Research News

Citizen Lab's latest research publications.

Blue Coat Errors: Sites Miscategorized as “Pornography”

As a follow-up to our post about the number of sites miscategorized by SmartFilter, our tests with Blue Coat show that miscategorization is not a problem limited to a single product. We should be skeptical of any company’s claims that they are able to categorize much of the web accurately, or that their rate of “collateral damage” is very low.

The Murky State of Canadian Telecommunications Surveillance

On January 20, 2014 the Citizen Lab along with leading Canadian academics and civil liberties groups asked Canadian telecommunications companies to reveal the extent to which they disclose information to state authorities. This post summarizes and analyzes the responses from the companies, and argues that the companies have done little to ultimately clarify their disclosure policies. We conclude by indicating the subsequent steps in this research project.

US-based Servers Part of Hacking Team’s Surveillance Infrastructure

Our analysis traces Hacking Team’s Remote Control System’s (RCS) proxy chains, and finds that dedicated US-based servers are part of the RCS infrastructure implemented by the governments of Azerbaijan, Colombia, Ethiopia, Korea, Mexico, Morocco, Poland, Thailand, Uzbekistan, and the United Arab Emirates in their espionage and/or law enforcement operations.

Hacking Team’s US Nexus

This report outlines an extensive US nexus for a network of servers forming part of the collection infrastructure of Hacking Team’s Remote Control System. The network, which includes data centers across the US, is used to obscure government clients of Hacking Team. It is used by at least 10 countries ranging from Azerbaijan and Uzbekistan to Korea, Poland and Ethiopia. In addition we highlight an intriguing US-only Hacking Team circuit.

Mapping Hacking Team’s Covert Surveillance Networks

This report maps out covert surveillance networks of “proxy servers” used to launder data that RCS exfiltrates from infected computers, through third countries, to an “endpoint,” which we believe represents the spyware’s government operator.