When a Smartphone Becomes a Surveillance Tool

Understanding Police Use of ODITs in Canada

Presumption of Innocence Canada | Public legal education

For most people, a smartphone is much more than a telephone. It may contain years of photographs, private conversations, medical information, financial records, location history, internet searches and communications with family members, employers, doctors or lawyers. It can also provide access to information stored elsewhere through email accounts, messaging applications and cloud services.

That is why recent reporting about Canadian police use of smartphone surveillance technology has attracted attention. A Toronto Star investigation published in May 2026 examined the use of what police call "on-device investigative tools," or ODITs, by the Ontario Provincial Police and several municipal police services. The RCMP has separately acknowledged using ODITs in a limited number of serious investigations since 2017.

An ODIT is software that can be covertly installed on a smartphone, computer or other electronic device. Depending on the particular tool, device and judicial authorization, it may allow investigators to collect information directly from the device, including communications that would otherwise be protected by encryption. Reported capabilities include capturing screenshots, recording keystrokes, obtaining stored messages and photographs, tracking a device's location, and activating its microphone or camera.

These capabilities can assist police in investigating serious offences. They also raise significant questions about privacy, judicial authorization, the handling of information belonging to third parties and the ability of an accused person to understand and challenge evidence collected through a technology whose operation may remain secret.

What is an on-device investigative tool?

Encryption has changed how private communications are protected. Some messaging services encrypt a message while it travels between devices, making it difficult for anyone other than the sender and recipient to read it in transit. An ODIT may avoid that barrier by collecting the information at one of the endpoints-on the device where the message is written, displayed or stored.

This distinction is important. A conventional wiretap generally intercepts a communication while it is occurring. An ODIT may provide access to several different types of information through the same device. The 2022 report of the House of Commons Standing Committee on Access to Information, Privacy and Ethics described possible functions that include obtaining texts and emails, collecting device identifiers, monitoring internet searches and application use, recording live audio, tracking location and, in some circumstances, exercising remote control over the targeted device.

Not every ODIT necessarily has every capability, and not every authorized use permits investigators to activate every available function. The parliamentary committee heard that functions vary according to the software, operating system, device and telecommunications service.

The scope of an actual search therefore depends on several separate questions: what the software is technically capable of doing, which functions police configured, what the judicial order authorized, what information was actually collected and how investigators handled information outside the authorized investigation.

Why ODITs are different from an ordinary phone search

Canadian courts have recognized that smartphones can reveal an extensive picture of a person's private life. An ODIT adds another dimension because surveillance may occur remotely, without the owner knowing, while the device continues to be used. It can follow the person between private settings and collect information as it is created, rather than only what was stored when a device was seized.

It may also collect information involving people who are not under investigation. A target's family members, friends, coworkers, medical providers and legal counsel may communicate through the same device. A microphone could capture the voices of anyone nearby. Location information can disclose visits to medical clinics, religious institutions, political meetings or private residences.

These effects do not mean every use is unlawful. They explain why limits in the judicial authorization and safeguards for privileged or unrelated communications matter.

What the RCMP has publicly acknowledged

The RCMP's use of ODITs became a matter of public discussion in 2022 after information emerged through a response to a question in Parliament. According to material collected by the Office of the Privacy Commissioner of Canada, the RCMP's Covert Access and Intercept Team was created in 2016, and the Privacy Commissioner had not been consulted before the program began.

During the parliamentary committee's study, RCMP representatives said ODITs had been deployed in 32 investigations from 2017 through the period examined by the committee, targeting 49 devices. The reported investigations involved offences such as terrorism, serious drug trafficking, murder, organized crime, money laundering, fraud, kidnapping, criminal harassment, breach of trust and certain forms of cybercrime.

The RCMP told the committee that ODITs are used rarely, for limited periods and against identified targets-not for indiscriminate or mass surveillance. It also said that only approximately one in ten investigative requests for an ODIT had resulted in deployment. In response to the Toronto Star in 2026, the RCMP reportedly stated that the technology had been used in three additional investigations since 2022.

Those figures are important for context. Publicly available information does not establish that Canadian authorities are using ODITs for mass surveillance. It does establish that police possess a capability that can be highly intrusive when directed at an individual device.

How police say authorization is obtained

Part VI of the Criminal Code governs the interception of private communications. Section 184 generally prohibits knowingly intercepting a private communication by means of a device, subject to listed exceptions, including interception carried out under lawful authorization.

RCMP representatives told the parliamentary committee that an ODIT deployment can require several judicial orders, sometimes collected into an omnibus order. Depending on the functions being used, these may include an authorization to intercept private communications, a general warrant for deployment and operation of the technology, a transmission-data recorder warrant, a tracking warrant, a sealing order and an assistance order.

The RCMP says its internal process involves consultation, chain-of-command approval and participation by a Crown prosecutor. Investigators are encouraged to consider less intrusive techniques, and requests affecting certain groups-including journalists, parliamentarians and religious or educational institutions-require additional approval.

Judicial authorization is an essential safeguard, but it does not end every legal question. A judge can authorize only what the law permits and must receive enough accurate information to evaluate the proposed search. Later proceedings may examine whether the correct form of authorization was obtained, whether important information was omitted from the application, whether police remained within the order's limits and what remedy is appropriate if a Charter right was infringed.

The Ontario investigations bringing ODITs into court

The Toronto Star investigation examined court proceedings connected with two Ontario police investigations. Many of the relevant issues remain before the courts, and some records are sealed or subject to publication restrictions. Claims made by the defence are arguments to be decided, not findings of fact.

In Project Fairfield, the OPP and Windsor Police Service investigated an alleged international auto-theft operation. According to the reporting, investigators obtained authorization in 2023 for several techniques, including ODITs. Police later announced 23 arrests, 279 charges and the recovery of vehicles valued at more than $9 million.

Defence lawyers are challenging aspects of the authorization. They reportedly argue that police did not provide the authorizing judge with all relevant information concerning the technology and related documentation. They also question whether a general warrant was the correct legal mechanism for remotely entering a device and extracting data. These arguments have not necessarily been finally determined.

Project Vegas concerns an alleged opium-smuggling operation in Brampton. According to the Star, the prosecution relies substantially on messages obtained through an ODIT. Defence lawyers have sought technical information, including documentation about the tool, its configuration and the company supplying it. The reporting states that federal prosecutors have resisted disclosure of more than 140 related documents under section 37 of the Canada Evidence Act. A lengthy ruling concerning ODIT disclosure was reportedly subject to a publication ban when the article appeared.

The technology is reportedly administered through the Joint Technical Assistance Centre, a provincially funded unit involving the OPP and police services in Toronto, Ottawa, Peel, York and Durham. The private supplier and tool have not been publicly identified.

Why police and prosecutors seek secrecy

Investigative techniques are not always fully disclosed to the public. Police and prosecutors argue that revealing how a covert tool is installed, how it communicates with police systems or how it avoids detection could allow criminal organizations to defeat it. Disclosure could also affect relationships with private suppliers or domestic and international law-enforcement partners.

Section 37 of the Canada Evidence Act permits a federal minister or official to object to disclosure on the ground of a specified public interest. A court may examine the information and decide whether the public interest in disclosure outweighs the stated interest in confidentiality. It may authorize disclosure subject to conditions.

The Crown's reported position in the Ontario litigation is that an accused person receives the evidence collected through the ODIT but does not necessarily require the technical details explaining how the tool acquired it. From this perspective, disclosing sensitive operational information could destroy the usefulness of a lawful investigative technique and affect public safety.

That position identifies a legitimate institutional concern. It also creates a difficult question: how much information about the collection process is necessary to test whether the evidence is authentic, complete, reliable and obtained within the limits of the authorization?

Disclosure and the ability to challenge evidence

Disclosure is a central part of a fair criminal process. The Crown generally has a duty to disclose relevant information to the defence, subject to established exceptions such as privilege and certain public-interest protections. Disclosure allows an accused person to know the case to be met, make informed decisions and challenge the admissibility or reliability of evidence.

ODIT evidence may raise questions that cannot be answered simply by reading the messages or files produced to the defence. What functions were enabled? What dates and devices were covered? Did collection remain within the authorized period? How were privileged conversations and unrelated information handled? Did a private supplier have access to the data?

Not every case will require disclosure of source code, trade secrets or every technical manual. Courts regularly balance fair-trial rights against privileges, confidentiality and public interests. The unresolved issue is where that balance should be placed when the evidence was created or collected through a secret commercial system and the technical process may be relevant to a Charter challenge or to the evidence's reliability.

The Star reported that an agreement associated with the Ontario technology contemplated ending a prosecution rather than disclosing particularly sensitive information, including the vendor's identity and technical infrastructure. This illustrates the tension when the government seeks both to rely on information produced by a covert tool and to restrict examination of details about that tool.

Privacy review and the role of oversight

A privacy impact assessment is a structured process used by government institutions to identify how a program or technology affects personal information and how identified risks can be reduced. It does not replace a warrant or determine whether evidence is admissible. Its purpose is broader and preventive: privacy concerns can be examined before a system is put into operation rather than only after a dispute occurs.

The Privacy Commissioner told the parliamentary committee that his office had not been informed or consulted before the RCMP implemented its ODIT program and learned about it through media reporting in 2022. At the time of the committee hearings, the RCMP had not completed a privacy impact assessment specifically addressing its use of ODITs.

RCMP witnesses took the position that an ODIT represented a new method of carrying out forms of surveillance that police had used for many years. Critics responded that combining numerous capabilities in a single device changes the scale and cumulative effect of the intrusion. Both perspectives are relevant: Canadian law has long permitted judicially authorized interception, tracking and covert recording, but a smartphone can concentrate access to communications, movements, habits and relationships in one continuously carried device.

The RCMP's later internal audit of emerging investigative technologies found fragmented governance and limited transparency and public notice. Although ODIT operations were not one of its three detailed case studies, the audit included ODITs within emerging investigative software and recommended stronger governance, standardized assessment, privacy review and public transparency.

What Parliament recommended

The House of Commons privacy and ethics committee concluded in 2022 that Canadian law had not fully adapted to the digital age. It recommended, among other measures:

• requiring federal institutions to conduct privacy impact assessments before using high-risk technological tools and submit them to the Privacy Commissioner;
• reviewing Part VI of the Criminal Code to determine whether it remains appropriate for modern digital surveillance;
• establishing clearer rules concerning spyware vendors;
• creating an independent advisory body to review new law-enforcement technologies and develop national standards; and
• adding explicit transparency requirements for federal institutions, with exceptions where confidentiality is necessary to protect investigative methods and the integrity of investigations.

These recommendations attempted to preserve two interests at the same time. Police need effective tools to investigate serious offences, particularly when communications are encrypted and criminal activity crosses borders. Canadians also have an interest in clear legal limits, independent review and sufficient transparency to understand the powers exercised in their name.

Because policing responsibilities are divided among federal, provincial and municipal institutions, practices may differ across Canada. Evidence of use by the RCMP and several Ontario services should not be treated as proof that every Canadian police agency uses ODITs. The full national picture is not publicly available.

What is known-and what remains unanswered

Canadian police have used ODITs. The RCMP says its use has been rare, targeted, time-limited and judicially authorized. The tools can collect multiple forms of information directly from a device, including some encrypted communications. Yet the public does not have a complete list of Canadian agencies with access to ODITs. The suppliers, products, technical safeguards, retention practices and vendor arrangements in the reported Ontario cases are not fully visible. Important legal issues remain under litigation.

Careful discussion should recognize those limits. An allegation that a warrant was deficient is not a judicial finding that police acted unlawfully. The existence of highly intrusive capability is not proof that every function was used in a particular investigation. Conversely, the existence of a warrant does not prevent a later court from reviewing whether the authorization was properly obtained and executed.

The larger question for the justice system

ODITs illustrate a broader challenge created by modern investigative technology. Legal rules often develop around separate activities: intercepting a call, tracking a location, installing a camera or searching stored documents. A smartphone tool may perform several of those activities together, remotely and continuously.

The debate concerns how judicial authorization remains meaningful when technology is complex; how unrelated and privileged information is protected; how courts evaluate evidence generated by a confidential system; and how an accused person can make full answer and defence without unnecessarily exposing a technique police say must remain covert.

Transparency does not necessarily require publication of instructions that would allow someone to defeat an investigation. Secrecy does not necessarily mean that no independent body can examine the technology. Between those positions are several possible safeguards: confidential review by privacy commissioners, technically informed judicial scrutiny, clear statutory standards, independent audits, public reporting of aggregate use and controlled disclosure within criminal proceedings.

As the Ontario cases continue, courts may provide further direction on the type of warrant required, the information an authorizing judge must receive and the technical material an accused person must be given. Until then, the central legal principles remain familiar even if the technology is new: searches must be authorized by law, state intrusion must remain within defined limits, relevant evidence must be capable of meaningful examination, and allegations must ultimately be determined through a fair process.

Sources and further reading

• Toronto Star: Ontario police are using spyware that lets them remotely take over a smartphone
• Office of the Privacy Commissioner of Canada: Articles on On-Device Investigative Tools
• House of Commons Standing Committee on Access to Information, Privacy and Ethics: Device Investigative Tools Used by the RCMP and Related Issues
• RCMP: Audit of Emerging Investigative Technologies
• Criminal Code, Part VI: Invasion of Privacy
• Canada Evidence Act, section 37

Educational disclaimer

This article explains general Canadian legal processes using publicly available information. It is provided for public legal education only. It is not legal advice and does not address any specific case. Presumption of Innocence Canada does not provide legal advice, legal representation, case assessments or advocacy for changes in law or public policy. Anyone seeking advice about an individual situation should consult a lawyer licensed in their province or territory.