Researchers have uncovered “possible links” between Ontario’s provincial police force and an Israel-based military-grade spyware maker called Paragon Solutions, raising questions about the extent and scope of Canadian authorities’ use of cyber weapons.
The new findings were published by the Citizen Lab at the University of Toronto, which tracks and identifies digital threats against civil society, and come three years after a parliamentary committee in Canada called for Ottawa to update the country’s privacy laws in the wake of press reports that the national police force was using spyware to hack mobile phone devices. No laws were ever passed to address the controversy.
The Citizen Lab, in a report published on Wednesday, found a possible technical link between Paragon, which sells a spyware known as Graphite to government clients, and entities based in Ontario, Canada, including one that used the address of the Ontario Provincial Police (OPP).
Paragon, which is now a US-owned company, does not disclose the names of its clients and did not comment on this story.
Like other spyware makers, the company has emphasized that it is meant to be used to fight serious crime and terrorism. But the company’s spyware, which can hack into any phone, was recently found to be used against an Italian journalist and several activists who support migrants. The Italian government has acknowledged it was a Paragon client and that the company has suspended its contract with Italy following revelations that the hacking software was used against members of civil society.
In a previous statement, a spokesperson said Paragon requires all of its users to “adhere to terms and conditions that preclude the illicit targeting of journalists and other civil society leaders”. A spokesperson added: “While we are not able to discuss individual customers, we have a zero-tolerance policy for violations of our terms of service.”
Canada’s use of spyware was a source of controversy in 2022, when the Royal Canadian Mounted Police admitted – in what was called a “remarkable” disclosure – that the national police force used spyware to infiltrate mobile devices and collect data. It said at the time that it only used the technology in serious cases, when other surveillance technology failed.
The Citizen Lab’s new report provides more detail about the use of spyware by Canadian authorities. Researchers said they found evidence of a “growing ecosystem” of spyware capability among Ontario-based police services. Researchers said public court records obtained by the Citizen Lab show that the OPP used a surveillance tool that was being used by the Royal Canadian Mounted Police in the course of a 2019 investigation to infect a mobile phone for remote interception of private communications.
Additionally, a 2023 judgement from the superior court of justice in Toronto described a joined investigation by Toronto police and York regional police services where investigators “considered” the use of a spyware surveillance tool, which in Canada is referred to as an “on-device investigative tool” (ODIT).
A 2023 search warrant application obtained by the Citizen Lab, which was prepared by the Toronto Police Service, also revealed that TPS has obtained an ODIT from an unknown source, and that the police were seeking authorization to use the software to intercept cellular communications through encrypted instant messaging applications.
“What these findings show is that there is a widening gap in public awareness regarding the extent to which spyware technology is being used in Canada,” said Kate Robertson, a senior researcher at the Lab. “These findings raise important questions for the government and privacy regulators about what technologies are being used, and underscores again the need for law reform to address the security and human rights risks concerned.”
The OPP did not immediately respond to a request for comment.
