Freedom House High-risk people should expect their accounts to be compromised, even if they have strong digital security practices, an employee of a technology company with knowledge of these issues told Freedom House. For people who rely on their online presence for their work or activism, security measures like setting social media accounts to private or refraining from having an online profile at all fundamentally undercuts their livelihood or effectiveness. A US-based Kashmiri academic explained how concerns about the Indian government’s surveillance affect her personal and professional life: “Whenever I call my family members there … we don’t talk about anything. I don’t even ask [my friends or colleagues] any questions because so many journalists and human rights defenders have gotten detained. We know that social media is heavily, heavily being surveilled. So we just don’t really talk about anything, which makes it really difficult to get information.”115 Many technology companies have special safety programs for people who are at high risk of persecution. These mechanisms alleviate the burden on individuals attempting to manage digital hygiene on their own. In December 2021, Facebook expanded Facebook Protect, a program meant to support account security for human rights defenders, journalists, government officials, and other targeted groups, to more countries.116 One high-profile Uyghur activist who spoke with Freedom House had previously received a message advising him to turn on Facebook Protect. Other victims of transnational repression interviewed for this report were not familiar with the program, demonstrating a need for wider awareness. Anyone can enroll in Google’s Advanced Protection Program, but there are similar concerns about whether it reaches the people who need it most.117 “I had to do some real research,” said Samuel Chu, a US-based Hong Kong activist, explaining his efforts to access special protection programs offered by technology companies.118 The need to vigilantly employ robust digital hygiene practices underscores the power differential between individuals at risk of transnational repression and the governments that target them. “There’s so many threats out there,” said al-Sadhan. “They have a whole army of those trolls, attacking at the same time.” Without access to resources that are comparable to those of a state, individuals will always have the odds stacked against them when trying to protect themselves. As a Uyghur activist told Freedom House, some of the online threats he receives make him feel as though he is “just nothing” compared with the power of the Chinese regime.119 The proliferation of spyware Spyware, or software used for targeted and covert surveillance, is among the most sophisticated and intrusive forms of digital transnational repression. The rise in zeroclick attacks, which install spyware on devices without the targeted user needing to click on a malicious link or file, is particularly insidious.120 Commercial spyware, sold by hundreds of companies around the world, makes militarygrade surveillance tools available to any government or law enforcement agency willing to pay.121 The industry has operated for years without meaningful oversight and transparency, creating ample opportunity for state actors to expand the use of such technology against civilians. At least 17 governments employ spyware abroad alongside physical transnational repression. “We know that social media is heavily, heavily being surveilled. So we just don’t really talk about anything, which makes it really difficult to get information.” –US-based Kashmiri academic Recent policy and regulatory responses The proliferation of spyware came into the spotlight in 2021 following the publication of the Pegasus Project, an international media investigation that documented the use of the Israeli company NSO Group’s notorious Pegasus software to surveil activists, journalists, politicians, and many others around the world. In some cases, governments deployed Pegasus to spy on their nationals abroad. Emirati activist Alaa al-Siddiq was hacked while living in Qatar and the United Kingdom,122 and Carine Kanimba, the Belgium-based daughter of Paul Rusesabagina, was surveilled as she advocated for her father’s release following his abduction by Rwandan authorities in a high-profile act of transnational repression.123 In 2019, a different investigation revealed similar uses of Pegasus against dissidents abroad.124 While Pegasus is far from the only commercial spyware available, it is among the best known and most powerful. Researchers and civil society organizations have persistently advocated for regulation of spyware. David Kaye, then the UN freedomhouse.org 29