ResearchTargeted ThreatsDigital Transnational Repression

Iran

By
This country spotlight is part of the Citizen Lab’s research on digital transnational repression. Digital transnational repression arises when governments use digital technologies to surveil, intimidate and silence exiled dissidents and diaspora communities. It is part of the broader practice of transnational repression, which refers to states using methods such as harassment, coercion-by-proxy, kidnapping, and assassination attempts, in order to control dissent outside their territories. Further research by the Citizen Lab on this issue – including research reports, country spotlights, stories of digital transnational repression, video interviews, and academic articles – is available here .

Iran is a persistent perpetrator of transnational repression using a broad range of methods. In 1992, for example, Iranian regime agents killed key members of the Iranian-Kurdish opposition in a Berlin restaurant.

1 More recent assassinations targeted opponents in the Netherlands and Turkey while further attempts in Denmark and France were disrupted by the authorities. Iranian security agencies have also kidnapped exiles traveling through neighboring countries and forcibly returned them to Iran.
2 In 2019, exiled journalist Ruhollah Zam, who ran a popular Telegram news channel from Paris, was lured to Iraq where he was captured by the Iranian Revolutionary Guard. He was brought to Tehran and later executed.
3 Prominent women’s rights advocate Masih Alinejad, who lives in New York, was the target of bold kidnapping and assassination attempts in 2022 and 2023, both of which were broken up by U.S. law enforcement agencies.
4

The Iranian government also frequently threatens family members of diaspora members, including through interrogations, the freezing of assets, arrests, and even torture.

5 Another widespread tactic to raise fear and suspicion among the Iranian diaspora are attempts to recruit Iranian citizens and dual nationals as informants whenever they visit Iran and can be put under pressure by the intelligence agencies. In 2020, for instance, the Revolutionary Guard arrested well-known software engineer Behdad Esfahbod, a dual-national from Canada on a family visit in Tehran, to force him into spying on Iranian tech activists abroad.
6

The targeting of activists and journalists abroad typically intensifies in times of political tension and protest. The Iranian government stepped up its global transnational repression campaign when 2022 anti-regime protests mobilized its diaspora communities across the world.

7 Journalists working for prominent Persian-language media stations, such as BBC Persian, Iran International, DW Persian, Radio Zamaneh and others, came under particular pressure for their extensive coverage of the protests.
8 British law enforcement agencies reported more than a dozen credible threats linked to the Iranian regime to kill or kidnap individuals on U.K. territory. In March 2024, Pouria Zeraati, a presenter for Iran International, was stabbed outside his home in London which is an important center for Iranian exile journalism. Due to increased threats against its staff members, the television channel Iran International decided to move its headquarters temporarily from London to Washington, D.C.
9

The Iranian regime also uses a wide spectrum of digital repression tools against the diaspora. For more than a decade, threat actors affiliated with the Revolutionary Guard Corps and other security agencies have engaged in phishing campaigns against activists abroad with the aim to gain access to accounts, confidential information and contacts.

10 These campaigns typically rely on sophisticated social engineering using information gathered through online monitoring and surveillance. Targets receive messages tailored to their professional profiles and interests to bring them to open links or attachments compromised with malware.
11

In addition, to limit the outreach of external Iranian news media, their websites have been taken offline by defacements and distributed denial-of-service (DDoS) attacks which disrupt their availability to legitimate users with massive false requests. Other operations copy the design and layout of prominent news sites, such as BBC Persian or Radio Farda, only to mock the content of the original sites to spread rumors about their staff members.

12 News websites and other regime-affiliated media often replicate and amplify defamation and disinformation directed against diaspora members. A typical tactic is to disseminate information that frames dissidents as regime affiliates, exposing them to attacks from hardline opposition groups in the diaspora.

These and similar tactics of digital repression are also used for the gender-based targeting of women dissidents in the diaspora. For the Iranian regime, control over women’s public appearance and behavior represents a cornerstone of its foundational ideology. While the Iranian women’s rights movement has a long history of challenging the regime, the 2022 “Women, Life, Freedom” protests put the struggle around women’s rights and emancipation at the center of political conflict. In return, women also bore the brunt of the regime’s response, both domestically and in the diaspora.

Regime-affiliated online media and social media accounts spread defamatory content depicting outspoken women as morally corrupt or promiscuous. Fake stories accusing women activists and journalists of working as prostitutes or owing their career to sexual favors aim to humiliate targets and discredit them as voices of the opposition. The Iranian women we interviewed also talked of constant insults, harassment, and abuse aimed at their appearance or behavior. Women from ethnic minorities and LGBTQ communities faced intersecting threats targeting their gender and racial or sexual identity. To intimidate and silence their targets, the attackers used threats of rape and other violence against women in the diaspora and their loved ones, including their children. A human rights activist said she had received photos of victims of femicide in Iran with the message “We’ll do the same to you or your mother” (who lives in Iran).

In combination with the Islamic Republic’s long history of actual physical attacks against its exiled opponents, these digital threats were particularly frightening for respondents. Many also feared for the safety of their relatives inside Iran, which further increased the mental and emotional toll of their activism abroad.

Yet, not all attacks are instigated and perpetuated by the regime and its affiliates. Within conservative sections of Iranian society, harassment and smear campaigns against women often fall on fertile ground and are amplified by ordinary users. Moreover, in the deeply divided Iranian diaspora, sexist abuse and other threats against publicly active women also come from other groups and individuals. Several respondents mentioned monarchists supporting Reza Pahlavi, the U.S.-based son of the last Shah who was removed in the Islamic Revolution of 1979, had a particular tendency to espouse a deeply chauvinist agenda, fiercely attacking more moderate voices or women advocating for minority rights. “Governments create oppositions that are quite similar to themselves in many ways,” summarized an Iranian journalist we interviewed about the bullying and sexual harassment that she received both from regime affiliates and monarchist groups in the diaspora.

  1. Caroline Moorehead (2011), “By the Ayatollah’s Decree,” The New York Times (September 16) <https://www.nytimes.com/2011/09/18/books/review/assassins-of-the-turquoise-palace-by-roya-hakakian-book-review.html>.↩︎
  2. Nate Schenkkan and Isabel Linzer (2021), “Out of Sight, Not Out of Reach,” Freedom House

    <https://freedomhouse.org/sites/default/files/2021-02/Complete_FH_TransnationalRepressionReport2021_rev020221.pdf>.↩︎

  3. Elian Peltier and Farnaz Fassihi (2020), “Iran Executes Dissident Accused of Stoking Protests,” The New York Times (December 12) <https://www.nytimes.com/2020/12/12/world/europe/iran-execution-Ruhollah-Zam.html>.↩︎
  4. Benjamin Weiser and Glenn Thrush (2023), “Justice Dept. Announces More Arrests in Plot to Kill Iranian Writer,” The New York Times (January 27) <https://www.nytimes.com/2023/01/27/us/politics/masih-alinejad-doj-assassination-plot.html>.↩︎
  5. United Nations (2020), “Iran: Targeting of Journalists Threatens Freedom of Press, Say UN Experts,” United Nations Human Rights Office of the High Commissioner <https://www.ohchr.org/en/press-releases/2020/03/iran-targeting-journalists-threatens-freedom-press-say-un-experts?LangID=E&NewsID=25706>.↩︎
  6. Farnaz Fassihi (2020), “He Was Iran’s Homegrown Tech Star. The Guards Saw a Blackmail Opportunity,” The New York Times (August 21) <https://www.nytimes.com/2020/08/21/world/middleeast/Iran-technology-arrest-spy.html>.↩︎
  7. Shane Harris, Souad Mekhennet, and Yeganeh Torbati (2022), “Rise in Iranian Assassination, Kidnapping Plots Alarms Western Officials,” The Washington Post (December 1) <https://www.washingtonpost.com/world/2022/12/01/iran-kidnapping-assassination-plots>; Manisha Ganguly (2023), “Iranian Activists Across Europe are Targets of Threats and Harassment,” The Guardian (September 22) <https://www.theguardian.com/world/2023/sep/22/iranian-activists-across-europe-are-targets-of-threats-and-harassment>.↩︎
  8. Reporters Without Borders (2024), “Watch Out Because We’re Coming for You: An RSF Report on Unprecedented Transnational Repression of Iranian Journalists in the UK,” <https://rsf.org/sites/default/files/medias/file/2024/04/Rapport%20Iran%20V6%20Web_2.pdf>.↩︎
  9. United Nations (2024), “Violence and Threats Against Journalists Reporting on Iran From Abroad Must Stop, Warn UN Experts,” United Nations Human Rights Office of the High Commissioner <https://www.ohchr.org/en/press-releases/2024/05/violence-and-threats-against-journalists-reporting-iran-abroad-must-stop>.↩︎
  10. John Scott-Railton and Katie Kleemola (2015), “London Calling: Two-Factor Authentication Phishing From Iran,” The Citizen Lab <https://citizenlab.ca/2015/08/iran_two_factor_phishing/>; Collin Anderson and Karim Sadjadpour (2018), “Iran’s Cyber Threat: Espionage, Sabotage, and Revenge,” Carnegie Endowment for International Peace <https://carnegie-production-assets.s3.amazonaws.com/static/files/Iran_Cyber_Final_Full_v2.pdf>.↩︎
  11. Mandiant (2022), “APT:42: Crooked Charms, Cons and Compromises,” <https://www.mandiant.com/resources/reports/apt42-spears-phishing-and-surveillance>.↩︎
  12. Marcus Michaelsen (2020), “The Digital Transnational Repression Toolkit, and Its Silencing Effects,” Freedom House <https://freedomhouse.org/report/special-report/2020/digital-transnational-repression-toolkit-and-its-silencing-effects>↩︎