Devices that track, spy on cellphones found at Montreal's Trudeau airport

If you were recently at Montreal's Trudeau International Airport, someone may have been spying on your cellphone, a revelation that comes after a joint CBC/Radio-Canada investigation found electronic surveillance devices near Parliament Hill.

CBC Radio-Canada investigation already found electronic surveillance devices near Parliament Hill

A Radio-Canada reporter detected the presence of an IMSI catcher at Montreal's Trudeau International Airport on Feb. 21. (Charles Contant/CBC)

If you were recently at Montreal's Trudeau International Airport, someone may have been spying on your cellphone.

A Radio-Canada reporter detected the presence of an electronic surveillance device known as an IMSI catcher on Feb. 21, while waiting for a U.S.-bound flight.

The revelation comes after a joint CBC/Radio-Canada investigation earlier this week found electronic surveillance IMSI catchers have been used in the area near Parliament Hill in Ottawa.

The devices, sometimes known by the brand name of one model, StingRay, mimic a cellphone tower to interact with nearby phones and read the unique ID associated with a phone — the International Mobile Subscriber Identity.

They have been used by Canadian police and security authorities, foreign intelligence and even organized crime.

At Trudeau airport, Radio-Canada detected the catcher's presence through the use of a CryptoPhone — a cellphone look-alike that emits red alerts when a fake antenna tries to catch its signal.

Several red alerts were received, throughout the afternoon and early evening, in the section of the airport for U.S. departures.

Conversations listened to in real time?

ESD America, the U.S. supplier of the CryptoPhone, which specializes in counterintelligence, analyzed the alerts.

"The IMSI catcher that you were connected to was tracking the phone but almost likely had the ability to listen to calls," said Les Goldsmith, CEO of Las Vegas-based ESD America.

Goldsmith added that that specific model of the IMSI catcher could probably listen to calls in real time.

The alerts recorded by the CryptoPhone at the airport indicate, among other things, that the system that allows the phone to encrypt conversations had been disabled.

A special cellphone purchased by CBC and Radio-Canada that can detect when an IMSI catcher is trying to intercept it. It is made by ESD America. (CBC)
When asked who could possess that kind of equipment, Goldsmith told Radio-Canada, "Your government, or any other government."

Goldsmith also said that if the data on our phones were intercepted that day by an IMSI catcher at the airport, the same goes for all other mobile phones in the vicinity.

IMSI catchers can cover a half-kilometre radius in urban areas and a two-kilometre radius in open spaces.

Another security expert, who comes from a federal agency and whose identity Radio-Canada has agreed to protect, believes that various organizations could have deployed this IMSI catcher.

"The Montreal police covers Trudeau airport. The RCMP and CSIS [Canadian Security Intelligence Service] are also there," he said. "If you're trying to identify the presence of a targeted individual, it's plausible to do it with that equipment in a specific place like the Montreal airport.

"U.S. customs officers also have a fair presence at the airport. It would not surprise me at all that they too have deployed something like that."

Who is spying at Trudeau airport?

Radio-Canada could not uncover who deployed the IMSI catcher at Trudeau airport on Feb. 21.

Police and intelligence agencies refuse to talk about their investigative techniques.

However, Quebec's provincial police, the Sûreté du Québec, said that it does not have an IMSI interceptor, but it refuses to say whether it uses the interceptor of other police forces.

The U.S. Embassy refused to comment.

Meanwhile, Aéroports de Montréal, the corporation that runs the airport, said it does not use an IMSI catcher.

Radio-Canada got the same response from Transport Canada. The federal department added that "we do not know which organization, if any, would have used an IMSI catcher."

Translated from a report by Radio-Canada's Brigitte Bureau