Secure messaging

Think of Achieng, a field researcher at a health rights group in Kisumu. She arranges interviews with the women she visits through one big WhatsApp group on her own Android phone. One week a colleague’s phone is stolen at a bus stop, with two years of the group’s messages on it: names, phone numbers and the date of every visit. Nobody is quite sure who else is still in the group, either.

WhatsApp could have kept most of that off the stolen phone. Disappearing messages would have cleared the old ones, and an agreement about which chat is for what would have kept the names out of the group.

What encryption protects, and what it doesn’t

End-to-end encryption means only the people in a conversation can read it. The company that runs the app can’t, and neither can anyone who breaks into its servers (Security in a Box).

It doesn’t hide the envelope. Metadata is the information about your messages rather than their content: who you talked to, when, for how long and from where. Even a little of it can say a lot about your work, and in many countries the police can get records of who called whom more easily than the calls themselves (EFF).

It also stops at the phones at each end. Anyone who can open a phone in the conversation can read what’s on it, whether the phone is lost, taken or infected with spyware (Security in a Box). And ordinary text messages and phone calls aren’t encrypted at all (NDI; SIIRF). If you’re crossing a border, Travel and border crossings covers what to do with your phone.

Principles for any app

Teams use every mix of apps, so these principles work whichever you have:

1. Use an app that encrypts end to end by default for anything sensitive. If the protection has to be switched on, it’s easy to forget (NDI; Security in a Box).
2. Remember the envelope. Who, when and where can show even when the words can’t be read.
3. Lock the account to your number with a PIN, so nobody else can register it on another phone (Security in a Box).
4. Let sensitive messages disappear, and keep backups encrypted.
5. Know who’s in every group, and who runs it.
6. Agree a backup channel before you need it.

The apps your team already uses

People use the apps their contacts use. In HURIDOCS’s 2025 study of human rights defenders in four African countries, 85% used Facebook, Instagram and WhatsApp, and half used Signal (HURIDOCS).

Tools like Signal are difficult to use to communicate with people. For example, very few people are using the Signal app in Senegal. Signal is not popular. So, if you want to communicate with people, you have to use WhatsApp, which is not safe for HRDs.

A human rights defender in Senegal, in HURIDOCS’s study by Tomiwa Ilori

So it’s normal to use more than one app, chosen by how sensitive the conversation is (Security in a Box). What to know about the common ones:

• Signal encrypts messages and calls end to end by default, one to one and in groups, and lets you check who you’re talking to. Security in a Box and NDI both recommend it for sensitive conversations. You still need a phone number to register, and it doesn’t hide the fact that you’re using encryption, which can draw attention where encryption is restricted. Where Signal is blocked, a proxy can get you connected (Security in a Box; NDI).
• WhatsApp also encrypts end to end by default, but it’s owned by Meta, and NDI points to how much information it collects about who you talk to and when. Its chat backups to Google or iCloud aren’t encrypted unless you turn that on (Security in a Box; NDI).
• Telegram doesn’t encrypt end to end by default, and its groups never are, so the company can read them. Keep it for public announcements (Security in a Box).
• Instagram direct messages lost end-to-end encryption on 8 May 2026, so Meta can now read them (Security in a Box; Digital Rights Foundation). Don’t use them for anything sensitive.
• Other apps, such as Session, SimpleX Chat and Delta Chat, don’t need a phone number, and Briar, on Android, can pass messages between nearby phones over Bluetooth or Wi-Fi when the internet is down (Security in a Box).

Which channel for what

Agree it as a team and write it into your security policies. Some organisations keep one app for everyday chat and another for their most confidential discussions (NDI). A simple starting point:

• Signal: names of sources and the people you serve, case details, travel and meeting plans, and anything that could put someone at risk.
• WhatsApp, with the settings below: everyday logistics, and partners who aren’t on Signal yet.
• Telegram channels or social media: announcements you’d be happy to see in public.
• Not in any chat: passwords, which belong in a password manager.

Email security covers what to keep out of email, and Video calls how to keep calls private.

Settings that matter

• A PIN on the account. Turn on WhatsApp’s two-step verification (Security in a Box) and Signal’s registration lock, which stops anyone registering your number on another phone without the PIN. Keep the PIN in your password manager, since Signal can’t reset it for you (Security in a Box).
• Disappearing messages. They delete themselves from every phone in the chat after a time you choose. If messages on a lost or taken phone could put people at risk, NDI suggests short timers (NDI). Someone can still take a screenshot or a photo of the screen, so they reduce the risk rather than end it (Security in a Box).
• Safety numbers. A safety number is a long string of numbers that Signal uses to show you’re really talking to the person you think you are (WhatsApp calls it a security code). Compare yours in person with the colleagues you share sensitive work with. If it changes, they may have a new phone, or someone else may be using their account, so check with them another way before you carry on (Security in a Box; NDI).
• Encrypted backups, or none. On WhatsApp, turn on end-to-end encrypted backup or switch cloud backup off (NDI).
• Link previews off. A preview can tell the website you’re linking to about you and your conversation (Security in a Box).
• Your number hidden. On Signal you can share a username instead of your phone number (Security in a Box).
• Your location kept to yourself. On calls, the option in Signal and WhatsApp to relay calls stops the person you’re calling seeing your internet address, which can show roughly where you are (Security in a Box). Deny an app your location unless you need it, and see Phones and laptops for the rest of the phone.

Groups

For every group your work runs through (Security in a Box):

• Make only people you’ve verified admins, and have more than one, so the group survives if an account is blocked (Security in a Box).
• Invite people you know and turn on admin approval for new members. Never post the invite link publicly.
• Don’t trust a screen name: anyone can copy one. Check another way that people are who they say they are.
• Remove anyone who no longer needs to be there. If that doesn’t work, start a new group.
• Decide who can post and add members. A working group and an announcement channel need different settings.
• Think about what joining says about someone. Membership of a support group can itself be dangerous for its members, so a coded name or a private group can help (Security in a Box).

Set up your backup channel

If email, phones or a messaging app can’t be trusted, the team needs another way to talk. Set it up while things are calm: an encrypted group and a phone tree (a list of who calls whom) (SIIRF). It works best as a group people already use, such as an existing Signal group, so nobody has to look for it in a hurry. Before you rely on it in an incident, check that no lost, seized or hacked phone or account is still in it. Put both in your incident response plan.

When the internet is cut

Shutdowns and blocked apps are a real risk in many places, often around elections and protests (SIIRF). Prepare before (SIIRF):

• an offline plan: a phone tree, simple text message codes and meeting points
• trusted tools installed in advance, such as Signal’s proxy setting (Security in a Box) and a reputable VPN (Browsing securely helps you choose one)
• offline copies of key contacts, maps and documents
• charged phones and power banks

During a shutdown, use only tools you installed before. Never install a VPN file shared in a group chat: it’s a common way to spread harmful software. Keep sensitive details off ordinary text messages and calls (SIIRF).

Bringing your team with you

1. Agree which channel is for what. Do it together, then write it into your policies.
2. Start with yourself and your director. NDI suggests setting a good example for your contacts and explaining why it matters (NDI).
3. Try it with one or two colleagues first. Find the snags before the whole team does.
4. Set it up together. In a short session, install Signal, set the registration lock PIN, turn on disappearing messages in the team group and compare safety numbers in person.
5. Help one to one. Some phones are too old or too full for another app, so sit with anyone who’s stuck and agree a fallback, such as WhatsApp with the settings above, until the phone can be replaced.
6. Keep one place for questions. The team’s Signal group can be the place to ask.
7. Fold it into joining and leaving. Add a new colleague to the right groups on their first day, after checking their number in person, and remove leavers from every group the day they go.
8. Check every three months. Look at who’s in each group, who’s an admin and whether everyone still has a PIN. Checklists and audits has the rhythm.

Bring partners along the same way: getting used to a new app takes a few days, and it’s easier once people understand why (NDI).

If it’s already happened

• A messaging account has been taken over: Account taken over.
• A phone has been lost, stolen or taken: Device lost or seized.
• The internet or an app has been cut off: SIIRF’s Internet Shutdowns playbook.

Teach it to your team

Try this at your next team meeting. It takes about 30 minutes.

• Prepare: a list of eight or so things your team sends in a typical week, such as a meeting time, a partner’s phone number, an interview recording, the office Wi-Fi password, a press release and a list of names.
• Exercise: go through the list together and decide where each item belongs: Signal, WhatsApp, email or not in a message at all. Write the answers down; they’re the start of your “which channel for what” agreement.
• Three questions: What can the app company still see when messages are end-to-end encrypted? Your safety number with a colleague has changed; what do you do? The internet goes down tomorrow; how does the team reach each other?
• Afterwards: help anyone one to one who wants their settings checked, and keep the team chat open for questions.