Federal watchdogs say the RCMP could jeopardize Canadian privacy by hiring a third-party technology company capable of pumping Internet information that is deeply ingrained in the public.
In a report released Thursday to Congress, Privacy Commissioner Philippe Dufresne questioned whether the force was relying on vendors whose services could escape the privacy laws that limit law enforcement searches.
Dufresne reviewed the RCMP’s Wide Awake project, a data exploration effort that the force began after the killing of three Mounties in 2014. An RCMP internal inspection of the mass shooting found that the police force could not cope with the large amount of social media posted by the public about the killer’s movements.
The RCMP now employs software vendors and corporate contractors to assist in crime investigations, as well as agencies that help officers break into many other hidden corners of the Internet.
But the sophistication of some vendors raises the question of whether the police are accessing “open source” material – content that sits in a normal setting – or using outside expertise to obtain hard-to-reach sources. No.
The existence of the Wide Awake project was reported by Tyee Online Magazine in 2019. The following year, NDP Ontario Congressman Charlie Angus formally filed a complaint against the initiative with the Privacy Commissioner.
On Thursday, Dufresne said the elements of Angus’ lawsuit were well-established.
The commissioner wrote in a report that his office “recommended that the RCMP conduct a comprehensive assessment to obtain a reasonable level of assurance that its third-party services comply with applicable privacy laws.”
“It also recommends that the RCMP be more transparent with Canadians about the collection of their personal information from the open source intelligence gathering and the purpose for which different types of information may be used.”
However, he wrote, “The RCMP does not agree to implement the recommendation.”
Dufresne said in his report that the search capabilities of some third-party companies get Internet gatekeepers, such as websites that require credentials. Others investigate sites hidden from the public Internet and that require specialized tools to access. Some such services even include a repository of “mobile geolocation data (which can display sensitive information about movement patterns),” Dufresne wrote.
The Privacy Commissioner does not deny that the Mounties have exploited such capabilities. But he questioned why contracts are being signed with companies that advertise such goods and whether the RCMP is doing enough privacy checks.
Dufresne, for example, highlighted the fact that police had purchased services from Babel Street. He said the US-based company BabelX program was very aggressive, he suggested that the Mounties stop using some capabilities.
“The RCMP does not agree to implement this recommendation,” Dufresne wrote.
The RCMP, which did not immediately respond to a request for comment, has already posted a review online, saying its use of BabelX does not pose a threat to privacy.
“Contrary to the media and other reports of public concern, Babel X is not used by the RCMP to spy on or track network users,” the assessment said.
“The platform does not have access to decrypt or unlock private data sources and is not used to retrieve other user activities and information from private social media accounts.”
The assessment goes on to say that any impact on an individual’s privacy will be controlled by the RCMP.
Babel Street did not immediately respond to a request for comment by email. In a press release this month, the company announced that it had hired a former top data scientist from the US Central Intelligence Agency.
In addition, the Privacy Commissioner has been critical of the RCMP, known as the National Technology Management Program (NTOP), which was created a few years ago for veterinary technology and software vendors for privacy reasons. Dufresne accused NTOP of ignoring the obvious red flag in its review of RCMP’s contract with Babel Street.
In his report, Dufresne also accused the RCMP of failing to fully implement the privacy fixes promised last year.
In 2021, the Office of the Privacy Commissioner blamed the RCMP for being among dozens of police officers who misused a form of identification software known as ClearviewAI. Observers considered RCMP to use the software illegally.
The new NTOP unit was soon formed by the RCMP with a mandate to review a variety of technologies used by the police, including drones, databases, algorithms, body cameras and cell phone interception and interception. .