Toronto police revealed to the Star two weeks ago that they recently acquired at least one “Stingray,” a type of cellphone surveillance technology controversial for the secrecy surrounding its use and its broad privacy impacts. The force won’t say how much it paid, how many devices it owns, or when the technology was purchased. Toronto police also have not disclosed any policies related to the device, also known as an IMSI catcher, including what it plans to do with the data of thousands of innocent bystanders that will be swept up when it is used. Here’s everything we can tell you about IMSI catchers, and why you might care.

How does it work?

Broadly speaking, an IMSI (International Mobile Subscriber Identity) catcher mimics a cellphone tower, forcing all mobile devices within range to connect to it. In the time that the device is activated — usually under 15 minutes — it quickly captures unique identifying data from each of the cellphones within its range, and then releases those phones to reconnect to cellular networks. A “Stingray” is just one brand name; there are many makes and models. Police forces across Canada have declined to disclose which models they use, their operating range, or most other technical details, arguing that doing so would compromise investigative techniques.

How do police use the technology?

We don’t know all the circumstances in which police have used IMSI catchers. But through a few court cases that have come to light, we do know the devices have been used to identify unknown cellphones carried by criminal suspects — usually in major drugs, guns and gang cases, where targets often change their phones to frustrate investigators.

It works like this. After getting a warrant to use the device, police follow a suspect from location to location and activate the IMSI catcher at each site, capturing unique identifiers on any cellphones carried by the suspect but also from the cellphones of whoever else is in range. Then, police go through the data and gather the cellphone identifiers that appeared at all the locations. These identifiers should belong to the suspect. With another warrant, police can connect the cellphone identifiers to subscriber information, like a name and address. And with further judicial approval, police can then find out what numbers the suspect is dialing on that phone, or wiretap the phone and listen in on conversations.

Less often, an IMSI catcher is used to track a single known cellphone. This is usually, but not always, used in exigent circumstances, like kidnappings and missing persons cases. In those cases, a device is sometimes used without a warrant.

What types of data do these devices capture?

Toronto police have said that their devices do not capture private communications like calls, texts or emails. Instead, they capture several kinds of unique identifiers that allow cellular networks to recognize a particular cellphone. Some of those are:

An IMSI number, a 15-digit serial code associated with a SIM card.

An IMEI number (short for International Mobile Equipment Identity), a 15-digit serial code associated with the phone itself.

The phone’s manufacturer, model, and service provider (at least in the devices the RCMP owns).

I didn’t even know I had an IMSI number. Why should I care if the police capture mine?

You might not care. Police strongly emphasize that they need a court-issued warrant to associate subscriber information — your name, address, and actual telephone number — to an IMSI or IMEI number, and that evidence of criminal activity is required to obtain that warrant. You might think that police capturing random serial codes associated with your cellphone is a fair price to pay for helping investigators gather evidence that will put criminals in prison. The federal Privacy Commissioner has investigated the RCMP’s use of IMSI catchers, and found that its use was compliant with Canada’s privacy laws, except for in six instances when the RCMP didn’t get a warrant. (More on that later.)

Read more:

Thousands of bystanders caught in Toronto police sweep of cellphone data

Toronto police tight-lipped on details around acquisition of controversial surveillance tool

Opinion: Police should end needless secrecy about cellphone surveillance

Loading... Loading... Loading... Loading... Loading... Loading...

Privacy experts care about this technology for several reasons. For one, it is broadly intrusive: it hoovers up information on thousands of bystanders in addition to suspects. The Star analyzed RCMP IMSI catcher data logs from a two-month period in a 2014 investigation, and found that as officers targeted 11 suspects, they swept up cellphone data on at least 20,000 and as many as 25,000 bystanders. The device was used in busy urban areas, including Yorkville, Chinatown/Kensington Market, and the Dufferin Mall.

And while most people are not aware of their IMSI or IMEI number, this data is nonetheless highly identifying personal information. Because we all carry our cellphones around constantly, these unique identifiers are a proxy for you in a particular location at a particular time. Canada’s Privacy Commissioner wrote in a report that this so-called metadata “can sometimes be more revealing than content itself,” because it is objective rather than open to interpretation and can be captured on a massive scale.

The accumulation of surveillance data is another of the privacy experts’ concerns: without proper safeguards on how this data is stored and accessed, they say, police can create a massive database that reveals the location of hundreds of thousands of people through time, and who they were with. Again, police say they need a warrant to associate a name to any of this captured data. But research has shown that supposedly anonymous metadata, especially cellphone metadata, is easily linked to individuals.

Lastly, privacy experts are concerned by the lack of transparency and accountability surrounding this technology, and how secretive police have been about the devices.

Maybe I care if police have captured my cellphone data, maybe I don’t. What will police do with my information, and everyone else who isn’t the target of a criminal investigation?

Toronto police have said their third party data policies are still being developed and will be in place before the device is used. (The force has in the past asked RCMP to operate an IMSI catcher on its behalf; in 2018, two years after Toronto police denied it ever used the technology, the Star learned it had in five separate investigations.)

Comparatively, the RCMP has said that only targeted suspects’ data is passed on to investigators and everything else is firewalled off, stored securely, and eventually destroyed. But the RCMP has also said it does not provide IMSI catcher policies or guidance for other police forces. So in short, in Toronto, we don’t know.

Are there laws governing these devices?

Police need a judge’s authorization to use the device. For about a decade, the RCMP has said they used a general warrant. Then, for a few months in 2015, the RCMP did not use any warrant at all, based on legal advice. Later that year, the RCMP began using a new kind of warrant known as a Transmission Data Recorder warrant, which requires a lower threshold of evidence to obtain. Toronto police have not yet confirmed what type of warrant they use.

Under the Criminal Code, parliament must be provided with annual statistics on police use of wiretapping. This is meant as a measure of accountability: the report must include how many warrants for wiretaps were sought, how many were provided, how many were denied, and how many charges were laid as a result of this invasive mode of surveillance. The Criminal Code also requires that anyone who is the target of a wiretap be notified. No such reporting requirements exist for IMSI catchers, so we don’t know how often they are used or how useful they are in producing criminal charges. Under current laws, the thousands of people whose cellphone data is swept up when these devices are used will never know.

Who else owns or uses this technology?

Besides Toronto police and the RCMP, the Ontario Provincial Police, Calgary and Winnipeg have confirmed to the Star that they own an IMSI catcher. Spokespeople from Hamilton, Niagara, Vancouver, and the Sûreté du Québec told us that police have used this technology with the assistance of a law enforcement partner but do not own it. Police in Ottawa, Barrie, Windsor, York Region, Durham Region, Edmonton, Montreal and Halifax would not confirm whether they have used the technology, though some confirmed they do not own it.

The American Civil Liberties Union counted 75 federal, state or municipal agencies in the U.S. that own an IMSI catcher, although they say their research was hampered by lack of disclosure. American police forces have used the device to investigate routine, nonserious crimes. Officers in Annapolis, Maryland used an IMSI catcher to try to apprehend someone suspected of stealing $57 worth of chicken wings and subs.

What kinds of cases have they been used in here?

Project Battery/Rx, Toronto: In 2014, police arrested 112 people after a months-long investigation into rival gangs involved in drug trafficking, guns, and murder. Four suspects are now appealing their convictions in part because their lawyers say that police breached their duty to provide the judge with complete and accurate information about an IMSI catcher used in the case. The Crown says the problems with the warrant were immaterial, and that the IMSI catcher did not produce evidence against those four suspects.

Operation Hybrid, Calgary: Police arrested five people in 2016 at the conclusion of a gang-related case that relied on an IMSI catcher. At trial, the Crown objected to the disclosure of information about an IMSI catcher. A judge upheld that police did not have to reveal its make, model, software, or any other information related to how it collects cellphone identifiers.