A note on funding (September 2026): CypherpunkGuide carries no surveillance advertising — no ad networks, tracking pixels, or sponsored content. Some articles contain clearly disclosed affiliate links, through which we may earn a commission. This article contains no affiliate links and does not recommend a hosting provider.
Correction: An earlier version presented foreign infrastructure as a more durable defense than identity protection, linked HKLeaks directly to later police bounties without evidence, and described a military interception of Ryanair flight FR4978. Those claims have been corrected. We have also removed claims that gendered abuse inevitably follows doxxing.
An activist can be publicly known while keeping their home address private. A website can remain online while its author faces danger. Moving the website does not move the author’s relatives, erase government records, or settle the legal risks of travel.
That distinction matters when a government pursues critics abroad. Freedom House’s 2026 report records 1,375 incidents of direct, physical transnational repression during 2014–2025, involving at least 54 governments. This is the organization’s documented dataset, not a count of every digital attack or everyone at risk. (Freedom House)
This article separates what the case records establish from the precautions we can reasonably draw from them. Its decision worksheet maps different harms to different responses. It is an editorial framework, not a measured safety score or a promise that a control would have prevented a historical attack.
Doxxing Is One Part of a Wider Threat#
Doxxing exposes personal information in a way that can enable harm. Transnational repression is broader: a state pursues people beyond its borders through intimidation, surveillance, coercion, or physical action. A public leak can contribute to that pressure, but repression does not require one.
Citizen Lab’s HKLeaks research documents a campaign that published personal details. The Belarus flight diversion and the US prosecution discussed below document different mechanisms. Calling all three proven doxxing chains would conceal a crucial uncertainty: we often do not know how authorities first obtained a particular piece of information.
Keep three questions separate when assessing your own situation:
- Personal safety: Can someone reach, threaten, detain, or pressure you or people close to you?
- Identity privacy: What connects your publishing activity to your legal identity, contacts, or location?
- Publication continuity: What would let readers recover your work if an account, domain, or host disappeared?
A useful measure may address only one of these. That is a reason to define its limits, not to abandon it.
Three Case Records, Different Mechanisms#
The records below support different conclusions about state reach. They do not establish one universal path from a leaked identity to an arrest, or show that moving a server would have prevented the harm.
Belarus: a flight diverted by a false bomb threat#
On 23 May 2021, Ryanair flight FR4978, flying from Athens to Vilnius, diverted to Minsk after receiving false bomb-threat information while in Belarusian airspace. Roman Protasevich and Sofia Sapega were detained after landing.
ICAO’s final investigation distinguishes that diversion from a military interception. A MiG-29 took off, but no military escort or interception occurred in Belarusian airspace. The crew reported no communication, interaction, or sighting of the military aircraft. ICAO places the fighter about 55 kilometres away when the passenger aircraft landed. (ICAO, sections 3.9.2 and 3.9.5)
This case illustrates a physical travel risk. The cited record does not establish that an activist’s public posting schedule revealed the itinerary. It cannot support a claim that scheduling posts, using a stronger pseudonym, or changing a host would have prevented the detention.
Hong Kong: a doxxing campaign, later bounties, and family pressure#
Citizen Lab found that HKLeaks exposed approximately 2,800 people, with active maintenance from August 2019 to May 2021. Its investigation found coordination, resources, and links to mainland China inconsistent with the network’s grassroots presentation. It assessed government involvement or support as likely on circumstantial evidence; it did not conclusively identify the operator. (Citizen Lab)
Separately, Hong Kong police announced warrants for eight overseas activists in July 2023, with HK$1 million offered for information about each person. Human Rights Watch also documented questioning of exiles’ relatives in 2025, including Frances Hui’s parents on April 10. (HRW, July 2023; HRW, May 2025)
These are distinct documented forms of repression. The sources reviewed here do not establish that HKLeaks supplied the information used for the later warrants or family questioning. Treat relatives’ safety as a separate concern, without assuming that every relationship can or should be hidden.
China-related surveillance in the United States: abuse of personal trust#
In August 2024, a US federal jury convicted Shujun Wang of offenses including acting as an agent of a foreign government without notifying US authorities. The US Department of Justice described how he used his position in a pro-democracy organization to collect information about activists for China’s Ministry of State Security, including details from private conversations. (US Department of Justice)
This case concerns access through relationships. It does not establish a domain registrar or hosting failure. Our practical inference is to limit unnecessary sharing of sensitive details, while preserving the trusted relationships that make collective support possible. It is not grounds to treat a diaspora community as inherently suspicious.
Include Gendered Abuse Without Treating It as Inevitable#
Sexual threats, non-consensual imagery, and attacks on relationships belong in a safety assessment when relevant. They are documented forms of abuse, not inevitable outcomes for every woman whose information is exposed.
Amnesty International describes technology-facilitated gender-based violence affecting women, girls, and LGBTI people, including threats, harassment, and non-consensual sharing of intimate material. Its research supports taking these harms seriously; it does not provide a probability that a particular doxxing incident will escalate. (Amnesty International)
A response plan can identify a trusted person to help with reporting, safe documentation, and contact with a workplace or support organization. Discuss public photographs, tags, and relationship details with the people affected rather than imposing isolation on them. Reducing exposure cannot guarantee protection, and publishing a photograph does not make someone responsible for an abuser’s conduct. Our guide to voice and face misuse addresses a related form of exposure.
Match the Response to the Harm#
Choose a response by the harm it can reduce and the information the adversary already has. Do not rank identity protection, foreign hosting, and planning for relatives’ safety as interchangeable defenses. The following worksheet is our synthesis of the case limits and guidance cited here.
| Situation | What to consider | What this does not establish |
|---|---|---|
| Immediate threats or suspected physical surveillance | Seek help through a route you can safely use; prioritize immediate safety | A website change or complete evidence file is not a prerequisite for help |
| Home or family details are publicly exposed | Review the exposure with affected people and consider safe removal requests | Removing a page does not remove other copies or records already held |
| A publishing identity is being linked to a private identity | Review public account reuse, contact details, and information shared between roles | A pseudonym cannot guarantee separation from provider records or a compromised account |
| A registrar or host could disclose records or suspend service | Examine actual data collection, retention, disclosure terms, and relevant legal advice | A foreign address or domain privacy service does not prove immunity from disclosure |
| Readers depend on one account or host | Prepare recoverable copies and check how readers could access them | A second copy does not make its publisher anonymous or guarantee access everywhere |
| Posting activity may reveal a routine | Consider whether scheduling reduces an unnecessary link to real-time activity | A timestamp without a timezone label does not prevent pattern analysis |
| A contact asks for sensitive information | Verify the request through a trusted route and share only what is needed | One infiltrator case does not justify distrusting an entire community |
The downloadable protection decision worksheet includes the objective, source links, and limits for each row. It contains no personal information and requires no online form. If you adapt it to your situation, consider where it can be stored safely; a detailed threat assessment can itself contain sensitive information.
For a public-information review, PEN America’s guide covers biographies, directories, personal contact details, and the separation of public and private accounts. Its data-broker examples are particularly US-focused. Our digital-footprint guide provides related context. Neither cleanup nor account separation erases records already obtained by someone else.
What Infrastructure Choices Can and Cannot Do#
Infrastructure choices can change who holds data and how publishing depends on individual services. They do not, by themselves, establish anonymity, legal immunity, or physical safety. Review the actual service and the relevant jurisdictions rather than relying on a country’s reputation.
Domain privacy concerns public registration data. ICANN distinguishes privacy and proxy services that substitute contact details or the registrant of record. That does not mean the provider holds no customer information or can never disclose it. Check its terms and collection practices. (ICANN)
Foreign hosting is a factor to evaluate, not a guarantee. A provider can have obligations, business ties, or infrastructure in more than one country. A static site may avoid an application database, but it does not eliminate billing details, administrative accounts, or whatever logs its services retain. These are questions to investigate for the specific setup. This article does not certify any host as beyond a government’s reach.
Distributed publishing also has operators and visibility limits. IPFS’s documentation explains that content identifiers and node identifiers can be public, and that a node’s IP address can be discoverable. Transport encryption does not make IPFS an anonymity service. Nostr’s basic protocol permits relays to reject events; using the protocol does not oblige any particular relay to keep your work. Copies help only when someone actually retains them and readers can retrieve them. (IPFS; Nostr NIP-01)
Scheduling does not erase timing information. Nostr events include a public created_at Unix timestamp. Its format need not spell out a local timezone for a series of events to reveal an activity pattern. Scheduling may separate writing from publication, but replies, account activity, and other observations can still provide clues. This is a limited precaution, not proof of an untraceable routine.
Identity protection remains valuable where it is feasible. A public name does not require a public home address or a public list of relatives. The appropriate balance depends on your situation, including the value of public accountability and access to support. More material on these tradeoffs is available in the Sovereignty section.
Key Takeaways#
Protect the person, the private information, and the publication as separate objectives. A control is useful when its limits are understood; none of the cases here supports a universal promise of safety through foreign infrastructure.
Frequently Asked Questions#
These answers distinguish the documented risks from the protections a particular tool or legal system can provide.
How are activists doxxed under authoritarian governments?#
Personal information can be collected from public material, exposed records, or people with access and then published to enable harassment. HKLeaks is a documented example of organized exposure. Not every case of state surveillance or transnational repression involves a public leak, and the initial information source may remain unknown.
Does a foreign warrant automatically authorize arrest where I live?#
No. A foreign government’s claim of jurisdiction is not the same as authority for its officers to arrest someone in another country. Local law, immigration status, extradition procedures, and the countries involved matter. Warrants can still have consequences, including travel risks and intimidation. A person facing a specific warrant should seek qualified legal support familiar with the relevant countries; this article cannot determine an individual’s arrest or extradition risk.
Is hiding my identity or moving my infrastructure more important?#
There is no universal ranking. Identity separation addresses certain links to a person; hosting and distribution choices address certain data holders and publishing dependencies. If an adversary already knows your name, protecting an address or relatives’ details can still matter. Choose the response according to the concrete harm, and do not substitute a server move for personal safety planning.
Does gendered harassment always follow doxxing?#
No. Sexual threats and non-consensual imagery are documented harms that deserve a place in relevant safety plans. They are not inevitable, and the sources here do not calculate the likelihood of escalation for an individual. Planning should support the targeted person’s choices and relationships rather than require withdrawal from public life.
What should I do first if I think I am being targeted?#
Put your immediate safety first. If you are in danger, get to a safer place if you can do so without increasing the risk, and seek emergency help through a service you can safely contact where you are. Do not wait to collect evidence. If contacting police could increase the danger, seek help from a trusted press-freedom or human-rights organization to consider safer options. Keep relevant messages, links and dates only when it is safe. Some apps notify the other person when you take screenshots. If your device or account, or those of your relatives, may be monitored, consider a safer way to communicate and store records, but do not delay emergency help to arrange it. Records can support later action, but you do not need a complete set of evidence to ask for help. See the UK government’s guidance on transnational repression (archived copy) and guidance on documenting abuse safely from the victim support organization NNEDV (archived copy).
Sources and Verification Limits#
The sources distinguish investigation findings, reported cases, technical specifications, and practical guidance. The worksheet is our own synthesis. It is not an experiment measuring how much any intervention reduces state repression.
