13 ways to protect your NGO from hacking and surveillance

Greg Day, vice president, Europe, the Middle East and Africa, FireEye, London, UK, @FireEye

Be aware of motives for attack: You may be wondering why attackers would focus on NGOs? The simple answer is that they are very often aggregators of information that can be used for commercial gain. A second motive could be that NGOs are often seen as a trusted source of information. In some instances they may be attacked because the attacker wants access the NGO's contacts. And fourthly, an attack could embed code onto the site so that visitors could be attacked from what they would believe to be a trusted source.

Mohammad Farooq, digital security trainer, Digital Rights Foundation, Lahore, Pakistan

Upgrade IT equipment: Most NGO computer systems are on obsolete operating systems and have major security vulnerabilities.

Don't get carried away: Paranoia knows no bounds. There has to be a delicate balance between internet security and common sense. Excess security will hamper trust between communicating parties and increase frustration. Internet security is a must but not when it threatens relationships.

Laura Schauble, associate director, commercial insurance, Clements Worldwide, Washington DC, @Tweet_Clements

Consider the wider risks: While there are always industry-specific concerns, NGOs are also focused on how to protect information like employee data, donor information, financial performance and so on. These are the same concerns that other organisations face.

Remember there's no safe space: A breach can happen anywhere. Regardless of where an NGO is operating, the same kind of due diligence and planning applies.

Ado A. Machida, president, International Stability Operations Association, Washington DC

Invest to protect assets: There is a perception that most NGOs do not have the resources to mitigate cyber threats. In some cases, the NGOs convince themselves that because they are so public about their mission, their information is always for public consumption. What they sometimes forget is that many NGOs operate with financial contributions and donations from individuals and very large institutions, and they provide an easy gateway for hackers to exploit this perceived gap.

Becky Kazansky, researcher, Tactical Tech, Berlin, Germany, @pondswimmer

Teach staff social media guidelines: Many organisations rely on platforms like Facebook and Twitter to organise and connect with audiences and communities. This puts staff at risk but is increasingly necessary. Yet the experience from NGOs suggest governments find social media one of the easiest ways to monitor activity. Putting in place some basic guidelines for staff helps to mitigate risk.

Don't rely on the law: We're sceptical that laws and regulations will ever provide a framework on which NGOs can rely for their security for a number of reasons: governments are frequently the most active transgressors of NGOs' digital security; laws in this area are poorly enforced and/or impractical to enforce and finally legislation inevitably falls behind new technologies and capabilities. Instead we strongly recommend that NGOs adopt global best-practice policies independent of regulatory frameworks.

Jim Loughran, head of media and communications, Front Line Defenders, @FrontLineHRD, Dublin, Ireland

Make sure there are no weak links: At every staff meeting we ask one person to present on an issue of digital security and emphasise that the security of our organisation, with a corresponding risk to human rights defenders, is only as strong as the weakest link. Nobody wants to be the weakest link.

Know the basics: It is so important to give people training in the basics – like how you wipe your tracks if you have to use the computer in the hotel lobby. Last year I logged onto a hotel computer in Guatemala only to find a sensitive document about adoption of children to Europe still open.

Convince the Luddites: As the last of the Luddites to get up to speed on the issue of digital security, I'm aware that one of the main challenges is to demystify the issue and explain it is not just for the specialists. While certain groups are particularly vulnerable, it should be of concern to anyone who worries about their online security.

Dr Richard Tynan, technologist, Privacy International, London, UK, @richietynan

Know that security awareness isn't about lack of trust: Creating a secure communication channel is a very different concept to trusting the person you are communicating with.

Start with these five basic security tips: 1. Long passwords, 2. different passwords 3. separate admin and user account on a machine 4. disk encryption. 5. firewall that shows inbound and outbound connections

Read more stories like this:

Megaphone for social movements: campaigning in the surveillance state

International development: how to minimise the risks during humanitarian work

How to campaign online: 15 dos and don'ts

Join the community of global development professionals and experts. Become a GDPN member to get more stories like this direct to your inbox