More questions than answers as Guelph Police confirm ownership of controversial forensic tool

The Guelph Police confirmed this week the ownership of a state-of-the-art forensic access tool GrayKey, capable of same day extraction of encrypted or inaccessible data from mobile devices. That information, made public through a freedom of information request filed by the Guelph Mercury Tribune, has privacy expert Ann Cavoukian concerned about the device’s utilisation, stressing the importance of individual privacy.

“It’s appalling – I cannot believe they're using this…” said Cavoukian. “Maybe if you had probable cause, and you went to court and got a warrant to gain access to people’s encrypted information… even that’s a stretch; but none of that has taken place – what authorizes them to do this?”

Ann Cavoukian is the Executive Director of the Global Privacy and Security by Design Centre, and the former Privacy Commissioner of Ontario. When asked if there were ever a reason or cause for a police officer to use technology like GrayKey in child exploitation cases, Cavoukian said again, “get a warrant.” Cavoukian said she’s not aware of GrayKey technology being used in jurisdictions outside of Guelph – as she wondered if the Chief of Police in Guelph is aware of the police force’s access to this technology.

“If you have child exploitation, obviously you have probable cause to explore something… you go and you get a warrant – you can’t just use this technology on your own, unwarranted.”

Waterloo Regional Police Chief Bryan Larkin briefly mentioned the technology in a recent segment of Ask the Chief with Mike Farwell, in which he mentioned he had heard of its use in ‘other jurisdictions’. Larkin mentioned that this sort of technology would typically be used in investigating child exploitation cases. During his last appearance on Ask the Chief, Larkin did not indicate whether the Waterloo Region Police Force has access to GrayKey, though he mentioned that previous experiences in investigation technology has led the force to develop a ‘stringent technology procedure”.

570 NEWS reached out to regional police to verify if the police force has access to this technology, to which we received the following response from Public Information Officer, Andre Johnson – confirming that WRPS uses GrayKey technology and is in possession of one GrayKey device.

“Any such technology is only used in accordance with the law as set out in the Criminal Code and by the Supreme Court of Canada; which includes obtaining lawful consent or prior authorization from a court, who has to be satisfied that there are reasonable grounds and are made aware that technology will be used to assist the police. The search and use of technology to assist in an investigation are done within the limitations imposed by the courts. Also, the lawful authority and the technology itself can be subject to further review by the court if challenged by the defence.” said Johnson.

“With the increase in the use of technology for sophisticated crimes, we continue to assess our use of forensic tools to combat these crimes, including proper judicial review and approval of use on a case-by-case basis. This technology has been used to assist in investigations into crimes such as break and enter, robbery, child exploitation, gun violence and homicides.

“I can tell you that the Ontario and Canadian Chiefs are working with the Informational Privacy Commissioner around a national framework of artificial intelligence,” said Chief Bryan Larkin. “Clearly, as technology evolves in our world (…) we have to find the appropriate balance between privacy, legislation, and supporting police investigations and how police use that technology.”

Earlier this year in March a review of the WRPS found their Cybercrime Unit had acquired a free Clearview AI licence, using that facial recognition software to identify victims and suspects in child exploitations between November 2019 and February 2020. The police chief issued a directive to cease use of the technology until privacy concerns were adequately addressed.

While the intrusiveness of the GrayKey device was particularly shocking to Cavoukian, she said that honouring an individual’s right to privacy does not mean they have ‘something to hide’.

“Privacy is about control…” said Cavoukian. “Personal control relating to the uses of your personal information. You have a right to your personal information – and to be able to control it. If the police have probable cause that you’ve done something wrong and they can go to court and get a warrant… then, under those circumstances, they may be able to gain access to my mobile device. Short of that, no, you can’t do that.”

Information on the policy surrounding the use of this device, when the device was acquired, whether a warrant would be required before utilizing it, or if the device has even been used by Guelph Police is still uncertain. When asked for further information regarding the Guelph Police Force and GrayKey, 570 NEWS was directed to submit a Freedom of Information Request by the Guelph Police Service.