Byron Sonne recently joked he was the last guy counter-terrorism officials would be prone to investigate.

The 37-year-old man made the comment about a month ago at a “Surveillance Club” meeting, a monthly gathering for academics and activists who enjoy discussing surveillance issues and ideas.

Sonne shared his plans to protest the G20 and mused he was hardly the type to raise security alarm bells — slightly nerdy with a receding hairline, the computer specialist lives in a million-dollar home with his artist wife. In his spare time, he likes to hang out at HackLab TO, a non-profit group for techies who delight in building everything from LED signs to computer codes.

“He looks, you know, generic. Kind of like a geek,” observed Jesse Hirsh, an Internet specialist and broadcaster who met Sonne at the May 5 meeting. “We sort of joked . . . he was this middle-aged white guy, how he didn’t really fit the (terrorist) profile.”

So Hirsh was shocked to read the headlines Wednesday and discover Sonne is at the centre of a G20 terror investigation.

On Tuesday afternoon, police converged on Sonne’s home on Elderwood Dr. in Forest Hill and arrested him on a slew of charges, the most serious of which is possession of an explosive. He also faces charges of mischief and intimidating a justice system participant.

While Sonne’s family would not respond to interview requests, friends and colleagues say they are baffled by the charges. Police are saying little other than that the charges stem from a G20-related investigation.

Sonne appeared briefly at a bail hearing Wednesday, dressed in a black T-shirt. He agreed to adjourn his hearing until Saturday and lawyer Kevin Tilley requested a publication ban, which was granted.

While Sonne looked tired and occasionally worried, when he walked from the courtroom he appeared to wink at some reporters.

For those who know Sonne, it is this tendency for mischief that may have landed him in hot water. In high school, Sonne reportedly planted a fake bomb that resulted in his school being evacuated, causing classmates to vote him “most likely to become an international terrorist” in their yearbook, according to a former schoolmate.

Those who now know Sonne say he is a good guy with strong ethics, the farthest thing from a scheming terrorist. With the entire city tense in the lead-up to the G20 summit, Julian Dunn wonders if security officials may have over-reacted to the stunts of an “agent provocateur.”

“He’s not a terrorist or anything like that,” said Dunn, who worked with Sonne in 2003. “If anything, he’s what I would term an agent provocateur. (He likes to) push buttons and challenge the security apparatus.”

At the Surveillance Club meeting, Sonne shared his plans to listen in on police scanners during the summit and disseminate information to protesters via Twitter, according to Hirsh and Andrew Clement, a University of Toronto professor who was also at the meeting.

This was the same tactic used by two protesters at last year’s G20 summit in Pittsburgh, a plan that ultimately led to their arrests. The charges were dropped.

According to Hirsh, Sonne knew his activities could attract unwanted attention from security officials. But at the same time, he did not seem like someone bent on causing mayhem and destruction, Hirsh said.

“He was more critical of the whole circus, as it were,” Hirsh recalled. “I suspect that this may just be a stunt and perhaps a stunt that got out of hand.”

Sonne may have also been deliberately baiting security officials, Hirsh said, and he mentioned wanting to purchase items online that would “trigger counter-terror alarms.”

“It was part of a larger critique or activist exercise to show the absurdity of what’s often referred to as security theatre,” said Hirsh, who didn’t know what items Sonne planned to buy.

Loading... Loading... Loading... Loading... Loading... Loading...

Sonne’s Twitter account also likely placed him on the radar, as G20 security has been actively monitoring social media. His recent tweets link to photos and videos of the security fence, as well as a G20 counter-surveillance “how to” guide he created and posted on a file-sharing website.

Sonne’s tweets suggest he has already been listening in on police communications with a radio scanner, a practice that is legal and used by many news outlets to stay abreast of breaking news. According to Twitter, he has also had two run-ins with G20 police prior to his Tuesday arrest.

“Some people must be stupid; I’ve never been arrested or forced to delete pictures of cops and I’ve been stopped 2 times now #g20report” he tweeted on Monday.

His last Twitter update was at 11:10 a.m. Tuesday.

While HackLab TO wouldn’t respond to interview requests, it released a statement on its website confirming one of its members had been arrested.

“Byron is innocent until proven guilty, and as a member of the lab and a friend we are concerned for him,” the statement read.

Colleagues say Sonne is well-respected in his field of computer security and has previously worked for top companies such as nCircle Network Security and FSC Internet Corp.

Today, he runs his own computer security consultancy called Halvdan, which means “half Danish,” according to former boss Mike Murray.

Murray has known Sonne for seven years and said he would never do anything malicious.

“There’s something fishy to all this. He’s not this kind of person,” Murray said. “Reading all the stuff about explosives — that’s not Byron.”

With files from Denise Balkissoon, Lesley Ciarula Taylor and Teri Pecoskie