The Citizen Lab

WATCH: Last week, the European Parliament had a plenary debate on #spyware after Citizen Lab researchers found that a former MEP's phone was hacked with #Pegasus spyware. The consensus: the crisis is getting worse. @HNeumannMEP @saskiabricmont @ElenaKountoura @LukasSieperMdEP @danusenerudova

4/ We are not attributing these infections to a particular Pegasus operator at this time, but we note an overlap with a previously-identified campaign targeting Russian and Belarusian-speaking exiled journalists and activists in Europe.

3/ This case is not the first time that a European member of parliament has had their devices either targeted or hacked with mercenary spyware.

2/ Kouloglou was infected during key periods of PEGA committee activity, meaning that confidential documents and communications relevant to the committee may have been exposed.

1/ NEW REPORT: Former Member of the European Parliament Stelios Kouloglou was repeatedly hacked with NSO Group’s Pegasus spyware while serving on the EU committee investigating Pegasus and other spyware abuses in Europe. Full report: t.co/IPiOhHDKix

In “How to Combat Transnational Repression,” published in @JoDemocracy Citizen Lab researchers Siena Anstis and @mmichae1sen write about the lack of accountability for perpetrators of transnational repression. Read: t.co/FkNEExR26B

Senior research associate @emiledirks has been elected to serve as a member of @PENCanada's board of directors, chairing the newly-formed Digital Threats committee to explore how digital and emerging technologies are impacting freedom of expression in Canada and around the world: t.co/fMk3QnQGAR

5/ Read @accessnow's recommendations to companies and states here: t.co/mObazFSyJx

4/ This is just the latest in a long line of abuses of Cellebrite’s technology by autocrats around the globe, including against activists in Kenya and Jordan earlier this year: t.co/B8onzaee5C

1/ NEW REPORT: We find that Russian authorities used Cellebrite to gain access to activist Andrey Pivovarov’s phone. Full brief: t.co/KFaRMZREli

2/ Our analysis is confirmed by a document prepared by Russian authorities showing that Cellebrite was used to extract information to aid in Pivovarov’s prosecution.

3/ Importantly, we found that authorities continued to use Cellebrite for political repression even after the company had cancelled its contracts with Russian customers.

Senior fellow Cynthia Khoo writes that Canada's new AI strategy is reorienting democratic functions "around the false god of AI" in @thewalrus t.co/5qRQZf4Ssh

Senior researcher Luis Fernando García participated in a Conversatorio Regional hosted by @FViaLibre on “Technologies of state surveillance, democratic control, and protection of civil space.” Watch here: t.co/oMAjCB4Xk9.

As part of World Press Freedom Day 2026, senior legal advisor Siena Anstis will be speaking on a webinar titled “Media Under Attack,” part of @FPCThinkTank "Freedom Under Threat” series. Register: t.co/7h9Ki5iyCL t.co/B3vNrFc03r

"We believe students aren’t protesting for a very simple reason: They are afraid. They are self-censoring and disengaging from campaign activism to avoid punitive measures," writes senior research fellow @jon_penney in his new essay w/ Bruce Schneier for @ConversationUS. t.co/buRRmFqgwo

Senior research associate @KateRobertson_ writes for @thewalrus about the potential implications of Canada’s proposed Bill C-22 for future data-sharing agreements with foreign law enforcement agencies. t.co/0EDbEC7Da6

These operations point to a shift toward a Military-Civil Fusion model, in which state-aligned objectives are pursued through state-sponsored attacks carried out by private contractors.

The dual targeting of ICIJ by two distinct actors–using different tactics and tradecraft–offers rare insight into China’s broader approach to digital transnational repression.

NEW REPORT🔎 In collaboration with @ICIJorg, we identified two distinct actors aligned with the People’s Republic of China that have been targeting and impersonating journalists and civil society. Full report 👇 t.co/22nNnED9AQ

These threat actors, which we refer to as GLITTER CARP and SEQUIN CARP, have used phishing emails and detailed digital impersonation schemes in an attempt to gain information and login credentials.

5/ For the TL;DR version, read the FAQ 👇 t.co/b7JMiqk3XL

2/ Our findings shed light on how suspected commercial surveillance vendors (CSVs) operate deep inside the global telecom ecosystem.

4/ Our findings highlight systemic weaknesses in global telecom trust models and the urgent need for stronger safeguards.

3/ These actors exploit telecom interconnect providers and leverage access to private operator networks to carry out covert location tracking that persisted for years.

🚨New research reveals how two sophisticated surveillance actors exploited the global telecom ecosystem and, for the first time, directly links combined 3G and 4G network attacks to mobile operator infrastructure. Full report 👇 t.co/NfBNUuewdj t.co/nL8Bvn44in

Join Noura Aljizawi at the inaugural Ottawa Civic Space Summit on April 21, hosted by Cooperation Canada and Resilient Societies: t.co/mEiaehHFGj

She will speak on the “Defend Across Borders: Safe Havens, Exile, and Transnational Repression” panel, discussing mobilization in exile, TNR, and the responsibilities of host states in responding to transnational threats against exiled dissidents and protecting the integrity of their own public spheres.

Senior research associate @emiledirks spoke with @DominoTheoryMag about Xi Jinping’s view of national security in light of U.S. and Israeli cyber operations in Iran: t.co/9Ass5U6vwx

Other products developed by Cobwebs are also concerning, as are its ties to spyware vendor Quadream via Omri Timianker, who founded Cobwebs Technologies and now oversees Penlink’s international operations. t.co/r6WjaI7BPM