I call this meeting to order.
With that, we'll ask the photographers with cameras to leave the room.
Welcome, everyone, to meeting number 31 of the Standing Committee on Access to Information, Privacy and Ethics. Pursuant to Standing Order 108(3) and the motion adopted by the committee on Tuesday, July 26, 2022, the committee is meeting to study device investigation tools used by the Royal Canadian Mounted Police.
Today's meeting is taking place in a hybrid format pursuant to the House order of Thursday, June 23, 2022.
For the first hour of this meeting, we are pleased to have the Honourable Marco Mendicino, privy councillor, member of Parliament and Minister of Public Safety.
With that, I will invite the minister, if he is ready, to proceed with opening remarks.
Minister, do you have your proper headset with you?
Thank you very much, Mr. Chair and colleagues.
I want to begin by thanking all the members of the committee for the study on the intersection of technology and policing, including the recent reports on facial recognition technology. I welcome the opportunity to talk about the adoption of new tools and technologies, especially as they concern transparency, privacy and legal and ethical standards.
Technology and policing have always been closely interconnected, but today's tech is advancing exponentially.
This progression extends from the evolution of mobile and wireless, to supercomputing, advanced analytics, biometrics, surveillance, forensics and beyond.
It's imperative that law enforcement bodies keep up with the pace of change. It's crucial that we do so to pursue those who would exploit new technologies for malicious intent.
This is necessary not only to increase efficiency, but also to closely examine how law enforcement selects and implements these technologies, to ensure the privacy, rights and freedoms of Canadians. In so doing, we must get that balance right.
For my part today, colleagues, I am pleased to provide a brief overview of the tools used by the RCMP.
The RCMP uses investigative technology and cutting-edge scientific tools in the areas of forensic science, fingerprinting, biometric and DNA data and surveillance, among other areas. Forensic science and identification services, for example, are integral parts of national police services, often relying on advanced science and technology.
Through these services, groundbreaking technology helps to identify biological evidence collected from crime scenes, examines firearms, seized materials and suspect counterfeit currency or I.D., and screens for a broad range of drugs and poisons and helps to provide expert scientific testimony in courts.
With respect to investigative technology specifically, the latest technology available to the RCMP helps to link crimes together, secures records and documents at crime scenes, identifies suspects and victims writ large and helps to keep Canadians and our communities safe.
The RCMP's CAIT program, or covert access and intercept team, uses approved technology to collect data that cannot be collected using traditional wiretapping technology or other less intrusive investigative techniques. This is only used under judicial authorization for the most serious offences.
Further, their Special “I” program is primarily responsible for the lawful electronic surveillance mandate of the RCMP. This has been the unit responsible for all interception of private communications that can be obtained pursuant to authority under part VI of the Criminal Code. It involves technical installations and deployments of electronic surveillance equipment in support of policing investigations. It also involves monitoring and analysis of data and communications that have been lawfully intercepted.
But colleagues, through all these examples, I'll be clear that transparency and accountability, privacy, and respecting fundamental rights and the law are paramount. The Privacy Commissioner has echoed that sentiment. And the government is committed to making sure that is foundational to all activities, including training and operational processes.
In particular, one of the key outcomes of the commissioner's investigation and report on the use of facial recognition was the need for a centralized process for the adoption of new tools and technologies.
In March of last year, the RCMP created the national technologies onboarding program, or NTOP.
The purpose of the national technologies onboarding program, or NTOP, is to centralize, standardize and bring greater transparency to the processes that govern how the RCMP identifies, evaluates, tracks and approves the use of new technologies and investigative tools. It will be the first point of contact for any unit interested in using any new operational technology. It will also ensure that a thorough evaluation of the technology is completed, making sure that the technology meets all privacy, legal and ethical standards.
The NTOP has begun accepting new technologies for assessment and will continue to increase capacity as it moves towards becoming fully operational.
I want to highlight that the RCMP is fully engaged with the Privacy Commissioner's office to ensure that privacy impacts are assessed for all new uses of facial recognition being considered.
Legal considerations are equally taken into account for the use of technology at all stages, including through the Criminal Code, which sets out provisions for judicial authorization and requires that we report annually to Parliament on the use of electronic surveillance.
Given the RCMP's mandate and the necessity to safeguard the ability to effectively use on-device investigative tools, we are not always able to discuss all of the technical or operational details of these tools. Where that is the case, it is for operational integrity and security only.
I understand that I'm out of time. I will be happy to take any questions from members of the committee.
Thank you for the question, Ms. Hepfner. It's not often that I get to compare notes on prior professions in the kind of alignment in which you just posed it, your being a former journalist and I being a former federal prosecutor.
Yes, I am familiar with the rigorous steps that have to be followed in order to deploy this kind of electronic surveillance technique. It is not an easy thing to obtain. There are numerous steps that have to be followed, as I pointed out in my prior answers to Mr. Bezan.
First and foremost, there needs to be an application submitted to a superior court judge. That judge then has to take a look at the facts in very meticulous detail, which will offer some evidence or information of a very specific offence that is being breached. I would point out that, as I think is implied in your question, you can't apply for this type of investigative tool or indeed wiretaps generally for any old criminal offence. There are a limited number of very serious offences that are listed under part VI of the Criminal Code for which this technique would be eligible.
After that, the judge has to engage in a balancing exercise to determine, among other things, whether the interception, the technique, is necessary and whether it's pressing and urgent enough that it requires the technique to be afforded to the state for the purposes of acquiring information that could then be potentially used as evidence in a subsequent criminal proceeding.
Again, there is a lot of attention to detail. It is not uncommon for the courts to put questions back to designated agents before approving these judicial authorizations, precisely because we place paramount value on the protection of people's privacy, individual privacy rights and other protections under the charter.
There is a lot of protection built in to the Criminal Code, precisely to strike the balance of ensuring that the state has the tools that are necessary to protect the security and safety of all Canadians while at the same time upholding people's charter rights.
You talked about openness, transparency and accountability. We agree that these are good things. All of these things are done to gain the public's trust. We agree with that.
The government has made a commitment to transparency and national security, while emphasizing that it will be transparent, but that it will not always be able to provide details. We understand that.
Based on what you said earlier in your opening remarks, efforts are being made to ensure transparency.
Pardon me for saying this, but we have to take your word for it. I'm wondering if having to take your word creates trust.
What do you think?
We'll take that as a “yes”, although with some equivocating on how you came about it.
Minister, as has been the case, and certainly as I've seen a number of times before this committee, the government's response seems to be that we need to build trust, so just trust us. In many cases, including the contradictory testimony you've given here today with what the Privacy Commissioner spoke about this morning...and seeing how the OPQ signed off on by, I believe, your parliamentary secretary at the time, , and the letter that was provided to this committee, there's a difference. There's a discrepancy that exists.
There are provisions within both the Criminal Code and other legislative frameworks that allow for national security to be used to circumvent part VI and the normal judicial processes required for surveillance operations. Minister, yes or no: Are you aware of that ever having been used while you've been Minister of Public Safety—yes or no?
Thank you for the question, Mr. Bains. I think in some ways I discussed this previously with the question from Ms. Valdez.
In essence, what the RCMP have done is they have created this branch or this particular office, if you will, to centralize our efforts in the use of this technology. By doing so, we can be sure that there are very clear and high expectations set with regard to professional standards; that there is training provided to those members who have been designated to apply for the use of this technology; and that, as part of that training, they are kept abreast of any developments in jurisprudence in the law so that where there needs to be improvement, where there needs to be course correction, and where there needs to be greater sensitivity to ensure that we're protecting privacy, we are adhering to those values.
As I think we've heard throughout today's conversation, one of the running themes is that we all want to build trust and confidence, but in order to do that, there needs to be transparency, openness and accountability. I think the creation of this office is designed to do just that.
Good afternoon, Mr. Chair and honourable members of the committee. The RCMP is grateful for the opportunity to speak with you today about this important matter. We hope that our comments will inform your study into the RCMP's use of on-device investigative tools, commonly known as ODITs.
Encryption is essential in our modern world. It protects financial and other sensitive information and helps ensure that Canadians' online activities remain safe and private. Unfortunately, encryption and the devices that help protect Canadians' privacy also help criminals conduct illegal activities and avoid police detection. Although police are sometimes able to collect data stored on those devices, encryption often renders the data unintelligible.
Before I go into detail on what ODITs are, I would like to be clear that the RCMP has never procured or used the Pegasus software, or any other NSO product.
ODITs are used extremely rarely and in limited cases. Their use is always targeted. It's always time-limited, and it's never to conduct unwarranted and/or mass surveillance. These tools are not used in secret. ODITs require judicial authorization prior to deployment, and the evidence collected, including how it was collected, is subject to disclosure and court scrutiny.
Given the RCMP's mandate, we are not able in this setting to discuss specific operational requirements, and the RCMP is not able to disclose sensitive details related to the tools and techniques used in the course of its investigations. Any public disclosure beyond the technical documentation that we provided to the committee that describes the general capabilities of an ODIT has the potential to adversely impact our investigations.
Our use of ODITs is in full compliance with Canadian legislation, including the Charter of Rights and Freedoms, the Criminal Code of Canada and established jurisprudence.
ODIT technology may be used to assist in high-priority investigations relating to national security, serious and organized crime, and other Criminal Code offences that impact the safety and security of all Canadians. It will only be deployed after judicial authorization has been obtained.
As for what an ODIT is, an ODIT is a computer program that's installed covertly on the cellphone and/or computer of a suspect.
ODITs assist investigations by maintaining law enforcement's ability to covertly collect private communications and other data that can no longer be acquired using traditional wiretaps and/or less intrusive investigative techniques. The amount and type of data collected is determined on a case-by-case basis in accordance with strict terms and conditions imposed by the judge who authorized the use of the ODIT.
The RCMP's cautious and measured approach is evidenced by the fact that since 2017, ODITs have only been used in support of 32 investigations, in which a combined total of 49 devices were targeted. Again, I emphasize that in the past five and a half years, we've targeted 49 devices for ODIT deployment.
The RCMP carefully considers the advantages and disadvantages, including the impact on privacy and third parties, before seeking judicial authority to use ODITs in support of a criminal investigation. That assessment is conducted in close collaboration with investigators, technical specialists and federal and provincial Crown prosecutors. It is overseen by our technical case management program within RCMP headquarters. Again, we stress that ODITs are only used for serious criminal offences, and only as approved by a judge who explicitly authorizes the use of ODIT on a specific suspect's device. Judges receive and continue to receive supporting material explaining what the ODIT is and its capabilities.
Although we are not able today to disclose the name of organizations with whom we work in a public setting, we would like to again confirm that the RCMP has never procured or used Pegasus or any other NSO product. Sharing details publicly exposes sensitive information that could negatively impact the RCMP and our public safety partners' ability to effectively use ODITs in the future. Criminal elements also use this sensitive information in order to render the tools ineffective. Further, in addition to negatively impacting the RCMP's investigations, the exposure may jeopardize the investigations of foreign partners and our relations with those countries.
In April of this year, we provided a detailed briefing on the RCMP's use of ODITs to Canada's National Security and Intelligence Review Agency. On August 23, representatives of the Office of the Privacy Commissioner of Canada will also receive a similar briefing.
I would like to bring to the committee's attention that on July 4, 2022, the National Security and Intelligence Committee of Parliamentarians—NSICOP—notified the Minister of Public Safety of its decision to conduct a review of the lawful interception of communications by security and intelligence organizations, which we will fully participate in. The objectives of the review include examining the current state of lawful access, concerns raised by civil society and privacy experts, technological challenges, as well as the gaps. On the basis of its review findings, NSICOP may make recommendations pertaining to various aspects of lawful intercept activities and frameworks.
I'm so sorry, Mr. Larkin, but I've let you go significantly over the time allotted for opening statements. Your testimony is important, but we're going to have to get to questions from members.
Even before we do that, I will say on behalf of the committee that voted for some very specific information from the RCMP that it was quite disappointing, in fact, troubling, to receive in Commissioner Lucki's letter what amounts to just a point-blank refusal of information.
As Canada's grand inquisitor, a committee of Parliament has unfettered power to request documents. We can have a discussion about the appropriateness, and you touched on that in your remarks. I look forward to the discussions that we'll have from the parties about that, but a blanket refusal to a committee is troubling. We'll get to that, I'm sure, with questions from committee.
With that, I will go to the first round that will begin with Mr. Bezan.
I want to thank our witnesses for being here.
I thank the RCMP for their work.
We on the Conservative side here do believe that we want to make sure you guys have the tools to do the job so that you can keep Canadians safe and deal with issues of national security and public safety at all times, but there's also the need to protect the rights of Canadians, the privacy of Canadians and their charter rights. There are concerns about the unintended consequences of deploying ODITs and the potential that those who aren't necessarily being targeted are also being spied on using the technology that you have.
There has also been confusion here, because when we had the response to the Order Paper question tabled by the RCMP via the parliamentary secretary to the Minister of Public Safety in the House back in June, it talked about 10 or 12 cases where ODIT was used. Then, in the rather disappointing letter that came from Commissioner Lucki, it talks about 32 investigations. Now you're saying that there were 49 individuals who were spied on. The number continues to move, Mr. Larkin, and we're all very concerned about where the truth lies. I think that's why we need to have better clarity on the information we have.
We already know that you're not using Pegasus, but you do have a technology. Is it made in Canada? What's the country of origin of this technology that you're using in your investigations?
Thank you very much, Mr. Villemure.
I'm going to turn it over to Assistant Commissioner Mark Flynn, who looks after our national security and protective services.
However, with regard to your previous point, I'd like to re-emphasize that the RCMP recognizes that there are gaps in current legislation. We think that the work of this committee is very important to enhancing and mitigating those risks, mitigating those gaps, and we're very open to working in that process about transparency. I think it's very important for us to recognize that as evolution of technology is outpacing our ability to keep up, necessarily there is a required need for enhanced legislation mitigating those risks to allow us to ensure accessibility and accountability, but also ensuring the privacy of Canadians.
I'll turn over your specific question, Mr. Villemure, to Mark Flynn.
As I'm sure you're well aware, one of Peel's principles is that the ability of the police to perform their duties is dependent on the public's approval of police actions. I think you've been present at the previous interventions indicating that we're having some trust issues.
We had members of your service refuse to provide basic information to this committee, which in my opinion is in contradiction to your duty of candour. I'm hoping that, at the appropriate time, we would get a chance, perhaps, to invite you back in camera to expand on our learning as a committee. Again, we have four meetings. I think there's probably going to be an opportunity to revisit some of this stuff once the privacy impact assessment is completed.
We've heard time and time again, Mr. Chair, from the minister responsible that he is keenly looking forward to our recommendations and, despite some of the protestations of the government members of this committee, is actually excited that we're having this discussion.
If there's a question that I have looming from today, it is about processes of oversight. I reference it in a sample letter. Have you been privy to the sample letter that was provided by the RCMP? It was on a warrant. I referenced it in the morning. It talked about interceptions of on-device investigative tools. It's on page 6:
d. When oral communications have been intercepted using an ODIT, the monitor who subsequently reviews the communication must cease reviewing the communication as soon as the monitor determines that no person in paragraph 3a is a party to the communication
Would you be willing to go on the record right now and say that this is a standard practice within these warrants, that parameter?
Going back to the point I raised earlier, it is a debate that we have, and sometimes it involves a discussion with the government advisory group and with the Privacy Commissioner's office as well, but we do take a look at what we are doing.
As I said, whether we're intercepting an analog communication or an encrypted communication, the privacy is in the content, not in the method of delivery. As we moved through time, we were looking at whether we were invading people's privacy any more. When it gets to a point where we believe there are concerns.... I've personally been involved in meetings where we've received advice that no PIA is required because we are not hitting the triggers. As an organization, we are changing our position on those, and I would say that, even in one particular case, we are moving ahead with the privacy impact assessment even though all of the advice that we have had is that one is not required.
We are trying to lean forward. We are moving forward. You have three people at this table today who believe strongly in erring on the side of revealing the details and allowing people to properly assess whether or not there is an additional invasion of privacy or whether or not we are simply doing things using a new method, but still substantially invading privacy at the same level as we previously had when authorized by judicial authority.
Thank you very much, Mr. Chair.
Thank you again, gentlemen, for attending today.
I think the biggest balance we're looking for here is the balance between national security or your investigative work, which is very important, and then ensuring that we have public disclosure and protection of privacy laws as a whole. We know that's very difficult sometimes. I think as our colleagues have indicated, part of the reason we're here is that it was based on parliamentary work that was just asking certain questions in Parliament. It was a shock or a surprise to parliamentarians to find out that something was being used and no one knew anything about it—including who we would trust would be the Privacy Commissioner. Hearing today that technology's been used for 10 years....
As my colleagues have stated, we had investigations on other technologies, such as facial recognition technology, and from that we also found that the RCMP were not totally engaged with the process. We found that there wasn't that communication. Knowing that, and knowing that the one tool that the Privacy Commissioner has asked for, which is going to be implemented here in August....
I guess from a general standpoint, just so I can understand, why was the Privacy Commissioner not engaged even three years ago, when this was really being used in the judicial system in different processes? What is the best answer about why the Privacy Commissioner, who has, as he explained to us this morning, complete and airtight systems that keep everything confidential better than we can in an open committee in the public today...? Why was that not the first step taken with the RCMP?
The most helpful way for me to explain those criteria that are used is to take you briefly through our process.
Initially we have a consultation with investigators who are considering these tools. During that consultation we explain to them—we demystify these tools and explain—just how complicated they are and the fact that they aren't necessarily going to be able to deliver the evidence they want, and we really encourage them to consider other, less invasive tools if possible.
Step one, we make sure they really understand what they're getting themselves into and have the resources to do it. Following that consultation, they have to submit an official request from their chain of command to our technical investigative services so there is executive awareness and oversight of their request to make sure it's been properly monitored.
After that request, and if it's approved on our side, then we have a second consultation involving their Crown prosecutor. Or, if they don't have a Crown prosecutor, we insist that a Crown be assigned so that a Crown understands the risks and the potential rewards of using these tools.
One thing we make clear during that consultation is that these are new technologies and we fully expect they will be litigated. We make sure they understand the litigation risk and the types of sensitive information that we're not able to share and would seek to protect under section 37 or section 38 of the Canada Evidence Act.
That whole process to date is really intended to make sure they understand that if there's another tool that works, they should use it, because these tools are complicated. Again, there's no guarantee they're going to work.
After all of those consultations, we do an engagement memo between our unit and the requesting unit to memorialize all the conversations, to set out the need to protect the tools. Only after that engagement memo is acknowledged by the commissioned officer overseeing that investigation would the assistance be provided. Of course, all that doesn't matter a whit unless judicial authorization has been granted through the process that we've described earlier in terms of a Crown agent, a proper authorization with all the terms and conditions we've included.
I hope that answers your question.
Mr. Chair, because we requested information and never got it, I'd like to move the following motion:
That, pursuant to the motion adopted by the committee on July 26, 2022, the committee re-affirm its request for all the documents outlined in its original motion. That any documents received from the RCMP that include warrants, lists of warrants, the scope of warrants and the affidavits submitted in support of the warrant applications be considered by the committee in camera only, and following the parameters outlined below:
That all documents issued pursuant to this motion be provided to the Office of the Law Clerk and Parliamentary Counsel within 15 days of the adoption of this order,
That all relevant documents be vetted for matters of personal privacy information, ongoing police operations, and national security by the Law Clerk and Parliamentary Counsel within seven days of the receipt of the documents,
That all documents be circulated to committee members, at the earliest opportunity, once vetted.
I'll speak to that motion, Mr. Chair, because I want to assure committee members and the RCMP that we don't want to undermine any investigations they have right now that are looking at criminality or national security.
What we do want to see is just the broad scope of what those warrants look like and the documents that are associated with them. Through the vetting process that we've used in the past at a number of parliamentary committees, the Law Clerk and Parliamentary Counsel would ensure that the documents are redacted and that the information that's withheld from us as committee members falls in line with protecting those investigations, national security and the privacy of those individuals who are subjects of interest.
I've forwarded this to the clerk, and I've asked that it be circulated. All committee members should have the motion before them now. I just received it myself. It's in both official languages.
I just want to reiterate because, based on what we heard today from the RCMP, from the OPC and from the minister, I feel that there may be other documents that we might want to add to this list. For example, we heard that there was some activity in 2012 that we may want to pursue. That's why I was hoping that we would have some time to perhaps go back, review the testimony, and see how else we can strengthen this motion—what other documents—rather than keep on doing it again and again and again in a piecemeal kind of way. We could do it in a more substantial and fulsome kind of way.
I am, myself, quite interested in the 2012 reference that was made. I know that some members might be interested in other things that perhaps we could include with the text of this motion, perhaps. I just wonder if there are members who would be willing to just give it a little bit of time to see if we can really expand this out.
To speak to the motion itself, I'm sure Mr. Bezan took some time to draft it. I'm sure he conferred with his colleagues who are in the room.
Again, I said this earlier today as well. I will reiterate that if you had circulated the text of the motion to me, to any of our Liberal members with a little bit of notice, we would have been able to review the document. We would have been able to have a substantive conversation.
We have two minutes left in a committee meeting, and we are now being forced to vote on something that we haven't even reviewed. We haven't had the opportunity to have a conversation about this. We haven't been given the courtesy by members in this room to say, “Hey, look, this is what we're proposing. Let's do this. Let's get this done.”
We're here. We're willing. We're asking questions. We're taking an interest in this very important study. We would just hope that we could be more collaborative.
I absolutely agree with the chair. I feel that with just a click of a button you could have flipped me an email. You could have given me a text or what have you. We would have been able to have a conversation on the side or simultaneously as the committee hearing was ongoing. Now, all of a sudden, we're facing a place where I haven't read the full text of the motion. Yes, it's on my phone here in front of me. I haven't read it. I haven't contemplated what else, what scope. I haven't had the time to digest what I've heard from the RCMP today to see where that lack is.
I would like us to be a little bit more collaborative, Mr. Chair. It is very unfortunate that we're having to complain to you about this lack of co-operation. I understand that you all have the votes. You're good to pass your motion in whatever way you want.
I'd just ask for a little bit of respect for the committee's time, for everybody's time here, just to be more co-operative, more collaborative, and for us to get things together without being so confrontational all the time, folks. We're here to work together with all of you guys.