The Architecture of Surveillance: Citizen Lab Raises Questions About US Government Power and Big Tech
Government surveillance is often discussed as a contest between privacy and national security. That framing is incomplete. Modern monitoring systems increasingly rely on a wider commercial ecosystem: mobile applications collect data, advertising markets circulate signals about devices and locations, analytics companies organize information, and public agencies may acquire tools that make those records searchable. The result is a policy problem that extends beyond any single agency or technology vendor.
That broader issue was underscored in October 2026, when Dark Reading reported on a speech by Ron Deibert, director of the University of Toronto's Citizen Lab, at the SecTor 2026 conference. Deibert warned about the growth of commercial surveillance and criticized the relationship between the US administration and influential technology executives. His characterization of the political environment was an argument made by an identified speaker, not a neutral finding that can be treated as independently established fact.
The more useful question for readers is what the available evidence reveals about the systems behind surveillance—and which safeguards can make their use accountable.
Beyond spyware: the commercial infrastructure of monitoring
Citizen Lab's research shows why surveillance cannot be understood only through the image of a hacker secretly installing spyware on a particular phone. In its April 2026 report, Uncovering Webloc: An Analysis of Penlink's Ad-based Geolocation Surveillance Tech, researchers examined a system that uses data derived from mobile applications and digital advertising to provide location intelligence.
The researchers said Webloc was developed by Cobwebs Technologies and is now sold by Penlink. Based on documents and other evidence reviewed for the report, they described access to records from as many as 500 million mobile devices worldwide, including device identifiers, location coordinates and profile information. That figure describes the system's reported data reach; it should not be interpreted as proof that every device was continuously tracked or that every record was used in a government investigation.
The report identified several US public-sector customers, including Immigration and Customs Enforcement (ICE), the US military, the Texas Department of Public Safety and certain police departments and local authorities. The report also documented customers or use in other countries. These findings matter because they connect a broad data marketplace to identifiable public institutions rather than relying solely on general warnings about future surveillance.
Advertising data can be revealing even when it was not originally collected for law enforcement. Location signals gathered from apps and advertising systems can, when linked over time, expose routines, visits to sensitive places and associations between devices. The risk grows when multiple datasets are combined and analyzed at scale.
Yet the distinction between technical capability and proven conduct remains essential. The existence of a data stream does not establish that every individual has been identified, that a particular official accessed a specific record, or that a particular search violated the law. Those questions require evidence about access, purpose, legal authority and actual use.
Why government contracts are only the beginning of the accountability question
A public contract can establish that an agency purchased or obtained access to a product. It cannot, by itself, answer how often the system was used, which people were searched, what legal process applied, how long information was retained or whether an independent body reviewed the searches.
Those details are not administrative trivia. They determine whether a surveillance system is narrowly deployed for a legitimate purpose or becomes a tool for broad monitoring with limited visibility to the public. They also determine whether a person wrongly targeted can challenge the action or seek a remedy.
Citizen Lab reported that its researchers submitted 96 freedom-of-information requests to law-enforcement bodies and other institutions across 14 European countries and to six European Union bodies while examining the use of Webloc. The report described many refusals or non-responses. That finding concerns the institutions and jurisdictions examined; it should not be generalized into a claim that every government conceals its surveillance activities.
The transparency problem is structural. A procurement record may reveal the vendor but not the operational rules. A privacy policy may explain how an app collects data but not what happens after that data enters an advertising exchange. A vendor may describe a tool as an intelligence product without making the system's error rates, data sources or retention practices public.
Big Tech, government power and the limits of voluntary safeguards
Deibert's October remarks, as reported by Dark Reading, placed technology executives and government surveillance policy in a wider political context. He criticized what he saw as closer alignment between major technology companies and the Trump administration, and raised concerns about commercial spyware, AI-generated disinformation and the potential targeting of civil society.
These are serious criticisms, but an evidence-led article must distinguish the speaker's interpretation from verifiable events. Political proximity between executives and officials is not, by itself, proof of unlawful surveillance. Likewise, the existence of an AI system does not prove that it has been used to manipulate a particular audience. Specific claims should be assessed against contracts, technical investigations, court records, agency statements and responses from the companies involved.
Nevertheless, the underlying governance question is substantial. Technology companies can shape government conduct through the products they sell, the data they retain, the access they grant and the restrictions they place in contracts. Voluntary safeguards can be meaningful, but they are vulnerable if they depend entirely on a company's current leadership or can be removed without public scrutiny.
A related US policy debate concerns whether AI providers should be permitted or required to maintain contractual limits on uses such as mass domestic surveillance. In March 2026, the organization Protect Democracy described a dispute over safeguards imposed by Anthropic and the Pentagon's response. That source represents an advocacy organization's account of the dispute, so its claims should be read alongside primary court filings and official statements rather than treated as a substitute for them.
The policy distinction is important: a government may have legitimate national-security needs, but those needs do not automatically justify every technical capability a vendor can provide. Nor should a company's refusal to enable a high-risk use automatically be treated as proof that the company is acting against the public interest. The appropriate standards are legality, necessity, proportionality, oversight and the availability of remedies when rights are violated.
Four tests for responsible surveillance
The debate becomes more concrete when surveillance systems are assessed against operational safeguards rather than broad promises of security or privacy. Four tests are particularly important.
1. Clear legal authority
Agencies should identify the legal basis for acquiring data and using analytical tools. Rules should distinguish emergency access from routine monitoring and should make clear when a warrant or other independent authorization is required. The precise legal standard varies by jurisdiction and type of data; no single rule should be assumed to apply to every surveillance method.
2. Necessity and proportionality
Authorities should explain why a particular tool is needed, why a less intrusive method is insufficient, and how the scope of collection is limited. Access to a large commercial dataset should not become a substitute for demonstrating a specific investigative need.
3. Auditable access and retention
Systems should maintain records showing who searched for information, when the search occurred, what authority supported it and whether the result was shared. Retention periods should be limited, and independent auditors should be able to test compliance without depending solely on the vendor's assurances.
4. Public reporting and remedies
Where operational security permits, agencies should publish aggregate information about use, legal requests, errors and complaints. People affected by unlawful or mistaken surveillance should have a meaningful route to challenge it. Oversight is weaker when the public cannot learn whether a system is being used, and individuals have no practical way to contest misuse.
| Question | Evidence that would help answer it |
|---|---|
| Who can access the system? | Procurement records, access-control policies and audit logs. |
| What data does it use? | Technical documentation, data-provenance records and independent testing. |
| What justifies a search? | Applicable law, written policies, authorization records and oversight findings. |
| How long is data retained? | Retention schedules, deletion records and independent compliance audits. |
| Can misuse be challenged? | Complaint procedures, judicial review, published findings and available remedies. |
What this means for citizens and the technology industry
Individuals have limited ability to opt out of the data economy while continuing to use connected devices and online services. They can review app permissions, restrict location access, reset advertising identifiers where available and remove applications they do not trust. These steps may reduce some forms of collection, but they cannot guarantee anonymity or prevent every form of commercial tracking.
The larger responsibility belongs to the institutions that design, buy, regulate and deploy these systems. App developers and advertising intermediaries should explain what data they collect and share. Vendors selling surveillance products should document their data sources and controls. Government agencies should publish clear rules and allow independent oversight. Legislatures and courts should ensure that legal protections remain effective when data is obtained indirectly from commercial sources.
News coverage should apply the same discipline. A vendor's advertised capability is not proof of its real-world effectiveness. A contract is not proof that every use is unlawful. A researcher's warning is newsworthy, but the warning should be attributed and tested against the evidence. These distinctions improve public understanding rather than weakening scrutiny.
The central issue is accountability, not technology alone
Citizen Lab's research and Deibert's public criticism point toward a common concern: surveillance power increasingly emerges from interactions between public authorities and private digital infrastructure. Advertising systems, data brokers, analytics platforms, spyware vendors and AI tools can each contribute to a monitoring capability that no single component fully explains.
The strongest conclusion is not that every government use of surveillance technology is abusive, or that every technology company is complicit in wrongdoing. It is that the public cannot assess legitimacy without knowing the purpose, legal basis, data sources, access rules, retention limits and oversight mechanisms governing these systems.
The test for democratic governance is therefore practical: can authorities demonstrate that surveillance is lawful and necessary, can independent bodies verify those claims, and can people seek redress when the system is misused? If those questions remain unanswered, technological sophistication risks advancing faster than public accountability.
Sources and references
- Christl, W., Perry, A., Garcia, L. F., Anstis, S., & Deibert, R. (2026, April 9). Uncovering Webloc: An Analysis of Penlink's Ad-based Geolocation Surveillance Tech. The Citizen Lab, University of Toronto. Read the original research report.
- Wright, R. (2026, October 7). Citizen Lab Slams Trump Administration, 'Techno-Fascist' Executives. Dark Reading. Read the conference coverage.
- Citizen Lab. (n.d.). Mass Surveillance. The Citizen Lab, University of Toronto. Read the research overview.
- Protect Democracy. (2026, March 9). Safeguarding frontier AI labs' guardrails from government overreach. Read the policy organization's account.
Source note: The Citizen Lab report is the primary research source for the Webloc findings. Dark Reading is a secondary source for Deibert's conference remarks. Protect Democracy is an advocacy organization and is identified as such here. Readers should consult the linked materials for the full evidence, qualifications and context.
Source: Dark Reading