ResearchTargeted ThreatsDigital Transnational Repression

Russia

This country spotlight is part of the Citizen Lab’s research on digital transnational repression. Digital transnational repression arises when governments use digital technologies to surveil, intimidate and silence exiled dissidents and diaspora communities. It is part of the broader practice of transnational repression, which refers to states using methods such as harassment, coercion-by-proxy, kidnapping, and assassination attempts, in order to control dissent outside their territories. Further research by the Citizen Lab on this issue – including research reports, country spotlights, stories of digital transnational repression, video interviews, and academic articles – is available here .

Prior to 2022, Russian transnational repression was characterized by the killing and attempted killing of former regime insiders, high-profile dissidents and members of armed groups previously engaged in conflict with Russia, especially from Chechnya.1 However, the full-scale war against Ukraine changed not only the composition of the exile community but also the scale and scope of Russian repression across borders.

The invasion of Ukraine in February 2022, as well as the announcement of a partial mobilization in September 2022, triggered a new wave of emigration as hundreds of thousands Russian citizens left their home country.2 In addition to former Soviet republics in the Caucasus and Central Asia, key destinations to flee included Turkey, the Baltic states, Germany, and other countries in the European Union. The broad exodus set off by a general opposition to the war encompassed Western-oriented businessmen, IT specialists, liberal intellectuals, human rights defenders, and other civil society activists.3 With increasing repression inside Russia, numerous independent media, civil society organizations and activist groups relocated to continue their work in exile.4

In this climate of anti-war activism, women play a key role. The Feminist Anti-War Resistance, launched immediately after the invasion, combines defiance against military aggression with feminist, anticolonial, and anti-racist values.5 With this agenda, it directly challenges the hypermasculinity and chauvinism of Putin’s autocratic rule and imperialist project. Anti-war initiatives from indigenous communities in Russia’s Far East also built on the initiative of exiled women activists. They often draw parallels between the Russian aggression against Ukraine and their own history of violent oppression.6

The Russian state targets these exile networks with different means of transnational repression including kidnapping attempts, killings and attempted killings, legal prosecutions in Russia, extradition and INTERPOL abuse, and the denial of consular services.7 In 2022 and 2023, exiled journalists and activists in Europe were targeted through a series of poisoning attacks.8 A method of choice of Russian intelligence agencies, the poisonings were interpreted as a demonstration of Moscow’s reach across borders to spread fear among the exile community.9

Journalists working for independent Russian exile media received threatening messages which mentioned travel schedules and hotel names for trips they had planned but eventually canceled. They also received pictures of their families in Russia to threaten them to stop writing.10 Russia has equally used criminal groups as proxies to attack exiled dissidents, such as opposition activist and Alexey Navalny’s aide Leonid Volkov in Lithuania.11

Russian activist networks and civil society organizations operating in exile face a range of digital threats. These groups are often distributed across different countries, working out of improvised offices, and relying heavily on digital communications. Their decentralized nature makes it difficult to implement coherent security protocols and conduct effective digital security training. All this creates new risks and vulnerabilities that the Russian regime seeks to exploit. In August 2024, the Citizen Lab together with Access Now and other partner organizations uncovered a sophisticated phishing campaign against Russian opposition-in-exile, media organizations, and staff members at non-governmental organizations in the U.S. and Europe. The campaign relied on nuanced social engineering and phishing tactics that revealed the extensive preparations the perpetrators had invested in the attacks. The researchers attributed the attacks to two different groups of threat actors working in alignment with the interests of the Russian state and at least one of them linked to the Russian Federal Security Service (FSB).12

In another example, the independent news media Meduza, headquartered in Riga, reported a new surge in digital attacks. Besieged with requests, their website was slowed down until it became inaccessible to legitimate users. Attackers also tried to manipulate the organization’s payment system to undermine their funding and used inauthentic accounts to fake reviews of the organization and outreach from its staff members. Distributed-denial-of-service (DDoS) attacks and censorship of websites inside Russia are common pressure tactics applied against exiled civil society and news organizations.13

Moreover, Galina Timchenko, a co-founder of Meduza, had her iPhone infected with the Israeli NSO Group’s Pegasus spyware in February 2023.14 The surveillance tool gave the hackers access to the entire contents of her device including its microphone, camera, and memory. Around the time of the infection, Timchenko was scheduled to attend a meeting with other exiled journalists in Germany. Research into the attack concluded that a direct involvement of the Russian government was unlikely as NSO Group did not sell their products to Russia. Potential perpetrators ranged from one of the Baltic states or other European governments to Russian allies such as Azerbaijan.15 The incident revealed the risks and uncertainties of Russian exiles who suddenly found themselves in the crossfire of several states and their competing security interests. “Europe gives a feeling of complete security […] But it is only an illusion”, Timchenko commented in a statement after the incident.16

The research participants from Russia we interviewed for this report faced online harassment, sexist insults, shaming, defamation, and violent threats from regime affiliates and nationalist social media influencers. Several respondents described campaigns of mass reporting against their Instagram accounts and coordinated trolling. In particular, women belonging to indigenous communities were confronted with intersecting gender-based and racist attacks. Young men from these minorities fill the ranks of the Russian army in disproportionate numbers and two of the interviewed women mentioned the risk that male family members in Russia were drawn for military service in Ukraine in retaliation for their activism in exile.

Several research participants explained in interviews that the looming threats of digital harassment, espionage, and physical assaults from Russian state actors added to the difficulties of adapting to a new life in exile. They not only had to manage the daily intricacies of immigration, but also dealt with feelings of guilt for leaving others behind and for belonging to the aggressor country. Many still had relatives in the country or owned flats and even businesses that the state could use to pressure them. They compensated by throwing themselves into activism, risking burn-out and depression. The potential infiltration and surveillance of activist networks by Russian regime agents also led to mistrust, severed ties, and paranoia. These small and under-resourced communities of activists from Russia have been ill-equipped to deal with the mental fallout of these pressures and to provide support and protection against the threats of digital transnational repression.


  1. Nate Schenkkan and Isabel Linzer (2021), “Out of Sight, Not Out of Reach,” Freedom House

    <https://freedomhouse.org/sites/default/files/2021-01/FH_TransnationalRepressionReport2021_rev012521_web.pdf>.↩︎

  2. Tsypylma Darieva, Tatiana Golova, and Daria Skibo (2023), “Russian Migrants in Georgia and Germany: Activism in the Context of Russia’s War Against Ukraine,” ZOIS Centre for East European and International Studies <https://www.zois-berlin.de/fileadmin/media/Dateien/3-Publikationen/ZOiS_Reports/2023/ZOiS_Report_3_2023.pdf>.↩︎

  3. Andrei Soldatov and Irina Borogan (2023), “In From the Cold: The Struggle for Russia’s Exiles,” CEPA <https://cepa.org/comprehensive-reports/in-from-the-cold-the-struggle-for-russias-exiles>.↩︎

  4. Kirill Shamiev and Ksenia Luchenko (2024), “Life in Exile: A New Approach to Russian Democrats in Europe,” European Council on Foreign Relations <https://ecfr.eu/publication/life-in-exile-a-new-approach-to-russian-democrats-in-europe>.↩︎

  5. Yulia Gradskova (2023), “War represents a culmination in the continuum of patriarchal violence. A conversation with Alexandra Talaver, coordinator of Feminist-Anti-War-Resistance” Baltic Worlds <https://balticworlds.com/wp-content/uploads/2023/06/BW-2023.1_enkelsidor.pdf>.↩︎

  6. Laura A. Henry (2024), “Long After Indigenous Activists Flee Russia, They Continue to Face Government Pressure to Remain Silent,” The Conversation (January 16) <https://theconversation.com/long-after-indigenous-activists-flee-russia-they-continue-to-face-government-pressure-to-remain-silent-220133>.↩︎

  7. Meduza (2024), “How Russia Targets Its Critics Abroad in Wartime,”(February 5) <https://meduza.io/en/episodes/2024/02/05/how-russia-targets-its-critics-abroad-in-wartime>.↩︎

  8. Meduza (2023), “‘The Most Likely Explanation’ at Least Three Russian Journalists and Activists Appear to Have Been Poisoned Abroad since Fall 2022,” (August 15) <https://meduza.io/en/feature/2023/08/15/the-most-likely-explanation>.↩︎

  9. Meduza (2023), “‘I Want to Live — And That’s Why I’m Writing’ Russian Journalist Elena Kostyuchenko Precounts Surviving an Apparent Poisoning Attempt in Germany,”(August 15) <https://meduza.io/en/feature/2023/08/15/i-want-to-live-and-that-s-why-i-m-writing>.↩︎

  10. Committee to Protect Journalists (2023), “Two Prague-based Russian Journalists Threatened, Fear Surveillance,” <https://cpj.org/2023/09/two-prague-based-russian-journalists-threatened-fear-surveillance/>.↩︎

  11. Freedom House (2024), “TNR Watch: Transnational Repression for Hire,” <https://freedomhouse.org/article/tnr-watch/transnational-repression-hire>.↩︎

  12. John Scott-Railton, Rebekah Brown, Ksenia Ermoshina, and Ron Deibert (2024), “Rivers of Phish: Sophisticated Phishing Targets Russia’s Perceived Enemies Around the Globe,” The Citizen Lab <https://citizenlab.ca/2024/08/sophisticated-phishing-targets-russias-perceived-enemies-around-the-globe>.↩︎

  13. Meduza (2024), “Meduza is Facing the Most Intense Cyberattack Campaign in Its History,”(March 11) <https://meduza.io/en/feature/2024/03/12/meduza-is-facing-the-most-intense-cyberattack-campaign-in-its-history>.↩︎

  14. Meduza (2023), “‘The Million-Dollar Reporter’ How Attackers Hijacked the Phone of Meduza Co-founder Galina Timchenko, Making Her the First Russian Journalist to Be Infected with Pegasus Spyware,” (September 13) <https://meduza.io/en/feature/2023/09/13/the-million-dollar-reporter>.↩︎

  15. Natalia Krapiva and Rand Hammoud (2023), “Hacking Meduza: Pegasus Spyware Used to Target Putin’s Critic,” Access Now (September 13) <https://www.accessnow.org/publication/hacking-meduza-pegasus-spyware-used-to-target-putins-critic>.↩︎

  16. Committee to Protect Journalists (2023), “Investigation Finds Russian Journalist Galina Timchenko Targeted by Pegasus Spyware,” <https://cpj.org/2023/09/investigation-finds-russian-journalist-galina-timchenko-targeted-by-pegasus-spyware>.↩︎