The mercenary spyware industry represents “one of the greatest contemporary threats to civil society, human rights and democracy”, a leading cybersecurity expert warns, as countries grapple with the unregulated spread of powerful and invasive surveillance tools.
Ron Deibert, a political science professor at the university of Toronto and head of Citizen Lab, will testify in front of a Canadian parliamentary committee on Tuesday afternoon about the growing threat he and others believe the technology poses to citizens and democracies.
In prepared remarks shared with the Guardian ahead of his testimony to a Canadian parliamentary committee, Deibert cautioned that the software used by law enforcement agencies and autocratic regimes was akin to a “wiretap on steroids”, with little formal oversight.
In June, Canada’s federal police agency admitted it uses powerful spyware technology. The tools, which have been used on at least 10 investigations between 2018 and 2020, give the police access to text messages, email, photos, videos, audio files, calendar entries and financial records. The software can also remotely turn on the camera and microphone of a suspect’s phone or laptop.
Civil rights groups condemned the police use of the technology as “profoundly dangerous” and the disclosure prompted the House of Commons ethics and privacy committee to call for summer study of the issue.
Deibert has previously briefed senior government officials in Canada and other democracies about the risks posed by the technology and the need for safeguards to regulate its use.
Last year, a collaborative investigation between the Guardian and other major international outlets, called the Pegasus project, revealed that spyware licensed by the Israeli firm NSO Group had been used to hack smartphones belonging to journalists, lawyers and human rights activists. On Monday, the RCMP told the committee it has never used the Pegasus software.
The brazen targeting of activists and journalists, as well as the unanswered questions about possible national security risks, have prompted some governments to begin curtailing the spread of the technology.
In 2021 the commerce department in the United States announced it had placed mercenary spyware companies like NSO on the country’s Entity List, effectively blacklisting them for their “malicious cyber activities” amid growing concern from US officials that the software posed a grave risk to national security.
In contrast, Canadian authorities have shown little appetite to take similar action, said Deibert, who has briefed senior Canadian officials within successive governments.
“Despite the nuclear-level capabilities of such spyware, it is remarkable that there has been zero public debate in Canada prior to the RCMP’s (or other [law enforcement] agencies) use of this type of technology,” he wrote in his notes.
Deibert, who will speak at 3pm EST, is expected to make a series of recommendations, including regulatory penalties on firms that are known to facilitate human rights abuses abroad, lifetime bans from working with mercenary spyware firms for former employees of Canadian intelligence and law enforcement agencies, and developing clear procurement guidelines.
The hearings are scheduled to last two days. On Monday, public safety minister Marco Mendicino defended the use of the spyware.
“There are stringent requirements in the Criminal Code that require accountability, including what facts the RCMP will be relying on prior to judicial authorization of this sort of technique. There are other safeguards that ensure that only designated agents put those applications to the court,” he told parliament.
