Inside Citizen Lab's Cyber Espionage Investigations

Ronald Deibert, the founder and director of the Citizen Lab, takes extraordinary measures to protect his digital privacy. In April 2025, he traveled from Toronto to Illinois without any electronic devices, purchasing a new laptop and iPhone immediately upon arrival to minimize the risk of confiscation. Deibert operates under the assumption that he is constantly being watched due to the nature of his work.

The Citizen Lab, housed at the University of Toronto, serves as counterintelligence for civil society. It investigates cyberthreats exclusively in the public interest, relying on research grants rather than government funding. The lab has gained global prominence for exposing digital abuses, including a massive espionage network known as 'GhostNet' in 2009. Deibert expresses concern over the state of democracy in the United States, noting that the pillars of democracy are under assault. The lab continues to investigate authoritarian regimes and commercial spyware vendors, despite facing personal risks and travel bans.

In April 2025, Ronald Deibert left all electronic devices at home in Toronto and boarded a plane. When he landed in Illinois, he took a taxi to a mall and headed directly to the Apple Store to purchase a new laptop and iPhone. He wanted to keep the risk of having his personal devices confiscated to a minimum, knowing his work made him a prime target for surveillance. "I’m traveling under the assumption that I am being watched, right down to exactly where I am at any moment," Deibert says.

Deibert directs the Citizen Lab, a research center he founded in 2001 to serve as "counterintelligence for civil society." Housed at the University of Toronto, the lab operates independently of governments or corporate interests, relying instead on research grants and private philanthropy for financial support. It is one of the few institutions that investigate cyberthreats exclusively in the public interest, and in doing so, it has exposed some of the most egregious digital abuses of the past two decades.

For many years, Deibert and his colleagues have held up the US as the standard for liberal democracy. However, Deibert states that this perspective is changing: "The pillars of democracy are under assault in the United States. For many decades, in spite of its flaws, it has upheld norms about what constitutional democracy looks like or should aspire to. [That] is now at risk." Even as some of his fellow Canadians avoided US travel after Donald Trump’s second election, Deibert relished the opportunity to visit.

Alongside his meetings with human rights defenders, Deibert documented active surveillance at Columbia University during the height of its student protests. He snapped photos of drones above campus and noted the exceptionally strict security protocols. "It was unorthodox to go to the United States," he says. "But I really gravitate toward problems in the world." Deibert grew up in East Vancouver, British Columbia, a gritty area with a boisterous countercultural presence, which influenced his respect for antiestablishment sentiment.

Deibert eventually entered a graduate program in international relations at the University of British Columbia. His doctoral research brought him to a field of inquiry that would soon explode: the geopolitical implications of the nascent internet. "In my field, there were a handful of people beginning to talk about the internet, but it was very shallow, and that frustrated me," he says. "And meanwhile, computer science was very technical, but not political—[politics] was almost like a dirty word."

Deibert continued to explore these topics at the University of Toronto when he was appointed to a tenure-track professorship. His work rose to global prominence after he founded the Citizen Lab in 2001. What put the lab on the map, Deibert says, was its 2009 report "Tracking GhostNet," which uncovered a digital espionage network in China that had breached offices of foreign embassies and diplomats in more than 100 countries, including the office of the Dalai Lama. The report and its follow-up in 2010 were among the first to publicly expose cybersurveillance in real time.

In the years since, the lab has published over 180 such analyses, garnering praise from human rights advocates ranging from Margaret Atwood to Edward Snowden. The lab has rigorously investigated authoritarian regimes around the world; Deibert says both Russia and China have his name on a "list" barring his entry. The group was the first to uncover the use of commercial spyware to surveil people close to the Saudi dissident and Washington Post journalist Jamal Khashoggi prior to his assassination. Its research has directly informed G7 and UN resolutions on digital repression and led to sanctions on spyware vendors.

Even so, in 2025 US Immigration and Customs Enforcement reactivated a $2 million contract with the spyware vendor Paragon. The contract, which the Biden administration had previously placed under a stop-work order, resembles steps taken by governments in Europe and Israel that have also deployed domestic spyware to address security concerns. "It saves lives, quite literally," says Cindy Cohn, executive director of the Electronic Frontier Foundation. "The Citizen Lab [researchers] were the first to really focus on technical attacks on human rights activists and democracy activists all around the world. And they’re still the best at it."

Work for the lab is not without risk. Citizen Lab fellow Elies Campo, for example, was followed and photographed after the lab published a 2022 report that exposed the digital surveillance of dozens of Catalonian citizens and members of parliament. Deibert recruits researchers who have personally experienced repression, such as Noura Aljizawi, a survivor of torture by the al-Assad regime in Syria who researches threats to women and queer people.