A former senior intelligence officer with the Canadian Security Intelligence Service says it has surveilled politicians at the federal, provincial and municipal levels because of concerns they’re being paid by foreign governments.
Michel Juneau-Katsuya told a House of Commons committee in French that foreign agencies try to recruit elected officials, who may not even be aware they’re being targeted.
That revelation raised eyebrows among committee members, who are studying the RCMP’s use of spyware after the force disclosed in June that it has been using the technology in some investigations for years.
Juneau-Katsuya also said Canadian government agencies are likely using spyware to hack into people’s cellphones without them knowing.
Conservative MP Ryan Williams asked if he knows of groups such as CSIS, the Canada Border Services Agency and the Communications Security Establishment using spyware.
“Other agencies are using it, probably, yes,” Juneau-Katsuya said.
Juneau-Katsuya is among several experts who told the ethics committee Tuesday that government needs to review and update the part of the Criminal Code related to electronic surveillance to bring it in line with evolving technology.
Privacy experts say police and government use of “extremely intrusive” spyware needs to be tightly controlled, and the technology should be outlawed for the general Canadian public.
The director of the University of Toronto’s Citizen Lab said spyware is “like a wiretap on steroids,” and requires more oversight and a much higher threshold for use.
“(Cellphones) are designed by their manufacturers to be as invasive as possible. They are designed — as well as the apps contained in them — to track every aspect of our lives, so this is a gold mine of information,” Ron Deibert said.
On Monday, senior RCMP officers told the committee that while the technology is new, the invasion of privacy on a digital device is similar to what police have done for years through wiretapping and installing surveillance cameras.
But experts speaking to the committee Tuesday said that’s not the case and highlighted concerns with the industry as a whole, which has facilitated human rights abuses and state targeting of politicians, journalists and activists.
Deibert made seven recommendations to the committee, including that the government hold public hearings about spyware, consult the public to create a legal framework around it, establish export controls on Canadian companies and penalize firms that facilitate human rights abuses.
He also said spyware firms are targeting local and provincial police forces as potential clients, and warned that oversight is not as stringent at those levels.
“We are really asleep at the wheel on the threats raised by the global mercenary spyware industry.”
Brenda McPhail, the privacy, surveillance and technology project director for the Canadian Civil Liberties Association, said police use of spyware encourages law enforcement to exploit software issues rather than reporting or fixing them.
She called for a moratorium on use of surveillance technology until a public discussion is done.
Former privacy commissioner Daniel Therrien told the committee earlier Tuesday that he did not know the RCMP has been using what it calls “on-device investigative tools” for more than a decade.
“It was surprising that in the context of many, many debates in the public about the challenges of encryption (in policing), that when I was privacy commissioner I was not told that a tool was used to overcome encryption,” he said.
During his tenure between 2014 and 2022, Therrien called for Parliament to strengthen Canada’s privacy laws. In particular, he said privacy needs to be recognized as a fundamental human right under the law.
Sharon Polsky, president of the Privacy and Access Council of Canada, called for spyware to be made unlawful except for in specific cases, when approved by an independent third party.
“They’re available commercially to anyone who has an internet connection and wants to download them,” she said, noting that spyware has been used by human traffickers and in intimate partner abuse.
“Nobody’s talking about how the spyware is able to take advantage of the shortcomings, the deficiencies in so many software programs … Require that software be tested properly to minimize the opportunity.”
Therrien agreed the technology can be lawfully used by police if there is an extremely compelling public interest, as in the case of serious crimes.
“Such level of intrusiveness can still be lawful and consistent with privacy principles if the collection of information is authorized by law, and it is necessary and proportional to the achievement of compelling government objectives,” Therrien said.
But he also said he cannot see any compelling reason why someone in the private sector should be able to use it.
New federal privacy commissioner Philippe Dufresne told the committee Monday that the Mounties didn’t notify his office before starting to use spyware, and he learned about it through the media.
He’s called on MPs to make changes to privacy legislation that would require government departments and organizations to launch privacy impact assessments when new technology is introduced that could have an impact on the fundamental right to privacy.
Sarah Ritchie, The Canadian Press
