RCMP’s Web Surveillance Methods Blasted by Privacy Commissioner

The RCMP did not follow the Privacy Act and its own guidelines when it chose web investigation technology, concludes a special report by Canada’s privacy commissioner, Philippe Dufresne, presented to Parliament on Thursday.

The investigation was spurred by Tyee reporting in 2019 and 2020, which revealed the RCMP’s Tactical Internet Operational Support unit used tools that can circumvent the privacy and security of Canadians online.

The previous privacy commissioner, after an earlier investigation, raised similar concerns about the RCMP’s use of the facial recognition service Clearview AI, and the force at the time said it would address those issues with a new screening program it called the National Technology Onboarding Program.

But the RCMP again violated privacy laws and its own new onboarding program when using a different technology for Project Wide Awake, the latest commissioner’s report notes.

The commissioner repeated in this report earlier recommendations made by his office to ensure the RCMP follows privacy laws when adopting technology, but noted the force has made it clear it would not commit to adopting them.

“It remains the [Office of the Privacy Commissioner’s] position that rigorous vetting processes and transparency surrounding the use of investigative tools that could have an impact on the privacy of Canadians will support public trust in our national police force and will allow the RCMP to fulfil its important public interest mandate in a privacy protective way,” says the new report.

Comic book code names

Tyee reporting cited in the new report five years ago resulted from an access to information and privacy or ATIP request that yielded hundreds of pages of internal documents and revealed the RCMP deployed members for digital surveillance in several projects it gave names taken from the comic book franchise X-Men.

Project Wide Awake, a code name for hunting “mutants” in the comics, was used to scour internet sources with, in the words of the RCMP, a “proactive approach” that aimed to “help detect and prevent a crime before it occurs.” Screenshots revealed by The Tyee indicate the Wide Awake system first used common market research software by Salesforce called Social Studio, but which appeared to have enhanced non-standard features like facial and voice recognition via “image biometric” and “audio biometric” buttons. And later The Tyee revealed the force purchased Babel X, which aimed to search deeper — seeking to capture activity on everything from Amazon reviews to Groupon to World of Warcraft.

The Tyee reported on RMCP tools designed to unmask friends of those on Facebook who set their friends to be hidden. Documents related to procurement also show the force listed “private communications” and those from “political protests” in a diagram of “darknet” sources, which it aimed to target with a “dark web crawler” and monitoring software such as Babel X.

Privacy and civil liberty experts interviewed by The Tyee at the time argued that internet users clearly have a reasonable expectation of privacy on some of the platforms that the RCMP’s methods appeared to seek to circumvent. And that even posting publicly should not expose internet users to systematic analysis and profiling by state actors and law enforcement in the absence of any crime.

The force’s push to identify people as potential threats arose in response to apparent missed online cues before the 2014 shooting on Parliament Hill.

Files obtained by The Tyee also showed the RCMP shielded from public knowledge other internet programs used by its digital surveillance unit, employing other comic book code names. ATIP requests that contain information on these have been delayed for years beyond initial deadlines under the Access to Information Act.

The Office of the Information Commissioner of Canada began an investigation in 2021 into the RCMP’s failure to respond to ATIP requests within the deadline required by the Access to Information Act but has yet to release any findings.

The RCMP released information on Project Wide Awake to The Tyee only after the information commissioner ordered the force to do so, following a years-long access to information complaint process.

NDP MP Charlie Angus wrote a letter to the previous privacy commissioner requesting an investigation of how the RCMP was monitoring the internet following The Tyee’s reporting. Last week’s report to Parliament is the result.

The RCMP also was subject to an overall investigation by the information commissioner in 2019 after being found to be the worst among 24 agencies and departments at meeting obligations.