RCMP stores explicit media flagged as child porn — even if it's not, Quebec court case reveals

CBC

18 hours ago

Every year, the RCMP receives tens of thousands of photos and videos of suspected child pornography from tech giants like Google or Meta, all per Canada's mandatory reporting laws.
But even though the majority of these images are not deemed harmful, the RCMP still plans to store them for 100 years.
This emerged after a Montreal lawyer argued that his client, accused of accessing child pornography via a messaging app, had his constitutional rights violated when AI software automatically flagged and forwarded the images to Canadian law enforcement.
"We ask the court to avoid abuses from a privacy point of view," said Félix-Antoine Doyon.
"Courts need to put their nose in the equation in order to balance the situation and in order to avoid the state collecting, again, private stuff from people who have done nothing illegal."
Back in July, his request for a stay of proceedings for his client was rejected in a Court of Quebec decision.
In his client's case, it was the messaging service Kik that forwarded imagery through the National Center for Missing and Exploited Children (NCMEC), a U.S. non-profit, to Canadian authorities.
Doyon argued the procedures constitute an unlawful search or seizure. The court, however, upheld the lawfulness of the process, stating that the actions of Kik and the NCMEC were in compliance with U.S. law and did not violate Canadian constitutional protections.
70% of reports dismissed, but content still stored
The case revealed that about 70 per cent of reports flagged by AI software are dismissed by the NCMEC, while the rest are sent to authorities, according to court documents.
According to the court decision, several factors can prevent a file from being referred to police, including when the reported material does not clearly meet the Criminal Code definition of child pornography — such as memes or humorous content deemed too minor to warrant resources — or when reports generated by AI without human validation turn out not to involve illegal content.
In Quebec, the RCMP's child exploitation unit found about 55 per cent of reports received in 2023 were not criminal and the cases were closed.
Doyon's request for a stay of proceedings revealed images collected remain with OCEAN, an RCMP-managed law enforcement database used to store information from reports of suspected child sexual exploitation online. Even if the report is closed, the data is retained for a century under the RCMP's policy, court documents show.
Access to OCEAN is strictly limited to police members working on online child exploitation investigations, documents say. Investigators can use information, such as IP addresses, to see if it matches previous reports or ongoing investigations, but OCEAN does not automatically share data with other databases.
While Doyon's request was rejected and his client's criminal case is continuing, he said he will take his argument to the Supreme Court of Canada if necessary.
Canada's privacy laws decades out of date, professor says
Any images, even personal photos, can be automatically reported by cloud services operating in Canada, according to Luc Lefebvre, president of Crypto.Québec, a Montreal-based non-profit that focuses on cybersecurity, privacy and technology.
"With the happening of machine learning and artificial intelligence, all the different cloud platforms are using these systems to automatically flag that kind of content," he said.
In Canada, companies must report suspected child sexual abuse online under mandatory reporting laws established in 2011 to protect children and aid law enforcement investigations.
Evan Light, a University of Toronto communications professor, said Canada's privacy laws are decades out of date and unable to deal with the current reality of technology and law enforcement.
"And so we have a pretty big open space in which law enforcement can essentially do what they please," he said.
Light said there is a conflict of interest when the government is asked to put "guardrails on its own ability to invade the privacy of people, and I think governments generally don't want to do that."