Glossary: Handbook of Digital Repression

Mobile phones are pushed away from 4G/5G and forced onto older networks such as 2G or 3G.

This can happen by disabling or jamming modern radio standards, using manipulated base stations, or changing network configuration. 2G is especially risky because its protections are weaker and attacks such as IMSI catching, location tracking, or connection disruption become easier.

The fewer independent paths to the internet exist, the easier censorship becomes.

When providers, data centers, internet exchange points, DNS resolvers, and international gateways are politically or technically centralized, blocks can be rolled out faster, more uniformly, and with fewer opportunities to route around them.

Internet access is restricted at specific times, for example at night or during expected protests.

These restrictions can be implemented through provider orders, central gateways, mobile cells, or regional routing rules. To users, they often look like recurring technical failures.

Access to the global internet passes through a small number of controllable chokepoints.

When international traffic is concentrated at central gateways, DNS blocking, IP blocking, DPI, throttling, and full shutdowns can be enforced with less effort. Individual providers also have fewer technical ways to avoid the controls.

Mobile data is shut down while fixed-line connections may continue to work.

The shutdown can affect specific mobile operators, cells, regions, or data services. Calls and SMS may still work while IP data is blocked. People on the move, at protests, or without fixed broadband are hit hardest.

A country is fully or almost fully disconnected from the global internet.

This can be done through central gateway blocks, routing manipulation, provider orders, or by cutting international transit connections. Domestic services often continue to operate so administration, banks, or state-controlled platforms remain reachable.

A state-controlled domestic network that feels like the internet but can be separated from the open global internet.

Domestic services, data centers, search engines, messengers, and government platforms are hosted and prioritized inside the country. During a crisis, international connectivity can be cut while this internal infrastructure continues. Iran's National Information Network is a central example of this architecture.

Domestic or state-approved services work better than international alternatives.

Providers can prioritize national services by exempting them from data caps, routing them locally, or keeping them reachable during blocks. International platforms may be throttled, blocked, or connected only unreliably at the same time.

Only certain cities, provinces, or conflict zones are taken offline.

A regional shutdown can be enforced through local providers, mobile cells, regional gateways, or routing rules. It can make repression harder to document while the rest of the country appears to remain online.

Instead of blocking forbidden sites, the network allows only explicitly approved services.

Whitelisting reverses the normal logic: unknown domains, IPs, protocols, or encrypted tunnels are blocked by default. This is especially effective against new circumvention tools because they do not need to be added to a blacklist first.

Certain state-approved or domestic services are free or cheaper to use.

Providers identify these services by IP ranges, domains, or platform agreements and bill them differently. This creates economic pressure to use more controllable platforms while independent or international services remain more expensive or slower.

The path internet traffic takes is manipulated so services become unreachable.

BGP controls which networks are reachable through which paths. When routes are withdrawn, falsely announced, or discarded internally, entire services, providers, or regions can disappear from global routing. To users this often looks like an outage, even when the block is deliberate.

Protections such as DNS-over-HTTPS or DNS-over-TLS are blocked so ordinary DNS censorship still works.

Resolver addresses, TLS fingerprints, or known DoH endpoints can be blocked. Users are pushed back to controllable DNS resolvers whose answers can be manipulated, logged, or filtered.

Hidden access points to Tor or other circumvention systems are systematically discovered and then blocked.

Censors try to identify bridges through test connections, leaked lists, active scanning, or traffic patterns. This is why modern circumvention systems rotate addresses, camouflage traffic, and use controlled distribution channels.

Large infrastructure providers are blocked even though many different websites depend on them.

CDNs and cloud platforms share IP ranges, certificates, DNS structures, and hosting infrastructure. A block aimed at one service can affect many unrelated services. Sometimes this collateral damage is accidental; sometimes it is accepted deliberately.

Blocking one target also breaks other services.

This happens when blocks are applied to IP ranges, cloud providers, CDNs, DNS resolvers, or protocols rather than individual content. The broader the block, the higher the collateral damage.

Network traffic is not only forwarded, but inspected in depth.

DPI systems analyze packet headers, protocol characteristics, TLS metadata, packet sizes, timing, and sometimes unencrypted content. This can be used to detect, throttle, or block VPNs, Tor, messengers, streaming, uploads, or specific apps.

A domain name is deliberately resolved incorrectly.

Instead of the real IP address, a DNS resolver returns a false answer, a block page, or no answer at all. The website appears unreachable even when the server and internet connection are working.

A website name can no longer be translated into an IP address.

Provider or state-controlled resolvers refuse the answer, return NXDOMAIN, time out, or redirect to a block page. DNS blocking is relatively easy to deploy, but may be bypassed with alternative or encrypted resolvers unless those are blocked as well.

A camouflage technique is blocked where forbidden traffic is made to look like access to an allowed major platform.

Domain fronting uses differences between the visible domain and the internal destination inside large cloud or CDN infrastructures. Censors respond with SNI/Host matching, CDN blocking, or political pressure on platform operators.

New protections that hide the destination name of an HTTPS connection are blocked or disrupted.

Encrypted Client Hello is designed to prevent the requested domain from being visible during TLS setup. Censors can block known ECH-enabled services, disrupt connection setup, or force users back to older, more filterable variants.

Unencrypted web traffic is altered, blocked, or redirected.

With HTTP without TLS, content can be read and modified directly. Censors can inject block pages, force redirects, alter downloads, or break connections. HTTPS protects against much of this, but not against all metadata-based blocking.

Specific server addresses are blocked.

Routers or firewalls discard packets to individual IP addresses, IP ranges, or autonomous systems. Because many services share infrastructure, IP blocking can easily create collateral blocking.

Content containing certain words is suppressed.

Keyword filters can inspect search queries, posts, comments, URLs, unencrypted traffic, or platform content. In authoritarian contexts, lists often include names of political prisoners, protest slogans, minority rights terms, or references to circumvention tools.

Traffic is deliberately sent nowhere.

Routers accept a route but silently discard packets or forward them to an unreachable destination. This can be harder to diagnose than a visible block page because it looks like packet loss or a technical fault.

Only approved kinds of connections still work.

Firewalls may allow ordinary web traffic, national apps, or specific corporate protocols while blocking unknown tunnels, VPNs, Tor, SSH, or new encryption protocols. This is a particularly strict form of access control.

Modern web connections using QUIC or HTTP/3 are disrupted so services become slower or easier to control.

QUIC runs over UDP and behaves differently from classic HTTPS over TCP. Censors can block or throttle UDP/443, forcing browsers to fall back to older protocols. This can reduce performance and make filtering easier.

Specific tools or connection types are deliberately made unusable.

Blocks target not only websites but protocols such as OpenVPN, WireGuard, Tor, SSH, Signal traffic, or other encrypted tunnels. Detection can rely on ports, packet patterns, handshakes, IP lists, or DPI.

Certain services remain reachable but are deliberately slowed down.

Providers can limit bandwidth, packet priority, or connection quality for specific platforms, protocols, IP ranges, or international routes. This is harder to prove than a clear block because it can look like congestion.

An HTTPS connection is blocked based on the visible domain name.

In classic TLS setup, the Server Name Indication field often exposes the destination domain. Firewalls can read this field and reset or block the connection even though the actual content is encrypted.

The internet is slowed so much that it becomes barely usable.

Bandwidth, latency, or packet loss are artificially worsened. Pages take minutes to load, uploads fail, messengers feel unstable, and livestreams become impossible without a full visible block.

Encrypted connections are disrupted while they are being established.

Firewalls can interrupt TLS handshakes, trigger certificate errors, filter by SNI, ALPN, fingerprints, or certificate properties, or push users toward less secure connection paths.

Access to the Tor network is made difficult or blocked.

Censors block public relays, known bridges, directory authorities, or typical Tor traffic patterns. Tor responds with bridges and pluggable transports that camouflage traffic or route it through harder-to-block paths.

Connections are deliberately made unreliable.

Instead of clearly blocking traffic, the network creates timeouts, packet loss, reset packets, false responses, or artificial errors. This makes diagnosis harder and can push users to abandon safer tools.

Not a whole website, but individual articles or subpages are blocked.

With unencrypted HTTP the full path can be visible. With HTTPS, URL filtering is harder, but can still happen through platform pressure, proxy systems, search engines, in-app restrictions, or state-controlled services.

VPNs are blocked so people cannot bypass censorship.

Blocks combine IP lists, DNS blocking, app-store restrictions, payment bans, DPI, protocol fingerprinting, and active probing of VPN servers. That is why some VPNs work intermittently, while others fail entirely or only work in camouflage mode.

Automated systems help decide which content remains visible.

AI-based or rule-based systems can flag, downrank, or remove text, images, videos, livestreams, and comments. In authoritarian contexts, this can scale filtering of political terms, symbols, faces, protest images, or information about circumvention tools.

Apps for secure communication or independent information become difficult to install.

Governments can pressure app-store operators, control local store versions, or order providers to block downloads. VPNs, messengers, exile media, news apps, and security tools are common targets.

Platforms remove content not only because of community rules, but because of state pressure.

This pressure can come through laws, fines, local representative requirements, threats of blocking, or informal government contacts. Users often cannot tell whether content disappeared because of a real rule violation, political influence, or automated error.

Critical information is not deleted, but drowned out.

Coordinated accounts, bots, or state-backed campaigns spread propaganda, misleading counter-narratives, spam, or large amounts of irrelevant content. The goal is to flood search, hashtags, comment sections, and public attention.

Content remains online, but cannot be accessed from certain countries or regions.

Platforms can hide content based on IP address, account region, SIM country, payment data, or location signals. This makes the block local and sometimes difficult to notice from outside.

A hashtag may still exist, but loses its function as a public rallying point.

Platforms or state-influenced systems can remove hashtags from trends, restrict search, disable autocomplete, or reduce the reach of posts using them. This disrupts mobilization without deleting every individual post.

People mostly see state or state-aligned information.

An information monopoly emerges from a combination of blocking independent media, pressuring journalists, prioritizing state platforms, spreading disinformation, and using legal intimidation. It can be reinforced technically through national platforms, search engines, or intranets.

Live images of protests or violence do not reliably reach the outside world.

Livestreams can be interrupted through platform throttling, upload blocking, mobile shutdowns, disruption of specific apps, or blocking of streaming endpoints. This is especially effective because livestreams are time-sensitive.

Private communication through messengers becomes difficult or impossible.

Blocks can target DNS, IP addresses, CDNs, push notifications, media uploads, or specific protocols. Even if text messages still work, voice calls, groups, file transfers, or registration codes may be selectively disrupted.

A platform is not fully blocked, but works so poorly that it becomes barely usable.

Providers can increase latency, packet loss, or bandwidth limits for specific platforms. This especially affects video, audio, uploads, livestreams, and large chat groups. From the outside, it can look like congestion or a platform problem.

People can no longer find certain information through ordinary search.

Search results can be removed, downgraded, locally hidden, or displaced by state sources. In controlled search engines, even autocomplete, indexing, or result ordering can be politically shaped.

Content stays online, but hardly anyone sees it.

Posts can disappear from recommendations, trends, search, or hashtag pages without an account being openly suspended. For affected users it is hard to prove whether an algorithmic decision, coordinated reporting, or political pressure is responsible.

Major social platforms become unreachable or severely restricted.

Blocks can affect whole platforms, individual functions, or specific kinds of content. Governments often use them during protests because social media is important for mobilization, documentation, international attention, and contact with diaspora communities.

Independent news sources become difficult for people inside the country to reach.

Targets include websites, apps, YouTube channels, podcasts, newsletters, exile media, human rights organizations, and investigative platforms. Blocking can happen through DNS, IP, SNI, or platform pressure and is often combined with criminalization.

State authorities demand that content or accounts be removed.

Takedowns can target individual posts, videos, domains, channels, groups, or whole accounts. They are often justified through broad national laws on national security, terrorism, extremism, or false information.

People can still view content, but cannot upload their own photos, videos, or livestreams.

Technically, upload traffic can be throttled or blocked more aggressively than download traffic. This is especially dangerous during protests and police violence because documentation is prevented while passive use appears to continue.

Content is checked before other people can see it.

Upload filters analyze text, images, audio, or video before or immediately after publication. In repressive contexts, political symbols, protest slogans, faces, locations, footage of violence, or references to circumvention tools can be filtered out.

Attackers gain access to social media, email, or messenger accounts.

They can then read private messages, spy on contacts, delete content, impersonate the account holder, or spread disinformation. This is especially dangerous when an account is trusted by groups, sources, or the public.

Apps collect data about how, where, and on which device they are used.

Telemetry can include device details, crash reports, behavior patterns, contacts, location data, or network data. In repressive contexts, seemingly technical data can reveal activism, whereabouts, or social connections.

Many small digital traces are combined into assumptions about a person.

Search behavior, contacts, locations, platform use, purchases, sleep patterns, or interactions can be merged into profiles. These profiles may suggest political orientation, activism, habits, vulnerabilities, or risk categories.

Body-based identifiers are stored so people can be recognized later.

This can include face images, fingerprints, iris data, voice profiles, or gait patterns. If such data is centrally available, it can be matched with cameras, border checks, police databases, or platform images.

A browser can be recognized even without cookies.

Websites can combine screen size, language, time zone, fonts, browser version, graphics features, and extensions. The combination may be distinctive enough to track users across sessions or websites.

Public or semi-public networks ask for personal data before allowing access.

Captive portals may require phone numbers, ID data, room numbers, social logins, or SMS codes. This can link later use of a Wi-Fi network or hotspot to a specific person.

Cameras do not only record; they are automatically analyzed.

AI systems can detect faces, clothing, movement patterns, vehicles, group formation, or unusual behavior. In protest contexts, this can help identify people later or track movement through a city.

A mobile phone can be roughly located through mobile towers.

Even without GPS, the network knows which cells a device is connected to. Signal strength, timing, and multiple towers can narrow down location, especially in cities with dense mobile infrastructure.

Users are pushed to install certificates that can weaken encrypted connections.

A state-controlled or otherwise controlled root certificate can enable man-in-the-middle monitoring if devices or apps trust it. HTTPS connections may then be intercepted, inspected, or manipulated unless additional protections apply.

Access to cloud accounts can indirectly expose private communication.

iCloud, Google, email accounts, or backups often contain contacts, photos, location history, device data, and sometimes unencrypted backups. Even end-to-end encrypted messengers can be weakened through backups, metadata, or linked accounts.

Authorities analyze relationships, not only individuals.

Contact lists, group memberships, call logs, messenger metadata, email headers, or shared locations can show who is connected to whom. This can reconstruct organizations, trusted people, sources, and informal networks.

Connection data is stored in advance, even without a specific investigation.

Stored data may include phone numbers, IP addresses, timestamps, cell towers, or communication partners. Even without message content, such data can later reconstruct networks, movements, and routines.

A device is recognized through many small technical characteristics.

Browser data, operating system, hardware, sensors, installed apps, network behavior, fonts, and settings can form a profile. This can enable tracking even when names, cookies, or IP addresses change.

Seized smartphones or laptops can be systematically analyzed.

Forensic tools look for chats, photos, location data, contacts, browser data, deleted files, app databases, and cloud access. Depending on device state, encryption, and configuration, even seemingly deleted information may be recoverable.

Network traffic is used to make behavior visible, even when content is encrypted.

DPI can identify protocols, tools, platforms, timing, packet sizes, and connection patterns. This can reveal whether someone is using VPNs, Tor, messengers, upload services, or specific apps.

People attending demonstrations can be identified by their faces.

Authorities or aligned actors can compare CCTV footage, social media images, livestreams, or press photos with ID, passport, school, workplace, or platform databases. Social connections and repeated locations can also make identification easier.

Technical security is bypassed through legal, physical, or coercive pressure.

When authorities or security forces demand passwords, PINs, unlock patterns, or account access, strong encryption offers limited protection. The risk extends to contacts, groups, sources, and stored documents.

A fake mobile base station causes nearby mobile devices to connect to it.

These systems can collect device identifiers such as IMSI or IMEI, narrow down location, and disrupt connections. Depending on the mobile standard, network configuration, and equipment used, they can also facilitate downgrades or further attacks.

Internet access or online services are tied to state identity.

When logins, phone numbers, ID cards, or digital IDs become mandatory, online behavior is easier to link to specific people. Anonymous criticism, whistleblowing, research, and safe political communication become much harder.

Keystrokes are secretly recorded.

Keyloggers can capture passwords, search queries, messages, drafts, and two-factor codes. They may run as malware, be hidden in manipulated keyboard apps, or operate through compromised systems.

Vehicles and movements can be tracked automatically.

Camera systems record license plates, locations, and timestamps and can create movement profiles. This can reveal who traveled to protests, meetings, newsrooms, embassies, or the homes of specific people.

People must use online services under their real names.

Real-name requirements connect political speech, group memberships, and media use directly to civil identity. Even without advanced technical surveillance, this creates strong pressure toward self-censorship.

Phone numbers are directly linked to identity documents.

When SIM cards require registration, calls, SMS, messenger registration, mobile location, and data connections become easier to associate with a person. This significantly weakens anonymous communication.

Communication is intercepted or altered while in transit.

In a man-in-the-middle attack, an attacker sits between the user and the service. This is especially dangerous on insecure Wi-Fi, with manipulated certificates, compromised routers, or state-controlled network infrastructure.

Communication can reveal a lot even without message content.

Metadata shows who communicated when, how often, from where, with whom, and through which service. For repression, that can already be enough because contacts, routines, group structures, and crisis moments become visible.

A compromised device can become a surveillance tool itself.

Spyware or abused permissions can access microphone, camera, location, screen, or files. Encrypted messengers offer only limited protection if surveillance happens directly on the device.

Mobile network data shows roughly where a device has been.

Providers process or store which cell a device was connected to and when. This can reveal movement profiles, places visited, travel routes, or participation in protests and meetings.

Advanced spyware can deeply compromise smartphones.

Pegasus-like tools often exploit unknown vulnerabilities and may install without visible user interaction. Messages, contacts, photos, location, microphone, camera, and account access can all be at risk.

People are lured into traps through fake links, files, or login pages.

Phishing targets passwords, two-factor codes, cloud accounts, or malware installation. Personalized messages are especially effective when they refer to real political work, media requests, support offers, or internal conflicts.

Data analysis is used to anticipate protests or activism.

Authorities may analyze social media, location patterns, contact graphs, previous arrests, or event calendars. This can lead to preventive intimidation, targeted checks, or surveillance of specific groups.

Spyware can see what is on screen or what has been copied.

Screenshots and clipboard data can expose messages, passwords, one-time codes, wallet addresses, contacts, or internal documents. This is especially risky with password managers, messenger apps, translation tools, and note-taking workflows.

A phone can be silently pinged to check reachability or approximate location.

Silent SMS or similar network signals do not appear as normal messages. They can still create traces in the mobile network that investigators may use to locate a device or confirm activity.

A phone number is taken over to attack accounts.

Attackers convince a provider to move a number to a new SIM or exploit compromised provider processes. They can then intercept SMS codes, reset passwords, and take over messenger or email accounts.

SMS two-factor codes are better than no protection, but not especially robust.

SMS codes can be exposed through SIM swapping, SS7 attacks, provider access, device seizure, or malware. Where possible, authenticator apps, passkeys, or hardware security keys are safer.

Public and semi-public online relationships are analyzed.

Likes, shares, followers, comments, group memberships, shared hashtags, and interactions can reveal political affinity, sympathies, or organizing structures. Social graphs can endanger even people who post very little themselves.

Weaknesses in older mobile-network infrastructure can be abused for surveillance.

SS7 is a signaling system that connects mobile networks worldwide. Attacks or privileged access can be used to request location data, redirect SMS, or attack certain mobile services.

Malware accesses the device directly instead of breaking encryption.

State trojans and spyware can read messages, files, photos, location, contacts, microphone, camera, or keystrokes. End-to-end encryption is bypassed because data is collected before or after encryption on the device itself.

Public Wi-Fi can expose locations and online activity.

If Wi-Fi requires registration, a phone number, ID, or captive portal, usage becomes identifiable. Operators may also log connection times, device identifiers, visited domains, or movement between access points.

Even encrypted traffic can sometimes be recognized by its pattern.

Packet sizes, timing, connection duration, data volumes, and typical handshakes can reveal apps or protocols. This can identify Tor, VPNs, messenger calls, or uploads without reading the content.

At borders, devices and accounts can become risks for contacts and sources.

Travelers may be pressured to unlock phones, open messengers, show cloud accounts, or disclose passwords. The risk affects not only personal data but also chat partners, photos, groups, and professional sources.

Critical voices lose paid reach and advertising income.

Media outlets, NGOs, or opposition groups may be banned from placing ads or excluded from ad networks. This weakens visibility, funding, and the ability to reach audiences beyond an existing supporter base.

Not only banned content, but tools for open access are targeted.

VPNs, Tor, bridges, proxy servers, Psiphon, Snowflake, satellite internet, or guides for bypassing blocks can be banned or criminalized. This also affects people who use such tools for safety, research, or contact with family.

Using certain services becomes illegal even if they remain technically reachable.

People can be punished for using VPNs, proxies, foreign platforms, unregistered messengers, or independent media access. These rules create fear and reduce use even when technical blocks could be bypassed.

Laws against digital crime are used to prosecute legitimate criticism.

Broad terms such as false information, extremism, insult, cybercrime, or national security can be applied to activism, journalism, satire, or human rights work. The line between genuine law enforcement and political repression is deliberately blurred.

Data must be stored or processed inside the country.

This can make state access easier because companies are subject to local laws, licensing rules, and government requests. International safeguards, foreign courts, and technical fallback options can become weaker.

Websites are knocked offline by massive numbers of requests.

DDoS attacks deliberately overload servers, networks, or protection systems. During political crises, independent media, NGOs, campaigns, exile groups, or documentation projects are often hit precisely when information is most needed.

A web address is taken away, shut down, or redirected.

Registrars, national domain authorities, courts, or government agencies can seize a domain. The content may still exist on a server, but it is no longer reachable at the known address or is redirected elsewhere.

Political communication is framed as a security threat.

Activism, journalism, protest calls, or contact with opposition actors can be treated as extremism or terrorism. This creates a justification for surveillance, account freezes, content removal, arrests, or international legal assistance requests.

Laws against disinformation are used against independent information.

Instead of narrowly defining demonstrably harmful false information, terms such as fake news or rumor are interpreted broadly. Reporting on violence, corruption, protests, minority rights, or state failure can then be criminalized.

Projects are attacked by blocking the flow of money.

Bank accounts, payment services, crowdfunding, donation platforms, credit cards, or cryptocurrency access can be blocked or restricted. This can weaken media, NGOs, technical infrastructure, or support networks without directly deleting content.

Content disappears because the technical service provider is pressured.

States or powerful actors can pressure hosting providers, data centers, domain providers, or infrastructure companies legally, economically, or politically. Small media outlets, NGOs, and projects without fallback infrastructure are especially vulnerable.

Foreign platforms must appoint people inside the country who can be held responsible.

Local representatives can be threatened with fines, prosecution, arrest, or loss of license. This creates direct pressure on platforms to remove content, hand over data, or implement blocking orders.

Online journalism is tied to state permission.

When media licensing applies to websites, channels, podcasts, or social media formats, critical outlets can be made formally illegal. Denying or withdrawing a license becomes a tool against independent reporting.

Platforms must register and accept state conditions.

Licensing systems may require local representatives, data localization, takedown deadlines, content filters, transparency toward authorities, or technical interfaces. Platforms that refuse risk blocking, throttling, or legal sanctions.

Internet providers may operate only if they comply with state requirements.

Licenses can be tied to filtering systems, surveillance interfaces, data sharing, local storage, shutdown capability, or cooperation with security agencies. Providers become enforcement points for state control.

International restrictions can unintentionally make free communication harder.

Sanctions, export controls, payment blocks, or platform risk rules can prevent people from receiving security updates, cloud services, app downloads, hosting, payment channels, or protection tools. A regime may be the intended target, but civil society is affected too.

Online services may only operate after registration or approval.

Blogs, associations, media outlets, newsletters, social media channels, or video platforms can be made subject to registration. Unregistered services are then treated as illegal and can be blocked, deleted, or prosecuted.

An organized campaign is disguised as spontaneous public opinion.

Coordinated accounts, paid commenters, bots, or state-aligned networks create the impression that a position is held by many independent people. This can shift debates, delegitimize criticism, and isolate targeted individuals.

People stay silent because they fear possible consequences.

A chilling effect emerges when surveillance, threats, arrests, public smear campaigns, or vague laws change behavior. Not everyone has to be prosecuted. The credible possibility is often enough to make people avoid posts, research, contacts, or protests.

Private information is used as leverage.

Attackers threaten to publish or share photos, chats, contacts, intimate material, location data, or professional information with authorities, employers, or family members. The goal is often not money, but silence, cooperation, withdrawal from public life, or abandonment of political work.

Personal data is published to make a person vulnerable.

Doxxing can include addresses, phone numbers, workplaces, family connections, photos, identity documents, or social media profiles. The disclosure is meant to intimidate and often enables further attacks such as threats, stalking, reporting campaigns, or pressure on relatives.

Digital attacks use gender, sexuality, or the body as a point of attack.

Women, queer people, and marginalized groups are often targeted with sexualized threats, intimate fakes, moral defamation, or threats against family and reputation. The goal is to push people out of public visibility, activism, and political debate.

Attackers pretend to be another person or organization online.

Fake profiles, hijacked accounts, or cloned websites can be used to exploit trust, map contacts, spread false information, or discredit activists. This is especially dangerous in networks where trust is built through personal relationships.

People are attacked online so heavily that public visibility becomes exhausting or unsafe.

Coordinated attacks can combine insults, threats, sexualized violence fantasies, racist or political abuse, doxxing, reporting campaigns, and spam. The goal is to exhaust, isolate, and push people out of debates or political work.

Family members are threatened to intimidate people abroad or in public life.

In transnational repression, relatives in the country of origin may be interrogated, monitored, professionally punished, or directly threatened. This creates pressure on exile activists, journalists, or human rights defenders even when they live outside the state's direct reach.

Mass coordinated reports are used to make accounts or content disappear.

Platforms often respond automatically to large numbers of reports. Organized groups can trigger suspensions, reduced reach, restrictions, or moderation reviews even when the reported content is legitimate. It looks like platform moderation, but often functions as coordinated intimidation.

People say, post, or investigate less because they fear consequences.

Self-censorship is not caused only by direct bans, but also by fear of surveillance, prosecution, job loss, attacks on family, social stigma, or digital violence. It is especially powerful for repressive systems because part of the control is internalized by the people affected.

The credibility of a person or organization is deliberately damaged.

Defamation can spread through rumors, manipulated screenshots, false accusations, state media, bot networks, or accounts that appear independent. It is especially effective when it draws on existing prejudice and makes supporters uncertain.

Repression does not stop at national borders.

States or state-aligned actors monitor, threaten, defame, or pursue critics abroad. This can include pressure on relatives, spying in diaspora communities, intimidation at events, digital attacks, extradition threats, or campaigns against exile media.

Organized accounts manipulate debates and attack critics.

Troll armies may be state-directed, party-linked, commercially paid, or ideologically motivated. They amplify propaganda, spread doubt, target individuals, shift hashtags, and create the impression that criticism is isolated or socially unacceptable.