The Effects of Digital Transnational Repression and the Responsibility of Host States

In March, days after the Russian invasion of Ukraine, the Russian government released a list of 313 Canadian politicians and civil society activists banned from Russia. Marcus Kolga, a Canadian journalist and policy analyst in Toronto with Eastern European roots and a special interest in Russian and Eastern European affairs, was not surprised when he found his name on the list. This was not the first time his activism led to retaliation by the Kremlin.

Kolga has long observed that people like him—open critics of Russia—are targeted in Canada through various means of online and offline transnational repression. Whenever he speaks about Russia’s human rights abuses, he quickly becomes the subject of online trolling, disinformation and smear campaigns. He receives online death threats aiming to discredit and silence him. Some of the most popular Russian media outlets are part of these campaigns. He also receives offline death threats from individuals whom he describes as “Kremlin nationalists” in Canada. 

Kolga is not the Kremlin’s sole target. As detailed by Freedom House, the Russian government has repeatedly sought to use digital tools—among other forms of cross-border repression—to target and intimidate Russia’s diasporas, as well as other critics of the Russian government who reside outside its borders. Many of those targeted have been speaking out against Russia’s recent invasion of Ukraine or the country’s poor human rights record. This trend of states using digital tools to target activists and dissidents outside their borders is called digital transnational repression. It is particularly disturbing because of the role that diaspora and exile communities play in transnational advocacy efforts in support of Ukrainians, as well as in fighting against human rights abuses by Russian authorities. 

The extension of digital authoritarianism to transnational spaces is not just a Russian phenomenon. Numerous other countries—including China, Saudi Arabia, Iran and Rwanda—undertake digital authoritarianism. (Liberal democracies are not immune either; the United States has long been criticized for the extraterritorial surveillance of targets in violation of international human rights law). This trend is perhaps unsurprising in a world where managing and regulating digital spaces is fraught with challenges and authoritarianism, including its digital form, is on the rise. In the past decade, authoritarian regimes have greatly refined how the internet and digital communications can be harnessed for domestic and transnational repression. Dissidents and activists worldwide pay a heavy price. While seeking refuge elsewhere may have once meant relative safety from authoritarian repression, the current reality is that many continue their activism under intense surveillance by their home states and face persistent online harassment and abuse. 

Digital Transnational Repression: Extending Authoritarian Practices Into Transnational Spaces

Transnational repression describes instances in which authoritarian regimes expand their oppressive policies and practices beyond their borders and into the territory of other countries to silence, harass, or threaten dissidents and activists through various means. Transnational repression undermines the human rights of exiled dissidents and activists, and it renders them susceptible to authoritarian practices exerted by their home states. While this is not a new phenomenon, digital technology and the spread of internet connectivity, in addition to other factors, have drawn greater attention to digital forms of transnational repression. 

Digital transnational repression arises when authoritarian regimes employ digital tools to silence and coerce activists and dissidents living abroad. This repression is undertaken through different tactics: the hacking of mobile devices, computers, social media and email accounts; harassment and abuse on social media platforms; as well as the use of online trolls and bots to engage in relentless digital attacks. Such activity may have several goals, such as uncovering and gaining access to an activist’s network, unearthing information to incriminate or track and locate activists to detain or kidnap them, or chilling speech. The ability to undertake this activity at scale and obfuscate its origin (for example, by employing private actors) makes digital transnational repression particularly pernicious as a tool of transnational repression.

Numerous technologies are available for states to undertake digital transnational repression. There is also a growing marketplace for digital surveillance technologies and mercenary spyware firms, such as NSO Group, Cytrox and Candiru. These companies operate with relative freedom in a booming, underregulated international marketplace. Their tools enable authoritarian regimes to expand digital repression against activists and dissidents overseas. The technology they sell can provide authorities with a complete view into an activist’s communications by granting access to a targeted device, including its camera, microphone, and email and messages contained in encrypted chat applications, and it can facilitate the planting of incriminating digital material. Further, the proliferation of surveillance tools means that states do not necessarily need access to expensive tools like Pegasus spyware. Instead, they can engage in more basic forms of hacking, such as deploying carefully crafted phishing messages to gain unauthorized access to a target’s email or social media accounts. 

Increasingly, authoritarian states make extensive use of social media to engage in coordinated harassment and abuse campaigns. Notable examples include the weaponization of social media to target dissidents and activists by Saudi Arabia’s “electronic army” and China’s so-called 50 Cent Party, a group of Chinese-government-backed trolls, among others. Online harassment can occur in a variety of forms, including threats, hate speech, misinformation, attacks on credibility and the publication of the targeted person’s personal information (known as doxxing). Targets find themselves attacked by groups of trolls on social media or experience mass reporting on their social media posts resulting in takedowns or account suspensions. While social media community guidelines likely prohibit such behavior, content moderation practices have not been effective at preventing these incidents from occurring and may not be attuned to the relevant social and political environments. For example, automated content moderation tools—such as the use of algorithms—may lead to the takedown or blocking of activists’ user accounts or content. In other cases, harmful content directed at activists—such as hate speech, disinformation, or smear campaigns—is not removed. Further, social media companies may be deferential when approached by state actors to remove user accounts or to hand over users’ data, and they are not always transparent in these practices. Moreover, default security settings on social media accounts are not tailored to high-risk users. 

Distributed denial-of-service (DDoS) attacks—which flood a target with traffic until it stops functioning—are also part of the arsenal of tools used by authoritarian regimes against activists and dissidents abroad. DDoS attacks were one of the first cyberattack methods and have been used by states for various malicious purposes such as targeting other countries’ critical infrastructure and banks. Most recently, prior to the Russian invasion of Ukraine, Russia conducted a number of DDoS attacks on the government of Ukraine’s websites. The low cost of a DDoS attack and the difficulty in distinguishing such an attack from normal traffic make it a common method for authoritarian states to target civil society and independent media operating within the country, as well as exiled dissidents’ organizations, personal blogs or businesses. DDoS attacks may be co-timed to prevent or hinder access to targeted websites during specific events (such as the launch of a new publication). DDoS attacks have multiple effects, such as impairing access to information and the ability to engage in free speech, as well as causing financial and professional harm. This is what happened to Amir (whose name was changed to protect his privacy), a Syrian Canadian business owner of a web-hosting business in Ontario. His company, which hosted the website of a Syrian pro-democracy media organization, suffered extensive DDoS attacks by Russia that affected the company’s entire data center and hurt his business. 

The Effects of Digital Transnational Repression

Self-Censorship, Isolation, and Other Social and Psychological Consequences 

In a recent study for the Citizen Lab, we interviewed 18 self-reported activists who migrated or fled to Canada from various home regions and states including China, Hong Kong, Tibet, East Turkestan, Iran, Balochistan (in Pakistan), Syria, Saudi Arabia, Yemen and Rwanda. These interviews shed light on tactics of online and offline repression and also uncovered the social and psychological impacts of this targeting, described by one of the participants as “emotional and psychological war.” Individuals subjected to digital transnational repression experienced paranoia and anxiety, became more cautious and self-isolated, experienced harm to their professional and academic lives, and limited their communication with friends and relatives in Canada and their country of origin, among other effects. Participants also drew parallels between their digital and physical security, emphasizing the scarcity of resources available to them to combat these dangers. 

For example, Chinese human rights activist Sheng Xue—who lives in Canada—has faced an onslaught of offline and online threats. Her devices have been compromised, she has been targeted with socially engineered phishing emails, and she has been subjected to unauthorized attempts to access her email and social media accounts. Some of these digital threats were also tied to her gender, with chilling consequences for her public and private life. For example, while preparing for an international conference in Toronto, she discovered that conference attendees had all received fabricated nude photos of her. She was doxxed and her personal information was posted in online ads soliciting sex services. As a result, she lost her sense of safety in Canada. In addition, her friends—fearful of being caught up in a cloud of repression—have stepped away, leaving her isolated both online and offline. While Xue thought she would be free to engage in activism abroad without fear or restraint, similar patterns of repression have persisted on Canadian soil, far away from China. 

Other studies have similarly observed that digital transnational repression leads to numerous, serious effects for those targeted. For example, Dana Moss’s research into Syrian activism abroad concludes that digital transnational repression can contribute to the erosion of these activists’ transnational ties and deter the use of online communication tools. Marcus Michaelsen’s synopsis of digital tools used in transnational repression describes similar effects, including that digital transnational repression leads to self-restraint in online communication and interactions, self-censorship, and fear for relatives and contacts in the home state, that it disrupts daily activist and outreach efforts, and that it causes burnout and significant stress. In another study on the Iranian diaspora, Michaelsen observes how online communication has opened “multiple points of exposure” that can be exploited by state actors, creating additional costs and pressures for Iranian activists in the diaspora and preventing a complete “exit” from the dangers associated with activism work in the home state.

The Unique Effect of Digital Transnational Repression on Women 

Exiled women dissidents are subjected to unique attacks and effects. In addition to what their male peers experience, online harassment targeting women often has a gender-based component. Such harassment has various faces, like cyber-stalking, nonconsensual sharing or distribution of intimate photos and videos, harassment, doxxing, blackmail, and rape and death threats. Sexual or gender-based violence is among the tactics of repression used by authoritarian regimes against female dissidents in their home countries. Digital technology allows regimes to digitize the sexual and gender-based violence that is already being used to repress and intimidate women activists and dissidents within national borders. It also allows regimes to expand these practices to the international stage where female activists would normally be protected from such repression. 

The International Human Rights Harms of Digital Transnational Repression

The effects of digital transnational repression translate into various forms of human rights violations. Most immediately, government hacking and the use of social media to engage in campaigns of surveillance and sustained harassment and abuse against activists and dissidents undermine the rights to privacy and freedom of expressions. Such activity also impairs the right to freedom of association, which extends to online spaces. When government authorities target human rights defenders and journalists, it is highly unlikely that the authorities’ actions meet the requirements under international human rights law of legality, necessity and proportionality. Further, digital transnational repression may facilitate or contribute to the commission of other human rights violations, such as facilitating the violation of the right to liberty and security of the person through arbitrary arrest, detention, torture, and enforced disappearances by facilitating location tracking or enabling the planting of incriminating data on a targeted device. For example, various friends and family members of murdered Saudi journalist Jamal Khashoggi were reportedly targeted by NSO Group’s Pegasus spyware both before and after his death.

Responding to Digital Transnational Repression

International human rights law requires that states take positive steps to ensure the protection of the rights of individuals within their jurisdictions, including non-nationals. This extends to situations where surveillance originates outside the territorial borders of the host state, such as in the case of digital transnational repression. Under international human rights law, states that have committed to such frameworks cannot sit idly by while human rights violations—including those of a digital nature—are being committed on their territory. While they may seek to remain dispassionate in the face of “traditional” international cyber-espionage activities, the cross-border surveillance and online harassment and abuse of activists and dissidents in exile by other states should not be approached with disinterest. Rather, policymakers of host states must take a principled stance and comply with their international human rights law obligations by taking concrete steps to prevent digital transnational repression. 

In Canada, participants in the Citizen Lab’s recent study concluded that there was little acknowledgment or support for individuals in Canada who were concerned about digital transnational repression, as well as a lack of response from the Canadian government. Participants sought assistance from Canadian law enforcement agencies, the Canadian Security Intelligence Agency and the government, but responses were often unhelpful. Dissatisfied with the lack of response from Canada, victims of digital transnational repression were left alone and feeling more vulnerable to further attacks. The Canadian government’s first steps should include adopting policies specifically aimed at addressing transnational repression, including its digital forms; training law enforcement and intelligence officers in understanding the human rights dimensions of this activity and its effects on targeted individuals; and creating a mechanism to report and track this phenomenon within Canada. In adopting a clear position on the application of international law in cyberspace, Canada should make it clear that digital transnational repression is an activity that will not be tolerated and should be considered illegal under international law.

Other countries, such as the United States and Sweden, have begun to take concrete steps to push back against digital transnational repression. For example, Sweden criminalized “refugee espionage” and prosecuted several individuals under this provision, which specifically targets the type of behavior that is captured by transnational repression, as well as its digital manifestations. The United States has recently been at the forefront of pushing for greater reforms to address transnational repression, including its digital dimensions. For example, in 2021, the U.S. Department of Commerce enacted export restrictions to certain surveillance companies placed on its Entity List, including NSO Group and Candiru, and has pursued criminal prosecutions against several actors that engage in or facilitate transnational repression from the United States. The FBI has launched a specific resource site for transnational repression. Such efforts are not sufficient to prevent the targeting of all activists and dissidents in exile, but they begin to send the right signal that host states are aware of the issue and increasingly invested in deterring such harms. 

Conclusion

The expansion of digital transnational repression has a chilling effect on the rights of exiled and diaspora activists and dissidents who find themselves repressed by authoritarian states, even in places where they assumed they had a relative degree of safety and freedom. The silencing and intimidation of dissidents abroad allows authoritarian regimes’ narrative and propaganda to prevail both domestically and internationally, giving authoritarianism an upper hand on the global stage. Democracies have a special role to play in responding to digital transnational repression and a particular interest in doing so to stop the surge of global authoritarianism. For activists and dissidents who have been forced to flee their home states, working within the borders of their host states is supposed to provide them with the security and safety necessary to engage in activism. Host states have the responsibility and obligation to protect those living within their jurisdictions and to push back against the draconian practices of dictatorships that are now extending far beyond their borders.