Information & Ethics Committee on Aug. 8th, 2022

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much, Mr. Chair, and to the members of the RCMP who are here. Thank you as well for the work you do to protect Canadians.

There are a few questions that I'm hoping to get as direct an answer as possible to. One, we've heard a lot about, though there's a little bit of discrepancy in, the number of authorizations, the number of individuals and the number of devices affected. That's not specifically the number I'm looking for here, but rather, the number of requests that have been made for judicial authorizations and were denied. Do you have that number available?

[Sgt Dave Cobey]

Do you mean judicial authorizations, or requests to use ODITs internally?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Both, if you could. I would like to get the number of requests internally to use the ODITs and any judicial authorizations that were denied, so I guess two different numbers.

[Sgt Dave Cobey]

The number of part VI authorizations denied is tracked in the annual federal wiretap surveillance report, so those numbers would be there. Do you want the other number as well?

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Please.

[Sgt Dave Cobey]

Anecdotally, with regard to the number of investigators who request ODITs versus the number of investigations on which ODITs are deployed, I would say that one in 10 investigations that seek or are interested in using ODITs would actually make it through our process and have ODITs deployed. Because our process is quite rigorous and it's a very challenging practice to implement these tools, very few of the investigators who request them actually end up being able to use them.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

When it comes to the use of ODITs—and it's obviously very complicated and we've talked a lot about the technological aspects of that—one of the challenges that exists and has been raised when using this sort of technology is solicitor-client privilege. Are there any examples where ODITs have been used where they have come into confrontation with attorney-client privilege and the use of this surveillance technology? Are there protocols in place to ensure that the rights of Canadians are protected in that regard?

[Sgt Dave Cobey]

The short answer is yes, there are protocols in place. The sample warrants you received, which is the sample part VI authorization, include specific terms and conditions related to solicitor-client privileges, and whether it be ODIT-collected information or information via a traditional telephone call, those terms and conditions must be followed.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

There are a couple other questions I'd like to ask specifically related to both the testimony....

I've now served on this committee over the course of two Parliaments and there have been some very public disagreements between the leadership of the RCMP and the Office of the Privacy Commissioner, and, as was stated today, there's frustration that there seems to be a hesitancy on the part of the RCMP to disclose documentation to Parliament. Are you aware of the testimony that the Privacy Commissioner offered this morning? Would you agree that it was only after this information was made public at the end of June that the RCMP engaged specifically with the Office of the Privacy Commissioner related to ODITs' use in your investigations?

[A/Commr Mark Flynn]

I guess, again, that it goes back to the evolution of the technology, because in my history in the lawful access debate for 20 years now, the use of this type of technology and the challenges presented to the RCMP and policing in general from encryption have been a topic of discussion that involved the Privacy Commissioner, criminal law policy at DOJ and the human rights law section for many, many years.

Going back to a more recent time frame and the June date, I don't recall the exact order here, but I do know that technical operations did invite the Privacy Commissioner's office to the presentation that's occurring in August.

As well, you'll note some public articles that had been published by people such as Sergeant Dave Cobey here that are meant to bring more public visibility into what we are doing. We are pulling back the veil. We are trying to do that in a way that's professional, that respects both the law around the protection of tools and techniques—

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

If I could say, because I'm almost out of time, one of the concerns that I think has been highlighted by this committee is that it seems like only after details have been revealed—and this is not limited to this circumstance—is the RCMP up front about some of the details related to their investigation.

I would simply like to put one more thing on the record, and that's one important distinction. NSICOP is a committee of parliamentarians, not a standing committee of Parliament, and I think that's an important distinction that needs to be made.

[The Chair, Conservative, Pat Kelly]

Thank you.

With that, you're out of time.

We'll go next to Ms. Hepfner for five minutes.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Thank you very much, Chair.

Thank you to the members of the RCMP here with us today.

I just want to start by asking: Why not do a privacy assessment every time the RCMP starts using some new technology? Why wouldn't a PIA be one of the first things you do?

[A/Commr Mark Flynn]

Going back to the point I raised earlier, it is a debate that we have, and sometimes it involves a discussion with the government advisory group and with the Privacy Commissioner's office as well, but we do take a look at what we are doing.

As I said, whether we're intercepting an analog communication or an encrypted communication, the privacy is in the content, not in the method of delivery. As we moved through time, we were looking at whether we were invading people's privacy any more. When it gets to a point where we believe there are concerns.... I've personally been involved in meetings where we've received advice that no PIA is required because we are not hitting the triggers. As an organization, we are changing our position on those, and I would say that, even in one particular case, we are moving ahead with the privacy impact assessment even though all of the advice that we have had is that one is not required.

We are trying to lean forward. We are moving forward. You have three people at this table today who believe strongly in erring on the side of revealing the details and allowing people to properly assess whether or not there is an additional invasion of privacy or whether or not we are simply doing things using a new method, but still substantially invading privacy at the same level as we previously had when authorized by judicial authority.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

From your background information here, it looks like you would need.... Are there two warrants, a transmission data recorder warrant and a general warrant, to intercept computer functions and use ODITs? Would it be two warrants?

Do judges, in your opinion, really look at the privacy of unrelated people? Are judges concerned about Canadians' privacy when they're assessing these warrants?

[Sgt Dave Cobey]

To answer your question, there are more than two warrants. Predominantly, the omnibus order that we seek requires, in addition to a part VI, which is the interception of private communication warrant, a general warrant that is required for the deployment and use of the ODIT, the technology in the background. There's a transmission data recorder warrant that is required to collect the transmission data that we would collect to operate those, and then, if the ODIT is being used to collect information related to the location of the device, we also seek a tracking warrant. All of those warrants are included predominantly in the authorizations we seek.

Occasionally, we would seek only a general warrant if the objective were to only remotely search a device for historical information, but most of the time, we're using these tools for investigations that are ongoing and seeking prospective communications, private communications. So all of those warrants I listed, including a sealing order and an assistance order, are sought at the same time.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

I think it was Mr. Flynn who talked about how similar technology was used as far back as 2012. I don't think we heard much detail about that technology and what was being done in 2012, so I'm wondering if I can give you a chance to expand on those comments.

[A/Commr Mark Flynn]

I'll add one element. I believe judges absolutely do understand privacy. That is their primary responsibility in weighing the needs of police to utilize such techniques.

Going back, in one of the previous questions the Delisle case was raised. If you look at the Delisle case, you will see in the news coverage that the RCMP, as part of our disclosure package, did present some of the material that was collected using the ODIT. This included screenshots of some of the communications between the accused in that case and what are believed to be the foreign actors he was engaged with.

When we speak about the technology, we hear “spyware”; we hear “malware”. I'll be frank. I don't believe it is either one of those. We are using tools and techniques that are designed to enable us to perform the duties that are expected to be performed by us in gathering evidence about criminal behaviour. You can see from the stats provided solely for 2017 onward that this involves serious cases with serious criminality.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Thank you very much.

I think that's my time, Chair, or do I have more time?

[The Chair, Conservative, Pat Kelly]

No, we're just a little over, so we are done.

Go ahead, Mr. Villemure. You have two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

According to documents that were provided, the relevance of launching a public debate on the use of technologies was assessed in 2016. A public debate has not been held. There may be reasons for that, which you can explain to us.

Is there an openness to initiating a public debate on the use of intrusive technologies?

[A/Commr Mark Flynn]

Is there an openness to discuss the use of invasive...? I think the translation may have missed a fine point there.

I would say there's absolutely an interest in publicly discussing the use of invasive technologies. We're here. We're happy to have that discussion. Again, you'll see the news articles that cover it, so I won't waste your time.

[René Villemure, Bloc, Trois-Rivières, QC]

You've been in your position since 2017.

Is that correct?

[A/Commr Mark Flynn]

I've been involved in this type of technology since 2002. I moved into a different position in 2015, and now I've been in my position in national security and protective policing since December, a year and a half ago.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay.

I'm still referring to the RCMP's desire to launch a public debate in 2016.

Is anyone able to tell me why this didn't occur?