How Does The Citizen Lab Investigate Spyware and Digital Threats?

The Citizen Lab investigates spyware and digital threats by combining device forensics with local partner organizations, then publishing the findings as research notes or full reports. It is an interdisciplinary research unit at the Munk School of Global Affairs & Public Policy, University of Toronto, applying expertise in law, computer science, cybersecurity, political science, and social sciences to complex 21st-century issues. Its investigations are relevant to anyone trying to understand how targeted surveillance and disinformation campaigns are documented and attributed.

The investigation model

The Citizen Lab's work follows a recognizable pattern: a suspected digital threat is identified, technical analysis is performed on the affected systems or infrastructure, and the results are interpreted against their legal and political context. Findings are then released publicly through research publications.

Working with local partners

Investigations are often conducted jointly with organizations that have direct access to affected individuals or communities. In the Pegasus spyware case involving a Serbian pro-democracy student activist, the Citizen Lab worked in collaboration with the SHARE Foundation. This division of labor matters: the local partner can identify and reach the target, while the Citizen Lab contributes forensic and technical capacity.

Forensic analysis of devices

To confirm an infection, the Citizen Lab performs forensic analysis of the target's device. In the Serbian case, this analysis confirmed that the iPhone of a member of Serbia's student protest movement was infected with Pegasus spyware. In a separate investigation, forensic analysis of former Member of the European Parliament Stelios Kouloglou's device found that he was hacked with Pegasus while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. The analysis indicated attackers could have had access to confidential documents and committee deliberations.

Interpreting findings in context

Technical confirmation is only part of the output. The Citizen Lab situates its findings within law, policy, and political science — for example, connecting a spyware infection to the target's role on a parliamentary oversight committee, which gives the technical fact a governance dimension.

What the research covers

The Citizen Lab organizes its work under Focus Areas, which include:

• App Security & Privacy
• Artificial Intelligence
• Censorship
• Digital Transnational Repression
• Disinformation
• Law & Policy
• Mass Surveillance
• Targeted Surveillance

Example: influence operations for hire

Under Disinformation, a research note examined the digital infrastructure of BlackCore, an Israeli influence-for-hire company. The investigation identified a BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation. This shows the same investigative approach applied to disinformation infrastructure rather than device infections.

How findings are published

Results appear as research notes or full reports, with a publication directory, tools and resources, and news and events sections on the site. A newsletter subscription is available for updates. Each investigation typically states the focus area, the partner organizations involved, the technical method used, and the conclusions drawn.

What this means for readers

If you want to understand how a spyware or disinformation claim was established, look for three things in a Citizen Lab publication: the named local partner, the forensic or infrastructure analysis performed, and the policy context in which the finding is placed. Those three elements are what turn a suspicion into a documented, attributable investigation.