Chasing shadows with The Citizen Lab

·21 min·2 clips

The Citizen Lab found a hacker spreadsheet exposing a Chinese government cyber espionage campaign targeting 1,300 computers in 103 countries.

The episode opens by framing Ron Deibert as a 'Forrest Gump of the internet' — someone present at every major inflection point in the digital world's evolution. Deibert grew up in a rough part of Vancouver where higher education was rare and most of his peers ended up in organized crime or prison. Watching the Watergate hearings at age nine gave him his first understanding of power, corruption, and the way systems can fail ordinary people. He describes a deep-seated hatred of bullies that would come to define his professional mission. After studying Soviet politics, a mentor advised him to pivot when the Cold War ended, pointing him toward what he called 'the telecommunications revolution.' Deibert was caught up in the early internet's utopian promise — the widespread belief that authoritarian regimes couldn't survive a free flow of information — but harbored a private suspicion that governments would eventually weaponize the technology against their own citizens. That suspicion became the founding logic of the Citizen Lab: if governments could use technology to watch citizens, citizens could use it to watch governments. Deibert identified a basement space under construction at the University of Toronto and set up shop there, hiring self-taught hacker Nart Villeneuve as his first researcher. Villeneuve had independently figured out how to browse the Chinese internet from inside the country without detection, and the two began documenting how authoritarian governments used technology to censor and surveil their populations. In 2008, a researcher named Greg Walton alerted Deibert that Tibetan activists were being flooded with computer viruses and that authorities seemed to know their plans in advance. The Citizen Lab flew to India, wiretapped the activists' machines with their consent, and discovered that someone had hacked into the Dalai Lama's computers. A critical mistake by the hackers — leaving a directory wide open — revealed a meticulously organized spreadsheet of every compromised machine: 1,300 computers in 103 countries, including foreign ministries, diplomatic missions, and banks. The report, later known as GhostNet, landed the Citizen Lab on the front page of the New York Times and introduced the world to the reality of state-sponsored cyber espionage. In 2016, the lab encountered Pegasus, a spyware tool developed by Israeli firm NSO Group, after UAE human rights activist Ahmed Mansour forwarded a suspicious text link to researcher Bill Marczak rather than clicking it. Unlike earlier spyware that required user error, Pegasus could silently infect a phone with no interaction, activating the microphone, camera, and screen recording without any indication to the user. NSO marketed Pegasus to governments as a counterterrorism tool, but the Citizen Lab found it being used against activists and dissidents. The lab's 'Million Dollar Dissident' report was the first public exposure of Pegasus. By 2021, the Biden administration put NSO Group on a federal blacklist and signed an executive order restricting commercial spyware use by U.S. agencies — outcomes Deibert describes as a 'Holy Grail' for his team's work. However, Deibert expresses growing alarm about the Trump administration's direction, citing reports that ICE has reactivated a contract with spyware company Paragon Solutions that Biden had paused, and that federal officers are using facial recognition apps to identify undocumented immigrants. He argues this normalizes powerful surveillance tools in everyday law enforcement rather than limiting them to national security. Deibert warns that 23 years of progress in civil society protection are now at their greatest risk, that the Citizen Lab itself could face aggressive litigation, and that authoritarian governments worldwide will take cues from what happens in the United States. The episode closes with Deibert saying the lab's mission has taken on new meaning in the current environment and that there is a great deal of work still to do.

As heard by us

A taut Citizen Lab profile that turns an early cyber espionage investigation into a human, unsettling story about power online.

Click Here profiles Ron Deibert as an unlikely cybersecurity watchdog, tracing his path from a hardscrabble Vancouver childhood to Citizen Lab, the Canadian research group that investigates how governments and other powerful institutions use the internet.

Read the full review in PlayNext →

Why you'd press play

A hacker's open directory, 1,300 compromised machines, 103 countries -- left exposed by mistake.

Read the full recommendation in PlayNext →

Listen to the show on

Apple Podcasts Spotify

Play clips from this episode More from Click Here