I personally am skeptical of any specific claims about what exactly (criminality, security, specific legislative prohibitions [hand-waving about whatever else is in there], etc) is meant by the 'background' and 'prohibitions' flags in the tracker.
I don't mean that anyone in particular is right or wrong about these - but I simply have not been able to parse out what the exact correspondence is, based on posts here (what people say is happening on tracker) and what they report as having been done/told (i.e. in gcms notes and call centre people). And I see no obvious way to confirm beyond inferring this way, unless someone who knows really well from inside IRCC exactly what they mean.
[Side note: it's 100% clear to me that when people hear 'not started' from the call centre people, it does not mean what normal english means by the expression 'not started.' It's some kind of basic system flag that means something else - or nothing significant at all, like 'someone touched it and reset the flag recently.').]
In other words: it remains a mystery exactly what it means and people get surprised (and worried) based on possibly (likely?) erroneous claims that they know this. And it's possible the model people have in their minds is wrong.
As for criminality specifically: my intuition (guess) is that criminality has to be cleared more than once - once at the background check stage (where there's an actual process, if needed), and later - as part of prohibitions - that may just be 'database check to ensure nothing has changed since the first-stage clearance.' The latter usually just a formality, if I'm right. (Also possibility for confusion in discussion since technically some of the other prohibitions - war crimes, human rights abuses - can also be termed criminality, but the basic criminal records checks in first stage wouldn't cover those except n rare cases)
Best of luck.
