Researchers have uncovered “possible links” between Ontario’s provincial police force and an Israel-based military-grade spyware maker called Paragon Solutions, raising questions about the extent and scope of Canadian authorities’ use of cyberweapons.
The new findings were published by the Citizen Lab at the University of Toronto, which tracks and identifies digital threats against civil society, and come three years after a parliamentary committee in Canada called for Ottawa to update the country’s privacy laws in the wake of press reports that the national police force had been using spyware to hack mobile phone devices. No laws were ever passed to address the controversy.
The Citizen Lab, in a report published on Wednesday, found a possible technical link between Paragon, which sells spyware known as Graphite to government clients, and entities based in Ontario, Canada, including one that used the address of the Ontario provincial police (OPP).
In a statement sent to the Guardian after this article was published, the OPP did not deny using spyware, but said: “In Canada, the interception of private communications requires judicial authorization in accordance with the Criminal Code, and is only used to advance serious criminal investigations. Such authorizations are subject to stringent criteria relating to designated offences defined in the Criminal Code.
“The OPP uses investigative tools and techniques in full compliance with the laws of Canada, including the Charter of Rights and Freedoms. Releasing information about specific investigative techniques and technology could jeopardize active investigations and threaten public and officer safety.”
Paragon, which is now a US-owned company, does not disclose the names of its clients and did not comment on this story.
Like other spyware makers, the company has emphasized that it is meant to be used to fight serious crime and terrorism. But the company’s spyware, which can hack into any phone, was recently found to have been used against an Italian journalist and several activists who support immigrants. The Italian government has acknowledged it was a Paragon client and that the company suspended its contract with Italy following revelations that the hacking software had been used against members of civil society.
In a previous statement, a spokesperson said Paragon requires all of its users to “adhere to terms and conditions that preclude the illicit targeting of journalists and other civil society leaders”. A spokesperson added: “While we are not able to discuss individual customers, we have a zero-tolerance policy for violations of our terms of service.”
Canada’s use of spyware was a source of controversy in 2022, when the Royal Canadian Mounted Police admitted – in what was called a “remarkable” disclosure – that the national police force had used spyware to infiltrate mobile devices and collect data. It said at the time that it had only used the technology in serious cases, when other surveillance technology had failed.
The Citizen Lab’s new report provides more detail about the use of spyware by Canadian authorities. Researchers said they found evidence of a “growing ecosystem” of spyware capability among Ontario-based police services. Researchers said public court records obtained by the Citizen Lab show that the OPP used a surveillance tool that was being used by the Royal Canadian Mounted Police in the course of a 2019 investigation to infect a mobile phone for remote interception of private communications.
Additionally, a 2023 judgment from the superior court of justice in Toronto described a joint investigation by Toronto police and York regional police services where investigators “considered” the use of a spyware surveillance tool, which in Canada is referred to as an “on-device investigative tool” (ODIT).
A 2023 search warrant application obtained by the Citizen Lab, which was prepared by the Toronto police service, also revealed that TPS had obtained an ODIT from an unknown source, and that the police had been seeking authorization to use the software to intercept cellular communications through encrypted instant-messaging applications.
“What these findings show is that there is a widening gap in public awareness regarding the extent to which spyware technology is being used in Canada,” said Kate Robertson, a senior researcher at the lab. “These findings raise important questions for the government and privacy regulators about what technologies are being used, and underscores again the need for law reform to address the security and human rights risks concerned.”
