RCMP says it's not using controversial Pegasus spyware to covertly access cellphones

OTTAWA — The RCMP says it is not using the controversial Pegasus spyware to circumvent encryption and monitor cellphone activity, but it has been using similar surveillance technology for 10 years.


Privacy commissioner learned of RCMP spyware use from media, calls for stronger laws

The Mounties' use of what they call on-device investigation tools is the subject of an investigation by the House of Commons ethics and privacy committee this week.

These tools enable police to access a phone or computer without a person knowing, allowing them to do everything from intercepting messages and phone calls to turning on the camera and microphone.

"These are used in extremely rare and limited cases," said Bryan Larkin, the RCMP's deputy commissioner of specialized policing services.

Pegasus is one such technology, which was created by an Israeli cybersurveillance company called NSO Group.

It has been under scrutiny after an investigation by the Organized Crime and Corruption Reporting Project in 2021 found Pegasus has been used to target journalists and human-rights activists.

Larkin said the force has never used any technology from NSO Group, but said for national security reasons he could not tell the committee any details about the technology it is using.

Earlier Monday Philippe Dufresne, the federal privacy commissioner, told the committee his office learned about the RCMP's use of spyware through the media, and he wants Parliament to strengthen and modernize privacy laws.

Dufresne said the country's laws should be changed to include "privacy by design" and create a section in the Privacy Act that requires organizations and departments to do a privacy impact assessment when new technology is introduced that could affect the public.

"These tools may well be needed, but do they have an impact from a privacy perspective that is greater than the intended purpose?" Dufresne said.

In response to a written question tabled in the House of Commons in June, the RCMP disclosed it had obtained warrants to use these tools in 10 investigations. That prompted the committee to launch its summer investigation.

The force has actually used spyware in 32 investigations since 2017, accessing 49 devices. RCMP witnesses at the committee did not explain the discrepancy in the numbers.

Sgt. Dave Cobey of the RCMP's technical investigation services said anecdotally, about one in 10 investigators who ask to use spyware actually get internal approval to seek a warrant to do so.

"We really encourage them to consider less invasive tools."

Related video: Public Safety Minister takes questions on use of Pegasus spyware by RCMP Duration 1:44  View on Watch

The requests that have been approved involved investigations into serious crimes such as terrorism, murder, drug trafficking, and breach of trust.

"These tools are never used to conduct mass surveillance," Cobey said.

The privacy commissioner's office was not notified when the RCMP began using the technology, or when it launched a privacy impact assessment of on-device tools in 2021. Dufresne said he has asked for details and will have a briefing from the RCMP on Aug. 23.

Several MPs on the committee say they are concerned that assessment began after years of use, and without the privacy watchdog's knowledge.

Mark Flynn, the RCMP's assistant commissioner of federal policing, national security and protective policing, said he thinks the committee is focusing too much on the tool, rather than the impact.

"We've installed for years … listening devices, hardware devices, cameras hidden discreetly in a particular location where criminal behaviour is occurring," he said.

"This is a new method of invading privacy, but invading privacy at the same levels that it had been previously."

But the privacy commissioner said a lack of public scrutiny erodes trust.

"What's important is that the tools be looked at in terms of their impact, in terms of their purpose and in terms of the public interest that's at play," Dufresne said.

"The important thing is that this exercise take place … it will strengthen trust because it will reassure Canadians."

Public Safety Minister Marco Mendicino, meanwhile, did not deny that other government agencies may be using similar technology. Conservative committee members repeatedly asked him whether organizations such as CSIS, CSE or the CBSA have used spyware, but he chose not to answer directly.

"When this techniques is used, it is done in a manner that is compliant with the law and the Charter," he said, referring the committee to ask those agencies directly.

Liberal MP Iqra Khalid questioned the commissioner about whether more public disclosure could allow criminal organizations to "get ahead" of the technology police are using.

Privacy and technology lawyer David Fraser said in an interview Sunday that this concern has been raised in the past, and he has "some sympathy" for that argument.

"But I think that the police and the prosecution service are not qualified to make that critical societal judgment call, because it's law enforcement interest against public interest," he said.

"And very often law enforcement imagine that law enforcement equals public interest."

Dufresne said privacy assessments can take into account the need for confidentiality in investigations.

"Privacy is not an obstacle to public interest."

This report by The Canadian Press was first published Aug. 8, 2022.

Sarah Ritchie, The Canadian Press