Our pioneering research on cyber espionage and spyware technologies began with a research project called the Information Warfare Monitor. Working in collaboration with SecDev Group, the Citizen Lab launched a multi-year study to track cyberspace as an emerging strategic domain for espionage.

This project led to the 2009 discovery of a cyber espionage network called GhostNet which consisted of 1,295 malware-infected computers in 103 countries. Of the infected computers, 30 percent were determined to be “high-value” targets, including ministries of foreign affairs, embassies, international organizations, news organizations, and a computer located at NATO headquarters. This “bombshell investigation” attracted the attention of several intelligence and law enforcement agencies, including the FBI, the U.S. Department of Homeland Security, and Canada’s Communications Security Establishment.
Although there was circumstantial evidence pointing to elements within the People’s Republic of China, our investigation concluded that there was not enough evidence to implicate the Chinese government itself and attribution behind GhostNet remains a mystery.

In 2010, the Citizen Lab uncovered a second cyber espionage network called Shadow that systematically compromised government, business, academic, and other computer network systems in India, the Offices of the Dalai Lama, the United Nations, and several other countries.
These ground breaking cyber espionage discoveries laid the foundation for a new era of Citizen Lab research, providing crucial counterintelligence to civil society.