Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications By Cynthia Khoo, Kate Robertson, Ronald Deibert JUNE 2019 RESEARCH REPORT #120 INSTALLING FEAR A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications By Cynthia Khoo, Kate Robertson, and Ronald Deibert Research report #120 June 2019 This page is deliberately left blank Copyright © 2019 Citizen Lab, “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications,” by Cynthia Khoo, Kate Robertson, and Ronald Deibert. Licensed under the Creative Commons BY-SA 4.0 (Attribution-ShareAlike Licence) Electronic version first published by Citizen Lab in 2019. This work can be accessed through https://citizenlab.ca. Citizen Lab engages in research that investigates the intersection of digital technologies, law, and human rights. Document Version: 1.0 The Creative Commons Attribution-ShareAlike 4.0 license under which this report is licensed lets you freely copy, distribute, remix, transform, and build on it, as long as you: · give appropriate credit; · indicate whether you made changes; and · use and link to the same CC BY-SA 4.0 licence. However, any rights in excerpts reproduced in this report remain with their respective authors; and any rights in brand and product names and associated logos remain with their respective owners. Uses of these that are protected by copyright or trademark rights require the rightsholder’s prior written agreement. iii Do you need help? If you are in immediate danger, call 9-1-1 or your local emergency police department. A Canada-wide directory of victim services, shelters, and other local organizations is available at the following web address: http://www.justice.gc.ca/eng/cj-jp/victims-victimes/vsd-rsv/sch-rch.aspx The Government of Canada maintains a list of information related to family violence, including a list of the specific resources available in provinces or territories, here: http://www.justice.gc.ca/eng/cj-jp/fv-vf/help-aide.html If you are concerned about your digital security or believe your device has been or is likely to become compromised, see the list of digital security guides and resources provided at the end of this report, in Appendix A. This report does not provide legal advice. The intended audience of this report includes legal professionals, educators, technologists, social workers, journalists, and advocates in Canada. It is provided for general information purposes only, and it is not legal advice or a substitute for legal advice. Information contained in this report is accurate and current to the best of our knowledge on the date that it was published, but readers should be aware that the laws, their application, and court processes can change frequently and sometimes without notice. Anyone dealing with the legal issues discussed in this report is strongly encouraged to meet with a lawyer to review their rights, options, and legal obligations. Any use made of the information contained in this report is not the responsibility of the authors and does not create a client relationship with either the authors or the Citizen Lab. iv About the Citizen Lab, Munk School of Global Affairs & Public Policy, University of Toronto The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs and Public Policy, University of Toronto, focusing on research, development, and high-level strategic policy and legal engagement at the intersection of information and communication technologies, human rights, and global security. We use a “mixed methods” approach to research that combines methods from political science, law, computer science, and area studies. Our research includes investigating digital espionage against civil society, documenting Internet filtering and other technologies and practices that impact freedom of expression online, analyzing privacy, security, and information controls of popular applications, and examining transparency and accountability mechanisms relevant to the relationship between corporations and state agencies regarding personal data and other surveillance activities. About the Authors Cynthia Khoo is a Research Fellow and former Google Policy Fellow at the Citizen Lab, in the Munk School of Global Affairs & Public Policy with the University of Toronto. She is a lawyer called to the Bar of Ontario, specializing in the intersection of technology and human rights. She is also completing an LL.M. (Concentration in Law and Technology) at the University of Ottawa, where she interned at the Canadian Internet Policy and Public Interest Clinic, and holds a J.D. from the University of Victoria Faculty of Law. Kate Roberson is is a Citizen Lab Research Fellow, and a criminal defence lawyer at Markson Law in Toronto. Her practice includes both trial and appellate work, focusing on a range of criminal law cases, including white collar crime, sexual offences, and computer-based investigations and crime. She previously acted as a provincial Crown prosecutor in Ontario, and as a Law Clerk at the Supreme Court of Canada. She holds a J.D from the University of Toronto’s Faculty of Law. Ronald Deibert is a Professor of Political Science, and Director of the Citizen Lab, in the Munk School of Global Affairs & Public Policy with the University of Toronto. He received his Master's from Queen’s University and his Ph.D from the University of British Columbia. In 2013 he was appointed to the Order of Ontario. v Acknowledgements The authors would like to extend their thanks and gratitude to a number of people who have provided support, feedback, and insights over the course of researching and writing this report. In particular, we are grateful to Christopher Parsons, Siena Anstis, Suzie Dunn, Maya Ganesh, Pam Hrick, Tamir Israel, Miles Kenyon, Jeffrey Knockel, Etienne Maynier, Adam Molnar, and Rhiannon Wong, for their invaluable insights as reviewers of this report. Our wholehearted thanks to Lex Gill for spearheading this project in its initial stages. We also extend our appreciation to Chelsey Legge, who supported this research in its initial stages as a clinical student through the International Human Rights Program at the University of Toronto. Thank you to Mari Zhou, who designed this document. We are indebted to our colleagues Jakub Dalek, Bennett Haselton, Miles Kenyon, Jeffrey Knockel, Adam Molnar, and Christopher Parsons for their findings detailed in an accompanying report published by the Citizen Lab, “The Predator in Your Pocket: A Multidisciplinary Assessment of the Stalkerware Application Industry.” We are further grateful to the individuals and organizations which gave us the opportunity to share early versions of this work and provided input, including participants in the “Evaluating Stalkerware” workshop at the 2018 Citizen Lab Summer Institute. Finally, the authors would like to offer our sincere thanks to Open Society Foundations, John D. and Catherine T. MacArthur Foundation, Ford Foundation, the Sigrid Rausing Trust, and the Oak Foundation, as well as the Office of the Privacy Commissioner of Canada’s Contributions Program, whose generous funding made this report possible. vi Corrections And Questions Please send all questions and corrections to the authors directly at: [email protected] [email protected] Suggested Citation Cynthia Khoo, Kate Robertson, and Ronald Deibert. “Installing Fear: A Canadian Legal and Policy Analysis of Using, Developing, and Selling Smartphone Spyware and Stalkerware Applications,” Citizen Lab Research Report No. 120, University of Toronto, June 2019. vii Contents Information Boxes x Table of Acronyms xi Executive Summary 1 Introduction 4 A. Structure of this Report 9 B. What Is Stalkerware? 10 C. How Is Stalkerware Deployed? 13 D. Methodology 14 E. Stalkerware and Technology-Facilitated Gender-Based Abuse: Background and Literature Review 17 Part 1: Legal Analysis of Stalkerware Use 22 A. Use of Stalkerware Technology and the Criminal Law 22 i. Invasions of Privacy 24 ii. Fear-Based Offences 32 iii. Intimate Images: Invasions of Sexual Dignity and “Sexual Privacy” 36 B. Preventative Orders and Additional Remedies under Criminal and Family Law 40 i. Preventative Orders: Peace Bonds and Restraining Orders 40 ii. Admissibility of Illegally Obtained Evidence in Family Law Proceedings 41 C. Civil Law Claims 41 i. Invasion of Privacy 42 ii. Public Disclosure of Private Facts 44 iii. Breach of Confidence 45 iv. Intentional Infliction of Mental Suffering (IIMS) 45 v. Non-Intentional Torts, the Tort of Harassment, and Developing Adequate Legal Responses to Stalkerware Technology in the Civil Justice System 46 Part 2: Legal Analysis of Creating and Developing Stalkerware 51 A. Human Rights Obligations Apply to Spyware Companies 53 i. Canada’s Obligations Regarding Business and Human Rights 59 B. Professional Ethics and Industry Initiatives 60 C. Regulating Harmful Innovation 65 i. Criminal Law and Product Liability 65 ii. Intellectual Property Law 66 Part 3: Legal Analysis of Selling Stalkerware 70 A. Criminal Liability of Vendors under the Criminal Code 70 i. Sale of Intercept Devices 70 ii. Illegal Commercial Activity in Relation to Computer Programs Designed to Commit Offences of Mischief in Relation to Computer Data or Unauthorized Use of a Computer System 72 iii. Risk-Based Offences: Criminal Negligence, Common Nuisance, and Dangerous