Ronald Diebert (Jamie Napier)

“If you own a device and connect to a cellular service anywhere in the world, you’re trackable.” That’s the sobering assessment of Ronald J. Deibert, someone who knows whereof he speaks. As the founder and director of The Citizen Lab, a digital security research centre operating out of the University of Toronto’s Munk School of Global Affairs and Public Policy, Deibert has been at the forefront of investigating instances of global cyber espionage for almost a quarter of a century. After probing phone hacking and other covert surveillance of politicians, journalists, and activists in the Middle East, Europe, South America, and elsewhere, Deibert has decided that the lack of security in our global telecommunications systems is, in his words, “nothing short of jaw-dropping.”

This might not come as a surprise to digital natives who blithely assume that in the internet era privacy is a quaintly outdated notion; those same digital natives might do well to read Deibert’s latest book, which provides even a cynic or skeptic an eye-opening primer on the extent of the problem around digital surveillance in the 21st century. Chasing Shadows: Cyber Espionage, Subversion, and the Global Fight for Democracy is several things simultaneously: a potted history of The Citizen Lab and an introduction to its key figures; a précis of various investigations the digital sleuths have undertaken; and an urgent warning about the threats to global democracy and freedom from autocrats and other instigators using widely available spyware to undermine dissent and silence critical voices.

Probably the most recognizable case Deibert discusses is the assassination of Jamal Khashoggi, the Washington Post journalist critical of the Saudi Arabian regime under Mohammed bin Salman, who in 2018 was lured into the Saudi consulate in Turkey where he was murdered and dismembered with a bone saw. But what many people may not know is that the same year Khashoggi was killed, a Saudi expat named Omar Abdulaziz, a vocal critic of bin Salman who had been granted asylum in Canada, had his phone hacked by Saudi security agents employing spyware known as Pegasus.

If there is a single arch-villain in Deibert’s story, it is the Israeli-run NSO Group, which owns and sells the Pegasus spyware. The tools of the malware (known as exploits) are able to spoof legitimate websites and, in their latest iteration, have “zero click” capabilities that can infect targeted devices without their owners taking any action. The list of autocratic government clients using NSO Group spyware is chilling, among them India, Kazakhstan, Rwanda, and the United Arab Emirates. El Salvador’s “millennial authoritarian” (Deibert’s term) Nayib Bukele, who fashions himself “the coolest dictator in the world,” was accused of using Pegasus spyware on journalists in his country; while Deibert says The Citizen Lab discovered no smoking gun, there was definitely “the sulfurous smell of gunpowder” around the charges.

The history of Pegasus and the NSO Group has been well covered before in Laurent Richard and Sandrine Rigaud’s 2023 book Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy. Deibert references the book but comes across as a bit miffed at a perceived “competitive dynamic” that “sidelined us from fully participating” in the project that resulted in Richard and Sandrine’s volume. This is OF a piece with Deibert’s generally triumphalist mien where The Citizen Lab is concerned: he writes about the group’s “blockbuster” investigations and spends a good deal of time patting himself and his colleagues on the back for the good work they have done for the world.

Much of this self-satisfaction is justified. Since its inception, The Citizen Lab has been at the forefront of exposing bad actors in the digital realm; perhaps the largest testament to their accomplishments is that the Munk School has been declared an “undesirable organization” by the Kremlin. (Deibert himself has also been warned not to travel to mainland China or Hong Kong lest he be scooped up and imprisoned.) The lab has done solid work in a lot of global hot spots; the attempt to capture this inevitably results in a narrative that is somewhat fragmented and highly technical in places. But despite occasionally getting bogged down in technical details or repetition, the story Deibert unfolds uncovers issues of pressing concern to anyone who is invested in using modern digital technology on a daily basis. That is, pretty much all of us.