Recorded Future Sees High State Surveillance Risk in 31 Countries

Jun 17, 2026 · Original article ↗

Summary

Recorded Future assesses state digital surveillance risk in 193 countries, finding high or very high risk in 31. The report details government surveillance capabilities, oversight concerns, risks to travelers and organizations, and recommended mitigations.

Key points

The report rates six countries as very high risk and 25 as high risk, citing advanced surveillance capabilities, limited oversight, and surveillance of foreign nationals, businesses, or government critics.
Its assessment considers surveillance capabilities, governments’ history of digital surveillance, and the strength of oversight mechanisms.
The report groups capabilities into network interception, endpoint compromise, platform-level access, public-space surveillance, and data aggregation.
Examples include telecommunications interception, commercial spyware, government access to platform data, facial recognition, and collection of biometric information.
Weak safeguards and broad data collection can expose travelers and organizations to data loss, intellectual-property theft, legal or physical risks, and reputational harm.
Recommended precautions vary by destination risk, ranging from standard security hygiene to using sterile, non-corporate devices in high-risk jurisdictions.

Article Details

Publisher: Recorded Future
Report Period: Data collected from 2024 to 2026
Scope: Government digital surveillance risks to foreign nationals and business travelers, assessed through capabilities, surveillance history, and oversight.
Sample Size: 193 countries
Key Statistics: Insikt Group assessed six countries (3%) as very high risk: Belarus, China, Iran, Myanmar, North Korea, and Russia.
Insikt Group assessed 25 countries (13%) as high risk, citing moderate to advanced surveillance capabilities, limited independent oversight, and surveillance used against domestic opposition.
Insikt Group assessed 74 countries (38%) as medium risk: 19 with advanced capabilities not typically used unlawfully, and 55 with less advanced capabilities frequently used against dissent and activism.
Insikt Group assessed 65 countries (34%) as low risk: 39 with moderate to advanced capabilities exercised under strong oversight, and 26 with limited capabilities.
Insikt Group assessed 23 countries (12%) as very low risk, citing minimal surveillance capabilities, well-established oversight, and no indications of surveillance abuses.
Recommendations: For very high-risk destinations, avoid non-essential travel and assume devices will be compromised. If travel is unavoidable, use dedicated trip-only devices with minimized sensitive data, avoid personal and corporate accounts, and transport devices in a Faraday bag.
For high-risk destinations, restrict sensitive-data access and non-essential account logins; install firmware and operating system patches before departure; use legally permissible VPNs and end-to-end encrypted messaging installed before travel.
Avoid domestically developed communication applications in high-risk destinations, or use a separate device for them.
For medium-risk destinations, update applications, train travelers to recognize social engineering and physical device risks, restrict social media privacy settings, and avoid sharing sensitive political or social content. Monitor weakening oversight where advanced surveillance capabilities exist.
Maintain baseline cyber hygiene across risk tiers: install security patches, download applications from verified providers through official stores, require authentication preferably with multiple factors, and avoid public Wi-Fi. Apply lower-tier precautions in higher-risk destinations.