DIGITAL BODIES, TERRITORIES IN DISPUTE.

In Mesoamerica, as in the rest of the world, we are living in an increasingly complex political context in which digital technologies have become tools for resistance and for the defense of human rights, but also for repression and surveillance carried out by the state and other actors. Given this situation, this study seeks to strengthen our understanding, as women human rights defenders, of how digital violence is deployed in El Salvador, Honduras, Mexico and Nicaragua and to lift up the protection strategies that we at IM-Defensoras believe can be used to combat it – Feminist Holistic Protection (FHP) and, in particular, our Digital Protection and Care strategy.

We undertook this task by conducting an analysis of the different actors, contexts and political frameworks (ideological, economic, legal and institutional) that influence the risks, and of our actual possibilities – and those of our movements, organizations, collectives and communities – to access protection and care strategies and measures.

Thus, from an intersectional feminist analysis that includes the socio-economic and cultural diversity in which we conduct our work as women defenders, the objectives of the study are to:

• Understand our situation in the digital sphere.

• Identify the digital protection and care strategies and actions that we employ, as well as lessons learned.

• Identify the direct and indirect perpetrators of the attacks we face in the digital sphere.

The report begins with a chapter that provides regional-level analysis, in which we reflect on key factors of the context that inform how we understand our situation in the digital sphere. This chapter continues with a quantitative and qualitative assessment of the digital violence that we face, including the gender dimension, the perpetrators, the most common forms of attack, the risks they create in our lives and political projects, and our priority needs regarding digital protection and security. It concludes with a series of recommendations aimed at strengthening our struggles and our capacity for protection, as well as IM-Defensoras’ work at the regional level and that of the networks and territorial articulations that comprise it. Next, following a similar structure, we ground our analysis in El Salvador, Honduras, Mexico and Nicaragua. In these chapters, we delve into the specific political contexts of each country, their existing digital public policies and regulations on digital matters, an analysis of how women defenders engage with technology, and the various expressions and modus operandi of technology-facilitated violence.

Four local researchers were involved in the investigation – one from each country included the study: El Salvador, Honduras, Mexico and Nicaragua. They carried out their work by reviewing a range of bibliographic sources and analyzing in-depth interviews conducted with four women defenders from each country between March and July 2024.

The sixteen women defenders interviewed were selected based on two criteria:

1. Having been victims of technology-facilitated violence, with their cases captured in our registry of attacks.

2. That, taken together, the set of interviews reflect a diversity of rights defended and of territorial origin (see Table 1). 

Given the increasingly repressive political contexts we face, it is important to note that throughout this report we have ensured the anonymity of all participants as a measure to safeguard their safety and protection.

The report is also informed by in-depth interviews conducted with eight specialists on digital security and gender-based violence facilitated or perpetrated using technology, who contributed a regional perspective on the difficulties experienced by women defenders. The qualitative information was complemented by two quantitative sources: data on digital violence extracted from our Mesoamerican Registry of Attacks against Women Human Rights Defenders and an online survey of women defenders in the region who have face gender-based violence facilitated or perpetrated using technology.

The online survey was hosted on a secure platform. The women defenders who responded were selected by IM-Defensoras’ networks and allies in the countries included in the study and were contacted by the local researchers. Due to the challenges posed by the digital infrastructure and the time required to complete the survey, it was decided – in addition to having participants respond individually – to offer telephone assistance for filling out the survey and to organize in-person support sessions led by the local researchers. This ensured that the women defenders had access to psychological and emotional support, as well as digital protection and security, when necessary.

We received 105 responses from the four countries: 25 from El Salvador, 27 from Honduras, 29 from Mexico and 24 from Nicaragua. The majority of women defenders surveyed (83%) live in the countries analyzed, while 17% live in other countries; among these, 11 self-identify as being in exile. 

Technology and society are inseparable; they are interrelated and mutually constitute one another, which is why we cannot analyze technology separate from the social dynamics with which it interacts. Thus, to analyze our situation as women defenders in the digital sphere, it is crucial to understand the political, social and technological contexts that influence our lives. In this study, we have identified at least two key contextual factors: political factors, which influence the human rights situation in different countries, and factors related to the current political-economic logic of the dominant technology companies. The combination of these two factors allows us to place our current situation in the digital sphere within a historical context and understand the challenges that lie ahead. In every country and territory, technologies are embedded in a specific historical context of use, which is influenced by global phenomena such as the rise of the far right and the reactionary agenda (see Image 1).

Throughout the region, we confront political, social and economic dynamics created by the capitalist, racist and colonial patriarchal hegemony that exacerbates inequality and social and territorial conflicts, making our lives precarious, dispossessing our communities and expelling us from our territories. Against this backdrop, the political response in the Mesoamerican region – with slight variations in each country – has been the rise of leaders with authoritarian tendencies and a conservative rhetoric who interpret social discontent by imposing their own narratives and creating internal and external enemies to justify their policies. These leaders continue to serve as mouthpieces for powerful groups that dominate the region: the extractive industry, ultra-conservative leaders, religious fundamentalists and organized crime. In the countries included in the study, we observe how polarizing rhetoric singles out and labels women human rights defenders as “the enemy”, whether due to our public stance as people who denounce abuses by the state and those in power, or because of our feminist agenda and our commitment to social justice.

This web of polarized discourse reveals how the strategic use of digital technology, the consolidation of restrictive legal frameworks and the hardening of authoritarian and militaristic policies are critical to state governance and to the agendas of de facto powers. Furthermore, it seems that one of the most important goals behind this governance model is to interrupt, silence and delegitimize our work. 

In the digital sphere of various countries, there are – on the one hand – legal and regulatory frameworks that are weak or insufficient to protect our rights as women defenders, that run counter to our work or that are directly manipulated and maliciously enforced to harm us. On the other hand, resources are invested to deploy a wide range of digital strategies against us, ranging from the constant monitoring of our personal data and the spread of disinformation through social media to illegal surveillance involving the use of spyware that collects information from our devices without our consent.

The role that technology plays in this hostile landscape does not happen by chance; rather, it is facilitated by the interests of technology corporations that, through both action and negligence, enable acts of violence against women defenders. There are many reasons for this, including the fact that their content-ranking algorithms prioritize the most violent and offensive content in order to generate more engagement and, consequently, more data that they can extract and monetize. Governments in the region take advantage of this situation to employ tactics in the digital sphere and target anyone perceived as an opponent. Moreover, violence is a driver of economic profit for technology companies, because it generates revenue for them and because they still believe it is too costly to create sustainable mechanisms that can effectively moderate content at scale and protect human rights. In most cases, these are companies based in the so-called Global North, thus perpetuating existing colonial dynamics and turning regions like ours into fertile ground for their extractive capitalism. Technology corporations extract resources – in this case, the personal data of the poorest segments of society, who also suffer the unwanted consequences of this operation, such as disinformation – and keep the wealth generated by the unequal exchange. 

Another element that is worth noting is the role of large technology companies in states’ digital infrastructure. As a crucial part of their political economy and with the aim of consolidating their global dominance, these companies provide governments with digital information (big data) – among other services – that can be used to analyze people’s behavior in order to make predictions or feed artificial intelligence. They also invest in digital infrastructure – communications satellites, undersea cables, data centers, and so on. Furthermore, because markets in techno-capitalism are so vertically concentrated, the same owners of platforms like social media also control the infrastructure that enables internet services. One example of these links between states and technology companies is the close business relationship that Alphabet, which owns Google, has with the government of El Salvador.

Any analysis – whether current or future – of the violence that women defenders in the region face must be based on these two important variables: the political context and the political economy of digital companies, as every national and regional policy has a connection with the business interests and political economy of technology corporations. Both are influenced by and shape the social, economic and political context in which we, as women defenders, operate.

According to the online survey of 105 women defenders from El Salvador, Honduras, Mexico and Nicaragua, Mesoamerican women defenders frequently access the internet, whether through computers connected via broadband or fiber optics, or through mobile data plans on our smartphones. 

The vast majority of respondents (79%) use internet-connected devices on a regular basis, and 77% use technology daily to carry out activities related to our activism. Most notable in this regard is the use for internal communications (among colleagues within the same organization or movement), external communications (with other organizations or people outside their organization), and organizing activities (see Figure 1).

Based on the interviews and surveys conducted, we identified four factors that influence our relationship, access and adoption of digital technology:

1. The intersection of our different identities and socio-economic, cultural, ethnic, territorial and sex-gender identities.

2. The specific political trends in our countries and territories.

3. Our knowledge of digital security.

4. The digital violence that we have experienced as women defenders.

HOW DO INTERSECTIONAL VARIABLES CONDITION OUR ENGAGEMENT WITH TECHNOLOGY?

The relationship that women defenders have with technology is influenced by our social, economic, ethnic, generational, territorial and sex-gender conditions, among others – known as intersectionalities – because they affect how we access and adopt technology, as well as our knowledge of and access to digital care. 

Women are more vulnerable to digital attacks because the digital divide (understood as women’s lack of meaningful access to technology) is a serious and persistent structural injustice in the region. Our gender affects not only our access to and adoption of technology – since technology is still perceived as a male-dominated field – but also the digital attacks we face and, consequently, the way we engage with the digital space.

While our intersectionalities span many contexts, there are common factors in Mesoamerica -such as geographic location (rural or urban) and socioeconomic status – that are key determinants of access to internet connectivity, bandwidth-intensive content services and state-of-the-art devices. We also found that access to official digital help or support centers tends to be concentrated in urban areas. Here, another significant intersection comes into play – belonging to an Indigenous Peoples – that can create language and cultural barriers that make it difficult to embrace technology and digital security concepts that are loaded with a colonial and patriarchal perspective. 

Another key factor is generational differences. The testimonies suggest that young women are more digitally sophisticated than older women, and it is acknowledged that older women make an extra effort – though not always successful – to learn how to use these technologies and adapt to them. Younger generations tend to show more ease in adopting technologies. 

POLITICAL TRENDS IN OUR COUNTRIES

The testimonies collected suggest that another challenge regarding the adoption of digital technologies stems from the diverse political realities of our countries and from the political tensions that arise at any given moment, as these force us to turn to new services and create new communications and care strategies. 

A significant factor identified in the countries included in the study is the impact of the massive shift to the digital sphere forced upon us by the covid-19 syndemic and the confinement policies – whether mandatory or voluntary – that were put in place as a result. Nevertheless, each country has specific political contexts that influence in different ways how women defenders engage with technology. In Nicaragua, for example, testimonies note that the outright ban on protest is the primary reason for activism’s shift to the digital sphere; whereas in El Salvador, the prominence that social media has gained in the government’s communications and propaganda strategy has led women defenders to be more strategic when using the internet.

OUR KNOWLEDGE ABOUT DIGITAL CARE

Many of us, to different degrees, have access to materials, trainings or accompaniment on digital care. Our reflections and practices reveal that the majority of us already has a base of digital care resources and a critical view of technology, which is an essential foundation for any work to mitigate or confront this violence in our own territories.

Digital security is not a completely unknown concept in the region. More than half of survey participants state that their risk assessments take into account the digital activities that they conduct (see Figure 2).

Additionally, it is worth noting that most respondents report using digital security practices and that the percentage of those who do not is minor (see Figure 3).

DIGITAL VIOLENCE

Without doubt, the most influential factor in our relationship with technology is actually the digital violence that we experience. While most of us understand the personal, professional and political potential of the internet, we are also acutely aware that it is a tool that is used to incite violence. Many of the testimonies speak of a turning point – a sort of “end of innocence” – after which, due to the violence they experienced, they were forced to adopt different practices, such as refraining from sharing personal information on social media, restricting their use of platforms and interactions with other users, strategically segmenting content across different platforms, seeking professional help with digital security, etc.

Today, the ways in which we use technology are part of a transition that has required personal and organizational effort, as well as a process of personal and collective transformation. Digital technologies have changed our work and our trajectories. Beyond our accomplishments and our self-recognition as people with experience in the digital sphere, this study shows that Mesoamerica has a wealth of digital care practices that are worth analyzing and that can greatly benefit the community.

Mesoamerican women defenders face increasingly complex contexts, where the rise of digital attacks and the dispute for the digital territory are ever present. Between 2020 and 2025, our registry system documented 9,091 digital attacks against 1,337 women defenders and 179 organizations in El Salvador, Honduras, Mexico and Nicaragua. This means that one in four of all attacks registered in the period was perpetrated in the digital sphere.

Based on this data, the women defenders who receive the highest number digital attacks are those who defend the right to information and freedom expression (23%); the right to political participation and to participate in decision-making spaces (22%); women’s right to a life free from violence (17.2%); the right to truth, justice and reparation (9.9%); and those who work for the right to land, territory and natural resources (9%). 

The survey conducted as part of this study indicates that the majority of women defenders (88%) perceive that attacks on digital platforms have worsened in our countries over the last two years. 

Of the total number of women defenders surveyed, the majority (78%) affirm having felt vulnerable to digital attacks always or almost always when they have used digital technologies as activists (see Figure 5). 

There are various reasons for this. The prevailing view is that digital attacks are on the rise (65%), and there is a perception that our activism and that of our organizations put us at particular risk (63%). Furthermore, there is a sense that the perpetrators of these attacks enjoy impunity due to their anonymity (58%).

The main reasons behind this sense of vulnerability lie beyond our control and that of our organizations; in other words, they fall within the realm of the public sphere. Among the factors contributing to this vulnerability that are within our control, we highlight a lack of knowledge about technology, which ranks fifth (45%); the perception that digital security is a complicated issue, which ranks seventh (39%); and, finally, a lack of access to digital security guidance (11%) (see Figure 6). 

This may indicate that we perceive ourselves as vulnerable to digital attacks due, on one hand, to the external political context and, on the other hand, to our moderate level of knowledge regarding digital security, coupled with the fact that this knowledge has limited reach in the current political context.

The main goal of the digital attacks we experience is to silence our critical voice, and this has an inevitable gender dimension related to a patriarchal strategy of silencing.

On this matter, our Mesoamerican Registry of Attacks against Women Human Rights Defenders identified gender-based discrimination in 63% of the 9,091 attacks through digital means documented between 2020 and 2025. 

Digital violence is a response to the denunciation and public expression of dissatisfaction and rejection that we, as women defenders, voice against the extractivist, colonial and patriarchal capitalism that dominates the region. This is why the attacks seek to re-establish gender hierarchies through disciplining, intimidation and delegitimizing our work, ethics and leadership. Based on these premises, the gender dimension becomes evident in the four aspects of digital violence that we analyze below.

WHY DO THEY ATTACK US?

The main cause behind the digital attacks that women defenders experience is the anti-feminist and misogynist agenda maintained by states and de facto powers. The point is to attack, with particular ferocity, all feminist values and, in particular, the rights of women and LGBTTTIQ+ people as symbols of a popular movement that seeks social justice and that, apparently, pose a significant threat to the status quo and political conservatism across the board. So, they seek to ridicule our agenda as women defenders and undermine the credibility of women as leaders and that of our organizations as social actors. At other times, they aim to divide or create conflict within the women’s movement through disinformation campaigns.

WHO DO THEY TARGET?

In most cases, the attacks target women who organize and coordinate through collectives and social movements, although this does not mean they are the only victims. There is a degree of cruelty and viciousness directed at women and LGBTTTIQ+ people who lead organizations, especially if they are of African descent, Garífuna, or Indigenous. The patriarchal disciplinary mechanisms are reinforced to stifle the leadership of those labeled as “bad women”, “bad mothers”, “bad wives”, “bad Indians”, “bad Black women”, and other similar derogatory terms, and they seek to convey their message to society as a whole: “Women – especially those of color and leaders of grassroots popular movements – have no place in public life.”

HOW DO THEY ATTACK US?

The insults we receive as women defenders target our gender and ethnic identities in order to attack us. There is widespread sexualization of our bodies, disparagement of our intellectual abilities and contempt for anything that challenges white supremacy and the heterosexual norm. Also common are sexual blackmail – from the publication of intimate images and photographs all the way to rape. The threats of death and rape are directed not only at us, but also at women in our families. Additionally, coordinated campaigns to delegitimize the feminist movement are common. All of these stigmatizing acts are deeply marked by prejudices regarding the role that women are expected to fulfil in society.

WHO ATTACKS US?

Beyond the fact that the perpetrators are mostly men, also noteworthy is the unequal power relationship that some of them wield over us. This inequality becomes very explicit when it comes to state officials and actors linked to de facto powers, since we have hardly any access to the economic and political resources they possess. This exercise of power is a form of intimidation that frightens us and instills in us a very specific fear of our assailants. And when they use digital technologies, from social media platforms to surveillance tools, the power imbalance grows – both in practice and in our perception – because we have legitimate concerns about the extent to which they intrude on our lives. This unequal exercise of power is also evident in the case of perpetrators of violence who invoke patriarchal norms about what it means to be a “good woman”, as in the case of ex-partners, who often use intimate material and personal information to threaten and discredit us.

THE CHALLENGE OF CATEGORIZING ATTACKS 

A prominent thread running through the testimonies collected for this study is the difficulty in identifying and distinguishing the technical classifications of digital attacks, which have been categorized by experts in digital care. This becomes clear, for example, when we talk about hacking or cracking, which is the act of illegally breaching a digital security system and which some of us confuse with phishing – that is, the technique of tricking someone into taking an action that allows information to be stolen from them – or other types of attacks. 

Another challenge encountered is the distinction between online and offline attacks. The survey responses reveal how, for some women defenders, the two are one and the same and are experienced as part of a cycle of violence that occurs in various settings. The testimonies jump from one setting to another, and as soon as they speak about a digital attack, they relate it to an offline attack. 

According to our registry of attacks, almost half of women defenders (47%) who were victims of a digital attack in 2025 also faced offline attacks that same year.

This finding shows that digital violence does not occur in isolation, but rather is often part of a continuum of attacks aimed at hindering and punishing human rights defense work. We documented, for example, cases of women defenders who, after being targeted by smear campaigns on social media, were subjected to judicial proceedings or threats that forced them to go into exile. This demonstrates that digital and non-digital attacks occur as a unified whole, as they constantly intertwine and overlap in the lived experiences of women defenders.

The complex nature of personal and organizational attacks is that most attacks and acts of violence focus on women leaders and the most visible figures in our organizations. However, women defenders who have a lower public profile but are part of a prominent organization, or one recognized for its work combating human rights violations, also face online attacks. Thus, for our assailants, women defenders are seen as representing the organization as a whole; they attack us to attack the organization, and they attack the organization to harm us as women defenders. All of this seeks to undermine any critical discourse and to perpetuate social conflicts. 

This demonstrates the futility of separating the digital from the non-digital, and the woman defender from the organization, since attacks affect the work and life experience wholly and in all its complexity. But it also creates a challenge for the registry and support networks; the technical concepts for classification appear as having limited use among the victims themselves.

Given this scenario, we opted to group the technical types into broader categories based on the objectives of the attacks. This approach allows us to see how these attacks affect our lived experience in activism and human rights defense, and can be a more grounded and strategic way of understanding them.

THE MOST COMMON FORMS OF ATTACK IN THE REGION

The survey results point to two forms of attack that women defenders perceive as most common for their activism and their organizations, both with more than 50% of respondents identifying them (see Figure 7): digital surveillance and tracking (on cell phones, computers, or social media), and cyberbullying or digital harassment – that is, online defamation involving false information (both personal and organizational), harassing messages sent across digital channels, threats, and the use of private information against them or their loved ones.

According to the survey, 92% believe that social media platforms are one of the channels in which most attacks take place. This coincides with the finding that 89% of digital attacks documented in our registry between 2020 and 2025 are concentrated in social media. Additionally, 61% of the testimonies point to chat platforms as one of the most utilized channels for perpetrating digital attacks (see Figure 8).

The results of this study show a high degree of correspondence between the types of attacks cited by the experts and those documented in our testimonies. There are certain patterns of attack that reveal the significant digital risks to which Mesoamerican women defenders are exposed. Based on the testimonies collected, we identified a grouping of the most common attacks in the region, which can appear on their own, in combination, or together. They are all present in the four countries analyzed in this study; however, they are mentioned with higher or lower impacts in certain territories and contexts (see Table 2). 

1. Gendered disinformation. Disinformation is the mass dissemination of false information – knowing full well that it is false – with the intent to deceive audiences and cause harm. Unlike other forms of disinformation, this one is based not only on false information but also on spreading preexisting misogynistic narratives to achieve social and political goals, including maintaining the gender status quo or polarizing society. On this matter, the Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, Irene Khan (2023), affirms,

   “Gendered disinformation is gendered because it targets women and gender nonconforming individuals, because of the gendered nature of the attacks and their gendered impact, and, very importantly, because it reinforces prejudices, bias and structural and systemic barriers that stand in the way of gender equality and gender justice... Gendered disinformation attacks not only individuals but also their collective struggles by seeking to delegitimize feminism and gender rights.”

   Thus, gendered disinformation seeks to cause harm by reinforcing gender stereotypes, exacerbating existing biases and prejudices, explicitly or implicitly, including threats of gender-based violence and employing overlapping tactics of intimidation, shaming, and discrediting women’s leadership, morals or ethics. 

   According to the experts interviewed, these are the types of attacks that have become most frequent in recent years and that cause the greatest distress and exhaustion due to the scale of their impact, the viral nature of their spread on social media, the anonymity that fuels them and the ease with which convincing evidence can be generated through the use of artificial intelligence – among other ways in which the internet and technology can amplify violence. 

   Based on the above, gendered disinformation combines three defining characteristics of online disinformation: falsehood, malicious intent and coordination. And, as this study shows, these three features are all present in the gendered disinformation campaigns directed against us. There is, thus, a coordinated strategy with malicious intent to publish false information that disparages and discredits us and our organizations. This is commonly done by publishing blatantly false information – for example, doctored photos or statements containing manipulated or incorrect information – or by spreading information taken out of context – for example, producing videos with partial information to support false accusations. Both approaches have a fairly distinct narrative: they are based on misogyny, gender-based violence and an anti-feminist agenda. Moreover, they polarize public opinion through the basic binary of “good” versus “bad”, with all its possible variations.

   To obtain the information needed to carry out the attacks, coordinated efforts are put in place to gather, produce and spread that information. There are indications that, in order to gather this basic information, the perpetrators are constantly and meticulously monitoring our lives. The materials produced to spread disinformation reflect prior research into personal details that go far beyond what we share on social media. Thus, as the experts interviewed point out, there are instances, for example, of the malicious use of intimate information for the purpose of discrediting someone. Furthermore, we see a wide range of media, platforms and formats used to spread this disinformation – from opinion pieces and posts, photographs and videos, to social media posts and fake websites. 

2. Digital harassment. This is a broad range of repetitive unwanted behavior against us with the purpose of causing us fear, anguish, intimidation or emotional distress. The most common forms of digital harassment are continued misogynistic insults, mass filing of complaints from social media accounts to deactivate our accounts, block them or even have them taken from us; the use of brute force to obtain access to the accounts of the different services we offer, thus flooding our e-mails with security messages, causing confusion, fear and frustration; and creating hashtags to group publications about the same topic in order to encourage mass harassment.

3. Threats to our integrity and that of our close circle. These are attacks that generally come from anonymous accounts and directly target our physical and psychological integrity. They may be direct death threats or warnings of rape, even against our families and close circles, which make us feel vulnerable and afraid. These types of attacks often mark a tipping point, because it is when we experience them that many of us begin to take digital violence seriously.

4. Digital sexual violence. On this matter, most notable are threats of rape and non-consensual distribution of intimate images by ex-partners, with the aim to personally and professionally harm us.

5. Illegal electronic surveillance. We have gathered evidence of governments installing spyware on some women defenders’ devices, as well as possible phone tapping. Other women defenders suspect that their ex-partners have access to their devices, but they haven't been able to determine whether this is due to some kind of malicious software or other, less technical means of access. We can add here the access that police forces gain to our cell phones and other electronic devices when we have been detained or searched. In Nicaragua, they have accessed the devices of women defenders’ families, doing so without complying with basic legal guarantees. In Mexico, the close association between physical and electronic forms of spying was evident. Overall, these are attacks that leave us particularly vulnerable because of the access third parties have to our personal and private information, that of our families, and information related to our activism.

   It is important to understand that electronic surveillance cannot always be detected. However, there is evidence indicating that various technologies are used for this purpose, ranging from spyware to surveillance tools that act as cell phone towers and capture the identifiers of nearby devices, known as IMSI catchers, which must always be regarded as a risk factor for us.

6. De-anonymization. This is usually carried out through practices such as doxing – the act of intentionally revealing and publishing personal information online that places the victim at risk – as well as the publication of misleading messages that, by creating a sense of closeness, seek to expose our activism. This is particularly relevant in Nicaragua following the totalitarian shift the country has undergone since 2018, where the real danger of severe consequences for revealing one’s identity has led our adversaries to employ tactics aimed at removing anonymity. In Nicaragua, a significant share of this type of attacks comes from ex-partners or members of the same social movements, and they are carried out with the intention of paralyzing and halting our activism and human rights defense work.

The vast majority of the women defenders surveyed (94%) believe that the online attacks we face are directly linked to our work defending human rights. Perpetrators deliberately use digital platforms to attack us because of the important role these platforms currently play in activism, the ease with which anonymous attacks can be carried out through them,and the impunity that often surrounds such attacks. Added to this is the fact that these types of attacks are highly effective and efficient, since at a very low cost they have a huge impact on us and on public opinion (see Figure 9).

According to our registry of attacks, between 2020 and 2025, 61% of the direct perpetrators of digital attacks were documented as “unknown”. Although anonymity in the digital realm makes it difficult to track down perpetrators, this does not necessarily mean they are an anonymous mass that is hard to identify. According to the testimonies gathered for this study, 21% of women defenders interviewed do not know, nor do they suspect, who is behind these attacks. However, in the risk analyses, the majority (79%) suspects or has identified the main alleged perpetrators of some or all of the digital attacks they have received (see Figure 10).

When it comes to identifying who is responsible for the attacks, whether based on suspicion or certainty, an overwhelming majority of the women defenders surveyed (70%) believe that the perpetrators are high-ranking public officials – federal or national, state, provincial, municipal and community authorities. Political parties, including their supporters and members, rank second, at 52%; and in third place, at 49%, are law enforcement agencies at various levels – federal, national, central, state, provincial, municipal and community. 

Behind the digital attacks we experience lie the same interests and motives as those behind non-digital attacks: they seek to punish us, make an example of us to show the consequences of standing up to powerful groups and undermine our struggles to defend human rights (see Figure 11). Therefore, our main digital assailants are the same ones we have identified in non-digital attacks: the state, groups with economic and political power, other influential and ultra-conservative forces and people in our close circle, such as partners and members of our family, community or organization. The testimonies also note that the direct assailants are sometimes social media users who independently – without belonging to a collective or having a clear strategy – act to amplify the more complex attack strategies orchestrated by those in power. 

Table 3 shows the broad range of perpetrators identified, beginning with the state, followed by de facto powers and going all the way to our close and intimate circle (see also below, Image 2). Many of these perpetrators operate in multiple countries and form alliances with one another. 

THE STATE AND ITS OFFICIALS 

In the four countries covered by the study, we identified the state as the primary perpetrator of violence facilitated or exerted using technology. This is because most states have enacted policies that criminalize human rights defense work, in line with their agendas of political control and their alliances with a variety of powerful interests – domestic and transnational corporations, organized crime and ultra-conservative groups that promote an anti-feminist and anti-rights agenda. Thus, when we speak of the state as the perpetrator, we are actually referring to a broad spectrum of actors who use public resources and infrastructure to attack us both through physical and digital means. This means that financial, law enforcement, and – in many cases – military resources are deployed to persecute us, enabling the use of coordinated digital attacks that range from disinformation campaigns to the use of spyware.

In countries such as Nicaragua and El Salvador, harassment begins within the executive branch, with top-level officials engaging in harassment and hate speech expressed in the digital sphere. This creates a ripple effect that leads to other public officials, shock troops – whether volunteers or paid – and pro-government social media users amplifying harassment and disinformation campaigns.

DE FACTO POWERS  

By “de facto powers”, we mean actors and groups that, directly and/or indirectly by co-opting states and their institutions, exercise real power within territories – ultra-conservative or fundamentalist groups; economic and financial interest groups; organized crime; caciques (local political bosses) and landowners; and paramilitary groups, among others.

These perpetrators have one thing in common: they wield power. These are not simply assailants, they are actors that can exercise extreme violence against us, our organizations and family members because they enjoy a troubling degree of impunity. Furthermore, in the region, it is clear that these actors often come together and form alliances; they operate on a transnational scale and even share sources of information and funding with one another, as evidenced by the similarities in their narratives and strategies for using technology to attack us.

Groups promoting the international ultra-conservative agenda 

In recent years, a strong ultra-conservative agenda has emerged in the region and around the world, driven by broad transnational alliances among far-right political parties, religious fundamentalist sectors and powerful economic groups with extractivist interests. Their openly racist, xenophobic and misogynistic narratives have tangible consequences in both the physical and the digital spheres. In the digital sphere, they shape public opinion by controlling social media and manipulating algorithms. On the political and legal fronts, they co-opt states and their institutions, driving public policies, legal frameworks and fiscal policies that erode human rights and promote territorial dispossession.

These groups directly or indirectly shape the narratives that are repeated in digital smear and disinformation campaigns against us. User profiles on social media hide behind the banner of “God, Country, Freedom and Family” to defend the patriarchal gender order and the economic system that benefits from it. In recent years, we have observed an increase in the number and severity of attacks against us and our organizations, where our commitment to the sovereignty of our bodies and territories is stigmatized as “gender ideology”, women’s activism and that of gender diverse people is ridiculed, and demands are made that we give up our political rights by telling us to “go home and wash the dishes”. 

Economic interest groups

We found that some attacks against women defenders are directly or indirectly carried out by a range of actors linked to economic interest groups – extractive, agribusiness, mining and technology companies; drivers of large-scale urban and tourism development projects; local landowners involved in land disputes; and local oligarchies, among others. These local, national and transnational corporate groups promote models of “development” based on dynamics of accumulation through dispossession and expropriation that run counter to the struggles of those who defend land and territory. To that end, they carry out coordinated strategies of physical and digital harassment and assault with the intent of stigmatizing demands and criminalizing leaders. 

Although they may act independently, they tend to operate in coordination with state officials, the judiciary and other de facto powers like the mainstream media and digital platforms. The latter use algorithmic manipulation to amplify racist narratives that serve their economic interests, thereby portraying women defenders of territory as troublemakers, illegal occupiers and enemies of progress and economic development. 

Organized crime

Some Mesoamerican women defenders point to organized crime as one of the perpetrators that use physical and digital violence as a tool for territorial control and silencing. In the digital sphere, its attacks are often a lead-up to or an extension of physical violence. These attacks take the form, for example, of direct threats via text messages or social media posts targeting women land defenders, searchers and journalists who denounce their crimes and the complex political and economic networks in which they operate.  

The capacity of these groups to inflict harm and act with impunity transcends national borders and is sustained by two pillars: the deployment of militarized mechanisms operated by professional perpetrators of violence, and the complicity, tolerance and collusion of local, state or national officials and institutions. In some countries in the region, these ties to public authorities show up in the form of financing or promoting political candidates to advance their interests under the guise of apparent institutional legitimacy.  

ACTORS WITHIN OUR CLOSE CIRCLE

The perpetrators of digital violence are sometimes people in our close circles – family members, ex-partners, colleagues, fellow members of an organization or social movement, and even neighbors. The testimonies show how these circles share with ultra-conservative groups an anti-feminist stance and patriarchal views that seek to politically demobilize us by reinforcing traditional gender roles designed to keep us silent and out of the public sphere. Having assailants in our homes, communities and organizations creates an environment of hypervigilance that is exhausting for our mental and physical health.

The ways in which the different perpetrators of digital violence in Mesoamerica operate share many similarities and can be grouped into three categories, which, when combined, can achieve greater levels of effectiveness. 

1. Setting the stage for criminalization. Attacks against us occur in an environment that is hostile to our work. States and de facto powers have resources, means of communication and impunity to accuse us and conduct campaigns that stigmatize our work. The explicit harassment we have endured in the countries where this study was conducted makes the impact of the attacks infinitely greater, because authorities at various levels have labeled us as enemies or criminals. The stigmatization of our work – whether through public statements or government and state actions – is part of a strategy to set the stage for justifying criminalization processes. Moreover, in many countries, this criminalization specifically targets the critical press and thus blocks the ability to verify facts and check the power of the state.

2. Use of surveillance technology. A key component of digital attacks is the constant monitoring of our digital activities. Many testimonies point to the likelihood that people are paid to conduct this monitoring. This indicates that digital attacks begin as a general process and then get more specific to the digital profiling of the woman defender, her circle and her organization. In fact, it is after suffering these attacks that we begin to fully understand the need to be very strategic in our use of the internet, because, given the platforms’ extractivist interests in our personal data, it is nearly impossible not to leave a digital footprint, meaning we are under the constant watch of our assailants. This reaffirms what the specialists interviewed say – attacks based on collecting personal data enable them to target our intimate sphere, and so matters like our sexual orientation or our families’ activities are used in the attacks. There are various legal and illegal mechanisms that may support this monitoring. On one hand, we see the malicious use of legal tools like open source intelligence (OSINT), which is a practice of collecting, evaluating and analyzing information from publicly available sources – like social media – for use in intelligence contexts. On the other hand, we found in the region the use of various illegal surveillance software such as Pegasus, FinFisher and Remote Control System (RCS), among others. Furthermore, some governments have created regulations to allow telecommunications companies to hand over personal data without clear consent from users. 

3. Strategies for going viral. Another tactic used by perpetrators is making their attacks go viral, since the attack cannot be fully harmful unless the malicious content reaches a wide audience. Key strategies for making content go viral include organized campaigns involving fake accounts, networks of digital accounts created to spread disinformation or manipulate public opinion (known as net centers) and software that automates repetitive tasks and is used to target online profiles (known as bots). In addition, the pattern of popular social media influencers posting or reposting attacks is now common in many countries. This creates a cascade reaction driven both by planned efforts – involving paid anonymous individuals (known as trolls) who post provocative and aggressive messages – and by the organic reach of followers. When it comes to the state, it is high-level authorities – including presidents – who use strategies for going viral. On this matter, it is worth noting that hegemonic media outlets act as a megaphone for digital attacks, clearly forming part of the perpetrators’ strategy for going viral. Some testimonies note that digital attacks increase significantly when a perpetrator uses a media outlet to publicize them.

4. Strategic timing of attacks. The timing of digital attacks is determined by the perpetrators. For example, as an escalation – organizational leaders are attacked first, and then the rest. Other testimonies note that digital attacks increase when an organization is in the midst of a key moment, such as a court verdict or the release of a report.

It is impossible not to ask why digital attacks against us have become increasingly common. Both the testimonies of the women defenders interviewed and those of the experts participating in this study indicate that the main reason is that these attacks are extremely cost-effective, as they require little investment for the high return they yield. A significant part of this effectiveness stems from the troubling prevalence of impunity in various arenas.

SOCIAL IMPUNITY

This type of impunity affects us most directly and involves the social normalization of attacks. It is based on the mistaken idea that the digital world is not real or is less important than the physical world. Additionally, people regularly experience these attacks individually, are not always able to share them with the collective, and they lack resources to address attacks. All these factors contribute to the fact that neither states nor platforms are held accountable, and that there is no social justice mechanism in place to prevent such attacks, defuse them and guarantee non-repetition. Thus, as a vicious cycle, this silence leads to more silence about digital violence.

IMPUNITY FOR STATE ACTIONS

Based on the testimonies gathered, one trend resonates loudly: only one in four women defenders surveyed (25%) filed a complaint with a state entity regarding a digital attack. This is probably linked to the fact that 95% of the women defenders believe that the legal framework in her country does not guarantee her digital protection.

According to the qualitative analysis, this impunity stems, on the one hand, from the fact that legal frameworks governing internet platforms are still under development and from the reality that, even when such frameworks exist, they cannot always be used to guarantee our human rights – and, in fact, are often used against us. On the other hand, there is a general reluctance among women to report incidents. First, because of the high levels of impunity that prevail within the justice system for almost all crimes. Second, because the perpetrators are often public officials, and there are insufficient guarantees that the complaint will be handled properly. Added to this is the fact that many public officials have not been trained to understand digital issues, much less online gender-based violence, so they create various obstacles to filing complaints. There are also strategic reasons for not filing complaints with state justice systems, since in some cases doing so can worsen the already delicate situation faced by women defenders, their families and their organizations.

Lastly, in the few cases where women defenders filed complaints, nothing came of it. Along these lines, protection mechanisms are broadly criticized because their measures are almost always designed to address risks and threats in the physical sphere and not in the digital sphere, and as a result, they tend to be ineffective in responding to digital violence.

IMPUNITY FOR TECH PLATFORMS

Regarding technology companies, the survey showed that 35% of the women defenders reported the attack to the company providing the service on which it occurred. However, most of those who reported the attack said that, although they received a response, it was unsatisfactory (51%) or that, despite making the report, they did not receive a response (35%).

This highlights a deeply worrying and widespread criticism of the growing ineffectiveness of the platforms’ help or support centers. We found that these channels are virtually nonexistent, that there is little opportunity to use them, that there are long wait times for a response – which can include months of deactivated accounts due to malicious reports by the perpetrators of attacks – and that there is no avenue for appeal. Many testimonies also point out that, over the years, it seems that the platforms’ standards for support and human rights protections have declined. Impunity has reached such a point that quite a few women defenders have stopped filing complaints, which means that the reports on complaints published by some platforms do not reflect what is actually happening.

The experts interviewed share this view, which is particularly interesting because they work directly with certain platforms’ help centers. Their view suggests that platforms are specifically designed to allocate minimal resources to fighting and preventing cyberattacks, which is surprising given the scale and widespread use of these companies around the world. Furthermore, they point out that these tools are always dominated by automated responses and analysis generated by bots, making it nearly impossible for an ordinary user to get a human response. Worse still, many of the most complex concerns, such as speech promoting gender-based violence, are self-regulated through the automatic detection of “dangerous” words that are not always culturally relevant and are very easy to circumvent.

Some experts believe that this is not merely a matter of inaction, but rather a deliberate strategy to evade responsibility, as these companies limit themselves to public relations efforts and do not try to meet human rights standards. Moreover, they impose their own ideologies when designing algorithms and moderating content, and they do not comply with demands for assistance from specialized organizations.

“The online attacks are against me personally, against my humanity.” This quote summarizes how digital violence transcends the online space and can materialize in multiple areas of life – personal, social, community and political-organizational. Although the woman defender who voiced this phrase had already heard the notion that the virtual world is also real, it was only after she experienced digital violence that this idea took on concrete meaning. The heightened intensity of these attacks can affect the way we communicate, obtain information and engage in activism, leading to demobilization and silencing that undermine our work defending human rights.

RISKS TO OUR PERSONAL WELLBEING AND THAT OUR FAMILY

• Emotional harms: The violence of misogynistic messages, disinformation campaigns and threats (that often include members of our families) spreads through the digital territory seeking to harm us at the psycho-social level, causing stress, insomnia, fear, depression, anxiety and a permanent state of alert or hypervigilance.

• Physical harms: Emotional harms can also appear in the body through pain and illness. 

• Material harms: Digital attacks can also have high economic costs, from losing our jobs due to smear campaigns to the material harms that come from forced displacement due to death threats or public dissemination of sensitive information about our location.

• Harms to our personal and professional relationships: Exposure to permanent harassment can result in loss of trust or fear of engaging with us among some people in our close circle.

• Harms to our political rights: Our first reaction to digital violence and harassment is to limit our exposure to social media, block suspicious users and be more cautious in our use. While this can be a good strategy to prevent and mitigate violence, it can also obstruct our access to rights that can be facilitated through the internet, such as access to information, freedom of expression and the right to assembly and organization. Thus, digital attacks can limit our use of the digital territory as a space for expressing opinions, accessing knowledge and connecting with political and professional networks.

RISKS TO OUR MOVEMENTS 

• Harms to the credibility of our demands: Gendered disinformation and other technology-facilitated violence can affect public opinion and the credibility of our leadership, struggles and movements.

• Harms to relationships within social movements: Constant attacks in the digital territory can affect our political relationships by provoking mistrust and threatening those who are associated with us. 

• Harms to the reach of our ideas: Constant attacks lead us to modify our strategies for how we interact online, limiting the reach of our activism and of our organizations. This can have repercussions on political discussions at the national and regional levels, as it limits the free exchange of diverse ideas and stifles counter-hegemonic viewpoints. 

• Changes to our digital care and protection measures: Confronting digital violence can lead to a recognition of the need for more careful strategies regarding our online presence and our digital security. As such, we note that we have gained knowledge regarding care in the use of digital technology. At the organizational level, this awareness of the need for digital care has led several organizations to specialize or connect with specialist networks to conduct risk assessments and implement digital security measures. To illustrate this, 64% of the women defenders surveyed reported having received some form of support from like-minded organizations or collectives in cases of technology-facilitated violence.

This study has revealed how digital violence against women and gender diverse people who defend rights is used to silence critical voices and to preserve and perpetuate patriarchal, racist and classist power structures. 

Considering the complexity of today’s digital landscape, seeking to address the situation of violence described above and to promote feminist holistic protection for women defenders, we make the following recommendations:

To states 

• Recognize the seriousness of the digital violence faced by women defenders and take urgent action to stop its normalization and to expose its intertwining with violence in the physical sphere. 

• Create standardized national registries of digital attacks against women defenders, which are essential in order to develop measures to prevent, investigate and guarantee non-repetition.  

• Strengthen national protection mechanisms and build capacity to provide comprehensive responses to digital violence, with a differentiated approach focused on protecting women and gender diverse human rights defenders. 

• Guarantee rapid responses to cases of digital violence through specific measures such as content removal, psychosocial and material support, and replacing equipment and restoring connectivity.

• Establish specialized mechanisms and law enforcement offices with a differentiated approach that acknowledge the particularly vulnerable situation of women and gender diverse defenders in the digital sphere, and offer protection. 

• Guarantee effective coordinated investigation processes that can respond quickly, investigate the use of spyware and take cross-institutional action against organized hate and disinformation networks.

• Guarantee regulatory frameworks that protect digital rights and set out clear responsibilities for social media platforms to foster a digital space free from violence.  

• Refrain from using or allowing the use of any digital platform or tool to censor, surveil or criminalize human rights defense work.

To international human rights bodies and mechanisms 

• Acknowledge and name digital violence against women defenders as a particularly serious threat.

• Broaden the definition of digital violence against women defenders, recognizing its link to offline violence, highlighting its gender-specific components and impacts, and expanding its definition to include forms of attack identified through our experience, such as “zoom bombing” and “viral hate”. 

• Promote coordination among different international mechanisms to provide prompt responses that support and counteract the impacts of digital attacks, including the establishment of specific mandates and the adoption of protection measures; publishing practical guides and assessments based on real-world experiences in order to understand the situation; deepening and expanding standards; analyzing the impacts of the use of Artificial Intelligence on digital violence against women defenders; and promoting flexible emergency funds, digital protection infrastructure and common reporting standards.

To social media companies

• Prioritize human rights and ethics over profits. This entails investing in mechanisms to provide prompt assistance and support in response to digital attacks, removing violent content that targets women and gender diverse defenders, promptly restoring accounts and content related to human rights defense, using verified channels, introducing human moderation with local expertise and stopping the algorithmic amplification of hate. 

• Strengthen support mechanisms through investments that ensure a gender and human rights based approach and a reliable human review to address and comprehensively respond to digital violence against women defenders and gender diverse people. 

• Use posts and campaigns to show clear positioning in support of the work of women defenders and gender diverse people who use social media to conduct their legitimate human rights defense work.

• Develop transnational means of collaboration and facilitate information that enables the identification of assailants, in order to prevent new attacks, ensure reparation of harms and guarantee non-repetition. 

To social and human rights organizations

• Include digital security and psycho-social well-being as permanent components of protection strategies, based on contextualized methodologies that take into account the diversity of realities at the territorial level: age, gender, education, access to the internet and to digital equipment, etc.

• Develop protocols to respond to digital attacks that allow for the timely identification of technology-facilitated violence, its documentation, assessment and responses – including criteria to determine when protection mechanisms must be activated.

• Strengthen capacities for documenting and preserving digital evidence so that attacks can be systematically registered and used for filing complaints, advocacy actions and – where appropriate – investigation and prosecution.

• Systematically document the links between digital violence and physical attacks, in order to show how these two forms of violence reinforce each other and are part of broader persecution and silencing strategies.

• Develop collective early-warning and monitoring systems, particularly to detect coordinated harassment, stigmatization, disinformation campaigns and other forms of digital violence against us and our organizations.

• Establish collective support and response mechanisms that ensure that those affected do not face attacks alone and that enable the distribution of tasks related to containment of the attack, documentation, communications and reporting.

• Promote communications and response strategies to counter disinformation and stigmatization campaigns, ensuring that the responses do not amplify attacks and prioritizing actions that protect those affected.

• Strengthen collaboration among organizations, journalists, technology experts and actors involved in protection efforts to improve the capacity to identify patterns and impacts of digital violence, and to respond in a coordinated manner.

• Promote advocacy efforts to demand transparency and accountability from states and technology and telecommunications companies regarding the use of surveillance technology, personal data protection and measures taken to address digital violence.