As of May 20, 2026, Ontario police services are quietly deploying some of the most intrusive digital investigative tools available to law enforcement worldwide. A bombshell Toronto Star investigation published yesterday revealed that the Ontario Provincial Police (OPP), through its Joint Technical Assistance Centre (JTAC), is using commercial “On-Device Investigative Tools” (ODITs)—essentially spyware—to hack into suspects’ smartphones and computers remotely. These tools grant near-total access: encrypted messages, keystrokes, screenshots, photos, real-time microphone and camera activation, all without the target’s knowledge.
This is not mass surveillance. Police emphasize that every deployment requires judicial authorization under the Criminal Code—typically a general warrant paired with wiretap authority—and is reserved for the most serious cases involving organized crime, encryption barriers, or threats like auto-theft rings and drug smuggling. Yet the extreme secrecy surrounding the programs, combined with the OPP’s long-standing relationship with Palantir Technologies’ Gotham analytics platform and the RCMP’s documented history with similar spyware, paints a picture of a policing apparatus increasingly reliant on high-tech, low-transparency tools.
Now, with Bill C-22 (the Lawful Access Act) moving through committee in the House of Commons, critics warn that the legal and technical foundations are being laid to make such capabilities easier to deploy at scale—potentially with lower evidentiary thresholds and broader obligations on tech companies.
The OPP’s ODIT Program: Targeted Hacking, Heavy Secrecy
The JTAC, led and funded by the OPP but serving multiple Greater Toronto Area services, acts as the central hub for these operations. Court records from Project Fairfield (Windsor, 2022–2023) explicitly authorized ODITs alongside traditional wiretaps, leading to 23 arrests and the recovery of roughly $9 million in stolen vehicles. A similar tool was pivotal in Project Vegas, an opium-smuggling probe in Brampton.
Once deployed—often via malware or zero-click exploits—ODITs bypass encryption on apps like WhatsApp and Signal. Defence lawyers in the Windsor cases are challenging the warrants, arguing judges were not fully briefed on the tools’ scope and that non-disclosure agreements with private vendors could force prosecutors to drop cases rather than reveal capabilities in open court. Privacy advocates, including the Canadian Civil Liberties Association and Ontario’s Information and Privacy Commissioner, have called for greater transparency, warning that such secrecy undermines Charter rights and judicial oversight.
Police stress rarity and necessity: these are targeted tools for cracking the hardest cases where encryption otherwise creates a “going dark” problem.
Palantir Gotham: The OPP’s “Supercharged Database” for Intelligence and Potential Predictive Policing
Parallel to the device-hacking tools, the Ontario Provincial Police (OPP) has maintained a close and largely opaque relationship with Palantir Technologies since at least 2015. The force uses the company’s flagship Gotham platform to ingest and fuse disparate data sources—crime reports, arrest records, license-plate reader (ALPR) hits, social-network mappings, physical descriptions, tattoos, vehicle information, and relational links—into a single, searchable “knowledge graph.” This creates a living digital map of people, places, events, and connections that analysts can query in real time. A 2023 contract, reportedly worth tens of millions of dollars, was awarded through a competitive process but with limited public oversight via a special exemption under Ontario’s Financial Administration Act. The OPP has declined to disclose precisely how the platform is configured or which features are active, citing the protection of “investigative and intelligence techniques.”
So what exactly is Gotham? Marketed by Palantir as an “operating system for global decision-making,” it is an AI-enabled data-integration and analytics platform originally developed for intelligence and defence clients. At its core is an “ontology”—a semantic layer that automatically extracts entities (a person, a car, a phone number, a social-media post) from raw data and links them through relationships (associates, co-travellers, financial ties). The result is a dynamic knowledge graph that lets users visualize networks, detect patterns, and generate insights far beyond what traditional databases allow. Recent upgrades, including the 2026-era Gotham Europa release, add enhanced AI for faster threat detection, common operating pictures (COPs), and common intelligence pictures (CIPs) across agencies. In law-enforcement terms, Gotham turns siloed records into a unified intelligence engine.
What does it actually do in policing? It enables risk scoring of individuals, chronic offender identification, network mapping of gangs or organized crime groups, geospatial hotspot analysis, and pattern detection that can drive proactive operations. Officers or analysts can search by granular traits—race, gender, associations, tattoos, or even “possible involved activities”—and instantly surface linked documents, travel histories, or social connections. In practice, this has produced “Chronic Offender Bulletins” or target lists used to allocate patrols, conduct interventions, or build investigative leads. It is not a standalone “predictive policing” algorithm like PredPol. Instead, Gotham’s design facilitates predictive-style policing by turning raw data into actionable intelligence at scale.
The OPP is far from alone in Canada. The Calgary Police Service has used Gotham since approximately 2013 for data integration, social-network visualization, and mapping of crime and calls for service. Calgary publicly states it does not activate the platform’s full algorithmic or predictive features—no social-media scraping, no telecom or financial data integration, no automated risk scores. Yet even this more limited deployment stores rich personal profiles that include physical characteristics, relationships, and police contacts, raising privacy-impact concerns flagged in earlier assessments.
Elsewhere, Gotham’s track record has been far more controversial. In New Orleans (2012–2018), the NOPD secretly used the platform—initially funded through a philanthropic backdoor—to analyze police reports, social media, jailhouse calls, and gang databases. It generated lists of roughly 3,900 high-risk residents judged likely to commit or become victims of gun violence. The program operated without City Council knowledge, produced gang scorecards, and became integral to racketeering prosecutions before being quietly terminated amid public backlash. In Los Angeles, Gotham powered Operation LASER, which assigned “chronic offender” scores based on 160+ data points and distributed department-wide bulletins with photos and personal details. An LAPD inspector-general audit later found significant inconsistencies in data handling, over-targeting, and little evidence of measurable crime-reduction impact.
Neither the ODIT program nor Gotham constitutes mass surveillance of the general public today. Both remain ostensibly limited to serious criminal investigations and require judicial authorization where applicable. Yet they operate behind layers of secrecy—NDAs, vendor protections, and limited disclosure—that critics say erode Charter rights, judicial oversight, and public trust.
The RCMP Precedent: Decades of ODIT Use, Explicitly Not Pegasus — But Ties to Israeli Spyware Persist Through Collaboration and Secrecy
Ontario is not alone in embracing these powerful tools. In June and July 2022, the RCMP made a striking admission before Parliament’s Standing Committee on Access to Information, Privacy and Ethics (ETHI). Under questioning, senior officials revealed that the national police force had been using “on-device investigative tools” (ODITs)—the law-enforcement euphemism for commercial spyware—since at least 2002. A dedicated Covert Access and Intercept Team (CAIT) was formally stood up in 2016. Between 2017 and 2022 alone, the RCMP deployed the technology in 32 investigations, successfully compromising 49 mobile devices.
The capabilities they described were virtually identical to those now publicly documented in the OPP’s JTAC operations: full remote device takeover, extraction of encrypted messages from apps such as WhatsApp and Signal, real-time screenshots, keystroke logging, and the ability to activate a phone’s microphone and camera without the owner’s knowledge. Then-RCMP Commissioner Brenda Lucki and Deputy Commissioner Bryan Larkin emphasized that every deployment required judicial authorization and was reserved for the most serious cases where encryption otherwise blocked lawful intercepts.
Yet the most politically charged question centred on the origin of the tools. Committee members repeatedly pressed whether the RCMP had ever used Pegasus, the notorious spyware developed by Israel’s NSO Group. Both the commissioner and the Public Safety Minister stated unequivocally—and under oath—that the RCMP had never procured, never used, and never deployed Pegasus or any other product from NSO Group. They insisted they relied instead on “other unnamed commercial vendors” and refused to identify them, citing national-security and operational sensitivities.
That narrow denial has never been publicly contradicted with forensic or documentary evidence specific to the RCMP and NSO. No leaked contracts, no Citizen Lab forensic matches, and no court records have surfaced showing NSO code on devices investigated by the Mounties. The RCMP’s position remains that its ODITs come from different suppliers.
However, the broader picture of Canadian police engagement with Israeli-origin spyware is more complicated—and the secrecy surrounding vendors has fuelled persistent skepticism. In March 2025, the University of Toronto’s Citizen Lab published technical evidence linking one Paragon Solutions customer (using the alias “C10862989”) to the exact physical address of Ontario Provincial Police General Headquarters in Orillia. Paragon, another Israeli firm founded in 2019, sells Graphite—a military-grade spyware suite with capabilities that closely mirror both Pegasus and the ODITs described in Canadian court records. The report also documented a “growing ecosystem” of spyware capability across Ontario police services, including Toronto, Peel, York, Durham, and others.
Crucially, public court records obtained by Citizen Lab show that as early as 2019, the OPP itself used RCMP-supplied ODITs to infect a mobile device in the course of a major investigation. In other words, even if the RCMP avoided NSO’s Pegasus, tools supplied by the national force to provincial partners may have come from vendors within the same Israeli-dominated spyware marketplace. The RCMP’s refusal to name its suppliers, combined with strict non-disclosure agreements and the possibility that prosecutions could be dropped rather than reveal technical details in open court, means independent verification remains impossible.
Critics, including privacy commissioners, defence lawyers, and civil-liberties groups, argue this opacity is the real issue. While the RCMP’s explicit denial of NSO technology stands unchallenged on the public record, the functional equivalence of the tools—and the documented presence of another Israeli firm (Paragon) in the OPP’s orbit—suggests Canadian law enforcement has still tapped into the same global ecosystem that produced Pegasus. The 2022 revelations prompted calls for stronger oversight and parliamentary reporting requirements, but no sweeping legislative reforms followed. Instead, the same model of secretive, vendor-protected spyware has quietly expanded to provincial forces through JTAC.
Bill C-22: Modernizing Lawful Access—or Lowering the Thresholds?
Introduced March 12, 2026, Bill C-22 (the Lawful Access Act) is the federal government’s latest attempt to update rules for police and CSIS access to digital data. It remains in committee as of May 20, 2026. Proponents, including police chiefs and Public Safety Canada, frame it as essential for fighting online extortion, human trafficking, and encrypted crime—tools that respect the Charter while giving investigators “timely” access.
Key provisions include lowered evidentiary standards for some data requests (from “reasonable grounds to believe” to “reasonable grounds to suspect”), expanded warrants covering “similar unknown” devices, mandatory technical capabilities for electronic service providers, and potential metadata retention requirements. The government insists this creates no new interception authorities—only makes existing ones technically feasible and faster. It is not mass surveillance; access still requires warrants or exigent circumstances.
Yet legal scholars like University of Ottawa’s Michael Geist and groups such as the Canadian Constitution Foundation, Canadian Civil Liberties Association, the Electronic Frontier Foundation, and tech companies including Apple and Meta warn of a “hidden tradeoff.” The lowered thresholds, combined with mandatory technical backdoors and metadata retention, could dramatically expand the volume and ease of surveillance. Encryption could be undermined indirectly.
In the context of OPP ODITs, RCMP history, and Palantir analytics, Bill C-22’s vagueness around “authorized access” and provider obligations raises the prospect that tomorrow’s targeted tools could become more routine—and harder to challenge in court due to secrecy provisions.
The Bigger Picture: Security, Privacy, and the Need for Scrutiny
While Ontario police services and the RCMP maintain that they are not running a dragnet on every citizen’s phone and insist that ODIT deployments remain judicially authorized, rare, and focused exclusively on serious crime, the extreme secrecy these programs maintain makes such claims impossible to independently verify. With critical details shielded by ironclad non-disclosure agreements with third-party corporate vendors — from the unnamed suppliers of the spyware tools to Palantir Technologies itself — the public, defence lawyers, and even some oversight bodies are largely forced to accept official assurances at face value. Just because authorities say a dragnet is not happening does not mean one is not underway, or could not be quietly expanded.
Palantir Gotham is officially described as an intelligence-analysis platform rather than a predictive “pre-crime” engine, and Bill C-22 continues to be pitched by the government as a simple technical modernization rather than a significant expansion of state surveillance powers.
But extraordinarily intrusive capabilities developed and operated in secrecy, with private corporations protected by NDAs so restrictive that prosecutors have, in some cases, been prepared to drop charges rather than reveal how the tools work. Defence lawyers, privacy commissioners, and civil-liberties organizations warn that this opacity risks eroding democratic accountability, amplifying systemic biases in data-driven policing, and gradually tilting the balance of power heavily toward the state.
As Bill C-22 advances through committee, Canadians deserve far more than reassurances. They deserve genuine transparency, robust independent oversight, and a full parliamentary debate on whether the legal framework now being constructed will genuinely keep these powerful tools narrowly targeted — or quietly pave the way for far broader digital surveillance in the years ahead. The technology already exists. The real question is whether meaningful guardrails will be put in place before it is too late.