{"code":"TC-21","label":"Surveillance Infrastructure / Spyware Deployment","category":"Physical and Digital Enforcement","definition":"State or state-linked actors deploy commercial or domestically developed spyware, surveillance software, or forensic extraction tools against civil society actors, journalists, activists, and opposition politicians. Includes zero-click spyware (Pegasus, NoviSpy), Cellebrite forensic extraction during detention, and digital surveillance during police or security service interviews. Structurally distinct from narrative tactics — this is direct operational enforcement creating chilling effect on communication, source protection, and organizational security.","needs_review":false,"instrument_type":"Digital Enforcement","detection_signal":"Confirmed spyware infection of journalist or activist device; forensic extraction during arrest or interview; Apple/Google state-sponsored attack notifications; CitizenLab or Amnesty Tech Lab confirmation; security service denial following forensic confirmation"}