Parliamentary Committee Notes: Findings of OPC and Other Entities on On-device Investigative Tools
Question Period Note
Date: August 3, 2022
Classification: Unclassified
Fully releasable (ATIP)? Yes
Branch / Agency: RCMP
Issue:
The Standing Committee on Access to Information, Privacy and Ethics (ETHI) has undertaken a study to determine and identify which "device investigation tools" are being used by the RCMP, which have technological capabilities similar to Pegasus and provide the committee with the name(s) of such software and the terms and conditions of its use. ETHI is interested to know the position of other review bodies.
Proposed Response:
- As part of NSIRA’s review of the RCMP handling of encryption, the RCMP presented a technical brief on On-Device Investigation Tools (ODITs) to the Committee and submitted documentation in support of their review.
- The National Security and Intelligence Committee of Parliamentarians (NSICOP) is also conducting a review of the lawful interception of communications by security and intelligence organizations. The RCMP believe that a presentation on ODITs will be required and are ready to provide one.
- The RCMP has also proactively reached out to the Privacy Commissioner regarding the use of ODITs and is scheduled to provide a similar technical brief to them on August 23rd.
- While these entities have not yet issued any findings, we look forward to receiving any recommendations for consideration that could further strengthen our legislative and policy framework regarding ODITs.
Background:
On September 24, 2021, the National Security and Intelligence Review Agency (NSIRA) notified the Royal Canadian Mounted Police (RCMP) its planned review of the handling of encryption in the RCMP’s interception of private communications in national security investigations. Specifically, the review would focus on how the RCMP handles encryption in intercepted voice or text-based communications. Handling encryption includes but is not limited to bypassing or decrypting encrypted communications. The review would not examine how the RCMP handles the encryption of data-at-rest on seized devices.
In the course of its reviews, NSIRA may make any finding or recommendation that it considers appropriate, including findings and recommendations relating to a department’s compliance with the law and any applicable Ministerial directions, and relating to the reasonableness and necessity of a department’s exercise of its powers.
After the RCMP fulfilled a number of NSIRA’s documentation requests over subsequent months, on July 13, 2022, NSIRA advised the RCMP that it was suspending its review until further notice.
On July 4th, 2022, the National Security and Intelligence Committee of Parliamentarians (NSICOP) notified the Minister of Public Safety of its decision to conduct a Framework review of the lawful interception of communications by security and intelligence organizations. This review will include, the RCMP, as well as, the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment (CSE), Public Safety Canada (PS), and the Department of Justice. The Committee expects to finish this review in 2023.
According to the draft terms of reference, the NSICOP will examine the legislative, regulatory, policy and financial framework for the lawful interception of communications by security and intelligence organizations, the challenges of new and emerging technologies, including the use of end-to-end encryption, and any limitations of the current framework. The objectives of the review include examining the current state of lawful access, concerns raised by civil society and privacy experts, and technological challenges and gaps in this space.
On the basis of its review, the Committee may make findings and recommendations relating to the legislative, regulatory, policy, administrative or financial aspects of lawful intercept activities and frameworks.
There are strong similarities between NSIRA and NSICOP’s respective reviews; however, it is understood that the review bodies are coordinating efforts and that NSIRA’s review has been placed on hold and suspended indefinitely until the NSICOP completes their review.
To date, no recommendations have been received by the RCMP from any of these entities in relation to ODITs.
- Date modified: