Coffee and Circumvention: Event Security Tips - Revision history

Victoria at 13:40, 10 May 2023

2023-05-10T13:40:57Z

← Older revision		Revision as of 13:40, 10 May 2023
Line 5:		Line 5:

	The woman activist may be a target of gendered harassment and violence by their state and community for challenging power through their activism/work, and thus may be a target of spyware, hacking, online violence or physical attacks. Meanwhile the older male director of an IT company may only face risks from hackers aiming to steal and profit from his company, but with no specific interest to harm him personally.		The woman activist may be a target of gendered harassment and violence by their state and community for challenging power through their activism/work, and thus may be a target of spyware, hacking, online violence or physical attacks. Meanwhile the older male director of an IT company may only face risks from hackers aiming to steal and profit from his company, but with no specific interest to harm him personally.
			[[File:Coffee and Circumvention Security Tips Door.jpg\|right\|frameless]]
	Unfortunately, however, in an event, your participants inherit the total sum of the risks of everyone involved. Thus, continuing the example above, the director of the IT company may find that he is also being surveilled or subjected to other threats because of his association with the woman activist through the event or any other type of community building initiatives where they are both present.		Unfortunately, however, in an event, your participants inherit the total sum of the risks of everyone involved. Thus, continuing the example above, the director of the IT company may find that he is also being surveilled or subjected to other threats because of his association with the woman activist through the event or any other type of community building initiatives where they are both present.

Line 13:		Line 13:

	==Step Zero: Threat Modeling==		==Step Zero: Threat Modeling==
			[[File:Coffee and Cirumvention Security Tips Woman Microphone.jpg\|right\|frameless]]
	The first step is to create a contextualized threat model based on the people who will be involved, and the particular context of your city/country. This allows you to gather all pertinent information related to your participant’s potential vulnerabilities and risks, and allow you to think through how to mitigate them. Again, starting with the most vulnerable of your group helps tremendously with this, as they probably face a wider set of risks than any other individual in your group. We also encourage you to do this exercise with people you trust, given that collective wisdom helps tremendously here. In addition, inviting a security expert from your community to help with this step, will be greatly helpful.		The first step is to create a contextualized threat model based on the people who will be involved, and the particular context of your city/country. This allows you to gather all pertinent information related to your participant’s potential vulnerabilities and risks, and allow you to think through how to mitigate them. Again, starting with the most vulnerable of your group helps tremendously with this, as they probably face a wider set of risks than any other individual in your group. We also encourage you to do this exercise with people you trust, given that collective wisdom helps tremendously here. In addition, inviting a security expert from your community to help with this step, will be greatly helpful.

Line 26:		Line 27:

	==Step One: Secure Communications==		==Step One: Secure Communications==
			[[File:Coffee and Circumnvention Security Tipis Cafe.png\|right\|frameless]]
	Putting together Coffee & Circumvention monthly events requires multiple points of communication and contact with attendees and other organizers - at the end of the day, community organizing involves a lot of coordination. Here are steps to help you with establishing secure communication channels.		Putting together Coffee & Circumvention monthly events requires multiple points of communication and contact with attendees and other organizers - at the end of the day, community organizing involves a lot of coordination. Here are steps to help you with establishing secure communication channels.

Line 45:		Line 47:

	Now you must determine how or what technology platforms you will be using to communicate with your participants. Keep in mind that each platform comes with its set of risks, and you must balance this with the preference of community members.		Now you must determine how or what technology platforms you will be using to communicate with your participants. Keep in mind that each platform comes with its set of risks, and you must balance this with the preference of community members.
			[[File:Signal App Logo.png\|right\|frameless]]
	A simple option is to use end-to-end encrypted email communication apps like Signal or Wire. (''End-to-end encryption simply means that only the sender and receiver(s) can see messages''.) '''Wire''' may be preferred because individuals can set up a “handle or name” versus having to use their phone number. In either app, make sure to use the disappearing or [https://support.wire.com/hc/en-us/articles/213216845-Send-a-self-deleting-message#:~:text=Self%2Ddeleting%20messages%20are%20messages,1%3A1%20and%20group%20conversations. self-deleting messages] option, especially if you are sharing sensitive information. Important note, Signal is not often the best choice in places where device seizures are common, where phone numbers are used as identifiers.		A simple option is to use end-to-end encrypted email communication apps like Signal or Wire. (''End-to-end encryption simply means that only the sender and receiver(s) can see messages''.) '''Wire''' may be preferred because individuals can set up a “handle or name” versus having to use their phone number. In either app, make sure to use the disappearing or [https://support.wire.com/hc/en-us/articles/213216845-Send-a-self-deleting-message#:~:text=Self%2Ddeleting%20messages%20are%20messages,1%3A1%20and%20group%20conversations. self-deleting messages] option, especially if you are sharing sensitive information. Important note, Signal is not often the best choice in places where device seizures are common, where phone numbers are used as identifiers.

Line 59:		Line 61:

	===4) A Private Communication Group for Your Organizing Team===		===4) A Private Communication Group for Your Organizing Team===
			[[File:Coffee and Circumnvention Security Tips Group of People.png\|right\|frameless]]
	We highly encourage you to create a private communication group (Signal or Wire) for your city’s organizing team. See above regarding end-to-end encrypted email communication apps, to understand why we recommend using Wire as a key communication space for the gathering.		We highly encourage you to create a private communication group (Signal or Wire) for your city’s organizing team. See above regarding end-to-end encrypted email communication apps, to understand why we recommend using Wire as a key communication space for the gathering.

Line 77:		Line 79:
	== Step Two: Selecting Secure Locations and Venues ==		== Step Two: Selecting Secure Locations and Venues ==
	Your venue choice will be influenced by who you are inviting, their various threat levels, and the political context of the location you are organizing within. It is important to center the most vulnerable participants invited.		Your venue choice will be influenced by who you are inviting, their various threat levels, and the political context of the location you are organizing within. It is important to center the most vulnerable participants invited.
			[[File:Hug.jpg\|right\|frameless]]
	For example, are you bringing together people who have openly advocated for LGBTQI+ rights within a state that criminalizes LGBTQ expressions?		For example, are you bringing together people who have openly advocated for LGBTQI+ rights within a state that criminalizes LGBTQ expressions?

Line 97:		Line 99:

	==Security of Organizers and Attendees==		==Security of Organizers and Attendees==
			[[File:Coffee and Circumvention Security Tips Woman and Man and Computer.png\|right\|frameless]]
	Ensure that each person attending is following key security protocols, listed below. Share security tips and information with all invited participants, including:		Ensure that each person attending is following key security protocols, listed below. Share security tips and information with all invited participants, including:

Line 110:		Line 112:
	# Even when your gathering is invite-only, you have to make sure that everyone that shows up is either known by you or by a trusted community member. For example, if someone shows up that you did NOT invite, it's important to find out who they are and how they got there. They could be someone’s partner, or they could be someone with bad intentions. Don’t be scared to directly ask questions. Most people will not react negatively, given that they know you are doing this for safety and security reasons. If people do react negatively, that may be a red flag to you that something is wrong.		# Even when your gathering is invite-only, you have to make sure that everyone that shows up is either known by you or by a trusted community member. For example, if someone shows up that you did NOT invite, it's important to find out who they are and how they got there. They could be someone’s partner, or they could be someone with bad intentions. Don’t be scared to directly ask questions. Most people will not react negatively, given that they know you are doing this for safety and security reasons. If people do react negatively, that may be a red flag to you that something is wrong.

	==Designing Safe Engagements==		==Designing Safe Engagements==
			[[File:Coffee and Circumvention Security Tips Woman Talking Table.png\|right\|frameless]]
	Security and safety also mean that participants do not feel threatened while engaging with others. This is why it's important to create Engagement Guidelines, that you can co-design with your community members and/or the organizing team. These guidelines help participants understand		Security and safety also mean that participants do not feel threatened while engaging with others. This is why it's important to create Engagement Guidelines, that you can co-design with your community members and/or the organizing team. These guidelines help participants understand

Line 133:		Line 135:

	==Have an incident response plan==		==Have an incident response plan==
			[[File:Coffee and Circumnvention Security Tips Hands.png\|right\|frameless]]
	An incident response plan is an essential component of any group's safety strategy. It is usually a set of tools, procedures, or processes that your team can use to identify, eliminate, and recover from safety threats or emergencies. It is designed to help your team respond quickly and uniformly. Having a plan at least outlined or resources identified can help reduce damage, minimize downtime, protect your team's reputation, and improve preparedness in the future.		An incident response plan is an essential component of any group's safety strategy. It is usually a set of tools, procedures, or processes that your team can use to identify, eliminate, and recover from safety threats or emergencies. It is designed to help your team respond quickly and uniformly. Having a plan at least outlined or resources identified can help reduce damage, minimize downtime, protect your team's reputation, and improve preparedness in the future.

	You do not need to be organizing in a risky or dangerous context to have an incident response plan. Even if you are organizing in a safe(r) environment, an incident response plan can help you address incidents like climate/environment emergencies; medical emergencies; external incidents (protests, crackdowns, etc). In short, this is the plan to fall back on when a crisis or an unanticipated incident occurs.		You do not need to be organizing in a risky or dangerous context to have an incident response plan. Even if you are organizing in a safe(r) environment, an incident response plan can help you address incidents like climate/environment emergencies; medical emergencies; external incidents (protests, crackdowns, etc). In short, this is the plan to fall back on when a crisis or an unanticipated incident occurs.

Line 176:		Line 177:

	===== '''Lessons learned''' =====		===== '''Lessons learned''' =====
			[[File:Coffee and Circumvention Security Tips High Five.jpg\|right\|frameless]]
	Once the incident is resolved, hold an after-action meeting with all incident response team members, discuss what you’ve learned. Be sure to analyze and document everything about the incident. Determine what worked well in your response plan, where the response team was effective, and areas that require improvement. This will help the team develop more creative and accurate approaches to incident handling. Do not delay this step, as details or information are often forgotten if this portion of an incident response plan is skipped or not prioritized. Sometimes an incident can be connected to a series of attacks other groups of people should be warned about, so outreach and networking with partners are often needed at this stage in order to spread public alerts describing this kind of incident. Be mindful of the emotional or psychological impact of the incident on the team or participants. If further processing or interventions are needed, seek psychosocial care.		Once the incident is resolved, hold an after-action meeting with all incident response team members, discuss what you’ve learned. Be sure to analyze and document everything about the incident. Determine what worked well in your response plan, where the response team was effective, and areas that require improvement. This will help the team develop more creative and accurate approaches to incident handling. Do not delay this step, as details or information are often forgotten if this portion of an incident response plan is skipped or not prioritized. Sometimes an incident can be connected to a series of attacks other groups of people should be warned about, so outreach and networking with partners are often needed at this stage in order to spread public alerts describing this kind of incident. Be mindful of the emotional or psychological impact of the incident on the team or participants. If further processing or interventions are needed, seek psychosocial care.

	''Key questions to address:''		''Key questions to address:''
	* What changes need to be made to the security/safety plan?		* What changes need to be made to the security/safety plan?
Line 211:		Line 212:

	======'''Grants'''======		======'''Grants'''======
			[[File:Coffee and Circumnvention Security Tips Crowd.png\|right\|frameless]]
	[https://www.digitalrights.community/weekly-newsletter Subscribe to Team CommUNITY's digital rights newsletter] for weekly emails where we list open grants and funding opportunities. However, some worth mentioning:		[https://www.digitalrights.community/weekly-newsletter Subscribe to Team CommUNITY's digital rights newsletter] for weekly emails where we list open grants and funding opportunities. However, some worth mentioning:
	* [https://urgentactionfund.org/apply-for-a-grant/criteriado-i-fit/ Urgent Action Fund Security Grant]		* [https://urgentactionfund.org/apply-for-a-grant/criteriado-i-fit/ Urgent Action Fund Security Grant]

Victoria: /* Designing Safe Engagements */

2023-04-04T13:36:50Z

Designing Safe Engagements

← Older revision		Revision as of 13:36, 4 April 2023
Line 88:		Line 88:
	When organizing in physical spaces, think about the travel journey of participants, including:		When organizing in physical spaces, think about the travel journey of participants, including:

	* ~~points~~ of exit and entry of the venue		* Points of exit and entry of the venue
	* ~~the~~ feasibility of travel to the location		* The feasibility of travel to the location
	* Mode of travel		* Mode of travel

Line 100:		Line 100:
	Ensure that each person attending is following key security protocols, listed below. Share security tips and information with all invited participants, including:		Ensure that each person attending is following key security protocols, listed below. Share security tips and information with all invited participants, including:

	1. Before the gathering, all participants need to ensure that their devices are password protected. Face and fingerprint IDs need to be disabled before attending any meetup in case phones are stolen or confiscated. If using an iphone, [https://support.apple.com/en-gb/guide/iphone/iph9a2a69136/ios disable access to the control center when your phone is locked].		# Before the gathering, all participants need to ensure that their devices are password protected. Face and fingerprint IDs need to be disabled before attending any meetup in case phones are stolen or confiscated. If using an iphone, [https://support.apple.com/en-gb/guide/iphone/iph9a2a69136/ios disable access to the control center when your phone is locked].
			# Provide tips on how to spot and [https://ssd.eff.org/module/how-avoid-phishing-attacks avoid phishing attacks]
	2. Provide tips on how to spot and [https://ssd.eff.org/module/how-avoid-phishing-attacks avoid phishing attacks]		# If possible, participants should turn off their GPS location tracking on their devices or turn on airplane mode. However, this may be more complicated especially when considering the mode of traveling of the participants. If participants are going to an unfamiliar location, they might have to use map services to navigate. You can inform participants that google maps work offline after the navigation data has loaded.
			# Scan locations for cameras, and do not type passwords or unlock devices within the camera view. Locations also include transport, transit and gathering locations.
	3. If possible, participants should turn off their GPS location tracking on their devices or turn on airplane mode. However, this may be more complicated especially when considering the mode of traveling of the participants. If participants are going to an unfamiliar location, they might have to use map services to navigate. You can inform participants that google maps work offline after the navigation data has loaded.		# If possible, participants should avoid connecting to public wifi
			# We encourage that photos should not be taken during the gathering. However, if you want to take photos to document the moment, take photos without unlocking one’s phone, and before sharing, scrap the metadata by screenshotting the image and uploading the screenshotted version.
	4. Scan locations for cameras, and do not type passwords or unlock devices within the camera view. Locations also include transport, transit and gathering locations.		# Phones may get lost, stolen and/or confiscated. We encourage that before the gathering, back up the data on your devices, [https://ssd.eff.org/module/keeping-your-data-safe store the information in a secure location].
			# When attending a gathering, encourage participants to cover any identifiable features such as tattoos, piercings if possible. Note, participants should dress accordingly to where you communicated that you are meeting (For example, if you let them know you are going to an Art gallery, they should dress appropriately for that)
	5. If possible, participants should avoid connecting to public wifi		# Even when your gathering is invite-only, you have to make sure that everyone that shows up is either known by you or by a trusted community member. For example, if someone shows up that you did NOT invite, it's important to find out who they are and how they got there. They could be someone’s partner, or they could be someone with bad intentions. Don’t be scared to directly ask questions. Most people will not react negatively, given that they know you are doing this for safety and security reasons. If people do react negatively, that may be a red flag to you that something is wrong.

	6. We encourage that photos should not be taken during the gathering. However, if you want to take photos to document the moment, take photos without unlocking one’s phone, and before sharing, scrap the metadata by screenshotting the image and uploading the screenshotted version.

	7. Phones may get lost, stolen and/or confiscated. We encourage that before the gathering, back up the data on your devices, [https://ssd.eff.org/module/keeping-your-data-safe store the information in a secure location].

	8. When attending a gathering, encourage participants to cover any identifiable features such as tattoos, piercings if possible. Note, participants should dress accordingly to where you communicated that you are meeting (For example, if you let them know you are going to an Art gallery, they should dress appropriately for that)

	9. Even when your gathering is invite-only, you have to make sure that everyone that shows up is either known by you or by a trusted community member. For example, if someone shows up that you did NOT invite, it's important to find out who they are and how they got there. They could be someone’s partner, or they could be someone with bad intentions. Don’t be scared to directly ask questions. Most people will not react negatively, given that they know you are doing this for safety and security reasons. If people do react negatively, that may be a red flag to you that something is wrong.

	==Designing Safe Engagements==		==Designing Safe Engagements==
Line 122:		Line 114:
	Security and safety also mean that participants do not feel threatened while engaging with others. This is why it's important to create Engagement Guidelines, that you can co-design with your community members and/or the organizing team. These guidelines help participants understand		Security and safety also mean that participants do not feel threatened while engaging with others. This is why it's important to create Engagement Guidelines, that you can co-design with your community members and/or the organizing team. These guidelines help participants understand

	1. How people should engage with each other (Rules of engagement)		# How people should engage with each other (Rules of engagement)
			# The type of culture you are creating collectively together
	2. The type of culture you are creating collectively together		# Behaviors to be avoided.

	3. Behaviors to be avoided.

	'''<big>Below are some tips, and you can also check out [[Community Culture\|TCU’s Cultural Guidelines]], [[Security Policy]] and [https://www.digitalrights.community/code-of-conduct Code of Conduct].</big>'''		'''<big>Below are some tips, and you can also check out [[Community Culture\|TCU’s Cultural Guidelines]], [[Security Policy]] and [https://www.digitalrights.community/code-of-conduct Code of Conduct].</big>'''
Line 132:		Line 122:
	Questions or areas that you may want to consider addressing with your community or organizing team:		Questions or areas that you may want to consider addressing with your community or organizing team:

	- Do participants want to avoid being photographed, or quoted while at the event?		* Do participants want to avoid being photographed, or quoted while at the event?
			* Do you want to discourage the use of social media about the event itself and what is discussed?
	- Do you want to discourage the use of social media about the event itself and what is discussed?		* Do participants want to use neutral pronouns and language? Note: It is advised that you do not force people into disclosing their gendered and sexual identities, as this can create unease and a somewhat hostile space. This, for example, can be put into your Engagement Guidelines.

	- Do participants want to use neutral pronouns and language? Note: It is advised that you do not force people into disclosing their gendered and sexual identities, as this can create unease and a somewhat hostile space. This, for example, can be put into your Engagement Guidelines.

	In addition, safe and collaborative environments always include a Code of Conduct (COC) also known as Code of Practice, which includes a list of harmful behaviors or actions that will not be tolerated, and will result in expulsion from the event. We recommend that you start off using an existing COC, such as [https://www.digitalrights.community/code-of-conduct TCU]’s and then update it with your community and/or organizing team.		In addition, safe and collaborative environments always include a Code of Conduct (COC) also known as Code of Practice, which includes a list of harmful behaviors or actions that will not be tolerated, and will result in expulsion from the event. We recommend that you start off using an existing COC, such as [https://www.digitalrights.community/code-of-conduct TCU]’s and then update it with your community and/or organizing team.
Line 203:		Line 191:
	== Digital Safety Resources ==		== Digital Safety Resources ==

	======Personal Security: Guides and Trainings======		======'''Personal Security: Guides and Trainings'''======
	* [https://securityplanner.consumerreports.org/ Assessment tool and personalized digital safety plan for individuals]		* [https://securityplanner.consumerreports.org/ Assessment tool and personalized digital safety plan for individuals]
	* [https://datadetoxkit.org/ Tactical Tech’s Data Detox Kit], a detailed guide to reducing your digital trail		* [https://datadetoxkit.org/ Tactical Tech’s Data Detox Kit], a detailed guide to reducing your digital trail
Line 213:		Line 201:
	* [https://sheltercity.org/resources/ Shelter City resources] for human rights defenders		* [https://sheltercity.org/resources/ Shelter City resources] for human rights defenders

	======Rapid-response helplines (in case of digital security emergencies or incidents)======		======'''Rapid-response helplines (in case of digital security emergencies or incidents)'''======
	* [https://www.accessnow.org/help/ Access Now Security Helpline]		* [https://www.accessnow.org/help/ Access Now Security Helpline]
	* [https://www.frontlinedefenders.org/emergency-contact Front Line Defender Emergency Contact]		* [https://www.frontlinedefenders.org/emergency-contact Front Line Defender Emergency Contact]
	* [https://smex.org/helpdesk/ SMEX Digital Safety Helpdesk] (MENA-focused)		* [https://smex.org/helpdesk/ SMEX Digital Safety Helpdesk] (MENA-focused)

	======Community Tools======		======'''Community Tools'''======
	* [https://digisec.directory/en/ Digital Security Community Directory] for compilation of tools and resources available.		* [https://digisec.directory/en/ Digital Security Community Directory] for compilation of tools and resources available.
	* [https://usesoap.app/ SOAP (Securing Organizations with Automated Policymaking)] to help you create security and safety policies.		* [https://usesoap.app/ SOAP (Securing Organizations with Automated Policymaking)] to help you create security and safety policies.

	======Grants======		======'''Grants'''======
	[https://www.digitalrights.community/weekly-newsletter Subscribe to Team CommUNITY's digital rights newsletter] for weekly emails where we list open grants and funding opportunities. However, some worth mentioning:		[https://www.digitalrights.community/weekly-newsletter Subscribe to Team CommUNITY's digital rights newsletter] for weekly emails where we list open grants and funding opportunities. However, some worth mentioning:
	* [https://urgentactionfund.org/apply-for-a-grant/criteriado-i-fit/ Urgent Action Fund Security Grant]		* [https://urgentactionfund.org/apply-for-a-grant/criteriado-i-fit/ Urgent Action Fund Security Grant]

Victoria: /* Have an incident response plan */

2023-04-04T13:34:17Z

Have an incident response plan

← Older revision		Revision as of 13:34, 4 April 2023
Line 152:		Line 152:
	Adapted from the cybersecurity framework of [https://www.exabeam.com/incident-response/incident-response-plan/ incident response planning], in an organizing context, a team should think of these phases:		Adapted from the cybersecurity framework of [https://www.exabeam.com/incident-response/incident-response-plan/ incident response planning], in an organizing context, a team should think of these phases:

	=====Preparation=====		====='''Preparation'''=====
	This phase can encompass your planning and organizing time of the event, included in the steps above. Identify who among your team members should be involved when an incident occurs. This can include incident responders, technical team members, decision makers, or partner/support organizations. Document these roles and responsibilities so that the team knows who to notify or will act as decision makers. It is helpful to establish communication protocols for when an incident occurs: include how and when to communicate with participants, law enforcement, and other third parties. If time permits, develop drills or possible scenarios that could occur. You can practice your plan on scenarios that have been identified during your risk assessment prior to the planning of the event		This phase can encompass your planning and organizing time of the event, included in the steps above. Identify who among your team members should be involved when an incident occurs. This can include incident responders, technical team members, decision makers, or partner/support organizations. Document these roles and responsibilities so that the team knows who to notify or will act as decision makers. It is helpful to establish communication protocols for when an incident occurs: include how and when to communicate with participants, law enforcement, and other third parties. If time permits, develop drills or possible scenarios that could occur. You can practice your plan on scenarios that have been identified during your risk assessment prior to the planning of the event

	* '''''Key questions to address:~~'''~~''		''Key questions to address:''
	** Has everyone been trained and made aware of security policies?		* Has everyone been trained and made aware of security policies?
	** Does the incident response team know their roles and the required notifications to make?		* Does the incident response team know their roles and the required notifications to make?
	** Have all incident team members participated in drills or exercises to address potential crises?		* Have all incident team members participated in drills or exercises to address potential crises?
	** Has your team made collaborations or contact with the necessary rapid response or crisis support organizations		* Has your team made collaborations or contact with the necessary rapid response or crisis support organizations
			====='''Identification'''=====
			When an incident is discovered, it is important to determine the severity of the breach to help prioritize the proportionate response. Collect additional evidence, decide on the severity of the incident, and document the “Who, What, Where, Why, and How”. Evidence can take the form of screenshots, interviews, digital evidence, community alerts

	~~=====Identification=====~~		''Key questions to address:''
	When an incident is discovered, it is important to determine the severity of the breach to help prioritize the proportionate response. Collect additional evidence, decide on the severity of the incident, and document the “Who, What, Where, Why, and How”. Evidence can take the form of screenshots, interviews, digital evidence, community alerts		* When did the incident happen?
	* '''''Key questions to address:~~'''~~''		* How was it discovered? Who discovered it?
	** When did the incident happen?		* Does the incident impact the operations, your event at-large, or specific participants?
	** How was it discovered? Who discovered it?		* Have any other areas been impacted?
	** Does the incident impact the operations, your event at-large, or specific participants?		* What is the scope of the incident?
	** Have any other areas been impacted?
	** What is the scope of the incident?
	If the incident involves a code of conduct violation, then the team would follow those protocols. If the incident will have a larger impact on the event and participants, proceed to the next phase.		If the incident involves a code of conduct violation, then the team would follow those protocols. If the incident will have a larger impact on the event and participants, proceed to the next phase.

	* '''Containment:''' Once the incident is identified, the natural instinct can be to delete everything or get rid of the breach. This could hurt in the long run, since you’ll be destroying valuable evidence that you need to determine where the breach started and devise a plan to prevent it from happening again. If the incident is technical in nature (a hack, data breach, misinformation being spread online, etc) contain the incident so it does not spread and cause further damage. Disconnect affected devices from the internet or suspend accounts that have access to data. Have regular backups in place, to make sure that data is not lost. Have short-term and long-term containment strategies ready. If the incident is physical in nature (disruptive participant, medical emergency, etc), plan to have a safe physical space that can be used to isolate the participant.		===== '''Containment''' =====
			Once the incident is identified, the natural instinct can be to delete everything or get rid of the breach. This could hurt in the long run, since you’ll be destroying valuable evidence that you need to determine where the breach started and devise a plan to prevent it from happening again. If the incident is technical in nature (a hack, data breach, misinformation being spread online, etc) contain the incident so it does not spread and cause further damage. Disconnect affected devices from the internet or suspend accounts that have access to data. Have regular backups in place, to make sure that data is not lost. Have short-term and long-term containment strategies ready. If the incident is physical in nature (disruptive participant, medical emergency, etc), plan to have a safe physical space that can be used to isolate the participant.

			===== '''Eradication / removal''' =====
			Once you have contained the issue, you may need to remove the root cause. If the incident is technical in nature, this could mean removal of malware/virus or affected systems are patched or hardened. When it is a physical incident, removal may include relocating participants to temporary safe locations or spaces, and identifying the ways to mitigate the threat towards sustainable solutions.

	* '''~~Eradication / removal:~~''' ~~Once you have contained~~ the ~~issue~~, you ~~may need~~ to ~~remove the root cause. If the~~ incident ~~is technical in nature, this could mean removal of malware/virus or affected systems are patched or hardened~~. ~~When it is a physical incident, removal may include relocating participants~~ to ~~temporary safe locations~~ or ~~spaces,~~ and ~~identifying~~ the ~~ways to mitigate the threat towards sustainable solutions~~.		===== '''Recovery''' =====
			This is the process of restoring and returning affected systems and devices back into normal operating procedures. At this stage, you can make the decision to communicate widely or to targeted audiences about your incident. The choice to communicate or disclose details should depend on your context and nature of the incident.

	* '''Recovery:''' This is the process of restoring and returning affected systems and devices back into normal operating procedures. At this stage, you can make the decision to communicate widely or to targeted audiences about your incident. The choice to communicate or disclose details should depend on your context and nature of the incident.		''Key questions to address:''
	* ''Key questions to address:''		* When can systems be returned to production?
	** When can systems be returned to production?		* Have systems been patched, hardened and tested?
	** Have systems been patched, hardened and tested?		* Can the system be restored from a trusted back-up?
	** Can the system be restored from a trusted back-up?		* How long will the affected systems be monitored and what will you look for when monitoring?
	** How long will the affected systems be monitored and what will you look for when monitoring?		* What tools will ensure similar incidents will not reoccur?
	** What tools will ensure similar incidents will not reoccur?

	* '''Lessons learned:''' Once the incident is resolved, hold an after-action meeting with all incident response team members, discuss what you’ve learned. Be sure to analyze and document everything about the incident. Determine what worked well in your response plan, where the response team was effective, and areas that require improvement. This will help the team develop more creative and accurate approaches to incident handling. Do not delay this step, as details or information are often forgotten if this portion of an incident response plan is skipped or not prioritized. Sometimes an incident can be connected to a series of attacks other groups of people should be warned about, so outreach and networking with partners are often needed at this stage in order to spread public alerts describing this kind of incident. Be mindful of the emotional or psychological impact of the incident on the team or participants. If further processing or interventions are needed, seek psychosocial care.		===== '''Lessons learned''' =====
			Once the incident is resolved, hold an after-action meeting with all incident response team members, discuss what you’ve learned. Be sure to analyze and document everything about the incident. Determine what worked well in your response plan, where the response team was effective, and areas that require improvement. This will help the team develop more creative and accurate approaches to incident handling. Do not delay this step, as details or information are often forgotten if this portion of an incident response plan is skipped or not prioritized. Sometimes an incident can be connected to a series of attacks other groups of people should be warned about, so outreach and networking with partners are often needed at this stage in order to spread public alerts describing this kind of incident. Be mindful of the emotional or psychological impact of the incident on the team or participants. If further processing or interventions are needed, seek psychosocial care.
	* ''Key questions to address:''
	** What changes need to be made to the security/safety plan?		''Key questions to address:''
	** How should team members be trained differently?		* What changes need to be made to the security/safety plan?
	** What weakness did the breach/incident exploit?		* How should team members be trained differently?
	** How will you ensure a similar incident does not happen again?		* What weakness did the breach/incident exploit?
			* How will you ensure a similar incident does not happen again?

	'''Resources:''' [https://tech-care.cc/03-incident-handling-procesa here]		'''Resources:''' [https://tech-care.cc/03-incident-handling-procesa here]
Line 196:		Line 201:

	— — — — — — — — — — — —		— — — — — — — — — — — —



	== Digital Safety Resources ==		== Digital Safety Resources ==

Victoria: /* Protecting Your People */

2023-04-04T13:31:31Z

Protecting Your People

← Older revision		Revision as of 13:31, 4 April 2023
Line 1:		Line 1:
	''The following are security tips and recommendations. However, we highly encourage each group to identify and work with someone in their community who specializes in digital security. This is because each group, context, and individual has specific threats that require tailor-made approaches. Also, this part of the manual is especially focused on individuals in places where gathering may present more risks.''		''The following are security tips and recommendations. However, we highly encourage each group to identify and work with someone in their community who specializes in digital security. This is because each group, context, and individual has specific threats that require tailor-made approaches. Also, this part of the manual is especially focused on individuals in places where gathering may present more risks.''

	~~=Protecting Your People=~~

			== Protecting Your People ==
	When you organize physical gatherings and meetups, you are bringing together diverse individuals each of which have their own unique and specific level of risk. For example, a young woman activist will have different risks than an older male director at an IT company.		When you organize physical gatherings and meetups, you are bringing together diverse individuals each of which have their own unique and specific level of risk. For example, a young woman activist will have different risks than an older male director at an IT company.

Victoria at 13:29, 4 April 2023

2023-04-04T13:29:42Z

← Older revision		Revision as of 13:29, 4 April 2023
Line 76:		Line 76:
	We also recommend you [[How to Critically Choose a VPN\|use a trusted VPN]] across all your devices. This is a crucial step to add a layer of security and privacy to your online activity (since VPNs mask what you do online). They also help you circumvent censorship in your location (for example, if a website is blocked in your country). In a nutshell, VPNs do this by hiding your Internet Protocol Address (which is unique to your device) and securing your digital data by encrypting it. HOWEVER, a VPN is not a magic tool for everything. In addition, [https://freedom.press/training/choosing-a-vpn/ be very careful] when selecting a VPN, because not all VPN providers have good intentions. TCU can provide you with a free code, please let your Community Lead know.		We also recommend you [[How to Critically Choose a VPN\|use a trusted VPN]] across all your devices. This is a crucial step to add a layer of security and privacy to your online activity (since VPNs mask what you do online). They also help you circumvent censorship in your location (for example, if a website is blocked in your country). In a nutshell, VPNs do this by hiding your Internet Protocol Address (which is unique to your device) and securing your digital data by encrypting it. HOWEVER, a VPN is not a magic tool for everything. In addition, [https://freedom.press/training/choosing-a-vpn/ be very careful] when selecting a VPN, because not all VPN providers have good intentions. TCU can provide you with a free code, please let your Community Lead know.

	===Step Two: Selecting Secure Locations and Venues===		== Step Two: Selecting Secure Locations and Venues ==
	Your venue choice will be influenced by who you are inviting, their various threat levels, and the political context of the location you are organizing within. It is important to center the most vulnerable participants invited.		Your venue choice will be influenced by who you are inviting, their various threat levels, and the political context of the location you are organizing within. It is important to center the most vulnerable participants invited.

Rima: /* Digital Safety Resources */

2023-04-03T15:24:20Z

Digital Safety Resources

← Older revision		Revision as of 15:24, 3 April 2023
Line 228:		Line 228:
	* [https://www.digitaldefenders.org/incident-emergency-fund/ Digital Defenders Partnership - Incident Emergency Fund]		* [https://www.digitaldefenders.org/incident-emergency-fund/ Digital Defenders Partnership - Incident Emergency Fund]
	* [https://www.csolifeline.org/ Lifeline Embattled CSO Assistance Fund]		* [https://www.csolifeline.org/ Lifeline Embattled CSO Assistance Fund]
	* [https://www.theengineroom.org/how-can-your-organisation-get-intensive-support-from-the-engine-room/ How can your organisation get intensive support from The Engine Room]For more safety resources, please go to our [[Network Resources#Digital safety resources: guides, online courses, helplines, grants\|Network Resources]] page.		* [https://www.theengineroom.org/how-can-your-organisation-get-intensive-support-from-the-engine-room/ How can your organisation get intensive support from The Engine Room]
			For more safety resources, please go to our [[Network Resources#Digital safety resources: guides, online courses, helplines, grants\|Network Resources]] page.

Rima: /* Digital Safety Resources */ added network resources link

2023-04-03T15:23:49Z

Digital Safety Resources: added network resources link

← Older revision		Revision as of 15:23, 3 April 2023
Line 228:		Line 228:
	* [https://www.digitaldefenders.org/incident-emergency-fund/ Digital Defenders Partnership - Incident Emergency Fund]		* [https://www.digitaldefenders.org/incident-emergency-fund/ Digital Defenders Partnership - Incident Emergency Fund]
	* [https://www.csolifeline.org/ Lifeline Embattled CSO Assistance Fund]		* [https://www.csolifeline.org/ Lifeline Embattled CSO Assistance Fund]
	* [https://www.theengineroom.org/how-can-your-organisation-get-intensive-support-from-the-engine-room/ How can your organisation get intensive support from The Engine Room]		* [https://www.theengineroom.org/how-can-your-organisation-get-intensive-support-from-the-engine-room/ How can your organisation get intensive support from The Engine Room]For more safety resources, please go to our [[Network Resources#Digital safety resources: guides, online courses, helplines, grants\|Network Resources]] page.

Sandy: /* Step Zero: Threat Modeling= */

2023-04-03T14:39:37Z

Step Zero: Threat Modeling=

← Older revision		Revision as of 14:39, 3 April 2023
Line 13:		Line 13:
	Protecting your people is done by assessing potential threats within your context and community, and following baseline security protocols for your gathering. In addition, usually, the best course of action is to look at the safety and security needs of the most vulnerable in your group. This is because when you cater to the needs of the most vulnerable, everyone’s needs are covered by default. We also suggest you assume and plan thoughtfully for the worst-case scenarios. This means thinking through different scenarios, so if something does happen, you are prepared to react.		Protecting your people is done by assessing potential threats within your context and community, and following baseline security protocols for your gathering. In addition, usually, the best course of action is to look at the safety and security needs of the most vulnerable in your group. This is because when you cater to the needs of the most vulnerable, everyone’s needs are covered by default. We also suggest you assume and plan thoughtfully for the worst-case scenarios. This means thinking through different scenarios, so if something does happen, you are prepared to react.

	==Step Zero: Threat Modeling===		==Step Zero: Threat Modeling==
	The first step is to create a contextualized threat model based on the people who will be involved, and the particular context of your city/country. This allows you to gather all pertinent information related to your participant’s potential vulnerabilities and risks, and allow you to think through how to mitigate them. Again, starting with the most vulnerable of your group helps tremendously with this, as they probably face a wider set of risks than any other individual in your group. We also encourage you to do this exercise with people you trust, given that collective wisdom helps tremendously here. In addition, inviting a security expert from your community to help with this step, will be greatly helpful.		The first step is to create a contextualized threat model based on the people who will be involved, and the particular context of your city/country. This allows you to gather all pertinent information related to your participant’s potential vulnerabilities and risks, and allow you to think through how to mitigate them. Again, starting with the most vulnerable of your group helps tremendously with this, as they probably face a wider set of risks than any other individual in your group. We also encourage you to do this exercise with people you trust, given that collective wisdom helps tremendously here. In addition, inviting a security expert from your community to help with this step, will be greatly helpful.

Line 26:		Line 26:
	* If and how you will grow the community you are cultivating.		* If and how you will grow the community you are cultivating.

	==Step One: Secure Communications===		==Step One: Secure Communications==
	Putting together Coffee & Circumvention monthly events requires multiple points of communication and contact with attendees and other organizers - at the end of the day, community organizing involves a lot of coordination. Here are steps to help you with establishing secure communication channels.		Putting together Coffee & Circumvention monthly events requires multiple points of communication and contact with attendees and other organizers - at the end of the day, community organizing involves a lot of coordination. Here are steps to help you with establishing secure communication channels.

Sandy at 14:38, 3 April 2023

2023-04-03T14:38:58Z

← Older revision		Revision as of 14:38, 3 April 2023
Line 200:		Line 200:


	=== Digital Safety Resources ===		== Digital Safety Resources ==

	======Personal Security: Guides and Trainings======		======Personal Security: Guides and Trainings======

Sandy at 14:38, 3 April 2023

2023-04-03T14:38:13Z

← Older revision		Revision as of 14:38, 3 April 2023
Line 192:		Line 192:
	** How will you ensure a similar incident does not happen again?		** How will you ensure a similar incident does not happen again?

	'''Resources:''' [https://tech-care.cc/03-incident-handling-~~proces~~ here]		'''Resources:''' [https://tech-care.cc/03-incident-handling-procesa here]

	Finally, Learn from local organizers, how do they safely create formal and informal gatherings within your context?		Finally, Learn from local organizers, how do they safely create formal and informal gatherings within your context?