The Citizen Lab

4/Robertson argues that strong encryption is critical to cybersecurity, and that government efforts to create lawful-access mechanisms, surveillance capabilities, or backdoors in communication technologies makes all Canadians less safe.

2/If passed, the controversial Bill C-22 (“Lawful Access Act”) would empower the Canadian government to require surveillance capabilities be built into any communications technology in Canada.

3/The bill would force the stockpiling of all Canadians’ sensitive metadata, and everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement.

4/Robertson argues that strong encryption is critical to cybersecurity, and that government efforts to create lawful-access mechanisms, surveillance capabilities, or backdoors in communication technologies makes all Canadians less safe.

3/The bill would force the stockpiling of all Canadians’ sensitive metadata, and everything from smartphones, smartwatches, banking apps, health apps, video game platforms, and public WiFi or CCTV networks could be accessed by law enforcement.

4/ Our research shows devices at international news network Al Jazeera were infected with mercenary spyware from Candiru (rebranded as “Integrity Labs”) via targeted online advertisements.

5/This report presents the first public technical documentation of in-the-wild infection of devices with zero-click mercenary spyware via targeted advertisements.

3/ Discover-Tech's platform enables spyware firms to mass profile and deanonymize users, then covertly hack them by displaying seemingly-benign ads containing zero-click exploits to install spyware.

2/ At the core of this report is Discover-Tech, a company that presents itself as a legitimate online advertising business. In reality, it operates as an intermediary bridging the digital advertising ecosystem and mercenary spyware vendors (and their government customers) seeking to identify and track individuals with spyware.

Citizen Lab director @RonDeibert tells @globeandmail how Canada’s lawful access bill “will make it impossible for a large number of invaluable privacy-preserving tools” to operate in the country.

2/ The second report from the Working Group on the use of mercenaries draws on Citizen Lab research to assess the human rights impacts of cybermercenaries. Read it here: t.co/HDJobA9LkF

2/ Join senior research associate @KateRobertson_ on September 23 at 3:45 am EST to talk about upholding justice when law enforcement reaches across borders. Register: t.co/5rfKOx4emL

3/ A report from BlackCore celebrates the success of their Angola training program, demonstrating the damage the influence-for-hire industry can do to an online ecosystem.

2/ In our brief, we examine BlackCore’s digital infrastructure, including how they construct fake profiles and amplify content, and how they market themselves and their results to clients.

2/ The letter cites the Citizen Lab’s 2020 research into BellTroX’s hack-for-hire operation, which found that it conducted commercial espionage on behalf of clients. Read it here: t.co/LiYu5RbfvX

2/ At least 11 Serbian pro-democracy campaigners and opposition figures recently received Apple Threat Notifications. Meanwhile, the team from @AmnestyTech has found that NoviSpy spyware is still being deployed against members of the student movement, and that the spyware has been modified in an attempt at greater stealth.

3/ Apple patched the iMessage exploit as of iOS iOS 18.4.1, but the continued Apple Threat Notifications indicate that the student movement continues to be aggressively targeted with mercenary spyware. If you are concerned your iPhone may be targeted with mercenary spyware, we encourage you to use Apple’s Lockdown Mode and seek expert guidance from trusted experts, such as the @accessnow digital security helpline. Read our investigation: t.co/r7jfmepmiM

4/ We are not attributing these infections to a particular Pegasus operator at this time, but we note an overlap with a previously-identified campaign targeting Russian and Belarusian-speaking exiled journalists and activists in Europe.

3/ This case is not the first time that a European member of parliament has had their devices either targeted or hacked with mercenary spyware.

2/ Kouloglou was infected during key periods of PEGA committee activity, meaning that confidential documents and communications relevant to the committee may have been exposed.

5/ Read @accessnow's recommendations to companies and states here: t.co/mObazFSyJx

4/ This is just the latest in a long line of abuses of Cellebrite’s technology by autocrats around the globe, including against activists in Kenya and Jordan earlier this year: t.co/B8onzaee5C

2/ Our analysis is confirmed by a document prepared by Russian authorities showing that Cellebrite was used to extract information to aid in Pivovarov’s prosecution.

3/ Importantly, we found that authorities continued to use Cellebrite for political repression even after the company had cancelled its contracts with Russian customers.

The dual targeting of ICIJ by two distinct actors–using different tactics and tradecraft–offers rare insight into China’s broader approach to digital transnational repression.

These operations point to a shift toward a Military-Civil Fusion model, in which state-aligned objectives are pursued through state-sponsored attacks carried out by private contractors.

These threat actors, which we refer to as GLITTER CARP and SEQUIN CARP, have used phishing emails and detailed digital impersonation schemes in an attempt to gain information and login credentials.

5/ For the TL;DR version, read the FAQ 👇 t.co/b7JMiqk3XL

3/ These actors exploit telecom interconnect providers and leverage access to private operator networks to carry out covert location tracking that persisted for years.

2/ Our findings shed light on how suspected commercial surveillance vendors (CSVs) operate deep inside the global telecom ecosystem.