How the channels connect
Person or adviser
Examine the devices and accounts that may have been targeted.
Device examination
Identify the information and professional relationships exposed.
Legal and travel context
Separate technical findings from conclusions about who commissioned the access.
Does the evidence establish targeting, successful access or an attributable operator—and which remains unknown?
These pathways describe methods and investigative questions. They are not a prediction of escalation or a finding about a particular individual. A shared method does not identify an actor.
Methods covered in this profile
Surveillance & tracking
Concerns may involve observation, unwanted approaches or exposure of movements and private information.
What the investigation needs to establish
Assess specific incidents, available records and alternative explanations. An unfamiliar person or vehicle alone does not establish surveillance.
Investigative assessment, fieldwork and technical examination where appropriate.
Coerced return & travel pressure
A demand to return, an unusual invitation or pressure involving a third country may need to be examined in its full personal and legal context.
What the investigation needs to establish
The invitation, correspondence, identities, itinerary and any associated demands are assessed together.
Investigation of the approach and coordination with relevant legal and protective specialists.
Legal pressure
Allegations, proceedings or demands may need investigation for political motivation, factual accuracy or connections to wider intimidation.
What the investigation needs to establish
Build a record of the allegation, its evidential basis, procedural history and associated communications.
Investigative support for counsel, including records, chronology and corroborating enquiries.
Digital intrusion & exposure
Account access, targeted phishing, device concerns or publication of private information may affect both a person and their contacts.
What the investigation needs to establish
Technical findings must distinguish a suspicious message, a targeting attempt and evidence of compromise.
Digital examination, incident reconstruction and coordination of practical security improvements.
Research basis
This country summary draws on TROM State MO Profiles, pages 22–23, and the TROM Operational Matrix, March 2026. Historical examples and reported patterns require case-specific corroboration; the profile is not a live threat bulletin.
Freedom House’s independent transnational repression research ↗