The Digital Transnational Repression Toolkit, and Its Silencing Effects

In summer 2018, the smartphone of a man named Omar Abdulaziz was infected with a powerful spyware. The Pegasus surveillance tool, produced by the Israeli NSO Group, gave the attackers access to Abdulaziz’s personal files, emails, and messages; they were able to monitor his communications and movements. A Saudi political activist living in Canada, Omar Abdulaziz was a close associate of Jamal Khashoggi, an outspoken journalist who had left Saudi Arabia for the United States in 2017 after falling out of favor with the authorities. Both men frequently discussed the human rights situation in their home country, and together they started developing a project for social media campaigns against Saudi government propaganda. A few months after the hacking of Abdulaziz’s phone, Khashoggi was murdered in the Saudi consulate in Istanbul, in an operation coordinated by high-level officials of the government in Riyadh, most likely even Crown Prince Mohammed Bin Salman himself.1

Oppressive rulers have time and again resorted to murder to get rid of exiled political opponents. But, in the case of Khashoggi, the crime was prepared with the help of twenty-first-century surveillance technology, which NSO Group may have sold to more than 45 countries around the world.2 An investigation by The Citizen Lab, a research institute at the University of Toronto, established that the spyware on Abdulaziz’s smartphone was indeed operated from Saudi Arabia.3 It had also been used to infiltrate the devices of other Saudi human rights defenders based abroad4 as well as potential foreign critics, such as the New York Times Middle East correspondent Ben Hubbard.5 Digital technologies have given authoritarian governments new tools to control, silence, and punish dissent across borders. They enable regimes to monitor and respond to the activities of political exiles and diaspora communities with greater scope and speed, reducing the costs of extraterritorial political control. Digital technologies have thus become essential components in the toolkit of transnational repression.

• 1United Nations Office of the High Commissioner for Human Rights (OHCHR), “Khashoggi killing: UN human rights expert says Saudi Arabia is responsible for ‘premeditated execution,’” June 19, 2019, https://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=24713.
• 2Bill Marczak, John Scott-Railton, Sarah McKune, Bahr Abdul Razzak, and Ron Deibert, “Hide and Seek: Tracking NSO Group’s Pegasus Spyware to Operations in 45 Countries,” The Citizen Lab, September 18, 2018, https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus….
• 3Bill Marczak, John Scott-Railton, Adam Senft, Bahr Abdul Razzak, and Ron Deibert, “The Kingdom Came to Canada: How Saudi-Linked Digital Espionage Reached Canadian Soil,” The Citizen Lab, October 1, 2018, https://citizenlab.ca/2018/10/the-kingdom-came-to-canada-how-saudi-link….
• 4Amnesty International, “Amnesty International among Targets of NSO-powered Campaign,” August 1, 2018, https://www.amnesty.org/en/latest/research/2018/08/amnesty-internationa….
• 5Ben Hubbard, “Someone Tried to Hack My Phone. Technology Researchers Accused Saudi Arabia,” The New York Times, January 28, 2020, https://www.nytimes.com/2020/01/28/reader-center/phone-hacking-saudi-ar….

Civil society has certainly benefited from digital technologies to inform, collaborate, and mobilize. For diaspora activists engaging for political change in their country of origin, digital technologies are key to communicate with contacts at home, maintain professional relations, and advocate against rights violations. Yet, as digital security researcher John Scott-Railton puts it, for civil society, “the capacity to connect has vastly outpaced the ability to secure.”1 Activists’ reliance on digital platforms and social media creates multiple points of exposure that authoritarian regimes exploit to prepare, deliver, and intensify threats across borders. Digital attacks via malware, online harassment, and disinformation campaigns are often intertwined with more traditional methods of transnational repression, such as pressure on families inside the country, smear campaigns in state media, or, as the Khashoggi case demonstrates, even assassinations.

This piece describes widespread methods of digital transnational repression, as well as their constraining effects on diaspora activism. It mainly draws on a project investigating digital threats against exiled activists from Iran, Syria, and Egypt, but it is also informed by broader research into the practices and trends of extraterritorial authoritarian rule.2 The following outlines the ways in which digital surveillance, hacking attacks, and online harassment affect the freedom, autonomy, and privacy of activists by encouraging self-censorship and by creeping into their ties and networks. The conclusion gives recommendations on how to curtail the impact of digitally enabled transnational repression and strengthen the resilience of diaspora activists.

• 1John Scott-Railton, “Security for the High-Risk User: Separate and Unequal,” The Citizen Lab, Spring 2016, https://www.johnscottrailton.com/security-for-the-high-risk-user.
• 2As a Senior Information Controls Fellow of the Open Technology Fund, I interviewed more than 50 political activists and journalists from Egypt, Syria, and Iran, residing in 12 different host countries, for a research project on digital threats and transnational repression. The final report is Marcus Michaelsen, The Silencing Effect of Digital Transnational Repression, Open Technology Fund, February 26, 2020, https://www.opentech.fund/news/silencing-effect-digital-transnational-r…. I also rely on previous research into digital threats against Iranian exiles: Marcus Michaelsen, “Exit and voice in a digital age: Iran’s exiled activists and the authoritarian state,” Globalizations 15, no. 2 (2018), https://www.tandfonline.com/doi/full/10.1080/14747731.2016.1263078. All interviews are cited anonymously.

From covert monitoring to targeted threats

Digital communication technologies expose diaspora activists to monitoring and surveillance from regime authorities. As avid social media users, activists leave online traces about their activities travel, conference participations, family members, friends, and collaborators. With professional and personal identities converging on social media profiles, security agents find ample opportunity to gather so-called open-source intelligence: publicly available information that can be used to manipulate and pressure targeted persons.1 Activists’ contacts with colleagues and relatives inside the home country create an additional opportunity for intercepting confidential communications as messages travel, at least partly, through infrastructure under regime control. Intelligence agencies also monitor the programs of international and exiled media to track the work of journalists and activists’ media appearances. Human rights defenders from Syria and Egypt, for instance, understood that their participation in the Arabic-language programs of foreign media stations had put them on the radar of security agents after their parents and fellow activists at home were interrogated.2

Civil society activists have become increasingly aware of their digital security and rely on encryption, anonymous browsing, and other protections. In response, however, state actors resort to more aggressive measures of targeted surveillance.3 By penetrating computers, mobile devices, email, and social media accounts, they aim to gain access to confidential communications and contacts. Attacks often involve some form of social engineering, with perpetrators working to trick targets into opening a malicious link or attachment by impersonating a friend or an organization associated with their field of expertise.4 Such phishing attempts have been delivered via invitations to seminars, files on human rights violations, and interview requests, not only through email but also in messages on Facebook, WhatsApp, and other channels.5 Once successfully executed, these operations provide remote access to a target’s device or reveal sensitive passwords.6

• 1“Shrinking Civil Space: A Digital Perspective,” Tactical Tech, https://ourdataourselves.tacticaltech.org/posts/shrinking-civil-space-a….
• 2Author interviews, October–November 2018.
• 3Amnesty International, “When Best Practice Isn’t Good Enough: Large Campaigns of Phishing Attacks in Middle East and North Africa Target Privacy-Conscious Users,” December 19, 2018, https://www.amnesty.org/en/latest/research/2018/12/when-best-practice-i….
• 4William R. Marczak and Vern Paxson, “Social Engineering Attacks on Government Opponents: Target Perspectives,” Proceedings on Privacy Enhancing Technologies 2, 2017, https://petsymposium.org/2017/papers/issue2/paper51-2017-2-source.pdf.
• 5Nex, “Operation Kingphish: Uncovering a Campaign of Cyber Attacks against Civil Society in Qatar and Nepal,” Medium, February 14, 2017, https://medium.com/amnesty-insights/operation-kingphish-uncovering-a-ca….
• 6John Scott-Railton and Katie Kleemola, “London Calling: Two-Factor Authentication Phishing from Iran,” The Citizen Lab, August 27, 2015, https://citizenlab.ca/2015/08/iran_two_factor_phishing/.

A number of repressive governments have engaged in large-scale phishing campaigns against civil society, both inside and outside their territory.1 Not all governments can afford or have access to the advanced commercial surveillance technology that a growing global market offers. Instead, they rely on techniques of cybercrime and open-source malware. But a lack of sophisticated tools and expertise is compensated for by assiduous information gathering and target manipulation—tasks that the intelligence organizations of authoritarian regimes are well versed in. Attacks build on the ties among activists to unravel entire groups and networks.2 In order to encircle high-profile targets, regime agents try to infiltrate the accounts of lesser-known and inexperienced users in activist networks—or even family members. A prominent Iranian women’s rights campaigner recalled how she was contacted in London through the Facebook profile of her niece from Iran, which had apparently been hacked by security agents, in order to reveal the access credentials for her own social media accounts. Security agents also use the online identities of individuals arrested inside the country to swiftly approach their international contacts before the arrest becomes public.3

Other than surveillance, authoritarian regimes use online harassment, disinformation, and smear campaigns to pressure and silence outspoken dissidents abroad. As much as social media help diaspora activists to circulate alternative information and opinion, these platforms can also turn into a toxic environment for abuse and threats. In campaigns that aim to undermine their credibility and taint their reputation, journalists and human rights defenders are portrayed as liars, accused of working for foreign powers, or attacked on moral grounds.4 These campaigns also exert psychological pressure, intimidating with threats of physical violence, assassination, and arrest upon return to the country.5 Female journalists and activists are particularly targeted with degrading, misogynistic, and sexually violent insults.6 Threats are also issued against in-country family members. An Iranian journalist based in Washington, DC, reported that, in an online comment under one of her articles, she was warned that her uncle in Tehran might have an accident, even mentioning his home address.

Some of these attacks may come organically from regime supporters, but others are clearly government coordinated. Russia, China, Turkey, and many others have organized groups of trolls to be unleashed against critics in concerted campaigns.7 These “electronic flies,” as pro-regime social media accounts were dubbed by Saudi-Arabian activists, diffuse propaganda and even take over the identities of government opponents to disseminate disinformation under their name.8 Moreover, regimes abuse the features of social media to drown out topics and manipulate online discussions. Automated bots and fake accounts amplify Twitter hashtags promoting regime positions or hijack those of the opposition.9

In their efforts to shut down online criticism and alternative information, regimes not only take aim at individuals in the diaspora but also at the websites of media and civil society organizations based abroad. Although these publications are often already blocked for audiences in the home country of activists, they also come under more aggressive attacks. Regime-affiliated hackers, such as the self-proclaimed Syrian Electronic Army10 or Iranian threat actors,11 have disrupted the services of media and opposition websites with defacements and Distributed Denial of Service (DDoS) campaigns. Facebook profiles of civil society organizations get blocked after being flagged in massive false reports of their violating the rules of the platform. Members of an Egyptian human rights campaign based in Turkey mentioned that their Facebook event for European-wide protests against President Sisi was taken down after government supporters flocked together to report the page as sexual harassment.

Activists point out that all these attempts to disable the online expression of diaspora and exiled communities often increase in times of political tension, protests, or elections.

• 1The Citizen Lab, “Targeted Threats,” https://citizenlab.ca/category/research/targeted-threats/.
• 2Azerbaijan Internet Watch, “Mass Phishing Attack against Azerbaijan Civil Society,” January 14, 2020, https://www.az-netwatch.org/news/another-phishing-attempt/.
• 3Mahsa Alimardani, “The Arrest of Arash Zad, Iran’s Start-Up Kid,” Global Voices Advox, September 23, 2015, https://advox.globalvoices.org/2015/09/23/the-arrest-of-arash-zad-irans….
• 4Reporters Without Borders, “Online Harassment of Journalists: Attack of the Trolls,” July 25, 2018, https://rsf.org/sites/default/files/rsf_report_on_online_harassment.pdf.
• 5Naheed Mustafa, “Life in the digital shadow of the Syrian war,” OpenCanada, October 18, 2016, https://www.opencanada.org/features/life-digital-shadow-syrian-war/.
• 6The OSCE Representative on Freedom of the Media, “Interview with Arzu Geybullayeva,” video, February 23, 2018, https://www.youtube.com/watch?v=hqFICXiSAt8.
• 7Samantha Bradshaw and Philip N. Howard, “Troops, Trolls and Troublemakers: A Global Inventory of Organized Social Media Manipulation,” Oxford Internet Institute, 2017, http://blogs.oii.ox.ac.uk/politicalbots/wp-content/uploads/sites/89/201….
• 8Katie Benner, Mark Mazzetti, Ben Hubbard, and Mike Isaac, “Saudis’ Image Makers: A Troll Army and a Twitter Insider,” The New York Times, October 20, 2018, https://www.nytimes.com/2018/10/20/us/politics/saudi-image-campaign-twi….
• 9Alexei Abrahams, “Regional Authoritarians Target the Twittersphere,” MERIP, Fall/Winter 2019, https://merip.org/2019/12/regional-authoritarians-target-the-twittersph….
• 10Anwar Abas and Abdulrahman al-Masri, “The new face of the Syrian Electronic Army,” OpenCanada, May 17, 2018, https://www.opencanada.org/features/new-face-syrian-electronic-army/.
• 11Collin Anderson and Karim Sadjadpour, “Iran’s Cyber Threat: Espionage, Sabotage, and Revenge,” Carnegie Endowment for International Peace, 2018, https://carnegieendowment.org/files/Iran_Cyber_Final_Full_v2.pdf.

The silencing effects of digital transnational repression

By targeting dissidents and critics abroad, authoritarian regimes aim to extend the influence of their security apparatus across borders and impose additional costs on the activities of transnational civil society. With their arsenal of digital threats, regime agents can pressure activists into self-restraint, undermine their ties to the home country, and put them under extreme tension and stress.

The knowledge or assumption of ongoing regime surveillance pushes many activists towards self-censorship. The uncertainty about the capabilities of monitoring authorities and the scope of their activities clearly has a chilling effect. Egyptian human rights defenders who organized a protest during one of President Sisi’s visits to Germany explained that some group members participated only in disguise, wearing sunglasses, hats, or even a wig, for fear of being photographed by security agents or pictures of the event circulating online. Other activists abstain from media appearances or carefully weigh their statements when participating in public events so as not to catch the attention of regime authorities.

Fear for relatives and colleagues forces many exiles to carefully manage their ties to the home country. In case their communications are being monitored, some activists circumnavigate critical topics in their conversations; others deliberately refrain from collaborating with in-country contacts. In any case, they forgo a key resource: the ability to gather authentic information from the ground to leverage against the regime in international media and advocacy organizations. An Iranian journalist working for a diaspora news website explained that he had given up on many connections that would have helped him to stay in touch with the country. “I am not only losing friends but also access to information sources,” he said. “The quality of my work suffers.”1

The threat of targeted surveillance and other intrusions puts activists under pressure to effectively protect their contacts and communications. Not only do they have to stay up to date with the rapidly evolving methods of attack and deception, but they also make daily security decisions knowing they are up against resourceful state actors. The complexity of today’s digital tools and platforms further complicates any understanding of the technical underpinnings of the threats they might be facing. Activists often feel uncertain in choosing the right tools and layers of protection. A Syrian digital security trainer based in Germany pointed out that this constant tension could lead to a “security paralysis”: “If you think about all the possibilities of getting hacked, then it can result in this attitude: OK, I will get hacked anyway.”2

The risk of mental stress and burnout is even higher for activists targeted by online harassment and hate speech. A Syrian journalist and trainer working to support female journalists explained that colleagues who had gone through a wave of trolling and threats online felt physically affected and were “thinking twice” before voicing their opinion again. As a result, the number of outspoken women in Syrian opposition media and civil society networks had decreased.3

Reaching across borders with the digital tools of transnational repression, authoritarian regimes are able to intervene in activists’ everyday routines and constrain some of the dynamics, impacts, and outreach of diaspora activism. Digital threats are often carried out with little chance to identify perpetrators and hold them to account. Moreover, regimes can escalate these threats into other forms of transnational repression in the attempt to punish exiled dissidents for crossing a red line and shut them up. After gathering material on the media campaign of a human rights advocate, for example, they may decide to interrogate her parents in the home country. They may also use a journalist’s intercepted private communications for slander in state-controlled media. The methods in the toolkit of transnational repression are clearly intertwined and build upon each other. Digital technologies therefore extend the scope and scale of repressive practices against political exiles.

• 1Author interview, February 2019.
• 2Author interview, February 2019.
• 3Author interview, October 2019.

 Countering digital transnational repression

To support activists in mitigating the risks of digital threats from repressive state actors, it is important to build their digital resilience, constrain the proliferation of surveillance technology, and involve the institutions and resources of societies hosting exiles and diasporas.

With ties across countries and communities, exiled human rights defenders and journalists are part of transnational networks in which a successful attack against the weakest link could lead to severe consequences for all involved. Consequently, the resilience and security of these activists should be thought of in terms of relationships and networks. Risk awareness and knowledge on fundamental practices of digital security within civil society have certainly increased within civil society. Yet activists from authoritarian contexts operate in an environment of swiftly shifting technical and political risks, relying on commercial applications not designed for high-risk users. One-time trainings are not enough to equip individuals and organizations against emerging threats to their information security.

It is therefore vital to build forms of long-term accompaniment embedding activists and their organizations in arrangements of persistent support and advice. Strong communities of practice will make it easier to share information on threats and provide emergency response and assistance, as well as education on information security. Building coalitions to connect larger, international organizations with smaller, local groups and regional networks will allow support to be properly and rapidly scaled, while also offering natural and trusted contact points for activists on the frontlines.

The global spread of intrusive surveillance technology has caused serious harm to civil society worldwide. It should be constrained. Saudi Arabia’s targeting of dissidents abroad exemplifies how authoritarian powerholders abuse sophisticated spyware to violate human rights, within and beyond their territories. NSO Group, the company behind the surveillance tool deployed against Omar Abdulaziz and fellow activists, is but one household name within a thriving and shadowy private industry.1 David Kaye, UN Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, considered the threat of commercial surveillance technology so grave that he has called for a moratorium on its global sale, transfer, and use until rigorous human rights safeguards have been put in place.2

Strict rules and independent oversight are needed to bring transparency and accountability into the market for spyware. Companies should follow due diligence procedures throughout the entire chain of development and sales; export licenses should be made conditional upon independent human rights review. Government use of surveillance technology needs to be subject to public debate and critical investigation, and there must be mechanisms for sanctions and redress in cases of abuse. Companies providing surveillance tools that interfere with the rights of targets should be named and shamed, and their deceptive practices targeted by strategic litigation.3

Political emigrants who feel harassed and threatened from their home regimes should get the support of the societies they have turned to in order to escape repression in the first place. The media and human rights organizations can play an important role in documenting and raising awareness on practices of transnational repression. Governments in democratic host societies should be more alert to the methods of authoritarian rulers exporting repression abroad. Some countries have developed legal instruments to penalize more blatant transgressions, such as the abuse of Interpol or refugee espionage. But law enforcement agencies should be enabled to deal with the broader range of threats too. Cybercrime laws, for instance, could be used to thwart targeted surveillance and hacking attacks on civil society.

With a deep understanding of their home country, as well as contacts to international organizations, media, and policy circles, exiled activists occupy a strategic position to challenge unaccountable and illiberal regimes from afar. Authoritarian powerholders seek to silence these voices, building on methods such as surveillance, hacking devices, and online harassment. They instrumentalize digital technologies to amplify their control over citizens and information flows beyond borders. As a consequence of their invasive methods, civil society’s continued ability to use digital tools to freely exchange, coordinate, and organize is in danger. These malign practices should be seen as actions undertaken by increasingly assertive authoritarian states extending their reach to undermine civil liberties abroad. They are a threat to human rights, and need to be responded to accordingly.

• 1Privacy International, “The Global Surveillance Industry,” July 2016, https://www.privacyinternational.org/sites/default/files/2017-12/global….
• 2United Nations Office of the High Commissioner for Human Rights (OHCHR), “UN expert calls for immediate moratorium on the sale, transfer and use of surveillance tools,” June 25, 2019, https://www.ohchr.org/EN/NewsEvents/Pages/DisplayNews.aspx?NewsID=24736.
• 3Sarah McKune and Ron Deibert, “Who’s Watching Little Brother? A Checklist for Accountability in the Industry behind Government Hacking,” The Citizen Lab, March 2, 2017, https://citizenlab.ca/wp-content/uploads/2017/03/citizenlab_whos-watchi….

About the author: 

Marcus Michaelsen is a senior post-doctoral researcher in the Law, Science, Technology and Society (LSTS) research group at Vrije Universiteit Brussel, Belgium.