In the press freedom literature, the two most documented cases of organised digital violence against women journalists in South Asia carry the names Rana Ayyub (@RanaAyyub) and Gharidah Farooqi (@GFarooqi).
The Coalition for Women in Journalism, the organisation that has tracked digital attacks on women in the regional press for the past decade, places them at the top of the same ledger. Its founding director Kiran Nazish, on the record in 2022, called Farooqi's case "the highest number of organized digital violence we have ever documented against a journalist in this region, after Rana Ayyub." The two women sit at one and two on the same regional list, documented by the same methodology, with the same finding.
Ayyub writes a column for the Washington Post and has been targeted by Hindutva accounts for over a decade. Farooqi has anchored political programming in Pakistan for twenty years, and has been targeted by Pakistan Tehreek-e-Insaf accounts for almost the same period. The two have never met. They have been attacked using the same techniques by political movements that consider each other irreconcilable enemies, in countries that have fought four wars. The enforcement architecture deployed against both is operationally identical.
This report documents that architecture, identifies the techniques common to both movements, and examines why two politically opposite organisations have produced operationally identical systems.
The state ledger
Both party leaderships built command-and-control systems for online attacks during their periods of political power. Leadership decides when and against whom. The system deploys through paid recruits when state machinery is available, party networks organised on WhatsApp, and overseas diaspora hubs operating without legal constraint. A single signal from a party leader, an official statement, or a quote-tweet from a verified party account is enough to activate the network within hours. The paid recruits in both cases were a fraction of the deployed force. The institutionalised payroll demonstrated the political will to use state machinery to formalise what was already a coordinated operation.
The BJP's IT Cell has been documented by The Caravan, Reuters, The Washington Post, and The Wire as the largest political online operation in the world. It is funded through the party and adjacent corporate structures, with operators numbering in the tens of thousands across India. The Modi government's enforcement apparatus, from the Enforcement Directorate to the Income Tax Department, runs in parallel against critics that the IT Cell first targets online.
The Pakistani version was smaller and provincial. The operating model was identical. In 2021, the Khyber Pakhtunkhwa provincial government, then led by PTI, launched the Establishment of Social Media Participatory Platforms project under the Annual Development Program. The project recruited approximately 1,360 social media influencers, paid each Rs25,000 monthly, and was allocated Rs736 million from the provincial budget. Total spending across 2021-22 and 2022-23 reached Rs870 million. The project director was Zar Ali, deputy director of IT at the KP Information Department. Recruits were selected on the basis of existing social media reach. The stated justification was the need to counter "fake news and negative propaganda against the PTI-led provincial government," which mirrors the justification the BJP IT Cell uses for its operations against critical Indian media.
In October 2023, the @PTI_insider account exposed the operational record, with the report stating that "PTI Chairman has created a media cell in KPK and nurtured his top trend desire." Opposition leadership characterised it as state money used to fund partisan attacks. The PML-N's Hina Pervez Butt said publicly that "the false popularity of Imran Khan was due to false propaganda."
The KP caretaker government ordered the project closed on 5 April 2023, citing the dissolution of the provincial assembly, the Election Commission's ban on new development spending during election periods, and the constitutional limits of the caretaker mandate. Caretaker information minister Feroz Jamal Shah Kakakhel told reporters that the PTI government had employed around 5,000 social media workers at Rs25,000 monthly. The closure removed one funding channel. The command-and-control system itself was unchanged. Party leadership continues to direct attack waves through party networks, the US-based diaspora wing, and the Republican-aligned lobbying operation that emerged after Khan's ouster. The activation pattern remains identical to the Hindutva version: a statement, a quote-tweet, a single dogwhistle, and the network deploys.
The five mirror techniques
The techniques deployed against critics by both movements are documented in detail in the press freedom literature. Five appear consistently on both sides.
Coordinated mass-reporting on platforms. On 20 May 2026, the Norwegian journalist Helle Lyng Svendsen had her Instagram and Facebook accounts suspended by Meta following coordinated mass-reporting by Hindutva accounts after she asked Modi a question in Oslo. The Pakistani equivalent runs continuously. In August 2020, the Dawn journalist Ramsha Jahangir watched her notifications fill with abuse after publishing a story on PTI's social media operation, and went offline. The technique works because platform enforcement is automated above a certain reporting threshold, and both movements field the volume to clear that threshold reliably.
Deepfake and sexual harassment. The original campaign against Rana Ayyub produced some of the earliest deepfake pornographic videos deployed against any journalist anywhere, alongside sustained calls for her murder. Pro-government accounts posted her home address publicly. In Pakistan, Geo News journalist Benazir Shah was the target of an AI-generated deepfake video in November 2025, which the Federal Information Minister Attaullah Tarar publicly condemned as "highly condemnable." Asma Shirazi at AAJ TV has documented years of "abusive comments, false allegations, doctored pictures and character assassinations" against her, and has named PTI as the source.
Doxxing. Ayyub's home address was published on the timelines of accounts followed by Modi. Personal and family information of multiple Pakistani women journalists was circulated publicly during the 2020 episode that produced the #AttacksWontSilenceUs campaign. The BBC Urdu reporter Saba Aitezaz was forced to flee Pakistan in 2017 after her personal details were tweeted alongside graphic rape threats. She now works for the Toronto Star.
The foreign-agent smear. In India, the template calls every critic an anti-national, a Pakistani plant, or an ISI asset. In Pakistan, PTI accounts call every critic a lifafa, an establishment mouthpiece, a Yahudi agent, or a paid contributor to a foreign agency. The vocabulary differs. The accusation carried is identical: dissent is foreign-sourced, betrayal is structural, the critic is by definition compromised.
Direct activation from the official party machinery. A signal from leadership, a quote-tweet from an official party account, a public statement from a senior figure, a like or a follow from the leader's verified handle, triggers waves of follow-on attacks within hours. The New York Times documented Hindutva accounts followed by Modi himself posting violent content after Gauri Lankesh's murder. The Pakistani equivalent appeared in November 2025, when PTI's official X account quote-tweeted Ansar Abbasi of The News in a manner that drew incoming PTI Chairman Barrister Gohar Ali Khan to issue a public statement distancing himself from the practice. Gohar Ali Khan stated: "Democracy ensures freedom of opinion. I have never believed in trolling." Earlier, the PTI federal government's state minister Shahbaz Gill launched repeated taunting Twitter attacks on the journalists Mehmal Sarfaraz and Benazir Shah while in office. Leadership defends the activation when it serves party interest and condemns it when reputational cost surfaces.
The empirical ledger
The names on the Indian side are documented in the press freedom record: Rana Ayyub, Arfa Khanum Sherwani, Siddharth Varadarajan, Ravish Kumar, Tanushree Pandey, Rajdeep Sardesai, Deepal Trivedi. The dead from 2017 include Gauri Lankesh, whose killers walk free and one of whom now holds municipal office in Jalna with Shiv Sena cover. The detained under the Unlawful Activities Prevention Act include Siddique Kappan, Prabir Purkayastha, Aasif Sultan, Fahad Shah, and Sajad Gul.
The names on the Pakistani side are equally well documented: Gharidah Farooqi, Asma Shirazi, Benazir Shah, Mehmal Sarfaraz, Ramsha Jahangir, Tanzeela Mazhar, Saba Aitezaz. The 165 prominent Pakistani journalists who signed the #AttacksWontSilenceUs joint statement on 12 August 2020 documented an operating environment that mirrors what Indian women journalists describe in their own statements. Reporters Without Borders' head of the Asia-Pacific desk Daniel Bastard said in 2020 that "the highest levels of the Pakistani government" under PTI were "either responsible or complicit in these recent cyber-harassment campaigns against certain women journalists who don't toe the official line."
The cases sit on the same evidence ledger.
The asymmetry
The two movements are politically opposite in every measurable respect. Hindutva is a religious-nationalist majoritarian project, in power, with state backing, with an industrial-scale partnership between the BJP IT Cell and the Modi government's enforcement apparatus. PTI populism is an oppositional grievance movement, with its leader imprisoned in Adiala Jail since August 2023, with hundreds of its workers behind bars, with internet shutdowns and social media restrictions deployed against it by the Pakistani state on a regular basis. Hindutva operates from inside Indian state power. PTI operates against the Pakistani state. The behaviours of their online wings are operationally identical.
The variable explaining this convergence is neither ideology nor state power. It is the deliberate construction of a command-and-control system for online attacks by party leadership. Both movements have built such systems. Both leaderships activate them on demand through dogwhistles, official statements, and quote-tweets from party accounts. Both rely on a combination of paid recruits when state machinery is available, party networks organised on WhatsApp, and overseas diaspora hubs operating outside the legal constraints of either country. Either ideology or state position would predict that only one of the two movements would produce this architecture. Both have produced it, using the same operating model.
The diaspora wing
Both movements derive disproportionate online firepower from supporters operating outside the legal and reputational constraints of their home countries. When Express Tribune interviewed the lead of PTI's official Twitter team in 2020, he turned out to be a 37-year-old corporate professional based in Chicago. The Indian equivalents operate from Edison, Houston, London, Toronto, and a half-dozen other diaspora hubs, with cultural authority in local Western media markets and no consequences in either home country.
When Imran Khan was ousted in April 2022, the diaspora wing scaled up to compensate for the loss of federal state machinery. PTI overseas campaigning routed advocacy through American Republican voices including Richard Grenell and Matt Gaetz. The Modi Eurotrip in May 2026 produced an identical pattern. Hindutva diaspora accounts coordinated mass-reporting against Svendsen, and her Meta accounts went down within 48 hours of her question. The PTI diaspora model, in the words of a former Pakistani official writing in December 2024, "amplifies political events to align with their narrative, spreading provocative content such as memes, edited videos, and fabricated news stories that stoke anti-military sentiment." The Hindutva diaspora model spreads provocative content to stoke anti-Muslim and anti-Pakistan sentiment.
The diaspora layer functions as structural infrastructure for both movements. It is the scaling system that operates the architecture when leadership cannot deploy state machinery directly.
The journalism cost
The journalists named in this report pay comparable costs regardless of which movement is operating the architecture against them. Costs documented in the press freedom literature include loss of employment, loss of platform access, suspension of accounts, harassment of family members, forced self-censorship, exile, and in a limited number of cases, death. The Coalition for Women in Journalism ranks Pakistan among the world's five worst environments for women journalists. India is 157th of 180 on the 2026 RSF World Press Freedom Index.
The Coalition for Women in Journalism, the Committee to Protect Journalists, Reporters Without Borders, the International Federation of Journalists, and the International Press Institute have documented the cases on both sides of the border for over a decade. The cumulative effect of that documentation on the architecture has been limited.
Bottom line
Two politically opposite party leaderships in India and Pakistan have built operationally identical command-and-control systems for online attacks against critical journalists. Both institutionalised the paid layer using state development budgets during their periods of political power. Both deploy the same five techniques: coordinated mass-reporting, deepfake and sexual harassment, doxxing, the foreign-agent smear, and direct activation from official party machinery. Both activate the network through leadership signals: dogwhistles, official statements, quote-tweets from party accounts. Both scale through diaspora hubs based in Western capitals. The evidence indicates that the architecture is a function of cult-personality politics at platform scale rather than of ideology or state position.
Outside South Asia, the pattern is also visible. MAGA developed its version after 2020. The BJP IT Cell has been operating since at least 2014. PTI built its version from 2018, embedded the institutional layer inside the KP state machinery from 2021 to April 2023, and has continued to operate the command-and-control system through the diaspora and party networks since. The architecture is platform-agnostic, ideology-agnostic, and increasingly state-agnostic.
Playbook will continue documenting the architecture as it operates against named journalists in both countries.
Originally published on X by @PKPlaybook — read the original post →
