Security in a digital world

Chapter summary

Digital threats to humanitarian organisations are widespread and multifaceted. They can include malware or spyware installed via apps or links, targeted hacks and data breaches, and network exploitation (use of untrusted and potentially hostile networks, e.g. fake wifi). Individual staff members can be vulnerable to online harassment and hate speech or cyber-crime such as identity theft. Direct targeting of aid workers is a growing and serious threat, particularly for those in public-facing roles or from under-represented or marginalised groups (e.g. women and individuals who identify as LGBTQI+). Organisations (and the aid sector generally) can face risks stemming from online smear campaigns propagated by hostile actors.

While responsibility for digital security often falls under IT, security staff are increasingly involved in digital security discussions, as digital threats can have significant physical security implications for aid workers. For instance, hacking or unauthorised access to sensitive data, such as travel itineraries or personal information, can lead to targeted physical attacks, kidnappings and harassment by hostile actors. Security staff need to understand the types of digital threats aid workers may face and how they can work with other organisational teams to mitigate digital risks, including promoting digital hygiene practices.

The nature of digital threats can vary depending on the level of the target, which can be an individual, a specific organisation or the aid sector overall. While there is often overlap (e.g. individuals may become victims when their organisations are targeted), it is beneficial for organisations to discuss the specific risks and implement measures to mitigate threats across all three levels. This may be particularly helpful in regard to the risks of harmful information.

Harmful information (misinformation, disinformation, malinformation and hate speech) is becoming a serious threat to aid organisations. Examples include spreading false information about aid activities, discrediting humanitarian reports or intentions, and impersonating humanitarian personnel for ulterior purposes. Mitigation measures may include sensitising and training staff, building strong networks with partners for information verification and counter-messaging, and systematically monitoring content and changes in perception (‘social media listening’).

Digital threats, including harmful information, should be incorporated into existing risk assessment processes. Organisations can equip responsible personnel, such as social media staff, with the tools needed to consider harmful information risks directly. Key staff should know what technology is being used within the organisation and ensure that there are protocols and platforms for managing devices securely.

Digital hygiene practices are essential and can help to maintain a consistent digital security baseline by promoting good, repeatable behaviours and protocols. Staff require training and support in understanding and following these protocols. Examples include:

• Using strong passwords and multifactor authentication
• Keeping everything updated
• Implementing secure device settings
• Minimising app and social media usage where appropriate
• Strengthening email security
• Managing and encrypting data
• Using VPNs and avoiding unsecured websites
• Reporting incidents immediately