Spyware & Technology Facilitated/Enabled Partner Abuse

Can There Be Criminal Consequences in Canada?

Caveat

Given that law enforcement is the gatekeeper of the criminal justice system when it comes to enforcing Canadian criminal law, sometimes those in law enforcement need the ability to think asymmetrically when applying existing criminal law to tech facilitate abuse. Such asymmetrical thinking will allow officers to ensure they apply (frame) the appropriate criminal code sections mentioned in this article, to the crime being investigated, ensuring that they cover all the essential elements needed to get Crown approval to lay a charge. We hope this article will spawn that asymmetrical thinking, especially for officers who come from smaller departments or detachments that do not have a specialized section to deal with this type of crime. To deal with this new digital threat we need to move away from user-based prevention strategy approaches which, don’t get us wrong are important; to a more offender-focused response - that is what this article is all about!

This article does not offer legal advice, rather it should be considered an educational resource for law enforcement, legal professionals, educators, and professionals who work with survivors of technology-facilitated/enabled abuse. As always, seek out legal advice from a qualified lawyer or law enforcement professional who specializes in this area of law if you are experiencing this type of violence.

Introduction:

In November 2019, we wrote a user-based prevention strategy article, “Digital Inoculation: Taking Back Control – Steps to Protect Yourself From Tech Facilitated Abuse” https://www.thewhitehatter.ca/post/digital-inoculation-taking-back-control-steps-to-protect-yourself-from-tech-facilitated-abuse This article is a follow-up that will concentrate on offender-focused based responses to this clear and present threat.

In any crime, but especial when it comes to tech-based crime where the cloak of anonymity is a constant challenge, law enforcement needs to prove “beyond a reasonable doubt” that the person arrested and charged is the person who engaged in the technology-facilitated abuse. This can be a challenge, even when it may be obvious to the target who their aggressor is. However, knowing it and proving it in a court of law are two different things. This is why law enforcement-based computer forensic experts are so important in today’s online investigational process, especially when it comes to tech facilitated abuse. Unfortunately, especially for smaller departments, this is a luxury that is not often available, or if there is such an officer trained, they are often underfunded, under-resourced, and often overworked. Given that technology is the new frontier for criminality, it is our opinion that law enforcement needs to strategize and re-organize resources to meet this new and growing challenge.

Criminal Code Recommendations:

As mentioned earlier, law enforcement needs the ability to think asymmetrically when applying existing criminal law to tech facilitate abuse. We offer the following sections of the Criminal Code of Canada for consideration:

#1- Interception of Private Communications Sec 184(1) CCC

Section 184(1) of the Criminal Code makes it a straight indictable criminal offence, punishable by up to five years imprisonment, to intercept the private communications of an individual. Section 184(1) reads:

Everyone who, by means of any electro-magnetic, acoustic, mechanical or other device, willfully intercepts a private communication is guilty of an indictable offence and liable to imprisonment for a term not exceeding five years.

“Private Communication” is defined under Part VI of the Code as:

“any oral communication, or any telecommunication, that is made by an originator who is in Canada or is intended by the originator to be received by a person who is in Canada and that is made under circumstances in which it is reasonable for the originator to expect that it will not be intercepted by any person other than the person intended by the originator to receive it”

Anyone, including a partner who uses spyware in an attempt to intercept private communications of their target, with another person, without the target’s informed consent, could be arrested, charged, and convicted under this section of the Criminal Code.

Other cases where this section could apply:

• Hacking someone else’s device (computer, laptop, cellphone)

#2 - Possession of Spyware/Technology: Section 191(1) CCC

191 (1) Every person who possesses, sells or purchases any electro-magnetic, acoustic, mechanical or other device or any component of it knowing that its design renders it primarily useful for surreptitious interception of private communications is guilty of

(a) an indictable offence and liable to imprisonment for a term of not more than two years; or

(b) an offence punishable on summary conviction.

This section of the criminal code could be considered when the aggressor is using any tech device to surreptitiously intercept digital communications such as emails, texts, phone calls, or online streaming communications, made by the intended target.

#3 - Unlawful Use and Disclosure of Intercepted Private Communication: Section 193(1) CCC

193 (1) If a private communication has been intercepted by means of an electro-magnetic, acoustic, mechanical or other device without the consent, express or implied, of the originator of that communication or of the person intended by the originator to receive it, every person commits an offence who, without the express consent of the originator of that communication or of the person intended to receive it, knowingly

(a) uses or discloses the private communication or any part of it or the substance, meaning or purpose of it or of any part of it, or

(b) discloses the existence of the private communication.

Anyone who intercepts private communications by means of electromagnetic, acoustic, mechanical or other devices (without the consent of the target, or a court-issued warrant), and then uses and discloses that communication publicly, would constitute an offence under this section of the Criminal Code.

#4 – Uttering Threats: Section 264.1(1) CCC

264.1 (1) Every one commits an offence who, in any manner, knowingly utters, conveys or causes any person to receive a threat

(a) to cause death or bodily harm to any person;

(b) to burn, destroy or damage real or personal property; or

(c) to kill, poison or injure an animal or bird that is the property of any person.

Anyone who uses technology (phones, laptops, gaming platforms, emails, text messages, social media platforms) to threaten bodily harm or death to another person would constitute an offence under this section of the criminal code. This section could also be utilized when the aggressor uses technology to target hate-based threats given the targets race, religion, or sexuality.

Case Law: R v Brame, R v Ahmad, R v Rioux, R v Mirsayah, R v Bahr, R v MG. R v Harding

#5 - Unauthorized Use Of A Computer: Section 342.1(1) CCC

342.1 (1) Everyone is guilty of an indictable offence and liable to imprisonment for a term of not more than 10 years, or is guilty of an offence punishable on summary conviction who, fraudulently and without colour of right,

(a) obtains, directly or indirectly, any computer service;

(b) by means of an electro-magnetic, acoustic, mechanical or other device, intercepts or causes to be intercepted, directly or indirectly, any function of a computer system;

(c) uses or causes to be used, directly or indirectly, a computer system with intent to commit an offence under paragraph (a) or (b) or under section 430 in relation to computer data or a computer system; or

(d) uses, possesses, traffics in or permits another person to have access to a computer password that would enable a person to commit an offence under paragraph (a), (b) or (c).

If the aggressor uses a target’s password without consent to access online accounts (as long as the account is not jointly owned) for the purpose of tech facilitated abuse, the aggressor could be arrested and charged under this section of the Criminal Code.

Case Law: R v Cole, R v Mackie

#6 - Possession Of Device To Obtain Unauthorized Use Of Computer System Or To Commit Mischief”” Section 342.2(1) CCC

342.2 (1) Every person who, without lawful excuse, makes, possesses, sells, offers for sale, imports, obtains for use, distributes or makes available a device that is designed or adapted primarily to commit an offence under section 342.1 or 430, knowing that the device has been used or is intended to be used to commit such an offence, is

(a) guilty of an indictable offence and liable to imprisonment for a term of not more than two years; or

(b) guilty of an offence punishable on summary conviction.

Spyware is technology, it’s a form of software that is primarily used to covertly access another person’s device, such as a cellphone or computer, and therefore sections 342.1 (1) and 342.2 (1) of the Criminal Code may apply. If the aggressor is using spyware to covertly and remotely block incoming calls, block access to the internet, or send spoofed text messages or phone calls pretending to be the target, then it is our opinion that the aggressor is purposely interfering with the target’s communication data so, therefore, this section would apply.

Other cases where this section could apply:

• Hacking home digital thermostats to covertly and remotely change temperatures in a home

• Hacking a vehicle’s computer/GPS system to track a target

Case Law: R v. McNish, R v. St-Martin, R v Senior

#7 - Fraud: Section 380(1) CCC

380 (1) Every one who, by deceit, falsehood or other fraudulent means, whether or not it is a false pretence within the meaning of this Act, defrauds the public or any person, whether ascertained or not, of any property, money or valuable security or any service,

(a) is guilty of an indictable offence and liable to a term of imprisonment not exceeding fourteen years, where the subject-matter of the offence is a testamentary instrument or the value of the subject-matter of the offence exceeds five thousand dollars; or

(b) is guilty

(i) of an indictable offence and is liable to imprisonment for a term not exceeding two years, or

(ii) of an offence punishable on summary conviction,

where the value of the subject-matter of the offence does not exceed five thousand dollars.

In cases where an aggressor commits an account take-over of a target’s bank account to drain funds, or “phishes” the target for money, this section would apply:

Case Law: R v Kalonji, R v. Usifah

#8 - Identity Fraud: Section 403(1) CCC

403 (1) Everyone commits an offence who fraudulently personates another person, living or dead,

(a) with intent to gain advantage for themselves or another person;

(b) with intent to obtain any property or an interest in any property;

(c) with intent to cause disadvantage to the person being personated or another person; or

(d) with intent to avoid arrest or prosecution or to obstruct, pervert or defeat the course of justice.

(2) For the purposes of subsection (1), personating a person includes pretending to be the person or using the person’s identity information — whether by itself or in combination with identity information pertaining to any person — as if it pertains to the person using it.

If the aggressor is accessing their target’s social media, emails, or other digital device pretending to be their target for personal advantage, or to cause disadvantage to the target, then this section would apply. This would especially be true if the aggressor was using the target’s username and password. This section could also be applied if the aggressor if purposely posting the target’'s personal account information to make the target more vulnerable to other forms of crime; this is commonly known as “Doxxing”.

Case Law: R v. Mackie

#9 - Mischief In Relation To Data: Section 430(1.1) CCC

430(1.1) Everyone commits mischief who wilfully

(a) destroys or alters computer data;

(b) renders computer data meaningless, useless or ineffective;

(c) obstructs, interrupts or interferes with the lawful use of computer data; or

(d) obstructs, interrupts or interferes with a person in the lawful use of computer data or denies access to computer data to a person who is entitled to access to it.

Under this section, computer data would include emails, text messages, pictures, and videos. So if the aggressor is interfering with communications of their target, or is remotely blocking, deleting, or manipulating a target's communications or data, this section would apply.

Other cases that could fall under this section:

• Direct Denial of Services Attacks (DDOSing)

• Infecting a targets device with malware (including ransomware, spyware, worms, trojans, and viruses)

Case Law: R v Geller, R v Maurer

Intimate Images, Morphed Nudes, Deep Fakes:

Although there are no laws in Canada specific to deepfake and nudification technology, we believe that the following sections of the Criminal Code could be used to hold those who sexually weaponize this type of technology criminally accountable. We will also talk about laws specific to the covert use of technology to record intimate images or video without consent.

#10 - Voyeurism: Section 162(1) CCC

162 (1) Every one commits an offence who, surreptitiously, observes — including by mechanical or electronic means — or makes a visual recording of a person who is in circumstances that give rise to a reasonable expectation of privacy, if

(a) the person is in a place in which a person can reasonably be expected to be nude, to expose his or her genital organs or anal region or her breasts, or to be engaged in explicit sexual activity;

(b) the person is nude, is exposing his or her genital organs or anal region or her breasts, or is engaged in explicit sexual activity, and the observation or recording is done for the purpose of observing or recording a person in such a state or engaged in such an activity; or

(c) the observation or recording is done for a sexual purpose.

If the aggressor has covertly downloaded a Remote Access Trojan (RAT) onto a target’s device that allows them to remotely access a computer or phone camera for the purpose of recording nudity or explicit sexual activity, then this section of the criminal code would apply.

Another case where this section would apply if the aggressor has placed a hidden Wi-Fi or USB camera into the target’s home or vehicle for the purpose of recording nudity or explicit sexual activity.

Case Law: R v McFarlane, R v Jarvis, R v Law

#11 - Publication Of An Intimate Image Without Consent: Section 162.1(1)(2) CCC

162.1 (1) Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct, is guilty

(a) of an indictable offence and liable to imprisonment for a term of not more than five years; or

(b) of an offence punishable on summary conviction.

(2) In this section, intimate image means a visual recording of a person made by any means including a photographic, film or video recording,

(a) in which the person is nude, is exposing his or her genital organs or anal region or her breasts or is engaged in explicit sexual activity;

(b) in respect of which, at the time of the recording, there were circumstances that gave rise to a reasonable expectation of privacy; and

(c) in respect of which the person depicted retains a reasonable expectation of privacy at the time the offence is committed.

In 2015 a new law, the non-consensual distribution of an intimate image was created (sec 162.1(1) Criminal Code) “Everyone who knowingly publishes, distributes, transmits, sells, makes available or advertises an intimate image of a person knowing that the person depicted in the image did not give their consent to that conduct, or being reckless as to whether or not that person gave their consent to that conduct” Again, this law has not been tested in Canadian courts specific to a deepfake, but we do think it has a good chance that it would survive a legal challenge.

Case Law: R v P.S.D., R v Mc Farlane, R v J.B.

#12 - Possession, Distribution, Accessing Child Pornography: Sec 163.1 (1)(2)(3)(4) CCC

163.1 (1) In this section, child pornography means

(a) a photographic, film, video or other visual representation, whether or not it was made by electronic or mechanical means,

(i) that shows a person who is or is depicted as being under the age of eighteen years and is engaged in or is depicted as engaged in explicit sexual activity, or

(ii) the dominant characteristic of which is the depiction, for a sexual purpose, of a sexual organ or the anal region of a person under the age of eighteen years;

(b) any written material, visual representation or audio recording that advocates or counsel’s sexual activity with a person under the age of eighteen years that would be an offence under this Act;

(c) any written material whose dominant characteristic is the description, for a sexual purpose, of sexual activity with a person under the age of eighteen years that would be an offence under this Act; or

(d) any audio recording that has as its dominant characteristic the description, presentation or representation, for a sexual purpose, of sexual activity with a person under the age of eighteen years that would be an offence under this Act.

(2) Every person who makes, prints, publishes or possesses for the purpose of publication any child pornography is guilty of an indictable offence and liable to imprisonment for a term of not more than 14 years and to a minimum punishment of imprisonment for a term of one year.

(3) Every person who transmits, makes available, distributes, sells, advertises, imports, exports or possesses for the purpose of transmission, making available, distribution, sale, advertising or exportation any child pornography is guilty of an indictable offence and liable to imprisonment for a term of not more than 14 years

(4) Every person who possesses any child pornography is guilty of

(a) an indictable offence and is liable to imprisonment for a term of not more than 10 years and to a minimum punishment of imprisonment for a term of one year; or

(b) an offence punishable on summary conviction and is liable to imprisonment for a term of not more than two years less a day and to a minimum punishment of imprisonment for a term of six months.

(4.1) Every person who accesses any child pornography is guilty of

(a) an indictable offence and is liable to imprisonment for a term of not more than 10 years and to a minimum punishment of imprisonment for a term of one year; or

(b) an offence punishable on summary conviction and is liable to imprisonment for a term of not more than two years less a day and to a minimum punishment of imprisonment for a term of six months.

If the target is under the age of 18, and their face was morphed into a pornographic picture or video that is made public, there is Case Law where the accused was arrested, charged and convicted for the possession, creation, and distribution of Child Pornography (R v H(C), 2010 ONCJ 270, R v Butler, 2011 NLTD(G)5, D(R) v S(G), 2011 BCSC 1118)

#13 - Indecent and Harassing Communications: Section 372(1)(2)(3) CCC

372 (1) Everyone commits an offence who, with intent to injure or alarm a person, conveys information that they know is false, or causes such information to be conveyed by letter or any means of telecommunication.

(2) Everyone commits an offence who, with intent to alarm or annoy a person, makes an indecent communication to that person or to any other person by a means of telecommunication.

(3) Everyone commits an offence who, without lawful excuse and with intent to harass a person, repeatedly communicates, or causes repeated communications to be made, with them by a means of telecommunication

If a picture or morphed picture/video is being digitally distributed publicly, then the aggressor could face being arrested and charged with “Indecent Communication” under section 372(1) of the Criminal Code. This could also include anyone who is weaponizing and sending unsolicited pornography to their target.

Case Law: R v Sean Michael O’Hare

#14 - Criminal Harassment: Section 264(1)(2) CCC

264 (1) No person shall, without lawful authority and knowing that another person is harassed or recklessly as to whether the other person is harassed, engage in conduct referred to in subsection (2) that causes that other person reasonably, in all the circumstances, to fear for their safety or the safety of anyone known to them.

(2) The conduct mentioned in subsection (1) consists of

(a) repeatedly following from place to place the other person or anyone known to them;

(b) repeatedly communicating with, either directly or indirectly, the other person or anyone known to them;

(c) besetting or watching the dwelling-house, or place where the other person, or anyone known to them, resides, works, carries on business or happens to be; or

(d) engaging in threatening conduct directed at the other person or any member of their family

If a real or morphed picture/video that is released publicly is used to harass a person in such a way to cause them to reasonably fear for their safety, then the aggressor could face being arrested and charged with “Criminal Harassment” under section 264(1) of the Criminal Code.

Other case where this section could be used:

• Constantly sending emails, text messages, Facebook or Instagram messages

• Sending multiple spoofed phone calls where there is no answer

Case Law: R v S.B., R v B.L.A, R v Erickson, R v Kordrostami, R v Labrentz, R v Amiri , R v Cholin

#15 - Defamatory Libel: Section 298 (1)(2) CCC:

298 (1) A defamatory libel is matter published, without lawful justification or excuse, that is likely to injure the reputation of any person by exposing him to hatred, contempt or ridicule, or that is designed to insult the person of or concerning whom it is published.

(2) A defamatory libel may be expressed directly or by insinuation or irony

(a) in words legibly marked on any substance; or

(b) by any object signifying a defamatory libel otherwise than by words.

This section could be used when the aggressor is:

• Using a morphed picture or intimate image where the likeness of the target is used and posted publicly.

• Sending intimate sexualized emails or text messages to others and spoofing the senders address to match that of the target

• ·Posting the targets face and sexualized messages on a website or social network

Case Law: R v. Simoes

#16 - Extortion: Section 346(1) CCC

346 (1) Every one commits extortion who, without reasonable justification or excuse and with intent to obtain anything, by threats, accusations, menaces or violence induces or attempts to induce any person, whether or not he is the person threatened, accused or menaced or to whom violence is shown, to do anything or cause anything to be done.

If a real or morphed intimate picture/video is being used as a form of blackmail, then the aggressor could face being arrested and charged with “Extortion” under section 346(1) of the Criminal Code.

Other situations that can be considered under this section:

• Doxxing

• Swatting

Case Law: R v McLean, R v. B.L.A. , R v Davis

#17 - Intimidation: Section 423 CCC

423 (1) Everyone is guilty of an indictable offence and liable to imprisonment for a term of not more than five years or is guilty of an offence punishable on summary conviction who, wrongfully and without lawful authority, for the purpose of compelling another person to abstain from doing anything that he or she has a lawful right to do, or to do anything that he or she has a lawful right to abstain from doing,

(a) uses violence or threats of violence to that person or their intimate partner or children, or injures the person’s property;

(b) intimidates or attempts to intimidate that person or a relative of that person by threats that, in Canada or elsewhere, violence or other injury will be done to or punishment inflicted on him or her or a relative of his or hers, or that the property of any of them will be damaged;

(c) persistently follows that person;

(d) hides any tools, clothes or other property owned or used by that person, or deprives him or her of them or hinders him or her in the use of them;

(e) with one or more other persons, follows that person, in a disorderly manner, on a highway;

(f) besets or watches the place where that person resides, works, carries on business or happens to be; or

(g) blocks or obstructs a highway.

When it comes to spyware, it’s the constant surveillance of the software that causes the intimidation to take place. Through the use of spyware, the aggressor now knows everything the target is doing, or where they are going, tracking their target through the GPS technology of a phone, vehicle, or even Apple’s new Air Tags.

Case Law: R v. Rouse, R v McCart , R v Boast

Conclusion:

Again, we believe that we need to move away from a siloed user-based prevention strategy approach, to a more offender-focused response. We need to hold those who use technology-based facilitated abuse criminally responsible for their actions. However, to do this, there are three significant challenges that must be overcome:

#1- Law enforcement needs the training and equipment to prove “beyond a reasonable doubt” that the aggressor identified is in fact the person responsible. Given technology and the anonymity of the internet, this can sometimes be very challenging. There is no doubt that identifying an aggressor is becoming more problematic with the increasing popularity of decentralized blockchain platforms where all interactions are protected by end-to-end encryption, and information shared and stored is held on a decentralized network of servers composed of devices of every user of the blockchain platform. The higher the number of users, the greater the capacity to stay anonymous.

#2- Many of the above noted Criminal Code sections have not been tested in a Canadian court of law specific to technology-facilitated abuse. Where we could find case law that supported a charge, we noted so in the article. However, given the recency of technology-facilitated abuse, it is going to take a couple of years for case law to develop specific to this ever-increasing challenge.

#3 - Crown Counsel, where appropriate and reasonable to do so, needs to be willing to take these sometimes very challenging cases on, under the domestic violence umbrella.

It is our hope that those in law enforcement who are tasked to enforce the Criminal Code of Canada, will become more educated on technology-facilitated abuse and the information contained in this article. It is our opinion that enforcement action needs to become more frequent specific to technology-facilitated abuse. Knowledge, and the understanding and application of that knowledge, is power. It is our belief that more education and training on this topic, specific to potential criminal code consequences, will lead to more charges being laid. As the Canadian courts start to rule on these cases, it will create more legal clarity (case law) specific to the criminal consequences associated with technology-facilitated abuse in all its forms.

Also, we believe that educating those who help survivors of technology-facilitated abuse, such as transition house workers, counsellors, and victim service worker is also important. By understanding possible criminal remedies, it will make workers better advocates when it comes to helping clients navigate the criminal justice system specific to this important topic.

Digital Food For Thought

The White Hatter