THUNDER BAY — Cyber crime units are often shown on TV and in movies as hacker types who must work fast to infiltrate a device ahead of a major incident. While that isn't necessarily false, it's not how the unit works within the Thunder Bay Police Service.
Thunder Bay police have made multiple arrests in many high-profile cases over the past few years, including the most recent prominent case involving 13 men accused of illegally sharing intimate photos of individuals.
After many back-and-forth conversations with police administration at the Balmoral Street headquarters, this reporter was granted an inside look at what this unit goes through when working its cases.
Chris Carlucci, acting inspector of investigative services, oversees the cyber crime unit (CCU). He spoke about how the unit investigates its own crimes, but also assists other units when there is computer or technology-based evidence that needs to be investigated and processed.
"They are utilized by many different units within the Thunder Bay Police Service, in the investigative services branch, specifically the intelligence unit, and the major crimes unit, as well as missing persons and general investigations," he said.
The CCU is also involved in traffic investigations as it can pull data from a vehicle's entertainment system.
The team consists of four sworn officers, two civilian members, and a beloved canine named Trace.
One of the two civilian members is a retired officer. Chris Dunnill previously served in the CCU and has returned to do contract work due to the sheer number of cases the unit handles, said Carlucci.
Kunwar Swaroop is the other civilian member of the team. He joined the cyber crime unit in 2022 as a computer forensic examiner, utilizing his degree in computer science to aid in cases and testify in court.
Carl Hagstrom is a detective-constable in the unit and serves as one of the computer forensic examiners and is a sworn officer.
"There's examiners, they're the ones that deal with all the evidence-based information, like preparing it for court," he said.
"There's Joel (Manherz) and Brian (Stewart), who are investigators and deal with mostly child exploitation investigations," Hagstrom explained.
"They'll receive a tip through different platforms, and they will create an incident number, start the investigation, try to find out where the internet protocol (IP) address is coming from, who the subscriber is, what house it came from, the parties that lived there, all of that.
"We try to do as much of that ahead of time, and then ultimately they will be writing search warrants, production orders, judicial authorizations to further their investigation. Then it results in a search warrant, usually."
Hagstrom said the examiners will assist in search warrants on the scene, seizing evidence and previewing it for relevance. All seized items will then be triaged by the examiners and processed at police headquarters.
To search through a cellphone, it takes an officer an average of a week to comb through all of its contents for possible evidence. There can be easily upwards of 100,000 to 150,000 image files on a cellphone, as things like app icons and emojis are also considered images.
"We kind of work for both the Crown and the defence in that matter," said Hagstrom.
"We're an unbiased kind of party that's looking at both sides of the story, trying to find out who the ultimate user is (of the devices located during a search), and it might not always be the person that we did the search warrant on."
Being in the digital age means this unit is busy, as there are unlimited options for storing data.
"So as a unit, we deal with anything digital, whether it is physical devices that you can hold like cellphones, computers, USB.
"Or if it's going into the Cloud, where it's dealing with pulling video from video surveillance systems, whether it's from Ring cameras or Nest cameras, where it's stored on someone else's computer in the Cloud, like Google or Amazon, or even like physically on the device as well."
While Hagstrom said he can "ballpark about a week per phone" when reviewing it for evidence, he has come across phones with one terabyte of storage, which took him four months to investigate.
He indicated that once data is downloaded, some policing programs can help in sorting the data, but ultimately, each image, text message, video or more will need to be reviewed by human eyes.
The unit was established in the early 2000s and initially consisted of one officer; it quickly expanded to two, with Hagstrom joining as the third officer in 2017.
Statistics of case loads were provided during the interview to show the staggering increases.
In 2018, there were 65 internet child exploitation (ICE) cases reported and investigated. That increased by 126 per cent by the end of 2024, to 147 reported cases.
Other cases where the cyber crime unit assisted, such as missing persons cases or traffic incidents, have increased by 407 per cent in the same timeframe.
The number of authorizations issued by police has also increased exponentially for this unit over the past six years.
An authorization is when police are granted legal permission to conduct search warrants, intercept communications, seize evidence, or obtain information, such as who owns a cellphone account or accessing call logs.
In 2018, 23 authorizations were issued. In 2024, that increased by 982 per cent to 249.
The number of devices seized in cases has also grown by 1,001 per cent. By the end of 2024, the unit will have seized 1,124 devices during the course of its investigations. The data storage capacity of seized devices has also increased, which ultimately means more work for the unit when searching for evidence.
Hagstrom noted that while the job is strenuous, it's like putting a puzzle together with the evidence. The complexity of each case is what drives him to help close them.
The content over the years is relatively the same, said Hagstrom. However, there has been a disturbing trend of more self-exploitation cases being reported.
Self-exploitation occurs when one person takes an intimate picture and shares it with others. Then, that image is shared without the original person's permission. And so the cycle of trauma begins as the victim is no longer in control of where the image goes and who sees it; the internet is fast, vast and unforgiving.
Cybertip.ca offers assistance to parents and youth who are at risk or are being exploited online. They also offer guidance for individuals over the age of 18 who are concerned that intimate images or videos may be shared without their consent.
Det.-Const. Joel Manherz worked for Toronto Police Service's cyber unit for 10 years before joining the ranks in Thunder Bay in January of 2022.
The pendulum has swung far for Manherz, as he only discovered that cyber crime was a unit in Toronto when he was offered a transfer over a decade ago. He eventually brought his skills to Thunder Bay.
Manherz said some of the biggest frustrations come from the accessibility of sharing information and data across international borders.
In the U.S., the National Center for Missing and Exploited Children (NCMEC) will send reported child pornography to Canada's watchdog agency, called National Child Exploitation Crime Centre (NCECC). That agency will then determine the source of the information and forward it to the relevant jurisdiction's policing agency.
There is some frustration because even though the information is travelling to a Canadian agency, law enforcement must still write a production order to access it due to limitations set out in previous case law.
This slows down investigations as the RCMP is inundated with hundreds, if not thousands, of these reports, and will have to author requests before they can send them out to the right jurisdiction.
Even certain programs have previously been helpful to police in identifying victims using AI technology. However, those that police agencies have previously used were banned in Canada due to their data collection practices. Leaving police with one less tool to identify potential victims.
Manherz said that reported incidents don't usually start as large-scale projects or cases, but that often happens as their investigations progress.
"I had a project a couple of years ago where it was just an 11-year-old self-exploitation case. I go to interview her, she ends up saying that she was part of a website where kids were selling their pictures.
"So all of a sudden it goes from one little kid where you're going to say 'don't do that anymore,' to now it's a project that ended up going out all over the world."
It was a similar situation for the case of the 13 suspects accused of trading intimate photos; one person came to the Thunder Bay police to make a complaint, and the case snowballed from there, said Manherz.
He still needed to write a production order, which held up the case's progress by a year. A year in which other investigative work could've been completed had that information been provided sooner.
There is, however, cooperation within Canada and Ontario. In Ontario, the Intelligence-led Joint Forces Strategy (IJFS) was established in 2021, to which Thunder Bay is included, along with some First Nations policing agencies.
Manherz said they don't get too many incidents that aren't valid.
"We try to do our best to investigate everything that comes in."
When investigating horrific crimes, especially ones that victimize children, Manherz and Hagstrom were asked what they do to disconnect and protect their mental health.
Both had similar answers. The detectives said it's difficult to "unplug," but they opt to spend time being in the moment with their families and try to compartmentalize what they see each day at work.
There is a safeguard program for officers. It's designed as a proactive and mandatory mental health program to support officers who routinely experience potentially traumatic situations. They are also required to see a psychologist yearly.
As the digital age continues to mature, so do the tactics of individuals who try to take advantage of those who are vulnerable.
Police advise parents to talk to their children about the harms of sharing intimate photos.
If you suspect that a child may be a victim of exploitation, contact the police or submit a report anonymously through Cybertip.ca. If you believe a child is in immediate danger, call 911. Your actions could help protect a child from further harm.
