Ontario police forces are deploying commercial spyware that can remotely take over a suspect’s smartphone — reading encrypted messages, activating microphones and cameras, and logging every keystroke — and fighting to keep nearly every detail about the technology hidden from courts, defence lawyers, and the public.
An exclusive Toronto Star investigation published on Tuesday reveals the tools, known as on-device investigative tools (ODITs), go far beyond a wiretap — capturing screenshots, monitoring keypresses, and accessing encrypted communications with the target, completely unaware.
The Secret Program
Six Ontario police services — from the OPP down to Durham Regional — pool resources into a little-known provincial unit called the Joint Technical Assistance Centre (JTAC), which manages the ODIT program. The OPP leads it, and the province funds it.
JTAC sources the tools from a private vendor whose identity it keeps classified. It’s so classified that police forces must sign an agreement committing to abandon major prosecutions rather than disclose the vendor’s name in court — and the Crown in at least one active case may do exactly that.
Sponsored · Selkirk Copper Mines
In March last year, the University of Toronto’s Citizen Lab identified “possible links” between the OPP and Paragon Solutions, an Israeli firm selling military-grade spyware called Graphite to government clients. The OPP neither confirmed nor denied it.
Researchers previously found Paragon’s technology on the phones of journalists and human rights activists in Italy, prompting Amnesty International to call the discovery “alarming.” And Canada has no legislation regulating police use of commercial spyware.
In Court
The Star’s investigation centers on two active Ontario cases. In Project Fairfield, an auto-theft investigation in Windsor, police deployed an ODIT alongside traditional surveillance, resulting in 23 arrests, 279 charges, and more than $9 million in recovered vehicles. In Project Vegas, a Brampton opium-smuggling case against three brothers, the Crown’s case relies almost entirely on ODIT-derived evidence.
Defence lawyers in both cases are challenging the constitutionality of the warrants authorizing ODIT use, arguing police should have applied for search warrants rather than general warrants — since extracting data from a phone is functionally a search of the device. Federal prosecutors have refused to release more than 140 related documents, citing Section 37 of the Canada Evidence Act.
No Oversight
Ontario’s Information and Privacy Commissioner said the office is “closely monitoring” ODITs, and had previously flagged that none of the named police services consulted it before acquiring the tools. The Royal Canadian Mounted Police disclosed in a 2024 transparency bulletin that it used ODITs in 32 investigations between 2017 and 2022, and only three times since, each costing upward of half a million dollars per target, according to testimony before a parliamentary committee.
“If police want to make the case that use of spyware is justified, they need to do this in a transparent manner that fully explains the details and level of intrusiveness of the tool,” said Tamir Israel, the Canadian Civil Liberties Association’s director of privacy, surveillance and technology. “If the secrecy makes it impossible for police to provide the information courts need to assess these tools, then these tools are inappropriate for police investigations, and police should not be using them.”
Different vendors have vastly different track records on data handling and human rights. Without knowing who built the tool, neither the courts nor the public can assess the risk. “This is not a tool that police buy and operate themselves,” Israel wrote. “You cannot separate the vendor from the tool.”
Information for this story was found via the sources and companies mentioned. The author has no securities or affiliations related to the organizations discussed. Not a recommendation to buy or sell. Always do additional research and consult a professional before purchasing a security. The author holds no licenses.
