Corporate Counter-Surveillance Ontario: Warning Signs

Intercepting a private communication in Canada is a federal offence under Section 184(1) of the Criminal Code, RSC 1985, c C-46, punishable by up to five years in prison. For Ontario businesses, the warning signs that a competitor, disgruntled insider, or state-linked actor may have planted a listening device are both physical and behavioural.

Recognizing those signs is the first step before engaging a PSISA-licensed counter-surveillance team. This guide covers the corporate espionage threat landscape facing Ontario businesses, the physical and behavioural indicators of active surveillance, the decision threshold for commissioning a sweep, and what to do — and what not to do — in the days before a licensed team arrives.

What is corporate counter-surveillance

Corporate counter-surveillance is the professional discipline of detecting, locating, and documenting devices capable of intercepting private communications in a business environment. Section 183 of the Criminal Code, RSC 1985, c C-46 defines “intercept” as listening to, recording, or acquiring a communication or its substance, meaning, or purport. The covered devices include any “electromagnetic, acoustic, mechanical or other device” capable of doing so. Counter-surveillance is the defensive mirror of that statute — identifying what someone else may be deploying unlawfully against a business.

The scope of the discipline is bounded by what the statute addresses. Corporate counter-surveillance covers detection and documentation of physical listening devices, RF-transmitting bugs, video surveillance hardware, telephone-line intercepts, and hardware-based data-exfiltration implants. It does not substitute for an IT network forensics audit or a legal-privilege review of communications; those require distinct engagements with qualified professionals.

Planting a listening device in a private space is a federal offence under Section 184(1) of the Criminal Code, which makes it a crime to knowingly intercept a private communication “by means of any electro-magnetic, acoustic, mechanical or other device,” punishable by up to five years in prison. The offence belongs to Part VI of the Code — the most comprehensive federal privacy-protection regime in Canadian criminal law.

In Ontario, counter-surveillance sweeps conducted for remuneration require a valid licence under the Private Security and Investigative Services Act, 2005, S.O. 2005, c. 34 (PSISA). Section 6 of the PSISA prohibits any person from acting as a private investigator without holding the appropriate licence issued by the Ministry of the Solicitor General. Businesses that engage an unlicensed operator face working with a team whose findings may be legally compromised if the matter proceeds to litigation or a regulatory complaint.

Possession of a device “knowing that its design renders it primarily useful for surreptitious interception of private communications” is itself a federal offence under Section 191(1) of the Criminal Code, punishable by up to two years on indictment. TSCM counter-surveillance teams operate detection and scanning equipment — spectrum analyzers, non-linear junction detectors — that are not designed primarily for surreptitious interception and therefore fall outside the s.191(1) offence.

Who targets Ontario businesses and why: the corporate espionage threat landscape

Ontario businesses face a layered threat landscape in which state-sponsored actors, criminal competitors, and disgruntled insiders operate through overlapping channels. Understanding the actors and their motivations is essential context before interpreting the warning signs in the next section.

• State-sponsored actors. The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025–2026 identifies state-sponsored actors from the People’s Republic of China, Russia, and India as conducting persistent espionage against Canadian private-sector firms. Priority targets include advanced and strategic technology, aerospace, energy, defence, and critical minerals. PRC actors have been assessed as very likely having stolen commercially sensitive data from Canadian firms and institutions to gain competitive advantage. Supply chain compromises are specifically flagged as a risk for Canadian organizations.

• Ontario as a primary geography of interest. The CCCS NCTA 2025–2026 specifically identifies Canada’s innovation ecosystem as a long-standing priority for intelligence collection by state-sponsored actors. Provincial and territorial governments receive particular attention due to their authority over regional trade, resource extraction, and critical minerals — making Ontario, as Canada’s largest provincial economy, a primary geography of interest to foreign intelligence services.

• Criminal competitors and industrial espionage. Not every threat originates with a foreign government. Domestic corporate competitors seeking proprietary formulations, bid pricing, or strategic plans represent a distinct threat category. Canadian businesses spent $1.2 billion recovering from cyber incidents in 2023 — double their 2021 recovery costs — while spending $11 billion on prevention and detection, according to Statistics Canada’s 2024 Canadian Survey of Cyber Security and Cybercrime. For a full breakdown of incidents, losses, and sectors, see our cybercrime statistics Canada research post.

• Spear phishing as an espionage entry vector. Targeted digital attacks often precede or accompany physical surveillance of a target firm. Spear phishing generated $67.3 million in reported losses in Canada in 2024, with 937 reports to the Canadian Anti-Fraud Centre, according to CAFC 2025 fraud statistics. A business that has been the target of executive impersonation or supplier-spoofing attacks should treat that digital intelligence interest as a factor when assessing physical surveillance risk. Our phishing statistics Canada post compiles the full business email compromise and spear-phishing dataset.

• Disgruntled insiders. Former employees, contractors, and current staff with grievances or competing interests represent the most proximate physical-access threat. An insider does not need to defeat perimeter security — they are already inside the boardroom.

Behavioural and technical warning signs that a business may be under surveillance

Section 183 of the Criminal Code defines the covered threat: any “electromagnetic, acoustic, mechanical or other device” capable of intercepting a private communication. This definition maps directly to the physical warning signs that precede professional detection. Any of the indicators below is consistent with a device that would engage the s.184(1) interception offence if operated by a third party without consent.

1. Unexplained electronic interference. Static on telephone lines during calls that were previously clean, AM radio interference near a conference room, or unexpected signal dropout on devices operating normally elsewhere in the building. These are consistent with RF-transmitting devices operating on adjacent frequencies.

2. Unfamiliar equipment in meeting rooms or private offices. Power adapters, charging blocks, smoke detectors, air fresheners, clocks, or electrical outlet covers that were not installed by facilities management and cannot be attributed to a known visitor. Devices capable of intercepting communications can be concealed inside any object with an accessible cavity.

3. Changes to telephone or network infrastructure. Wall plates that have been moved, additional splices or connectors on telephone lines, or unfamiliar network devices plugged into switch ports. Section 342.1(1) of the Criminal Code criminalizes fraudulently obtaining computer services and intercepting computer functions via device — meaning hardware keyloggers, USB exfiltration implants, and rogue network devices planted in a business’s infrastructure engage a distinct federal criminal provision alongside s.184(1).

4. Anomalous wireless signals in secured areas. Devices transmitting on bands not associated with approved corporate equipment — particularly in areas where sensitive discussions routinely occur such as boardrooms, executive offices, or legal conference rooms. A spectrum analyzer sweep will detect transmissions that a standard Wi-Fi survey misses.

5. Behavioural patterns consistent with monitoring. Competitors accurately anticipating bid prices or proprietary product decisions before public disclosure, confidential legal strategy appearing in opposing counsel’s materials, or negotiating counterparties demonstrating awareness of internal deliberations are among the strongest business-context indicators of active listening.

6. Unexplained access events. Cleaners, contractors, or service personnel who accessed secured areas without a verifiable work order — particularly in the period immediately preceding the appearance of other warning signs. A device does not need to be installed remotely; physical access for as little as two minutes is sufficient.

7. Changes in employee or visitor behaviour. An employee who was recently terminated or passed over for promotion and who had access to sensitive meeting spaces, or a visitor who spent unusual time near fixed infrastructure during a site tour, represents an elevated insider-access risk.

How to distinguish a real threat from background noise: the decision threshold

Not every indicator in the preceding section confirms active surveillance. The challenge for Ontario businesses is separating a genuine threat from coincidental equipment failures, infrastructure age, or ordinary RF noise in a dense commercial environment.

The Office of the Privacy Commissioner of Canada’s 2009 Guidance on Covert Video Surveillance in the Private Sector establishes a four-part proportionality test that applies to surveillance decision-making: there must be a demonstrable evidentiary need, the information must relate to a legitimate purpose, the privacy intrusion must be proportionate to the need, and less invasive alternatives must have been considered. The same proportionality reasoning anchors the decision threshold for engaging counter-surveillance. A business should not commission a sweep on mere suspicion alone, but neither should it wait until competitive damage is already proven.

Three or more of the warning signs in the preceding section occurring within the same location or time window, or a single high-probability indicator such as a competitor accurately anticipating a confidential bid, are the practical thresholds most practitioners use when advising clients on whether to proceed to a physical sweep.

The reporting gap in Canada makes the threat probability calculation harder than it appears. Police-reported cybercrime reached 225.1 incidents per 100,000 Canadians in 2024 — more than double the 2018 rate of 91.9 — yet only 13% of impacted businesses reported the incident to police, according to Statistics Canada 2025. The absence of a police report or a prior confirmed incident does not lower the threat probability. Our cybercrime statistics Canada post puts the full exposure picture in context.

Business decision-makers should also consider the timing of their most sensitive upcoming activities. Contract negotiations, M&A discussions, patent filings, and executive departures all create windows in which the intelligence value of a listening device is at its highest. Commissioning a sweep before rather than during such a window is the lower-risk approach.

What to do — and what not to do — before the counter-surveillance team arrives

The period between recognizing a warning sign and the licensed team’s arrival is operationally critical. Actions taken during this window can either preserve or destroy the evidentiary basis for any subsequent criminal complaint or civil action.

1. Do document the warning sign immediately. Record the date, time, location, and a precise description of what was observed. Photograph or video the anomalous item using a personal device — not a corporate device that may itself be compromised. The OPC’s 2009 Guidance on Covert Video Surveillance specifies that organizations must document the decision-making process: formal policy rationale, records of each decision and alternatives attempted, and a record of all personnel who accessed related findings.

2. Do restrict access to the affected area. Without explaining why, limit access to the room or infrastructure in question to personnel who were already authorized to be there. Do not introduce new people into the space while the potential device may be active.

3. Do not touch, move, or remove a suspected device. Premature tampering with a suspected device destroys the evidentiary chain that would support a criminal complaint or civil action for breach of confidentiality. A device that has been disturbed before forensic documentation may be inadmissible.

4. Do not attempt to disable or jam suspected RF-transmitting bugs. Section 9(2) of the Radiocommunication Act, RSC 1985, c R-2 prohibits intercepting and making use of, or intercepting and divulging, any radiocommunication without the originator’s or recipient’s permission. Section 4(4) of the same Act prohibits the possession, use, or manufacture of a jammer. Attempting to jam, disable, or actively interfere with a suspected RF-transmitting bug before the licensed team arrives may engage the s.4(4) prohibition and will corrupt the RF evidence the sweep team needs to locate and document the device.

5. Do communicate about the matter off-site and off corporate devices. If a device is active, it is intercepting whatever is said in the affected space. Coordinate with counsel and the counter-surveillance team using personal devices in a location away from the building.

6. Do engage legal counsel before the sweep. The findings of a licensed counter-surveillance sweep can be used in a criminal complaint to police or in civil litigation. Engaging counsel before the sweep team arrives ensures that the scope of the engagement, the chain of custody for any device recovered, and the disclosure framework are established in advance.

How corporate counter-surveillance fits a broader security posture

A counter-surveillance sweep addresses the physical and RF detection layer. It is one component of a corporate security posture that spans three distinct legal frameworks in Ontario.

• The Criminal Code layer (the floor). Part VI of the Criminal Code establishes the federal criminal prohibitions on interception: s.184(1) (audio), s.342.1(1) (computer data), and s.184.5(1) of the Criminal Code, which extends the interception offence to radio-based telephone communications and is punishable by up to five years on indictment when communications are intercepted maliciously or for gain. A corporate security posture that addresses only physical bugs and wired intercepts, but overlooks mobile and RF-based threats, leaves a gap: each distinct threat type is governed by a distinct provision of the federal criminal framework.

• The privacy law layer. Canada’s surveillance law rests on three overlapping layers: the federal Criminal Code (the floor), PIPEDA or a substantially similar provincial equivalent (the personal information governance layer), and each province’s PI-licensing regime. The Office of the Privacy Commissioner’s overview of provincial laws confirms that Ontario businesses are governed by PIPEDA for private-sector privacy obligations, since Ontario has no substantially similar private-sector statute. For the full cross-provincial comparison, see our surveillance laws by province legal research post.

• The physical security layer. Counter-surveillance sweeps address what the Criminal Code prohibits; they do not replace access-control audits, visitor-management protocols, or security-clearance reviews for personnel with access to sensitive spaces. A complete security posture addresses all three layers and treats the sweep as the detection instrument for the physical-intercept threat specifically.

Businesses in Ontario’s advanced technology, energy, aerospace, defence, and critical minerals sectors — the sectors the CCCS identifies as priority targets for state-sponsored espionage — should consider counter-surveillance sweeps as a standing component of their security program rather than a reactive measure triggered only by a specific incident.

What engaging a PSISA-licensed counter-surveillance team means for your business

Engaging a PSISA-licensed counter-surveillance team in Ontario satisfies the provincial licensing requirement under Section 45(1) of the Private Security and Investigative Services Act, 2005, which sets the penalties for unlicensed investigative work: an individual found guilty faces a fine of up to $25,000 and/or imprisonment of up to one year; a corporation faces a fine of up to $250,000. These penalties apply to the unlicensed operator, not the client — but they signal how seriously Ontario regulates who may lawfully conduct investigative services, including counter-surveillance sweeps, for remuneration.

Under Canadian surveillance law, the three-layer framework means that engaging a PSISA-licensed counter-surveillance team satisfies the provincial licensing requirement, but the team’s work must also be conducted within the Criminal Code’s Part VI interception framework and the PIPEDA data-handling obligations that govern any personal information uncovered during the sweep. The detailed legal framework is documented in our surveillance laws by province legal research post.

For a detailed explanation of the physical sweep methodology — what equipment is used, how the inspection of a room or telephone line proceeds, what happens when a device is found, and how findings are documented for use as evidence — see our companion post on TSCM bug sweeps in Toronto.

As licensed PSISA investigators operating across Ontario, at Discreet Investigations our investigators conduct counter-surveillance sweeps that span the full Criminal Code Part VI threat set — audio devices, RF-transmitting bugs, video surveillance hardware, telephone-line intercepts, and data-exfiltration implants. When a client reaches out with the warning signs described above, our first step is a structured intake to assess the plausibility of the threat before recommending a physical sweep, because proportionality — as the OPC’s covert surveillance guidance requires — is as important for the decision to sweep as it is for the sweep itself.

To discuss whether a counter-surveillance sweep fits your situation, call +1 (888) 680-0036 or visit our espionage and bug sweep service page.

Licensed · Insured · Bonded.