The Citizen Lab

As part of World Press Freedom Day 2026, senior legal advisor Siena Anstis will be speaking on a webinar titled “Media Under Attack,” part of @FPCThinkTank "Freedom Under Threat” series. Register: t.co/7h9Ki5iyCL t.co/B3vNrFc03r

"We believe students aren’t protesting for a very simple reason: They are afraid. They are self-censoring and disengaging from campaign activism to avoid punitive measures," writes senior research fellow @jon_penney in his new essay w/ Bruce Schneier for @ConversationUS. t.co/buRRmFqgwo

Senior research associate @KateRobertson_ writes for @thewalrus about the potential implications of Canada’s proposed Bill C-22 for future data-sharing agreements with foreign law enforcement agencies. t.co/0EDbEC7Da6

These operations point to a shift toward a Military-Civil Fusion model, in which state-aligned objectives are pursued through state-sponsored attacks carried out by private contractors.

The dual targeting of ICIJ by two distinct actors–using different tactics and tradecraft–offers rare insight into China’s broader approach to digital transnational repression.

NEW REPORT🔎 In collaboration with @ICIJorg, we identified two distinct actors aligned with the People’s Republic of China that have been targeting and impersonating journalists and civil society. Full report 👇 t.co/22nNnED9AQ

These threat actors, which we refer to as GLITTER CARP and SEQUIN CARP, have used phishing emails and detailed digital impersonation schemes in an attempt to gain information and login credentials.

5/ For the TL;DR version, read the FAQ 👇 t.co/b7JMiqk3XL

2/ Our findings shed light on how suspected commercial surveillance vendors (CSVs) operate deep inside the global telecom ecosystem.

4/ Our findings highlight systemic weaknesses in global telecom trust models and the urgent need for stronger safeguards.

3/ These actors exploit telecom interconnect providers and leverage access to private operator networks to carry out covert location tracking that persisted for years.

🚨New research reveals how two sophisticated surveillance actors exploited the global telecom ecosystem and, for the first time, directly links combined 3G and 4G network attacks to mobile operator infrastructure. Full report 👇 t.co/NfBNUuewdj t.co/nL8Bvn44in

Join Noura Aljizawi at the inaugural Ottawa Civic Space Summit on April 21, hosted by Cooperation Canada and Resilient Societies: t.co/mEiaehHFGj

She will speak on the “Defend Across Borders: Safe Havens, Exile, and Transnational Repression” panel, discussing mobilization in exile, TNR, and the responsibilities of host states in responding to transnational threats against exiled dissidents and protecting the integrity of their own public spheres.

Senior research associate @emiledirks spoke with @DominoTheoryMag about Xi Jinping’s view of national security in light of U.S. and Israeli cyber operations in Iran: t.co/9Ass5U6vwx

Other products developed by Cobwebs are also concerning, as are its ties to spyware vendor Quadream via Omri Timianker, who founded Cobwebs Technologies and now oversees Penlink’s international operations. t.co/r6WjaI7BPM

Webloc provides access to data on hundreds of millions of people across the globe, which is constantly harvested from the apps installed on their mobile devices. Customers can use it to monitor the movements and personal characteristics of entire populations, including their past locations.

Location data collected from apps and digital advertising can reveal habits, interests and almost any other aspect of someone's life. The misuse of consumer data raises concerns, especially when used to target vulnerable groups such as immigrants or protesters. t.co/8ROctGnefJ

Based on the responses to 96 freedom of information requests, we conclude that governments in Europe and the UK are highly nontransparent about their potential use of ad-based surveillance. t.co/vsSCwghf0j

Webloc customers also include the national police in El Salvador and US law enforcement agencies at the federal, state, and local levels, including ICE, US military, Texas Dept. of Public Safety, and Dept of Homeland Security West Virginia. t.co/pesCXCudO9

In collaboration with @VSquare_Project, we reveal that Hungarian domestic intelligence has been using Webloc since at least 2022 and continues to use it today. This represents the first confirmation of the use of ad-based surveillance tech in Europe. t.co/XwP0IFuTl5

Webloc is a global geolocation surveillance system that monitors hundreds of millions of people based on data purchased from consumer apps and digital advertising. It was developed by Cobwebs Technologies and is now sold by its successor Penlink.

NEW REPORT: “Uncovering Webloc: An Analysis of Penlink’s Ad-based Geolocation Surveillance Tech” Our research confirms that ad-based surveillance tech Webloc is used by military, intelligence, and law enforcement agencies across the globe. t.co/JAhezx0KUV

“People will fall back to what works, and they won’t think about security in those critical moments.” Senior researcher Ksenia Ermoshina spoke w/ the @nytimes about how Russians may start giving in to the limits imposed by state censorship technology. t.co/hjUUmlTdWX

In a submission to the @UNHumanRights Working Group regarding the use of tech in the operations and activities of mercenaries, mercenary-related actors and private military and security companies, co-author @RonDeibert warns that states should stop relying on the private sector for digital operations. Read it here: t.co/ukhl92eMFM

When it comes to the consequences of AI disinformation, “the risk cuts both ways,” senior researcher Alberto Fittarelli told the @nytimes. t.co/9kFPI8msfv

Today at 3:30 pm @RonDeibert will appear before the 🇨🇦@HoCCommittees Subcommittee on International Human Rights of the Standing Committee on Foreign Affairs and International Development (SDIR) to testify on transnational repression. t.co/ffjUCeI6BI

Italian prosecutors have confirmed the hacking of journalist Francesco Cancellato by Paragon spyware. Senior researcher @jsrailton spoke with The Guardian and @TechCrunch about the case. 🧵

New submission from the Citizen Lab to @UNHumanRights on protecting human rights defenders from digital transnational repression: t.co/uGyLMEScRx

Senior researcher @irenepoet writes for @CarnegieEndow about the Myanmar military junta’s use of internet service provider (ISP) infrastructure to surveil and censor users. Read the article: t.co/RkAJtB5tq7