Transnational Repression: Mission Domain Intelligence Guide

A dissident's family is visited at home, an INTERPOL notice appears, and a spyware link arrives by messenger, all within a fortnight. That is one campaign, not three coincidences.

What Transnational Repression covers as a mission domain

Transnational repression intelligence covers the actions states take beyond their borders to silence, control or punish diaspora communities, exiles, journalists, activists and political opponents. It spans surveillance and commercial spyware deployment, coercion by proxy against relatives in the origin country, abuse of INTERPOL notices and extradition requests, harassment and disinformation campaigns, forced returns and renditions, consular intimidation, assault and assassination, and the co-option of community organisations. Analysts document these campaigns, attribute them where the evidence allows, and support targets with protective advice and routes to legal remedy.

Perpetrators range from intelligence services and diplomatic missions to state-linked media, contracted spyware vendors, proxy criminal groups and diaspora organisations operating under direction. Tactics form a graduated repertoire: online harassment and smear campaigns at the low end, digital surveillance and misuse of legal instruments in the middle, and abduction or lethal force at the extreme. Targets are frequently multiply exposed as journalists, minority community members and relatives of people still inside the country.

Why it matters

Transnational repression exports authoritarian control into democracies and defeats the protection that asylum is meant to provide. Its practical effect is self-censorship: exiled journalists stop reporting, activists withdraw, and communities begin policing themselves. Host states are often slow to recognise the pattern because each individual incident looks like a minor crime or a private dispute, which leaves targets without recourse while the campaign continues and escalates.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Relatives in the origin country summoned, detained or dismissed from employment shortly after a target publishes or speaks publicly.
• Sudden appearance of a Red Notice or extradition request based on fraud, terrorism or extremism charges filed years after the target left.
• Targeted spyware or phishing delivered in messages referencing the target's actual work, appointments, contacts or pending legal matters.
• Coordinated smear campaigns combining state-aligned media and inauthentic accounts, timed to advocacy activity or an asylum hearing.
• Consular obstruction such as refusal to renew passports or register births, used to render an exile administratively stateless.
• Surveillance of community events, photography of attendees, and subsequent approaches by embassy-linked figures.
• Repatriation or amnesty offers accompanied by expressions of concern for family welfare that function as threats.
• Physical surveillance, break-ins where devices are taken but valuables are not, or vehicle interference reported by several targets in one city.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Freedom House transnational repression research — Documented case database and country-level typologies of extraterritorial coercion and its methods.
• Citizen Lab — Technical forensic reporting on commercial spyware deployment against civil society targets.
• Amnesty International Security Lab — Forensic methodology and case documentation for mobile device compromise investigations.
• Committee to Protect Journalists and Reporters Without Borders — Case records of journalist harassment, detention and targeting in exile, by state.
• Fair Trials and the INTERPOL Commission for the Control of Files — Analysis of politically motivated notice abuse and the routes available to challenge it.
• Safeguard Defenders — Documentation of overseas policing operations, involuntary returns and coercion-by-proxy campaigns.
• US DOJ and European prosecutorial indictments — Charged cases naming officers, proxies and the specific methods used in individual operations.
• Access Now and digital rights organisations — Incident reporting, helpline data and analysis of shutdowns and targeted surveillance.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Trauma-informed intake — Interview the target with an interpreter they choose, establishing timeline, family exposure and prior reporting without pressing for unsafe detail.
2. Assemble the incident set — Collect every incident across digital, legal, physical and family domains, because the pattern rather than any single event evidences the campaign.
3. Refer for forensic assessment — Send devices to a qualified forensic partner for spyware analysis, preserving state and avoiding any action that destroys artefacts.
4. Test the legal instruments — Examine any notice, extradition request or charge for political motivation indicators and prepare a challenge to the appropriate body.
5. Attribute carefully — Link tactics to services, proxies or contractors using technical infrastructure, procurement records, indictments and comparative case patterns.
6. Protective planning — Deliver practical measures covering device hardening, account security, travel decisions, family contact protocols and host-state reporting routes.
7. Escalate and archive — Support reporting to host law enforcement, regulators and rapporteurs while archiving material for future litigation or sanctions submissions.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Practised with these disciplines

• Human Intelligence — Information from People, Ethically Obtained
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Identity Intelligence — Resolving and Verifying Who Someone Is
• Government Intelligence — Government Structures, Policy, and Officials
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Disinformation Intelligence — Detecting and Analyzing Information Manipulation
• Telephony Intelligence — Phone Numbers, Networks, and Telephony Data

Worked in these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Phone Number — Telephone number for voice, SMS, or messaging identification.
• Device / Advertising ID — A mobile advertising or device identifier used in adtech data to track and locate devices.
• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.
• Messaging Handle — An identity on a messaging platform (Telegram, Signal, Discord) used for coordination and sales.
• Biometric Identifier — Face, fingerprint, iris, gait, or voice templates used for identification — most sensitive PII class.

Adjacent mission domains

• Nation State
• Extremism & Radicalization
• Corruption & Governance
• Conflict & Humanitarian
• Border Security & Migration
• Election Security & PSYOP

Inside the platform: where Transnational Repression lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• domain.php?d=repression — Transnational Repression dashboard
• theater.php?d=repression — Threat theater view
• search.php — Person / Name profile
• phone-profile.php — Phone Number profile
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

Relevant playbooks

Of the 14 incident playbooks in playbooks.php, these apply directly to Transnational Repression:

• Disinformation / Influence Op Response — a step-checked workflow with the pivots, sources and handling rules already wired in.
• Insider Threat Review — a step-checked workflow with the pivots, sources and handling rules already wired in.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Threat Hunt
• Correlate Infrastructure
• Run Alert Rules
• Score Country Risk
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Trauma-informed intake is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Refer for forensic assessment turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Escalate and archive feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Transnational Repression

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Direct military relevance is limited, but two areas matter. First, personnel security: service members from diaspora communities, and their relatives abroad, can be targeted by foreign services seeking leverage, which is a counterintelligence and welfare issue. Second, defence attaches and deployed personnel in states practising transnational repression operate in an environment where surveillance and coercion of local staff is routine, which affects how local employment and contact management are handled. Products feed personnel security policy and duty of care. Constraints include the fact that this is fundamentally a civilian law enforcement and human rights matter, and military involvement in cases concerning civilians in the home state is generally inappropriate.

🕵 National intelligence

National services assess foreign state activity against residents and citizens, which is both a counterintelligence problem and a sovereignty violation. Requirements ask which services and proxies are operating, through which channels, against whom and with what capability, including which commercial spyware is in use. Fusion combines technical forensics, human reporting, diplomatic monitoring, immigration data and open-source analysis. Handling must protect targets absolutely, since exposure of a target's cooperation can endanger relatives in the origin state. Dissemination priorities are law enforcement, protective security advice to targets, diplomatic response including expulsions, and sanctions designation processes.

👮 Law enforcement

Cases are difficult because the conduct spans jurisdictions and the perpetrators frequently have immunity or are beyond reach. Charging usually proceeds against local proxies for harassment, stalking, assault, computer misuse or acting as an unregistered foreign agent. Evidence includes device forensics establishing spyware infection, communications with handlers, financial payments, surveillance logs and victim testimony. Legal process for foreign platform and infrastructure records is slow. Victim confidence is the binding constraint, since targets frequently will not report for fear of consequences to family abroad, so protective measures and credible non-disclosure assurances precede any evidence gathering.

🔍 Private investigation and corporate security

Corporate and private practitioners encounter this through client protection work for exiled businesspeople, journalists and activists, and through due diligence where a client is the subject of a state-driven legal campaign. The deliverable is a threat picture and a protective plan covering digital, physical and legal dimensions. A private actor must not accept instructions that amount to locating or profiling a dissident, which is the demand side of this problem, and should have a documented process for declining and reporting such approaches. Reputation management work for state-linked clients targeting critics raises the same issue directly.

📰 Journalism and OSINT media

Reporting requires unusual source protection, because the sources are the targets and their families in the origin state are the leverage. Verify spyware claims through forensic analysis by a qualified laboratory rather than by inference from device behaviour. Corroborate coercion-by-proxy accounts, which are frequently reported second-hand and are difficult to confirm without endangering relatives. Be precise about attribution, distinguishing a state's service, a state-linked contractor and an enthusiastic diaspora group. Provide right of reply to states and companies, expect legal intimidation, and plan for the possibility that the reporting team is itself targeted.

🌍 NGO, humanitarian and human rights

This is a core human rights practice area. Work covers documentation, direct support to targets, digital security assistance, litigation and advocacy for policy response. Practice must be target-centred: the person's assessment of their own risk and their family's exposure governs everything, including whether documentation happens at all. Do-no-harm means never publishing detail that identifies relatives in the origin country, and recognising that a public campaign can escalate pressure on them. Duty of care is acute, since organisations in this field are themselves targeted with spyware, litigation and infiltration, and staff with family in the origin state carry personal exposure.

🎓 University and research

Research covers authoritarian practice beyond borders, diaspora politics, spyware proliferation and the effectiveness of state responses. Methodology must handle underreporting, since targets frequently do not report and datasets therefore capture the most visible cases. Ethics approval is essential and should address the specific risk that participation endangers relatives abroad, with protocols for consent, withdrawal and data security that assume a capable state adversary. Reproducibility should be balanced against the need to withhold anything identifying. Researchers should assume they are themselves potential targets and should apply the same digital security practices they study.

Playbook: working Transnational Repression end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish the target's own risk picture first

Begin with the person, not the incident. Establish who they are, what they do, who remains in the origin country, what has already happened, and what they most fear. Their assessment of risk to family governs what can safely be documented or published. Output is a target-led risk statement, recorded with their consent and revisited as things change. Stop when the person has defined what outcomes they want and what they will not accept.

Phase 2 — Build the incident chronology

Assemble every incident in one timeline: online harassment, phishing, suspicious messages, visits to relatives, legal notices, consular problems, following, surveillance, threats and physical incidents. Campaigns look like coincidences until they are laid out chronologically, and the pattern is usually what convinces both the target and any authority. Output is a dated chronology with sources and corroboration status.

Phase 3 — Assess the digital dimension forensically

Where spyware or account compromise is suspected, route to a qualified forensic laboratory rather than attempting inference from device behaviour, which produces both false positives and false reassurance. Preserve the device state, avoid factory resets that destroy evidence, and manage the target's expectations about what analysis can establish. Output is a forensic finding with its confidence, or a documented negative result.

Phase 4 — Map the coercion-by-proxy dimension

Establish what has happened to relatives in the origin country: visits by security services, detention, employment loss, property seizure, travel bans or pressure to make public statements. This is the most effective and least visible instrument in the repertoire, and it constrains what the target can do. Document with extreme care, since specificity here can identify the relatives concerned.

Phase 5 — Examine misuse of legal instruments

Check for abusive INTERPOL notices or diffusions, politically motivated extradition requests, in absentia convictions, asset freezes, passport revocation, and civil defamation actions in permissive jurisdictions. These are formal, documented and challengeable, which makes them one of the more actionable strands. Output is a legal exposure assessment with the challenge routes identified.

Phase 6 — Attribute carefully and by layer

Distinguish direct state action, contracted commercial capability, proxy criminal actors and state-aligned diaspora organisations, since each implies different responses. Base attribution on technical infrastructure, financial links, tasking patterns and corroborated human reporting rather than on plausibility. Record confidence separately for each element. Stop when you can state what would falsify the attribution.

Phase 7 — Connect the incidents into a campaign picture

Test whether apparently separate incidents share timing, targeting logic, infrastructure or tasking. Campaigns typically escalate through a graduated repertoire, so identifying where a target sits on that ladder supports prediction. Compare against other targets in the same community, since campaigns are rarely against one person. Output is a campaign assessment with the linkage evidence shown.

Phase 8 — Deliver protective measures now

Do not wait for analytical completeness. Provide immediate practical support: device hardening, account security, communication practice, physical security advice, and guidance on contact with relatives that reduces rather than increases their exposure. Protective action is the deliverable that matters most to the person and it should run in parallel with everything else.

Phase 9 — Identify the available remedies

Match findings to routes: police report, INTERPOL notice challenge through the commission for control of files, asylum or protection claim evidence, sanctions designation nomination, foreign agent registration enforcement, platform action against harassment networks, or civil action against a spyware vendor. Output is a remedy map with the evidence each requires and the risks each carries for the target.

Phase 10 — Support the reporting decision honestly

Many targets will not report to authorities, and that is frequently a rational decision given the consequences for family and their experience of official responses. Set out what reporting would involve, what protection is realistically available and what the likely outcome is, without pressure. Document their decision. Respect a decision not to proceed, including when you believe the case is important.

Phase 11 — Aggregate for policy without exposing anyone

Build community-level and country-level pattern evidence from many cases, stripped of identifying detail, to support policy change: foreign agent registration, spyware export controls, INTERPOL reform, victim support funding and diplomatic response. Individual cases rarely change policy; documented patterns across a community do. Stop when the aggregate could be published without any individual being identifiable.

Phase 12 — Protect the responders

Assume the organisation and its staff are themselves targets. Apply the digital security practices being recommended to clients, compartment case data, plan for litigation and infiltration attempts, and support staff with family in the origin state who carry personal exposure. This is an operational requirement in this domain, evidenced by repeated documented targeting of the organisations doing this work.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Citizen Lab	Open	Technical research on commercial spyware, targeted digital espionage against civil society and censorship technology.	Primary reference for spyware capability, infection indicators and documented targeting of exiled individuals.
Amnesty International Security Lab	Open	Forensic investigation of spyware infections against activists and journalists, with published methodology and tooling.	Provides forensic analysis capability and the documented methodology for establishing device compromise.
Freedom House transnational repression research	Open	Global tracking of transnational repression incidents by origin state and tactic, with country case studies.	Supplies the comparative dataset and typology for assessing a state's repertoire and pattern of activity.
Access Now digital security helpline	Open	Direct digital security support to civil society, plus research and advocacy on internet shutdowns and surveillance.	Route for immediate protective support to targets and source of incident pattern data.
Front Line Defenders	Open	Protection support for human rights defenders at risk, with case documentation and emergency assistance.	Provides protection casework, relocation support and documented case history for defenders under threat.
Committee to Protect Journalists	Open	Case records on journalists imprisoned, killed or under threat, including exiled journalists targeted abroad.	Establishes precedent and pattern where the target is a journalist and supports advocacy responses.
Reporters Without Borders	Open	Press freedom monitoring, country indices and case advocacy including surveillance of exiled media workers.	Supplies country press freedom context and case support routes for targeted media professionals.
Fair Trials	Open	Research and casework on abuse of INTERPOL systems and extradition, including challenge mechanisms.	Provides the practical route and precedent for challenging politically motivated notices and requests.
INTERPOL Commission for the Control of Files	Open	Independent body handling requests for access to and deletion of data held in INTERPOL systems.	The formal mechanism through which an abusive notice or diffusion can be challenged and removed.
OHCHR special procedures	Open	Special Rapporteur reporting on human rights defenders, privacy, torture and extrajudicial execution with communications to states.	Provides an international accountability route and authoritative legal analysis of state conduct abroad.
Human Rights Watch and Amnesty International reporting	Open	Country and thematic investigations documenting repression, forced returns and surveillance of exiles.	Supplies corroborating documented cases and country context for assessing a specific campaign.
Privacy International	Open	Research and litigation on state surveillance capability, surveillance industry exports and data exploitation.	Documents the surveillance supply chain and export routes behind capability observed against targets.
Electronic Frontier Foundation	Open	Technical and legal analysis of surveillance, security research protection and digital rights litigation.	Provides technical explanation and legal precedent relevant to spyware and platform accountability.
Article 19	Open	Freedom of expression research and legal analysis, including transnational censorship and legal harassment.	Supports analysis of abusive legal actions used to silence critics across borders.
OFAC and allied human rights sanctions programmes	Open	Designations under human rights authorities targeting individuals and entities responsible for serious abuses.	Identifies existing designations and provides the route for nominating perpetrators of transnational repression.
Forensic Architecture	Open	Investigative research using spatial and media analysis to reconstruct incidents of state violence.	Supplies methodology for reconstructing physical incidents where official accounts are contested.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Transnational Repression. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Mobile Verification Toolkit and forensic analysis tooling — Examines device artefacts for indicators of known spyware families. Limitation: absence of indicators does not prove absence of infection, and interpretation requires expertise.
• Secure messaging and hardened device configurations — Reduce interception and compromise risk for targets and responders. Limitation: sophisticated implants defeat transport encryption at the endpoint.
• Account security and authentication hardening — Hardware keys and account recovery review close the most common compromise routes. Limitation: recovery pathways through telecoms remain a persistent weakness.
• Structured incident chronology tools — Assemble scattered incidents into a pattern that supports assessment and reporting. Limitation: depends on the target recalling incidents they had dismissed as coincidence.
• Network and infrastructure analysis platforms — Link phishing infrastructure and harassment networks across campaigns. Limitation: commercial spyware infrastructure is designed to resist exactly this analysis.
• Case management with strict compartmentation — Protects target identity and family detail with role-based access. Limitation: small organisations frequently cannot implement meaningful separation of access.
• Open-source monitoring for harassment campaigns — Detects coordinated online attacks and doxxing directed at a target. Limitation: closed platforms and private groups carry much of the activity.
• Legal challenge tracking for notices and extraditions — Manages the formal processes for contesting abusive legal instruments across jurisdictions. Limitation: processes are slow and outcomes rarely public.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Threat Hunt — Runs saved hypotheses against the corpus and surfaces what matches, with the query preserved as a versioned artifact.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Run Alert Rules — Evaluates saved rules against new data so a first sighting raises a notification rather than waiting for review.
• Score Country Risk — Recomputes country risk from the weighted inputs and snapshots the result so movement over time is measurable.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The target defines the risk, not the analyst. Their family in the origin country is the leverage, and only they can weigh the consequences of documentation or publicity, so any product or campaign designed over their objection is a harm however well intentioned.
• Build the chronology before assessing anything. Individual incidents are deniable and are frequently dismissed by the target themselves as coincidence, and it is the sequence, timing and escalation across digital, legal, family and physical strands that establishes a campaign.
• Never infer spyware infection from device behaviour. Battery drain, heat and odd notifications generate both false alarm and false reassurance, and only qualified forensic analysis can establish compromise, so route it to a laboratory and preserve the device state meanwhile.
• Coercion by proxy is the most effective instrument in the repertoire and the least visible in datasets. A visit to a parent in the origin country silences a target more reliably than any surveillance, and it leaves no trace in any system the destination state can see.
• Abusive legal instruments are the most actionable strand. Notices, extradition requests and in absentia convictions are formal, documented and challengeable through defined mechanisms, unlike surveillance and harassment, which are difficult to attribute and harder to remedy.
• Attribute by layer. Direct service action, contracted commercial capability, criminal proxies and enthusiastic diaspora organisations produce similar effects and require completely different responses, and collapsing them into the state weakens both the analysis and any remedy sought.
• Assume you are a target. Organisations doing this work are repeatedly and demonstrably targeted with spyware, litigation, infiltration and harassment, and the security practices recommended to clients must be applied internally first or the case data itself becomes the vulnerability.
• Respect a decision not to report. Many targets rationally conclude that engaging authorities will not protect them and may endanger relatives, and a practitioner who overrides that judgement because the case matters analytically has substituted their own risk tolerance for the person carrying the consequences.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Transnational Repression is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of supported targets who receive protective measures within a defined period of first contact, independent of case progress.
• Number of abusive INTERPOL notices, extradition requests or legal actions successfully challenged or withdrawn.
• Proportion of suspected spyware cases routed to qualified forensic analysis rather than assessed by inference.
• Documented cases aggregated into country-level pattern evidence without any individual becoming identifiable.
• Policy outcomes achieved, such as export control action, designations, foreign agent enforcement or dedicated victim support provision.
• Reporting rate among affected communities, tracked as an indicator of trust in the response, alongside stated reasons for non-reporting.
• Zero incidents of family exposure or escalation attributable to the organisation's documentation or publication decisions.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Assessing incidents individually, which makes each look like ordinary crime or a personal dispute and conceals the campaign behind them.
• Assuming a target is safe once relocated, when second and third countries are chosen precisely because protection is weaker there.
• Discounting an account because trauma has affected chronology or recall, which is a normal effect rather than evidence of fabrication.
• Attributing spyware to a state solely because a vendor sells to it, when deployment attribution requires infrastructure and targeting evidence.
• Publishing case detail that identifies family members still inside the origin country, which transfers the risk directly onto them.
• Treating an INTERPOL notice as a reliable indication of criminality when abuse of the system is extensively documented.

Legal and ethical considerations

Targets are frequently asylum seekers or refugees whose data is protected and whose disclosure can prejudice claims or endanger relatives, so consent, minimisation and secure storage are non-negotiable. Device forensics requires informed consent and a qualified examiner if the findings are to be usable in any proceeding. Naming state officers carries litigation and diplomatic risk and must rest on documented evidence. Coordinate all publication with the target: the decision to go public is theirs, and it changes their risk profile permanently.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Transnational Repression, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 7 intelligence disciplines, 7 data points, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How do you establish that separate incidents are one campaign?

Chronology and convergence. Lay every incident on a single timeline, including the ones the target dismissed: a phishing message, a strange call, a relative's summons, a legal notice, someone photographing a house. Campaigns escalate through a graduated repertoire and the incidents cluster around triggers such as a publication, a court date or a diplomatic event. Then test for shared elements: infrastructure between phishing attempts, the same proxy individuals, timing correlated with the origin state's working hours. Comparing against other targets in the same community is often decisive, since campaigns are almost never directed at one person alone.

Can you tell whether a phone has spyware on it?

Only through proper forensic analysis, and even then the answer is often qualified. Consumer symptoms such as battery drain, heat or unusual behaviour are unreliable in both directions and have caused both unnecessary alarm and false reassurance. Qualified laboratories examine device artefacts for indicators associated with known implant families, which can establish infection with high confidence when found. A negative result means indicators were not found, not that the device is clean, particularly for implants that leave minimal traces. Preserve the device rather than resetting it, since a factory reset destroys the evidence.

What can actually be done for a target?

More than most people assume, though rarely a complete solution. Immediate digital hardening and account security close the most common attack routes. Legal challenge to abusive notices and extradition requests works through defined mechanisms and has a real success rate. Asylum and protection claims can be supported with documented evidence of targeting. Physical security advice, relocation support and community connection reduce exposure. And the pattern evidence contributes to sanctions designations and policy change. What cannot usually be delivered is protection for relatives in the origin state, which is why their exposure governs every other decision.

How should the diaspora organisation dimension be handled?

Carefully and specifically, because this is where analysis most easily becomes harm. Some community organisations do operate under direction and participate in surveillance and intimidation, and that is documented. Many others are simply communities, and treating diaspora institutions as presumptively suspect replicates the profiling that targets these populations in the first place. The standard should be evidence of specific conduct and specific direction, not affiliation or political alignment. Getting this wrong damages the communities the work is meant to protect and undermines the credibility of the well-founded cases.

Why do targets so often not go to the police?

Because the calculus rarely favours it. Reporting can trigger retaliation against relatives in the origin state, and destination-state police frequently lack the training to recognise the pattern, treating a harassment campaign as isolated incidents or a civil matter. Some targets have immigration status precarious enough that any official contact is risky. Others come from states where police are the perpetrators and the instinct is well founded. The practical response is to build police capability and dedicated points of contact, provide credible assurance about how information will be handled, and accept that a target's refusal to report is often the correct assessment of their own situation.

What policy measures make a difference?

The measurable ones are export controls and sanctions against commercial spyware vendors, which have visibly constrained parts of the market; foreign agent registration enforcement, which creates a chargeable offence where the underlying conduct is hard to prosecute; INTERPOL reform and effective challenge mechanisms, which remove the most formal instrument of harassment; and dedicated victim support with trained points of contact in law enforcement. Diplomatic responses including expulsions impose cost. What consistently fails is treating incidents as ordinary crime without recognising the state dimension, which produces case-by-case responses to a coordinated campaign.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• International Covenant on Civil and Political Rights, particularly the rights to life, privacy, expression and freedom from arbitrary interference, which apply extraterritorially in relevant circumstances.
• UN Guiding Principles on Business and Human Rights, applied to surveillance technology vendors and their duty to prevent misuse.
• INTERPOL Constitution article 3 and the Rules on the Processing of Data, prohibiting activity of a political character and governing notice challenges.
• UN Declaration on Human Rights Defenders, setting out state obligations to protect defenders including those in exile.
• 1951 Refugee Convention non-refoulement obligations, which constrain forced return and are engaged by extradition requests against refugees.
• Vienna Convention on Consular Relations, which defines the lawful limits of consular activity and is breached by intimidation of nationals abroad.
• Foreign agent registration regimes such as the US FARA and the UK foreign influence registration scheme, creating disclosure obligations for those acting for foreign principals.
• Global Magnitsky-style human rights sanctions authorities, enabling designation of individuals responsible for serious human rights abuse abroad.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. Research on commercial spyware and targeted digital espionage — Citizen Lab, University of Toronto. Technical documentation of spyware capability and civil society targeting.
2. Forensic methodology for spyware investigation — Amnesty International Security Lab. Published forensic approach and tooling for establishing device compromise.
3. Transnational repression global tracking — Freedom House. Comparative dataset and typology of cross-border repression tactics by state.
4. Research on INTERPOL abuse and extradition — Fair Trials. Analysis and casework on politically motivated notices and challenge routes.
5. Commission for the Control of Files procedures — INTERPOL. Formal mechanism for challenging and deleting abusive notices and diffusions.
6. Special procedures communications and reports — UN Human Rights Office. International accountability route and legal analysis of extraterritorial abuse.
7. Digital security support and surveillance research — Access Now. Direct assistance to targeted civil society and incident pattern research.
8. Surveillance industry and export research — Privacy International. Documentation of the surveillance technology supply chain and export routes.
9. Case documentation on threats to journalists in exile — Committee to Protect Journalists. Records of targeting of exiled media workers by origin states.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: connects digital, legal, physical and family-directed incidents into one attributable campaign picture. Explore the platform, or browse the rest of the library by following any tag above.