Transparency & Accountability
Citizen Lab hunts the spyware that hunted Palestinian rights defenders
Graphic: Times of Palestine
Original Reporting
In November 2021, forensic researchers confirmed something Palestinian civil society had long suspected: the phones of staff at Palestinian human-rights organisations — the same six organisations Israel had just designated "terrorist" — were infected with Pegasus, the military-grade spyware sold by Israel's NSO Group. The verification came from Front Line Defenders working with the Citizen Lab at the University of Toronto, and it turned an unprovable fear into a documented fact: the people documenting the occupation were themselves being watched through their own pockets — among them a researcher for Al-Haq, the director of the Bisan Center, and the Jerusalem lawyer Salah Hammouri, who was later stripped of residency and deported. This report profiles the laboratory behind that finding, the researcher who has become mercenary spyware's most relentless public adversary, and a fight that, in 2026, they are visibly winning.
The Citizen Lab is an unlikely superpower: an academic research group at the University of Toronto's Munk School, founded in 2001 by political scientist Ronald Deibert, that applies forensic methods to a simple question — who is spying on civil society, and with what? Its researchers dissect infected phones the way pathologists dissect tissue, and publish the results with evidentiary rigour that has survived every courtroom and every denial. It was Citizen Lab that traced Pegasus infections across dozens of countries; Citizen Lab whose analysis of a Saudi dissident's phone put NSO in the orbit of Jamal Khashoggi's murder; and Citizen Lab that in 2021 captured FORCEDENTRY, the zero-click exploit that could seize an iPhone through an invisible message — a discovery that forced an emergency patch for every Apple device on earth and armed both Apple's and WhatsApp's lawsuits against NSO.
The lab's most visible spyware hunter is John Scott-Railton, a senior researcher whose career began, improbably, in kite aerial photography over Tahrir Square and evolved into a decade of tracking mercenary surveillance. He has testified to the US House Intelligence Committee, briefed parliaments, and — unusually for a forensic researcher — mastered the public square: his threads translating technical findings into plain consequence have made the spyware industry's costs legible to millions. His framing of the industry has never softened. "NSO Group is behaving exactly like the dictators it serves," he said this year, as fresh evidence emerged; "you cannot turn your back on NSO Group or the broader spyware-for-hire industry."
The Palestinian file is where the lab's work cut closest to this newspaper's readers. The 2021 verification — Pegasus on six Palestinian defenders' devices, discovered after Israel's terror designations of Al-Haq, Addameer, Bisan, Defense for Children Palestine, the Union of Agricultural Work Committees and the Union of Palestinian Women's Committees — collapsed the boundary between surveillance and criminalisation: the designations and the infections targeted the same institutions in the same season. Al-Haq's director Shawan Jabarin, profiled in this paper's TOP 100, has spent the years since carrying that file to every capital that would listen. For Palestinian journalists — this paper's witnesses among them — the lesson was structural: the tools of espionage sold as counter-terrorism had been turned on documentation itself.
What makes 2026 a story rather than an anniversary is that the fight is producing verdicts. In late 2025 a US federal court permanently barred NSO from targeting WhatsApp and ordered it to delete the exploits it had built — after Judge Phyllis Hamilton found the company liable for violating US anti-hacking law and a jury in May 2025 awarded WhatsApp 167 million dollars in punitive damages. The US Commerce Department's blacklist, imposed in 2021 on Citizen Lab-documented evidence, still stands. And then came the part Scott-Railton had predicted: WhatsApp reported that NSO-linked Pegasus campaigns ran anyway — one from 3 to 7 February 2026, another from 13 to 19 April — in apparent defiance of the injunction, and said it would ask the court to sanction the company. The firm that sold governments impunity is discovering, one filing at a time, what it is like to be watched by someone with evidence.
The lesson Citizen Lab's two decades teach is one this newspaper's own beats keep confirming: documentation compounds. A hash captured from an activist's phone in Ramallah becomes an exhibit in San Francisco, becomes a blacklist entry in Washington, becomes 167 million dollars, becomes a permanent injunction, becomes a sanctions motion. Starting this week, Citizen Lab joins this paper's standing wire sources — alongside the rights organisations whose staff its forensics once cleared of doubt — so that when the lab publishes, our readers see it, in both languages, the same day. The people most likely to be targeted deserve to be the best informed about the targeting.
