged in a case questioning the conduct of a still-secret terrorist investigation, details of which have been redacted from last month's judgment, in which the Canadian Security Intelligence Service (CSIS) used "Cell Site Simulators" (CSS).

Such devices are miniaturised base stations that accept connections from nearby phones, gathering intelligence about the handsets and their whereabouts, before passing their activity through to a legitimate base station. They are called IMSI-catchers because they record, among other things, the IMSI – a unique ID number – of each passing gadget's cellular subscriber.

In the Canadian case, the court said, CSIS wanted to capture "the identifying characteristics" of a suspect's phone, and was challenged because it did so without a warrant.

The decision, handed down by Chief Justice Paul Crampton, has given agents limited permission to do so, if they're using the IMSI-catcher only to link a phone to a suspect.

The judgment said the CSIS should take measures that ensure the device "does not capture the contents of any other communications or any of the content stored on, or available through, anyone's mobile device(s)."

Additionally, the ruling said the snoops have to minimise their intrusion on the privacy of people not being considered during an investigation, by ensuring that "incidentally captured information pertaining to the mobile devices of third parties is quickly destroyed and is not subject to any analysis whatever."

Location is also somewhat protected, with both the court and CSIS agreeing that seeking geospatial data triggers the need for a warrant: "The second use that CSIS makes of CSS technology is to 'geo-locate' a subject of investigation’s cellular device. SIRC [Canada's Security Intelligence Review Committee] observed, and CSIS has since conceded, that this use of CSS technology must be sanctioned by a warrant issued by this Court."

The court found that using IMSI-catchers does constitute a "search", as defined by Section 8 of Canada's Charter of Rights and Freedoms, because the information allowed the CSIS to build a profile of the target by determining his contacts and communication patterns. However, so long as the search was "narrowly targeted, highly accurate and minimally intrusive", it passed the test of reasonableness.

The court also noted that the IMSI-catcher wasn't used to capture the subject's identity, because they were already known to the CSIS. "Where CSIS requires detailed billing or subscriber information from a TSP, it will require a warrant," the judgment read.

CSIS's use of Stingrays emerged in February 2016, when the CSIS gave the federal court a classified SIRC document. Early this year, the Mounties owned up that they also operated the devices.

The full judgment is in this PDF. ?


Biting the hand that feeds IT ? 1998–2017