On January 14, 2016, the Ontario Superior Court ruled that “tower dumps” – the mass release of data collected by cellphone towers at the request of law enforcement agencies – violate privacy rights under the Canadian Charter of Rights and Freedoms. Christopher Parsons is a postdoctoral fellow and managing director of the telecom transparency project at Citizen Lab, Munk School of Global Affairs, at the University of Toronto. Read on for his break-down of this decision and its limits.
The Limits of Tower Dump Privacy Protections
When travelling with your mobile phone it routinely — often a few times second — communicates with the neighbouring cellular towers so that it can send, or receive, communications. Each such communication will geolocate the mobile device and send unique identifying information.
Authorities use production orders to compel telecommunications companies to disclose mobile tower-related retained data. Data from these so-called ‘tower dump warrants’ can be used to identify persons suspected of committing a crime. But they can also result in signification infringements of Canadians’ privacy because of the sheer volume of information that can be disclosed, which includes affected persons’ subscriber information and billing records. It was exactly this issue of over breadth that led TELUS and Rogers to challenge a tower dump order for an aggregate total of 43,000 persons’ information. The challenge was finally decided in January of 2016.
Justice Sproat declared that the Peel Regional Police’s production orders “authorized unreasonable searches and so breached the s. 8 Charter rights of the Rogers and Telus subscribers.” He also outlined the following guidelines for authorities to adhere to when requesting tower dump warrants in the future:
1. Provide a statement or explanation that demonstrates the officer seeking the order is aware of the principles of incrementalism and minimal intrusion, and tailored the requested order with that in mind.
2. Explain why all the named locations or cell towers, and all the requested date and time parameters, are relevant to the investigation.
3. Explain why all the types of records sought are relevant.
4. Identify details or parameters which could be used to target the production order to conduct narrower searches and produce fewer records.
5. Request a report based on the specific data instead of requesting the underlying data itself.
6. Justify any requests for underlying data, when it is requested.
7. Confirm that the types and amounts of data being requested can be meaningfully reviewed.
Justice Sproat declined to prohibit authorities from requesting ‘large’ amounts of data on the basis that the authorities and authorizing judge alike may be uncertain of the data required to conduct an investigation. He also declined to offer guidelines addressing how long authorities could retain data provided by telecommunications companies; legislatures, not courts, had to make that decision. Moreover, he maintained that legislatures, not courts, had to determine whether tower dumps be ‘last resort’ investigative techniques.
Importantly, the guidance Justice Sproat provided does not set precedent. As such, the guidelines are not binding obligations on authorities requesting production orders.
The decision may limit authorities’ request for Canadians’ personal information. Such narrowed targeting will constitute a victory for Canadians and their privacy interests.
The decision and guidelines will not improve Canadians’ understanding of how often such requests are actually made. Authorities needn’t publicly report on how often, or to what effect, tower dump orders are useful for investigating or resolving criminal incidents. Moreover, those affected by tower dumps will not be notified of their data being collected by authorities unless charged with a crime. And finally, Canadians will not know if their data is used, later, for purposes unrelated to the original tower dump investigation: the unique identifiers and billing information might, as an example, be subsequently used to identify persons later detected at public events or protests by combining newly collected surveillance data with that previously disclosed by telecommunications providers.
So while Canadians have enjoyed a significant victory concerning their privacy rights they are no more aware of actually being affected by such requests unless charged with a crime. And this data might ultimately be used against them in subsequent investigations or government surveillance. Consequently, Canadians are still left to trust, without being able to verify, that our personal information is being accessed and retained appropriately by authorities. This privacy victory, in other words, has not come with an ounce of real transparency for the public at large.
Christoper Parsons is on twitter at @caparsons.
 R. v. Rogers Communications, 2016, ONSC 70.
Photo: Carlos Ramalhete