Canada's New Nightmare: Violence As a Service?

0:08 Hello and welcome back to the Global Intelligence Weekly Wrap-Up. I'm your host, No Bison, a retired intelligence officer with the Canadian Security Intelligence Service and the Director of the Global Intelligence Knowledge Network. Each week I take open source information from major news outlets concerning national security, espionage, sabotage, foreign interference, and terrorism, and provide you with the insights, analysis, and intelligence to help you understand how the shadowy world of spies affects your country, your career, and your safety.

0:33 It's been a frightful week in intelligence, from an Ukrainian man being arrested in Germany for spying for Russia, to further revelations that Canada is seeing an increase in gun for hire transnational repression. There's a lot to talk about, so let's get into it. We begin this week in Germany, where authorities have arrested a Ukrainian national suspected of collecting military intelligence on behalf of Russia.

0:53 What makes this case particularly interesting is not simply the arrest itself, but the type of information Russian intelligence was allegedly seeking, and how it connects to several other cases we previously looked at. According to Germany's federal prosecutors, the suspect, identified only as Vadim Y, had been in contact with the Russian intelligence service through an intermediary since at least July of 2025.

1:15 He was arrested on October 22nd in Brottingburg, and a German court subsequently ordered him held on suspicion of espionage. Prosecutors alleged that he gathered information concerning the production of armored vehicles, ammunition, and explosives, along with information about military personnel and facilities involved in security NATO's eastern flank.

1:34 Some of this information was publicly available. However, investigators also alleged that he deliberately approached individuals within Europe's defense industry to obtain additional information. Now that last part is particularly important. From an intelligence collection perspective, there is a significant difference between gathering publicly available information and cultivating relationships with individuals who have access to sensitive or classified information.

1:56 Both can be valuable to a foreign intelligence service. Publicly available information can identify manufacturers, production facilities, contracts, and supply chains, but someone with access to a defense company may be able to provide additional details about production capacity, delivery schedules, security arrangements, or operational vulnerabilities.

2:15 And when we're talking about military equipment destined for Ukraine, that information is highly sought after by Russia. These allegations do not establish that Vadim obtained classified information or successfully recruited an insider or helped plan sabotage. Those questions remain unresolved for the moment.

2:31 But the information he allegedly sought is consistent with intelligence requirements that could support both military planning and the identification of potential targets. For regular listeners, this is a familiar scenario. During our September 18, 2026 episode, we examined the case of Alona W, Berlin businesswoman accused of assisting Russian intelligence.

2:50 German prosecutors alleged that she used her professional connections to introduce a Russian intelligence officer to individuals within political and military circles. She was also accused of seeking information about Germany's defense industry and military assistance to Ukraine. What was particularly interesting about the case was her alleged ability to facilitate introductions.

3:09 An intelligence officer doesn't necessarily need to approach someone with access to sensitive or classified information directly. Instead, an intermediary with legitimate business or professional relationships may be able to identify potential sources and establish contact without immediately raising suspicion.

3:24 Now consider what German prosecutors are alleging in this case. Once again, we have an individual accused of collecting defense-related information for Russian intelligence through contacts outside the intelligence service itself. Different suspects, different circumstances, but potentially a similar collection methodology.

3:40 And this pattern goes even further. In May of 2024, we discussed the case of Thomas H., a German military procurement employee who admittedly provided military information to Russia. In July of 2024, we examined reporting that American intelligence had uncovered an alleged Russian plot to assassinate a senior executive at Rheinmetall, one of Germany's major defense manufacturers.

4:02 Ryan Metal manufacturers equipment and ammunition are essential to Germany's defense capabilities and Ukraine's war effort. Taken together, these cases illustrate why German defense production has become such an important counterintelligence concern. But there is another dimension to the story. The Al Jazeera article reports that Germany's military has raised its assessment of the Russian sabotage threat against German troops and facilities to significant, the second highest level on its internal scale.

4:28 That follows reports of explosive laden drones near strategically important aviation facilities, including Leipzig, Hale Airport, and Woodstoff Air Base. German authorities are also examining suspected reconnaissance involving military installations and transportation infrastructure. These incidents have not been publicly established as components of a single Russian operation.

4:49 However, they demonstrate why German authorities are increasingly concerned about the relationship between intelligence collection and potential sabotage. And here's the intelligence question I think deserves particular attention. Is Russia collecting information simply to understand Germany's military capabilities?

5:06 Or is some of the collection intended to identify vulnerabilities that could be exploited through future sabotage operations? Given what we have seen since the war in Ukraine began, it is a safe bet to say that Russia intelligence is working to keep Germany from providing any military assistance to Ukraine.

5:22 But the above noted objectives are not mutually exclusive. An intelligence service may collect information for several reasons, and the same information can become useful for different operations as circumstances change. Consider the intelligence value of knowing where armored vehicles are manufactured, how ammunition moves through Europe, which facilities support NATO deployments, and what security arrangements protect those locations.

5:44 That information could assist Russian military planning. It could also help identify weaknesses in the industry and logistical system supporting Ukraine. Earlier this month, Germany's BND chief Martin Jaeger warned lawmakers that Russia's undeclared campaign against Germany and its allies was becoming increasingly dangerous.

6:01 And that brings us to a broader concern. Germany is simply not another NATO member. It is a major European industrial power, a significant supplier of military assistance to Ukraine, and an increasingly important contributor to NATO's eastern defense posture. Disrupting Germany's defense production or undermining confidence in its military security could have consequences well beyond Germany's borders.

6:21 The arrest of Vadivoui remains an allegation of espionage, and it will be important to follow the evidence as the German investigation progresses. But when we compare this case with the other German intelligence stories we've examined over the past two years, a broader pattern begins to emerge. Russian intelligence has really been accused of seeking access to German defense information, military personnel, political networks, and infrastructure supporting Ukraine.

6:46 Some cases involve alleged human sources or intermediaries, others concern cyber operations, surveillance, or suspected sabotage. The methods may differ, but the strategic interests are overlapping. And that is why counterintelligence cannot focus exclusively on protecting classified documents. It must also consider who has access to defense production information, how relationships with outside contractors and business contracts are managed, and whether seemingly routine information requests might form part of a larger intelligence collection effort.

7:15 As Canada continues efforts to strengthen our military and national security stance, given the quickly changing geopolitical alliances, we must keep these lessons in mind. Canadian defense contractors, drone manufacturers, the military, and other government organizations are all targets of Russian intelligence services, especially given the continued support that Canada is providing to Ukraine in their efforts against Russia.

7:38 We all need to remember that the information gathered by foreign enemy states today may help that adversary determine where to strike tomorrow. For our next story, we're examining an Israeli technology company called Discover Tech, which is facing serious allegations concerning the use of digital advertising technology for intelligence collection and surveillance.

8:03 While this week's reporting focuses on the company's alleged targeting of Starlink users, there's a much bigger story here involving the commercial spyware industry, corporate connections, and the increasingly blurred lines between legitimate technology businesses and intelligence operations. On October 27th, Reuters reported that Discover Tech had been identified as a major bidder for digital advertising opportunities involving Starlink users across more than 100 countries.

8:26 Now, for most people, digital advertising is something we associate with companies trying to sell as products or services, but there's another side of the industry that is considerably more concerning. Every time you visit a website or use an application supported by advertising, information about your device and browsing activity can be exchanged through automated advertising services.

8:46 Those systems are designed to help advertisers determine whether they want to pay to display an advertisement. But what happens when somebody isn't particularly interested in selling you anything? What happens when the objective is to identify you, determine where you are, or potentially compromise the device you're using?

9:01 That's where Discovery Tech becomes particularly interesting from an intelligence perspective. According to Reuters, researchers examining the company's activities identified unusual bidding patterns that suggested its interest in Starlink users went beyond conventional advertising, and the concerns aren't limited to Reuters' latest investigation.

9:18 Earlier this month, researchers at the University of Toronto's Citizen Lab published findings examining how DiscoverTech advertising infrastructure was allegedly used to facilitate the delivery of commercial spyware. Citizen Lab reported that advertising systems associated with the company had been used in operations involving surveillance technology developed by other commercial spyware providers.

9:38 One of the particularly concerning findings involved the reporting and targeting of devices associated with Al Jazeera, where malicious advertisements were allegedly used to deliver spyware without requiring the victim to click on them. Let's think about that for a moment. We're not necessarily talking about someone opening a suspicious email attachment or downloading an application from an unknown source.

9:57 We're talking about the possibility of a person's device being compromised through the advertising infrastructure operating in the background while they're using the internet. For intelligence services, that represents a potentially valuable method of identifying and targeting individuals while reducing the need for direct contact with them.

10:12 But the technology is only part of the story. The corporate connections behind Discovery Tech deserve just as much attention. Citizens Labs examination of Israeli corporate records identified that Eric Benoon has a former director of Discovery Tech serving between 2020 and the beginning of 2025. Benoon has also been associated with several companies operating in the commercial surveillance industry, including Circles, Senpai Technologies, and Intelos.

10:36 Circles has been associated with NSO Group, the Israeli company responsible for the Pegasus spyware platform. Senpai Technologies has been connected to the Intellexa Consortium, which is associated with another sophisticated spyware platform known as Predator, and Intelos has reportedly developed technology capable of exploiting digital advertising systems for intelligence collection.

10:55 These relationships themselves do not prove that Discover Tech was operating on behalf of Israeli intelligence agency. But they do establish that individuals involved in Discover Tech had significant corporate connections to businesses operating in offensive surveillance industry. But they do establish that individuals involved in Disc had significant corporate connections to businesses operating in the offensive surveillance industry.

11:18 And this isn't the first time we've discussed these companies and their capabilities on the Global Intelligence Weekly wrap-up. Back on March 21, 2025, we examined a reporting concerning Israeli developed spyware and its reported use by Ontario Law Enforcement. The discussion included Paragon Solutions, the company behind Graphite, as well as NSO Group and the Pegasus Spyware.

11:39 At that time, we discussed the legitimate operational value that sophisticated surveillance technology can provide to intelligence and law enforcement agencies. Having worked in intelligence, I understand why organizations investing terrorism, espionage, organized crime, and other serious national security threats would want to access these capabilities, but we also discussed the importance of legal authorities, oversight, and accountability, because the same technology that can help identify a terrorist or foreign intelligence operative can also be used to monitor journalists, political opponents, human rights activists, or anyone else a government considers inconvenient.

12:11 That brings us back to Discover Tech. Citizen Lab also identified connections between Discover Tech and another surveillance company called Bindice, portally founded by individuals with backgrounds in Israeli military intelligence. Separate reporting has associated Bindency with offensive cyber capability and alleged contracts involving Israeli intelligence organizations.

12:32 There have also been reports that technology associated with Intelos was offered to Israel's domestic security service, Shinbet. Now we need to be careful about what these connections actually establish. Having former military intelligence personnel working in the private technology industry isn't unusual, particularly in Israel.

12:55 And a company having former directors or shareholders connected to other surveillance businesses doesn't automatically mean it is controlled by an intelligence service. What these connections do demonstrate is an overlapping network of individuals, companies, and technologies operating in a highly specialized commercial intelligence industry.

13:12 And that's where I think the story becomes particularly relevant. Intelligence agencies have traditionally developed many of their surveillance capabilities internally. Intelligence agencies have traditionally developed many of their surveillance capabilities internally, often using specialized equipment and techniques that were closely guarded government secrets.

13:28 Today, sophisticated capabilities can also be developed, marketed, and sold by private companies. That creates opportunities for governments to acquire technology without necessarily having to develop it themselves. It can also complicate efforts to establish who is responsible when that technology is used improperly.

13:44 Is the company responsible for collecting information? Is another company responsible for exploiting the device? And who is the ultimate customer receiving the intelligence? Those are three different questions, and the answers may involve three entirely different organizations. In Discover Tech's case, Reuters and Citizen Lab have raised substantial concerns about the company's activities and its relationship with other surveillance businesses.

14:05 But the publicly available evidence does not establish that Discover Tech was owned, directed, or tasked by Masad, Shinbet, or any Israeli military intelligence. Nor does it establish who ultimately benefited from every surveillance operation associated with this technology. Those remain important, unanswered questions.

14:22 And we should also remember that commercial surveillance industry isn't exclusive to Israel. Governments and private companies around the world are developing technologies capable of identifying individuals, tracking their activities, and exploiting vulnerabilities in the devices they use every day. What makes this particular case noteworthy is the reported use of an advertising ecosystem that billions of people interact with, often without realizing how much information is being established behind the scenes.

14:48 For those of us who have worked intelligence, the ability to identify and locate a person of interest has always been an important part of intelligence collection. But traditionally, doing so requires surveillance teams, technical collection capabilities, human sources, or access to information held by telecommunications providers.

15:04 Now consider the implications if a commercial advertising platform can provide some of that information without the individual ever knowing they were being monitored. And if the same infrastructure can also be exploited to deliver spyware, the intelligence opportunities become considerably more significant.

15:19 Discover Tech investigation raises questions about whether existing laws, regulations, and oversight mechanisms have kept pace with the development of commercially available surveillance technology. It also reinforces something we've discussed repeatedly on this podcast. Intelligence collection is no longer exclusively the domain of government intelligence agencies.

15:37 Private companies can develop and operate capabilities that were once available only to some of the world's most sophisticated intelligence services. And when those capabilities are sold, shared, or operated through complicated corporate arrangements, determining responsibility becomes increasingly difficult.

15:52 For now, Discover Tech remains the subject of serious allegations and technical findings that deserve further scrutiny. But the larger issue extends well beyond one Israeli company. It's about the growing commercial market for surveillance capabilities, the potential for their misuse, and the challenges governments face in ensuring that technology developed for legitimate purposes isn't exploited for covert intelligence collection against unsuspecting individuals.

16:16 And that is something worth paying attention to, regardless of which country the company happens to operate for. Individuals arrive in stolen vehicles, fire multiple rounds at a designated building, record the attack on their phones, and flee the scene. The recordings were allegedly used as proof that the assignment had been completed so that individuals could receive their pay.

17:55 What makes this particularly concerning is that many of those individuals allegedly involved were young people, some as young as 15 years old. From my previous experience as a law enforcement officer, I know this is a typical scenario when criminal organizations want to initiate someone into that organization.

18:10 And the young age of the offender also helps protect them from longer jail times. The Toronto Police Services have identified growing criminal marketplaces in which individuals are recruited through encrypted messaging applications to carry out acts of violence in exchange for money. This practice is increasingly being described as violence as a service, and its usefulness foreign enemy states is increasing.

18:30 From an intelligence perspective, there is something particularly important about this method of conducting operations. Traditionally, when an intelligence service wanted to carry out a covert operation in another country, it might rely on trained intelligence officers, recruited human sources, or individuals associated with organizations sympathetic to their objectives.

18:48 But what we're increasingly seeing is the exploitation of existing criminal networks. Think of the Bishwa gang and the assassination of Hardit Singh Nijar or Hell's Angels members being used to intimidate or assassinate Iranian dissidents in Maine. These individuals may have absolutely no ideological commitment to the organization or government directing the operation.

19:06 They may not care about Iranian foreign policy, the conflict in the Middle East, or political significance of attacking a synagogue or an American diplomatic facility. For them, it's simply an opportunity to make some money. And that creates an attractive opportunity for foreign intelligence organizations.

19:20 Rather than developing their own operational infrastructure, they can potentially exploit criminal networks already operating in the country. Individuals carrying out the attacks may never know who ultimately commissioned them, particularly when recruiters, financial intermediaries, and encrypted communications are used to conceal the identity of the person directing the operation.

19:39 And this is something we've seen happening in other Western countries. Back on August 29, 2025, we examined Australian intelligence findings linking Iran's Islamic Revolutionary Guard to the December 2024 arson attack against Melbourne's Hadas Israel Synagogue. Australian investigators reported that the individuals responsible for the attack were recruited and financed through intermediaries, with the funding ultimately traced back to Iran.

20:02 The significance of this investigation was that the individuals carrying out the attack reportedly did not necessarily know who was ultimately directing their activities. This creates a degree of separation between the foreign government and the criminals committing the violence, making it more difficult for intelligence and law enforcement agencies to identify those responsible for organizing and financing the operation.

20:22 But returning to Toronto, CBC's investigation has uncovered another important development. Toronto police chief, superintendent Joe Matthews told CBC that investigators had identified firearms used in the attacks against Jewish institutions and a U.S. consulate that were also associated with shootings connected to the waste management company Green for Life.

20:41 Now think about that for a moment. We're seeing the same firearms allegedly being used in attacks that appear in very different motivations. Some are connected to local criminal or business disputes, while others appear intended to intimidate Jewish communities or target American diplomatic interests.

20:57 These suggest that the same criminal networks may be accepting assignments from different individuals or organizations. And that's a serious concern from a counterintelligence perspective. But if a foreign intelligence service can exploit an established criminal network, it doesn't necessarily need to import, recruit, and trade its own operatives.

21:13 It can simply use individuals who are already willing to commit violent acts for a financial game, and those individuals may have little or no information about the people ultimately financing their activities. And why would they care? CBC investigation has also raised questions about possible international connections.

21:28 American prosecutors have previously alleged that Iranian-backed organizations were involved in coordinating attacks against targets in Europe and North America, including incidents in Canada. Those allegations are significant, but they need to be distinguished from findings established through a criminal conviction.

21:43 More importantly, Canadian authorities have not publicly confirmed that Iran was responsible for the entire series of shootings in Toronto. However, on July 3, 2026, Global News reported that a Canadian intelligence assessment had identified a realistic possibility that Iranian intelligence services For using local criminal networks to target Canada's Jewish community.

22:03 That assessment provides important context for CBC's latest investigation. It suggests that Canadian intelligence authorities were already examining the possibility of Iranian involvement, even as police continued working to establish who was organizing and financing the individual attacks. And this brings us to another important aspect of the investigation.

22:20 Finding the person who fired a weapon at a synagogue or diplomatic facility is only part of the problem. The more difficult task is identifying who recruited that individual, who provided the instructions, who arranged payment, and ultimately who ordered the attack. Having spent much of my intelligence career involved in human intelligence operations, I can appreciate the challenges associated with identifying and establishing relationships between individuals who may never have met one another.

22:41 Encrypto communications, anonymous online identities, and multiple intermediaries can make those relationships particularly difficult to establish. There's also an important distinction between intelligence collection and criminal investigation. An intelligence service may develop credible information identifying individuals or organizations directing an operation.

22:58 However, the intelligence may not necessarily be available or suitable for use as evidence in a criminal prosecution. Law enforcement needs evidence that can withstand scrutiny in court. And when a foreign government may be involved, gathering that evidence becomes considerably more complicated. This is why cooperation between Toronto police, the RCNP, CESIS, CBSA, and international partners, such as the FBI, is so important.

23:20 We have already seen the dangers associated with these investigations. In our June 2026 coverage, we discussed the death of Toronto police constable Mark Pinizuto, who was killed while officers were executing a search warrant connected to the broader investigation into the Toronto shooting. We also examined how Toronto police had identified what appeared to be a multi-layered gun for hire network involving young individuals recruited through encrypted messaging applications.

23:43 At the same time, one of the central questions was whether the people commissioning these attacks were operating from within Canada or from overseas. CBC's latest investigation doesn't conclusively answer the question for every incident, but it does provide additional evidence that investigators are examining possible foreign sponsorship alongside organized criminal activity, and this isn't a threat that's unique to Canada.

24:05 We discussed numerous examples of Russian intelligence allegedly recruiting criminals across Europe to conduct sabotage, arson, and other acts of violence. CBC also spoke with Kir Jiliz, a security analyst with Chatham Hose, who identified similarities between these activities and methods used by Russia.

24:22 The common element is exploitation of individuals who are motivated primarily by financial gain rather than political or ideological commitment. And this is where I think the broader national security implications become particularly important. Traditionally, when we discuss foreign interference in Canada, much of the attention focuses on election interference, disinformation, espionage, and attempts to influence politicians or government officials.

24:44 But foreign interference and transnational oppression can also involve intimidation, threats, and physical violence. And when foreign governments potentially use criminal networks to carry out those activities, the distinction between organized crime and national security becomes increasingly blurred.

24:58 We need to be careful not to conclude that every politically motivated shooting in Toronto was directed by Iran simply because the methods resemble those used elsewhere. The evidence must establish those connections. But when we consider the Australian intelligence findings from 2025, the warnings issued by CESIS earlier this year, the Toronto police investigations, and now CBC's latest reporting, there is an emerging pattern that deserves serious attention.

25:22 The central issue isn't simply identifying the individuals responsible for pulling the trigger. It's determining whether foreign governments are exploiting criminal networks operating in Canada to conduct acts of intimidation and violence against communities and institutions on Canadian soil. Because arresting the gunman doesn't necessarily eliminate the organization that commissioned the attack.

25:41 And if that organization is operating on behalf of a foreign government, then we're dealing with something considerably more serious than ordinary criminal activity. We're dealing with a potential threat to Canadian sovereignty and the safety of people living in this country. Before we wrap up this week's Global Intelligence Weekly wrap-up, I wanted to take a moment to acknowledge something of a milestone.

26:00 You are now listening to the hundredth episode. Over those hundred episodes, we've examined everything from espionage, foreign interference, terrorism, sabotage, proxy operation, and some of the more unusual activities taking place in the world of intelligence. And through those episodes, my goal has remained the same: to go beyond the headlines, connect the dots, identify emerging threats and trends, and provide you with analysis, insight, and intelligence that you can use.

26:24 Over the last four years, the Global Intelligence Weekly wrap-up has streamed and been downloaded around the world. From Ottawa to Oman, from Saskatchewan to Singapore, this audience is, well, incredibly global. And as we work towards another hundred episodes, my commitment to providing you unbiased insights, analysis, and intelligence will continue.

26:43 I also want to acknowledge and thank everyone who has listened, subscribed, shared an episode, or taking the time to provide feedback. Your continued interest and support are generally appreciated. And again, if you find this content worthwhile, please go to the Buzzboat page identified in the show notes and the transcript and consider a one-time or continuous donation.

27:02 It helps keep this type of analysis and intelligence available to everyone. And finally, with Halloween coming up this Saturday, I hope everyone has a safe and enjoyable weekend. Although, after covering a hundred episodes of espionage, sabotage, terrorism, and foreign interference, I have to admit that some of these things happening in the intelligence world are considerably scarier than anything that you'll likely see walking around your neighborhood on Saturday night.

27:24 Speaking of Halloween costumes, having spent much of my career as a spy, I have to admit, my favorite Halloween costume has always been the Invisible Man. After all, in the intelligence business, if nobody notices what you're up to, you're usually doing it right. Until next week, stay curious, stay informed, and stay safe.