Kyrgyzstan's Digital Dilemma
Hackers pose as Kyrgyz ministries, while new laws put journalists at risk. Kyrgyzstan is trying to make its internet safer, and the question is who decides what safe means.
Bishkek. Photo: Isakov Eldiiar on Unsplash
For someone receiving an official-looking email in Kyrgyzstan, the difference between a genuine government document and a cyberattack may be difficult to recognise. A message might appear to come from a ministry, contain familiar language and include what looks like an ordinary administrative attachment. Opening it, however, could give an attacker access to the recipient's computer.
Elsewhere in the country's digital environment, a journalist publishing an investigation faces a very different concern. Information that the journalist considers legitimate reporting may be challenged by authorities under legislation intended to restrict false or unreliable information.
These situations are not necessarily connected, but they illustrate two challenges developing alongside Kyrgyzstan's digital transformation. The country needs to protect citizens and institutions against increasingly sophisticated cyber threats, while also addressing growing concerns about the freedom to publish, challenge and exchange information online.
In 2026, that tension has become particularly visible. Cybersecurity specialists are working with government institutions to investigate malicious activity, civil society organisations are collaborating to address disinformation and online hate, and international human rights groups are documenting restrictions affecting independent journalism.
For Kyrgyzstan, the challenge is becoming about more than securing technology. It is also about how trust is established, who is responsible for protecting people online and where the boundaries between digital security and freedom of expression should lie.
When a government email becomes a cyberattack
In November 2025, cybersecurity company Group-IB published details of a campaign targeting government institutions in Kyrgyzstan.
The attackers, identified as a group known as Bloody Wolf, had been impersonating the country's Ministry of Justice, using official-looking PDFs and lookalike web addresses.6 Their approach involved apparently official documents directing recipients towards malicious software designed to establish remote access to their computers.
The techniques were not entirely dependent on sophisticated malware. Instead, the attackers relied heavily on the credibility of familiar institutions and the likelihood that recipients would trust documents appearing to come from government authorities.
Group-IB's investigation, conducted in cooperation with Kyrgyzstan's state institution Ukuk, found that the group had been active against targets in the country since at least June 2025. The same group has also been linked to campaigns in Uzbekistan and Kazakhstan.6
The incident illustrates a basic difficulty in digital security. Technology can protect networks and identify suspicious activity, but attackers can also exploit ordinary human behaviour, particularly the trust people place in recognised institutions.
A person who would normally avoid an unfamiliar website may behave differently when presented with correspondence apparently originating from a ministry.
The risks extend beyond the individual receiving the message. When government organisations are impersonated, public confidence in official digital communications can also be affected.
Another campaign demonstrated the cross-border nature of these threats. In October 2025, researchers reported that a group known as Cavalry Werewolf, also tracked as YoroTrooper, had used correspondence disguised as communications from Kyrgyz ministries to target Russian government agencies and industrial businesses.7
Some messages reportedly originated from compromised government email accounts, making the deception more convincing. The researchers did not conclusively attribute the activity to a government.
These campaigns demonstrate how the identity and credibility of a country’s institutions can be exploited in cyber operations, even when the intended victims are located elsewhere.
For ordinary internet users, the distinction between genuine and fraudulent communication becomes increasingly important. For governments, protecting the credibility of public institutions becomes part of the wider cybersecurity challenge.
A country between digital development and political pressure
Kyrgyzstan has historically had a comparatively active media and civil society environment within Central Asia, although the space for independent reporting has faced increasing restrictions in recent years.
The country's digital transformation is taking place against this changing political background.
Online platforms provide opportunities for people to obtain information, participate in public discussion and communicate beyond established media organisations. They also create channels through which disinformation, harassment and fraudulent activity can circulate.
For authorities, harmful online content can present genuine challenges, particularly where false information contributes to fraud, public confusion or hostility between communities.
However, efforts to regulate online information can also raise concerns about who determines whether something is false and what safeguards exist against legitimate journalism or political expression being restricted.
In July 2025, President Sadyr Japarov signed amendments introducing administrative penalties for distributing false or unreliable information through mass media or the internet.4
According to the Committee to Protect Journalists, the amendments established fines of 20,000 Kyrgyz soms for individuals and 65,000 soms for media outlets found to have violated the provisions.4
The government has presented measures against false information as part of protecting the public information environment. Press freedom organisations, however, have argued that broadly defined restrictions can be used against independent media and critical reporting.
The Committee to Protect Journalists described the amendments as part of a wider legislative development restricting independent journalism.
The distinction matters because disinformation and legitimate disagreement are not interchangeable. A deliberately fabricated claim intended to deceive an audience differs from an investigation that challenges official accounts or presents information the authorities dispute.
Where legal definitions are broad, the question of who makes that distinction becomes especially important.
The growing pressure on independent journalism
Concerns about media freedom in Kyrgyzstan extend beyond the wording of legislation.
Human Rights Watch's 2026 country report documents a series of cases involving independent journalists and media organisations.
In July 2025, a district court in Bishkek ordered the closure of April TV following allegations that its reporting contained negative information about the authorities and material that could destabilise public order.5
Later that year, four staff members associated with independent outlet Kloop were convicted of offences involving alleged calls for mass unrest. Human Rights Watch reported that two videographers received five-year prison sentences, while two accountants received non-custodial restrictions on their freedom.5
The authorities maintained that the prosecutions concerned unlawful activity. Human rights organisations raised concerns about the cases and their implications for independent reporting.
These developments have wider consequences for the information environment.
Journalism plays a role in examining public decisions, investigating wrongdoing and providing information that citizens can assess independently. When reporters face uncertainty about what they can publish, the effects may extend beyond the outlets directly affected.
Sources may become reluctant to speak, journalists may avoid sensitive subjects and audiences may have fewer opportunities to encounter information that challenges official narratives.
This does not mean that governments have no legitimate role in addressing harmful content. It does, however, highlight the importance of clear legal standards, independent oversight and the ability to challenge decisions affecting expression.
For Kyrgyzstan, these issues are developing at the same time as the government seeks to strengthen its digital infrastructure and cybersecurity capabilities.
Who controls the internet?
The question of state authority became particularly significant in 2025, when Kyrgyzstan introduced a temporary state monopoly over the provision of international internet traffic.
Under a presidential decree signed in late July 2025, a trial arrangement was established for the period from 15 August 2025 to 14 August 2026.
The decree provided for a single state-owned operator, ElCat, to handle the supply and transit of international internet traffic during that period.8
The measure was introduced as part of efforts to improve the management and development of digital and telecommunications infrastructure.
However, concentrating international connectivity through a single designated provider raises wider questions about market competition, operational resilience and the extent of state influence over essential communications infrastructure.
Such an arrangement does not, by itself, establish that internet communications are being monitored or censored. The implications depend on the technical arrangements, oversight mechanisms and the powers exercised by the institutions involved.
The trial period ended in August 2026. At the end of that month, a draft government resolution was published for public discussion that would make ElCat's role as sole operator permanent.9
The issue nevertheless illustrates a broader reality of digital sovereignty. Governments can seek greater control over national infrastructure for reasons including security, reliability and economic development, while the same concentration of authority may generate concerns about transparency and freedom of information.
For citizens and businesses, decisions about connectivity affect much more than network administration. They can influence the reliability of services, access to international markets and the practical conditions under which information circulates.
A problem global platforms are struggling to understand
While government regulation receives considerable attention, Kyrgyzstan faces another challenge that originates beyond its borders.
Major social media platforms operate internationally, but their ability to understand local languages, cultural references and political contexts is not always consistent.
This can become particularly important when platforms attempt to identify harmful content or moderate disputes taking place in languages that receive comparatively limited technical and human resources.
Research presented in 2026 through UNESCO's EU-funded Social Media 4 Peace project identified a disconnect between global digital platforms and the linguistic and social context of Kyrgyzstan.
The research found that major platforms lacked sufficient content moderation capacity in the Kyrgyz language and had limited mechanisms for interpreting local context.2
This creates difficulties in both directions.
Harmful content may remain available because automated systems fail to recognise language-specific expressions, coded hostility or references requiring local understanding.
At the same time, legitimate content may be incorrectly restricted when moderation systems lack the context necessary to distinguish reporting, criticism or discussion from prohibited material.
These challenges can become particularly significant during periods of social tension.
Kyrgyzstan's online discussions reflect differences involving political identities, language, religion, gender and regional affiliations. Content that appears harmless when translated literally may carry a different meaning within a particular community.
The reverse can also occur, with legitimate cultural or political expression being misunderstood by systems developed primarily around other languages.
This creates a situation in which international technology companies exercise considerable influence over the information people encounter, despite sometimes having limited capacity to understand the communities using their services.
Civil society is developing its own response
Against this background, a coalition established in April 2026 is attempting to address harmful online content while protecting freedom of expression.
Known as Aikyn Sanarip, meaning Transparent Digital Platforms, the coalition brings together organisations working in journalism, human rights, peacebuilding, community development and technology.
Its formation was supported through UNESCO's work on online content moderation and freedom of expression.1
Rather than concentrating exclusively on removing harmful content, the coalition is seeking to improve the relationship between digital platforms and the communities using them.
Its priorities include media and information literacy, cooperation with technology companies, research into harmful online activity and greater transparency surrounding artificial intelligence-powered content moderation.
The approach reflects an important distinction between protecting users and simply restricting the information available to them.
For example, improving the ability of a social media platform to recognise threats in Kyrgyz may help address online harassment without requiring broad restrictions on public discussion.
Similarly, improving media literacy can help users identify manipulation and misleading information while preserving their ability to make their own judgements.
The coalition also provides an opportunity for local organisations to contribute expertise that international technology companies may otherwise overlook.
For a country whose language and social context are not always adequately represented in global digital systems, this kind of involvement could help make online safety measures more relevant to the people they affect.
What online safety means for ordinary people
The challenges facing Kyrgyzstan are often discussed through national security, technology policy or media regulation. Their consequences, however, are experienced in everyday life.
Someone receiving fraudulent correspondence may lose money or expose confidential information. A woman facing persistent online harassment may withdraw from public discussion. A journalist concerned about legal penalties may hesitate before publishing an investigation.
These situations involve different forms of harm, but each influences whether people feel able to participate confidently in digital life.
In September 2026, UNESCO and the Aikyn Sanarip coalition held a discussion in Osh as part of Yntymak Week, examining how online hate, harassment and aggressive communication affect social cohesion and the participation of women and young people.3
The event reflected growing attention to the social consequences of harmful digital communication, rather than treating online abuse as an isolated problem of individual behaviour.
For people experiencing harassment, the consequences can extend beyond the screen. Participation in professional networks, public debates and community activities may become more difficult when online spaces are hostile.
Yet efforts to improve these conditions need to account for the risks of overregulation.
An internet environment in which harmful activity goes unchallenged can discourage participation. An environment in which people fear penalties for legitimate expression can produce a different form of exclusion.
This is the dilemma facing governments, platforms and civil society organisations in Kyrgyzstan.
The objective of making digital spaces safer is widely shared, but there are competing views about which measures are appropriate and how decisions should be made.
Cybersecurity and free expression are different, but connected
It is important not to treat every issue affecting Kyrgyzstan's digital environment as a single cybersecurity problem.
Cyber espionage involves unauthorised access to systems and information. Phishing relies on deception to compromise victims. Disinformation concerns misleading or manipulated information, while media restrictions involve laws and government actions affecting expression.
These are distinct issues, requiring different forms of evidence and different responses.
Nevertheless, they can influence one another through the trust people place in digital institutions.
When attackers impersonate government ministries, they exploit the authority associated with official communication. When platforms struggle to understand local languages, users may lose confidence in their ability to identify harmful material fairly. When journalists face legal restrictions, questions arise about the independence and availability of public information.
For citizens, these concerns can become part of a wider uncertainty about which information and institutions are reliable.
Strengthening technical cybersecurity can address some of these risks, particularly those involving fraud, malicious software and unauthorised access.
It cannot, by itself, resolve disagreements about freedom of expression, political accountability or the regulation of online platforms.
Likewise, laws aimed at misinformation cannot replace the technical measures needed to protect government systems and businesses from cyberattacks.
Recognising these distinctions is important when assessing Kyrgyzstan's developing digital policies.
The wider question for Kyrgyzstan
Kyrgyzstan's experience illustrates how the development of a digital society involves decisions extending far beyond technology.
The country is strengthening its cybersecurity capabilities, examining the regulation of online information and working with international organisations to address harmful content.
At the same time, human rights organisations have documented increasing restrictions on independent media, while researchers have identified shortcomings in the ability of global platforms to respond to the country's linguistic and cultural context.
Each development raises different questions about responsibility and public trust.
The challenge for government institutions is to protect citizens and national systems while ensuring that measures affecting information and expression are transparent and subject to appropriate safeguards.
For technology companies, the challenge is to provide services that understand the communities using them, rather than relying on moderation systems that overlook local languages and social circumstances.
For civil society, journalists and researchers, the challenge is to contribute to a safer information environment while maintaining space for independent reporting and public discussion.
There are signs of constructive cooperation, particularly through the work of Aikyn Sanarip and UNESCO. There are also documented concerns about restrictions on media freedom that remain unresolved.
Kyrgyzstan's digital future will therefore be shaped not only by the systems it builds or the cyber threats it confronts, but also by the relationships between institutions, technology providers and the people who rely on them.
A secure digital society needs to protect people from fraud, harassment and malicious activity. It also needs to preserve the conditions in which reliable information can be examined, challenged and shared.
In Kyrgyzstan, the effort to achieve both is becoming an increasingly important part of the country's digital transformation.
Corrections: none. If you spot an error, tell us and we will correct it openly.
