How many times have we been told not to click on a strange link or attachment? Because if we do, someone can hack our bank account, steal our identity, take over our phone, switch on its camera and microphone, read our messages and track us wherever we go.
Sadly, that advice is stale-dated.
Now, you’re reading the news on your phone. A banner ad for running shoes, a concert, a local restaurant or whatever slides into view. You barely notice it. You don’t need to tap it. But you, dear reader, are now infected.
Last week The Citizen Lab at the University of Toronto published “Exposing AdFection,” the first public proof that mercenary spyware can be delivered through an ordinary “Zero-Click” targeted ad.
Citizen Lab’s researchers discovered that an Israeli company called Discover-Tech, posing as an ad business, bought the ads. Behind them sat spyware from Candiru, another Israeli firm, which the U.S. blacklisted in 2021 and now calls itself, yes… Integrity Labs. Since 2024, they’ve targeted and hacked 45 different phones and computers within Al Jazeera. Most of them belonged to Al Jazeera journalists covering sensitive stories.
The shock is not that this is happening; it’s the scale. Citizen Lab discovered the ads run on more than 120,000 websites and 75,000 apps. Among them: NATO, the United Nations, the Pentagon, the International Atomic Energy Agency and the International Criminal Court.
Last week’s expose went global with big stories in The Guardian, The Globe and Mail, The Financial Times, Wired, plus all the major TV networks including CNN. And of course in Al Jazeera.
None of this is new for The Citizen Lab.
Ron Deibert, a political scientist raised in East Vancouver, founded the Lab in 2001 at what’s now U of T’s Munk School. His idea was simple and audacious: build “counterintelligence for civil society.” Governments have spy agencies. But dissidents, reporters and human-rights workers have nobody. So he built them one, and over 25 years it has produced 120 peer-reviewed reports on cyber espionage, commercial spyware, internet censorship and digital threats to human rights. Its findings have fed spying scandals in Spain, Poland, Hungary and Greece, and even showed that a member of the European Parliament committee investigating spyware had himself been hacked with Pegasus.
In 2009 the Lab’s “Tracking GhostNet” report exposed an espionage network inside hundreds of government offices and NGOs, including the Dalai Lama’s.
In 2016 it caught the Israeli firm NSO Group’s Pegasus spyware trying to break into the phone of Ahmed Mansoor, a human-rights defender in the United Arab Emirates.
On October 1, 2018, it reported that Saudi operators had hacked the phone of Omar Abdulaziz, a Saudi dissident living in Quebec.
The next day, his friend Jamal Khashoggi walked into the Saudi consulate in Istanbul and never came out. Later the Lab found that Pegasus had been used on people close to Khashoggi, among them his wife and the New York Times reporter Ben Hubbard, who covered the case.
But when you expose bad people, you’re going to get big pushback. In 2019 undercover operatives from Black Cube, a private intelligence firm staffed by former Israeli spies, went after its researchers. One of them posed as an investor and invited the Lab’s John Scott-Railton to lunch in Manhattan and tried to get him to say something damaging about the Lab. Scott-Railton saw it coming. Together with the Associated Press, he set up a counter sting.
To this day, you’ll work very hard to find The Citizen Lab’s office on the U of T campus.
As you can imagine, the Lab not only has to be independent, it has to appear that way. It can’t accept the kind of financial support that most university research runs on. No money, thank you, from a big tech company whose products the Lab may be exposing next month.
But let’s not downplay the very real heroism of what The Citizen Lab is doing. A small team of researchers is taking on the mercenary spy industry and the states and people who buy from it. They do it with scrupulous evidence, forensic skill and a stubborn belief that the truth must be published. And tell me, is that not Canada at its best? We’re always outnumbered, but here we’re not outfought.
You can give to the Citizen Lab here. Please do that today. Then install an Ad-blocker. The Lab calls it basic cybersecurity for all of us.
Meanwhile…
1. The Debaters. Three Russian musicologists debate Schubert. WASPS don’t talk like this.
Plus a rare wood, a disappearing forest, and the music that could vanish with it. And Bach’s greatest organ music and Yannick Nezet-Seguin becomes a mentor, and opera’s most talked-about young artist, and what the sound of a drum looks like and finally what 6-part harmony sounds like.
Speaking of great music…fresh from her rave performance with LA Opera, Tunisian-Canadian mezzo-soprano Rihab Chaieb and Israeli pianist Ammiel Bushakevitz blend French repertoire with Tunisian lullabies at Koerner Hall on Sunday, Nov. 15 at 3:00 p.m. Use promo code RAMSAY for 20% off: Tickets.
2. Tic Toc on Tech Talk. First, the next Hinton Lectures on AI safety are Nov. 9-11, with Paul Christiano, Sinead Bovell and, of course, Geoffrey Hinton. Tickets here.
Next, this documentary was made entirely by AI, about AI. Also, this MIT report on AI ends up as a critique of university education. And do you remember the human web? And you can now recreate the entire ritual of online shopping on Dopamine Shop and on Food Never Comes: You search for products, compare reviews, add items to your cart, enter a shipping address, place an order, and even track your delivery. Then… nothing happens.
3. Are you sailing through The Northwest Passage with us? Already, 30 of our friends have signed on for this epic voyage in 2028. 20 days, one expedition ship, two helicopters, expert speakers. So join our company of gentle adventurers, and if you raise your hand and register by next Saturday, Oct. 31, you’ll save $2,700+ per person. Read all about it here.
4. Power and its players. First, is there nothing Donald Trump won’t destroy, even a golf course? Next, Margaret Atwood on the Steven Galloway court case. Then, why not throw out all the immigrants? And what John Ralston Saul thinks of the Alberta referendum (not much). And what MI5 thinks about Britain’s terror threat, and why you might want to join MI6.
5. Doctors say… “I would never…” Plus new nasal spray for erectile dysfunction, and how fungi keep the planet healthy, and how your mistakes aren’t random, but have real structure. And, no surprise, nine in 10 articles disputing the definition of ultraprocessed foods have industry ties. And finally, why whistle-blowing in universities is still far too risky.
6. Pretty Pictures. First, 39 pictures that change the way we see men (paywall, but free). Plus bears, birds and blooms from National Geographic, and the wildlife photos of the year. And speaking of bears…and sharks. Plus, the art of paper-cutting.
7. Getting around. The best airlines for economy class. How Great Lakes shipping works. How articulated buses bend, and how the London Underground really is. Toronto cosmetic surgeon Dr. Trevor Born makes a splash at the Met Gala.
8. The food of love. The hip foods now. And bagels, once mocked by the New York Times, are now a multi-billion-dollar global industry – and they just helped rescue Tim Hortons in China.
9. Novel approaches. First, do you actually have to finish that novel? Plus, the map to read your house and the woman who made Van Gogh famous. And finally, the map to the route of your life.
10. Can we be zen all the time? No, we can’t, especially if we’re Sebastian Junger. Should we equate success with happiness? No to that too. And finally, is reading for pleasure that big of a deal? Yes, yes it is.
Read what you will – and pay what you can.
For the past few years, the Omnium Gatherum blog has opened your Saturday morning InBox with news of intriguing people, odd places, and new things that may have escaped your glance.
These blogs have been free for you to receive and read. However, they aren’t free to produce and never have been. So I’d like to ask if you could help cover the costs of this little venture – and ask you to pay what you can to receive it.
If you don’t want to pay anything, that’s fine too. We’re not going to withhold our affections, and you’ll keep getting your blog on Saturday no matter what. But if you do think what you read here is worth your time, then please pay what you think it’s worth.
Many thanks, and here’s to curiosity and the freedom to pursue its joys down any lane.
Bob Ramsay
I’ll give a non-tax-deductible donation of:
1. $20
2. $50
3. $100
4. $1000
5. $999,999,000
6. Pay What I Can
Guaranteed 100% written by Bob Ramsay, human.