ORDER MO-3887

Appeal MA18-364

Durham Regional Police Services Board

January 16, 2020

Summary: The appellant submitted a request to the Durham Regional Police Services Board (the police) under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) for records related to the police’s use of the international mobile subscriber identity (IMSI) device, also known as cell site simulator or Stingray technology. Citing section 8(3)  of the Act , the police refused to confirm or deny the existence of responsive records. The appellant appealed. The adjudicator finds that the police failed to establish that disclosing the existence or non-existence of records responsive to the request would reveal information that would itself convey information that is exempt from disclosure under sections 8(1)  or (2)  the Act . The police are ordered to issue an access decision in response to the request, without relying on section 8(3) .

Statutes Considered: Municipal Freedom of Information and Protection of Privacy Act , R.S.O. 1990, c. M.56 , as amended, sections 8(1)  and 8(3) .

Orders and Investigation Reports Considered: Orders MO-3236 and PO-3998.

OVERVIEW:

[1]  The Durham Regional Police Services Board (the police) received a request under the Municipal Freedom of Information and Protection of Privacy Act  (the Act ) for access to all information relating to the police’s use of the “Stingray” and/or IMSI device.

[2]  The police issued a decision letter that stated:

Following careful consideration, a decision has been made to refuse to confirm or deny the existence of any record pursuant to section 8(3)  of the Act .

[3]  The requester, now the appellant, appealed the decision to this office.

[4]  During mediation, the police maintained their position that they would not confirm or deny the existence of any records. As the appeal did not settle at mediation, it was transferred to the adjudication stage of the appeal process, and I conducted an inquiry under the Act . I sought and received the police’s representations. I then provided the police’s representations to the appellant, and sought and received the appellant’s representations. Portions of the police’s representations were withheld from the appellant in accordance with the confidentiality criteria set out in Practice Direction 7. The police provided additional representations by way of reply.

[5]  I then wrote to the police requesting supplementary representations. The particulars of my request are detailed below. The police provided supplementary representations in response.

[6]  In this order, I do not uphold the police’s decision to refuse to confirm or deny the existence of responsive records, because I do not accept that disclosure of the very fact of their existence or non-existence would itself convey information that is exempt from disclosure under section 8(1)  or (2)  of the Act . Accordingly, I order the police to issue an access decision to the appellant without relying on section 8(3).

DISCUSSION:

[7]  IMSI (international mobile subscriber identity) catchers and Stingray devices, also known as cell site simulators, are forms of cellular phone surveillance technology that mimic a cellphone tower. Various police forces use the devices in their investigations -- for example, to pinpoint suspects’ whereabouts by tracking their phones. The devices are controversial, “for fear that hundreds of innocent device users can be swept up in the collection of cellular data”. [1]

Have the police properly applied section 8(3) in the circumstances of this appeal?

[8]  Section 8(3) states:

A head may refuse to confirm or deny the existence of a record to which subsection (1) or (2) applies.

[9]  This section acknowledges the fact that in order to carry out their mandates, law enforcement agencies must sometimes have the ability to withhold information in answering requests under the Act . However, it is the rare case where disclosure of the mere existence of a record would frustrate an ongoing investigation or intelligence- gathering activity. [2]

[10]  For section 8(3) to apply, the institution must demonstrate that:

1. The records (if they exist) would qualify for exemption under sections 8(1) or (2), and

2. Disclosure of the fact that records exist (or do not exist) would itself convey information that could reasonably be expected to harm one of the interests sought to be protected by sections 8(1) or 8(2). [3] [4]

[11]  The police submit in the non-confidential portions of their representations that confirming that responsive records exist (or do not exist) could reasonably be expected to harm the interests sought to be protected by sections 8(1)(c), (e), and/or (g) of the Act . These sections state:

A head may refuse to disclose a record if the disclosure could reasonably be expected to,

(c) reveal investigative techniques and procedures currently in use or likely to be used in law enforcement;

(e) endanger the life or physical safety of a law enforcement officer or any other person;

(g) interfere with the gathering of or reveal law enforcement intelligence information respecting organizations or persons[.]

[12]  It is not enough for an institution to take the position that the harms under section 8 are self-evident or that the exemption applies simply because of the existence of a continuing law enforcement matter. [5] The institution must provide detailed evidence about the potential for harm. It must demonstrate a risk of harm that is well beyond the merely possible or speculative although it need not prove that disclosure will in fact result in such harm. How much and what kind of evidence is needed will depend on the type of issue and seriousness of the consequences. [6]

Representations

The police’s representations

[13]  The police submit that the appellant’s request was very broad, seeking “all information” relating to the police’s use of a cell site simulator. The police submit that they properly applied section 8(3) in this instance, because disclosure of the fact that records exist (or do not exist) would in itself convey information to the requester that could compromise the effectiveness of a law enforcement activity that may exist or may be reasonably contemplated. The police specifically cite sections 8(1)(c) (reveal investigative techniques and procedures); 8(1)(e) (endanger life or safety); and 8(1)(g) (intelligence information). They submit that to confirm or deny the existence of documentation related to a cell site simulator would in and of itself reveal an investigative technique. They also submit that if suspects or persons of interest are aware of the use (or non-use) of the device, they could alter their behaviours and interfere with the police’s ability to gather intelligence on criminal activities.

[14]  The police provided additional confidential representations in support of their position on the application of section 8(3).

[15]  Finally, the police submit that if I find that they did not exercise their discretion under section 8(3) reasonably, I can only return the matter back to the police for a re- exercise of their discretion.

The appellant’s representations

[16]  The appellant notes that the police’s representations are heavily redacted. He then counters the arguments set out in the police’s non-confidential representations and any arguments the police may have made in their confidential representations with respect to the application of section 8(1). He states, for example, that it is unclear how the police can state that disclosure of the use of a cell site simulator could reveal investigative techniques (section 8(1)(c)), when the use of a cell site simulator without judicial authorization would be an illegal investigative technique. He submits that to allow the police’s argument would be to permit them to use illegal methods to conduct investigations and thus subvert the broad judicial authorization process.

[17]  The appellant also disputes the police’s claim under section 8(1)(e), arguing that there would be no endangerment of the life or safety of a law enforcement officer by virtue of simply disclosing that the police use the cell site simulator device.

[18]  Regarding the exemption in section 8(1)(g), the appellant states disclosure of the fact that the cell site simulator has been used would not reveal the intelligence information that was gathered. He notes that he is not requesting the fruits of any investigations that used a cell site simulator.

[19]  With respect to the police’s exercise of discretion in invoking section 8(3), the appellant states that the police’s discretion cannot have been exercised appropriately as the very use of the device would constitute an illegal investigative tool.

[20]  The appellant also stresses the limited scope of his request:

I cannot reiterate enough that I am seeking only disclosure that the device is being utilized and not details of the particular investigations or certainly the fruits of any investigation.

Police’s reply and supplementary representations

[21]  In reply, the police refute each of the appellant’s arguments, including his arguments on sections 8(1)(c), (e) and (g). They also deny having engaged in any illegal activity, stating that they were entitled to refuse to confirm or deny the existence of any records that may be responsive to the request, on the grounds cited in their initial representations.

[22]  The police further note that regulation of cell site simulators and judicial authorization for their use are separate from the access process under the Act , and should not affect their ability to claim the section 8(3) exemption.

[23]  Following receipt of the police’s reply, I wrote to them inviting supplementary representations. My letter to the police stated in part:

I am enclosing a number of news articles that demonstrate, among other things, that various police forces have publicly acknowledged that they use Stingray technology, while other police forces have acknowledged that they do not use Stingray technology. These articles can also be found online at:

• “Cellphone Surveillance technology being used by local police across Canada” [7]

• “RCMP reveals use of secretive cellphone surveillance technology for the first time” [8]

• “Two years after they said they didn’t, Toronto police admit they use Stingray cellphone snooping device.” [9]

I am also enclosing a recent order of this office, Order PO-3998.

I invite you to submit representations on the enclosed material and its relevance to the issues in this appeal, should you wish to do so. In particular, please comment on the Durham Police’s refusal to confirm or deny any use of Stingray technology, in light of other police forces having publicly stated that they do, or do not, use this technology.

[24]  The police submitted representations in response. In the non-confidential portion of their representations, the police state:

Regardless of what other services [have] elected to acknowledge, DRPS maintains that it was a proper exercise of its discretion to refuse to confirm or deny the existence of responsive records for all of the reasons set out in its submissions dated September 18, 2018 and its reply submissions dated April 15, 2019.

Analysis and Finding

[25]  For the reasons set out below, I find that section 8(3) does not apply in the circumstances, and I order the police to issue a new access decision without relying on that provision.

[26]  I begin by briefly addressing the appellant’s apparent assertion that the police may be using cell site simulator technology illegally and that for that reason, I ought not to uphold the police’s invoking section 8(3). It is not clear to me whether the appellant is arguing that any illegality is relevant to the issue of whether the requirements of section 8(3) are met to begin with, or whether it is only relevant to the police’s exercise of discretion in invoking section 8(3), assuming it applies. However, given my finding below that the requirements of section 8(3) are not met in any event, I will not address the appellant’s argument on this point further.

[27]  On a related point, the police argue that if I find that they did not exercise their discretion properly in invoking section 8(3), I can only return the matter to them for a re-exercise of discretion based on proper considerations, and I cannot substitute my own discretion for theirs. However, because I find below that section 8(3) does not apply, the police have no discretion to invoke it. [10]

[28]  I now turn to whether the police have established that section 8(3) applies. As I noted above, for 8(3) to apply, the police must demonstrate that:

1. The records (if they exist) would qualify for exemption under sections 8(1) or (2), and

2. Disclosure of the fact that records exist (or do not exist) would itself convey information that could reasonably be expected to harm one of the interests sought to be protected by sections 8(1) or 8(2).

Part one: would the records (if they exist) qualify for exemption under sections 8(1) or (2)?

[29]  Because I find below that part two of the test is not satisfied, I do not need to make a determination on whether the records, if they exist, satisfy part one of the test. I note that, given the wording of the appellant’s request, it is possible that if responsive records exist, they would consist of a wide variety of documents. For example, in a recent order of this office involving the Ontario Provincial Police’s (OPP’s) use of cell site simulators, Order PO-3998, the responsive records included various agreements, purchase orders, and an operating protocol. The adjudicator in that case upheld the application of section 14(1) of the Freedom of Information and Protection of Privacy Act (the equivalent provision to section 8(1)  of the Act ) for some of the records, but found that the exemption did not apply to others, and ordered the OPP to disclose the latter records. In the appeal before me, some responsive records, if they exist, may be exempt from disclosure under section 8(1) or (2). However, I do not make a finding on that point.

Part two: would disclosure of the fact that records exist (or do not exist) in itself convey information that could reasonably be expected to harm a section 8(1) or (2) interest?

[30]  Under part two of the test, the police must demonstrate that disclosure of the mere fact that records responsive to the request exist (or do not exist) would itself convey information that could reasonably be expected to harm one of the interests sought to be protected by sections 8(1) or (2).

[31]  At this stage, I should point out that confirming that records responsive to the request exist (or do not exist) is not necessarily the same as confirming the use or non- use of the cell site simulator device. In responding to an access request, an institution is to adopt a liberal reading of the request. [11] An institution may have records in its custody or control about its non-use of cell site simulators, and such records could be responsive to a request for records relating to the institution’s use of the device.

[32]  However, even assuming that confirming or denying the existence of records responsive to the appellant’s request equates to confirming or denying the use of cell site simulator technology, I find, for the following reasons, that the police have not established that this could reasonably be expected to harm one of the interests sought to be protected by section 8(1) or (2).

Developments since Order MO-3236 was issued

[33]  Before addressing the police’s specific arguments on sections 8(1)(c) and (g), [12] I will address a previous order of this office, Order MO-3236, dealing with an institution’s section 8(3) claim in response to a similar request, and the increase in public knowledge of the use of cell site simulators since Order MO-3236 was issued.

[34]  In Order MO-3236, this office upheld a decision of the Toronto Police Services Board applying section 8(3)  of the Act  in response to an access request for records relating to the Toronto Police’s use of cell site simulator technology. The adjudicator found that the second part of the section 8(3) test was met, stating that “information which would confirm or deny the existence or non-existence of responsive records could reasonably be expected to reveal the fact that the police have or do not have these types of surveillance equipment.” He also found that “knowledge of the existence of this investigative tool would enable those who are subject to an investigation to take steps to avoid detection or surveillance by the police.”

[35]  Since the time that Order MO-3236 was issued in August 2015, and as demonstrated by the news articles referenced above, the Toronto Police Service have publicly confirmed that they have used cell site simulators. The RCMP, in a public briefing to the press on April 5, 2017, also confirmed that it owned several such devices. Other municipal police forces and the OPP have acknowledged either that they do or do not use the technology, while other forces continue to decline to state one way or the other.

[36]  These developments coincide with the increased public knowledge of the use of cell site simulators. They also demonstrate, in my view, that police forces continue to find utility in the use of those devices, even when the public is aware that those police forces count cell site simulators among their investigative tools.

[37]  This office recently issued Order PO-3998, regarding records held by the OPP about its use of cell site simulators. A reporter made an access request to the OPP for information relating to the OPP’s acquisition of cell site simulators, and the OPP initially refused to confirm or deny the existence of records, citing section 14(3) (the section 8(3) equivalent in the provincial version of the Act ). The OPP then changed its position and acknowledged that it had responsive records but withheld them, citing various law enforcement exemptions.

[38]  In considering the application of the equivalent provision to section 8(1)(c) to the records before her, Assistant Commissioner Sherry Liang stated the following:

In its submissions, the ministry relies on Order MO-3236 [the August 2015 order referred to above], in which this office upheld a decision applying section [8(3)] (refuse to confirm or deny)…. It urges me to adopt a finding in that order that a “cell site simulator is an “investigative technique” that is currently or is likely to be used by the police in law enforcement activities and that the disclosure of this fact could reasonably be expected to hinder or compromise its effectiveness.”

The conclusions in Order MO-3236 must be considered in context. In that case, the Toronto Police Service refused to confirm or deny that it held any records relating to the acquisition of a cell site simulator. The adjudicator accepted the contention that confirmation of the mere existence of this investigative tool would harm law enforcement interests. As acknowledged by the ministry, it is not clear that such a contention would prevail today. At the time of that finding, the level of public awareness about the technology was much lower than it is today. Indeed, as noted above, the RCMP has since held a very public briefing to discuss its use of the technology.

The section 8 harms cited by the police in this case

[39]  In the case at hand, the appellant has been clear that he is “seeking only disclosure that the device is being utilized and not details of the particular investigations.”

[40]  I have carefully reviewed the police’s representations, their reply representations and their supplementary representations, including the confidential portions. The police have failed to provide evidence satisfying me that disclosure of the fact that responsive records do or do not exist could reasonably be expected to harm an interest protected under sections 8(1)  or (2)  of the Act .

[41]  As noted above, in their non-confidential representations, the police specifically argue that disclosure of the use or non-use of cell site simulators could reasonably be expected to reveal investigative techniques (section 8(1)(c)) and interfere with the gathering of or reveal law enforcement intelligence information (section 8(1)(g)). [13] They state:

[regarding the police’s section 8(1)(c) claim]:

To confirm or deny the existence of documentation related to a stingray device would in and of itself reveal an investigative technique (either the use or the non-use of the device)

[regarding their section 8(1)(g) claim]:

The thread continues into this exemption where it must be noted that if suspects or persons of interest to the police service are aware of the use (or non-use) of the stingray device, they could alter their behaviours, specifically in relation to the use of cellphones, and therefore interfere with the [police’s] ability to gather intelligence on criminal activities.

Further, disclosure of the use (or non-use) of the device could reasonably be expected to reveal intelligence information about organizations or individuals because the request itself is so broad.

[42]  The police also argue that regardless of what other police forces have elected to acknowledge, it was a proper exercise of their discretion to refuse to confirm or deny the existence of responsive records.

[43]  For section 8(1)(c) to apply, the police must demonstrate that confirming or denying the existence of records could reasonably be expected to disclose a technique or procedure (i.e. the use or non-use of cell site simulators) and hinder or compromise its effective use. [14] The exemption will normally not apply where a law enforcement technique or procedure is generally known to the public. For section 8(1)(g) to apply, the police must show that confirming or denying the existence of records could reasonably be expected to interfere with the gathering of or reveal law enforcement intelligence information.

[44]  Here, the police state that persons of interest or suspects “could” change their behaviour if the use (or non-use) of cell site simulator technology is known to suspects or persons of interest to the police. However, the police do not explain why this could reasonably be expected to occur nor do they demonstrate how a behavioural change, if it did occur, could reasonably be expected to hinder or compromise the use of an investigative technique or interfere with their ability to gather intelligence information, particularly as the technology is generally known to the public. In my view, the harms that the police raise do not rise above the merely possible or speculative in nature. The police have not explained how merely confirming the existence or non-existence of responsive records (as opposed to the contents of any records, if they exist, or in what context the records, if they exist, were created or used) could reasonably be expected to hinder or compromise the effective utilization of an investigative technique or reveal intelligence information.

[45]  I have also carefully reviewed the police’s confidential representations. While the police have stated specific harms that they submit could result from confirming or denying the existence of records, their submissions in this regard are vague and again speculative. The police’s arguments lack any level of detail to enable me to conclude that the harms identified by the police could reasonably be expected to result from merely confirming the existence or non-existence of responsive records, even if I were to accept that confirming their existence or non-existence amounts to confirming or denying the use of cell site simulator technology.

[46]  I return to the growing knowledge among the public of the use of cell site simulator technology, and the public acknowledgment by many police forces of their use, or non-use, of the devices. In my view, it is reasonable to infer from these public acknowledgements that the relevant police forces do not view these acknowledgments as posing a realistic threat to the integrity of their law enforcement activities. While the Durham Regional Police are entitled to disagree with those police forces in this regard, their representations, in my view, do not amount to more than stating a general apprehension of harms that could result from acknowledging the existence or non- existence of records in this case.

[47]  For these reasons, I find that the police have not established that part 2 of the section 8(3) test is met. On that basis, I do not uphold the decision of the police to refuse to confirm or deny the existence of records responsive to the appellant’s request. As mentioned above, since section 8(3) does not apply, the police have no discretion to rely on that provision.

[48]  I will, therefore, order the police to issue an access decision with respect to the appellant’s request for information.

ORDER:

1. I do not uphold the decision of the police to refuse to confirm or deny the existence of responsive records in this appeal on the basis of section 8(3). If I do not receive an application for judicial review from the police on or before January 30, 2020 in relation to my decision that section 8(3) does not apply, I will send a copy of this order to the appellant on or after January 31, 2020.
2. I order the police to make an access decision under the Act , treating the date of this order as the date of the request, and without relying on section 8(3).
3. In order to verify compliance with order provision 2, I reserve the right to require the police to provide me with a copy of the access decision sent to the appellant.

Original Signed By:		January 16, 2020
Gillian Shaw
Senior Adjudicator