Covert Access and Intercept Team privacy impact assessment

On this page

1. Program overview
2. Program or activity type
3. Data type
4. Program or activity partners
5. Program duration
6. Program population
7. Technology and privacy
8. Personal information transmission
9. Impact on individuals in the event of a breach

Program overview

In order for the RCMP to carry out its mandate to enforce the law and investigate offences, the RCMP must conduct policing duties pursuant to section 18 of the RCMP Act by collecting evidence and personal information. Successful criminal investigations rely on relevant evidence that must be lawfully obtained to prove the elements required for each of the alleged offences. Broadly speaking, individuals who are involved in the most serious of crimes typically understand that if caught they face greater risk of incarceration and therefore make more sophisticated efforts to avoid detection. Nevertheless, as the use of digital devices has become increasingly incorporated into our day-to-day lives, those individuals are also more likely to leave a digital trail of evidence of their activities. Although police are sometimes able to collect the data sent, received, or stored on or by digital devices, protections such as end-to-end encryption are often used to render such data collection unreadable and therefore useless to investigators. As internet and telecommunication technologies have evolved, tools and techniques used by police have likewise advanced, which led to the establishment of the RCMP's Covert Access and Intercept Team in late 2016.

Search and seizure powers that permit police to collect evidence are long established practices recognised in both statute and common law as well as by the courts. The Covert Access and Intercept Team's mandate is to implement lawful technological techniques to evidence collection that respects the law for search and seizure of digital evidence.

The Covert Access and Intercept Team's primary role is to access computers and digital devices, under warrant without the owner's knowledge, where evidence of serious criminality is believed to be held and to seize that evidence in a manner compliant with the Canadian Charter of Rights and Freedoms.

The tools and techniques used may vary greatly and are dictated by the hardware, software, and network configurations of the targeted computer systems, tablets or smartphones. This class of tools is generally referred to as On Device Investigative Tools.

Information collected by the Covert Access and Intercept Team in support of investigations is described in the RCMP's Personal Information Bank PPU 005 - Operational Case Records, Treasury Board of Canada Secretariat Registration Number 000997, in Personal Information Bank PPU 015- Criminal Operational Intelligence Records (Exempt Bank), Treasury Board of Canada Secretariat Registration Number 000999 and in PPU 025 National Security Investigations Records.

Program or activity type

Data type

Program or activity partners

Program duration

Program population

Technology and privacy

Personal information transmission

Impact on individuals in the event of a breach

A breach of privacy during Covert Access and Intercept Team operations could no doubt be damaging to the individual in question. Various types of judicial authorizations are granted to support the Covert Access and Intercept Team's evidence seizure efforts. Those authorizations define what the court has deemed appropriate information to collect in pursuit of the specific investigation and how that that evidence can be collected. Presently, mobile devices and other computer systems contain a myriad of information some of which likely constitutes sensitive personal information. Law enforcement is only entitled to collect information specified in the warrant.

While the risk of a breach is minimal given the security measures put in place by the RCMP, given the nature of the information sought through Covert Access and Intercept Team services, it is possible a breach could result in serious injury to the individual. The RCMP and the Covert Access and Intercept Team recognize the need to maintain the integrity of seized data, not only for continuity and court admissibility purposes, but also to minimize the potential impacts to an individual's privacy. To that end, the Covert Access and Intercept Team manages the collected information in accordance with RCMP and Government of Canada policies for Protected B information. The evidence collected is only accessible in a human-readable format once the data is delivered to the RCMP database. Due to the precision and targeted nature of Covert Access and Intercept Team operations, in the event of a breach, only limited data from one computer system or device will be affected. That data will be encrypted and rendered unreadable. In the extremely unlikely event that Covert Access and Intercept Team operations result in a data breach and the Covert Access and Intercept Team's encryption processes also fail, the resulting data, while clearly no longer fully secure, would still not be rendered into a human-readable format without substantial effort and expertise.

When data must be removed from the database, such as for disclosure in court proceedings, the investigator will protect the information in accordance with RCMP policies on the protection of information.