The State as Perpetrator: Digital Gender-Based Violence in Belarus

TL;DR

Technology-facilitated gender-based violence (TFGBV) is described in the international literature primarily as interpersonal: former partners, stalkers, anonymous trolls. The Belarusian case works differently.

We analysed 7,814 documents from the FORESIGHT corpus, which covers state, pro-regime and independent media and Telegram channels. The largest perpetrator of gendered digital violence in the Belarusian information space turned out to be the state: security services, the propaganda Telegram vertical and state media together account for 42% of documented Belarus-related cases of gender-based violence. That is more than anonymous criminals (26%) and interpersonal violence (19%). And of the documents that are themselves acts of violence (doxxing, distribution of sexualized fakes, mocking of victims), 99% were produced by the state and pro-regime segment.

What TFGBV is

The United Nations Population Fund (UNFPA) defines TFGBV as an act of violence committed, assisted or amplified through digital media or information and communication technologies and directed at a person because of their gender. The typology includes doxxing (publication of personal data), non-consensual distribution of intimate images, sexualized deepfakes, sextortion, cyberstalking and online harassment. The key idea of the UNFPA framework is the continuum: violence that starts online escalates into physical space, and women’s self-censorship under the threat of digital violence impoverishes the public sphere and harms democracy.

The legal framework around this definition has become concrete in recent years. GREVIO, the monitoring body of the Istanbul Convention, adopted General Recommendation No. 1 on the digital dimension of violence against women in 2021; CEDAW had already extended the concept of gender-based violence to digital environments in 2017 (General Recommendation No. 35). EU Directive 2024/1385 obliges member states to criminalise the distribution of manipulated intimate material, including deepfakes, with a transposition deadline of 14 June 2027; Latvia has already introduced the corresponding Section 145¹ of its Criminal Law, in force since 16 April 2026. Finally, in March 2026 the Committee of Ministers of the Council of Europe adopted Recommendation CM/Rec(2026)2, the first international standard devoted specifically to accountability for technology-facilitated violence against women and girls. All of these instruments rest on one premise: the state wants to hold the perpetrator accountable.

Our data confirm the continuum but show that in Belarus it is institutionalised, and the premise of the international framework does not hold. The publication of personal data in a Telegram channel and the detention that follows are not linked by coincidence: between them stands GUBOPiK, the main directorate for combating organised crime, for which such publications serve as working material.

How we measured

From the FORESIGHT corpus (about 3.6 million documents from the Belarusian information space as of August 2026) we retrieved 7,814 unique documents from 2018–2026 using eight search indicators: doxxing, intimate images, online harassment, deepfakes, sexualized fakes, coerced “repentance videos”, attacks on women journalists and activists, and framework discourse on digital violence.

Each document was independently coded by two LLM annotators against a single codebook built on the UNFPA glossary: relevance, form of violence, gender-based targeting, gender and category of the victim, type of perpetrator, and the function of the document (reporting an event or being the act of violence itself). Inter-model agreement was measured with Cohen’s kappa: from κ=0.83 (“almost perfect”) for victim gender to κ=0.36 for gender-based targeting, the most interpretive field in the codebook. Disagreements (34% of documents) were resolved by a third, stronger LLM annotator coding blind; the final label was assigned by majority vote. 64% of final labels are unanimous. The core cases on which the conclusions rest were additionally verified by hand. The full agreement table is given in the methodological appendix.

Result: 2,671 documents were classified as TFGBV; 2,420 of them concern Belarus, Belarusians or the Belarusian diaspora, the rest cover foreign cases. Explicit gender-based targeting (the victim attacked as a woman or through sexualization and gender stereotypes) was labelled in 868 documents, 711 of them Belarus-related. Where a claim concerns the Belarusian ecosystem, the figures below refer to the Belarus-related subset. 87% of victims in this group are women.

A note on ethics. The publication names only women who have themselves made their stories public, reproduces no images or links, and describes the pattern rather than individual “online dramas”.

The division of labor: who reports the violence and who commits it

The codebook distinguished the function of each document: coverage of a case of violence, victim testimony, prevention, or a perpetration artifact, that is a document which is itself an act of violence: a post with personal data, distribution of fake intimate images, mocking of a victim.

Of 222 perpetration artifacts, 220 (99%) were produced by the state and pro-regime segment. The ecosystem that commits the violence and the ecosystem that documents it practically do not overlap. State discourse on digital violence does exist, but only in two genres: apolitical crime news (sextortion, fraudsters) and “protecting children online”. Framework language on gendered digital violence appears in 33 documents across the whole corpus, almost entirely in the independent segment.

The Belarusian form: coerced public humiliation

The most common form of TFGBV in the corpus (850 documents, 825 of them Belarus-related) is absent from the UNFPA typology as a separate category. It is the coerced “repentance video”. A video apology recorded under pressure from security services and distributed through pro-government channels fuses offline coercion with digital humiliation and works as a tool for intimidating the audience.

Here it is necessary to explain whom the Belarusian regime treats as “its own” and whom as “other”. The boundary is defined by loyalty, not by social position and not by gender: “its own” are the state apparatus, the security services, public-sector employees and the loyal audience of state media; “others” are everyone connected with the 2020 protests, independent media or the diaspora. In the vocabulary of pro-regime channels, clearly visible in our corpus, these are “zmahary”, “extremists”, “the runaways”. Gender sets the way in which a person is turned into an “other”. Women are stripped of agency through sexualization and roles: “impostor”, “runaway zmaharka”, “the cook” aimed at Tsikhanouskaya, “porn actress” aimed at Mentusova, accusations that a politician “abandoned her children”. Men are stripped of masculinity: “zmahariki”, “cockerels”, “cowards”, sexualized mockery, the portrayal of an opponent as a coward or a kept man. In both cases the goal is the same: to show the audience of “its own” that “others” deserve neither respect nor protection.

Importantly, the status of “one’s own” is conditional and is revoked at the moment of deviation. In July 2026 the editor-in-chief of a Homel district state newspaper, who had allowed herself to criticise a music group loyal to the authorities, recorded a “repentance video” with apologies. “One of ours” the day before, she was publicly moved into the “others” by the same instrument normally applied to opponents of the regime.

The practice is already crossing borders: in 2026 independent media recorded that “apology videos” on the Belarusian model had begun to be recorded by the security services of Azerbaijan.

The state: the largest perpetrator

In the 711 Belarus-related documents with established gender-based targeting, the distribution of perpetrators looks as follows. The state group: security services (189), pro-regime Telegram channels (90), state media (22), in total 301 cases, or 42%. Anonymous criminals: 182 (26%). Interpersonal violence: 138 (19%). In most of the “state” cases the victims are women.

A telling case: in September 2025 the journalist Larysa Shchyrakova publicly reported that after her detention, security officers had posted her intimate photos on a dating site. This story contains every element discussed in this publication. The violence is committed by the state; there is no anonymous stalker in this story; the form of violence, non-consensual distribution of intimate images, comes from the classic TFGBV typology; the chain begins with a search and seizure of devices and continues online; and the purpose is the humiliation of a journalist specifically as a woman.

Coordinated waves: the infrastructure of attacks

The corpus makes it possible to reconstruct attacks as operations: with seeding dates, a network of channels and a distribution of roles.

The wave of 9–10 April 2025. In two days, seven perpetration posts in five pro-regime channels (“Zholtye Slivy”, “NewsSliv”, “KrysolOFF”, “BELARUSKAYA KUKHNYA”, “PEREOBUTAYA Realnost”) attack one target, Maryna Mentusova, presenter of the programme “Obychnoe Utro” on the Belsat channel. Two vectors: AI-generated “intimate” images are uploaded to a porn site under her name, and fabricated photos are circulated with links to a porn platform. The state-TV presenter Ryhor Azaronak accompanies the wave with a mocking meta-commentary that puns on the name of her show. Independent outlets respond the same day, Mentusova herself speaks publicly three weeks later, but the asymmetry is obvious: producing the fake costs minutes, the rebuttal costs reputational damage forever.

The wave of 7 August 2025. Six channels of the same network (the “Slivy” family, “Smotri na Mir Otkrytymi Glazami”, “PEREOBUTAYA Realnost”) synchronously distribute a “scandal video” aimed at Sviatlana Tsikhanouskaya. The mechanics are identical to April; the target is the most recognisable woman politician of the country. This is a textbook example of what researchers call gendered disinformation: discrediting a woman politician through sexualization and kompromat instead of criticism of her position.

The seeders of both waves form the core of the anonymous “yellow” tier of the propaganda Telegram vertical that FactCheck.LT described in its study of the pro-regime Telegram field. Two-thirds of the doxxing discourse in the corpus is produced by two brands: “Zholtye Slivy” (139 documents in the TFGBV indicators) and “NewsSliv” (126). Gendered violence belongs to the standard repertoire of this infrastructure, alongside doxxing and harassment.

Whose victimhood counts: the asymmetry

The state ecosystem knows how to be outraged by deepfakes, when the victims are its own. In March 2026 the story of “fraudulent deepfakes of Ryhor Azaronak” was synchronously distributed by dozens of channels of the state vertical, down to district and factory ones (“Krichevtsementnoshifer”, “Steklozavod NEMAN”, “CHAS PIK KHOTIMSK”). The corpus even contains a pro-regime “People’s Anti-Fake” channel that debunks deepfakes targeting officials.

The figures of the asymmetry, Belarus-related documents. Among victims of non-sexualized deepfakes (fraud, political fakes; 379 documents) men outnumber women more than two to one: 228 against 104. These are officials and propagandists, and their cases receive a “defence” campaign. Among victims of sexualized fakes (29 documents) women make up 88% of identified victims (23 against 3), and their cases are produced and distributed by the same ecosystem: 14 of the 29 documents are perpetration artifacts, 11 of them aimed at women.

Two caveats to this comparison. The count is of documents, not incidents: the single March story of Azaronak’s deepfakes produced more than thirty documents, so the male majority partly measures the intensity of the defence campaign, and that is precisely the phenomenon. Moreover, the categories differ in function: deepfakes are represented mostly by defensive coverage, sexualized fakes include the acts of violence themselves. The comparison therefore shows not who is attacked more often, but whose victimhood the ecosystem recognises and defends. Tellingly, Azaronak stands on both sides: in April 2025 he mocks Mentusova, in March 2026 the whole vertical defends him from a deepfake. When a deepfake targets a man of the system, it is called an attack by fraudsters and enemies. When a sexualized fake targets a woman activist, it is called content.

The continuum and the limits of the picture

The online-offline continuum, which UNFPA describes as a risk, is the norm in the Belarusian data. 1,328 documents, half of the relevant corpus (1,272 of them Belarus-related), record a transition between digital and physical violence: doxxing followed by detention; detention followed by a “repentance video”.

Two reservations for completeness. First, gendered digital violence is directed not only at women: 46 documents record male victims of gender-based attacks, from rape threats against a Belarusian volunteer in Ukraine to sexualized mockery of male activists by pro-regime channels. The mechanism is the same: control through sexualized humiliation. Second, harassment allegations also arise inside the democratic community: in autumn 2025 several such cases led to suspensions and internal proceedings in diaspora organisations. We do not assess the substance of these allegations. For our story two facts matter: inside the community, unlike inside the state, accountability mechanisms operate, and every such case is instantly instrumentalised by pro-regime channels as fuel for gendered disinformation.

Limitations

The corpus reflects the media visibility of violence, not its prevalence: cases that never reached the media or Telegram are invisible to us, so all quantitative estimates are lower bounds. LLM labelling is imperfect: model agreement on the most interpretive field (gender-based targeting) is moderate (κ=0.36–0.65 across pairs), which we compensated for with adjudication, conservative wording and manual verification of the core cases. Attribution of perpetrators is based on the content and source of documents, not on technical forensics.

What to do about it

The Belarusian experience matters for the whole Eastern Partnership region for two reasons. Practices of coercion are already being borrowed by neighbours, and the infrastructure of coordinated attacks is cheap and easily reproduced in any country with a developed pro-regime Telegram network. Three practical conclusions follow.

First. Protection mechanisms for women in politics and journalism must account for the state as perpetrator. Standard platform protocols, designed for interpersonal violence and for law enforcement as a neutral party, do not work in this configuration: in Belarus the security services, from the militia and GUBOPiK to the KGB and the Investigative Committee, are themselves the perpetrator.

Second. Documentation to standards usable for future accountability (seeding dates, channel networks, retransmission chains) must begin now. Our method shows that this is feasible on open data.

Third. Support for victims must include fast rebuttal and legal assistance in EU jurisdictions, where many targets of attacks live. The legal basis for this is emerging: Latvia’s Section 145¹ has explicitly covered AI-generated intimate material since April 2026, and Lithuania and Poland are obliged to introduce equivalent provisions by June 2027 when transposing Directive 2024/1385. Tools for organisations already exist, including the digital-security toolkit for women’s organisations published by the EU Neighbours East programme. And finally: five of the six Eastern Partnership countries are addressees of Recommendation CM/Rec(2026)2 as members of the Council of Europe. Belarus stands outside all of these frameworks, and that is exactly why the protection of its women depends on its neighbours.

Documents were coded by two LLM annotators (GPT-5.6-luna, OpenAI; Claude Haiku 4.5, Anthropic) independently and blind; disagreements were resolved by a third annotator (Claude Sonnet 4.6, Anthropic) with the final label set by a 2-of-3 majority.

Conditional fields were computed on documents both annotators judged relevant. Cohen’s kappa corrects raw agreement for chance; interpretation follows the Landis and Koch scale. The low kappa for gender-based targeting reflects the interpretive nature of the “unclear” category and is compensated by adjudication (the arbiter’s agreement with haiku on this field is κ=0.65) and manual verification. 64% of final labels are unanimous, 20% were set by majority, 16% by the arbiter’s deciding vote. Manual verification covered all documents on sexualized fakes, both 2025 waves and the key cases; as a result five documents were relabelled (fraud and prevention instead of sexualized fakes), which is reflected in the figures above.

Data: FORESIGHT corpus, 7,814 documents, 2018–2026. Code and codebook available on request.

• Gendered Digital Violence and State Propaganda in Belarus