This undated handout photo provided by the U.S. Patent and Trademark Office shows the StingRay II, manufactured by Harris Corporation, of Melbourne, Fla., a cellular site simulator used for surveillance purposes.The Associated Press
On Feb. 21, 2014, Detective Shingo Tanabe swore an affidavit in hopes of getting a warrant. Feuding gangs had been shooting in the streets, so he told a judge some powerful surveillance was in order.
He suggested the Asian Assassinz gang could be dismantled only if Toronto Police could get a read on its shifting array of mobile phones. Police teams shadowing suspects needed a machine that mimicked a cellphone tower, he argued, capable of capturing data from all phones in a given radius.
The document acknowledged some risks. Such as possible inadvertent interference with bystanders' data or 911 calls. Or, even that police could run afoul of Canada's radio laws. Yet, "investigators require a means to covertly identify the numbers of these mobile devices without alerting the subjects of the investigation," Det. Tanabe wrote.
The sworn statement, obtained by The Globe from court documents, reveal the first documented use of police "stingray" technology in Toronto, the country's most densely populated metropolis. Across North America, this mobile-phone-targeting device – also known as an "IMSI catcher" – is being revealed as controversial and indiscriminate, but judges have endorsed the police legal logic in this case and others.
Like other law-enforcement agencies in North America, Toronto Police have never publicly confirmed using an IMSI catcher. The force last year fended off a freedom of information request from a journalist by arguing before a tribunal that any such disclosure "would quickly lessen its effectiveness" or even "jeopardize the safety of law enforcement officials operating such devices."
How the RCMP's secret surveillance tools work
RCMP documents disclosed in a recent trial acknowledge that portable surveillance devices, used to target crime suspects, directly impact "innocent third parties" within range — including people dialling 911.
The devices, known as IMSI catchers, mimic cellphone towers and are capable of extracting key identifiers such as the International Mobile Subscriber Identity (IMSI) from nearby GSM phones.
MURAT YÜKSELIR/THE GLOBE AND MAIL
1 A police team turns on its device causing radio waves to emit from an unmarked police vehicle. The machine beckons to phones suggesting it is the strongest cellphone tower in the area.
2 It’s a “hit” – the targeted person’s phone automatically redirects its signal to the police device.
3 The suspect’s phone has unique digital identifiers that are pulled into a database – as are those of phones belonging to innocent third parties. Police can later try to bug the target phone.
4 The police devices can have the side effect of temporarily blocking all new calls – and while 911 calls are supposed to override the interference, up to half the time this does not happen.
Recent articles in The Globe and Mail have highlighted the use of this technology in Canada, where it is apparently controlled by federal police experts and lent to municipal police forces.
In countries such as Germany, officials are required to disclose publicly how often they resort to IMSI catchers. In Canada, people who are not police are usually kept in the dark. Federal officials who regulate privacy and the radio waves, and the politicians who pass surveillance laws, know little about the devices.
Despite the secrecy, information about police tactics seeps out in criminal courts. The filings in the gang case come from a Toronto Police investigation dubbed "Project Battery."
Two years ago, the force announced that hundreds of officers had arrested dozens of people in the case, seizing more than 30 guns, $350,000, and several kilograms of drugs. Police said the raids had targeted the Asian Assassinz and a rival gang, whose score-settling allegedly led to several homicides.
Today, the charges are heading to trial and evidence is being disclosed to the defendants. The affidavit sworn by Det. Tanabe arrived to defence counsel partly blacked out.
In a February motion, criminal lawyer Craig Bottomley argued that the Crown will need to provide a lot more material about IMSI catchers – including the police operations manual – if he and his colleagues are to defend their clients. "Without disclosure of this material, it is impossible to know if the state complied with judicially imposed restrictions," he wrote. Prosecutors replied: "The Crown will not be disclosing the operation manuals. ..."
Bids for disclosure can scuttle entire cases regardless of what the incriminating evidence is. A Montreal first-degree-murder prosecution involving gang members was recently derailed when a judge ordered the Crown to say more about IMSI catchers and related technologies than police wanted to reveal.
Excerpts of Det. Tanabe's sworn "information to obtain" search-warrant statement suggest Toronto Police used several surveillance techniques against the Asian Assassinz. But the most revelatory details concern a "mobile device identifier" – MDI – which is what the Mounties call an IMSI catcher.
The RCMP appears to have pioneered police use of such devices in Canada, and it is not clear how much latitude municipal forces have to use them. The Toronto Police affidavit materials suggest a Mountie expert was brought in to operate the machine in Toronto.
Det. Tanabe sought judicial permission to use the device under a general warrant, saying in the application he was aware of no other legal power in Canada to govern the situation. He also said he did not know of any "reasonable expectation of privacy" that would attach itself to identifying data broadcast by mobile phones – a legal distinction that allows police to capture the data of many phones before winnowing it down to those controlled by suspects.
Det. Tanabe said in his sworn statement that suspects "will communicate on mobile devices that are not known to the investigators," explaining that drug dealers often "change their devices to avoid police detection."
MDIs solve such problems by revealing unique identifiers for specific phones. It is unclear what police do with bystander data that are intercepted. But Det. Tanabe said in the affidavit this technology would be used to identify only suspects' phones to set up subsequent eavesdropping campaigns.
The MDIs themselves "will not receive voice communications and will not receive text messages or e-mails," Det. Tanabe said.
Explaining he knew police in Canada must be wary of violating the Radio-Communications Act – which protects the public air waves – Det. Tanabe said the workaround was to run the machines at restricted ranges and in short bursts.
"The Operator will not activate the MDI for more than 3 minutes at a time," Det. Tanabe said in his sworn affidavit. He added the machine was also programmed to shut itself down if anyone nearby tried to call 911.
The range and model of the device were withheld from the materials obtained in court.
All of the information in the document suggests municipal forces like Toronto Police follow rules the RCMP laid out in a recently disclosed 2011 memo for this mass-capture surveillance technology. This includes limiting the range of the search, shutting off if someone in the area calls 911, and using it for only three minutes at a time.
Spokespersons for the Toronto Police Service did not reply to questions about surveillance techniques in Project Battery.
Brendan Crawley, a spokesman for provincial prosecutors, said in an e-mail that "it would be inappropriate for the Ministry of the Attorney-General to speculate on matters that may relate to any legal and evidentiary issues surrounding the use of police investigative techniques, including MDIs or other similar technologies."
Colin Freeze