Online security guide for activists

In the modern world, activism is as digital as it is physical. From organizing protests on social media to leaking documents via encrypted channels, the tools of change are now online. But this digital frontier is also a battlefield. Governments, corporations, and malicious actors routinely surveil, harass, and disrupt the work of those who challenge the status quo. For today’s activist, digital security isn’t a technical niche—it’s a core pillar of operational safety, protecting not just you, but your entire movement, your colleagues, and your sources.

This guide moves beyond simple “password tips” to provide a foundational framework for building a culture of security, or “opsec” (operational security), into your activist work.

Part 1: The Mindset – Operational Security (OPSEC) is Your First Weapon

Before you download a single app, you must adopt a new mindset. OPSEC is the process of identifying your critical information, analyzing the threats to it, and then implementing measures to protect it.

1. Know Your Adversaries: Who might want to disrupt your work? Is it state surveillance? Corporate espionage? Hacktivists with an opposing ideology? Understanding their capabilities and motivations helps you tailor your defense. A local corporation might hire a private investigator to dig through your public social media, while a state actor might use sophisticated malware.
2. Identify Your Crown Jewels: What information would cause the most harm if it were exposed? This isn’t just a list of members. It could be:
   • Communication: Chat logs with sensitive sources.
   • Planning: The location and time of an upcoming action.
   • Membership: The identities of fellow activists, especially those who are vulnerable.
   • Research: Unpublished data or documents that are the basis of your campaign.
3. Think in “What If” Scenarios: What if your phone is stolen at a protest? What if you receive a phishing email disguised as a message from a colleague? What if you are detained and asked to unlock your devices? Planning for these scenarios in advance is the key to resilience.

Part 2: Fortifying Your Digital Castle – Device and Account Security

Your smartphone and computer are the primary targets. They must be hardened.

• Encryption is Non-Negotiable: Encryption scrambles your data so it’s unreadable without a key.
  • Full-Disk Encryption: Ensure this is enabled on your computer (FileVault on Mac, BitLocker on Windows) and smartphone (enabled by default on modern iPhones and Android with a strong passcode). This protects your data if your device is physically seized.
  • Encrypted Communication: Use apps that provide end-to-end encryption (E2EE), meaning only you and the recipient can read the messages. The service provider cannot access them.
• The Power of the Passphrase: Ditch short, complex passwords. Use a long, memorable passphrase made of random words. CorrectHorseBatteryStaple! is far stronger and easier to remember than P@ssw0rd123. Use a reputable password manager (like Bitwarden or KeePassXC) to generate and store unique, strong passwords for every account.
• Two-Factor Authentication (2FA): Your Safety Net: Enable 2FA on every account that offers it. This adds a second step to logging in (like a code from an app on your phone), making it useless for an attacker to have just your password. Use an authenticator app (like Aegis Authenticator or Authy) instead of SMS codes, which can be intercepted via SIM-swapping attacks.

Part 3: The Art of Secret Conversations – Secure Communication

This is often the most critical vulnerability for activist groups.

• Avoid Default Tools: Treat standard SMS text messages and phone calls as public. They are easily intercepted and metadata (who you called and when) is collected en masse.
• Embrace Encrypted Messaging:
  • Signal: The gold standard for activists. It’s open-source, independently audited, and provides E2EE for messages, voice, and video calls. Use its disappearing messages feature for sensitive plans and always enable screen security to prevent message previews from showing up in your app switcher.
  • WhatsApp: While it uses the Signal protocol for E2EE, it’s owned by Meta, which collects significant metadata and is a larger, more attractive target for surveillance. It’s better than SMS but not as private as Signal.
• For the Highest Risk: If you’re dealing with whistleblowers or information that could have severe legal consequences, consider Session or Briar. These apps are designed to minimize metadata and can work over Tor or Bluetooth, reducing their digital footprint even further.

Part 4: Becoming a Digital Ghost – Browsing and Anonymity

Your internet activity can paint a detailed picture of your research, contacts, and plans.

• VPN (Virtual Private Network): A VPN encrypts your internet traffic and routes it through a server in another location, hiding your IP address from the websites you visit. Crucially, choose a VPN provider with a verified no-logs policy (meaning they don’t record your activity) and that is based in a privacy-friendly jurisdiction. Paid VPNs are almost always more trustworthy than free ones.
• Tor Browser: For the highest level of anonymity, use the Tor Browser. It routes your traffic through multiple volunteer-run servers, making it extremely difficult for anyone to trace your activity back to you. It is essential for safely researching sensitive topics, accessing potentially blocked resources, or anonymously submitting information to journalists.
• Scrub Your Metadata: Before sharing a photo you took at a action, remember that it contains EXIF data—a digital record of the time, date, and precise GPS coordinates where the photo was taken. This has been used to identify and arrest activists. Disable location services for your camera app and use tools to scrub this data before posting anything online.

Part 5: Building a Culture of Security – It Takes a Village

Security is a collective effort. One weak link can compromise an entire group.

1. Train Together: Hold workshops for your collective or organization. Practice identifying phishing emails. Walk through how to install and use Signal. Make security knowledge accessible, not intimidating.
2. Establish Communication Protocols: Decide as a group which tools to use for what purpose. Maybe Signal is for urgent planning, while a more open Discord server is for general discussion. Clarity prevents mistakes.
3. The Principle of Least Privilege: Not everyone needs access to everything. Sensitive information should be shared on a strict need-to-know basis. This contains the damage if one person’s account is compromised.
4. Prepare for the Worst:
   • Data Backups: Regularly back up your crucial data to an encrypted external hard drive or a secure cloud service. What if your laptop is destroyed during a raid?
   • Emergency Contacts: Have a plan for who to call if you are detained. Use “burner” phones for high-risk actions.
   • Digital Will: Have a trusted person who knows how to access your accounts and secure or delete sensitive data if you are incapacitated.

Conclusion: Security is a Practice, Not a Destination

There is no such thing as perfect security. The landscape is always changing. What matters is building resilient habits and fostering a culture of awareness within your movement. This isn’t about living in fear; it’s about operating with confidence. By taking proactive steps to secure your digital presence, you protect your ability to speak truth to power, to organize effectively, and to ensure that your movement—not the adversaries trying to stop it—controls its own narrative and its own future.

Your cause is important. Protecting it is too.