Online harassment and abuse

The morning after her group publishes its report on evictions, Tendai opens the organisation’s accounts to hundreds of replies. She’s the communications officer at a land and housing rights group in Bulawayo, Zimbabwe, and the replies land on her phone first. Dozens of new accounts without photos post the same insult, word for word, and the colleague quoted in the report has threats in her messages. By lunchtime, two colleagues have taken over the screenshots, and the one who was threatened has someone checking in on her every few hours.

What it looks like

Online harassment is abuse, threats or intimidation aimed at a person or an organisation, often coordinated across many accounts (SIIRF). It takes many forms: abusive messages and comments, threats, personal details published (doxxing), private images shared without consent, fake accounts in someone’s name and hacked accounts (Access Now). Three tactics come up again and again:

• Troll networks: accounts run together, often paid, so that a few attackers look like a crowd (SIIRF). One sign is many accounts posting near-identical messages within minutes of each other (Amnesty International Kenya).
• Smear campaigns: false claims, doctored screenshots, fake documents and fake pages in your name, spread to discredit a person or the organisation (SIIRF). More and more often they include deepfakes: images, voice notes or videos made with AI that show real people saying or doing things they never did (SIIRF). Front Line Defenders saw deepfakes that put defenders in sexually explicit scenes, tied them to fraud or radical statements, or cast them as foreign agents (Front Line Defenders).
• Fake abuse reports: many accounts reporting a page or profile at once, so the platform suspends it (Access Now).

Threats can also move offline, with people turning up at homes or offices or strangers contacting family members (SIIRF). Watch for the early signs: a sudden rise in hostile messages or mentions, personal details of staff appearing online and new accounts using a colleague’s or the organisation’s name (SIIRF).

Why groups like yours are targeted

The aim is usually to silence people: to discredit them, frighten them and wear them down until they stop (Access Now; Amnesty International Kenya). Self-censorship is often the result (Amnesty International Kenya):

I could not sleep for several nights. I am scared of checking my social media accounts or even as I used to do- sharing my news reports online because these trolls would start attacking me again

A reporter in Somalia, to the Somali Journalists Syndicate, 2019

Attacks spike after a publication, a court case, a protest or a media appearance (SIIRF). Women, LGBTQ+ people, minorities and outspoken staff are hit hardest, and the abuse aimed at them is often sexual (SIIRF; Digital First Aid Kit; Amnesty International Kenya). In 2025, 58% of the people who contacted the Digital Rights Foundation’s helpline in Pakistan were women (Digital Rights Foundation). Worldwide, threats and harassment on social media were the second most common digital threat that defenders reported to Front Line Defenders that year, after online surveillance and censorship (Front Line Defenders).

Organised attacks on groups like yours tend to come from three places:

• Paid troll networks: accounts paid to push a political line, drown out critics and brand them as foreign agents or “paid activists” (Amnesty International Kenya). During Kenya’s 2024 and 2025 protests, a member of one such network described about 20 people, organised in a chat group, each running a dozen or more accounts, paid to push a political line into the top trends. On one morning alone, a data journalist found about 200 accounts posting more than 3,000 times (Amnesty International Kenya). In Somalia, journalists have reported organised groups attacking independent reporters online and trying to break into their Facebook accounts (Somali Journalists Syndicate).
• Anti-rights movements: organised religious and “family values” groups, some working across borders, amplify hostility to LGBTQ+ rights and to sexual and reproductive rights, and abuse follows (Amnesty International Kenya). Front Line Defenders found LGBTIQ+ defenders around the world targeted with doxing and deepfakes (Front Line Defenders).
• Armed and extremist groups: they threaten people who report on them, and those people can face threats from the security forces too. Journalists covering an insurgency in Nigeria described death threats from the insurgents, and threats and intimidation from soldiers (Abubakar, Journal of African Media Studies).

Before it happens

1. Agree who does what. If someone is targeted, who watches the accounts and keeps the record, who reports posts, who speaks for the organisation and who checks on the person? Write it into your incident response plan, with a deputy for every role, yours included. Agree too what the organisation offers anyone targeted, such as time off and counselling (SIIRF).
2. Shrink what can be found. Run the search in Doxxing, tighten privacy settings and keep work and personal accounts apart (SIIRF). Keep personal email addresses and where you are right now out of public posts (Take Back The Tech). Social media accounts covers the settings.
3. Lock the accounts. Turn on two-factor authentication on every account, with an app or a key rather than text messages where you can (Access Now). On chat apps that show you messages from strangers before you accept them, don’t accept senders you don’t know (Digital First Aid Kit).
4. Find the report and block options now. Look them up on every platform you use, so nobody has to hunt for them in a hurry (SIIRF). Keep your helpline’s details with them: Access Now’s Digital Security Helpline is free for civil society, day and night.
5. Make your real accounts easy to recognise. Keep your official accounts easy to find, get them verified where you can and keep the originals of your statements, photos and documents, so fakes stand out (SIIRF).
6. Plan for high-profile moments. Before a publication, a court case or a protest, agree who will watch the replies and who the people most exposed can call (SIIRF).

If it happens

If personal details are out or anyone has been threatened with violence, start with Details posted online: physical safety comes first. Treat threats from armed groups the same way, and make a safety plan with the person (SIIRF). Then:

• Someone else keeps the record. Screenshots with links, dates, times and account names, kept in a log (SIIRF). Document before you block, because once you block an account you can’t see its posts to record them (Digital First Aid Kit).
• Report, then block or keep watch. Report the posts and accounts. If the person wants to know what’s being said, a trusted colleague can keep track of what the attacker posts instead of blocking (Access Now).
• Don’t engage the attackers in public. People targeted use different strategies, from ignoring the abuse to speaking out about it, and the person targeted chooses theirs (SIIRF; Take Back The Tech).
• Tell the group. Attackers often go after several members, and fake accounts may follow (Access Now).
• Answer a smear calmly. Post a short, factual correction on your official channels, tell partners and funders directly before they hear it elsewhere and repeat the false claim no more than you must (SIIRF).
• Think it through together. Who might be behind it, what can they do and what do they want? A simple risk analysis like this helps the person feel less stuck (Access Now).
• Go to the police or a lawyer only where it’s safe and the person agrees. If the attackers are linked to the government, going to the police can make things worse (SIIRF; Access Now).

When reports go nowhere, a helpline can raise them with the platform; Details posted online has what works. For an account suspended after fake abuse reports, Social media accounts covers appeals. If the attacker seems to know where someone is or what’s on their phone, see Spyware and surveillance. Whoever leads the response can follow SIIRF’s Harassment & Doxxing and Disinformation & Fakes playbooks.

Supporting the person

Start by believing them. Access Now’s helpline tells its own staff that “we should put them at ease, treat them seriously, and ensure they know that we believe them and are on their side”, and that people targeted should hear that they’re not alone and that it isn’t their fault (Access Now). Then:

• Let them choose how to talk: a voice call without video, or through someone they trust (Access Now).
• Take the reading off them. Someone else monitors and documents, so they don’t have to see the abuse again (SIIRF).
• Ask whether they’ve told family or close friends, so they have support outside work (Access Now).
• When you refer them to a helpline, offer to pass on what happened, so they don’t have to tell it all again (Access Now).

The toll can be heavy, and it builds:

Having strangers say things about you every single day, being targeted every single day, it’s hard. It took away the spark, the joy. It took away who I was.

Hanifa Adan, human rights defender, speaking to Amnesty International Kenya

Over the following weeks, watch for the signs of stress and burnout: poor sleep, fear of opening the apps, someone going quiet online or stepping back from the work (Somali Journalists Syndicate; Amnesty International Kenya). Offer time off, and check in again over time, not just once (SIIRF). Psychological first aid comes down to looking, listening and linking people to support, and anyone can give it. Well-being and care explains it, and where to find support.

If you’re the one being targeted, hand the response to your deputy.

Teach it to your team

A session of about 30 minutes, best held before a high-profile moment. Make it optional for anyone who has been targeted before, and offer them a one-to-one instead (Training your team).

• Prepare: your plan from “Agree who does what”, with names filled in, and the report and block options for the platforms you use.
• Exercise: read out Tendai’s morning from the top of this guide, then ask the room what happens in the first hour: who takes the screenshots, who checks on the colleague, what gets reported and whether the organisation says anything in public. For a longer exercise, play level 2 of SIIRF’s Chips Down, in which a colleague’s home address is posted online.
• Three questions: What do you do before blocking an account? Who keeps the record if you’re the one targeted? Who decides whether the organisation answers in public?
• Afterwards: follow up one to one with anyone the session stirred up, and keep questions coming in the team chat.