Digital abuse can, in extreme cases, amount to torture under international law. That is the conclusion of a new legal analysis by DIGNITY Senior Legal Adviser Grant Shubin for the Cyber Law Toolkit.
The hypothetical scenario follows a journalist targeted by a State through sustained surveillance, threats, online harassment, hacked intimate material and sexualised deepfakes. Together, the attacks cause severe psychological harm.
In the Q&A below, Grant Shubin explains how existing torture law can apply to digital abuse and what this could mean for courts, investigators and human rights practitioners.
The Cyber Law Toolkit is an international, open-access resource on how international law applies to cyber operations, developed by partners including the NATO Cooperative Cyber Defence Centre of Excellence, the International Committee of the Red Cross and the University of Exeter.
Seven questions for Grant Shubin
01
You argue that wholly digital conduct can, in extreme cases, cause mental or psychological suffering severe enough to amount to torture. What kinds of digital abuse are we talking about?
We are talking about extreme forms of digital abuse, particularly when they are persistent, coordinated and difficult to escape. In the scenario, the victim receives thousands of intensely harassing messages, including misogynistic abuse and credible threats of sexual violence and death. Her devices and communications are placed under constant surveillance. Intimate images are hacked and published, AI is used to create sexualised deepfakes, and private messages are exposed in order to forcibly out her as a lesbian.
Like in many instances of torture, the suffering accrues cumulatively. When a person is subjected to harassment, threats, surveillance, sexual humiliation and exposure across every part of their digital life, continuously and over a prolonged period, the psychological impact can be severe—and, as the scenario demonstrates, amount to torture.
02
There has already been discussion about “cyber torture”. What does that mean, and what does this scenario add that is new?
In 2020, the UN Special Rapporteur on Torture addressed Cyber Torture directly in a thematic report on psychological torture where he recognized that cyber technologies can be used to inflict severe mental suffering, including through surveillance, harassment, intimidation and public shaming.
What this scenario adds is a much more practical legal analysis. Rather than simply saying that cyber conduct can amount to torture, it takes a concrete factual pattern and works through the legal test, element by element: severe mental suffering, intent, prohibited purpose, State involvement and, for crimes against humanity, custody or control.
My hope is that by bringing a technical and legal analysis, we can shift the discussion from a general proposition to a framework that courts, investigators, and human rights practitioners can actually use in documenting torture when it is perpetrated via cyber means.
03
Your analysis works through the legal elements of torture one by one. Which of those elements are easiest to apply in the digital sphere - and which are the most difficult?
Some of the legal elements are relatively straightforward to apply in the digital sphere. Intent, for example, can be established from a coordinated campaign of hacking or surveillance. The prohibited purposes of torture—such as intimidation, coercion, punishment or discrimination—also translate quite readily. If a State deliberately targets a journalist with threats, sexualised abuse and surveillance because of her reporting, those purposes are not fundamentally different just because the conduct is carried out through digital or cyber means.
In the scenario, the public-official requirement is also straightforward because the campaign is carried out by a government agency. In real cases, however, State involvement may be much more obscured by the operators covering their tracks or acting anonymously. Having said that, from a practical perspective, operations like the one in the scenario require considerable technical capacity, access to surveillance tools, coordination and resources, all of which may provide important evidence of State involvement.
The trickiest question is severity: can conduct that happens through a phone, computer or online platform really cause suffering severe enough to amount to torture? People might assume that a victim can simply turn off the device, close or block an account, or walk away. The scenario is designed to show why that assumption can be wrong. Empirical studies increasingly show that sustained online harassment, cyberstalking and hate speech can be associated with serious psychological consequences, including anxiety, depression, PTSD symptoms, hypervigilance and, in some cases, suicidal ideation (see here, here, and here). When the abuse is persistent, follows the victim across platforms, includes surveillance, credible threats, forced exposure of intimate material and public humiliation, and becomes effectively inescapable, the psychological consequences can be profound.
The most important point is that we do not need new laws to properly confront torture carried out by cyber means—existing torture law already provides the tools.
04
One of your key arguments is that “custody or control” does not necessarily require physical detention. How can a person be under a perpetrator’s control through their digital and online environment?
“Custody or control” is a distinct legal element for proving torture as a crime against humanity under the Rome Statute of the International Criminal Court. (Which is to say it is not required to show torture as a human rights violation).
And it sounds, at first, like it must mean a prison cell or physical detention. But the legal authorities are broader than that. International criminal jurisprudence makes clear that formal detention is not required and that some form of control can be enough.
The scenario asks what that means for a digital environment. In the scenario, the perpetrators effectively dominate the victim’s online and digital life. They monitor her communications, populate her inboxes and social-media accounts with threatening and degrading content, publish hacked and manipulated intimate material, and make it extremely difficult for her to escape the campaign because blocked accounts and removed content simply reappear elsewhere.
That kind of control can create a situation of profound powerlessness. The UN Special Rapporteur on Torture has made a similar point, observing that people who are systematically targeted by cyber-surveillance and cyber-harassment may be left without any effective means of defence, escape or self-protection, placing them in a situation comparable, in that respect, to physical custody.
So whether the victim was in the ‘custody or control’ of the perpetrator is not as simple as ‘was the victim locked in a room?’ For digital or cyber environments, the more telling question is whether the perpetrator exercised such pervasive control over the victim’s environment that she was effectively unable to escape or protect herself from the abuse.
05
Why does the cumulative nature of the abuse matter? How do surveillance, threats, harassment, deepfakes, forced outing and intimate-image abuse interact to intensify suffering?
The cumulative nature of the abuse matters because severity of suffering is not always about one isolated act. A single threatening message or one episode of online harassment may not, by itself, amount to torture. But thousands of messages, constant surveillance, repeated threats, sexualised deepfakes, the circulation of intimate images and forced outing can accumulate and reinforce one another over time.
Torture law already recognizes this idea. Conduct that may not reach the threshold when viewed in isolation or in a single moment can become severely harmful when it is prolonged, repeated and combined with other forms of abuse. For example, in sensory or sleep deprivation, or solitary confinement duration and accumulation fundamentally change the impact on the victim.
Such cumulative pile up is what happens in the scenario. The victim cannot simply avoid one platform or block accounts. The abuse follows her across her phone, email, social media and workplace; threats are amplified by surveillance; intimate-image abuse is intensified by public humiliation and forced outing. Together, these acts create an omnipresent and unpredictable environment that produces severe psychological suffering.
06
The scenario is hypothetical, but it draws on documented practices from countries including Belarus, Ukraine, Myanmar and Ethiopia. How close is this legal scenario to what is already happening in the real world?
Very close. The scenario is hypothetical, but the forms of abuse it describes are drawn from documented real-world practices.
The factual pattern brings together conduct seen in places includingBelarus, Ukraine, MyanmarandEthiopia: intrusive surveillance, hacking, coordinated harassment, threats, the misuse of personal information, posting of degrading images, and the weaponisation of digital platforms against journalists and other perceived opponents. The scenario also draws on broader examples such as Project Raven (were the UAE hacked into hundreds of iPhones belonging to political figures, activists, and perceived opponents and remotely obtain photos—including compromising and sexually explicit images—emails, text messages, location data, and saved passwords) and the Pegasus revelations (mobile phone spyware that can copy messages, harvest photos, record the phone owner’s calls, track the owner’s movements, and switch on microphones and cameras for recording live video and audio).
So the hypothetical is not meant to imagine some distant future. It takes practices that already exist and asks what follows when we analyse them through the legal framework of torture. In that sense, the scenario is fictional, but the underlying conduct is not.
07
If this analysis is right, what should courts, prosecutors and human rights organisations start doing differently now?
The first step is recognition. Courts, prosecutors and human rights organisations need to recognize that torture can be perpetrated through digital and cyber means.
The traditional paradigm of torture — prisons, interrogation rooms, physical restraint — remains very real. But perpetrators are no longer limited to fists, batons or electrodes. They can also use spyware, botnets, algorithms, social media platforms and AI to surveil, threaten, humiliate, isolate and intimidate people.
For documenters, investigators, prosecutors, or judges recognition means looking at these abuses in a way that unpacks their torturous nature. This includes apprehending the full context and cumulative impact of such conduct, such as: the nature and content of the abuse; the means used to carry it out; its psychological or physical consequences for the victim; the duration of the conduct; how sustained or inescapable it became; the scale and reach of dissemination; the credibility and immediacy of threats; the extent of surveillance and intrusion into the victim’s private life; the degree of control or powerlessness created by the campaign; the level of coordination required to carry it out; who was behind it; and what purpose it served.
Overall, the point is not to create a new category of harm, but to recognize when the torture we know is being carried out through new, in this case cyber, means.
Grant Shubin
More Q&A's
