Campaign Toolkit - Digital Security Check List

Before launching your campaign, it is essential that you consider the potential risks involved, especially if your campaign targets vulnerable groups or touches on sensitive topics such as radicalisation, hate speech or gang culture. If your NGO works with vulnerable communities, it is especially important to consider the potential consequences of your campaign on this group.

From security breaches to online harassment and abuse, digital threats can take multiple forms. Before launching your campaign, it is critical that you conduct a robust risk assessment to be aware of potential threats to your staff and infrastructure, and take steps to minimise these threats.

Organisations dedicated to helping institutions, companies and non-profits mitigate their risks online can offer you specific advice related to the needs of your campaign and assists you in conducting a thorough risk assessment. Valuable resources and guides on digital security for NGOs can also be found online (see our list of other resources).

The checklist below provides an overview of some key elements to consider to enhance your campaign’s security. This list is not comprehensive and cannot replace a tailored risk assessment. Each campaign presents a specific set of challenges which depend on your target audience, country of operation and area of work.

Digital Security Checklist [users should be able to tick the things that they have carried out for their campaign]

 1 – Computer security

• • Regularly update your computer and use antivirus and firewall software
  • Update your passwords regularly and use an encrypted password manager
  • Do not connect to the Internet in public spaces or using insecure connections
  • Securitize and encrypt your data, documents and content
  • Use password protected external hard drive
  •  Beware of phishing emails, avoid clicking links in emails and keep an eye on the URL
  • Be careful about what software you install; avoid cracked or pirated software
  • Don’t put USB drives into your computer if you don’t know whose they are or where they came from

2 – Phone security

• • Keep the phone’s operating system updated
  • Make regular encrypted backups
  • Deactivate geo-localisation on your phone
  • Use strong passwords with a password manager
  • Review the access permissions you’ve given different apps
  • Disable ad tracking
  • Enable SSL for your email accounts
  • Protect yourself with OpenVPN when using public networks
  • Don’t use untrusted power plugs

3 – Staff security

• • Do not use your personal email for professional social media or in relation to your campaign
  •  Provide duty of care to visible messengers of the campaign
  • Provide duty of care to your staff
  • Consider the risks your campaign may be posing to your target audience
  • Create new social media accounts from which to sync with campaign pages

Threat response

If your campaign becomes targeted by a contrary audience, is hijacked by a malicious group, or faces any form of crisis – be it online harassment, threats or trolling – there are a number of steps you can take to address the situation:

• • Do not engage with comments on social media channels using your personal account
  • Use qualified interventionists to engage directly with at-risk individuals
  • Report instances of hate speech if you encounter any on the platforms you use
  •  Report threats to you or your organisation to police forces
  • If unsure on how to proceed, call a helpline; several organisations, including Access Now, have a 24/7 free helpline for NGOs and offer support in several languages
  • If you are facing a major cyber security breach, you can report it to the relevant authorities in your country
  • When seeking help, ensure that you are using a secure line of communication, which might require using and alternate device