Citizen Lab is a research lab at the University of Toronto’s Munk School of Global Affairs, founded in 2001 by Ronald Deibert. Documents targeted digital threats against journalists, activists, dissidents, lawyers, and civil-society figures. Operates the most consequential public attribution research on commercial spyware: discovered Pegasus deployments in over 45 countries, identified Hermit, Predator, NSO Group operations, and contributed to the disclosure of zero-day exploits used against specific targets.
What it means in practice
Where the public record of mercenary spyware mostly comes from. Citizen Lab’s methodology combines on-device forensic analysis (cooperating with at-risk individuals who suspect targeting), network-level scanning (identifying command-and-control infrastructure operated by spyware vendors), legal and policy analysis (documenting how the procurement and deployment chains operate), and public-interest reporting (publishing technical findings in plain English that journalists and policymakers can act on). The lab’s reports have triggered EU parliamentary inquiries, US sanctions against NSO Group and Intellexa (Commerce Department Entity List, 2021 and 2023), and Apple and Meta lawsuits against the spyware vendors.
Who uses its work, and how
Used by: journalists writing on surveillance and authoritarianism (the Citizen Lab report is often the source citation), human-rights lawyers building cases against spyware vendors and customer governments, policymakers drafting export controls and sanctions, security researchers building detection tooling, and at-risk individuals seeking forensic evidence of compromise. The lab provides confidential forensic services to specific at-risk targets (the engagement is gated by an intake process; not every concerned individual receives a scan, but the prioritization is on documented threat exposure). Predaxia’s editorial frame: when an article cites Citizen Lab, that citation is the closest the public has to a verified attribution in a domain where almost everything is denied or classified.
What you can change today
If you suspect targeted spyware compromise (specific and credible suspicion, not generalized worry), the path is: do not wipe the device, do not factory reset, contact Citizen Lab through their secure intake (citizenlab.ca/contact) or Amnesty’s Security Lab (securitylab.amnesty.org) from a different device. For general awareness: subscribe to the Citizen Lab Substack and reports feed (citizenlab.ca), which publishes the discoveries that drive much of the privacy-and-surveillance news cycle. Donations support the lab’s capacity to take cases pro bono; the lab is funded primarily by foundations and academic sources, with capacity bottlenecks during high-volume incident periods.