Babel X platform

Government institution

Royal Canadian Mounted Police

Head of the government institution or delegate for section 10 of the Privacy Act

Danielle Golden
Director of Privacy
Access to Information and Privacy Branch

Senior official or executive responsible for the privacy impact assessment

Chief Superintendent Richard Baylin
Director General, Covert Operations / Operational Information and Data Science

Name and description of the program or activity of the government institution

Federal Policing Tactical Internet Operational Support group

Legal authority for the program or activity

Section 18 of the Royal Canadian Mounted Police Act

Paragraph 14(1)(a) of the Royal Canadian Mounted Police Regulations

Standard or institution specific personal information bank

Operational Case Records, RCMP PPU 005

Criminal Operations Intelligence Records, RCMP PPU 015

National Security Investigations Records, RCMP PPU 025

Protection of Personnel and Government Property, RCMP PPU 055

Description of the project, initiative or change

With the advent of the internet, there has been a fundamental shift in how people communicate and interact. Today, billions of people around the world use the internet and social media to socialize, to conduct business, to keep up with the news, and to discover, discuss, and share information. While the internet and social media help to connect people and to facilitate a wide variety of legitimate and lawful interests, they also facilitate and support the conduct of illegitimate and unlawful activities, such as human trafficking, organized crime, terrorism, human rights abuses, war crimes, and fraud. The prolific use of the internet and social media sites has created new and critical sources of information about criminal activities and threat actors. That information is both necessary and relevant to policing and law enforcement, and for ensuring Canada's safety and security.

The collection and use of open-source information is directly related and essential to the RCMP's law enforcement and policing mandate. The RCMP's Tactical Internet Operational Support group operates functionally as the RCMP's national policy centre for the use of open-source information for intelligence and criminal investigations. The Tactical Internet Operational Support team was established in 2005 to respond to the increasing demand for support in internet-related investigations. It supports Federal Policing by conducting internet-based research in direct support of criminal investigations with a nexus to national security, drugs, organized crime and economic integrity. It is also assists the RCMP's national tactical enforcement priorities and criminal intelligence initiatives.

While the Tactical Internet Operational Support group is the policy centre for open-source activities, and itself an operational unit conducting searches of open-source information, other RCMP units are involved in open-source activities through their respective policing mandates. The RCMP uses internet research and on-line search tools organization-wide to search publicly available information pertinent to predicated investigations. Work done within other operating units of the RCMP falls to specially trained Open-Source Intelligence Practitioners. Their work helps the RCMP to identify and respond to threats of violence, acts of terrorism, and other potential federal violations within the scope of the Force's mandate.

Babel X

Designed and supported by Babel Street, an American-based software as a service provider, the Babel X platform allows users to locate and isolate publicly available information from social media sites, blogs, forums, news, and other on-line channels.

Although Babel X enables users to source and collect personal information, Babel X does not itself collect or retain data from open-source information searches (personal or otherwise). Babel Street is not a bulk data provider; it does not scrape information from the internet in support of its platform and does not create private or proprietary databases of information in the service of its customers. The software merely identifies data feeds for analysis, and helps customers analyze and organize data sources for review. Collections of data are driven and undertaken exclusively by the platform user.

Using Babel X, the RCMP can design and initiate highly specific searches of publicly available information. Searches can be customized using geospatial and temporal parameters and be filtered by topics of interest and other inputs. While searches of social media and other internet sites have historically been conducted using publicly available search engines, such as Google or Bing, Babel X allows the RCMP to tailor its search efforts and to narrow its search results. This leads to the identification of more specific, relevant, and accurate data feeds, and the collection of less ancillary data. It also improves the efficiency and effectiveness of the RCMP's open-source activities.

Purpose and scope of the privacy impact assessment

The objective of the privacy impact assessment was to ensure that the RCMP meets its legal obligations under the Privacy Act in relation to its use of Babel X (a third-party social media and analytics platform that supports targeted searches of social media and other internet sites), and to ensure that privacy risks associated with the identification and collection of open-source information using the platform are appropriately managed. The Babel X privacy impact assessment was also intended to help to identify and address public misconceptions associated with the RCMP's on-line search and collection activities.

Privacy analysis

Based on its assessment, privacy impacts associated with the collection, use, disclosure and retention of open-source information by the RCMP from social media and other internet sites using the Babel X platform are expected to be moderate. Recommendations from the privacy impact assessment process, once fully adopted, are expected to reduce those risks to a low (or acceptable) level.

Contrary to media and other reports of public concern, Babel X is not used by the RCMP to spy on or monitor web users. The platform cannot access, decipher, or unlock private data sources, and is not used to extract activity and other user information from private social media accounts. The platform is not used to gain access to or infiltrate internet sites requiring login credentials, or to access private content (including conversations otherwise hidden from search engines).

Potential impacts on the privacy of individuals will be managed by the RCMP through appropriate legal, policy and technical measures geared at the protection of their personal information.

A) Type of program or activity

Personal information is used for investigations and enforcement in a criminal context (for example, decisions may lead to criminal charges/sanctions or deportation for reasons of national security or criminal enforcement).

Level of risk to privacy: Elevated risk

B) Type of personal information involved and context

Personal information, with no contextual sensitivities after the time of collection, provided by the individual with consent to also use personal information held by another source.

Level of risk to privacy: Low risk

C) Program or activity partners and private sector involvement

Within the institution, with other government institutions, federal, provincial or territorial, and municipal governments and private sector organizations, international organizations and/or foreign governments.

Level of risk to privacy: Elevated risk

D) Duration of the program or activity

Long-term program or activity

Level of risk to privacy: Moderate risk

E) Program population

The program's use of personal information for external administrative purposes affects certain individuals.

Level of risk to privacy: Moderate risk

F) Technology and privacy

1. Does the new or substantially modified program or activity involve implementation of a new electronic system or the use of a new application or software, including collaborative software (or groupware), to support the program or activity in terms of the creation, collection or handling of personal information?

   Risk to privacy: Yes

2. Does the new or substantially modified program or activity require any modifications to information technology legacy systems?

   Risk to privacy: No

3. Does the new or substantially modified program or activity involve implementation of new technologies or one or more of the following activities:
   • Enhanced identification methods;

     Risk to privacy: No

   • Surveillance;

     Risk to privacy: No

   • Automated personal information analysis, personal information matching and knowledge discovery techniques?

     Risk to privacy: No

   Level of risk to privacy: Moderate risk

G) Personal information transmission

Information collected by the RCMP using Babel X may be shared or transmitted between groups internally who are involved in the conduct or support of investigations, or with law enforcement partners. The transmission of that data will be effected through secured network, or through the use of encrypted portable storage devices. While RCMP employees may use a force-issued encrypted portable storage device for the transmission of data exported from Babel X, the use of portable storage devices is subject to strict rules and policies. Data shared, if sensitive, will be encrypted prior to transfer.

Level of risk to privacy: Moderate risk

H) Potential risk that in the event of a privacy breach, there will be an impact on the individual or employee

Data collected by the RCMP through the Babel X platform is from the internet and is publicly available. As such, the privacy impacts on an individual in the event of a data breach are considered to be relatively low (since the individual themselves has made the information public). Risks to an individual could conceivably include inconvenience, embarrassment, or financial harm. Where information gleaned from an open-source activity results in a law enforcement action or criminal charges, the impact on an individual would naturally be higher.

Level of risk to privacy: Moderate risk