TNR Watch July 30, 2026
TNR Watch: Cyberattacks as a Tactic of Digital Transnational Repression
A new report from Cloudflare, a company that provides cybersecurity services to internet providers, highlights the array of digital transnational repression tactics employed against exile media outlets and journalists.
Cat-and-mouse game: Exiled journalists and media outlets are exposed to malicious web activity at a rate four times higher than media organizations overall. This is one of the findings of a report recently released by Cloudflare based on data collected as part of the company’s Project Galileo, which offers free services to at-risk public interest groups. The report finds that around 5 percent of the 41 billion requests directed to exile journalism websites between February 2025 and January 2026 were harmful and sought to disrupt the outlets’ connections to their readers. Tactics employed to paralyze these platforms included distributed-denial-of-service (DDoS) attacks, website-vulnerability attacks, and phishing attempts; the sites were also made inaccessible via internet shutdowns.
While Cloudflare did not attribute these attacks on exiled media to governments or state-aligned actors, they mirror well-documented patterns of digital transnational repression. In December 2025, the Cuban outlet elToque, which is run by reporters in exile, contended with a significant DDoS attack and a website block in Cuba. The site developer connected the incident to elToque’s measurement of the informal currency market in the country, which exposed cracks in the government’s effort to strictly control the economy. On the anniversary of its designation by the Russian government as an “undesirable organization” in July 2025, the Amsterdam-based Moscow Times reported a similar DDoS attack. Cloudflare also helped the independent China Digital Times block an uptick in unauthorized requests to the outlet’s site in November 2025, which could have revealed the identities of staff members who prefer to remain anonymous to reduce threats to themselves and their families.
A Persistent Problem: Cloudflare’s findings are consistent with Freedom House’s research on the digital and physical intimidation of exiled journalists. In a 2023 report, Freedom House traced incidents of physical transnational repression against journalists to at least 26 governments. Digital threats regularly force small newsrooms to dedicate limited resources to constantly reassessing safety measures and determining ways to protect themselves from cyberthreats. Fears of surveillance fray bonds between journalists and their sources back home. Abusive messages, many that direct gendered abuse at women journalists, exact a toll on the mental health of prominent voices.
Fighting Back: Support for exiled media is essential. Cloudflare’s Project Galileo, Google’s Project Shield, the Common Good Cyber Fund, and similar initiatives provide crucial cybersecurity services and training to vulnerable organizations and outlets. But bad actors are constantly developing new tactics and employing emergent technologies like AI to target activists and journalists. This means that systematic, government-funded support and training is needed to combat the threat posed globally by digital transnational repression.
Facts Only
* Exiled journalists and media outlets are exposed to malicious web activity at a rate four times higher than media organizations overall.
* Approximately 5 percent of 41 billion requests directed to exile journalism websites between February 2025 and January 2026 were harmful and sought to disrupt connections to readers.
* Tactics included distributed-denial-of-service (DDoS) attacks, website-vulnerability attacks, phishing attempts, and internet shutdowns.
* The Cuban outlet elToque contended with a significant DDoS attack and a website block in Cuba in December 2025.
* The site developer connected the elToque incident to measurement of the informal currency market.
* The Moscow Times reported a similar DDoS attack on the anniversary of its designation as an “undesirable organization” by the Russian government in July 2025.
* Cloudflare helped block unauthorized requests to the China Digital Times site in November 2025.
* Freedom House traced physical transnational repression against journalists to at least 26 governments in a 2023 report.
Executive Summary
Full Take
The consistent deployment of cyberattacks, DDoS, and access blocks against exiled media outlets reveals a systemic strategy for digital transnational repression that extends beyond traditional state control. The link drawn between technical disruptions—such as blocking information or disrupting economic signaling in Cuba—and political objectives suggests that digital infrastructure is being weaponized to enforce geopolitical control. This operational reality is reinforced by the observation that these digital threats mirror physical intimidation tactics faced by journalists, demonstrating a unified approach to silencing dissent regardless of physical location. The focus on privacy and security for exiled journalists highlights how digital vulnerability directly impacts the ability to operate as sources and convey information safely. The call for systematic, government-funded support suggests that countering this repression requires institutional recognition, moving beyond ad-hoc cybersecurity measures to address the underlying structural imbalance. The emergent use of AI in these tactics suggests an escalation in the sophistication of these operations, demanding a parallel evolution in defense strategies to maintain cognitive sovereignty for those operating outside established power structures.
Bridge Questions: If digital attacks are proven transnational repression, what mechanisms exist for international legal accountability against state or non-state actors utilizing these methods? How can support initiatives like Project Galileo be scaled to provide sustainable, resilient defenses against evolving threats without creating new surveillance vectors? What frameworks are necessary to protect the digital autonomy of journalists operating in contested spaces?
Sentinel — Human
This text reads like a well-researched synthesis of cybersecurity reports and human rights findings, effectively linking digital repression tactics to documented patterns of physical intimidation.