DIGITAL BODIES, TERRITORIES IN DISPUTE: MEXICO

For decades, Mexico has confronted the imposition of a neoliberal capitalist model that has enabled the accelerated concentration of wealth, thus increasing social inequality and leading to the impoverishment of more than half the population. This model fosters corruption and exploitation at the expense of the rights of the majority, adversely affecting women, children, Indigenous and Afro-Mexican Peoples, and the working class. The cruelty of this model – rooted in extractivism and policies of accumulation through dispossession that lead to precariousness and death – has exacerbated insecurity and violence in its various forms.

Violence in Mexico escalated following the so-called “war on drugs”, declared in 2006 by then President Felipe Calderon and continued by Enrique Peña Nieto. In practice, this strategy involved the mass deployment of the Armed Forces for public security tasks in the country’s territories and communities. As a result, they unleashed one of the most serious crises of violence and human rights violations in recent decades, with profound impacts on the economy, politics and the social fabric, which are very difficult to reverse in the short term (IM-Defensoras, 2024).

Although there has been a shift in the narrative of the Federal Executive Branch over the past two six-year terms, and other security models have been implemented, the creation of the National Guard and the power retained by the Army intensified concerns about the militarization of civilian tasks, reports of human rights violations and the persistent infiltration of organized crime in state security structures.

Measures were implemented in recent years that have reduced inequality. However, these have failed to transform the structural conditions that give rise to inequality, and thus social violence and capitalist policies like extractivism persist and continue to be a source of conflict in many territories throughout the country.

The historical and structural violence present in the country has led to very high rates of homicides, feminicides and other forms of violence. In 2023, Mexico ranked fifth among the countries with the highest homicide rates in the world (World Population Review, n.d.). This situation is reflected in the homicide rate per 100,000 residents recorded in 2024: while the global rate was 5.8 and the rate for the Americas was 20.2, in Mexico, it reached 25.8 (INEGI, n.d.). In 2024, the states with the highest homicide rates per 100,000 residents were Colima (123), Morelos (77), Baja California (65), Guanajuato (63) and Chihuahua (60). In January 2026, INEGI reported that from January through June 2025, the national rate of suspected homicides was 11.1 per 100,000 residents; this was lower than the rate recorded for the same period in 2024, which was 12.6. Regarding feminicide, 852 feminicides were recorded in Mexico in 2024, which averages to one every 10 hours and amounts to a rate of 1.3 gender-related killings of women per 100,000 female residents (ECLAC, 2025). 

This widespread context of violence seriously undermines the human rights of the population and increases the risks faced by those who defend them. The law for the protection of journalists and human rights defenders came into effect in 2012, establishing an official protection mechanism. As of October 2025, the mechanism has benefitted 2,619 people. Between 2012 and October 2025, 70% of attacks reported to the mechanism related to threats, 25% to physical attacks and 5% to kidnapping or deprivation of liberty (Protection Mechanism for Journalists and Human Rights Defenders, 2025).

It must be noted that, as Mexico is a Federal Republic, different realities and complexities coexist in the country. At the federal level, protection measures and efforts have been advanced to address structural causes (in some cases, in dialogue with human rights organizations and social movements); however, the reality in the territories and at the state level does not often align with federal efforts.

In several states, violence and territorial control exerted by so-called organized crime groups overwhelm institutional capacities, revealing high degrees of complicity between some public authorities and unlawful groups. This has led to the instrumentalization of the state by these groups and other economic powers, thereby consolidating a system of impunity that directly impacts all aspects of Mexican people’s lives and, in particular, the work of women human rights defenders.

Between 2019 and 2024, our registry system documented 10,262 attacks against 2,303 women defenders and 143 organizations in Mexico. The largest portion of these attacks were concentrated in Chiapas, Oaxaca and Mexico State. Mexico City joins the list, in part due to its greater share of the population and because conditions allow for better access to the information that feeds into our registry.

Year after year, Mexico ranks among the deadliest countries for journalists. Small and alternative media outlets face media oligopolies, criminalization and violence. The precarious working conditions for journalists are another key factor to understand the level of exposure and risk inherent in the profession. Furthermore, our registry system has documented greater attacks against those who cover issues related to politics, corruption and collusion between organized crime and political actors. Journalists who cover demonstrations, particularly feminist marches, also face an especially high level of risk (IM-Defensoras, 2024).

Meanwhile, extractive policies in the country persist. Although there is currently a push for greater state oversight and a shift in the allocation of resources toward social programs, this has not fundamentally altered the developmentalist economic model that continues to devastate territories. As of the date of this report’s publication, 230 environmental conflicts have been documented in Mexico (EJAtlas, n.d.). In this context, women defenders of land, territory and natural resources confront hegemonic models of capitalist accumulation and extractivist exploitation, in an inherently transgressive struggle that exposes them to particularly high risks.

The Mexican Center for Environmental Law (CEMDA, 2024) reveals that 102 environmental defenders were killed over a 10-year period, 20 of which were killed in 2023 alone. Regarding non-lethal attacks, CEMDA registered 1,317 cases, the majority of which affected indigenous people whose struggles center on the defense of territory against mining and the defense of water.

In the last three years (2023–2025), our registry of attacks documented 655 attacks against women defenders of land, territory and natural resources in Mexico. These women confront the powerful economic interests that sustain extractive and infrastructure projects. Some of the recorded attacks occurred within the context of resistance to the Mayan train megaproject, the mega pig farm in Yucatan, the inter-oceanic corridor in Oaxaca, the Bonafont Company’s water exploitation in Puebla, and various real estate projects throughout the country (IM-Defensoras, 2025a).

Additionally, since the start of the so-called “war against drug trafficking” in 2006, the situation of risk faced by those who defend the right to truth, justice and reparation has become more acute. This is particularly reflected in the attacks against women searching for disappeared persons [buscadoras in Spanish], with a higher incidence in states such as Jalisco, Guanajuato, Querétaro, Quintana Roo, Morelos, Guerrero, San Luis Potosí, Michoacán and Oaxaca (IM-Defensoras, 2025b). At present, and according to the National Registry of Disappeared Persons updated as of January 8, 2026, there are 133,472 people in Mexico who have been reported missing and have not been located (Comisión Nacional de Búsqueda, n.d.). The scale of the crisis of disappearances in the country is directly proportional to the level of risk and violence faced by the women who search for their loved ones.

Between 2020 and June 2026, we documented the feminicide of 23 buscadoras, accounting for 38% of all women defenders killed in Mexico. Additionally, we documented other types of attacks against this group of women defenders, including stalking, surveillance, death threats, physical assaults and disappearances (IM-Defensoras, 2026).

Two other groups of women defenders who are particularly vulnerable to attacks in Mexico are those who defend women’s right to a life free from violence and those who belong to and/or promote advances in guarantees for the rights of sex and gender diverse communities.

The violence against women defenders of women’s right to a life free from violence comes from the assailants of the women they accompany, as well as the entire institutional and de facto infrastructure that protects and perpetuates the patriarchal order.

Between 2020 and December 2025, we documented 2,582 attacks against women who defend this right, most of which (75%) were committed during collective actions. According to the 2024 report by Letra Ese (2025), of the 80 LGBTTTIQ+ victims of homicide registered in 2024, at least seven were recognized as human rights defenders, five of which were trans women, one was a gay man and one was a Muxe person [a Zapotec word for non-binary people].

The situation of trans women defenders is especially worrying, as they face an especially high risk of lethal violence.

Through our registry, we have documented 16 transfeminicides of women defenders between 2020 and June 2026.

Additionally, we have registered the use of smear campaigns that question the leadership and moral integrity of women defenders of the rights of sex and gender diverse people through ridiculing their sexual lives or spreading false accusations of corruption or misuse of their organizations’ resources.

Mexico has robust laws to guarantee data protection and combat cyberbullying. However, we have identified practices, amendments, proposed reforms and the creation of laws, regulations and protocols that – without adequate human rights safeguards and limits – could allow for surveillance practices and facilitate the criminalization of human rights defenders and their collectives.

CONNECTIVITY

Mexico has the highest percentage of the population with access to the Internet and information and communication technologies (ICT) in Mesoamerica. The National Institute of Statistics and Geography (INEGI) and the Federal Institute of Telecommunications conduct the annual National Survey on Household Availability and Use of Information Technologies (ENDUTIH), which in 2024 found that 83.1% of the population aged 6 and older had access to the internet, 81.7% had a telephone, and 43.9% of households had a computer. When broken down by gender, the data show that 82.3% of women had access to the internet – compared to 84.1% of men – which is a significant increase from 2021. The age group with the highest rate of internet use was 18-24, while people over 65 used it the least (INEGI, 2025a).

It is important to note that there are variations by state, and between rural and urban areas. In 2024, the states with the highest percentages of the population using the Internet were Sonora (91.3%), Quintana Roo (90.7%) and Baja California Sur (90.4%). In contrast, the lowest percentages were found in Oaxaca (69.2%) and Chiapas (64.9%) (INEGI, 2025a).

PERSONAL DATA PROTECTION

Articles 6 (Section A) and 16 of the Political Constitution of the United Mexican States as well as the General Law on the Protection of Personal Data in Possession of Obliged Subjects (2025) protect personal data, although not unconditionally, as they allow surveillance on grounds of security, public order, public safety and public health, and to protect third-party rights. These provisions can be found in Articles 252, 291 and 303 of the National Code of Criminal Procedures, which, in summary, stipulate that any interception must be authorized by a judge after being requested by the head of the federal or state Attorney General’s Office. In certain exceptional and urgent cases, the Public Prosecutor’s Office may also order the disclosure of personal data, a decision that must be confirmed by a judge within 48 hours.

Articles 189 and 190 of the Federal Telecommunications and Broadcasting Law (2014) establish, in general terms, the obligation of telecommunications license-holders – and even service, application and content providers – to comply with any written, well-founded and reasoned order issued by a qualified authority. This includes cooperation with security, law enforcement and judicial agencies; facilitating real-time geolocation; and retaining and providing users’ communications data (also known as “communications metadata” or “communications traffic data”) when requested by appropriate authorities – that is, by the head of the Public Prosecutor’s Office of the Republic or their state equivalents; by any agent of the Attorney General’s Office (pursuant to an agreement published on 6 December 2023); by the National Intelligence Center; and by the head of the National Guard. Additionally, the National Guard Law, the National Code of Criminal Procedures and the National Security Law authorize the latter three agencies to intercept communications under the conditions described above, but without setting any limits.

All the laws protecting personal data and private communications allow for some form of exception with a court order, and action can even be taken without such an order in emergency situations, thus posing a risk to digital rights.

In its report “El Estado de vigilancia fuera de control” [“The State of Surveillance Out of Control”], the Digital Rights Defense Network (r3d, 2016) revealed that although less than 3% of all requests received by telecommunications companies for access to retained data between 2013 and 2015 were backed by a court order, information was disclosed in more than 95% of cases – even to agencies not authorized by law to make such requests. Less than 9% of all these requests resulted in legal proceedings. There is no data available for recent years because telecommunications companies are no longer required to provide this type of information; it is therefore not known how this legal recourse is currently used.

DIGITALIZATION INITIATIVES

On 14 March 2023, the Chamber of Deputies approved the General Law on the Operation of Civil Registries (LORC), which transfers the administration of the Civil Registry to the Ministry of the Interior – a federal institution – and establishes the National Identity and Registry System (SID) – a centralized mandatory biometric database that would house records of births, deaths, marriages, adoptions and divorces, as well as gender changes and the Unique Population Registry Code (CURP) with a photograph. As of the date of this report’s publication, this law is on hold because it has not yet been approved by the Senate.

Meanwhile, significant changes have taken place following the latest amendment to the General Population Law, published on16 July 2025 in the Official Gazette. This reform provides for the mandatory collection of data on the Mexican population based on the biometric CURP, which includes photographs, fingerprints and other biometric data. Similar initiatives were put forward in recent years – first in 2021, with the Single Digital Identity Card; then in March 2023, with the Citizen Identity Card; and later that same year came the CURP with a photograph.

It is of the utmost importance that all these digitalization initiatives establish clear limits within the human rights framework, to prevent the unrestricted transfer of this data to other public or private entities.

CYBERSECURITY

Various proposals to create a Federal Cybersecurity Law have been put forward and promoted over the past years, seeking to strengthen data protection, comply with international cybersecurity standards, establish parameters for cybercrimes and penalties associated with them, create a national registry of cybersecurity incidents and establish a new entity to coordinate and oversee these efforts. The most recent draft law was introduced in the Senate on 30 April 2025, and has yet to be passed. Likewise, the General Law on Cybersecurity Coordination was submitted to the Chamber of Deputies in January 2026, proposing the creation of a “National Cybersecurity Agency” to serve as a coordinating body among different areas of government.

In December 2025, the Digital Transformation and Telecommunications Agency (ATDT) approved the General Cybersecurity Policy for the Federal Public Administration, whose aim is “to establish a common comprehensive cybersecurity framework for the Federal Public Administration that safeguards digital rights, protects government infrastructure and information, guarantees the resilience and continuity of digital services, and reduces systemic risk to the state through differentiated controls, dynamic risk management and continuous improvements” (ATDT, 2025).

VISIBILITY AND PROTECTION IN THE FACE OF DIGITAL VIOLENCE

The INEGI module on cyberbullying (MOCIBA) found that 21% of internet users aged 12 and older suffered cyberbullying in 2024; 22.2% among women and 19.6% among men. The 12-19 and 20-29 age groups reported the highest levels of cyberbullying, for both men and women. The two main forms of cyberbullying for both men and women were making contact using fake identities and sending offensive messages. However, women are more likely than men to be subjected to cyberbullying that is sexually explicit or involves sexual innuendo and advances; 27.5% of acts of cyberbullying reported by women included sexual content and 29% involved sexual innuendo and advances, while the corresponding figures for men were 15.8% and 13.9%, respectively (INEGI, 2025b).

The feminist movement’s effort to expose digital violence, along with the activism of Olimpia Coral Melo – who became a symbol of this struggle after becoming a victim of non-consensual distribution of intimate content – were instrumental in the Senate passing of the legislation known as Olimpia’s Law in November 2020. It is not strictly a law, but rather a set of reforms aimed at recognizing and punishing digital violence by declaring the digital distribution of intimate content without consent a criminal offense, guaranteeing the protection of victims and promoting preventive awareness campaigns. Unfortunately, effective implementation remains a challenge, as does ensuring that complaints are formally received and that – once admitted – judicial proceedings are initiated and result in a verdict. Additionally, Ingrid’s Law was passed in 2023, establishing a set of reforms to punish public officials who disseminate images of victims and survivors of violence, with the aim of safeguarding their dignity and integrity. This law also provides for an amendment to the Criminal Code to expand the penalties for acts of corruption and harassment of minors using electronic means.

The testimonies gathered in this study reveal how digital use and care practices have changed over the years, as the majority of women defenders note that they now use technology much more intensively; that they are more aware; and that they adopt care practices regarding their data and privacy. As an anecdote, one woman defender interviewed recounts that when she got her first cell phone number, she wrote it on a blackboard so that people could see it; today, she says this would be unthinkable.

Overall, technology is initially seen as a neutral tool, but this perception changes over time. For some women defenders, traumatic experiences – such as spying or other forms of digital attacks – are what prompt them to educate themselves:

“After so many years, I’m finally taking my first short course on digital materials, tools and everything having to do with security.”

For others, the context and seeing other women defenders take precautions when using technology have helped them recognize the problems and learn together.

Although none of the women interviewed identify themselves as being experienced in digital care, their testimonies show that some women defenders actually do know about, and apply, certain security strategies and practices. For example, some testimonies name as a care measure the practice of compartmentalizing content based on the context – whether it is personal or work-related – and the type of social media platform on which it is shared – whether open or restricted. Another measure identified, which stems from the nature of their work, is to exercise special caution when sharing information on their cell phones while crossing national borders. There are other measures that come from daily practices, such as changing passwords and using backup email accounts.

A key intersectional factor in women defenders’ adoption of technology and digital security is age.

“I’m already 61, so yes, I don’t have the same ease that younger women have in using technology, but I’m making an effort”.

In fact, the interviewees value more formal learning opportunities like digital security courses during which women defenders share experiences, especially from an intergenerational perspective, where – as one testimony states – younger women defenders who are more familiar with technology provide support to those who are older.

According to our registry, 2,377 digital attacks against women human rights defenders and their organizations were committed in Mexico between 2020 and 2025, meaning one in five (20%) of all attacks registered in the country during the period were carried out through digital means. 

The majority of these attacks targeted women journalists, women defenders of the right to information and freedom of expression, and women defenders of women’s right to a life free from violence.

The Mexican women defenders who participated in the survey believe that digital attacks are systematic as part of their activism and that the situation has worsened over the last two years. As such, the majority feel vulnerable to attacks linked to the use of technology due to the hostile context for defending human rights where impunity persists, and digital attacks are perceived to be on the rise.

THE GENDER DIMENSIONS OF DIGITAL VIOLENCE

According to our registry, 70% of the digital attacks documented in Mexico between 2020 and 2025 include gender components.

The testimonies collected for this study confirm these findings and show how technology-facilitated attacks are part of patriarchal strategies to silence and intimidate women defenders.

The verbal abuse expressed on social media is usually rife with misogyny and includes derogatory comments regarding women defenders’ physical appearance, a sexualization of their bodies and constant challenges to their feminism. Misogynistic attacks are especially common against feminists. As one of the women defenders interviewed notes,

“There are causes that are recognized as valid, and others that are constantly questioned. I think about this a lot when it relates to women’s rights, and even more if we talk about girls and adolescents, or lesbians and bisexual people.”

Another factor is the use of sexual violence as a component of attacks. Examples include the publication of intimate images or videos of women defenders without their consent as well as threats of “corrective” rape when they do not comply with the patriarchal mandate of heterosexuality. Death threats are also widespread and extend to women defenders’ family members, due to the roles of mothers, grandmothers and caregivers that many of them play, which causes them particular distress.

When we asked them about the most common forms of digital attacks they face in their activism, we found that the Mexican women defenders we interviewed had difficulty distinguishing and naming them. Hacking and spying, for example, are concepts that allow for a wide range of interpretations. Given this situation, we describe and categorize the different types of attacks we identified based on the interviews and surveys, highlighting their impact on women defenders.

• Digital harassment. This form of attack seeks to frighten, anger and humiliate women defenders in order to delegitimize their work. Misogynistic insults are hurled at both women defenders and their organizations, which – depending on the context – can be experienced as a form of systematic intimidation. The greatest number of attacks are carried out on social media. Another common harassment tactic is the attempt to take over their accounts or profiles. For some women defenders, these attacks have become somewhat normalized – perhaps because their impacts are dismissed, or because they have neither the time nor the resources to devote too much attention to them. Nevertheless, these attacks end up being costly. One of the interviewees notes,

  “The truth is that it has taken up some of our meeting time to reflect and work through our feelings, without being able to find a strategy to address the situation.”

  In April 2023, the feminist news site SemMéxico was hacked by 1915 Team (a hacker or group of hackers), which gained unauthorized access to the site, altered its appearance and left a threat in English. SemMéxico had previously experienced ten failed attempts, although it is unclear if those were similar types of attack.

• Threats. These attacks target the integrity of women defenders and their families, ranging from direct death threats to warnings of rape.

• Digital sexual violence. This type of attack involves sending messages or making calls with sexually-explicit language in order to harass or threaten women defenders. It also includes the non-consensual distribution of intimate images of women defenders, usually by ex-partners. This type of violence generates a broad range of responses: some do not take it seriously, while for others, it has cost them their jobs.

  In 2025, we documented the case of a woman defender who was attacked online by the ex-partner of the woman she was accompanying, after the latter had reported the man for the crimes of kidnapping and attempted feminicide. The constant attacks and harassment this woman defender experienced included threats and the use of fake accounts to send sexually explicit photographs via Facebook messages.

• Illegal surveillance. This type of attack involves a wide range of tactics: unauthorized recordings that are made public to harass, intimidate or spread disinformation; phone tapping; electronic surveillance; tracking the woman defender; and monitoring her digital activities. It is important to note that the spying and surveillance taking place in the country is part of a long-standing strategy to control social leaders and collectives.

  One case that illustrates the implications of these systems of surveillance or espionage is that of Mexican journalist Marcela Turati, a woman defender of the families of the San Fernando massacre victims. From 2015 to 2016, the Specialized Deputy Prosecutor’s Office for the Investigation of Organized Crime (formerly SIEDO) targeted Marcela, along with Argentine expert witness Mercedes Doretti and Ana Lorena Delgadillo, mapping her communications, tracking her phone calls and text messages, and logging her geolocation (Castañeda, 2021). This had a psychological and physical impact on Marcela’s personal and professional life, but it also had collective effects by fueling impunity and promoting fear, distrust and criminalization toward and among those who seek justice and work as journalists and lawyers.

These types of attacks can appear simultaneously. For example, illegal surveillance has been found to be sometimes connected to forms of harassment that – through other means – let a woman defender and her organization know that they are being watched:

“I’m talking (on the phone) and there’s this huge echo; voices start coming through, and they start playing a recording… I mean, it’s obvious, they’re listening to us.”

According to our registry system, 53% of perpetrators of digital attacks registered in Mexico between 2020 and 2025 were unknown persons.

Mexico is a vast country, and the political realities that women defenders face vary greatly from one region to another. Likewise, the identities of the perpetrators also span a wide range of possibilities, as one testimony states,

“There comes a point where you don’t know who your assailant might be – whether it’s a state actor, someone targeting you because of your defense work, or perhaps a deranged ex who’s still obsessed with you.”

While it is nearly impossible to identify with complete certainty the perpetrators of these attacks, we know that attacks do not occur in a vacuum; behind them are people with vested interests – business elites, organized crime, members of political parties, state authorities – or people from the women defenders’ close circle – from within their communities or organizations, as well as ex-partners or former colleagues.

These are the groups of perpetrators that stood out in the testimonies collected:

1. Close circle. Several testimonies indicate that ex-partners generally engage in digital sexual violence, particularly by posting intimate images without consent. Meanwhile, colleagues or opponents of their rights-defense work insult them on social media and conduct harassment and disinformation campaigns against them.

2. State representatives and institutions. Different public officials and institutions have been identified on several occasions as being responsible for digital attacks. This creates a perception for women defenders that they find themselves in a context of a totally unequal balance of power, where they are particularly vulnerable.

3. Organized crime. These groups are identified as perpetrators digital violence against women defenders that is often accompanied by physical threats. The complexity and lethality of these perpetrators lies in their use of professional structures to exercise violence and in the complicity – or tolerance – of some public authorities. What’s more, in the regions with the highest rates of violence, organized crime groups help political blocks win public office or consolidate their power. One woman defender’s testimony notes that these groups

   “do not hold public office, nor are they public servants, but they are involved in election processes and social representation.”

Given the diversity of perpetrators and their motivations, it is difficult to identify clear patterns in their behavior. However, our research reveals the following trends in the modus operandi of technology-facilitated attacks in Mexico:

• Systematic attacks that intensify at specific times. For some women defenders, digital attacks are part of a continuous strategy. However, they point out that there are specific circumstances that lead to an increase in incidents or the emergence of new forms of attack. Digital violence is often activated at strategic times during the women defenders’ work. One testimony states,

  “There have been critical moments during certain cases [we accompany] when we have indeed observed strange activity on our networks and phones. Right now, we aren't dealing with anything sensitive, so it's a quiet moment; I don't notice any sound echoing on the phone, hear any strange noises, or see anyone trying to access my Instagram profile.”

  In November 2020, we alerted that defenders Andrea Sánchez and Thalía Carolina Salazar, along with other feminist collectives and activists from the state of Sonora – members of collectives such as Marea Verde Sonora, Colectiva Juvenil Feministas del Desierto, Defensoras Digitales Sonora, Las de Abajo, Desérticas Films and Niñas Feministas Mx – faced multiple attacks, including the circulation on social media of a “list of feminists to attack”, harassment, hate messages, threats, hacking, physical assaults, surveillance, criminalization, raids and destruction of property. These attacks were especially concentrated in periods when the women defenders issued calls to action for demonstrations such as for 8 March (International Women’s Day), 28 September (International Day for the Decriminalization of Abortion), 2 November 2020, when a vigil was held to protest feminicides.

• Links between digital and physical attacks. Digital attacks maintain a close connection to physical violence. Cutting across the testimonies, we can infer – depending on the perpetrator’s power and resources – a continuous line between digital threats and physical attacks, which can include killings.

  In August 2025, after publishing several articles in news outlet Artículo 7 that revealed alleged links between a businessman extradited to the US on drug trafficking charges and the Tamaulipas state government, woman journalist Shalma Castillo was subjected to various attacks on social media that transcended the digital space and were made real in the physical sphere. At first, Shalma received several death threats on social media; she was the victim of doxing (the disclosure of personal data) through the illegal dissemination of her National Electoral Institute (INE) identification and her address; and she suffered a mass digital harassment attack, with hundreds of messages and calls that rendered her phone unusable, to the point that she was unable to contact emergency services to report the situation. Experts from the organization SocialTIC categorize it as a denial-of-service (DoS) attack on her phone line.

  At the same time, Shalma faced a smear campaign and attempts to criminalize her, with various local media outlets trying to link her to the extradited drug trafficker who was the focus of her investigation. Later, she noticed that the security cameras at her house had suddenly stopped working. This coincided with a group of people wearing vests from the political party that governs Tamaulipas hanging out outside her house, taking pictures, asking neighbors questions and gathering information.

• Use of Open Source Intelligence (OSINT). This is a tactic of gathering and analyzing information from open-source, publicly accessible places – such as the internet, social media, academic publications, official documents and communications media, among others. The practice is often downplayed in the face of other, more complex forms of surveillance; however, there is evidence that various institutions use this tactic to monitor women defenders, activists, feminists and journalists. Furthermore, software and devices designed for this purpose have recently been added to the mix.

  A clear example of this can be seen in the Guacamaya leaks of Army data that exposed how people, collectives and feminist organizations have been spied on for more than fifty years. Research conducted as part of the project “Lo que no callaron las olas” [“What the Waves Did Not Silence”] (Poder, 2023) reveals records from the 1970s containing information on organizations and activities. At time went on, this form of surveillance was updated, and the leaks reveal the use of open-source intelligence (OSINT) to gather information on activists, particularly from Facebook, Instagram and Twitter (now X). This is in addition to the use of state-run camera systems, known as C5.

• Use of sophisticated surveillance tools. Various government agencies (whether or not authorized by law), organized crime and transnational corporations use these tools. Over the past twelve years, Mexican authorities have been found to make extensive and constant use of digital surveillance tools such as FinFisher, Galileo, Pegasus, Circles, ULIN, Reign, Echo, Geomatrix, HIWIRE and TITAN. Some of these tools were confirmed to have been used against women human rights defenders and journalists. Additionally, the National Institute of Migration, the Army, and other state institutions have used tools to obtain personal information without consent, such as forensic phone scanners like the ones manufactured by Cellebrite, MSAB (the manufacturer of XRY) and Magnet Forensics (Valencia and Cejudo, 2024). It was further revealed in 2020 that there are at least 21 fake cell towers (IMSI catchers) in Mexico City, located near military or government facilities, which pose an ongoing risk to those who work nearby or report from those locations – particularly women human rights defenders and journalists. These antennas enable the interception of phone signals and the capture of mobile device traffic. A 2023 investigative report asserted that the Army owns this type of antenna (Tourliere, 2023).

  On the border of the state of Chihuahua, the Centinela platform is described as a “mass surveillance monster” (R3D, 2023). In its official website, the government stated that this is part of a “comprehensive security strategy designed to strengthen surveillance throughout the entire state of Chihuahua using protection systems to prevent and avoid risks that could affect citizens’ lives, meaning, to enhance residents’ peace of mind and well-being” (Government of the State of Chihuahua, 2022). It is, however, an example of mass surveillance that is part of a broader strategy to secure the Northern border and bilateral collaboration between the United States and Mexico. For women defenders and migrants, this means that the Chihuahua government and – therefore – organized crime actors that act in collusion – have the ability to surveil whomever they want with almost total impunity.

In contrast with the other countries analyzed in this study, the majority of Mexican women defenders surveyed affirm they have filed complaints with the state and with digital platforms to report the attacks they experienced. While this shows that there is a legal framework in place that allows for the reporting of digital attacks, for women defenders, the existence of this framework does not in itself guarantee their digital protection.

Three key findings emerge from the testimonies regarding the filing of reports on violence:

• There is a certain level of normalization of violence, which leads to the dismissal of complaints. As one interviewee affirms,

  “we normalize it and we have accepted it as something that happens to us.”

• The state, in its different levels of government, is responsible for guaranteeing the rights of women defenders and is simultaneously an occasional perpetrator of attacks against them.

• The complaints filed with the state do not seem to lead to justice for women defenders. As one testimony affirms:

  “I filed my complaints and the cyber-police, supposedly, would investigate, and then they called me to close the case but without providing any response.”

  Another woman defender also describes her experience:

  “I filed my claim with the Public Prosecutor’s Office, they asked for my cell phone, they did not examine it in front of me, they took it away, who knows if they downloaded it, if they listened to everything... to then tell me that they did not find the people.”

The top areas of digital security in which the Mexican women defenders surveyed feel most vulnerable are: first, facing online smear campaigns and, second, detecting viruses and malware, as well as managing their own digital identities.

To address these vulnerabilities, women defenders point to some organizations and collectives that have created digital security protocols. However, they stress the need to strengthen more holistic strategies and agreements that can allow them to protect themselves in the digital sphere. They highlight the need to create more spaces to talk, exchange and learn about digital violence. As one of the women defenders interviewed notes,

“We still lack many tools to be able to name [what we experience], as well as spaces and strategies, because this cuts across our lives, our emotions and our efforts.”

When analyzing the testimonies collected, we can identify the following common elements: the normalization of violence in the digital sphere; fear of attacks; and a need to learn more about protection and security. Many testimonies point to the need to create intergenerational and regional spaces for permanent exchange and support regarding the following themes:

• Care and use of personal data to ensure security, both for women defenders and their families and people close to them.

• Understanding and implementing more specialized procedures regarding information management.

• Technical support that addresses questions regarding the use of technology, and regarding suspected electronic surveillance.

• Emotional care, because as one testimony affirms in relation to capacity-building,

  “the knots of information that need to be disentangled are accompanied by emotional knots.”

• Channels for support and reporting digital violence, through which women defenders can understand the situation, the state’s responsibilities, and potential obstacles in the search for justice. As one testimony states,

  “so that we can begin to demand a stop to the situation and that the necessary justice be dealt.”

The regional dimension of digital protection and care is seen as positive, as one Mexican woman defender reflects:

“You realize that the care measures are proportionate to the situation of violence against women defenders. Like our sisters who are acting in different places, like Nicaragua and El Salvador. There are some who very quickly say, ‘this yes, this no...’ and we learn from this. At the beginning it can feel very rigid, but then you see the structures through which they are able to mobilize and you have to learn about all these measures.”

Furthermore, the women defenders note the importance of continuing to identify, name and analyze where attacks come from and the factors that could be driving them, in order to determine the best protection programs and the ways to address the risks within the existing legal framework, in the short and long term.

Finally, Mexican women defenders affirm the importance developing a feminist techno-political perspective based on the experiences of social organizations, that can be integrated into protection plans but can also enable them to position themselves regarding the use of artificial intelligence or legislative proposals that promote the use of software or hardware that can be used for surveillance. Internally, feminist protection plans must include mechanisms to address digital vulnerabilities that take into account their psychosocial impacts – not just the technical aspects.