TNR Watch: Cyberattacks as a Tactic of Digital Transnational Repression

Cat-and-mouse game: Exiled journalists and media outlets are exposed to malicious web activity at a rate four times higher than media organizations overall. This is one of the findings of a report recently released by Cloudflare based on data collected as part of the company’s Project Galileo, which offers free services to at-risk public interest groups. The report finds that around 5 percent of the 41 billion requests directed to exile journalism websites between February 2025 and January 2026 were harmful and sought to disrupt the outlets’ connections to their readers. Tactics employed to paralyze these platforms included distributed-denial-of-service (DDoS) attacks, website-vulnerability attacks, and phishing attempts; the sites were also made inaccessible via internet shutdowns.

While Cloudflare did not attribute these attacks on exiled media to governments or state-aligned actors, they mirror well-documented patterns of digital transnational repression. In December 2025, the Cuban outlet elToque, which is run by reporters in exile, contended with a significant DDoS attack and a website block in Cuba. The site developer connected the incident to elToque’s measurement of the informal currency market in the country, which exposed cracks in the government’s effort to strictly control the economy. On the anniversary of its designation by the Russian government as an “undesirable organization” in July 2025, the Amsterdam-based Moscow Times reported a similar DDoS attack. Cloudflare also helped the independent China Digital Times block an uptick in unauthorized requests to the outlet’s site in November 2025, which could have revealed the identities of staff members who prefer to remain anonymous to reduce threats to themselves and their families.

A Persistent Problem: Cloudflare’s findings are consistent with Freedom House’s research on the digital and physical intimidation of exiled journalists. In a 2023 report, Freedom House traced incidents of physical transnational repression against journalists to at least 26 governments. Digital threats regularly force small newsrooms to dedicate limited resources to constantly reassessing safety measures and determining ways to protect themselves from cyberthreats. Fears of surveillance fray bonds between journalists and their sources back home. Abusive messages, many that direct gendered abuse at women journalists, exact a toll on the mental health of prominent voices.

Fighting Back: Support for exiled media is essential. Cloudflare’s Project Galileo, Google’s Project Shield, the Common Good Cyber Fund, and similar initiatives provide crucial cybersecurity services and training to vulnerable organizations and outlets. But bad actors are constantly developing new tactics and employing emergent technologies like AI to target activists and journalists. This means that systematic, government-funded support and training is needed to combat the threat posed globally by digital transnational repression.