Ron Deibert (2:38)

I witnessed bullying and intimidation firsthand growing up. I know what it's like. I don't like bullies. I especially don't like bullies getting away with things and hurting innocent people.

Dina Temple Raston (2:52)

Eventually, Ron applied to university. He got in one of the only kids in his class who did.

Ron Deibert (2:57)

And I just was blown away, reading philosophy, reading history. This whole world that was opened up to me.

Dina Temple Raston (3:06)

This was the 1980s, and Ron got interested in Political science, specifically Soviet politics. And in a way that feels like something right out of Forrest Gump. Ron found himself in East Berlin just as the Wall came. He returned to Canada, ready to dive deep into Soviet studies, prepared to earn his doctorate. But fate, or rather a mentor, had other plans.

Ron Deibert (3:37)

And he very sagely said, look, the Cold War's over. There are not going to be a lot of jobs for Sovietologists, so you need to come up with something else to specialize in. And he said, you know, no one's looking at the way he phrased it was the telecommunications revolution. And a light bulb just went off.

Dina Temple Raston (3:57)

A spark of clarity, an epiphany, the kind of moment that changes your life. I'm Dena Temple Rasten and this is Click Here. A podcast about all things cyber and intelligence. We tell true stories about the people making and breaking our digital world. And today, Ron Deibert and the birth of one of the most celebrated Internet watchdog groups in the world. And we look back at the digital world we were promised and the one we actually got.

Ron Deibert (4:33)

You know, there have been great strides made in raising awareness about security risks and some amazing new tools to better communicate securely, like signal, but against all of that, honestly, it's like we're living in a Philip K. Dick novel.

Dina Temple Raston (4:50)

Stay with us. Click Here is brought to you by Progressive Insurance. Do you ever find yourself playing the budgeting game? Well, with the name your price tool from Progressive, you can find options that fit your budget and potentially lower your bills. Try it@progressive.com Progressive Casualty Insurance Company and affiliates. Price and coverage match limited by state law. Not available in all states from recorded future news. I'm Dena Temple Reston and this is Click Here. While Ron was getting his PhD, he started studying satellite imagery. It was the final days of the Cold War and the United nations started building a high tech global monitoring system to make sure that nations that said they had stopped testing nuclear weapons actually had stopped. Ron found himself with a sort of third row seat to this technology. He was studying it for his program, but in a subtle guy in the back of the room, slightly out of focus in group pictures kind of way.

Ron Deibert (6:07)

I didn't have any security clearance, but people kind of got used to having me being around and I was privy to a lot of things I probably shouldn't have seen.

Dina Temple Raston (6:16)

Around the first, it was eye opening.

Ron Deibert (6:18)

I got into this world and it really opened my eyes to this concept of technology being used to verify whether governments are keeping to their commitments or doing something bad.

Dina Temple Raston (6:35)

This was the early 90s the Internet was still in the public imagination, at least this boundless utopian space.

Ron Deibert (6:43)

The enthusiasm around the Internet was very contagious, and I was caught up in it too. It was one story after another about all of these dramatic improvements in how we access information and communicate with each other. Something that was oriented towards more freedom, more democracy, more individual empowerment.

Dina Temple Raston (7:06)

The thinking then was governments couldn't possibly control something as expansive as the Internet, which meant that sooner or later the world would be awash in this free flow of information, this tidal wave of democratic ideas.

Ron Deibert (7:20)

Serious people were talking about it in that way. It'll be impossible for authoritarian regimes to withstand this, you know, tsunami of information.

Dina Temple Raston (7:32)

But Ron, the kid who had grown up in East Vancouver, who had seen enough to make him skeptical of big promises, wasn't quite so sure. Yes, the Internet could be a force for good, but he had already seen up close how else it might be used. If governments were using technology to map entire countries from space, to track weapons, to spy on adversaries, then why wouldn't they use it to monitor their own people?

Ron Deibert (8:00)

I thought, governments are already doing things in the subterranean realm of telecommunications. There's no way that this is not going to happen around the Internet.

Dina Temple Raston (8:12)

And that's when he started thinking, hmm, if governments were using technology to watch people, why couldn't people use that same technology to watch them right back?

Ron Deibert (8:23)

This is a model that could be appropriated by citizens, by scientists, by even academics, to watch what governments are doing and hold them accountable.

Dina Temple Raston (8:35)

And just like that, the idea for the Citizen Lab was born.

Ron Deibert (8:39)

Let's find out what's going on beneath the surface of the Internet that citizens need to know about.

Dina Temple Raston (8:48)

By then, ron had his PhD, he was teaching at the University of Toronto. And as he went around campus, he started keeping an eye out for a place to set up his lab, somewhere where he could go unnoticed.

Ron Deibert (9:00)

So I identified a building that was under construction and I actually smuggled myself in while it was under construction and identified a small basement space, got the permission.

Dina Temple Raston (9:13)

A basement. It was, in his words, their little hacker hothouse. And his first hire, a fellow East Vancouver native named Nart Villeneuve, also a.

Ron Deibert (9:25)

Bit of a street kid himself, had no computer science training, was a self.

Dina Temple Raston (9:30)

Taught hacker, a guy who loved computers so much he didn't even consider this a job.

Ron Deibert (9:36)

I found out from our payroll office that many months had gone by and he had not submitted his timesheet to get paid. He told me he couldn't actually believe that someone was paying him to do the work that he was doing which he would have gladly done for free.

Dina Temple Raston (9:57)

Every day, Ron and Nart sat in that basement blasting heavy metal, hunting for malware. And it turns out Nart had this special gift all on his own. He'd figured out a way to connect to computers in China and browse the Internet as if he were inside the country without China knowing.

Ron Deibert (10:18)

Something that we do now routinely in the citizen lab. But it was the first time I had seen this presented, and what he was doing there was trying to cross check, you know, what web content is being blocked by China.

Dina Temple Raston (10:32)

And as they followed that digital trail, they suspected this was happening in other authoritarian regimes. So they started poking around in places like Saudi Arabia and Ron, because at the time, the Internet was, well, let's just say, far less secure than it is today.

Ron Deibert (10:50)

People constructed things in such a way that if you knew where to look, you could find a lot.

Dina Temple Raston (10:56)

And then in 2008, Ron got a.

Ron Deibert (10:59)

Call from a researcher, a person named.

Dina Temple Raston (11:01)

Greg Walton, who worked with activists and NGOs in Tibet. Greg explained that they'd been having these weird computer virus problems.

Ron Deibert (11:11)

They're saying, we're being flooded with this stuff. Is this something we should be concerned about?

Dina Temple Raston (11:16)

Imran thought, well, yes. And then Greg mentioned something else.

Ron Deibert (11:22)

Simultaneously, people in those communities were occasionally being arrested. And it seemed like authorities knew in advance things that they were planning and doing, suggesting that they were under surveillance.

Dina Temple Raston (11:36)

This time, Ron's team got on a plane, they flew to India to the home of the Tibetan government in exile to look into. And then, with the activist consent, we.

Ron Deibert (11:47)

Effectively wiretapped their machines, and they took.

Dina Temple Raston (11:51)

All the data back to their lab. And what they found is that the Dalai Lama's aides were right to be worried his computer had been hacked. But what was even more surprising was that the hackers had made this huge mistake.

Ron Deibert (12:04)

They had left a directory wide open, allowing us to see this very well organized spreadsheet that they maintained online of all of the victims that they had compromised.

Dina Temple Raston (12:20)

And when he says all the victims, he doesn't just mean the Dalai Lama's networks. The spreadsheet listed the IP addresses of some 1300 computers in 103 different countries.

Ron Deibert (12:32)

Ministries of foreign affairs, diplomatic missions, ASEAN banks. We were looking over the shoulders of spies who were involved in a global cyber espionage campaign. It was truly the first of its kind.

Dina Temple Raston (12:50)

The breadth and scale of the hacking program was unprecedented.

Ron Deibert (12:54)

We just looked at each other like, what the hell? What do we do with this? This is unbelievable.

Dina Temple Raston (13:01)

So they did what researchers do. They named the hack, called it Ghostnet and wrote a report about it. And then they just went back to work. Or at least they tried to.

Ron Deibert (13:16)

Well, when the day of that report came out, journalists flooded to the university. There were trucks parked outside of the building. I remember walking up to the lab that morning and I'm thinking as I'm walking, geez, I wonder what's going on here today.

Dina Temple Raston (13:37)

And it was you.

Ron Deibert (13:38)

It was us.

Dina Temple Raston (13:39)

Yeah.

Ron Deibert (13:39)

We were the biggest story in the world that day.

Dina Temple Raston (13:42)

Their little basement lab was on the front page of the New York Times.

Ron Deibert (13:45)

A lot of smart people said, wow, I had no idea that this could happen, that my computer, which I see as a window to the world, could also in the very next minute, be looking back at me.

Dina Temple Raston (13:59)

For some, though, Citizen Lab was a little too effective. When we come back, it turns out that they weren't just making headlines, they were making enemies too.

Ron Deibert (14:12)

This is the same for any investigative journalist who antagonizes powerful people. There are going to be consequences. And maybe I didn't fully anticipate where that would come from.

Dina Temple Raston (14:27)

Stay with us.

Joseph Cox (14:34)

Hey, I'm Joseph Cox, the host of another podcast I think you'll like, the 404 Media Podcast. We're an independent news outlet covering the bleeding edge of technology. And every week we discuss our latest stories. Whether that's how AI images are taking over Facebook and fooling people, how drugs are being sold on Instagram, or the spread of AI enabled surveillance cameras. We hold tech to account. Catch me and the rest of the 404 Media gang wherever you listen, just search for the 404 Media podcast. Chat to you soon from Recorded Future News.

Dina Temple Raston (15:09)

This is Click Here. I'm Dina Temple Raston. In the back of his mind, Ron expected his work would make him enemies. These days, he can't step foot in China. And the Saudis and Jordanians and Mexicans aren't too happy with his team's research either. But he was surprised by the blowback. A little closer to home, but it.

Ron Deibert (15:34)

Also seemed to antagonize the Canadian government.

Dina Temple Raston (15:38)

Why was that?

Ron Deibert (15:39)

I can only speculate, and I've come to settle on. What we were doing presented a risk, not just to whoever it was that we were publishing about. It had to do with the whole realm of cyber espionage as a whole and espionage generally, which all governments do.

Dina Temple Raston (15:58)

And governments, democratic or otherwise, would prefer that their, let's say, activities stay in the shadows. But what the Citizen Lab was doing was pulling back the curtain.

Ron Deibert (16:08)

There's an immediate risk for the Canadian government. Oh, there's this small group in a basement in Toronto, upsetting things by doing this. And this is going to cause us diplomatic blowback. I wasn't privy to that, but I'm sure they experienced it. In fact, I know the University of Toronto's president at the time told me he faced a lot of pushback from Chinese officials, which he resisted, to his credit. But I'm sure the Canadian government experienced that as well. I'm sure that went through their mind. If we are to believe what diebert is saying, we might be next.

Dina Temple Raston (16:46)

Because espionage, the kind the Citizen Lab was exposing, all governments do it. And over the next few years, Ron and his crew seem to be finding a lot of it, making headlines around the world.

Ron Deibert (17:02)

How truly free is the Internet?

Ron Deibert (17:04)

Computer researchers in Canada have created what some say is the most advanced tool yet in helping Internet users.

Dina Temple Raston (17:10)

Called siphon is a software program that's been created Basement computer lab at the University of Toronto. The Citizen lab would go on to expose hacking programs targeting dissidents, journalists, lawyers, teachers, governments, corporations, intelligence agencies. No one seemed to be off limits. The Citizen Lab had built a machine to watch governments and flag their abuse. And Ron seemed to find it nearly everywhere he looked. And over the years, the abuse he found got more insidious, more sophisticated. No more so than what he and his team uncovered in 2016. It started with a single suspicious text sent to an activist named Ahmed Mansour in the United Arab Emirates.

Ron Deibert (17:56)

He received a text message on his iPhone that contained a link that if he clicked on it, would have activated a zero day exploit.

Dina Temple Raston (18:08)

Zero day exploit, A vulnerability not yet discovered by the people who made the software. It takes advantage of no patch yet, no defense, just an open door for hackers to slip into. Fortunately, Ahmed did what you're supposed to do when you get a fishy text or email. He called the Citizen Lab.

Ron Deibert (18:28)

Instead of clicking on that, he shared it with Bill Marzak, the lead technical researcher in the Citizen Lab, who set up a system in the lab that allowed him to capture all of those ingredients, including Pegasus.

Dina Temple Raston (18:44)

Pegasus, a piece of spyware we've talked about before, Sold by an Israeli company called NSO Group. It wasn't just another piece of malware. This was something different. Eventually, it would be able to infect a phone without the user doing anything and then actually take control of.

Ron Deibert (19:06)

Can turn on the microphone. Even when you're not using a phone caller, just record what you're doing in the room. It can turn on your camera. It can record what's on your screen.

Dina Temple Raston (19:14)

And all of this was legal for years. Pegasus was marketed and sold to governments under the understand that it would be deployed against criminals and terrorists. That was the pitch, but the reality was something else entirely.

Ron Deibert (19:30)

And so that was August 2016. That was the first time we encountered it.

Dina Temple Raston (19:35)

You went out with a report about NSO a short time later.

Ron Deibert (19:39)

Yes. The million dollar dissident report was the first ever report on Pegasus. And for us, that was as big, if not more a deal than ghostnet.

Dina Temple Raston (19:51)

People started bringing their phones to the citizen lab to get them checked for Spyware. And in 2021, it even got the attention of the white house. Former president Joe Biden announced that he was putting NSO group on a federal blacklist. He signed an executive order to restrict the use of commercial spyware by the U. S. And for Ron, this was the sort of thing that the citizen lab was supposed to help make happen.

Ron Deibert (20:16)

All of those things that you hope would come out of your research were starting to happen, and I just couldn't believe that there were these outcomes. An executive order being put out there by president Biden on commercial spyware. Phenomenal. This is like the holy grail.

Dina Temple Raston (20:38)

But Ron wasn't punching the air for long. Now he has to deal with the Trump administration.

Ron Deibert (20:45)

You know, there have been great strides made in raising awareness about security risks and people, you know, documenting Internet censorship and surveillance and cyber espionage. But the very mission that we set up for ourselves to act as a counterintelligence for civil society, I think that mission is now at the greatest risk that it's ever been in the last 23 years that we've been around. Keep in mind that they're very explicit about going after academic centers like the citizen lab. I could very well foresee aggressive litigation efforts coming at us and other groups to try to shut us down.

Dina Temple Raston (21:27)

But his concerns go beyond the citizen lab, beyond the United States. He's worried about the world.

Ron Deibert (21:33)

All of the gains that we've made are almost certainly now at risk, but there will be ripple consequences as well throughout the world because of his behavior. It's going to open up the opportunity for oligarchs and dictators around the world to model themselves on that behavior.

Dina Temple Raston (21:53)

And the way Ron sees it, things are going to get worse before they get better.

Ron Deibert (21:58)

We're in for a very dark period. So, you know, our mission now, it takes on a new meaning in this current environment. We've got a lot of work to do.

Dina Temple Raston (22:09)

Want to learn more about Ron Deibert and the citizen lab? Ron has written a new book called chasing shadows from Simon and schuster, author Margaret Atwood called it essential reading, and we agree. It tells not just Ron's story, but how the Citizen Lab became the world's foremost digital watchdog. We thank him for sharing it with us early because we couldn't put it down. This is Click Here.

Unknown (22:43)

Looking for more of the cybersecurity and intelligence coverage you get on Click Here. Then check out our sister publication the Record from Recorded Future News. You'll get breaking cyber news from reporters in New York, Washington, London and Kyiv, among others, and you'll see for yourself why it attracts hundreds of thousands of page views every month. Just go to TheRecord Media.

Dina Temple Raston (23:07)

Today is Tuesday, February 25th, and here are some of the top cyber and intelligence stories of the past week. Thailand is cracking down on cyber scam networks run from labor camps across its border with Myanmar. As many as a thousand Chinese nationals who were rescued from online scam centers in my Myanmar last week are scheduled to return home following an international crackdown on these operations. All told, thousands of foreigners were freed last week from these scam centers, where workers are forced to run romance and investment scams for organized criminal rings. China and Thailand are now working together to try to bring an end to the practice. Myanmar officials say they will deport some 10,000 people linked to the online crimes. The securities and Exchange Commission is scaling back on a special unit of more than 50 lawyers who have been focused on crypto enforcement actions. The move is part of a broader campaign by the Trump administration to give cryptocurrency and other digital assets a bit of a boost. One of President Trump's first executive orders was aimed at, in his words, eliminating regulatory overreach on digital assets. Some of the SEC lawyers in the crypto unit are being assigned to other departments. A spokesperson for the SEC declined to comment. And finally, a little more of Elon Musk's space junk plummeted to Earth last.

Joseph Cox (24:42)

Week in a surprising turn of events. Rocket debris from a SpaceX rocket has fallen on Polish soil.

Dina Temple Raston (24:50)

A three and a half foot piece of a fuel tank fell near a warehouse in Poland, and while no one was hurt, it was an unusually large piece of debris because most space junk burns up on re entering the Earth's atmosphere. Experts say the sheer number of launches these days is making heavy things falling from space a real concern. Today's episode was produced by Zach Hirsch, Sean Powers, Megan Dietrich, Erica Guida and me, Dina Temple Reston. It was edited by Karen Duffin, Fact Checked by Darren Ancrum, and contains original music by Ben Levingston with some other music from Blue Dot sessions. Our staff writer is Lucas Riley, and our illustrator is Megan Gough. Martin Peralta is our sound designer and engineer, and Click Here is a production of Recorded Future News and prx. Tune in on Friday for Mic Drop, which features our favorite interview of the week. We'll see you then.

Unknown (26:23)

Looking for more of the cybersecurity and intelligence coverage you get on Click Here? Then check out our sister publication, the Record from Recorded Future News. You'll get breaking cyber news from reporters in New York, Washington, London, and Kyiv, among others. And you'll see for yourself why it attracts hundreds of thousands of page views every month. Just go to the Record Media.