Privacy experts say police and government use of “extremely intrusive” spyware needs to be tightly controlled, and the technology should be outlawed for the general Canadian public.
Former privacy commissioner Daniel Therrien told the committee he was not aware the RCMP has been using what it calls “on-device investigative tools” for more than a decade.
“It was surprising that in the context of many, many debates in the public about the challenges of encryption (in policing), that when I was privacy commissioner I was not told that a tool was used to overcome encryption,” he said.
During his tenure between 2014 and 2022, Therrien called for Parliament to strengthen Canada’s privacy laws. In particular, he said privacy needs to be recognized as a fundamental human right under the law.
Therrien appeared before the House of Commons ethics committee Tuesday as part of its probe into the RCMP’s use of spyware in 32 investigations over the last five years.
On Monday, senior RCMP officers told the committee that while the technology is new, the invasion of privacy on a digital device is similar to what police have done for years through wiretapping and installing surveillance cameras.
But experts, including Therrien, say that’s not the case.
“The state, the police, has access to everything on that phone,” he said.
Sharon Polsky, president of the Privacy and Access Council of Canada, said spyware needs to be made unlawful except for in specific cases, when approved by an independent third party.
“They’re available commercially to anyone who has an internet connection and wants to download them,” she said, noting that spyware has been used by human traffickers and in intimate partner abuse.
“Nobody’s talking about how the spyware is able to take advantage of the shortcomings, the deficiencies in so many software programs … Require that software be tested properly to minimize the opportunity.”
Therrien agreed the technology can be lawfully used by police if there is an extremely compelling public interest, as in the case of serious crimes.
“Such level of intrusiveness can still be lawful and consistent with privacy principles if the collection of information is authorized by law, and it is necessary and proportional to the achievement of compelling government objectives,” Therrien said.
But he also said he cannot see any compelling reason why someone in the private sector should be able to use it.
The director of the University of Toronto’s Citizen Lab said spyware is “like a wiretap on steroids,” and requires more oversight and a much higher threshold for use than traditional wiretaps.
Ron Deibert will speak to the committee later Tuesday.
In prepared remarks provided to The Canadian Press, Deibert said what he calls the “mercenary spyware industry” is poorly regulated and associated with widespread abuses.
He said the industry is a threat to civil society, human rights and democracy and governments should be transparent about procurement of this technology.
Federal privacy commissioner Philippe Dufresne told the committee the Mounties didn’t notify his office before starting to use the technology, and he learned about it through the media.
He’s called on MPs to make changes to privacy legislation that would require government departments and organizations to launch privacy impact assessments when new technology is introduced that could have an impact on the “fundamental right to privacy.”
