Security for NGO

The security and stability of data can be a major concern to civil society groups whose major activities revolve around information generation, exchange and dissemination. In particular, this is true for high risk groups (independent media, those working on human rights, womens issues, anti-corruption, etc) who can become targets of surveillance, computer theft, damage and confiscation, or suffer from loss of data due to mismanagement, mistake or virus. In order to successfully work towards achieving their goals, these groups need to be able to protect their information and communications. They need access to the knowledge and tools that allow them to choose when and how to appropriately and securely collect, store and distribute information.

Tools which can serve to protect information and communications have been in use for some time (such as PGP), however the selection and deployment of such tools and techniques is often not sophisticated enough to appropriately meet the needs of groups on the ground. Solutions have to be specific to a variety of factors in order to be effective. These are:

• the country situation (politically and technologically);
• profile of the group or individual (high profile or low, human rights or media);
• the circumstances under which the information is being used (in an internet cafe or on an office computer);
• the function of the information (communication outside the base-country, information sharing, data collection etc);

These factors are very important in deciding which solutions to use, and therefore make training and consultations by well-informed local technology/civil society experts essential. Particularly because in some circumstances badly prescribed technology can do more harm than good. In addition to this other factors such as, in-office installs, accessibility to follow-up and troubleshooting post training can greatly effect a groups ability to successfully utilise new tools, and therefore reinforce the need for local expertise. The problem with many security trainings currently available to civil society groups is that they are too technically focused, concentrating on the intricacies of encryption technologies, instead of outlining how to transform the security culture of an organisation. End-users need to understand the context in which the tool can be applied, to be able to make decisions about what risks to take when, and to understand how to build up institutional security protocols.

In response to the above challenges, this initiative aims to strengthen security trainers working in the region whilst at the same time increasing access to such expertise and tools for high risk groups. This practical initiative, will focus on enabling the delivery of appropriate skills and tools to organisations on the ground in need.