citizenlab.ca

The Citizen Lab is an interdisciplinary research unit at the Munk School of Global Affairs & Public Policy, University of Toronto. Its work is organized into a set of focus areas that span the technical, legal, and political dimensions of digital threats. If you want to know whether its research is relevant to your interests, the list below is the most direct answer: App Security & Privacy, Artificial Intelligence, Censorship, Digital Transnational Repression, Disinformation, Law & Policy, Mass Surveillance, and Targeted Surveillance. The unit also frames part of its mission as "counterintelligence for civil society," investigating novel threats to democracy, human rights, and global security in the digital ecosystem.

The focus areas at a glance

How the focus areas show up in published research

The focus areas are not abstract categories; they map onto concrete investigations. Recent work listed on the site illustrates the range:

• Disinformation — A research note examines the digital infrastructure of BlackCore, described as an Israeli influence-for-hire company. The team describes identifying a campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation.
• Targeted Surveillance — In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia's student protest movement was infected with Pegasus spyware.
• Targeted Surveillance — The unit also found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Forensic analysis of his device indicated attackers could have had access to confidential documents and committee deliberations.

These examples show how a single focus area such as Targeted Surveillance can connect to law, policy, and civil-society outcomes rather than standing alone as a technical finding.

Which focus area matches your interest

• If you follow spyware and device intrusions, start with Targeted Surveillance.
• If you care about population-scale monitoring programs, Mass Surveillance is the closer fit.
• If your concern is platform and app-level risk, look at App Security & Privacy.
• If you track coordinated deceptive campaigns, Disinformation is the relevant area.
• If you work on rules, regulation, or advocacy, Law & Policy and Digital Transnational Repression are the most directly useful.

Where to go next

The site organizes its output under sections including Our Work, Research Publication Directory, Tools & Resources, News & Events, and Expert Insights. You can browse by focus area or search by keyword. A newsletter subscription option is also present on the page; the available material does not state terms, frequency, or cost, so check the sign-up page directly before subscribing.

The Citizen Lab investigates spyware and digital threats by combining device forensics with local partner organizations, then publishing the findings as research notes or full reports. It is an interdisciplinary research unit at the Munk School of Global Affairs & Public Policy, University of Toronto, applying expertise in law, computer science, cybersecurity, political science, and social sciences to complex 21st-century issues. Its investigations are relevant to anyone trying to understand how targeted surveillance and disinformation campaigns are documented and attributed.

The investigation model

The Citizen Lab's work follows a recognizable pattern: a suspected digital threat is identified, technical analysis is performed on the affected systems or infrastructure, and the results are interpreted against their legal and political context. Findings are then released publicly through research publications.

Working with local partners

Investigations are often conducted jointly with organizations that have direct access to affected individuals or communities. In the Pegasus spyware case involving a Serbian pro-democracy student activist, the Citizen Lab worked in collaboration with the SHARE Foundation. This division of labor matters: the local partner can identify and reach the target, while the Citizen Lab contributes forensic and technical capacity.

Forensic analysis of devices

To confirm an infection, the Citizen Lab performs forensic analysis of the target's device. In the Serbian case, this analysis confirmed that the iPhone of a member of Serbia's student protest movement was infected with Pegasus spyware. In a separate investigation, forensic analysis of former Member of the European Parliament Stelios Kouloglou's device found that he was hacked with Pegasus while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. The analysis indicated attackers could have had access to confidential documents and committee deliberations.

Interpreting findings in context

Technical confirmation is only part of the output. The Citizen Lab situates its findings within law, policy, and political science — for example, connecting a spyware infection to the target's role on a parliamentary oversight committee, which gives the technical fact a governance dimension.

What the research covers

The Citizen Lab organizes its work under Focus Areas, which include:

• App Security & Privacy
• Artificial Intelligence
• Censorship
• Digital Transnational Repression
• Disinformation
• Law & Policy
• Mass Surveillance
• Targeted Surveillance

Example: influence operations for hire

Under Disinformation, a research note examined the digital infrastructure of BlackCore, an Israeli influence-for-hire company. The investigation identified a BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation. This shows the same investigative approach applied to disinformation infrastructure rather than device infections.

How findings are published

Results appear as research notes or full reports, with a publication directory, tools and resources, and news and events sections on the site. A newsletter subscription is available for updates. Each investigation typically states the focus area, the partner organizations involved, the technical method used, and the conclusions drawn.

What this means for readers

If you want to understand how a spyware or disinformation claim was established, look for three things in a Citizen Lab publication: the named local partner, the forensic or infrastructure analysis performed, and the policy context in which the finding is placed. Those three elements are what turn a suspicion into a documented, attributable investigation.

The Citizen Lab is an interdisciplinary research unit at the Munk School of Global Affairs & Public Policy, University of Toronto. It applies expertise in law, computer science, cybersecurity, political science, and social sciences to investigate complex issues of the 21st century — specifically, novel threats to democracy, human rights, and global security in the digital ecosystem. If you want to understand who produces forensic research on spyware infections, influence-for-hire operations, and digital transnational repression, this is the organization behind much of that work.

What The Citizen Lab Does

The organization describes its mission as "counterintelligence for civil society." In practice, that means investigating the digital ecosystem for threats to democracy, human rights, and global security, and publishing the results.

Its work sits at the intersection of several disciplines rather than inside a single one. Law, computer science, cybersecurity, political science, and social sciences all feed into the research, which is why its outputs range from technical forensic analyses to policy-oriented reports.

Focus Areas

The site lists these focus areas:

• App Security & Privacy
• Artificial Intelligence
• Censorship
• Digital Transnational Repression
• Disinformation
• Law & Policy
• Mass Surveillance
• Targeted Surveillance

These categories map onto the kinds of findings the Lab publishes. Targeted Surveillance, for example, covers device-level forensic work, while Disinformation covers coordinated influence campaigns.

Examples of Published Research

The Lab's publication directory includes research notes and full reports. Three examples from the site:

A pattern runs through these: the Lab pairs technical device or infrastructure analysis with the political context of who was targeted and why it matters.

How to Follow or Use Its Output

The site organizes material into several sections:

• Our Work — research and publication directory
• Tools & Resources — practical outputs beyond reports
• News & Events — including expert insights, media appearances, and events
• About — who they are, contact information, and people

You can search by keyword, and the site offers a newsletter subscription for the latest research. The site also has a Donate option.

When The Citizen Lab Is the Right Source

Use it when you need:

• Forensic or technical findings on spyware targeting specific individuals
• Research on influence operations, disinformation, or censorship infrastructure
• Policy-relevant analysis connecting digital threats to human rights and democracy
• A university-affiliated, interdisciplinary source rather than a vendor or advocacy-only outlet

Its research is published openly through the publication directory, so you can read the underlying reports rather than relying on summaries.

The Citizen Lab publishes its research through a dedicated publication directory, a news and events section, and a newsletter you can subscribe to. To keep up with new findings, start with the "Our Work" and "Research Publication Directory" sections on citizenlab.ca, then subscribe to the newsletter for updates delivered to you. The site also offers tools and resources, expert insights, and media coverage for broader context.

Where the research lives on the site

The Citizen Lab is an interdisciplinary research unit at the Munk School of Global Affairs & Public Policy, University of Toronto. Its site organizes output into a few main entry points:

• Research Publication Directory – the full archive of reports and research notes.
• Tools & Resources – practical material connected to its investigations.
• News & Events – announcements, event listings, and coverage.
• Expert Insights and In the Media – commentary and press appearances.

If you want the primary sources rather than summaries, the publication directory is the place to browse.

Focus areas to track

The site groups its work under defined focus areas, so you can follow the topics most relevant to you:

Recent findings that show the output style

The homepage highlights current work, which gives a sense of what following the Lab looks like in practice:

• BlackCore's Influence Operations for Hire (Disinformation, September 17, 2026) – a research note examining the digital infrastructure of BlackCore, an Israeli influence-for-hire company, including a campaign that provided a training program to government employees in Angola and launched a supervised influence operation.
• Pegasus Spyware Infection of Serbian Pro-Democracy Student Activist (Targeted Surveillance, September 2, 2026) – in collaboration with the SHARE Foundation, the Lab confirmed that the iPhone of a member of Serbia's student protest movement was infected with Pegasus spyware.
• Espionage Against the European Parliament (Targeted Surveillance, July 3, 2026) – former Member of the European Parliament Stelios Kouloglou was found to have been hacked with Pegasus while serving on the PEGA committee, which investigated spyware abuses in Europe; forensic analysis indicated attackers could have accessed confidential documents and committee deliberations.

These examples show the Lab mixes technical forensics with policy and civil-society collaboration, so following it means tracking both reports and the partnerships behind them.

How to subscribe and search

Two practical tools make ongoing tracking easier:

1. Newsletter – the site offers a "Subscribe to our newsletter" option. Use it to receive the latest research without checking the site manually.
2. Site search – a keyword search box lets you look up specific topics, companies, or technologies across the site.

A simple routine: subscribe to the newsletter for alerts, then use the publication directory and search when you need the full report behind a headline.

What to expect if you're deciding whether to follow

The Lab's work is research-driven and often tied to investigations involving spyware, disinformation, and surveillance. If your interest is academic, journalistic, or policy-related, the publication directory and focus areas give you a structured way in. If you mainly want periodic updates, the newsletter is the lowest-effort option. Note that the site lists a "Donate" option alongside its research sections, but no pricing or access restrictions are described in the available material, so treat the research pages as the primary resource and check the site directly for any current terms.

The Citizen Lab's published work spans targeted surveillance, disinformation, and digital transnational repression, with several findings drawing international attention because they identified spyware infections or influence operations against specific people and institutions. The three findings below are documented on the organization's site with dated research notes or reports, and each illustrates a different threat category.

Pegasus Spyware Infection of a Serbian Pro-Democracy Student Activist

Published September 2, 2026, under the Targeted Surveillance focus area.

• What was found: In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia's student protest movement was infected with Pegasus spyware.
• Why it matters: The finding links commercial spyware to surveillance of a domestic pro-democracy movement rather than a foreign intelligence target.
• How to read it: The value of this research is the forensic confirmation itself — a device-level finding that turns an allegation into a documented infection.

Espionage Against the European Parliament

Published July 3, 2026, under Targeted Surveillance.

• What was found: Former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe.
• What the forensic analysis showed: Attackers could have had access to confidential documents and committee deliberations.
• Why it matters: This is a case where the target was simultaneously a spyware investigator and a spyware victim, which raises direct questions about interference with legislative oversight.

BlackCore's Influence Operations for Hire

Published September 17, 2026, under Disinformation.

• What was found: The research note examines the digital infrastructure of BlackCore, an Israeli influence-for-hire company.
• The campaign described: A BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation.
• Why it matters: It documents influence operations as a purchasable service delivered to state clients, rather than as a purely domestic propaganda effort.

How These Findings Fit Together

Two of the three findings are spyware infections confirmed through device forensics, and one is an infrastructure-level analysis of a commercial influence operation. Together they show the Lab's method: identify a specific target or operator, document it with technical evidence, and publish the result.

Where to Go Next

If you want to assess the Lab's research output more broadly, the site organizes its work into Focus Areas — App Security & Privacy, Artificial Intelligence, Censorship, Digital Transnational Repression, Disinformation, Law & Policy, Mass Surveillance, and Targeted Surveillance — and maintains a Research Publication Directory, Tools & Resources, and a newsletter subscription for new research. Reading the full reports rather than the summaries is the better route if you need the underlying technical detail.