Ontario Police Are Using Spyware on Phones in Secret, and It Puts Women and Vulnerable People at Greater Risk
police spywareYOUR PHONE, INSIDE THEIR SYSTEM
Ontario police are using spyware that can enter and operate inside a person’s phone. This goes far beyond traditional surveillance. Most details about how the system works remain hidden because of court‑ordered secrecy and ongoing legal disputes.
ODITs: THE TOOL BEHIND IT
Court documents describe these systems as on‑device investigative tools, also called ODITs. They can access messages, photos, call logs, encrypted chats, and in some cases can remotely activate microphones or cameras. This is direct device intrusion rather than passive monitoring.
NOT A WIRETAP. A DEVICE TAKEOVER
A wiretap intercepts communications as they move between networks. ODITs operate inside the phone itself. Investigators can extract data that never travels across a network, including drafts, deleted files, and private app content.
USED ACROSS ONTARIO INVESTIGATIONS
Court records show that ODITs have already been used in major investigations across the province. They are coordinated through JTAC, a centralized unit that links multiple police services.
THE GENDERED RISK: HOW THIS TECHNOLOGY CAN BE TURNED AGAINST WOMEN
This is the part that is usually missing from public reporting. Any tool that gives police deep access to a person’s phone can also be used to stalk, monitor, intimidate, or harm women and other vulnerable people. This concern is not theoretical. Police forces across Canada have faced repeated allegations of sexual assault, harassment, coercion, and abuse of authority.
Survivors have reported officers using their position to access personal information, monitor movements, or retaliate when complaints are made. ODITs increase these risks because they provide unrestricted access to the most intimate parts of a person’s life. When a system is secret, unregulated, and shielded from public scrutiny, the risk of misuse becomes structural rather than hypothetical.
SECRECY IS A SAFETY ISSUE
Police and prosecutors are withholding basic information about ODITs. This includes the identity of the vendor, the technical capabilities of the tools, the safeguards that govern their use, the limits on authorization, and the existence of any audit trails. Without transparency, women, survivors, and marginalized communities have no way to know whether these tools are being used against them or whether misuse would ever be detected.
COURTS MAY NEVER SEE THE FULL DETAILS
In some cases, prosecutors have indicated they would rather abandon major criminal prosecutions than disclose information about the spyware. If courts cannot see how the system works, there is effectively no judicial oversight. This leaves the public with no assurance that the technology is being used lawfully or safely.
WHY VENDORS MATTER
ODITs are not built by police forces. They are purchased from private surveillance companies. This means that data handling practices depend on external vendors. Storage locations may be outside Canada. Vulnerabilities or backdoors may exist. Accountability becomes fragmented. When the public does not know the vendor, it becomes impossible to assess the safety risks, including the risk of internal misuse by individuals within police forces.
A GLOBAL COMMERCIAL SPYWARE MARKET
ODITs are part of a global industry that sells deep‑intrusion spyware to governments and law enforcement agencies. These tools are designed for maximum access with minimal visibility. This makes them powerful and dangerous.
ISRAELI CYBER SURVEILLANCE INDUSTRY
Citizen Lab and other researchers have documented that many of the world’s most advanced spyware systems originate from Israeli cyber‑intelligence companies.
NSO GROUP (PEGASUS)
Pegasus is capable of full device compromise. It has been used against journalists, activists, lawyers, and political figures. It has been linked to human rights abuses. NSO Group has been sued by WhatsApp and placed on the United States Entity List.
PARAGON SOLUTIONS (GRAPHITE)
Graphite is part of the same mercenary spyware market. It has been used in surveillance of journalists and civil society members in Europe. WhatsApp has reported disrupting campaigns linked to Paragon.
These examples show that commercial spyware is repeatedly used to target vulnerable groups, not only criminal suspects.
THE STRUCTURAL PROBLEM
The danger is not only the technology. The deeper problem is the normalization of hyper‑surveillance in a context where:
- police forces across Canada face ongoing sexual‑violence allegations
• marginalized communities already experience disproportionate policing
• oversight bodies lack the power to enforce transparency
• commercial spyware companies operate in secrecy
• courts may never see the full technical details
This creates conditions where the same tools used in criminal investigations can also be used to monitor women, survivors, activists, journalists, and marginalized communities. Public accountability becomes almost impossible.
References
Powell, B. (2026, May 19). Ontario police using on‑device investigative tools in criminal investigations while fighting disclosure in court. Toronto Star. https://www.thestar.com
Canadian Civil Liberties Association. (n.d.). Surveillance technologies and privacy concerns in Canada. https://ccla.org
Office of the Information and Privacy Commissioner of Ontario. (n.d.). Privacy and surveillance technology oversight. https://www.ipc.on.ca
University of Toronto, Citizen Lab. (n.d.). Pegasus spyware and mercenary surveillance industry research. https://citizenlab.ca
Meta Platforms, Inc. (2021). WhatsApp v. NSO Group legal filings and security advisory. https://about.fb.com
U.S. Department of Commerce. (2021). Entity List additions: NSO Group and related entities. https://www.commerce.gov
Parliament of Canada. (2024). Review of national security and law enforcement use of on‑device investigative tools and spyware systems. https://www.parl.ca
Royal Canadian Mounted Police. (2024). Transparency bulletin on on‑device investigative tools. https://rcmp-grc.gc.ca
Blogs
2026
