Toronto Consulate Shooting: Canada’s Security State Logic

Toronto U.S. Consulate shooting exposes a documented pattern: the security state decides what gets solved, what stays open, and who pays.

Shots Fired. No Suspects. No Motive. No Surprise.

At approximately 4:30 in the morning on March 10, 2026, a white Honda CR-V stopped in front of the United States Consulate General on University Avenue in downtown Toronto. Two men stepped out of the vehicle, fired multiple rounds at the front of the building, got back into the car, and drove south. Within hours, the political machinery of the Canadian state was fully activated. The Prime Minister condemned it. The Premier condemned it, invoking the spectre of “sleeper cells.” The Mayor condemned it. The RCMP’s Integrated National Security Enforcement Team was engaged. FBI coordination was announced.

No suspects have been identified. No motive has been confirmed. The car drove away. This is a city blanketed by Automated License Plate Recognition technology — technology that Toronto Police have publicly called a “game-changer” for security operations, capable of scanning thousands of plates per hour. The consulate itself is under constant surveillance. There were cameras. There were shell casings. There was a vehicle description. The building is, by the Deputy Chief’s own description, “highly secure, highly fortified.” The suspects drove south on University Avenue and disappeared.

This came three days after two synagogues struck in North York and Thornhill in the early hours of Saturday morning. Which came four days after Temple Emanu-El shooting in North York shortly before 11pm following a Purim celebration. Which followed months of similar overnight incidents stretching back through 2024 across the Greater Toronto Area and Montreal — a series of shootings at Jewish schools, synagogues, and community institutions, consistently overnight, consistently without injuries, consistently without independent witnesses, consistently without public arrests. The consulate shooting is not the beginning of a story. It is the latest chapter of one.

Since October 7: The Pattern Nobody Will Name

In the weeks and months following Hamas’s October 7, 2023 attack on Israel, and Israel’s subsequent military campaign that has killed tens of thousands of Palestinians in Gaza, Canadian political life was split along a fault line that has not closed since. On one side: a broad, sustained, and largely peaceful pro-Palestine movement demanding ceasefire, arms embargoes, and accountability. On the other: a coordinated institutional effort — from lobby organizations, federal politicians, and the security apparatus itself — to frame that movement as a threat to Jewish safety in Canada.

Into this environment, beginning in early 2024 and continuing with accelerating frequency through the beginning of 2026, came a wave of overnight shootings at Jewish institutions across the GTA and Montreal. May 2024: two masked suspects fire multiple shots at Bais Chaya Mushka, a Chabad girls’ school in North York at 4:52 in the morning. No injuries. No eyewitnesses.

Within a week, Montreal school shooting at the Belz Yeshiva Ketana. Days later, a second Montreal Jewish school is struck. October 2024: Bais Chaya Mushka is struck again — on Yom Kippur. December 2024: the same school hit a third time, at 2:33 in the morning.

March 2026: Temple Emanu-El struck by gunfire shortly before 11pm following a Purim celebration. Multiple shell casings at the front entrance, bullet holes in windows and doors. No suspect information confirmed. Within four days, two more synagogues struck — Beth Avraham Yoseph in Thornhill and Shaarei Shomayim in North York — within roughly an hour of each other. By the count of UJA Federation president Adam Minsky, this marks UJA’s four-year count: at least four Jewish institution shootings in Toronto in two years.

Across more than a dozen incidents in two cities over more than two years: overnight timing, no injuries, no independent witnesses, evidence limited to surveillance footage and police statements, investigations described as “relentless” with minimal public updates on arrests. The CBC reported on Jewish community reaction — a community increasingly afraid and increasingly frustrated by the lack of resolution.

There is only one set of institutions in Canada with the power, reach, and historical track record capable of shaping narratives of domestic threat at this scale: the security state itself. This does not require some cartoonish centralized plot. What it suggests instead is something far more familiar in the history of national security politics: a symbiotic relationship. Certain actors benefit from heightened threat narratives, while the security apparatus benefits from the legitimacy, funding, and expanded powers that those narratives produce. Once you understand how the Canadian security state actually operates, the pattern stops looking mysterious. It starts looking institutional.

Canada’s Documented Security State Record

In 1919, Max Weber established the foundational definition of the modern state: the entity that claims a monopoly on the legitimate use of physical force within a given territory. Not just the entity that uses force — the entity that decides who is permitted to use it, under what conditions, against whom, and with what justification. The monopoly has a maintenance requirement. It needs ongoing justification. A security apparatus without threats has no mandate, no budget, and no political cover.

This is not a conspiracy — it is an institutional logic that operates whether or not any individual within the system consciously intends it. Police agencies need crime. Intelligence agencies need threats. The counterterrorism apparatus, built at enormous expense following September 11, needs terrorism. The question is never whether the security state will find ways to demonstrate its necessity. The question is how it does so, and at whose expense. In Canada, the answers are documented in court rulings, parliamentary records, and civil lawsuits.

Manufacturing Threats: The Terror Factory on Canadian Soil

The most thoroughly documented case of the Canadian security apparatus manufacturing the threats it claims to be neutralizing is the BC Legislature bomb plot. John Nuttall and Amanda Korody were recovering heroin addicts living in Surrey, British Columbia. Recent converts to Islam, they held extreme views and were, by the trial judge’s assessment, entirely incapable of acting on them without outside direction. In early 2013, the RCMP launched “Project Souvenir” — a six-month undercover operation Project Souvenir approval came despite a “lack of evidence of any criminal activity.”

An undercover officer posing as an Arab businessman befriended the couple, provided religious “guidance,” exploited their vulnerabilities, and steered their nuclear submarine plans — they had talked about hijacking nuclear submarines — toward something executable. The police provided the C-4 explosive. The police provided the fake detonators. The couple placed what they believed were functional pressure cooker bombs on the grounds of the BC Legislature on Canada Day 2013. They were convicted by a jury in 2015.

Then BC Supreme Court Justice Catherine Bruce stayed the proceedings. Her ruling: Justice Bruce ruling — “Simply put, the world has enough terrorists. We do not need the police to create more out of marginalized people who have neither the capacity nor the sufficient motivation to do it themselves.”

The BC Court of Appeal upheld the stay unanimously in 2018. One justice called the investigation a Court of Appeal ruling — “a travesty of justice.” Nuttall and Korody filed a civil lawsuit. Their lawyer: they Nuttall Korody lawsuit — “would not have been a threat to the Canadian public if it weren’t for the actions of the RCMP.”

The Toronto 18 case involved two embedded informants. Mubin Shaikh was Shaikh’s RCMP payment — paid $300,000 by the RCMP, led training camps, and bought bullets for the group. Shaher Elsohemy — who made Elsohemy’s compensation request of $15 million and received $4.1 million — arranged the phony ammonium nitrate purchase that formed the basis of the bomb plot charges. Seven charges stayed against seven of the eighteen accused.

In the United States, researcher Trevor Aaronson documented in The Terror Factory that in the overwhelming majority of domestic terrorism prosecutions following September 11, an FBI informant was central to developing the plot — not merely observing it. In Australia, a Victorian court found undercover officers had groomed a 13-year-old autistic Muslim boy via Discord into a fake terrorism plot. The Five Eyes counterterrorism model produces this outcome not by accident but by design: informants are paid to find threats, and when threats don’t exist at the required level of prosecutability, informants help create them.

Managing Non-Resolution: When the State Looks Away

The apparatus’s second documented failure mode is the inverse: managing the non-resolution of real threats when resolution serves institutional purposes less well than continuation. On October 20, 2014, Martin Couture-Rouleau drove his car into two Canadian soldiers in Saint-Jean-sur-Richelieu, Quebec, killing Warrant Officer Patrice Vincent. Paulson confirmation details — RCMP Commissioner Paulson confirmed his passport had been seized and that he was one of 90 suspected extremists under active investigation.

He had been arrested at the airport in July attempting to travel to Turkey. The RCMP had enlisted his family in de-radicalization efforts and October 9 contact — had spoken with him as recently as eleven days before the attack. He killed a soldier anyway. Two days later, Michael Zehaf-Bibeau shot Corporal Nathan Cirillo at the National War Memorial and stormed Parliament Hill. His email had been found on the hard drive of an individual the RCMP had charged with terrorist-related offences. He was “on their radar.” He penetrated the Centre Block of Parliament anyway.

We have covered the Parliament Hill attack and CSIS intelligence failures in detail. Zehaf-Bibeau’s vehicle had a fake license plate fashioned from junk mail that Zehaf-Bibeau ALPR evasion — evaded detection for nearly 24 hours — in a city with widespread ALPR deployment at the time.

The political aftermath is inseparable from the attacks. Harper’s Bill C-51 was introduced on January 30, 2015 — three months after Parliament Hill — and received Royal Assent on June 18, 2015. What C-51 powers explained: gave CSIS the power to actively “disrupt” suspected threats rather than merely surveil them; expanded grounds for warrantless preventative arrest; allowed unprecedented inter-agency information sharing; permitted CSIS to seek judicial pre-authorization for measures that would otherwise violate the Charter.

The Canadian Civil Liberties Association asked the obvious question — before expanding these powers, shouldn’t we understand why the powers that already existed failed to prevent the attacks? The question was not answered. The bill passed anyway. The structure is worth naming plainly: two known individuals, both under active monitoring, carried out political violence. That violence became the primary justification for the largest expansion of Canadian surveillance and security powers since September 11. The security apparatus emerged from its own documented failure with more resources, a broader mandate, and fewer legal constraints.

More recently: in February 2026, an 18-year-old in Tumbler Ridge, British Columbia killed eight people at a school and family home. Firearms seizure confirmation — RCMP officials confirmed firearms had been seized from the family home due to documented mental health concerns, but were returned after a successful court petition. The killing followed. Pre-knowledge. Intervention. Reversal. Lethal outcome.

We have also written about the Vancouver attacker, Kai-Ji Adam Lo, who was known to police before he drove into a Filipino community festival and killed 11 people. The payoff in each case is the same: violence that wasn’t stopped becomes the justification for expanded power.

What October 7 Is For, in Canada

Go back to the pattern documented above. More than a dozen overnight incidents. Two cities. Two-plus years. No injuries. No independent witnesses. No meaningful public arrests. A school struck three times. Synagogues struck on Yom Kippur and after Purim celebrations. An apparatus with mass ALPR, coordinated RCMP-CSIS-FBI intelligence sharing, and a demonstrated ability to run six-month undercover operations against recovering heroin addicts — unable, apparently, to identify the occupants of a white Honda CR-V who opened fire on a diplomatic building at 4:30 in the morning.

The apparatus has a documented record of manufacturing prosecutable threats when institutional incentives require them. It has a documented record of managing non-resolution of real incidents when open cases serve institutional purposes better than solved ones. Post-October 7, the institutional incentives are among the most clearly aligned they have ever been: pro-Israel lobby organizations are pressuring the government to criminalize BDS and pro-Palestine speech; security agencies are explicitly asking to treat pro-Palestine activism as a threat category; Israeli government officials are applying diplomatic pressure on Ottawa.

We have tracked this pressure across pieces on Trump’s terror factory signaling, the architecture of crisis, and Canada’s imperial complicity. In this context, a sustained pattern of antisemitic attacks with no arrests serves specific, identifiable political functions: it maintains a narrative of existential threat to Jewish communities; it justifies expanded security presence and surveillance infrastructure; it creates political pressure to treat criticism of Israeli policy as adjacent to physical violence; and it delegitimizes the pro-Palestine movement by placing it permanently in the same political frame as the unsolved shootings.

None of this requires the incidents to be fabricated. The machine does not need a central coordinator deciding to manufacture a threat. It needs an institutional incentive structure that produces certain outcomes through the ordinary operation of its logic. Threats that justify the apparatus get manufactured. Investigations that resolve inconvenient open cases get under-resourced. Narratives that serve the expansion of power get amplified. This is not speculation — it is the documented operational history of Canadian counterterrorism, confirmed by two courts and a parliamentary record stretching back to the McDonald Commission in 1981.

Consider the data point that the mainstream press has conspicuously failed to connect to the synagogue shooting pattern. In November 2024, an assistant director of Honest Reporting Canada was HRC graffiti charges — charged with 17 counts of mischief for anti-Palestinian graffiti in an east Toronto neighbourhood. Multiple witnesses. Caught on camera. Charges laid within days. Those charges were HRC charges withdrawn in March 2025 after the accused and co-defendants each made a $1,000 donation to SickKids Foundation.

In the same city, during the same period: a dozen overnight shootings at Jewish institutions, overnight, no witnesses, no arrests. The apparatus that quickly identified and charged a graffiti vandal — three suspects, 17 counts, prompt arrest — has spent two-plus years unable to identify the network conducting coordinated overnight drive-by shootings across the GTA and Montreal. The parsimonious explanation is not “shadowy anti-Zionist terror network outsmarts the most surveilled security apparatus in Canadian history.” It is: a machine that has institutional incentives to let certain cases stay open is letting them stay open.

Canada Iraq War myth — Canada’s history of aligning its security apparatus with American and Israeli imperial interests — did not begin with October 7 and will not end when the bombs stop falling on Gaza. The security apparatus built to monitor “terrorism” in Muslim communities following September 11 is now being explicitly asked to treat pro-Palestine activism as a security threat. Surveillance of mosques, infiltration of community organizations, monitoring of social media for “extremist content” — these are the documented operational history of CSIS and the RCMP, now applied with expanding scope.

The Question That Isn’t Being Asked

The consulate shooting will generate weeks of political commentary, security analysis, and geopolitical speculation. Most of it will ask: what does this mean for Canadian security? What does this mean for the US-Iran conflict? What does this mean for Jewish communities? These are not illegitimate questions. But they are not the most important one. The most important question is structural: why does the pattern of what gets solved and what doesn’t correspond so precisely to institutional interest?

Serious accountability journalism would ask: what investigative resources were deployed in the synagogue and school shooting investigations, compared to the Toronto 18 or Nuttall/Korody cases? Have informants been deployed in these investigations, and if so, what is their relationship to the perpetrators? What political direction, if any, has been communicated to RCMP and CSIS regarding these investigations? Why has a network conducting coordinated overnight attacks across two major Canadian cities for more than two years remained substantially publicly unidentified?

These questions are not asked because the dominant media framework — in which the security state is essentially well-intentioned but resource-constrained, occasionally failing but never strategically — cannot accommodate them. The framework that can accommodate them is the one Weber gave us over a century ago and that two Canadian courts confirmed in the past decade: the state does not merely respond to violence. It manages it. It decides what constitutes a threat, who gets prosecuted, which narratives get amplified, and which investigations stay open.

That management has never been neutral. It is not neutral now. Understanding that the Toronto US Consulate shooting and the synagogue shootings before it are not simply failures of a well-meaning apparatus, but events functioning within a system with clear institutional beneficiaries — is not cynicism. It is the precondition for any accountability worth having. The car drove south on University Avenue and disappeared. The investigation is ongoing. The political machinery is fully activated. The pattern continues.

Sources