Open-source research, service providers and international cooperation

Pike told Park, in his second interview with his lawyer's agreement, that he had found the courier job through an advertisement on a social media marketplace in late January. He still remembered the wording: 'Courier driver needed, Port Ardent area, cash paid daily, own car, no experience.' Park's unit has an analyst, Kofi Mensah, who handles open-source research. Within a day he had found the advertisement, still live, along with eleven nearly identical ones posted in other towns over the previous three months, each from a different account and each with the same phone number for text replies. He documented every page and, before reporting them, asked the platform to preserve the accounts. Desjardins says this lesson is about the three kinds of work that take a cybercrime case beyond the local file: research in public sources, requests to companies, and cooperation with other countries.

What open-source research is

Open-source research, often called open-source intelligence or OSINT, is the collection and analysis of information that is publicly available: websites, public social media posts and profiles, online marketplaces, news, public records, business registries, domain registration records and the like. It is often the fastest way to learn who is behind an account, how a scheme is advertised, what else an offender has done, and which companies hold the records worth requesting. Mensah's search found the advertisements, connected them through the shared phone number, and found that one of the accounts had been created with an email address that also appeared in a public forum post offering 'payment processing' work. None of this required a warrant, because all of it was visible to any member of the public.

That last point needs care. Information being visible online does not mean police may collect anything, any way, for any purpose. Police services have policies, and in some places legal requirements, governing online research. Common rules include using only authorized police equipment and accounts, never personal accounts; doing passive research only, viewing what is public without interacting with anyone, unless an undercover operation has been authorized; recording the purpose of each research task in a log; limiting collection to what the investigation needs; and treating systematic monitoring of individuals or groups, especially around protest or other protected activity, as requiring higher approval. Canadian privacy commissioners have warned that the public availability of information online does not remove all privacy interests in it, and courts have looked closely at how police gather and use it.

Undercover online work

Interacting with people online while posing as someone else is undercover work, and it requires authorization, training and supervision, just as undercover work in person does. Officers posing as children to identify adults seeking to exploit them is the best-known example. In R. v. Mills (2019), the Supreme Court of Canada held that an adult had no reasonable expectation of privacy in online messages he sent to a person he believed was a 14-year-old girl he did not know, who was in fact a police officer, so the officer's screenshots were not a search. But undercover operations raise other legal issues, such as entrapment, and must follow strict rules. Patrol officers and analysts doing open-source research must not improvise them.

Documenting online evidence

Online evidence can change or vanish within minutes, so documentation must be done carefully and consistently. For each page captured, the researcher should record the full web address, the date and time with time zone, the method of capture, and who captured it. Good practice is to capture the whole page, not just the visible screen, using a tool that records the address and time automatically, and to calculate a hash value of each capture file so its integrity can be shown later. Notes should explain how the page was found, so that another person could follow the same path. Mensah's captures of the twelve advertisements each had a file, a hash value and a log entry. Two of the advertisements were deleted by their posters within a week, and his captures were the only record of them other than the platform's own preserved data.

# Logging online captures with hash values
import hashlib
captures = [
    ("https://market.example/ads/88231", "2026-03-23T09:14-05:00", b"Courier driver needed, Port Ardent area, cash paid daily"),
    ("https://market.example/ads/90517", "2026-03-23T09:22-05:00", b"Courier driver needed, Westmere area, cash paid daily"),
    ("https://market.example/ads/91044", "2026-03-23T09:31-05:00", b"Courier driver needed, Harrow Bay area, cash paid daily"),
]
for url, when, page in captures:
    digest = hashlib.sha256(page).hexdigest()[:16]
    print(when, url, "sha256", digest + "...")
same_text = len({page.split(b",")[0] for _, _, page in captures}) == 1
print("same wording in every ad:", same_text)

2026-03-23T09:14-05:00 https://market.example/ads/88231 sha256 b8e928206aa812e8...
2026-03-23T09:22-05:00 https://market.example/ads/90517 sha256 4966f4c1e5c1bc42...
2026-03-23T09:31-05:00 https://market.example/ads/91044 sha256 122cf3183b137908...
same wording in every ad: True

The example uses placeholder addresses and shortened page text, but the method is the one Mensah used: every capture logged with its address, time and hash. The matching wording, the matching reply number and the timing of the advertisements were later set out in a table in Park's court brief, showing that the courier recruitment was organized rather than a set of unrelated job offers.

Working with service providers

Most of the records investigators need are held by companies: phone carriers, internet providers, social media and messaging platforms, email services, banks, payment services and cryptocurrency exchanges. Large companies have law enforcement response teams and online portals for submitting legal process, and publish guidelines explaining what records they keep, for how long, and what legal process they require. Officers should read those guidelines before drafting an order, because asking for records a company does not keep wastes time, and describing records in the company's own terms makes the order easier to execute.

Requests generally fall into four kinds. Preservation requests ask the company to keep records while legal process is obtained, as lesson 8 described. Requests with legal process, such as production orders, subpoenas, court orders or warrants, compel the records. Emergency requests ask for voluntary disclosure where there is an imminent risk of death or serious harm; companies have teams that respond to these at any hour, and officers must explain the emergency honestly. And notifications report accounts or content that break the company's rules, which can lead to closure or removal. Companies may notify users about requests unless a court order or law prevents it, so officers should consider whether a non-disclosure order is needed.

Crossing borders

The voice over internet protocol account that placed the calls to Grace and Mercer was held by a company based in the United States. Its records showed that the account had been opened with a free email address, paid for in cryptocurrency, and accessed almost always through commercial virtual private network services that hide users' real internet addresses. On four occasions, however, it had been accessed from a residential internet address in a country in South Asia. The 'Mav' messaging account, held by a company in a third country, had been accessed through the same virtual private network services, and once from the same residential address. Grace's two wires had gone to a bank in a fourth country.

Evidence held abroad cannot simply be ordered produced by a domestic court, although some companies will respond voluntarily to foreign requests for non-content records. The formal route is mutual legal assistance: a request from one government to another under a treaty, asking the other country's authorities to obtain the evidence under their own law and send it back. Canada has mutual legal assistance treaties with many countries, including the United States since 1990, and requests are handled through the Department of Justice's International Assistance Group. These requests are reliable but slow, often taking many months, and the evidence may be gone by the time they are executed unless it was preserved.

Several faster mechanisms exist. The Budapest Convention requires its parties to maintain a 24/7 network of contact points who can arrange urgent preservation across borders, and a Second Additional Protocol, opened for signature in 2022, provides for more direct cooperation between authorities and providers. The United States' CLOUD Act of 2018 allows agreements under which each country's authorities can serve orders directly on the other's providers for serious crime; the United States and Canada began negotiating such an agreement in 2022. Interpol and joint investigation teams help police in different countries share intelligence and coordinate operations against networks that span many countries.

What came of it

Park's unit sent a mutual legal assistance request for the records of the bank account that received Grace's wires in April 2026. In November it was still being processed. The NC3 shared the residential internet address and account details with the police of the country where it was located, through Interpol channels, along with similar information from other cases with the same pattern. Mensah's work identified the woman whose account had paid Pike: a 24-year-old in another province who had been recruited through a work-from-home advertisement and had forwarded money for six weeks believing she was a 'payment processor'. Her account was closed, and police in her area interviewed her; whether she would be charged depended on what she knew. Pike pleaded guilty in October 2026, as lesson 12 describes.

Cryptocurrency exchanges and blockchain analysis

The calling account in the case had been paid for in cryptocurrency, and Mensah worked with the cybercrime unit to trace the payments. The account's records gave the addresses that had paid it. Using a blockchain analysis tool, the unit followed the funds backwards through several addresses to a deposit made at a large regulated exchange. Regulated exchanges must identify their customers and keep records, so the unit obtained a production order for the exchange's records of that account, which was held through the exchange's Canadian business. The account had been opened with a passport from the same South Asian country as the residential internet address, and the exchange's records showed a phone number that had also been used to register two of the courier advertisements.

Blockchain analysis is powerful but has limits. Analysts infer which addresses belong to the same person or service from patterns, and those inferences can be wrong. Mixing services and some privacy-focused cryptocurrencies are designed to break the trail. And exchanges in some countries do not identify their customers or do not respond to foreign requests. Desjardins tells the class that tracing results should be treated as leads to be confirmed with records, not as proof by themselves, and that examiners should explain in their reports which conclusions depend on inference.