Authoritarian Compliance

ZyMix, a chat-payments-community 'super app' marketed to UK university students as a Gen Z product, stores user data and content on servers owned by Tencent Frankfurt, a German-based Tencent Holdings subsidiary. Tencent was added to the US Department of Defense's 1260H list in January 2026 over alleged indirect affiliation with China's People's Liberation Army. The arrangement routes UK students' personal data and communications through infrastructure owned by a company the US military has flagged as a national-security risk.

A Polish parliamentary investigative commission's final 370-page report, presented October 12, 2026 after 130 sessions and 77 witnesses, concluded that Poland's 2017-2018 purchase of NSO Group's Pegasus spyware was based on a 'triple violation of the law: illegal financing, misleading state bodies and ignoring warnings from its own services and lawyers.' Prosecutors separately stated NSO Group had the technical capability to access data harvested by Pegasus operations run by Polish security services, though they said they could not confirm whether NSO actually exercised that access. Prime Minister Donald Tusk called the episode 'a crime against the state' and 'one of the biggest scandals in the history of Poland after the fall of communism.' The purchase was financed through misuse of the Justice Fund, a fund intended for crime victims; a former deputy justice minister has been indicted over his role in diverting those funds to buy the spyware.

In evidence filed as part of Alibaba's lawsuit challenging its Section 1260H 'Chinese military company' designation, the U.S. Department of Defense disclosed that beyond applying censorship to its own consumer platforms and Qwen generative-AI models, Alibaba develops a product called 'Green AI' that automates real-time content filtering across text, images, voice, video, and streaming data, and sells it as a content-moderation tool to domestic and overseas developers, e-commerce vendors, video-streaming services, and gaming platforms so they can comply with Chinese censorship requirements.

A Pulitzer Center cross-border investigation published October 6, 2026 found that G42 subsidiaries Presight AI and Khazna Data Centres, through a partnership with Egyptian company Benya, gained access to Egypt's public digital health infrastructure under the banner of 'digital transformation.' The investigation traced a multi-year corporate structure -- a 2023 Maadi Technology Park data-center announcement that never disclosed ownership or the operating entity, followed by special-purpose vehicles registered in Abu Dhabi in 2024 with no reference to Egypt -- and found Benya, Khazna, G42, and Egypt's telecom regulator all declined to answer substantive questions over several months. The report also noted weak enforcement of Egypt's 2020 data protection law and flagged G42's history of ties to Israeli defense contractor Rafael Advanced Defense Systems.

Documents unsealed in September 2026 and made public in redacted form around October 3, 2026 showed ICE has been feeding photographs of protesters into a Palantir-built database as part of its immigration enforcement casework system. Palantir's work for ICE includes a 2014 original contract, a roughly $96 million five-year Investigative Case Management (ICM) support contract from 2022, and an additional roughly $30 million in 2025 for the 'ImmigrationOS' platform. Civil liberties advocates say storing images of individuals engaged in First Amendment-protected protest activity in an immigration-enforcement database raises concerns about surveillance of lawful protest and potential chilling effects on civic participation.

An investigative report by Tibet Watch, with research support from C4ADS, analyzed Chinese government procurement tenders, contract awards, police bulletins, flight bans, and training records to document an extensive drone surveillance and counter-drone network built across the Tibet Autonomous Region. Security agencies from regional anti-terror units down to county police stations have acquired DJI equipment, with pilots trained for 'stability maintenance' (weiwen) - the CCP term for suppressing dissent - echoing DJI's 2017 training of police in Xinjiang for similar purposes. The report found authorities closed airspace over Lhasa and four other prefecture-level areas to unapproved flights and, since May 2026, require all newly manufactured drones in China to be registered to the owner's identity.

Norway's national criminal investigation service (Kripos) charged Telenor with complicity in crimes against humanity, and Norway's domestic security service (PST) separately charged the company with breaching the Sanctions Act, following a joint raid on Telenor's Fornebu headquarters on September 15, 2026. Prosecutors allege that Telenor Myanmar Ltd (TML) repeatedly handed the military junta customer call logs, names, addresses, and location data after the February 2021 coup, which the junta used to track, arrest, and imprison dissidents; documents show roughly 500 customers were put at risk of arrest, and a civil suit alleges the data sharing contributed to the 2022 execution of activist-lawmaker Phoe Zeya Thaw. The Sanctions Act charge concerns Telenor's March 2022 sale of TML, which allegedly included surveillance equipment transferred without required Foreign Ministry authorization. Telenor, 54%-owned by the Norwegian state, said its employees faced imprisonment or death if they had refused military orders and that it is cooperating fully with prosecutors. The charges are described as among the first criminal prosecutions of a major telecom for authoritarian surveillance complicity.

A racketeering, money laundering, bank/wire fraud, sanctions-violation, and trade-secrets-theft trial against Huawei began September 9, 2026 in federal court in Brooklyn before Judge Ann Donnelly, expected to last about three months. Prosecutors allege Huawei supplied surveillance equipment to Iran that was used to 'monitor, identify and detain' protesters during the 2009 Tehran demonstrations, concealed business operations in North Korea, deceived banks about its Iran dealings to evade US sanctions, and stole trade secrets from five US technology companies. Huawei has pleaded not guilty and denies wrongdoing. The case stems from Huawei's 2019 US trade blacklisting.

Digital rights group SHARE Foundation, corroborated by Amnesty International and Citizen Lab, found at least 14 Serbians infected with mercenary spyware between December 2025 and August 2026, including student pro-democracy activists, an opposition member of parliament, and a local government official. At least one confirmed Pegasus infection (zero-click) was documented alongside at least two infections with a domestic NoviSpy spyware variant, one occurring after police confiscated a student's phone during questioning. Apple sent threat notifications to affected users in 110 countries on August 13, 2026. The targeting coincided with Serbia's March 2026 local elections and ongoing student protests following the 2024 Novi Sad railway station collapse, with additional targeting anticipated around October 2026 parliamentary elections. Citizen Lab researcher John Scott-Railton said Pegasus 'is still being used to hack people campaigning for democracy' despite a decade of NSO reform promises.

In August 2026, Huawei courted Egypt with a proposal to build AI data centers powered by its Ascend chips, explicitly including military and surveillance applications and integration with national population databases; reporting noted the presence of China's Ministry of Public Security insignia in proposal materials, suggesting direct involvement of Chinese state surveillance infrastructure. The bid put Huawei in direct competition with a US-backed consortium for the same government tender, marking one of the first instances of head-to-head US-China competition for a national AI data center contract. The US government raised concerns, warning of extraterritorial legal consequences for unauthorized use of restricted Huawei accelerators; Egypt is one of roughly 40 countries requiring US permission for AI chip shipments. A similar Huawei-powered national AI proposal in Malaysia was scaled back after US pressure, and Malaysian customs seized a $13 million chip shipment bound for re-export in June 2026.

On August 24, 2026, French AI company Mistral AI announced a strategic collaboration with HUMAIN, the Saudi state-owned AI company, to jointly develop and localize frontier AI models optimized for Arabic, explore use of HUMAIN's Saudi data-center infrastructure, and pursue a joint go-to-market strategy across regulated sectors (financial services, telecommunications, public sector, manufacturing) in Saudi Arabia and the wider Middle East. The deal is valued in the 'hundreds of millions of euros' though key infrastructure and customer terms remain undisclosed. Mistral framed the deal around data 'sovereignty' and customer control, but made no public statement addressing human rights concerns about deploying AI infrastructure for a government with a documented record of surveillance and suppression of dissent, including for public-sector deployment.

Starting July 20, 2026, Indian authorities issued a series of at least seven consecutive orders directing Reliance Jio, Bharti Airtel, and Vodafone Idea to suspend mobile internet service across a roughly 1.5km radius of central Delhi around Jantar Mantar, in response to a student protest (organized by group 'CJP') at the site. The shutdown, repeatedly extended through July 25, became the longest mobile internet suspension in Delhi's history. Jio and the other operators confirmed receiving the government orders and complied, but the government did not publish copies of the suspension orders in the public domain as required by India's Telecommunications (Temporary Suspension of Services) Rules, 2024, and telecom providers reportedly had not received a formal revocation order even after service was restored. Digital rights group SFLC.in challenged the shutdown's legality in the Delhi High Court, arguing it violated transparency and proportionality standards set by the Supreme Court in Anuradha Bhasin v. Union of India (2020).

A cross-border investigation by Forbidden Stories, the Guardian and Middle East Eye, based on a decade-long DGST insider (pseudonym 'Safir') corroborated by security sources in Morocco and Europe, detailed how Morocco's intelligence agency DGST acquired and used NSO Group's Pegasus spyware from 2017 onward against domestic political opponents, journalists and foreign officials, including French President Emmanuel Macron and 15 French government members. The investigation described a three-party arrangement in which a UAE-linked company (Al Fahad Smart Systems, later acquired by UAE state-owned defense group Edge) acted as financial intermediary or payer for Morocco's access to Pegasus. Morocco has consistently denied purchasing Pegasus despite the documentary and testimonial evidence; NSO Group declined to confirm Morocco as a customer, citing Israeli law.

On July 13, 2026, the European Union imposed sanctions on VK Company for developing MAX, a messaging app mandatorily preinstalled on all smartphones, tablets, computers, and smart TVs sold in Russia since September 2025. MAX's terms of service explicitly permit sharing user data with Russian government institutions, and human rights lawyers say law enforcement has access to VK-administered platforms including VKontakte, Odnoklassniki, and MAX. The EU action, part of a package that also sanctioned developers of the FSB's SORM surveillance system, followed a Russian government crackdown on independent apps such as Telegram and WhatsApp. MAX had over 45 million registered accounts and 18 million daily active users as of late 2025.

TikTok removed or shadow-banned at least two MalaysiaNow videos in July 2026 - a July 6 report on a Greenpeace-led protest against Lynas rare-earth operations, and a July 7 press-conference video featuring lawyers representing youths killed by police - citing only 'integrity and authenticity' issues. It was the third MalaysiaNow video removed from TikTok in 2026 without further explanation, following earlier removals of coverage on Malaysia's anti-corruption commission chief and opposition parties. The removals occurred while TikTok operates under Malaysia's MCMC content-licensing regime; the same videos remained available on YouTube, Facebook, and Instagram. Coverage noted allegations of a pro-Israel moderation bias following TikTok's 2025 US ownership restructuring.

On June 5-8, 2026, the US Department of Defense added Alibaba Group Holding Limited to its Section 1260H list of 'Chinese Military Companies operating in the United States,' citing indirect affiliation with SASAC and military-civil fusion contribution through MIIT ties. Alibaba disputed the designation, stating it 'is not a Chinese military company nor part of any military-civil fusion strategy.' The listing bars the Defense Department from contracting directly with Alibaba immediately, and from procuring its products/services through third parties starting June 2027.

On June 5-8, 2026, the US Department of Defense added Baidu, Inc. to its Section 1260H list of 'Chinese Military Companies operating in the United States,' citing indirect affiliation with SASAC and military-civil fusion contribution through MIIT ties. Baidu called the designation 'entirely baseless.' The listing bars the Defense Department from contracting directly with Baidu immediately, and from procuring its products/services through third parties starting June 2027.

On June 5-8, 2026, the US Department of Defense added BYD Company Limited to its Section 1260H list of 'Chinese Military Companies operating in the United States,' citing direct and indirect affiliation with SASAC, indirect affiliation with MIIT, and residence in or affiliation with a military-civil fusion enterprise zone. BYD called the determination a contradiction of facts, said it is 'not a military enterprise,' and stated it would pursue administrative and legal remedies. The listing bars the Defense Department from contracting directly with BYD immediately, and from procuring its products/services through third parties starting June 2027.

Middle East Eye reported in June 2026 that Israeli spyware firm NSO Group continued to target WhatsApp users with Pegasus despite a binding US court order arising from the Meta v. NSO Group litigation. The reporting cited evidence of continued infections after the judgment, raising the prospect of contempt proceedings and renewed pressure on US sanctions enforcement against the company.

In April 2026, the EFF published analysis showing Palantir's ELITE tool is used by ICE for mass deportation sweeps, contrary to Palantir's claims of 'prioritized enforcement.' Sworn testimony revealed ICE agents use ELITE to determine where to conduct deportation sweeps using data from 'all kinds of sources' including Medicaid. Nearly 1 in 5 ICE arrests were of Latine persons with neither criminal history nor removal order. Reports link Palantir systems to facial recognition used to identify people recording law enforcement. The tool has been connected to deaths of Renee Good and Alex Pretti. Palantir publicly embraces UN Guiding Principles on Business and Human Rights.