Introduction

In January 2021, Carine Kanimba, a Rwandan activist living in the United States and Belgium, discovered that her mobile phone had been infected with Pegasus spyware, a powerful commercial surveillance tool that provides its operator with complete access to the targeted device. A forensic examination of her device revealed that the spyware was likely active during her meetings with European Union officials, such as the Belgian minister of foreign affairs with whom Kanimba was discussing the release of her father, Rwandan dissident Paul Rusesabagina. Rusesabagina was imprisoned in Rwanda at the time. In describing her experience as a target of Pegasus spyware, Kanimba recounted: “It is horrifying to me that they knew everything I was doing, precisely where I was, who I was speaking with, my private thoughts and actions, at any moment they desired.”

The targeting of Kanimba is an example of a practice called digital transnational repression. Transnational repression occurs when states engage in the cross-border targeting of diaspora and exiled communities in order to silence or repress dissent. Traditionally, transnational repression is defined by the methods or practices of repression, such as extraterritorial killings, extraditions, the abuse of Interpol processes, and harassment or assault. Digital transnational repression arises when states use digital technologies to engage in such actions. Targeted individuals often include journalists, human rights defenders, and dissidents (such as Kanimba) who have fled their country of origin and who remain highly critical of that country’s government.

While acts of transnational repression can be particularly impactful or even fatal for their victims, digital forms of transnational repression are becoming a pervasive and all-encompassing threat to people who seek to challenge the policies of their country of origin from abroad. From online harassment and disinformation campaigns launched on social media to spyware, the adaptability, versatility, and proximity of digital technologies mean that dissidents in exile or in the diaspora are no longer safe from the repressive practices of their country of origin. Once heralded as a tool of empowerment and expression, digital technologies have, perversely, become a major source of insecurity, fear, and self-censorship.

In this essay, we discuss findings from interviews conducted with over 80 human rights defenders, journalists, and other members of civil society living in the diaspora or in exile who believe they were targeted by their country of origin (or “perpetrating state”) through digital transnational repression. We also analyze the impact of this targeting on these individuals’ ability to engage in activism and express themselves freely. Further, through the lens of international human rights law, we explore how host states—in particular, the U.S.—have responded and should be responding to the practice of digital transnational repression. Finally, we discuss how permissive norms around extraterritorial surveillance serve to condone and facilitate this practice.

Silencing Speech Abroad: The Use of Digital Technologies in Transnational Repression

Key features of transnational repression

Transnational repression is a term that emerged from the social sciences and the study of authoritarianism, and it has yet to be defined by law. Nonetheless, several governments have already begun implementing policy measures to combat this phenomenon. The term was developed to describe the growing practice of states seeking to silence or limit any form of dissent that originates from abroad: for example, from nationals or ex-nationals who have fled their country of origin and sought refuge and protection in the U.S. or elsewhere and who continue to engage in transnational advocacy work. The practice of transnational repression is undertaken using a variety of methods and approaches. This includes extraterritorial killings; the deployment of embassy and consulate staff to protests to intimidate, surveil, or attack anti-regime protesters; the use of “coercion-by-proxy,” which involves targeting family members in the country of origin to stop the target living abroad from engaging in organizing work; passport cancellations or denials of renewals; the use of bilateral agreements, such as extradition agreements, to secure the detention and deportation of a targeted person back to the country of origin for punishment; and the use of digital technologies.

At the core of transnational repression are a number of common features. It is a practice undertaken by state or state-related actors. For example, in the case of the killing of Saudi journalist Jamal Khashoggi, Saudi state officials were dispatched to Turkey to kill him. States may also contract private individuals in the host state to undertake acts of transnational repression, such as organizing an extraterritorial killing, attending protests with the intent to intimidate protesters, or deploying a so-called “digital army” to surveil, intimidate, and harass diaspora and exiled activists who are active online. The intent behind acts of transnational repression helps differentiate transnational repression from other cross-border state activity. The intent is to silence or stifle dissent that originates abroad. This goal may be accomplished through different means—for example, the outright killing of a diaspora or exiled activist. However, the approach may also be more subtle, as we discuss in this essay: for example, relentless campaigns of online harassment and intimidation that lead activists in exile to self-censor or simply quit transnational advocacy work altogether.

Persons targeted through transnational repression tend to be nationals or ex-nationals of the perpetrating country, although this is not necessarily a requirement for an act to qualify as transnational repression (for example, a state may also target individuals who have another nationality but are critical of the regime). Targeted persons tend to engage in some kind of transnational work that is critical of the perpetrating state. Consequently, human rights defenders, activists, journalists, and members of the political opposition tend to be common targets of this practice and face heightened vulnerability when they leave their country of origin.

In undertaking acts of transnational repression, perpetrating states have implicitly adopted an expanded understanding of the boundaries of territorial sovereignty that gives rise to at least two dimensions of unlawfulness. The repression itself can give rise to an unlawful act under both domestic law and international human rights law (for example, it is illegal to engage in an extraterritorial killing under international human rights law and such an act is likely criminalized in domestic law as well). Further, repressive activities can also give rise to violations of international law principles, such as state sovereignty. Thus, physical acts of transnational repression—such as extraterritorial killings or the opening of so-called extraterritorial “police stations” in the host state —are obvious violations of international human rights law and of the principle of territorial sovereignty.

A perpetrating state may also seek to legitimize their activity by cloaking it under the guise of domestic law and arguing that their extraterritorial actions are simply a matter of extraterritorial enforcement. One could also conceive of such extraterritorial action as a violation of enforcement jurisdiction—which includes acts by state agencies such as serving papers, acquiring criminal evidence for a prosecution, or arresting and detaining someone abroad—that is traditionally restricted to the territorial borders of the state. Under international law, a state cannot send its law enforcement agents into the territory of a host state without its permission to, for example, ‘acquire’ (i.e., arrest, detain, and transfer) a human rights activist who was charged and convicted in their country of origin.

Digital transnational repression: transnational repression at scale

Between 2019 and 2024, the Citizen Lab, an interdisciplinary research laboratory at the University of Toronto’s Munk School of Global Affairs and Public Policy (where the authors work as a senior legal advisor and as director) has undertaken over 80 semi-structured interviews to better understand the nature and impact of digital transnational repression. Along with other researchers and fellows at the Citizen Lab, we have spoken to individuals from around the world who have fled or left their country of origin and who continue to engage in some form of transnational advocacy work or critique their country of origin and believe they have been targeted using digital technologies because of their work. These interviews focused on understanding the different methods used by state or state-related actors in undertaking digital transnational repression and, in particular, on understanding how targeted persons react to and are impacted by such attacks—psychologically, socially, practically, and in other ways.

Digital transnational repression arises when states use digital technologies with the intent to silence and neutralize dissent abroad. Based on interviews with human rights defenders, activists, and journalists who self-reported having been targets of digital transnational repression acts, we have identified a number of different technological approaches used to perpetrate this method of repression. We can categorize these into the following: the use of spyware or similar technology to engage in unauthorized surveillance of a target’s computer or cell phone; the hacking of social media, email, and other internet accounts (for example, through phishing campaigns in which the targeted person accidentally provides their personal login information to the operator) to acquire information about the activities and networks of the targeted person; the abuse of social media to engage in sustained and coordinated campaigns of disinformation and intimidation, including with the assistance of newly emerging artificial intelligence tools; the acquisition of location data (for example, from data broker exchanges or cell phone roaming networks) to track target movements; and the use of distributed denial-of-service (DDoS) attacks to take down websites that share information critical of the perpetrating state, such as blogs or independent newspapers.

Digital transnational repression presents an even more complex problem than physical acts of transnational repression. Digital technologies are versatile and adaptable to a variety of different goals. For example, if a perpetrating state wants to both silence someone online and map out their professional and personal networks in order to find other activists to target, they can deploy a multi-faceted digital campaign that involves both discrediting the targeted activist through online disinformation and harassment and hacking their email accounts to identify family members or colleagues to pursue.

The growth of the hack-for-hire, mercenary spyware, disinformation, and “dark PR” marketplaces means that more states have access to technology and services that facilitate such multi-faceted repression. Targeted persons are extremely vulnerable in such situations, with a limited ability to mitigate attacks, because they are vastly outnumbered and outsourced by their attackers. There is a huge asymmetry between the attackers and their targets, in other words. Victims generally have access to limited digital security resources while government perpetrators using state funds can procure a range of products and services from numerous vendors. When faced with some of the more expensive and sophisticated forms of digital targeting, such as spyware, there is only a highly limited set of actions that targets can take to prevent being targeted or to discover such targeting: for example, by activating Apple’s Lockdown mode on their iPhone. Furthermore, vendors of these types of services employ highly trained operatives, many of them veterans of elite intelligence agencies with specialized skills and years of experience in professional subversion and covert operations. In addition, identifying who has undertaken an act of digital transnational repression can be complex, in particular because perpetrators engage in covert or thinly concealed acts that muddy the waters around attribution while effectively creating a climate of fear.

Finally, digital transnational repression is less resource-intensive and politically explosive than, for example, sending state agents into the territory of another state to kill someone. Attribution back to the state—which is necessary to establish state responsibility—is easier to mask when operations are undertaken remotely and at a distance from the target and blended into organic or grassroots online harassment campaigns that arise spontaneously or are amplified and encouraged by operators. Such campaigns represent an even more pernicious form of transnational repression that can be performed at scale and on a full-time basis (for example, by funding electronic armies) and that may also leverage and exploit masses of private citizens by implicitly or explicitly encouraging them to harass specific targets.

These characteristics—in particular, the fact that investigations into digital transnational repression and the attribution of such acts to a specific state require highly specialized technical skills and knowledge and that such digital campaigns may involve members of the general public and not exclusively state or state-funded actors—make it more complicated for host states to enact legislative, institutional, and legal responses to deter such behavior by state perpetrators. The regulation of digital transnational repression is also part of the broader landscape of online speech regulation and content moderation, which continues to challenge policymakers—in particular, in determining to what extent host states can regulate or limit online speech that amounts to digital transnational repression without engaging in human rights violations of their own and in assessing whether the chosen regulatory regime is ultimately effective.

Territorial sovereignty and digital transnational repression: a weak normative framework

Digital transnational repression has flourished in part because there is continuing uncertainty about how norms of international sovereignty apply in the digital sphere. Operating outside any bilateral or international legal frameworks, some states have taken the liberty of hacking computers or servers located in foreign jurisdictions. Whether such activity (or remote-access espionage more generally) amounts to a violation of territorial sovereignty has been hotly debated.

It is also the subject of debate whether extraterritorial surveillance—such as hacking a dissident’s cell phone abroad—constitutes an actionable violation of international human rights law or whether jurisdictional limitations built into treaties like the International Covenant on Civil and Political Rights (ICCPR) preclude claims of such violations. While there is clearly a substantive rights violation in such situations (because the hacking of a human rights defender’s or a journalist’s phone is unlikely to be considered necessary or proportionate under international human rights law), perpetrating states are likely to argue, from a procedural point of view, that they do not owe any extraterritorial human rights obligations to targeted persons under the language of international human rights treaties. The argument is essentially that a relevant international human rights treaty—for example, the ICCPR—only applies to persons within the jurisdiction of the perpetrating state and that individuals located abroadwhen they have their human rights violated by the perpetrating state do not fall within this scope of jurisdiction and thus have no recourse against the offending state. If such legal arguments are successful, from a practical point of view, it becomes impossible for the victim to seek a remedy as their complaint is likely to be thrown out at the admissibility stage.

In addition, to the extent that acts of digital transnational repression could be characterized as espionage, international norms around whether espionage is permissible are unclear, with some arguing that espionage is not regulated by international law and operates in extralegal territory. In short, digital transnational repression is less costly (politically and economically) than in-person acts of repression and is a highly scalable and easily adaptable method by which states can seek to repress critical speech abroad. As we demonstrate next, it is also very effective in accomplishing one of its objectives: to chill dissent abroad.

The Impacts of Digital Transnational Repression: The Violation of the Rights to Freedom of Expression, Privacy, and Peaceful Assembly

Before discussing how international human rights law provides a framework for host states to respond to transnational repression, we discuss the severe impacts of this practice on targeted persons. In interviews with human rights defenders, activists, and journalists in exile or in the diaspora, we identified a number of negative outcomes that we discuss below. In particular, targeted persons reported engaging in self-censorship online, experiencing social isolation (both online and in their host state community), experiencing psychological harms that impaired their ability to work, study, and care for themselves and their families, and quitting their advocacy work in order to protect themselves and those around them. We discuss some of these negative impacts and how they result from a series of human rights violations, including violations of the right to freedom of expression, the right to peaceful assembly, and the right to privacy.

The impacts of digital transnational repression

Self-censorship and curtailing online communications

A significant impact of the unchecked spread of digital transnational repression has been self-censorship. As David Kaye, the former U.N. special rapporteur on the promotion and protection of the right to freedom of opinion and expression, remarked in 2019, targeted surveillance in particular “creates incentives for self-censorship and directly undermines the ability of journalists and human rights defenders to conduct investigations and build and maintain relationships with sources of information.” This dynamic also applies on a transnational basis. Indeed, our research participants frequently mentioned that being the target of persistent digital attacks led them to be more cautious in their online behavior, including by limiting and controlling who they followed on social media and what they posted online. For example, a research participant from Yemen who worked as a blogger and activist and fled to Belgium described how, in the wake of digital attacks, she began to self-censor online in order to protect her family members. As she recounted: “I was self-censoring and I wanted to write, and then I would imagine my family and I’d stop writing. There was a lot of self-censorship, I kept thinking, questioning. It broke my confidence a little bit.”

Another research participant from Syria who fled to the United Kingdom in 2016 and who works in journalism, writing about the freedom of expression and gender, explained how self-censoring has changed the way she engages in activism: “I don’t express my opinion unless it’s very related to my [work]. I stopped writing, I mean, writing is what I do. … Self-censorship is one of my main traumas.” Being cautious about online communication is another impact of digital transnational repression, according to a Uyghur human rights activist who works in the U.S. She shared that many of her friends and family members stopped communicating with her because affiliating with an activist who opposes the Chinese government poses safety risks for them. This activist also self-censors and limits her posting online, explaining, “I don’t want to share too much and give more information and data to the attackers.”

Social isolation and withdrawal from work critical of the country of origin

Arriving in the U.S. or another host state as an asylum seeker or immigrant is a challenging experience in and of itself. This challenge is compounded by transnational repression, which can make it difficult to trust and rely on co-nationals who have similarly relocated to the new host state. Drawing on our interviews, we observe that digital transnational repression can push targets to isolate themselves both online and from their physical communities, with negative consequences on their resettlement in the host state and their ability to engage in transnational advocacy work.

A research participant from Tanzania who works on human rights campaigns and who fled to another country in East Africa recounted: “I am conscious about my communications. … I don’t want to put people I speak to in danger. There is a form of isolation that gets worse over time.” She described her life as “closed off” and involving no interaction with others from her country of origin living in her host state. Another research participant from Azerbaijan who worked in peacebuilding and journalism and fled to Georgia described how the digital attacks she faced led her to refrain from communicating with other members of the diaspora. Her self-isolation included limiting which social media accounts she followed and deactivating Facebook for a period of time.

Othertargets describe how self-isolation affects the cultural connections they feel with their country of origin. A research participant from Eritrea who advocates for refugees and works as a human rights activist in Uganda said that she did not eat at Eritrean restaurants. She felt distrustful in social settings related to her country of origin, adding, “I don’t know if [Eritreans] hate me or support me because I have been attacked in person too many times.” Another Uyghur research participant who fled to the U.S. and who works as a human rights activist recounted that she likes to show pride for her home country in the way she dresses. However, she now refrains from sharing her culture both online and offline in order to protect herself from acts of digital transnational repression.

A research participant from Turkey who worked as a journalist and fled to Germany described themself as an “open book” prior to being targeted online. However, after relocating, they have now reduced their contacts with other members of the diaspora “to the bare minimum.” Other targets said they withdrew completely from their activism work. A research participant from Eritrea who fled to the United Kingdom and worked for a human rights organization explained that she took longer breaks from work because of the digital attacks she experienced. Another research participant from Azerbaijan who worked on women’s human rights issues and fled to the Czech Republic said she simply had to quit her advocacy work to protect her health and family.

Digital transnational repression as a violation of international human rights law

One could view transnational repression, including its digital forms, as an infringement on the host state’s territorial sovereignty. While this is one dimension of transnational repression, as we noted earlier, arguments regarding territorial sovereignty in digital spaces are complex and the legal framework remains fuzzy. In addition, in responding to transnational repression through a sovereignty-driven framework, host states are primarily acting in the furtherance of their own self-interest. Thus, the sovereignty response is primarily about preserving the sovereignty (or control) of the host state over persons within its territorial borders. A sovereignty-oriented response to transnational repression is not about acknowledging and remedying harms and losses suffered by targeted persons; nor does it ensure that the host state meets its own obligations under international human rights law to protect individuals residing within its jurisdiction from rights violations. However, a human rights response to transnational repression, in addition to one grounded in state sovereignty, brings into focus the experience of the targeted person, the human rights being violated, the need for specific actions to prevent similar human rights violations in the future, and the requirement of offering targets some kind of remedy.

Article 19 of the ICCPR provides that everyone “shall have the right to freedom of expression,” which includes the right to “seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print.” In undertaking acts of digital transnational repression, a state violates the right to freedom of expression of the targeted person. As the United Nations Human Rights Committee (U.N. HRC) explains in its General Comment No. 34, states cannot impose restrictions on the exercise of freedom of expression that put the right itself in jeopardy. In particular, it is strictly forbidden to restrict freedom of expression with the intent of “the muzzling of any advocacy of multiparty democracy, democratic tenets and human rights.” The repressive acts associated with digital transnational repression aim to do just that: to prevent individuals from engaging in the free expression of ideas that are critical of the perpetrating state. Many of the negative impacts of digital transnational repression lead to a silencing of targets or have a chilling effect: Persons who are targeted through this practice start to engage in self-censorship, isolate themselves socially, or even abandon the work that is critical of the perpetrating state and likely to attract negative attention.

Digital transnational repression also involves other human rights violations. One such violation is the violation of the right to privacy in instances where states hack the computers and mobile devices of targeted persons and engage in surveillance and the exfiltration of data. The right to privacy is protected under Article 17 of the ICCPR, which provides that “[n]o one shall be subjected to arbitrary or unlawful interference with his privacy.” Article 17 has been interpreted to mean that interference with the right to privacy must be “‘authorized by domestic law that is accessible and precise and that conforms to the requirement of the Covenant’, is in pursuit of a ‘legitimate aim’ and ‘meet[s] the tests of necessity and proportionality.’” While a state might argue that it is allowed to hack the phone of a human rights defender and exfiltrate their data by characterizing the target as a terrorist charged under domestic law, in many cases terrorism allegations are likely to be a convenient fiction used to justify the unlawful treatment of the targeted individual. The lack of accountability and the absence of public oversight mechanisms in states most associated with digital transnational repression call into question the legitimacy of such designations.

Further, as targeted persons refrain from engaging in peaceful assemblies online because of sustained digital threats, their right to peaceful assembly is also violated. The right to peaceful assembly is intended to “enables individuals to express themselves collectively and to participate in shaping their societies.” It includes peaceful assemblies that are organized online and in both public and private spaces. Restrictions on peaceful assembly must be in “conformity with the law and . . . necessary in a democratic society in the interests of national security or public safety, public order (ordre public), the protection of public health or morals or the protection of the rights and freedoms of others.” The U.N. HRC observes that, as peaceful assemblies increasingly take place online, digital surveillance of such assemblies can interfere with the right. The use of surveillance technologies can thus also “infringe on the right to privacy and other rights of participants and bystanders and have a chilling effect.”

The need to strengthen norms around the extraterritorial application of international human rights law

While digital transnational repression gives rise to a series of human rights violations, there are legal gaps that allow states to persist in this activity with impunity. States engaging in transnational repression may argue that such cross-border targeting using digital technologies is outside the scope of international human rights treaties like the ICCPR. For example, the U.S.—in maintaining “its long-standing position that the ICCPR only applies to individuals who are both within the territory of the State Party and within that State Party’s jurisdiction in line with Article 2(1) of the ICCPR —has enacted legislation to specifically allow extraterritorial surveillance and has engaged in surveillance programs that target non-American individuals located outside the country. While the U.S. government asserts that such surveillance furthers legitimate aims, it is perceived by human rights groups to be overbroad and to be a potential violation of the state’s human rights obligations.

Such narrow interpretations of jurisdiction under international human rights law are harmful as they facilitate an international environment in which states could legitimately argue that the digital targeting of dissidents and activists in exile is permitted under international human rights law and that there are no constraints on such behavior. With respect to the U.S., there remains an evident contradiction between the policies it has enacted to address transnational repression, including digital transnational repression, and its position that it can simultaneously engage in the extraterritorial surveillance of foreigners outside the U.S. without regard for international human rights law principles.

In addition to the U.S.’ contrary position on extraterritorial surveillance and the application of international human rights law, case law around extraterritoriality is confusing and needs to be distilled into a coherent and streamlined set of principles. International human rights treaty bodies generally agree that states owe human rights obligations to persons within their territory (including any territory under the effective control of the state, even if it is not formally a part of it) and to persons over whom the state has effective control (which has traditionally been applied to cases of, for example, states detaining an individual). It is unclear whether the hacking of an electronic device translates into some kind of effective control by the perpetrating state over the targeted person as it remains unclear how this concept applies in the digital sphere.

There has been some progress towards a more expansive interpretation of jurisdiction that reflects the transnational and international nature of human rights violations. For example, the U.N. HRC appears to have embraced what has been described by legal scholars as a “functional” approach to extraterritoriality and human rights obligations. Under this approach, states owe human rights obligations to individuals whose human rights they can impact (and not just to those individuals located within their territory or in cases where a state has effective control over a territory or a specific individual). Embracing this broader and more flexible approach to extraterritoriality should form a part of the U.S. response to transnational repression if it intends to ensure that this response is aligned with international human rights norms. At the same time, we acknowledge that, realistically speaking, it is unlikely that states will proactively adopt a more expansive understanding of their obligations under international human rights law when they perceive their security to be implicated.

The United States as a Host State: Responses to (Digital) Transnational Repression and the Obligation to Ensure Human Rights

When we construe digital transnational repression as a series of violations of international human rights law, we bring into focus the specific human rights obligations of host states that have ratified international human rights treaties like the ICCPR. The ICCPR sets out a useful framework for considering how host states should respond to transnational repression (including its digital form). While the perpetrating state (i.e., the country of origin) is unlikely to change its behavior, the host state is in a position to engage in specific efforts to prevent and mitigate the impacts of transnational repression within its territory. Under international human rights law, this constitutes a legal requirement for the host state—rather than a set of discretionary actions—and gives individuals an avenue to hold the host state accountable when it fails to adequately respond to international human rights law violations. In particular, states that have ratified the ICCPR are required “to respect and to ensure to all individuals within its territory and subject to its jurisdiction the rights” provided for in the ICCPR. Thus, host states cannot just sit back and allow transnational repression—which amounts to a series of human rights violations—to continue, nor can they limit their responses to a set of diplomatic or backdoor initiatives.

In its General Comments, the U.N. HRC has offered some abstract guidance to host states for ensuring that persons within their territory and jurisdiction enjoy full access to the rights outlined in the ICCPR. For example, with respect to the right to privacy, General Comment No. 16 provides that states should take “[e]ffective measures … to ensure that information concerning a person’s private life does not reach the hands of persons who are not authorized by law to receive, process and use it, and is never used for purposes incompatible with the Covenant.” In General Comment No. 34, the U.N. HRC notes that states “should put in place effective measures to protect against attacks aimed at silencing those exercising their right to freedom of expression.” The committee further underlines that “[j]ournalists are frequently subjected to such threats, intimidation and attacks because of their activities,” as are “persons who engage in the gathering and analysis of information on the human rights situation and who publish human rights-related reports.” Such attacks must be “vigorously investigated in a timely fashion, and the perpetrators prosecuted, and the victims … be in receipt of appropriate forms of redress.” In General Comment No. 37, the committee underscores that states must “facilitate the exercise of the right [of peaceful assembly] and to protect participants.”

The U.N. HRC or other human rights treaty bodies have yet to provide specific commentary on how host states must respond to transnational repression, although the General Comments provide some helpful general guidance. However, some states have already taken measures to address transnational repression—notably, the U.S. under the Biden administration. By reviewing U.S. efforts to combat transnational repression at the domestic and international levels, we can identify some initial, specific measures that host states should adopt to prevent this practice, which do not place an unreasonable or disproportionate burden on the host states.

While the U.S. has initially reacted to transnational repression as a violation of its sovereignty, over the past few years a concern for the human rights of diaspora and exiled communities has started to play a role in the government’s policy response. U.S. efforts to combat transnational repression under the Biden administration can be divided into three categories: legislative responses (i.e., drafting new bills to address transnational repression), institutional responses (i.e., tasking various federal agencies with addressing transnational repression and engaging in public communications regarding the nature, scope, and impact of transnational repression), and punitive responses (i.e., issuing indictments related to cases of transnational repression and deploying sanctions against persons who engage in this practice and target individuals located in the U.S.). We review these responses to transnational repression before examining how the U.S. government is tackling the digital component of transnational repression.

Among legislative measures, in 2021, the U.S. Congress passed the Transnational Repression Accountability and Prevention Act (“TRAP Act”) to help address the abuse of Interpol Red Notices and diffusions, which is a component of transnational repression. Red Notices are “requests sent to [Interpol] members that ‘seek the location of a wanted person and his/her detention, arrest, or restriction of movement for the purpose of extradition, surrender or similar lawful action.’” Diffusions are also “aimed at locating and securing the arrest of a wanted individual.” Host states that receive Red Notices or diffusions may act on these requests to detain an individual and facilitate their subsequent extradition back to the perpetrating state even if the criminal charges laid by that state are entirely baseless.

Two bills pertaining to transnational repression are also pending: One measure proposes to criminalize the practice (the Schiff bill), and another proposes specific policy responses to transnational repression (the Merkley bill). At the institutional level, the Federal Bureau of Investigation (FBI) has undertaken an awareness-raising campaign about the threat of transnational repression through various public-facing mechanisms and opened a tip line for individuals to report acts of transnational repression. The FBI is also attempting to classify and document acts of transnational repression within the U.S. in a more systematic manner. Finally, punitive measures have also been deployed. The U.S. Department of Justice (DOJ) has issued indictments against various individuals, characterizing their alleged acts as transnational repression.

Addressing digital transnational repression poses a more complex problem than tackling physical acts of transnational repression, in which the perpetrating state’s agents are sent into the U.S. or U.S. residents are contracted by foreign states to undertake transnational repression. Digital transnational repression is carried out at a distance, is generally hard to detect and attribute, and is easily adaptable to circumvent different defenses that the targeted person may put up. For example, where a phishing campaign to hack an individual’s email account fails, a state may instead deploy zero-click spyware to infect their phone.

To date, responses to transnational repression do include a specific concern about digital transnational repression. The Merkley bill, for example,considers that transnational repression is achieved through different methods, including “digital threats, such as cyberattacks, targeted surveillance and spyware, online harassment, and intimidation.” The bill further notes that the “spread of digital technologies provides new tools for censoring, surveilling, and targeting individuals deemed to be threats across international borders, especially dissidents pushed abroad who themselves rely on communications technology to amplify their messages, which can often lead to physical attacks and coercion by proxy.” Among the bill’s proposed actions to develop and refine interagency responses to transnational repression is the creation of a strategy that includes “safeguards to prevent the access, use, and storage of personal digital data by governments and technology companies for the purposes of transnational repression,” as well as the provision of emergency assistance to civil society organizations. This emergency assistance includes “digital security installation and support; support and training beyond basic digital hygiene training, including emergency response to cyberattacks and enhanced capacity to deter surveillance and monitoring by malicious actors.”

Additional legislative and punitive measures have also been taken against spyware manufacturers. Spyware is used by governments not only to target and surveil perceived domestic opponents but also to reach across borders and engage in transnational surveillance of dissident and exile communities. Addressing the proliferation of spyware is a component of the U.S. response to digital transnational repression, with a focus on curbing the mercenary spyware industry. Such efforts include an executive order by former President Biden prohibiting the use of spyware when it poses counterintelligence or security risks to the U.S. or when the spyware has been used by a foreign government or person to target dissidents or human rights defenders. The U.S. government has also added spyware companies to the U.S. Commerce Department’s Bureau of Industry and Security Entity List, implemented visa restrictions, and revised its export controls, among other initiatives. The U.S. Department of State’s Bureau of Democracy, Human Rights and Labor (DRL) also made funding available to help respond to transnational digital attacks.

The U.S. has also implemented institutional changes to better respond to and mitigate digital transnational repression. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with some foreign states, announced the creation of a Strategic Dialogue on Cybersecurity of Civil Society Under Threat of Transnational Repression to share information about best practices and existing responses to transnational repression, the threat landscape, and opportunities for protecting the cybersecurity of civil society actors. The CISA has also implemented a High-Risk Community Protection Initiative to respond to transnational repression and a Joint Cyber Defense Collaborative intended to bring together technology companies, civil society groups, and the government to “strengthen the cybersecurity of civil society organizations in the U.S. under threat of transnational repression.” These efforts are part of a broader set of initiatives that the Biden-Harris administration announced at the 2023 Summit for Democracy under the umbrella of the Presidential Initiative for Democratic Renewal, which includes a focus on “advancing technology for democracy” as one of its primary pillars.

In May 2024, the CISA, along with other internationally based cybersecurity agencies, developed a guide for civil society groups to mitigate the risks of digital transnational repression perpetrated by states. The guide was designed for civil society organizations, civil society members, and software manufacturers. It recommends that civil society organizations offer cybersecurity training and implement incident recovery plans. For individual members of civil society, the agencies suggest using strong passwords, verifying contacts, and enabling multi-factor authentication (MFA), to name a few guidelines. They also encourage software manufacturers to enable MFA across products and create alert systems so customers are aware of malicious cyber behavior.

While this section has focused specifically on the responses of host states to digital transnational repression, it is also worth emphasizing that civil society organizations play a critical role in this response—beyond simply offering the types of cybersecurity training the CISA suggests. For example, civil society organizations can liaise with different diaspora and exiled communities in a way that law enforcement or intelligence agencies are unlikely to be able to do due to pre-existing distrust. Host states are in a position to fund and facilitate this engagement. With government support, civil society organizations can document instances of transnational repression and escalate them to the attention of relevant government institutions, as well as provide digital security training and other forms of support to impacted communities.

Conclusion

This essay has examined the impacts of, and responses to, digital transnational repression, with a specific focus on the chilling effects it has on the targets of such practices. Based on our interviews with numerous individuals who have experienced digital transnational repression, we can see that such practices often lead to self-censorship and withdrawal from advocacy and produce other pernicious effects that erode human rights. We have also highlighted the international human rights law framework and the response of the U.S. to digital transnational repression as a host state where numerous exiled and diaspora communities reside and are targeted.

From this review, we can observe that the trends are mixed. The U.S. has taken the lead in responding to digital transnational repression when compared to other Western host states, and it is possible other states will follow suit. However, the permissive environment for digital transnational repression is only growing. Techniques of digital transnational repression are becoming increasingly sophisticated. Service providers that enable perpetrating states to engage in acts of digital transnational repression are becoming more plentiful, and the market is exploding. Artificial intelligence will likely make the situation worse by, for example, facilitating effective online disinformation campaigns that already-limited content moderation protocols are unable to identify. Furthermore, there is a long-standing reluctance among states to extend human rights protection to noncitizens located abroad and a competitive dynamic among states to ensure access to surveillance technologies, which are likely to make things worse before they get better.

Despite all these challenges, one component of an effective legal and policy response that can prevent human rights violations resulting from digital transnational repression will be the actions of host states that reflect and put into practice their human rights obligations. When we conceptualize transnational repression as a set of transnational human rights violations, as we have done in this essay, we can urge states to focus on their own obligations under international human rights treaties. This approach provides a broader legal framework under which host states must respond to digital transnational repression (or other forms of transnational repression) as part of their duty to guarantee the rights contained in the ICCPR. A robust human rights response is critical in the face of weak norms around state sovereignty—particularly cross-border digital intrusions—and the reality that state sovereignty aims to protect states’ own interests, which may not always reflect those of individuals whose rights are violated. In shifting the focus from the sovereignty aspect of transnational repression to a human rights response, we can hopefully see a more victim-centered approach to transnational repression emerge that includes legislative, institutional, and punitive responses.

 

© 2025, Siena Anstis and Ronald J. Deibert

Cite as: Siena Anstis and Ronald J. Deibert, Silenced by Surveillance: The Impacts of Digital Transnational Repression on Journalists, Human Rights Defenders, and Dissidents in Exile, 25-05 Knight First Amend. Inst. (Feb. 18, 2025), https://knightcolumbia.org/content/silenced-by-surveillance-the-impacts-of-digital-transnational-repression[https://perma.cc/23RN-UX6V].