How the channels connect
Platform or device
Establish what information was accessed and by whom.
Private contacts
Identify which contacts or locations that access could expose.
Personal exposure
Examine whether subsequent approaches relied on that information.
Does an approach reveal information that was private, and can its source be established?
These pathways describe methods and investigative questions. They are not a prediction of escalation or a finding about a particular individual. A shared method does not identify an actor.
Methods covered in this profile
Physical threats & violence
Threats of violence, assault or attempted abduction require an assessment of immediate safety alongside investigation of the incident.
What the investigation needs to establish
Threat messages, witness accounts, incident records and relevant footage can help establish what happened and what requires urgent attention.
Personal threat assessment and coordination of appropriate protective support.
Pressure on relatives
Pressure can be applied to someone abroad through relatives who remain in another country, including demands, questioning or threats to employment and property.
What the investigation needs to establish
Record what was communicated, when, by whom and whether demands referred to the person’s activities abroad. Connections need evidence rather than assumption.
A chronology of the pressure, corroboration where possible and a coordinated assessment of the people affected.
Digital intrusion & exposure
Account access, targeted phishing, device concerns or publication of private information may affect both a person and their contacts.
What the investigation needs to establish
Technical findings must distinguish a suspicious message, a targeting attempt and evidence of compromise.
Digital examination, incident reconstruction and coordination of practical security improvements.
Reputation & information campaigns
Repeated allegations, impersonation or coordinated exposure may require analysis of how information originated and spread.
What the investigation needs to establish
Preserve the content, dates and distribution. Similar messages alone do not establish common control.
Source and network analysis, an evidence chronology and assessment of substantiated connections.
Academic & corporate pressure
Institutions may encounter pressure concerning researchers, employees, speakers or the publication of work.
What the investigation needs to establish
Compare the demand, the decision-making record and any stated consequences with the wider sequence of events.
Institutional investigations, staff-support assessments and evidence for decision-makers.
Research basis
This country summary draws on TROM State MO Profiles, pages 12–14, and the TROM Operational Matrix, March 2026. Historical examples and reported patterns require case-specific corroboration; the profile is not a live threat bulletin.
Freedom House’s independent transnational repression research ↗