18 June 2019 Dear Yana and Stephen Peel, We write to you in light of recent reporting indicating that you both own a stake in Novalpina Capital LLP. As Yana Peel has recently expressed that she believes criticism of NSO Group is “misinformed,” we thought it appropriate to specifically draw Ms. Peel’s attention to the… Read more »

This report provides an in-depth legal and policy analysis of technology-facilitated intimate partner surveillance (IPS) under Canadian law. Stalkerware apps are designed to facilitate remote surveillance of an individual’s mobile device use with the surveillance often being covert or advertised as such. Despite increasing recognition of the prevalence of technology-enabled intimate partner abuse and harassment, the legality of the creation, sale, and use of consumer-level spyware apps has not yet been closely considered by Canadian courts, legislators, or regulators.

This report was collaboratively written by researchers from computer science, political science, criminology, law, and journalism studies. As befits their expertise, the report is divided into several parts, with each focusing on specific aspects of the consumer spyware ecosystem, which includes: technical elements associated stalkerware applications, stalkerware companies’ marketing activities and public policies, and these companies’ compliance with Canadian federal commercial privacy legislation.

Endless Mayfly is an Iran-aligned network of inauthentic websites and online personas used to spread false and divisive information primarily targeting Saudi Arabia, the United States, and Israel. Using this network as an illustration, this report highlights the challenges of investigating and addressing disinformation from research and policy perspectives.

This research brief details how Griselda Triana, journalist and the wife of slain journalist Javier Valdez Cárdenas, was targeted with NSO Group’s Pegasus spyware in the days after his killing.

Published by the Review of Policy Research, this paper by the Citizen Lab’s Ron Deibert, Joshua Oliver, and Adam Senft takes a deep dive into data provided by the circumvention tool Psiphon to reveal Iran’s increasingly sophisticated Internet blocking strategy around elections.

Without Novalpina Capital—or the parties that you hired to conduct due diligence—concluding that Citizen Lab reporting is flawed and providing a substantiated basis to prove such a finding, it remains the case that you are purchasing a company implicated in serious human rights abuses and have decided to simply ignore this fact. It also remains the case that, without meaningful engagement with our research, your due diligence process will appear to many as nothing more than a superficial effort to check boxes and appease stakeholders concerned by NSO Group.

The purpose of this letter is to alert Jefferies Financial Group and lending firms interested in the syndicated loan to the Citizen Lab’s structured, evidence-based research into the abuse of NSO Group spyware, as well as investigations and research conducted by organizations such as Amnesty International, security companies, and the security team at Google Inc.

We appreciate your commitment—as stated in your letter of February 15, 2019—to “helping NSO Group become more transparent about its business.” As a first step, we ask that Novalpina Capital provide answers to the following questions regarding Novalpina Capital and NSO Group’s human rights due diligence and corporate social responsibility practices.

Over the last month, two Citizen Lab staff members were contacted by two separate individuals in what appears to be an attempt to compromise our work. Each of the contacts purported to show an interest in the staff members’ personal, non-Citizen Lab related interests, and presented themselves as serious and professional.