Resources Safety and your rights
Digital safety and pressure from abroad
What to do if you are threatened or pursued from abroad, and how to protect your phone, accounts and messages.
This is general information, not legal advice: QARAVAN has no lawyers. QARAVAN does not help anyone enter the US and cannot arrange visas, invitations, sponsorship or evacuation. For your own case, talk to a licensed immigration attorney or a representative accredited by the U.S. Department of Justice.
Transnational repression, as the FBI defines it, is when a foreign government reaches beyond its borders to intimidate, silence, coerce or harm members of diaspora and exile communities: surveillance, harassment, threats, forced return, pressure on family, hacking, attacks.
Those most often targeted are activists, human rights defenders, dissidents, journalists, political opponents, religious and ethnic minorities, and diaspora members with green cards, US citizenship or born in the US, and their family and friends. The FBI says your freedoms in the US are protected regardless of citizenship.
Phone and account tips come from the Surveillance Self-Defense guide by the Electronic Frontier Foundation (EFF, a digital rights organization); it is available in Russian. The protection you need depends on your risk: start simple.
Start here
- If you are in danger, call 911. If you are threatened or targeted from abroad, report to the FBI at tips.fbi.gov.
- If you were hacked or suspect surveillance, Access Now's Digital Security Helpline answers 24/7 in 10 languages, Russian included, within two hours.
- Set a long passcode on your phone, turn on two-factor authentication or a passkey for your accounts, and message on Signal.
Stalking and harassment
The person is watched, followed and harassed.
Threats and intimidation
Threats, direct or through others, to silence someone.
Pressure through relatives back home
Family or friends back home are threatened or detained to put pressure on you.
Coercion to return
Someone is pushed to go back to their country of origin.
Pressure through courts, assets and documents
Lawsuits, frozen assets, withholding of documents such as passports.
Hacking and online campaigns
Hacking of accounts and devices, disinformation campaigns against a person.
Assault
Attacks, attempted kidnapping or murder. If you are in danger right now, call 911.
If you are in danger now, call 911
Say “Russian” to get an interpreter.
Write down and save evidence
Write down dates, names, phone numbers and account names, screenshot messages, save page addresses, and don't delete conversations.
Report to the FBI
Fill in the form at tips.fbi.gov. The FBI stresses that your freedoms in the US are protected regardless of citizenship.
Read the FBI guide
The Threat Intimidation Guide is an FBI flyer on what to do if you are threatened, in English and many other languages. Look for the Russian version on the FBI website.
Ask for help with hacking and surveillance
Access Now's Digital Security Helpline helps activists, journalists and human rights defenders: urgent help if an attack is under way, and help assessing risk and improving protection if it is ahead.
Tell your lawyer
If you have an immigration case, tell your lawyer what happened and show what you saved.
Work out what you are protecting and from whom
Ask yourself: what am I protecting, from whom, how likely it is I'll need to, what failure would cost and how much effort I'm willing to put in. Make a security plan (also called a threat model) from the answers. Don't install everything: the simpler the setup, the fewer weak spots.
Put a long passcode on your phone
EFF suggests a passcode of 8 to 12 random characters that is easy to remember and type: without a strong one a phone is easier to break into. On iPhone, change it in Settings → Face ID (or Touch ID) & Passcode.
Decide whether to use a fingerprint or face
A fingerprint or face is more convenient, but in EFF's view US law here is still changing, and a memorized passcode usually has stronger protection. It's your choice; ask a lawyer if unsure. At airports and the border, CBP may in rare cases inspect a phone; CBP says travelers must present devices in a condition that allows inspection, and a device locked by a passcode or encryption may be detained, seized or face other action. Ask a lawyer before you travel.
Turn on two-factor authentication
Two-factor authentication (2FA) asks for a second check besides the password. EFF recommends an authenticator app, a passkey or a security key rather than SMS: SMS codes can be intercepted. Ask your carrier to protect your number with a PIN or passphrase so it can't be moved to someone else's SIM. Save backup codes so you don't lose access.
Do not enter a password from a link in a message
Phishing is an email, text or message that looks harmless but gets you to click a link, open an attachment or enter a password on a fake site. Look at the address in the browser, don't trust the sender's address, check suspicious messages another way, and keep software updated. If a familiar voice asks for money or something unusual, ask them to confirm who they are another way.
Message in Signal
Signal encrypts messages and calls between users, but everyone needs the app. You need a phone number to register. In settings, turn on registration lock (write down the PIN), disappearing messages and screen lock, and check linked devices now and then.
Remember that Telegram doesn't encrypt everything
As Telegram itself explains, ordinary chats and groups are stored on its servers and are not end-to-end encrypted; only one-to-one “secret chats” and calls are. For conversations that could hurt you, use Signal or a secret chat.
Check your phone for spyware
Stalkerware secretly shows someone else your searches, location, messages, photos and calls. The Coalition Against Stalkerware, a group of domestic violence organizations and security experts, has a help section for survivors.
Which levels of protection exist and who needs them
| What it does | What to know | |
|---|---|---|
| A long passcode on your phone | Makes a locked phone harder to break into | Suits everyone; you need to remember it |
| Two-factor authentication, a passkey or a security key | Asks for a second proof at sign-in; a passkey and a security key protect against fake websites | You can lose access to an account if you lose your phone or key: save the backup codes |
| Signal | Encrypts messages and calls between users who both installed the app | A phone number is needed to register; the other person must use Signal too |
| Advanced Protection (extra protection for a Google account) | For people who may be attacked in a targeted way: sign-in only with a passkey or security key, stricter checks of downloads, data access only for verified apps | You need at least one passkey or security key; if you lose the key and are not signed in on any device, recovery can take a few days |
| Lockdown Mode from Apple | Extreme protection for the few people who may be hit by sophisticated spyware: message attachments, complex web technologies, FaceTime calls from strangers, device connections and unsecured networks are limited | The phone does not work as usual: some apps, websites and features are limited; Apple says most people are never targeted by attacks of this kind |
FBI: report transnational repression
Any status
The FBI takes reports from people targeted from abroad, regardless of citizenship. Report online at tips.fbi.gov. The website has the Threat Intimidation Guide.
Access Now, Digital Security Helpline
Any statusFree
24/7 technical help for activists, journalists, bloggers and human rights defenders worldwide in 10 languages, Russian included; replies within two hours. Free for civil society. They first check whether your case fits their mandate. The contact address is on the website.
EFF Surveillance Self-Defense
Any statusFree
EFF's guide to protecting yourself from surveillance. There is a Russian version: basics, risk assessment, Signal, two-factor authentication, phishing, Lockdown Mode on iPhone.
Apple: Lockdown Mode
Any status
What Lockdown Mode restricts and how to turn it on for iPhone, iPad and Mac. It is meant for very few people who may face highly sophisticated attacks.
Google: Advanced Protection Program
Any status
Extra protection for a Google account, for people who may be attacked in a targeted way. Signing in requires a passkey or a physical security key.
Coalition Against Stalkerware
Any status
A coalition of domestic violence organizations and security experts. The website explains stalkerware and has sections for survivors and “Get Help”.
- Transnational repression
- Pressure by one country’s government on people outside its borders: stalking, threats, coercion to return, pressure on relatives, hacking.
- End-to-end encryption
- Encryption in which only the people in the conversation can read a message.
- Two-factor authentication (2FA)
- Signing in to an account with two proofs: a password and a second factor, such as a code from an app or a physical key.
- Passkey
- Data created on your device for signing in to one website; it replaces a password and a second factor, and a fake website cannot use it.
- Security key
- A device you connect to a phone or computer when you sign in; it is the strongest form of two-factor authentication.
- Phishing
- A message or link that looks harmless but is meant to make you give up a password or install malicious software.
- Security plan (threat model)
- Your answers to the questions of what you protect, from whom, how likely it is and what is at stake.
- Stalkerware
- A program that lets someone secretly spy on another person’s device: messages, calls, location and photos.