November 14 2024 GM

Advancing Digital Resilience for African CSOs

Glitter Meetups What are Glitter Meetups Notes from Past Glitter Meetups Virtual Events Calendar Join the TCU Mattermost

• Date: Thursday, November 14
• Time: 9am EST / 2pm UTC
• Who: Elizabeth Kolade and Anthony Sule
• Facilitator: Mardiya
• Where: On TCU Mattermost "IF Square" Channel.
  • Don't have an account to the TCU Mattermost? you can request one following the directions here.

Join us on 14 November, to hear from Elizabeth Kolade and Anthony Sule, currently Executive Director and Director of Security and Innovation of Resilience Technologies who will be talking about:

1. How Resilience Technologies is transforming digital resilience for African civil society organisations (CSOs).
2. Their capacity building, innovation and customized solutions that address the unique challenges organizations face in the region.
3. Key highlights on their new product Zeroth Cloud and the RT Spyware Fellowship, two initiatives designed to critically address the challenges of state-sponsored threats and attack, surveillance and threat intelligence in the region

Elizabeth Kolade (Executive Director, RT) – Elizabeth is a multi-disciplinary cybersecurity professional with experience spanning private, government and the non-profit space. She is particularly adept at helping organisations make sound decisions on risk management, policy development and implementation, forestalling cyber attacks, and handling and recovering from cyber incidents.

Anthony Sule (Director of Security and Innovation) – Anthony is a Digital security professional with over 7 years experience in the internet freedom space. He has built and deployed innovative digital security solutions, supporting multi-racial at-risk communities across Africa, the Middle East and Asia.

What is Glitter Meetup?

Glitter Meetup is the weekly town hall of the digital rights and Internet Freedom community at the IF Square on the TCU Mattermost, at 9am EST / 2pm UTC. It is a text-based chat where digital rights defenders can share regional and project updates, expertise, ask questions, and connect with others from all over the world! Do you need an invite? Learn how to get one here.

Notes

Community Updates:

• Inclusive Web Devroom happening in FOSDEM. CFPs are open in case folks are interested to submit talks about security, privacy, accessibility, etc. https://github.com/Inclusive-Web-Devroom/fosdem-2025/blob/main/CFP.md
• We launched Zeroth Cloud today! (http://www.rtafrica.org/zerothcloud). Super excited.

Glitter Meetup with Resilience Technologies:

Can you tell us a bit about Resilience Technology, and the work you do with CSOs in Africa?

• Resilience Technologies is a Nigerian-based company that provides research-driven, innovative digital security solutions to Civil Society Organizations and at-risk communities in sub-Saharan Africa.
• We help organisations build sustainable digital resilience, empowering them to operate securely and confidently in an increasingly digital world with many threats.
• Think of us as your go to for digital security solutions that actually meets your specific needs, not blanket solutions. This way, organizations can focus on their mission without compromising on security, even in the face of limited resources and rising cyber threats.

What type of research have you conducted in the past or are conducting? And how do you use it to build and sustain digital resilience? What do you for the CSOs specifically?

• We recently did a research to understand the state of Digital resilience among CSOs in Africa. We conducted this research because we wanted to identify the specific pain points and needs of organizations and not just what was perceived - The report for this research can be found here - https://rtafrica.org/RT-10-Report/

What were some of the key challenges or pain points you found through the report?

1. Limited personnel resources and capacity was a major challenge. Due to limited resources, many organisations struggle to have personnel responsible for managing digital security related activities within the organisation. This often results in them outsourcing certain operations. While cost-effective, this can pose additional security risks. In some cases, a member of the team takes on this responsibility with no expertise or training. Also, the volunteer-heavy nature of some organisations leads to organisations having temporary personnel with inadequate training which also poses additional security risk. Interestingly from our engagement with these organisations, they recognize the importance of digital security. This is why some of our solutions are tailored to take the responsibility of identifying and responding to digital incidents away from organisations to allow them focus on their primary objectives.
2. Slow Response time- when we engage with organisations - in some cases, this is tied to the fact that organisations have limited personnel.
3. Internet Shutdowns and Connectivity Issues: Internet access is often unreliable, particularly in rural areas, and as we know, internet shutdowns are used as a tool by some governments to control information. These shutdowns disrupt the work of these organisations and limit access to information, which is critical for advocacy and mobilisation. Unfortunately, this also impacts organisations being able to access digital security solutions. There was one instance where we were just at the beginning of an intervention for an organisation and unfortunately, the internet was shut down in the country before any action could be taken and we lost touch with that organisation for weeks. - this was a situation that was beyond our control and that of the organisation. While some of these issues were beyond the control of organizations, there are some adjustments that needed to be made within these organizations.

How does Resilience Technology then use these insights to support the CSOs? What does your capacity support look like? You work on surveillance and spyware related solutions, can you share a bit more on those? Including your insights and what you built to address state-sponsored spyware against digital rights activists.

• Our support includes:
  1. Organization wide assessment
  2. Training - now our training is design in a way that meets the specific needs of different people within organizations. Management level training, training for technical and non-technical staff, work with orgs to develop and implement their digital security policies, and we support orgs to remediate issues identified during assessment.
• The issue of surveillance and spyware is a major one on the continent. We are currently doing four key things:
  1. The first is our spyware fellowship program to help build technical capacity in the region)
  2. The second is a series of collaborations we are working on to strengthen and pool efforts together amongst different security operators. This is important to ensure our efforts are more impactful
  3. The third is our threat investigation work, which is a service we render
  4. And finally, Zeroth Cloud. This is a solution we just launched. It is a threat management solution that helps us to prevent, detect and respond to situation of spyware, surveillance and other threat types

And how exactly does Zeroth Cloud work or do?

• So, first things; when an organisation is targeted by a state actor, every possible asset and infrastructure (like mobile phones, laptops, email systems, etc) and whatever might give them access to critical and sensitive data are all targeted for attack. Zeroth Cloud, in simple terms, is a solution that prevents these attacks from being successful.
• Think about Zeroth Cloud as an army of armed guardsmen constantly patrolling the perimeter of a house that has a treasure inside (the house being the asset like your computer, and the treasure the sensitive data contained within).
• The guardsmen are super intelligent and are fitted with eye gears that help them detect if an approaching entity is a threat or not. The eye gears notify them if the threat is critical, high, medium or low severity, which then informs their action. If the threat level is higher than tolerable, the guardsmen instantly neutralise the threat, take details of the assailant and send it as a report (or threat data) to an operator.
• In a layman example, this is how Zeroth Cloud works. With it, we are able to significantly increase the digital resilience of organisations against known and unknown threats, and almost as important, we can collect a lot of intelligence data that lets us know what entity is behind an attack, what technologies they are using, and so on.

Is there a link to a place on your website where you explain the resilience model?

• The Resilience Model is explained in this report - https://rtafrica.org/RT-10-Report/. We will consider putting up a page that explains it on the website. Also, we'll do something about the search box

So do organizations reach out to you to ask for this support, or after your diagnostics you provide this as an option to them?? Can you also expand a bit more on the spyware fellowship, who gets to be a fellow and what skills do you support them with??

• So, the Spyware fellowship was designed to address the rise of surveillance targeted at CSOs, journalists and human rights defenders in Africa. While the concept of surveillance is not particularly new, the case in Africa is particularly challenging as it was difficult for targets of these activities to detect the presence of surveillance technologies on their devices due to a lack of skilled personnel knowledgeable in the identification and detection of surveillance technologies.
• Through the fellowship, we empower individuals across the continent to investigate, respond to, and mitigate spyware threats. The African centred approach we took was necessary as there were peculiarities in the way spyware operations were carried out in the region.
• Organisations interested in Zeroth Cloud can either pay for it (we begin deployments in January. So they can just join the waiting list here- www.rtafrica.org/zerothcloud)
• We are working to make it free for organisations under attack who cannot afford it. We will pick those organisations from the waiting list as well

Once you collect the data, does it go into a repository of the type of attacks? Folks are doing research on understanding various forms of spyware and surveillance, how do you collaborate with these entities or individuals??

• The architecture of Zeroth Cloud allows us to keep a very good categorization of the threat data collected which we can funnel to useful platforms like Leafcutter for more people in the community to see and make informed decisions with.
• We are partnering with some organisations in and outside the continent to make Zeroth Cloud available to organisations at risk next year.

When does the fellowship reopen?

• Yes, the next cohort will run in 2025. We are yet to announce the next cohort of the fellowship, but interested participants should subscribe to our newsletter to receive updates as soon as applications open - https://rtafrica.org/
• We are seeking to partner with organisations for the next cohort of the fellowship. - mentors, placement organisations for fellows, funding, etc.

Is Zeroth Cloud only for African organizations? or anyone from the global south can also use it? And on the free part, that was my next question, does the org also say whether or not they can afford it?

• No, Zeroth Cloud is a truly global solution. It is one of our goals to make it as accessible as possible to everyone in repressive environments
• And for the cost. It starts at $4k per annum, which we are well aware is a seizable sum for the average civil society
• But Zeroth Cloud is truly unique in the sense that it gradually approaches zero cost
• It's early days and there are engineering bottlenecks to solve for. But once we get over the hump, it becomes very close to free
• But even at the moment, we are working very hard to make it available for free to organisations that need it but can't afford it

Have you already tested Zeroth Cloud and where have you tested it out? in what environment?

• So we have been testing Zeroth Cloud in-house for more than 2 months and we are very happy with where we are at with the solution, which is why launched today
• The results, the impact of it, the data and telemetry it collects are truly astonishing.

Finally how should folks who want to collaborate connect with you?

• Email - [email protected], [email protected], [email protected]
• Instagram, X - @rtafrica_
• LinkedIn - https://www.linkedin.com/company/resilience-technologies/