Canadian police have an iPhone unlocking device… but no policy on how to use it

Police in the city of Guelph in southwestern Ontario now have a device that can unlock an iPhone and copy its contents. But Guelph police do not have a policy on when or how the device should be used, which has raised alarm bells among privacy experts.

According to a report by the Guelph Mercury Tribune, the Guelph Police Service (GPS) owns a device called a GrayKey. Developed by Atlanta-based company Grayshift, this device can unlock iPhones and extract “encrypted or inaccessible data” from these devices.

But the GPS currently has no internal policy or procedural documents about the device, according to the report. Police leadership has also not issues any directives on its use. Instead, the GPS simply says that the GrayKey “is used only by our technological crime detectives.”

GrayKey in use since last year with no official policies on its use

Guelph police obtain the GrayKey device following a request in its 2020 budget. Reports from the GPS’s police service board meetings in July, September and October 2019 noted that it had an expected annual operating cost of U.S. $18,000. But it is unknown when exactly the GPS came into possession of its GrayKey unit.

A statement by the Office of the Information and Privacy Commissioner of Ontario (IPC) states that no police service in the province has consulted with them on the use of the GrayKey device.

“Public institutions in Ontario, including police services, need to be transparent about their use of privacy intrusive technologies and ensure they are using them in compliance with both the Charter and provincial privacy laws that apply to the collection, use and disclosure of personal information,” the IPC’s statement reads.

The statement adds that Canadian courts have “recognized that individuals have a reasonable expectation of privacy” when it comes to the contents of personal devices, such as cellphones.

There are limited circumstances in which Canadian police can search the contents of a person’s cellphone without a warrant. In 2014, Canada’s Supreme Court ruled that police in Canada could do so only following a lawful arrest. In addition, the court also determined that the search much take place promptly and be directly related to the investigation at hand.

On top of this, police are also required to take “detailed notes” of what information they looked at, as well as how long they looked at the information.

Lack of official policy on hacking tool’s use worrying

According to Brenda McPhail, director of the Canadian Civil Liberties Association’s privacy, technology and surveillance project, the lack of a policy from the GPS on the use of GrayKey is concerning.

“If this type of technology is being used in the absence of policy, they haven’t thought through the civil implications,” she said.

“They need [a policy], and they need it now,” she added. “When very powerful technology gets used without written safeguards, that’s just wrong.”

She said that it is these policies that determine how the device would be used and whether it should be focused on major crimes, like murder and rape, or minor crimes as tends to be the case south of the border.

Experts are now worried that, without transparency on GrayKey’s use, Canadian police would soon follow in the footsteps of their American counterparts, who have made much more widespread use of tools such as GrayKey. (Related: US is now officially a ‘police state’ says NSA spook.)

“I just find this appalling, that there is widespread use of this hacking tool in the U.S., which means, I’m sure, that it’s being used here in Canada as well,” said Ann Cavoukian, Ontario’s information and privacy commissioner from 1997 to 2014, in an interview with the Mercury Tribune.

Cavoukian reiterated that police investigators must utilize the proper legal channels when it comes to using the tool to search people’s phones.

“How do you know it’s being used properly? If the police want to gain access to information, they need to have probable cause. They can go to a judge, and if they have probably cause, then they’ll be granted a warrant,” she said.

Even IPC has raised concerns.

“While our office supports police services in their work to maintain public safety, we would be very concerned if police were unlocking and searching people’s phones without a court order. Some phones can be used to store highly sensitive personal information, including information about people’s location over long periods of time and their sensitive health information.”

Follow Surveillance.news for more on the technologies police and government are using to spy on regular, law-abiding citizens.

Sources include:

StrangeSounds.org

GuelphMercury.com