Citizen Lab Research

Targeted Threats

Investigations into the prevalence and impact of digital espionage operations against civil society groups.

Latest Research

PAPERWALL: Chinese Websites Posing as Local News Outlets Target Global Audiences with Pro-Beijing Content

A network of at least 123 websites operated from within the People’s Republic of China while posing as local news outlets in 30 countries across Europe, Asia, and Latin America, disseminates pro-Beijing disinformation and ad hominem attacks within much larger volumes of commercial press releases. We name this campaign PAPERWALL. We attribute the PAPERWALL campaign to Shenzhen Haimaiyunxiang Media Co., Ltd., aka Haimai, a PR firm in China based on digital infrastructure linkages between the firm’s official website and the network. These findings confirm the increasingly important role private firms play in the realm of digital influence operations and the propensity of the Chinese government to make use of them.

PREDATOR في الاتصالات: أحمد الطنطاوي مستهدف ببرنامج التجسس Predator بعد الإعلان عن نيته للترشح للرئاسة

بين شهري مايو وسبتمبر 2023، استُهدِف عضو البرلمان المصري السابق أحمد الطنطاوي ببرنامج التجسس Predator من Cytrox عبر روابط أُرسلت إليه عبر رسائل قصيرة و رسائل WhatsApp. وقع الاستهداف بعد أن صرح الطنطاوي علنًا بخطته للترشح لمنصب الرئاسة في الانتخابات المصرية لعام 2024.

PREDATOR IN THE WIRES: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions

Between May and September 2023, former Egyptian MP Ahmed Eltantawy was targeted with Cytrox’s Predator spyware via links sent on SMS and WhatsApp after Eltantawy publicly stated his plans to run for President in the 2024 Egyptian elections. As Egypt is a known customer of Cytrox’s Predator spyware, and the spyware was delivered via network injection from a device located physically inside Egypt, we attribute the attack to the Egyptian government with high confidence.

Read More from Targeted Threats

Free Expression Online

Studies of Internet filtering, network interference, and other technologies and practices that impact freedom of expression online. 

Latest Research

Chinese censorship following the death of Li Keqiang

As part of our ongoing project monitoring changes to Chinese search censorship, we tracked changes to censorship following Li Keqiang’s death across seven Internet platforms: Baidu, Baidu Zhidao, Bilibili, Microsoft Bing, Jingdong, Sogou, and Weibo. We found that some keyword combinations in search queries triggers hard censorship whereas others trigger soft censorship. Our results demonstrate China’s ongoing efforts to push state-sanctioned narratives concerning politically sensitive topics, impacting the integrity of the online information environment.

Not OK on VK: An Analysis of In-Platform Censorship on Russia’s VKontakte

This report examines the accessibility of certain types of content on VK (an abbreviation for “VKontakte”), a Russian social networking service, in Canada, Ukraine, and Russia. Among these countries, we found that Russia had the most limited access to VK social media content, due to the blocking of 94,942 videos, 1,569 community accounts, and 787 personal accounts in the country.

Read More from Free Expression Online

Transparency and Accountability

Examinations of transparency and accountability mechanisms relevant to the relationship between corporations and state agencies regarding personal data and other surveillance activities.

Latest Research

Finding You: The Network Effect of Telecommunications Vulnerabilities for Location Disclosure

This report provides a comprehensive guide to geolocation-related threats sourced from 3G, 4G, and 5G network operators. Case studies, references, examples, and evidence are provided to give a complete and contextual understanding of mobile network-based location tracking in order to formulate policies and actions that protect civil society from current and future geolocation surveillance.

You Move, They Follow: Uncovering Iran’s Mobile Legal Intercept System

Citizen Lab examined a set of documents leaked to news outlet The Intercept that describe plans to develop and launch an Iranian mobile network, including subscriber management operations and services, and integration with a legal intercept solution. If implemented fully as envisioned, it would enable state authorities to directly monitor, intercept, redirect, degrade or deny all Iranians’ mobile communications, including those who are presently challenging the regime.

Mass Iris Scan Collection in Qinghai: 2019–2022

Police led mass iris scan collection in Qinghai, a region with a population that is 49.4% non-Han, including Tibetans and Hui Muslims. Iris scan collection is part of long-standing police intelligence gathering programs. Through this data collection, Qinghai’s police are effectively treating entire communities as populated by potential threats to social stability.

Read More from Transparency and Accountability

App Privacy and Controls

Research into privacy, security, and information controls of popular applications.

Latest Research


重要:我们建议所有用户立即更新所使用的输入法软件以及操作系统。并建议高风险用户停止使用任何输入法提供的云端建议功能,改为完全离线的输入法,以避免数据外泄。 本文是完整版报告的摘要翻译。 重要发现 我们分析了常见云端拼音输入法的安全性,包含百度、荣耀、华为、讯飞、OPPO、三星、腾讯等九家厂商,并分析了它们发送用户输入内容到云端的过程是否含有安全缺陷。 分析结果指出,九家厂商中,有八家输入法软件包含严重漏洞,使我们得以完整破解厂商设计用于保护用户输入内容的加密法。亦有部分厂商并未使用任何加密法保护用户输入内容。 综合本研究和我们先前研究中发现的搜狗输入法漏洞,我们估计至多有十亿用户受到这些漏洞影响。基于下述原因,我们认为用户输入的内容可能已经遭到大规模收集: 这些漏洞影响了广泛的用户群体 用户在键盘中输入的信息极为敏感 发现这些漏洞不需要高深技术 五眼联盟过去曾利用中国应用程序中类似的漏洞施行监控 我们已向受影响的九家开发商提交这些漏洞,大部分开发商均认真看待问题并予以回应,修补了漏洞,但仍有少数输入法未修补漏洞。 在报告的末尾,我们为受漏洞影响的各方提供了综合建议,期待这些建议可以减少未来类似漏洞所造成的危害。 漏洞总结 在我们测试的九家厂商的应用程序中,仅有华为的产品未发现任何上传用户输入内容至云端相关的安全问题,其余每一家厂商都至少有一个应用程序含有漏洞,使得被动型网络攻击者得以监看用户输入的完整内容。 注:主动型网络监听攻击意指监听时必须要主动发出讯号,例如在信息传输过程中篡改少数比特数据,才能破解加密内容。主动型网络监听相对容易被侦测到。被动型网络监听攻击意指无需发出任何讯号,单纯读取传输中的的数据,即可达成解密。与主动性攻击相比,被动型网络监听攻击难以被侦测到。 图例 ✘✘ 主动和被动型网络监听者均可以破解加密的用户输入内容,已被我们成功实测 ✘ 主动型网络监听者可以破解加密的用户输入内容,已被我们成功实测 ! 加密法实操中存在弱点 ✔ 未发现问题 N/A 该产品在我们测试的设备上不提供或是不存在 输入法开发商 Android iOS Windows 腾讯† ✘ N/A ✘ 百度 ! ! ✘✘ 讯飞 ✘✘ ✔ ✔ 内置输入法开发商 装置制造商 自有 搜狗 百度 讯飞 iOS Windows 三星 ✘✘  ✔* ✘✘ N/A… Read more »

Chinese Keyboard App Vulnerabilities Explained

We analyzed third-party keyboard apps Tencent QQ, Baidu, and iFlytek, on the Android, iOS, and Windows platforms. Along with Tencent Sogou, they comprise over 95% of the market share for third-party keyboard apps in China. This is an FAQ for the full report titled “The not-so-silent type: Vulnerabilities across keyboard apps reveal keystrokes to network eavesdroppers.”

Read More from App Privacy and Controls

Global Research Network

Outputs related to the global community of practice that the Citizen Lab helps to cultivate through our Cyber Stewards Network, various fellowships, and events.

Latest Research

Asociación por los Derechos Civiles to hold public session at Inter-American Commission on Human Rights

Cyber Steward Network partner Asociación por los Derechos Civiles (ADC) will lead a public hearing at the 167 extraordinary period of session of the Inter-American Commission on Human Rights (IACHR). Taking place on February 28 at 11:30 am EST, the hearing is titled “Digital Intelligence, Cybersecurity, and Freedom of Expression in America”. The topics to be addressed in… Read more »

Sula Batsu Honoured with 2017 EQUALS in Tech Award

Cyber Stewards Network organization Sula Batsu Cooperativa has been honoured with a 2017 EQUALS in Tech Award. Presented at the Internet Governance Forum at the United Nations in December, Kemly Camacho– Sula Batsu Coordinator– accepted the award on behalf of the group. They were recognized in the Leadership category for their work to create women-led… Read more »

Read More from Global Research Network

Tools & Resources

While the Citizen Lab is primarily focused on high-level academic research, we also produce accessible tools and educational resources to help everyone better navigate their online lives. Below are some of the latest projects that are aimed at making everyone safer online.

Access My Info

Access My Info is a project designed to understand what can be learned about company data practices by filing data access requests (DARs), seeking access to the requester’s personal information held by a company.
Read More from Tools & Resources