The Arab Spring uprisings of 2011, with their images of crowded squares and raised phones, symbolized the internet's potential to empower ordinary people. However, the subsequent decade has revealed a darker side: the transformation of these same tools into the backbone of a powerful state surveillance apparatus. For activists, journalists, and everyday users, this reality translates into a constant threat. The devices in their pockets, the platforms they use to organize, and the systems they rely on for safety can be weaponized at any moment. A global surveillance industry has capitalized on repression by governments in the Middle East and North Africa (MENA), and the tactics refined there are now shaping digital authoritarianism worldwide. This article examines how this shift occurred: security agencies upgraded their systems with new surveillance tools and permanent monitoring infrastructure. Cybercrime laws and the rise of mercenary spyware turned digital control into standard operating procedure. Furthermore, biometrics, facial recognition, and 'smart city' projects have laid the groundwork for AI-driven surveillance that now impacts protests, borders, and daily life far beyond the region. Remembering the Arab Spring requires acknowledging it as both a moment of empowerment through networked tools and the beginning of a long effort to transform those tools into mechanisms of state control. ## Old‑School Repression, New‑School Tools Even before **Facebook** and **Twitter**, regimes in countries like [Egypt](https://www.hrw.org/news/2008/05/27/egypt-extending-state-emergency-violates-rights) and [Syria](https://www.hrw.org/report/2010/07/16/wasted-decade/human-rights-syria-during-bashar-al-asads-first-ten-years-power) were adept at crushing dissent. They relied on informant networks, physical surveillance, and wiretaps, backed by emergency laws that allowed security agencies to monitor and detain critics with minimal restraint. Research on the [use of surveillance technology in MENA](https://timep.org/2019/10/23/timep-brief-use-of-surveillance-technology-in-mena/) shows that even before the Arab Spring, states were layering early digital tools like internet monitoring, deep packet inspection, and interception centers onto this existing machinery of control. Simultaneously, connectivity was rapidly expanding. Affordable smartphones and social media enabled people to share information at scale, coordinate protests, and broadcast abuses in real time. In 2011, **EFF** [described](https://www.eff.org/deeplinks/2011/12/2011-review-internet-freedom-wake-arab-spring) both the excitement surrounding “Facebook revolutions” and the early signs that governments were scrambling to enhance their capacity to monitor and disrupt popular dissent. In the aftermath of the uprisings, Western critics debated the role of social media. However, security agencies across several MENA states reached a straightforward conclusion: if networked communication can help topple a dictator, they needed to embed themselves deeply within those networks. Analyses of the [rise of digital authoritarianism in MENA](https://kalam.chathamhouse.org/articles/the-rise-of-digital-authoritarianism-in-mena/) illustrate how quickly officials transitioned from being surprised by online organizing to building systems to monitor and preempt it. In the years following 2011, governments across the region invested heavily in tools that allowed them to systematically monitor online activity. [Foreign vendors](https://timep.org/2019/10/23/timep-brief-export-of-surveillance-to-mena-countries/) established monitoring centers and interception systems that enabled security agencies to block tens of thousands of websites, scrape and analyze social media at scale, monitor activist pages and online communities, and [track activists in real time](https://ecfr.eu/publication/iron-net-digital-repression-in-the-middle-east-and-north-africa/). They [built a new, pre‑emptive model of digital control](https://pomeps.org/transnational-digital-repression-in-the-mena-region), one that assumes the state should have maximum visibility as early as possible. As [we noted in 2011](https://www.eff.org/deeplinks/2011/09/government-internet-surveillance-starts-eyes-built), exporting permanent surveillance infrastructure to already abusive governments doesn’t “modernize” public safety; it locks in an architecture of control that is primed to abuse dissidents, journalists, and marginalized communities. ## Domestic Lawfare and Cyber-Mercenaries Following the uprisings, many governments rewrote the rules governing online life. [Cybercrime laws](https://www.aljazeera.com/news/2019/7/25/how-arab-governments-use-cyberspace-laws-to-shut-down-activism), “fake news” provisions, and overbroad public order and ‘morality’ offenses provided prosecutors and security agencies with legal cover to act with impunity. Governments in Saudi Arabia, Tunisia, Jordan, and Egypt combined counterterrorism, cybercrime, defamation, and protest laws into a legal thicket [designed to make online dissent feel dangerous and costly](https://www.eff.org/pages/crime-speech-how-arab-governments-use-law-silence-expression-online). Morality laws and cybercrime provisions are used to [target queer and trans people](https://www.eff.org/deeplinks/2023/09/growing-threat-cybercrime-law-abuse-lgbtq-rights-mena-and-un-cybercrime-draft) based on identity and expression. At the United Nations, a new global cybercrime convention now risks baking this logic into international law. The convention was adopted by the UN General Assembly in late 2024, despite serious human rights concerns raised by civil society. Echoing our partners, EFF warned at the time that the [UN cybercrime draft convention remained too flawed to adopt](https://www.eff.org/deeplinks/2024/06/un-cybercrime-draft-convention-remains-too-flawed-adopt) and urged states to [reject the draft language](https://www.eff.org/deeplinks/2024/06/if-not-amended-states-must-reject-flawed-draft-un-cybercrime-convention) because it legitimized expansive surveillance powers and criminalized legitimate expression, security research, and everyday digital practices around the world. While on paper, these instruments gesture to “public safety” objectives, in practice they function as pathways for state security agencies to monitor, prosecute, and silence the communities most at risk. For state-targeted communities, that makes being visible online a calculated risk, not a neutral choice. Criminal codes are only half the story; mercenary tech is the other. As governments worldwide looked for ways to outpace their critics, a parallel market emerged to help them [infiltrate and take over devices](https://citizenlab.ca/research/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/). Companies like **NSO Group** marketed their **Pegasus** spyware and similar tools as off‑the-shelf capabilities for governments that wanted to [hack a target’s cellphones](https://www.washingtonpost.com/investigations/interactive/2021/nso-spyware-pegasus-cellphones/?itid=lk_inline_manual_2) or other devices to read messages, turn on microphones, and monitor entire social networks while bypassing the courts. In 2019, UN Special Rapporteur **David Kaye** [called for a global moratorium](https://undocs.org/A/HRC/41/35) on the sale and transfer of private surveillance tools until real, enforceable safeguards exist. Two years later, forensic work by **Amnesty International** and media partners showed how the same spyware used to hack phones of [Palestinian human‑rights defenders](https://www.amnesty.org/en/latest/research/2021/11/devices-of-palestinian-human-rights-defenders-hacked-with-nso-groups-pegasus/) was used to surveil journalists, activists, lawyers, and political opponents [across dozens of countries](https://www.amnesty.org/en/latest/press-release/2021/07/the-pegasus-project/).