Ontario police using spyware to hack phones, trying to keep it secret

Ontario police have reportedly been using spyware to hack into phones without alerting their users.

In a new report, The Toronto Star reveals that Ontario Provincial Police (OPP) and Windsor Police Service (WPS) have been using what are known as “on‑device investigative tools,” or ODITs. Essentially, ODITs allow the user to hack into a phone or computer to extract sensitive data like screenshots, passwords, text messages and more.

Naturally, this raises many privacy and security concerns, but The Star notes that police and government lawyers have been fighting to keep their use of ODITs quiet. In fact, a court document filed in Windsor Superior Court reveals that the Crown may even abandon an ongoing prosecution into an alleged international auto-theft ring that involved the use of ODITs just to maintain secrecy surrounding the technology.

In particular, the Crown is arguing that details about how this spyware works must be kept secret if revealing them would jeopardize future investigations. It says that the defence would still get full access to whatever evidence might be gathered through ODITs, but it wouldn’t learn how it was obtained. And in a separate case against Brampton drug dealers, the Crown is relying almost entirely on evidence obtained by ODITs, to which defence lawyers say they need access to make a proper defence.

With all of that said, an RCMP spokesperson claimed to The Star that ODITs have only been used in three other cases since 2022 that involved particularly serious criminal and national security investigations. The technology can also cost $500,000 to deploy, a former senior intelligence officer and expert previously revealed to a parliamentary committee.

Speaking to The Star, Tamir Israel, the CCLA’s director of privacy, surveillance and technology, criticized police for their lack of disclosure surrounding ODITs. “If police want to make the case that use of spyware is justified, they need to do this in a transparent manner that fully explains the details and level of intrusiveness of the tool,” he said.

The Information and Privacy Commissioner of Ontario also told The Star that it’s concerned with these violations and said it’s “closely monitoring” the use of ODITs in the province. It added that “it is critical that police adopt and apply an appropriate transparency and accountability framework” related to the use of this tech.

The province’s privacy commissioner has also previously expressed concerns about police using new and emerging forms of tech, including investigative genetic genealogy. Radio-Canada also reported in 2023 that ODITs were being used by 13 different federal organizations, including the CRA, CRTC, RCMP and National Defence.

Source: The Toronto Star