COURT FILE NO.: 23-13378-MO
DATE: 2023/12/06
SUPERIOR COURT OF JUSTICE - ONTARIO
RE: In the Matter of an Application Pursuant to s. 490(3) of the Criminal Code for an Order for the Further Detention of Things Seized
BEFORE: Carter J.
COUNSEL: Sonia Beauchamp Counsel, for the Crown Cassandra Richards Counsel, for the Respondent
HEARD: December 1, 2023
REASONS FOR DECISION ON APPLICATION
[1] 44 nonillion - or to be more precise 44 012 666 865 176 569 775 543 212 890 625.
[2] That is the number of potential passcodes that exist for each of three phones seized by the Ottawa Police. Over the past year, forensic investigators have tried about 175 million different passcodes in an effort to view the contents of the phones but have had no success. They wish to keep trying for another two years. The issue on this application is whether the Court should grant an order allowing them to do so.
[3] By way of background, an investigation commenced when the Ottawa Police were notified that the user of a Google account had uploaded images of child pornography. Pursuant to a warrant, several electronic devices were seized on October 19, 2022. Police were not able to access the Google account in question via the devices. All the devices that were seized have been returned, except for three phones linked to the Respondent.
[4] The three phones have been subject to a series of detention orders pursuant to s. 490 of the Criminal Code, although there was a lapse in January and February and again in May 2023. The last detention order in place was made on September 8, 2023, at which time Wadden J. ordered the further detention of the phones until October 18, 2023. In so doing, however, he
expressed concern about the lack of evidence before him as to the exact steps the police were taking and the potential timelines.
[5] The Applicant filed notice on October 12, 2023, for a further detention order pursuant to s. 490(3). The application was perfected in late November. It was heard by this Court on December 1, 2023, approximately six weeks after the expiration of the last detention order. The primary question on this application is whether a further order of detention ought to be made, either pursuant to s. 490(3) or s. 490(9.1) of the Code.
THE JURISDICTIONAL BASIS FOR THE APPLICATION: S. 490(3) OR 490(9.1)?
[6] A preliminary issue arises.
[7] The Respondent submits that to benefit from the statutory requirements pursuant to s. 490(3) of the Code, the application must be started or heard prior to the lapse of the detention order. Here, the matter was not spoken to in court until after the detention order had expired and therefore the Crown cannot rely on s. 490(3). Instead, it is argued that the Court should convert the application to one under s. 490(9.1), which applies to situations where there is no current detention order in place.
[8] The Crown argues that the application has been properly bought under s. 490(3). All that is required for the provision to be operative is that notice be provided prior to the expiry of the last detention order. In this case, the Crown filed notice six days prior to the expiry of the prior detention order.
[9] I would note that, on this issue, the wording in s. 490(3) is far from clear. The language in question is emphasized in the subsection as set out below:
(3) More than one order for further detention may be made under paragraph (2)(a) but the cumulative period of detention shall not exceed one year from the day of the seizure, or
any longer period that ends when an application made under paragraph (a) is decided, unless
(a) a judge of a superior court of criminal jurisdiction or a judge as defined in section 552, on the making of a summary application to him after three clear days notice thereof to the person from whom the thing detained was seized, is satisfied, having regard to the complex nature of the investigation, that the further detention of the thing seized is warranted for a specified period and subject to such other conditions as the judge considers just, and the judge so orders; or
(b) proceedings are instituted in which the thing detained may be required.
[10] In Further Detention of Things Seized (Re), 2021 BCSC 1323 at para. 109, Riley J. commented on the subsection as follows:
Since the prior detention order expired before the application was perfected and spoken to in court, the s. 490(3) application was brought out of time. To be clear, the approach I have described herein accounts for the phrase “or any longer period that ends when an application made under [this subsection] is decided” as set out in s. 490(3). That language effectively provides that where the application process begins before the expiry of the existing detention order, the detention order continues until the application for an extension is decided. But, in my view, the application process does not begin until the application for further detention is perfected and spoken to in court, however briefly; the application does not have to be decided, but it has to be perfected [emphasis added].
[11] The difficulty I have with this interpretation is that it does not accord with the actual wording of s. 490(3). The subsection simply does not contain a condition that the application process must begin before the expiry of the existing detention. In fact, the section is so poorly worded that I am unable to say that this can even be inferred from the language that is used.
[12] In any event, for reasons set out below, I need not decide the issue. Whether the application is considered under s. 490(3) or s. 490(9.1), the result is the same. A further detention order is not warranted.
THE FURTHER DETENTION OF THE SEIZED ITEMS
[13] The scheme for the detention of seized items is contained in ss. 489.1 and 490 of the
Criminal Code.
[14] Where the police wish to keep something seized during the execution of their duties, s.
489.1 requires that they make a report to a justice “as soon as is practicable”. A report filed under s. 489.1 allows the seized items to be dealt with in accordance with s. 490(1), which grants a justice the power to order the things seized detained or returned. The balance of s. 490 contains numerous provisions governing the continued detention, use, and return of seized property.
[15] The level of judicial authorization and the threshold to be met to justify detention increases the longer the items are detained. Section 490(1), which applies to the initial detention, only requires the Crown to show before a justice that the property is required for the purposes of an investigation. Section 490(2) mandates that nothing shall be detained beyond an initial three- month detention period unless the applicant shows to a justice that, “having regard to the nature of the investigation”, its further detention is warranted. Section 490(3) stipulates that nothing can be detained for a period greater than one year, unless a judge of a superior court is satisfied, having regard to the “complex nature of the investigation”, that a further period of detention is warranted: R. v. Churchill, 2021 NLSC 179 at para. 11.
[16] The cases dealing with s. 490(3) have largely focused on the complexity of the investigation. It is often taken as a given that whatever items have been seized have value in terms of a potential prosecution. The applications tend to turn on whether the investigation is sufficiently complex such that holding the seized items for a further period of time is justified while it continues: see for example Canada Revenue Agency v. Okoroafor, 2010 ONSC 2477, 2010 O N SC 2477.
[17] The issue here is somewhat different. It is not a question of holding on to the phones while the rest of the investigation unfolds. To a large extent, the phones are the investigation. They have no value in and of themselves at the moment. Their value for a criminal prosecution will only be realized if the passwords are cracked and evidence of an offence is uncovered on them.
[18] At this stage, the investigation is really only complex to the extent that trying to discover the passwords is difficult. While the challenge of cracking a phone can be considered complex (R v. Seguin, 2015 ONSC 1908 at para. 4), that does not end the analysis. The Crown must also demonstrate that the further detention of the phones is “warranted” in light of that complexity: Further Detention of Things Seized (Re), 2021 BCSC 1323 at para. 125.
[19] In my view, the evidence on this application establishes that further detention of the phones is not warranted because there is little hope that the passwords will be cracked in a reasonable period of time.
[20] All three phones use complex-alpha-numeric passcodes. The only way to obtain these passcodes it through a brute force process. A specialized software application utilizes a pre- defined dictionary and attempts to "guess" the passcode and unlock the device. The "guess" is simply the application selecting each passcode, one at a time from the dictionary, and using it to attempt to unlock the device. Commonly known as a dictionary attack, this relies on pre-set word lists collected from various sources.
[21] Newer Android based devices perform brute force attacks at rates between 2500 and 4000 passcodes per minute. A 30 million passcode dictionary, if exhausted, would take approximately eight days to complete. These word lists are generally limited to common English language words including some special characters, and "Leet" speak (where letters are replaced with numbers or special characters, for example, "fear" becomes "f34r", "leet" becomes "133t", "Alert" becomes "@lert".Leet is commonly used in passcode creation to increase the complexity of the passcode, making it more difficult to obtain.
[22] The success of brute forcing complex alphanumeric passcodes depends entirely on the passcode used being present in the dictionary to which the device passcode is being compared. Various dictionaries are used by th e O tta w a P o lic e , most of which have been compiled from Open Source lists.
[23] A new program has recently been implemented by the forensic unit called "Mentalist" which is able to create dictionaries using pre-set words and character combinations, as well as number/character substitutions to generate "Leet" dictionaries. Existing password lists are being converted to "Leet" using this application and being used to attempt brute-forcing where this method has previously failed. This resource can convert a single eight character English language word and generate over 2 million "Leet" words.
[24] Investigators have already tried the popular cellular device passcode dictionaries available to them. They have also tried some specialized dictionaries which relate to the subject's interests. Using these dictionaries, they have attempted about 175 million different passcodes over the past year.
[25] If a further order of detention is made, the plan would be to keep trying the specialized dictionaries. Mentalist would also be used to help generate more of these subject specific dictionaries. In fact, Cst. David Fong, a digital forensic investigator who is working on cracking the passcodes, testified that using Mentalist he could create more dictionaries than he would be able to use in his lifetime. In contrast, they have not attempted to locate additional dictionaries in the open market as the belief is these will not be effective.
[26] I return to the numbers I set out at the beginning of the decision. There are 44, 012, 666, 865, 176, 569, 775, 543, 212, 890, 625 potential passcodes for each of the three phones. It has taken a year to try 175,000,000 of them. Without setting out an exact percentage, it is safe to say that only an infinitesimal number of the potential passcodes have been attempted.
[27] The Crown is asking for an order to find a needle in a very large haystack. While it is certainly “possible” that they may find the needle in the next two years (the length of the detention order they seek), the odds are so incredibly low as to be virtually non-existent. This is an important consideration when determining whether a further detention order is warranted.
[28] The overall objective of s. 490 of the Code is to achieve a fair balance between the property rights of individuals and the state’s legitimate interest in preserving evidence during an on-going investigation into criminal activity: R. v. Classic Smokehouse and Leader Cold Storage, 2012 BCPC 232, 2012 BCPC 0232 at para. 14l.
[29] Here, the evidentiary value of the phones is non-existent at this point. A further detention order is highly unlikely to change that. On the other hand, the individual’s interest in the phones is high. From a property perspective, phones have value as a tool. From a privacy perspective, they are akin to computers and can store a significant amount of personal information.
[30] A detention order for a further six months, two years, or even a decade will not alter the calculus in any meaningful way. The phones will continue to have almost no evidentiary value. The Respondent’s property and privacy interests in them will remain high. As a result, I conclude that a further detention order is not warranted.
[31] Two additional points.
[32] First, in making this order I am not placing a “time limit” on the police investigation: Okoroafor at para. 18. The investigation can continue without the phones. In fact, an MLAT request has been submitted and will make its way to the United States in order to attempt to obtain the data from Google. This strikes me as a potentially more fruitful avenue of investigation than using brute force to enter the phones.
[33] Second, the Respondent has brought an application for the return or destruction of the phones. The focus on the hearing was the continued detention order. As a result, I did not hear extensive submissions on the Respondent’s application. The parties can arrange for a time to have the application heard before me if they are unable to reach an agreement on a draft order.
Carter J.
Date: December 6, 2023
COURT FILE NO.: 23-13378-MO
DATE: 2023/12/06
ONTARIO
SUPERIOR COURT OF JUSTICE
RE:In the Matter of an Application Pursuant to s. 490(3) of the Criminal Code for an Order for the Further Detention of Things Seized
BEFORE: Carter J.
COUNSEL: Sonia Beauchamp Counsel, for the Crown Cassandra Richards Counsel, for the Respondent
REASONS FOR DECISON ON APPLICATION
Carter J.
Released: December 6, 2023