Digital security basics for civil society

What is digital security for civil society?

Civil society teams hold contact lists, case files, funding documents and plans that others may want to read, change or delete. The risk may come from criminals, from hackers who target any weak account, or from actors who want to monitor or disrupt your work. Some risks are simple: a lost phone, or a staff member who clicks a fake link.

Front Line Defenders' Security in a Box is written for activists, journalists and civil society members, and it stresses that people should assess the risks they face and define their own needs. The Electronic Frontier Foundation (EFF) makes a similar point: security is a process, not a purchase, and no tool gives absolute protection in all circumstances. Start with your risks, then choose measures.

What are the basic steps?

Step 1: Do a simple risk assessment

Answer four questions with your team.

1. What do we need to protect? Contact lists, case files, financial records, social media accounts, locations.
2. Who might want it, and why? Criminals, competitors, individuals with a grudge, authorities.
3. What could happen if they got it? Harm to people, loss of funds, loss of trust, shutdown of work.
4. How likely is it, and what can we do? Rank the risks, and tackle the highest first.

EFF calls this process threat modelling. Keep the result short, on one page, and review it every six months or when your context changes. Our article on risk management for organisations shows a wider approach.

Step 2: Secure your accounts

Accounts are the most common point of attack.

• Use a long, unique password for every account. A password manager helps, because you only remember one strong password.
• Switch on two-step login for email, cloud storage and social media. Email is the most important account, because it can reset the others.
• Do not share one login between staff. Use separate accounts so you can remove access when a person leaves.
• Check the recovery options (phone number, backup email) and keep them current.

Step 3: Secure your devices

• Set a screen lock on every phone and laptop.
• Install updates for the operating system and apps, because updates fix known weaknesses.
• Use only trusted software and apps from official stores.
• Encrypt laptops and phones that hold sensitive data, so a lost device does not mean lost data.
• Avoid sensitive work on public or shared computers and unknown Wi-Fi networks.

Step 4: Avoid phishing and malware

Phishing means a message that tricks you into giving a password or opening a harmful file. It can arrive by email, chat or SMS, often with an urgent tone.

Teach staff to stop and check before they act:

1. Is the sender expected? Look at the full address, not only the name.
2. Is it urgent or too good to be true? Pressure is a warning sign.
3. Does a link look right? Hover to see where it goes, or type the address yourself.
4. Is an attachment unexpected? Confirm with the sender by another channel.
5. When in doubt, report it to your focal point and do not click.

Step 5: Back up and plan for loss

Devices break, get lost or get seized. Keep copies of important files in at least one other place, such as an encrypted external drive or a trusted cloud account. Test a restore once, because a backup that does not work is no backup. Keep the organisation's master files organised, as described in our guide on organising shared files.

Step 6: Choose communication tools with care

Messages and calls can be read by others if they are not encrypted from end to end. Pick tools that fit your risks and that your contacts will actually use. Our guide on choosing secure messaging tools explains the options.

Step 7: Write a short incident plan

Decide in advance what staff do if a phone is lost, an account is hacked or a suspicious file is opened.

• Tell the focal point at once.
• Change passwords and sign out other sessions.
• Lock or wipe lost devices if you can.
• Warn contacts who may receive fake messages from the account.
• Write down what happened and what you will change.

Also read our guide to data protection for NGOs, which covers personal data in more detail.

Keep it realistic

Myanmar teams may work with shared devices, unstable internet and changing risks. Do not try everything at once. Pick the five measures that cut your biggest risks, train the team, and add more over time. Choose measures people will use, since tools that staff abandon give no protection.

How EMPO can help

EMPO is a trusted, Yangon-based training and consultancy provider and one of Myanmar's leading names in practical NGO training, with 1,200+ people trained and 15 partner organisations. We support organisational development and deliver training online or in person across Myanmar, in English and Burmese. See our services or contact us to plan a session for your team.

Sources

• How does Security in a Box work? — Front Line Defenders
• Choosing Your Tools — Electronic Frontier Foundation, Surveillance Self-Defense