“Smart” in-store shopping carts, developed by Caper and used by Sobeys, issue electronic receipts via SMS message and share a URL that uses an easily predictable format. These receipts contain a number of personal data points, including the customer’s partial credit/debit/Air Miles card numbers, a full list of purchases, and the date, time, and location of the customer’s purchase.

Citizen Lab fellow Bill Marczak comments on how he uncovered a Pegasus surveillance operation aimed at two lawyers and Princess Haya Bint Al Hussein.

Citizen Lab researchers reviewed the consultation materials, including the “Technical Paper” and the “Discussion Guide” associated with the government’s proposal to address what it has referred to as “online harms.” We provide the following comments in response to that consultation process.

On September 28, the Citizen Lab published an analysis of COVID-19 data collection practices. In this post, we discuss the significance of the findings with report authors.

In this report, we undertake a preliminary comparative analysis of how different information technologies were mobilized in response to COVID-19 to collect data, the extent to which Canadian laws impeded the response to COVID-19, and the potential consequences of reforming data protection or privacy laws to enable more expansive data collection, use, or disclosure of personal information in future health emergencies.

Delivered by the Writers’ Trust of Canada, the award was announced at the digital edition of Politics and the Pen gala on September 22, 2021.

The Hong Kong police recently forced one of the city’s most prominent activist groups to delete its online presence, in a move some fear means that Hong Kong’s digital spaces will move to more closely resemble the mainland.

Ron Deibert joined Democracy Now to discuss how Citizen Lab research of a zero-click zero-day exploit—used by NSO Group—led Apple to issue a patch to over 1.65 billion products.

While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.

Senior researcher, Irene Poetranto, discusses a joint report written by the Citizen Lab, OutRight Action International, and the Open Observatory of Network Interference (OONI), focused on LGBTIQ website censorship and its impact on LGBTIQ communities.