SecTor 2025 | Chasing Shadows: Chronicles of Counter-Intelligence From the Citizen Lab

Why It Matters

Citizen Lab’s disclosures force governments and tech firms to confront the unchecked spread of mercenary spyware, protecting vulnerable civil‑society actors and shaping global policy on digital surveillance.

Key Takeaways

• Citizen Lab exposed global abuse of NSO’s Pegasus spyware.
• Pegasus hacks targeted activists, journalists, and even royalty worldwide.
• Apple’s “Lockdown Mode” and threat alerts stem from Citizen Lab disclosures.
• Government spyware bans, like US executive order, follow Lab’s evidence.
• Civil‑society groups lack resources to defend against sophisticated cyber threats.

Summary

The SecTor 2025 talk highlighted the Citizen Lab’s role as a counter‑intelligence hub exposing the worldwide misuse of commercial spyware, especially NSO Group’s Pegasus. Founded in 2001, the Toronto‑based academic team blends political‑science insight with technical forensics to document how governments target dissidents, journalists, and even royalty. Key findings span high‑profile cases: Saudi activist Omar Abdulaziz’s phone was compromised, leading to the murder of journalist Jamal Khashoggi; a zero‑day chain captured from an Emirati activist forced Apple to patch three vulnerabilities within weeks; and the discovery of a zero‑click Pegasus variant prompted Apple to launch “Lockdown Mode” and unprecedented threat notifications. The Lab also uncovered spyware abuse in Mexico, Spain, Greece, and the United Arab Emirates, where the prime minister hacked his estranged wife’s phone and her legal counsel. Notable quotes underscore the stakes: former NSO CEO claimed the tech was “strictly controlled,” yet the Lab’s research concludes users should be “very afraid.” The Saudi case, the Spanish intelligence firings, and the Princess Haya breach illustrate how commercial spyware permeates both authoritarian regimes and democracies, often reaching high‑profile individuals. The implications are clear: a market failure leaves civil‑society actors defenseless against sophisticated threats, prompting policy responses such as the U.S. executive order banning federal procurement of abusive spyware. The Lab’s evidence drives corporate security changes, fuels litigation, and pressures governments to adopt stricter oversight, reinforcing the need for independent, evidence‑based research in the digital security ecosystem.

Original Description

For over twenty years, the University of Toronto's Citizen Lab has pioneered investigations into digital security and human rights—from exposing state cyber espionage to uncovering the global spread of mercenary spyware targeting journalists, activists, and human rights defenders. Drawing from my latest book, Chasing Shadows, I will recount how our mission to conduct "counter-intelligence for civil society" revealed surveillance around the inner circle of murdered Washington Post journalist Jamal Khashoggi and uncovered domestic espionage campaigns across Mexico, Spain, Hungary, Poland, Thailand, El Salvador, and most recently, Italy. As our small team disarmed cyber mercenaries and helped improve the digital security of billions, we, too, became targets—caught in the same sinister crosshairs as those we sought to protect. I will also look ahead to the future of our mission and the rising challenges of AI-enabled subversion, Dark PR, and advertising intelligence, and how the kind of public-interest research the Lab has championed is now under threat from a growing tide of despotism and authoritarianism.

By: Ron Deibert | Director, The Citizen Lab, Professor of Political Science, University of Toronto

https://blackhat.com/sector/2025/briefings/schedule/?#chasing-shadows-chronicles-of-counter-intelligence-from-the-citizen-lab-49605