Canada joined several other governments in 2023 to pledge better regulation of commercial spyware, but has so far not done anything concrete to meet those commitments.Adrian Wyld/The Canadian Press
Ronald Deibert is a professor of political science and director of the Citizen Lab at the University of Toronto’s Munk School of Global Affairs and Public Policy.
Although U.S. President Donald Trump chose to leave the forum early, the G7 summit in Alberta last month did accomplish some important outcomes – among the most important was the Leaders’ Statement on Transnational Repression.
Transnational repression occurs when authoritarian governments reach across borders to silence and harass political dissidents. Unfortunately, for the millions of refugees and immigrants who experience this form of repression, it’s a phenomenon that is only growing in scope, scale and sophistication worldwide.
Alongside others in the digital-rights space, the Citizen Lab has studied digital transnational repression extensively over the past decade, conducting interviews with victims and carefully documenting the harms resulting from the use of mercenary surveillance technologies by governments engaged in transnational repression, including against targets here in Canada. Among the most important was our discovery in 2018 that Saudi Arabia hacked the phone of Omar Abdulaziz, a Canadian permanent resident and close confidant of murdered Washington Post journalist Jamal Khashoggi.
We were thus very encouraged to see the G7 leaders make such a forceful condemnation not only of transnational repression, but also “the misuse of spyware and cyber tools to engage in surveillance, and to enable physical targeting and tracking, hacking or cyber harassment.”
Former justice minister Irwin Cotler warns Iran may have activated sleeper cells in Canada
Opinion: The final Hogue report was a missed opportunity to tackle transnational repression
As the host of the G7, Canada should be applauded for helping organize this joint statement. But it’s also important to be frank in acknowledging just how far Canada has to go to meet its own commitments – or, to put it less mildly, how much its own practices are currently at odds with those commitments.
For example, earlier this year, the Citizen Lab published a report presenting evidence that the Ontario Provincial Police may be a client of an Israel-based mercenary-spyware vendor called Paragon, a firm whose powerful technology, we discovered, has been abused in Italy via hacking the phones of migrant-support workers and journalists.
That revelation was hardly shocking to those of us who follow the area. In 2022, the RCMP acknowledged that it has been using commercial spyware for years as part of its own investigations, although it failed to properly disclose the details to the Privacy Commissioner who said, at the time, that he was “surprised” to hear about it.
In May, 2023, Canada joined several other governments in a Biden-administration-led pledge to better regulate commercial spyware, but it has so far not done anything concrete to meet those commitments. Among other things, that pledge commits signatories to preventing “the export of software, technology, and equipment to end-users who are likely to use them for malicious cyber activity.”
However, in September, 2023, a Citizen Lab report showed that Canadian technology manufactured by Waterloo-based company Sandvine was being abused in Egypt to facilitate surveillance on an Egyptian politician’s phone. You would think such a discovery would prompt Canadian authorities to act in accordance with their own commitments, but it was the United States that acted instead, placing Sandvine on a sanctions list. The sanctions hurt. Sandvine filed for corporate restructuring and subsequently rebranded earlier this year with a commitment not to sell to authoritarian regimes.
It’s not just prior practice that is at issue. Also at odds with the G7 statement is Canada’s own proposed border-security bill (C-2), which has been widely condemned by this author and numerous other rights groups for the ways it may open up transborder surveillance by foreign governments into Canada. As written, the bill might actually facilitate further transnational repression.
As my Citizen Lab colleague Kate Robertson noted in a recent analysis, Bill C-2 “contains several areas where proposed powers appear designed to roll out a welcome mat for expanded data-sharing treaties or agreements with the United States, and other foreign law-enforcement authorities.” In light of the authoritarian train wreck unfolding in the U.S., and the prospect of high-risk individuals fleeing that country for Canada, such data-sharing could conceivably become a tool of transnational repression used by our closest neighbour, not to mention other repressive regimes.
Pledges are important and the Canadian-backed G7 statement on countering transnational repression and abuse of spyware is certainly a very welcome one. But for Canada to actually translate those pledges into meaningful laws and policies will require some serious self-reckoning about how our own past and current practices are actually implicated in the very acts we have once again condemned.