Why digital security matters

Picture Grace. She’s the finance and admin officer at a 12-person women’s rights organisation in Kampala, and the person colleagues ask when their phones play up. One Monday, the director’s WhatsApp starts asking partners to send money. Grace spends the afternoon calling them one by one to say it isn’t really the director. Nobody ever asked her to look after the organisation’s security, but she’s the one doing it.

If that sounds like you, this handbook is for you. It’s about a few habits shared with your team, and knowing where to turn when something goes wrong.

What’s at stake

Civil society groups face the same kinds of attack as governments and big companies, with far fewer people and much less money to defend themselves (Citizen Lab; New America).

Some attackers want your money. Others want what you hold about people: the contacts in your phones, your sources, your partners and the communities you serve. Some want to silence you, or to make the work too hard to carry on (NDI). A leak can put people in danger, and it can cost you the trust that made them share their details with you.

I’m often aware of general threats against organizations like ours, but the missing piece is always the practical response. The warnings tell me a threat exists, but they rarely provide clear steps on what my organization should do about it.

A respondent to New America’s 2025 survey of human rights groups

Every guide in this handbook pairs a risk with something you can do about it. Along the way you’ll keep meeting a few words: the things worth protecting (assets), the people who might want to harm them (adversaries), what could go wrong (threats) and how likely and how bad that would be (risk). Conducting a risk assessment explains them properly.

What happens most often

In small civil society organisations, the same four problems come up again and again:

• Accounts taken over: someone gets into an email, WhatsApp or social media account and uses it to write to people as its owner. It was the emergency Access Now’s helpline handled most, every year from 2013 to 2020 (Access Now). See Account taken over.
• Phishing and scams: messages and calls that trick people into handing over a password, a code or money. Researchers who followed 10 civil society groups for four years found that the harmful software used against them was technically simple, but the tricks used to get people to open it were well thought out (Citizen Lab). See Phishing and Social engineering.
• Harassment and doxxing: abuse and threats online, sometimes with a home address published, meant to frighten people into silence. See Online harassment and abuse and Doxxing.
• Devices taken or searched: phones and laptops taken at an arrest, a border or a raid, and copied. See Device lost or seized.

Front Line Defenders logged 1,221 digital threats against human rights defenders around the world in 2025, led by surveillance and by threats on social media.

Not every risk comes from outside. A former colleague who kept a password, or a message sent to the wrong group, can do harm too (NDI).

Your organisation’s digital footprint

Your digital footprint is everything about your organisation that can be found online or sits on its accounts and devices. It has two halves:

• What anyone can find: your website, social media, reports, staff profiles, photos and old posts.
• What you hold: your accounts, phones and laptops, shared folders, contact lists and case files, and where each one lives.

A first stocktake asks four questions of each kind of information (Holistic Security):

1. What is it?
2. Where is it kept?
3. Who can get to it?
4. How bad would it be if it got out?

Spend your effort on what would hurt people if it leaked. What you already publish doesn’t need protecting (NDI). Keep the stocktake itself somewhere safe: it’s a map of what matters most.

Conducting a risk assessment turns the stocktake into decisions. Doxxing shows you the public half the way an attacker would see it, and Who has access helps you sort what you hold by how sensitive it is.

What you can do this month

1. Get a quick picture of where you stand. SIIRF’s Readiness Assessment asks 32 short questions across eight areas. Then Conducting a risk assessment helps you choose what to fix first.
2. Lock the main doors. Move everyone’s passwords into a password manager and turn on two-factor authentication, starting with email, because most other accounts reset their passwords through it.
3. Learn the tricks. Phishing shows the signs, and a simple habit that stops payment scams.
4. Keep copies. With backups, a lost phone or locked files don’t take your work with them.
5. Plan for a bad day. Write down who does what when something goes wrong, in your incident response plan.

None of this needs a technical background (NDI). It also can’t rest on you alone: it works when everyone does a small part, regularly. Security champions describes yours.

For your team

Try this at your next team meeting. It takes about 20 minutes.

• Ask which of the four problems above has already happened to your team, or to a group you know. Let anyone who wants to tell it in their own words.
• Ask what would hurt the people you work with most if it got out. Note the answers: they’re the start of your stocktake.
• Agree one thing to fix this month, and who’ll help.

Keep it calm. Facts and a clear next step work better than frightening stories, which make people dismiss the message or give up (NDI). If you need your director’s backing, a real incident at a group nearby is often what convinces leaders. Funders help too: many now require the groups they support to keep their security strong (NDI).

Where to go next

• Conducting a risk assessment: decide what to tackle first.
• Security champions: what your role involves, and what it doesn’t.
• Something already happening? Go straight to Incident Response.