The Premier of Ontario said that any organization has a few bad apples. He was not wrong about the number, and the number was never the question. What the record shows is that nobody counted anything until a gunman arrived at a stranger’s door — and that the duty to report the kind of breach this was does not begin until the first of January, 2027.
“I don’t want to paint a broad brush or tarnish the police — we have phenomenal police officers. When they get sworn in and they get their badge, they have a duty, and it’s very disappointing to hear what’s been going on, but I don’t want the public to lose trust in our great police, because they are incredible. There’s always, as you say, (in) any organization, there’s always a few bad apples.”
Three things are being said at once. One is a statement about proportion, and it is defensible. One is a request, and it is reasonable. The third is a premise that neither of the first two can survive without — that somebody is in a position to know how many apples there are. That is the one the record destroys, and it does not take long.
On the morning of Thursday 5 February 2026, at York Regional Police headquarters in Aurora, Chief Jim MacSween stood beside Toronto’s chief, Myron Demkiw, and announced that seven serving Toronto police officers and one retired constable were facing charges arising from an organized crime investigation called Project South. Demkiw called it “a painful and unsettling moment” and said the service had “a long road ahead of us.” Later that day the Premier was asked about it somewhere else, and gave the answer above.
The phrase “a few bad apples” is a claim about a distribution. It says: the quantity is small, and the barrel is sound. Everything in this volume concerns the second half of that sentence, because the barrel is the part that can be checked without waiting for a trial — and because the judge who unsealed the file has already published her own finding on it.
Taken in the order the sentence makes them.
There is a rule that would require a police service in Ontario to tell the provincial regulator when someone inside it has helped themselves to personal information. It is real, it is enacted, and it does not apply yet.
Ontario built this in two halves. Provincial institutions — ministries, hospitals, colleges, universities — were brought under a mandatory privacy breach reporting duty by Schedule 2 of Bill 194, the Strengthening Cyber Security and Building Trust in the Public Sector Act, which amended the Freedom of Information and Protection of Privacy Act. Municipal institutions were not included. A municipal police service is a municipal institution, governed by the Municipal Freedom of Information and Protection of Privacy Act, and for the whole of Project South it sat on the other side of that line.
The matching municipal duty arrived in Bill 97, which received royal assent on 24 April 2026 — eleven weeks after the arrests were announced. Municipal institutions, municipal police services expressly among them, must assess a breach against a real risk of significant harm and, where that threshold is met, report it to the Information and Privacy Commissioner and notify the people affected. It takes effect on 1 January 2027. The first annual statistical report covering it is due by 31 March 2028, for the 2027 calendar year.
Every date in the conduct this volume describes falls before the duty starts.
That is the easy observation, and it is not the important one. The important one is that this duty would not have caught Timothy Barnhardt even if it had been in force on 27 May 2025 — because of what kind of duty it is.
A breach reporting obligation is a duty to disclose what the institution has determined. It runs from the moment the service knows. It is an honesty requirement placed on an organisation that has already discovered something, and it is a good one: without it, a service that finds an officer inside a database has every institutional reason to handle the matter quietly. But it has nothing at all to say about the step before. It does not require anybody to look.
The thing that was missing in this file was not candour after discovery. It was discovery. Seventeen off-duty queries over a period of months, several of them followed by violence at the addresses they returned, produced no internal question at any point. A rule that begins “once you have determined a breach occurred” has no purchase on a service that never determines anything, because nothing is reading the log.
And the regulator had already said, in writing, what reading the log would look like. In December 2024 — five months before the query at the centre of this case — the Information and Privacy Commissioner of Ontario published guidance on automated licence plate recognition. On the question of manual searches it was specific:
Police should configure ALPR systems to log all manual searches, and the log should include the identity of the officer conducting the search, the date, time, nature of and reason for the manual search and any associated file numbers.
Read what that sentence already contains. The regulator knew that the live risk in a plate system is not the automated capture, it is a human being typing. It knew what a search log needs in order to be answerable: who, when, what, and the reason. It wrote the specification out.
Two things about it matter here, and they pull in opposite directions, so both get said. The guidance is about automated licence plate recognition, which is not the Ministry of Transportation database Barnhardt is alleged to have used seventeen times; it would be wrong to claim the document covers his conduct. And the guidance says should. It is advice. In December 2024 Ontario’s privacy regulator could describe the control precisely, name the exact fields, and publish it — for one system, as a recommendation.
So the sequence is this. December 2024: the control is specified, as a “should,” for one system. May and June 2025: the queries run, and a gunman finds the address. February 2026: the arrests, and the Premier’s sentence about apples. April 2026: a duty is enacted. January 2027: the duty starts — and it is a duty to report what you have already found.
Nothing in that sequence is anybody’s scandal. It is the ordinary speed of institutional repair, and it is worth stating plainly that Ontario did legislate, which is more than many jurisdictions manage. The point is narrower and harder: the thing enacted is downstream of the thing that failed. The barrel got a rule about reporting rot. It did not get a rule about looking for it.
The detection story is the whole argument, so here it is as a sequence, with the sources for each line set out in full at the end.
Read down the dates and the shape is unmistakable. Everything institutional in this story happens after 18 June 2025, and it happens quickly and in reasonable good faith: an inspection, a regulator’s investigation, a statute, a chief’s programme, a judge insisting on openness. Before 18 June 2025 the column is almost empty, and the one entry in it is a recommendation about a different system.
The barrel did not fail to respond. It responded well. It failed to notice.
This is an economics publication, and the reason this file belongs in it is that the alleged conduct was not a favour economy. It had prices, recurring revenue, a product line and a protection racket, and the prices were low.
Set the five hundred dollars against what it is alleged to have bought. A residential address, supplied to people who wanted it in order to send a man with a gun to the door. On the other side of that transaction, the thirty federal prosecutions the Public Prosecution Service of Canada now records as affected, the trials that will run into 2027 and beyond, a province-wide inspection with an eighteen-month clock, and whatever the Toronto Police Service’s standing with the city is worth.
The supply side had no monitoring cost, so the price did not have to carry one.
That is the economics of it, and it is not a metaphor. A seller who faces no chance of detection does not need to be paid for risk, which is why a plate search cost about what a decent dinner costs. The price was low because the barrel had no sensor, and the absence of the sensor was the subsidy.
Twenty months after the gunman and eight months after the arrests, the number of findings a court has made about the conduct in this file is two, and this is the part of the record that most deserves to be read slowly.
Both of those outcomes look, on their facts, about right. Neither man is alleged to have sold anything, and the second is the clearest case in the file of someone swept in by proximity. His counsel’s description of him — an officer who made the most arrests in his division in his first year, who felt wrongly caught up in this — is not obviously wrong.
But look at what the ledger therefore says. The two matters that have resolved are a stolen cellphone and a single plate lookup done as a favour, and they resolved into house arrest and a pending argument about a discharge. Everything that makes this file a national story — the seventeen searches, the envelopes, the uniforms, the address that reached the men with the gun — remains an allegation in a document written by investigators, and will not be tested until well into 2027.
So the honest state of the record in October 2026 is this. Two convictions, both small, both appropriately resolved. One very large set of allegations, untested. And one finding that is not an allegation at all, because a judge made it in her own reasons: that nobody was suspicious of any of this until a gunman turned up at a door.
That last item is the only thing in the file that is already settled, and it is the one the Premier’s sentence needed to be false.
A few bad apples is a finding. It requires somebody to have opened the barrel.
The response, read as a whole, concedes the point better than any critic could. You do not appoint a retired Court of Appeal judge, arm him with the power to compel documents and data from every police service and board in the province, and give him eighteen months, because eight people in one service did something wrong. You do that when you do not know what is in the barrel and have realised that you have no way of finding out. Ontario’s own answer to “a few bad apples” was a province-wide inspection, and it was the right answer.
The finding here is narrow: not that Toronto’s police are corrupt, but that in this file nothing was watching, and the repair enacted since is downstream of that. Four things would break it.
Ontario is not the control group. The Network, a primary-source atlas of Canadian police technology, publishes evidence ledgers for nine municipal services across six provinces — Edmonton, Regina, Calgary, Lethbridge, Grande Prairie, Vancouver, Winnipeg, Montreal and now Toronto — recording what each service bought, what it switched on, and what its own records do not establish.
Across the seventy-two capability states those ledgers carried before the question was put, not one row asked whether anybody reviews who ran a search. Auditing appeared six times, always inside the evidence for some other system, and always as a feature a vendor advertises or a record nobody obtained.
Toronto is the exception, and it sharpens the point rather than blunting it. Its Board barred predictive policing, mass surveillance and the use of carding data outright in February 2022, and requires that all use of AI technology be auditable. The Service publishes a rule that every licence-plate search carry a valid search reason or case number, with the audit log kept indefinitely — the strongest published position of any service in that atlas. The Globe and Mail counts thirteen police-act convictions in Toronto for unauthorized database access since 2018. Not one is recorded as having surfaced because somebody read a log.
The legal picture is the same shape as the one set out above, and it is not an Ontario problem. Saskatchewan has required a police service to report a breach since 2018, Manitoba since 2022, Quebec since 2022, British Columbia since 2023 and Alberta since June 2025. Every one of those duties begins once a breach is known. None of them requires anyone to look.
The Network · Finding 09, Unwatched: the capability nobody registered · Finding 10, the Toronto ledger
Visual direction after the oceanographic films of Jacques-Yves Cousteau and the crew of the R.V. Calypso, 1943–1996. The saucer is the SP-350 “Denise”. No affiliation; the debt is the point.