Canada's Growing Threat of Proxy Operations - A Deep Dive

🇨🇦🔐 Canada's Growing Threat of Proxy Operations | Global Intelligence Weekly Wrap-Up

What happens when organized crime, foreign interference, and national security threats begin to overlap?

This week on Global Intelligence Weekly Wrap-Up, Neil Bisson — retired CSIS Intelligence Officer, former CBSA Officer, and Director of the Global Intelligence Knowledge Network — examines the investigation into the shooting at the U.S. Consulate in Toronto, attacks targeting Jewish schools and synagogues, and the tragic death of Toronto Police Constable Marc Pinizzotto.

As Toronto Police uncover what they describe as a multilayered gun-for-hire network operating through encrypted messaging platforms, larger questions emerge:

• Who selected the targets?
• Who financed the attacks?
• Were the perpetrators motivated by money, ideology, or something more?
• Could foreign actors be using criminal proxies to conduct operations inside Canada?
• Is Canada beginning to experience the same proxy warfare tactics seen in Europe, the United States, and the Middle East?

In this week's Deep Dive, Neil examines how criminal proxies, encrypted communications, violence-for-hire networks, sabotage, transnational repression, and foreign interference are reshaping the modern national security landscape.

⏱ CHAPTERS

00:00 Introduction
01:45 Canada's Growing Threat of Proxy Operations
02:40 Toronto Officer Killed During Investigation into U.S. Consulate and Synagogue Attacks
11:15 The Gun-for-Hire Network: Recruitment, Encryption and the New Face of Organized Violence
18:30 The Outsourcing of Violence: How Proxy Operations Are Changing National Security
25:00 Final Thoughts
25:55 Outro

🎓 Learn More

Neil Bisson teaches the University of Ottawa Professional Development Institute course:

Sabotage and Proxy Operations in Modern Intelligence

Course Information & Registration:
https://pdinstitute.uottawa.ca/PDI/Courses/National-Security/Sabotage-and-Proxy-Operations/Course.aspx?CourseCode=S0245&429f5b2a066e=3#429f5b2a066e

☕ Support the Podcast

https://www.buzzsprout.com/2336717/supporters/new

If you enjoy independent analysis of espionage, foreign interference, sabotage, terrorism, intelligence operations, and national security threats, please consider supporting the show.

Stay curious. Stay informed. Stay safe.

Transcript

SPEAKER_00 0:08

This week on the Global Intelligence Weekly wrap-up, Neil B. Sond, a retired Canadian security intelligence service intelligence officer and the director of the Global Intelligence Knowledge Network, examines a disturbing trend that is increasingly blurring the line between criminal activity and national security threats. The episode begins in Toronto, where the death of a Toronto police constable during the execution of a search warrant has drawn national attention to an investigation involving the shootings targeting the United States consulate, Jewish schools, and synagogues in the Greater Toronto area. As the investigation has expanded, Toronto police have uncovered what they describe as a multilayered gun for higher network in which young people were allegedly recruited through encrypted messaging platforms, provided with targets and paid to carry out acts of violence on behalf of others. From there, Neil takes listeners into a special deep dive examining the growing use of criminal proxies, encrypted communications, and outsourced violence by both state and non-state actors. Drawing on examples previously discussed on Global Intelligence Weekly wrap-up, including Russian sabotage operations in Europe, Iranian criminal proxy networks, and allegations involving transnational repression, Neil explores how foreign adversaries are increasingly relying on local intermediaries rather than intelligence officers to conduct intimidation, sabotage, and violence while maintaining plausible deniability. The episode also examines allegations emerging from U.S. court proceedings involving Mohammed Baker Saud Dawood al-Sodi and explores why investigators are working to determine who selected the targets, who financed the attacks, and who ultimately benefited from the violence. What do encrypted messaging applications, violence for higher networks, foreign interference, and attacks against symbolic targets have in common? They all point to a changing national security environment where the worlds of policing, criminal violence, and intelligence are increasingly colliding. Are you ready? Let's begin.

SPEAKER_01 2:11

Hello, and welcome back to the Global Intelligence Weekly Wrap-up. I'm your host, Neil B. Son, a retired intelligence officer with the Canadian Security Intelligence Service and the director of the Global Intelligence Knowledge Network. Each week I take news articles from reliable media outlets concerning espionage, sabotage, foreign interference, and terrorism, and provide you with the insights, analysis, and intelligence you need to understand how the shadowy world of spies affects your country, your career, and your safety. Last Thursday, a Toronto police officer was killed while executing a warrant to arrest individuals involved in violent acts against the U.S. consulate and various Jewish community centers in the Greater Toronto area. For this week's episode, I will be doing a deep dive in how Canada is now seeing the disturbing trend of violence for hire by enemy foreign states to cause chaos, conduct transnational repression, and acts of sabotage on our soil. There's a lot to discuss, so let's get into it. We start this week's episode with the first segment of our deep dive into the arrest of several individuals in Toronto related to the U.S. consulate shootings back in March and various attacks on synagogues in the Toronto area. The death of a veteran Toronto police officer has drawn renewed attention to an investigation that is rapidly evolving from a series of isolated shootings into what authorities now believe may be a sophisticated crime for higher network operating across the Greater Toronto area. On June 11, 2026, Toronto Police Constable Mark Pinizuto, a 19-year veteran of the service, was killed while officers were executing a search warrant connected to an ongoing investigation into a number of high-profile shootings, including attack targeting the United States consulate in Toronto and several Jewish institutions in the Greater Toronto area. The incident has shocked both Canadian law enforcement and national security communities. What initially appeared to be separate criminal investigations has now become part of a much larger effort to understand who is responsible for directing and financing a network of individuals allegedly recruited to carry out acts of violence across the GTA. Constable Pinazuto was fatally shot while members of the Toronto police were executing a warrant relating to major investigations examining a series of targeted shootings and firearms offenses. The broader investigation has focused on several incidents that attracted significant public attention over the past year, including shootings targeting Jewish schools, synagogues, and the United States consulate in Toronto. According to Toronto police, investigators now believe many of these attacks may be connected through a broader criminals for higher network operating within the GTA. Authorities alleged the young individuals were recruited through encrypted messaging platforms and paid to carry out shootings on behalf of, quote, others. Police have stated that participants were often directed remotely, provided with targets, and in some cases required to provide video evidence of the attack before receiving payment. As part of the investigation, police arrested several individuals, including Sheldon Tracy Stewart, Jayon Berger, and Nicholas Bennett, who were alleged to have participated in various aspects of the network. The final suspect, Zara Javi, was arrested on Thursday at Pearson International Airport. Investigators have also examined possible connections between the Toronto-based shootings and individuals operating outside Canada, including Mohammed Bakur Saeed Daoud El-Sadi, who has been identified in court documents and media reporting as having alleged links to anti-American and anti-Israeli extremist activity. While investigators continue to determine the full extent of these connections, authorities have acknowledged that understanding who directed and financed these attacks remains one of the central questions in this case. The attacks that formed the basis of this crime occurred in March of this year, during a period of heightened tensions following the outbreak of conflict in the Middle East. Across North America and Europe, law enforcement agencies recorded increased incidents targeting Jewish institutions, diplomatic facilities, and communities associated with various international conflicts. In Canada, several shootings directed at Jewish schools and synagogues generated concerns that some incidents may have been motivated by ideology, foreign influence, or broader geopolitical tensions rather than traditional criminal motivations. The shooting directed at the United States Consulate in Toronto further elevated concerns because diplomatic facilities are often viewed as symbolic targets. Attacks against embassies and consulates frequently attract heightened scrutiny from intelligence and national security agencies due to the potential involvement of foreign actors, extremist organizations, or politically motivated groups. The murder of Constable Pinnazuto has added an additional layer of significance to the investigation, highlighting the increasing risk faced by Canadian law enforcement as they attempt to identify and bring to justice networks involved in serious acts of violence. One of the most significant observations to emerge from the investigation has come from Toronto police leadership itself. Police have repeatedly emphasized that while arrests have been made, the larger question remains unanswered. Who is directing and paying for these attacks? From an intelligence and national security lens, this is a critical distinction. Identifying the individuals who pull the trigger is just one step in the investigation. Equally important is determining who selected the target, who provided the funding, who coordinated the activity, and ultimately who benefits from the act itself. Those questions remain at the center of this investigation and will likely continue to shape the investigation in the months ahead. The death of Constable Mark Penezudo represents a tragic moment in an investigation that continues to expand in scope and significance. What began as a series of seemingly disconnected shootings has evolved into a major investigation involving organized criminal activity, encrypted communication, potential international connections, and attacks directed against diplomatic and religious institutions. While investigators have made significant progress identifying alleged participants, many of the most important questions still remain unanswered. Specifically, who organized the attacks, who financed them, and were the participants acting solely for criminal gain? Or were they largely ideological, political, or strategic objectives at play? Those questions bring us to the next part of this story, where we will examine the alleged perpetrators themselves, how they were recruited, and what their actions may reveal about the changing nature of how criminal violence is overlapping national security in Canada. As Toronto police continue their investigation into the shootings targeting the United States consulate, Jewish schools, synagogues, and other locations across Greater Toronto area, investigators uncovered what they describe as a multi-layered gun-for-hire network that relied heavily on encrypted communications, remote direction, and young recruits willing to carry out acts of violence for money. The investigation has revealed a disturbing evolution and criminal activity. Rather than traditional street crime like gang rivalries or disputes over territory, police allege the individuals were recruited through encrypted messaging platforms and paid to carry out attacks on behalf of others. And given my previous discussions on this podcast about how foreign state actors increasingly use criminal groups and local intermediaries to conduct proxy operations, one of the most important questions investigators now face is whether these attacks were directed solely by criminal actors or whether they may have been connected to a broader international network. The targets selected, the operational methodology and allegations emerging from U.S. court proceedings suggest the possibility deserves serious consideration. While investigators have identified several alleged participants, they continue to focus on determining who organized the attacks, who selected the targets, and who provided the financing. According to Toronto Police, investigators believe the number of shootings across the Greater Toronto area are connected through suspects, vehicles, firearms, and communication methods. Police allege that the young people involved were recruited through encrypted messaging applications including Signal, Telegram, and WhatsApp. Investigators say these platforms were used to communicate instructions and facilitate the coordination of attacks while making it difficult for authorities to identify those directing the activity. This is a classic combination of intelligence tactics consisting of obfuscation and plausible deniability. One of the most concerning allegations to emerge from the investigation is that participants were required to provide video evidence of completed attacks before receiving payment. Police alleged the shootings were recorded and transmitted through encrypted platforms to verify that instructions had been carried out. Investigators have described the network as multilayered and continue to examine who may have been responsible for directing, organizing, and financing the attacks. As part of the investigation, police arrested Sheldon Tracy Stewart, 18, in connection with the March 10th shooting at the United States Consulate. Police also announced charges against Jayon Berger, 18, in relation to one of the connected shootings. Nicholas Bennett, 19, has been charged, or is expected to be charged with first-degree murder and the death of Constable Mark Penezotto. And as mentioned, Toronto police arrested 19-year-old Zara Jabi at Toronto Pearson International Airport on June 18, 2026, ending the province-wide manhunt for the suspect. The investigation has drawn international attention because of allegations involving Mohammed Bakr Sad Daoud al-Sadi, an Iraqi national whom U.S. prosecutors allege is associated with Katib Hizbolah, an Iranian-backed militia organization. According to court filings in the United States, prosecutors allege that al-Sadi was involved in coordinating or directing attacks against targets linked to the United States and Israel, including the March 10, 2026 shooting at the U.S. Consulate in Toronto. Prosecutors further allege that the same network may be connected to attacks targeting Jewish schools and synagogues in the Greater Toronto area. While Toronto police have not publicly confirmed these allegations and continue to investigate who organized the financial attacks, the cases raised important questions about whether the shootings were solely criminal in nature or whether they may have been linked to a broader international network operating through local proxies and intermediaries. Toronto police have not publicly confirmed those allegations and continue to investigate whether an international connection exists. While investigators have not publicly concluded that a foreign state directed these attacks, the allegations concerning Al-Sadi are significant because they introduced the possibility that local criminal actors may have been operating on behalf of interests located well beyond Canada's borders. If true, that would place these incidents within a broader pattern of proxy operations that has emerged in Europe, the United States, and elsewhere in recent years. The use of encrypted communications has become increasingly common among organized crime groups, extremist organizations, and transnational criminal networks. As we will discuss in the next segment, it is also the preferred way in which foreign state agents solicit sabotage and proxy operations, including violence, surveillance, and transnational repression from individuals willing to participate in these national security threats. Apps such as Signal, Telegram, and WhatsApp provide end-to-end encryption that can make it difficult for law enforcement agencies to identify those in communications behind the criminal activity. Investigators alleged that these platforms played a significant role in the recruitment and coordination of individuals involved in the shootings. The recruitment of young people presents an additional challenge for investigators. Police alleged that financial incentives were used to encourage participation, create a system in which individuals could be recruited remotely, and directed to carry out attacks without necessarily understanding the broader motivations behind them. Toronto police have repeatedly emphasized that identifying the individuals who carried out the shootings is only one part of the investigation. Determining who selected the targets, who provided the funding, and who ultimately benefited from the attacks remains a key investigative priority. One of the most significant observations from investigators has been the degree of separation between those carrying out the attacks and those believed to be directing them. The structure described by police suggests an effort to create layers between organizers and participants. Such arrangements can complicate investigations by making it more difficult to identify those ultimately responsible for planning, financing, or directing this type of criminal activity. Investigators have also highlighted the growing role that encrypted communications play in facilitating modern criminal operations. By combining encrypted messaging platforms with remote recruitment and financial incentives, facilitators can communicate with participants while reducing their own exposure to law enforcement or intelligence agency scrutiny. The arrests made by the Toronto police represent a significant step in disrupting a network believed to be linked to multiple shootings across the Greater Toronto area. However, despite police having identified several alleged participants, investigators continue to focus on identifying those responsible for directing and financing the activity. This is where the world of policing collides with the world of spies. As the investigation progresses, the answers to those questions may help determine whether these incidents represent more than simply organized criminal activity. Those questions bring us to our final segment on this deep dive, where I'll examine why criminal proxy actors are increasingly being used to conduct violence on behalf of state and non-state actors and what that trend means for Canada's national security. The investigation into the shooting targeting the United States consulate, synagogues, and Jewish institutions in the Greater Toronto area has raised important questions about who organized the attacks, who financed them, and what motivations may have been behind them. At this stage, investigators have not publicly concluded that a foreign state directed these attacks. The investigation remains ongoing and many questions remain unanswered. However, the operational characteristics described by investigators are remarkably similar to patterns that intelligence and national security professionals have been observing around the world for several years. Specifically, the use of encrypted communications, remote recruitment, financial incentives, layered organizational structures, and the separation of planners from perpetrators. These characteristics are increasingly associated with sabotage and proxy operations conducted by state and non-state actors seeking to achieve strategic effects while maintaining that ever-important plausible deniability. As regular listeners know, I teach a course at the University of Ottawa's Professional Development Institute called Sabotage and Proxy Operations in Modern Intelligence. I'll leave a link in the show notes for registrations. One of the central themes of that course is that modern states increasingly rely on proxies, intermediaries, criminal organizations, or cutouts to conduct operations that they once would have assigned to intelligence officers or military personnel. Historically, covert operations often involved trained intelligence officers operating under diplomatic cover, using false identities and forged documents, requiring specialized equipment with carefully planned exfiltration strategies. These operations were expensive, risky, and increasingly vulnerable to detection through biometrics, international intelligence sharing, surveillance systems, and diplomatic expulsions. Not to mention that if a foreign state were identified as being involved in actions like this, it could escalate into military action as a response. Today, many foreign adversaries in enemy states face a different reality. Why send an intelligence officer into another country when a criminal intermediary can recruit local individuals to carry out the same task? Why assume the risk of direct involvement when violence can be outsourced through layers of facilitators, criminal actors, and online communicators? The result is a model that is cheaper, faster, and significantly more difficult to attribute to the state or non-state actor. In the Toronto investigation, police alleged the individuals were recruited through encrypted messaging applications provided with targets, paid to conduct attacks, and in some cases, required to provide video proof before receiving compensation. Those allegations mirror operational characteristics increasingly observed in modern proxy operations around the world. Since I started this podcast, the Global Intelligence Weekly Wrap-Up has examined numerous examples of proxy operations and state-directed violence carried out through intermediaries rather than intelligence officers. In Europe, investigators have linked Russian intelligence services to sabotage campaigns involving recruited intermediaries, criminal actors, and individuals contacted through encrypted communication platforms. In one case, previously discussed on this program, individuals were recruited through Telegram, paid relatively small amounts of money, and directed to participate in a broader sabotage campaign without fully understanding the larger operation. In the United States, prosecutors allege that Indian intelligence officer Vikesh Yadav used intermediary Nakil Gupta in an alleged plot targeting Sikh activist Gupatwa Singh Panun. According to prosecutors, Gupta's role was not to conduct the attack himself, but to identify and connect violent capability to those directing the operation. In Canada, the investigation into the murder of Hardy Singh Nijar has drawn attention to alleged connections between state interest criminal actors linked to the Lawrence Bisnoi network. Open source reporting and RCMP assessments have highlighted the role that transnational criminal organizations can play as facilitators of violence and intimidation. Similarly, U.S. authorities have alleged that Iranian intelligence services have relied upon criminal facilitators such as Naji Sarif, Zindashti, and his network to organize surveillance, kidnapping plots, and murder for hire operations targeting dissidents living abroad. Different countries, different targets, different motivations, but increasingly the same operational model. One of the most important lessons from studying sabotage and proxy operations is that these activities often follow a recognizable pattern. Foreign states face strategic constraints. Direct action is considered too risky, too expensive, or politically too costly. An indirect method is selected. Responsibility is delegated to intermediaries, criminal organizations, or individuals with no obvious connection to the sponsoring state. The operation is deliberately designed to create ambiguity and frustrate attribution. Violence, intimidation, sabotage, or disruption occurs. Investigators struggle to determine who ultimately directed the activity. And in many cases, the desired strategic effect is achieved long before attribution can be established. What makes the Toronto investigation particularly important is not simply the allegations themselves, it is the possibility that Canadians are witnessing the same operational characteristics that have emerged repeatedly in Europe, the United States, and other democratic countries. Whether the ultimate motivation proves to be criminal, ideological, political, or something else remains to be seen. However, we need to consider the following. If this is strictly a criminal act, what was the payoff? No bank was robbed for money, no person was killed for a paid contract. This was an act of intimidation with a political and ideological focus. The death of Constable Mark Pinazzoto serves as a strategic reminder that the consequences of these investigations are not just theoretical. Canadian lives are at stake, and a community protector has been killed. A veteran police officer lost his life while investigating a network allegedly linked to shootings targeting diplomatic and religious institutions in Canada. There is an increasingly important connection between national security concerns and criminal actors willing to carry out acts of violence on behalf of others. Whether those quote others are criminal organizations, extremist movements, or foreign states is often the very question investigators are trying to answer. Looking at the targets in this case, it is responsible to ask why a criminal organization would choose a U.S. consulate, Jewish schools, and synagogues. These are not traditional profit generating targets. They are symbolic targets. While investigators have not publicly identified who ultimately directed the attacks, the target selection itself raises important questions about the motive. Intent, and who stood to benefit from the fear and disruption these attacks created. For many Canadians, shootings, arsons, vandalism, intimidation, and extortion are viewed primarily as criminal matters. Increasingly, intelligence services and law enforcement agencies are confronting situations where criminal activity may serve strategic, political, ideological, or foreign state objectives. Determining whether that is occurring requires investigators to look beyond the immediate act of violence and identify who ultimately benefits from it. Foreign states have learned that they don't need intelligence officers operating under diplomatic cover to intimidate critics, silence opponents, and create fear. In many cases, they can simply purchase that capability from anyone willing to take crypto payments for violent acts. That is why the line separating organized crime and street thugs from national security threats is becoming increasingly blurred. I often remind the participants of my University of Ottawa course that the challenge facing Canada is not simply identifying who shut up the residents or started the fire at the warehouse, it is understanding who truly benefits from these acts of violence or sabotage. When violence appears criminal without gain, but advances political, ideological, or strategic objectives, it must now be examined through both a law enforcement and a national security perspective. And as this investigation continues, that may ultimately prove to be one of the most important lessons of all. Well, that's going to wrap it up for this week. If you're a listener of the podcast and work in law enforcement, private security, or an industry or field that may be targeted by transnational repression or sabotage from a foreign state, you should reach out to the Global Intelligence Knowledge Network to help your organization gain a better understanding and appreciation of how these events are likely to impact you and your organization. Unfortunately, this kind of national security threat is not going away anytime soon, and loss of property and potentially more Canadian lives could be the result of ignoring the signs. This Sunday marks Father's Day in Canada and the United States. I would like to wish a happy Father's Day to all those who have such an important role to play in the lives of their children and in shaping our future. Until next week, stay curious, stay informed, and stay safe.

SPEAKER_00 24:10

That wraps up this week's Global Intelligence Weekly wrap-up. Thank you for listening. From the tragic death of Toronto Police Constable Mark Kenitsoto to the investigation into shootings targeting the United States consulate, Jewish schools, and synagogues in the Greater Toronto area, to the emergence of what police describe as a multi-layered gun for higher network. This week's episode examined a troubling evolution in how violence may be organized, directed, and carried out in Canada. The investigation remains ongoing, and many important questions remain unanswered. While investigators continue to pursue those answers, the case highlights a reality that intelligence and security professionals around the world have been increasingly confronting in recent years. The line separating criminal violence and national security threats is becoming increasingly blurred. Foreign states, extremist organizations, and other hostile actors have learned that they do not always need intelligence officers operating under diplomatic cover or sophisticated covert networks to achieve their objectives. In many cases, they can simply recruit, incentivize or manipulate local individuals willing to carry out acts of violence on their behalf. As we discussed in this week's deep dive, the use of proxies, intermediaries, encrypted communications, and plausible deniability has become a defining feature of modern intelligence and security threats. Whether the examples come from Europe, the Middle East, the United States, or now potentially here in Canada, the operational patterns are becoming increasingly familiar. And as these methods continue to evolve, Canadians will need to better understand how criminal activity, foreign interference, sabotage, transnational repression, and national security threats are becoming increasingly interconnected. Producing the Global Intelligence Weekly Wrap-Up requires ongoing monitoring of global events, intelligence developments, foreign interference activities, espionage cases, and emerging security threats to provide listeners with independent analysis and context each week. If you find value in this work, please consider supporting the podcast through Bus Sprout. There is a link in the transcript and show notes. Contributions from listeners help ensure that independent intelligence and national security analysis remains available to those who can react to it quickly, keeping everyone safer. You can also help by subscribing to the podcast, sharing episodes with colleagues and friends, and leaving a review on your favorite podcast platform. Your support helps grow the audience and ensures these important conversations continue. And as Neil always reminds us, stay curious, stay informed, and stay safe.