Citizen Lab, a cybersecurity watchdog organization at the University of Toronto, has published hard-hitting research on powerful targets in recent years: Chinese government censorship, Silicon Valley’s invasion of customers’ privacy, despotic regimes’ electronic surveillance of dissidents. It’s the kind of work that can make enemies.

So when John Scott-Railton, a senior researcher at Citizen Lab, got an odd request for a meeting last week from someone describing himself as a wealthy investor from Paris, he suspected a ruse and decided to set a trap.

Over lunch at New York’s five-star Peninsula Hotel, the white-bearded visitor, who said his name was Michel Lambert, praised Mr. Scott-Railton’s work and pried for details about Citizen Lab. Then — “as I was finishing my crème brûlée,” Mr. Scott-Railton said — a reporter and photographer from The Associated Press, alerted by Mr. Scott-Railton and lurking nearby, confronted the visitor, who bumped into chairs and circled the room while trying to flee.

At least two other men nearby appeared to be operatives — one who stood at the door, another who seemed to be filming from a table, said Mr. Scott-Railton, who himself filmed his lunch companion.