CITIZEN LAB RESEARCH REPORT NO.151 9 y Hard to detect: Intrusion attempts with digital technologies can be difficult for impacted individuals to detect.45 People struggle to trace the origins of a smear campaign or to discover the real identity of those who write harassing or threatening messages on social media or other online platforms. The availability of zero-click exploits provides a mechanism for infecting someone’s phone without leaving an obvious trace (such as a malicious text) or needing the target to take a specific action (such as clicking on a link).46 It can be challenging for law enforcement or other relevant groups, who often lack necessary technical expertise, to identify such activity and attribute it to a specific actor. y Adaptable: Digital transnational repression is characterized by the ease with which states that engage in such activities can rapidly change tactics and strategies when using digital technologies.47 Further, digital transnational repression does not necessarily require the same resource expenditure as physical surveillance activities.48 y More widespread chilling effect: The mere existence of digital technologies, such as spyware and malware, and the possibility that a country of origin would use them against a target creates a sense of insecurity and has chilling effects on the social and political activities of those targeted. Essentially, “having one’s private life exposed after a malware attack, or learning that a family member was threatened, can prompt a person to scale back or halt rights activism or other undesired behaviour immediately.”49 y Lack of accountability for state actors and other perpetrators: As researchers observe, the “normative cost” of transnational repression may be “low” as such threats may not be perceived as “breaching the sovereignty of the host country.”50 This impunity is coupled with the reality that the “normative cost of using transnational repression has gone down, particularly due to the erosion of norms against states using extraterritorial violence in the absence of war.”51 Indeed, the international law framework for digital attacks that fall below the threshold of the use of force remains debated.52 at chap. 3; Erica Frantz, Andrea Kendall-Taylor, and Joseph Wright (2020), “Digital Repression in Autocracies” Varieties of Democracy Institute at 2 <https://www.v-dem.net/media/publications/ digital-repression17mar.pdf> [Frantz et al., “Autocracies”]. 45 Moss, “Ties That Bind” at 278. See also Dalmasso et al., “Intervention” at 3; Schenkkan and Linzer, Freedom House Report at 4. 46 See e.g. Bill Marczak, John Scott-Railton, Bahr Abdul Razzak, Noura Al-Jizawi, Siena Anstis, Kristin Berdan, and Ron Deibert (2021), “FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild,” Citizen Lab <https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-clickexploit-captured-in-the-wild/>. 47 Moss, “Ties That Bind” at 278. 48 Frantz et al., “Autocracies” at 2. 49 Schenkkan and Linzer, Freedom House Report at 13. 50 Ibid. 51 Ibid at 7. 52 See e.g. Chatham House (2019), “The Application of International Law to Cyber Attacks” Chatham