The Defender’s Protocol

The Holistic Security Protocol for Human Rights Defenders

The Holistic Security Protocol for Human Rights Defenders (the Defender’s Protocol) helps us advance our physical safety, digital security, and well-being and resilience. By following the Protocol, we enhance our individual and collective security, and can reduce the burden of attacks, harassment, and censorship on us and our communities. The Defender's Protocol was created by Open Briefing.

Safety and security

1.1 Seek to better understand and manage the risks that you face

1.1.1 Consider who your allies and adversaries are.

Understand the resources and networks that your allies might leverage in your defense. Understand the capabilities and intentions of your adversaries so that you can better judge the threat that they pose.

It can be useful to identify the individuals, organizations and institutions that are your allies and adversaries. Allies are people that you trust and who stand with you or your cause. They may have networks and other resources, including funding, that can be used to improve your safety and security or be leveraged in your defense should you experience attacks, harassment or censorship. Understanding what these resources are and appealing to each ally’s individual motivations and priorities will help you engage more effectively with them.

In contrast, adversaries may try to undermine or attack you or your organization. They are likely threatened by your activities and stand to lose something if your work is successful. They may be criminal gangs, armed groups, powerful business interests, or government officials and politicians. You can better understand the threat that these adversaries pose by considering what their likely intentions are and the capabilities that they have. For example, a troll on social media may intend to shut you down but have limited ability to actually do so; whereas local security forces may both wish you harm and have the means and impunity needed to realize that intent.

--> Exercise: Identifying Allies and Opponents (by New Tactics in Human Rights)

1.1.2 Consider how your work, identity, tactics, and other factors and characteristics increase or decrease your vulnerability or exposure to the threats.

1.1.3 Assess the likelihood of an attack or other incident occurring and the impact should it occur, in order to understand the level of risk to you.

1.1.4 Take concrete steps to reduce the likelihood and/or impact of each of your risks.

1.2 Maintain awareness of what is going on around you and be alert to any changes to the people and things in your environments.

1.3 Ask a trusted and capable friend, co-worker or family member to be your safety contact.

At times of heightened risk, tell them in advance where you are going, what you are doing, and when you will return. Check in with your safety contact at pre-agreed regular times throughout the day. Agree with them what they will do and who they will contact should they not hear from you.

Resources:

https://the-engine-room.github.io/PACT-kit/

1.4 At high-risk times or locations, travel with friends, family members or co-workers or request international protective accompaniment.

1.5 Prepare your family and co-workers so that they are better able to cope should the worst happen:

1.5.1 Make a will and ensure that your family knows where your important financial and legal documents are stored.

1.5.2 Develop a continuity plan with co-workers so that they can continue working in your absence.

1.5.3 Help your family and co-workers draw up plans for them to relocate, seek sanctuary or asylum, or otherwise keep themselves safe from any further reprisals.

1.6 If possible, complete holistic security training designed for human rights defenders. Also consider completing advanced first aid training and purchase individual trauma kits for your home, vehicle, and office.

1.7 Understand the level of risk to you and your family that you are prepared to accept. Do not be afraid to ask for help or pause your work if the situation becomes riskier than you are comfortable with.

2. Digital security

2.1 Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms.

2.2 If it has to be shared, communicate sensitive information with co-workers face-to-face or using communication tools that allow end-to-end encryption and disappearing messages.

2.3 Ensure that any computer or mobile device that you use:

2.3.1 Cannot be physically accessed by unauthorized persons.

2.3.2 Requires a password or passcode to unlock.

2.3.3 Is running the latest available versions of the operating system and all installed apps/software.

2.3.4 Has full disk encryption enabled, if legal in your country.

2.3.5 Has antivirus software and a firewall installed, updated and configured correctly.

2.3.6 Is not rooted or jailbroken and does not have any pirated software installed on it.

2.3.7 Is shut down and powered off as frequently as possible, rather than just put into sleep or hibernate state.

2.4 Ensure that any online service that you use:

2.4.1 Requires a complex, unique password to access.

2.4.2 Has two-factor authentication (2FA/2SV) enabled, if available.

2.5 Use a privacy-focused VPN if accessing the internet through a public or untrusted network.

2.6 Securely delete sensitive information in all its forms and variations as soon as it is no longer needed, and ensure that it is not recoverable.

3. Well-being and resilience

3.1 Maintain good sleep hygiene, including establishing a regular nightly routine and a pleasant sleep environment, if possible.

3.2 Eat regular meals and maintain a healthy diet.

3.3 Regularly walk, exercise or play sport.

3.4 Address physical illness or injury, and give yourself time to heal.

3.5 Engage daily in self-reflection and contemplative practices.

3.6 Do not use drugs or alcohol as a way of coping with stress or trauma.

3.7 Maintain relationships with friends, family, co-workers and community members who can support you.

3.8 Understand what stressors might trigger changes in your health and wellbeing and learn to recognize the signs and symptoms of stress in yourself.

Safety and security

Guidance notes

It can be useful to identify the individuals, organisations and institutions that are your allies and adversaries. Allies are people that you trust and who stand with you or your cause. They may have networks and other resources, including funding, that can be used to improve your safety and security or be leveraged in your defence should you experience attacks, harassment or censorship. Understanding what these resources areand appealing to each ally’s individual motivations and priorities will help you engage more effectively with them.

In contrast, adversaries may try to undermine or attack you or your organisation. They are likely threatened by your activities and stand to lose something if your work is successful. They may be criminal gangs, armedgroups, powerful business interests, or government officials and politicians. You can better understand the threat that these adversaries pose by considering what their likely intentions are and the capabilities that they have. For example, a troll on social media may intend to shut you down but have limited ability to actually do so; whereas local security forces may both wish you harm and have the means and impunity needed to realise that intent.

Spectrum_of_actors_exercise.docx

719KB

Binary

Spectrum of actors exercise

b. Consider how your work, identity, tactics, and other factors and characteristics increase or decrease your

vulnerability

or exposure to the threats.

In risk terms, ‘vulnerability’ is your exposure to a threat; it has nothing to do with weakness. There may be a threat, but if you are not exposed – or vulnerable – to it, then it does not translate into a risk for you personally. Risk exists where the threats and your vulnerabilities overlap. While most threats are external, factors that increase your vulnerability are generally internal. Some of these will be related to your work: the issues that you campaign on or the tactics that you use, for example. You will generally have a degree of control and choice over these factors. Other factors may be related to your personal identity, and include your sexual orientation, gender identity, age, ethnicity or nationality, for example. While you cannot control these characteristics, it is still important to understand how they may increase or decrease your vulnerability to the threats against you.

Increased_exposure_exercise.docx

718KB

Binary

Increased exposure exercise

c. Assess the

likelihood

of an attack or other incident occurring and the

impact

should it occur, in order to understand the level of

risk

to you.

Not all the threats that you are exposed to will carry the same level of risk. You can explore this by following a systematic process to assess the

likelihood

of each threat occurring and the

impact

should it do so. This will help you better understand which risks you should focus on reducing. This is even more important if you are working with limited resources or few allies.

Start by listing all the specific threats that could potentially harm you and describe how you are exposed to each of them. Adversaries will pose a direct (targeted) threat against you. Other threats that could cause you harm or injury will be indirect. It is important to consider safety, medical and health issues as well as security concerns. You should also consider threats to your digital security and wellbeing alongside physical threats.

Considering your vulnerabilities, give each threat a score from 1-5 (very unlikely to very likely) for how likely it is to occur and a score from 1-5 (negligible to critical) for what the impact on you or your work would be. Multiplying your likelihood and impact scores together for each threat will give you a risk rating from 1 to 25. Those risks rated 1-3 can be considered very low; risks rated 4-6 can be considered low; those rated 8-10 are moderate; risks rated 12-16 are high; and those rated 20 or 25 are very high. This is known as the inherent (or unmitigated) risk.

You should conduct this exercise periodically, in response to new or changing threats or vulnerabilities or following any significant changes in the political, economic, social, or legal environment.

Risk_assessment.xlsx

33KB

Binary

Risk assessment

d. Take concrete steps to reduce the likelihood and/or impact of each of your risks.

Once you better understand the risks that you face, you can begin to think about some targeted measures to reduce those risks. You can do this by systematically reducing the likelihood and/or impact of each threat in turn. You should focus on addressing your vulnerabilities, as some of these will be under your control. It can sometimes be difficult to affect the likelihood of a threat occurring, but you may still be able to limit its impact. Be mindful that making simple changes to your behaviour and working practices will likely be cheaper and more effective than reaching for technical solutions. Combing these measures in a single list will give you a simple risk reduction plan, which you should review regularly.

If you are facing a large number of threats, it may be helpful to decide which ones to focus on first. There are a number of ways you can do this. You can choose to accept a risk, avoid it altogether, transfer or share it with others, or manage it. You might decide that you are willing to accept for now any risks that are moderate or lower, but avoid, transfer or manage all risks that are high or very high, for example. (The point above which you are not prepared to accept risk is known as your risk threshold.) This would allow you to focus your efforts and limited resources on mitigating just the high and very-high risks that you cannot avoid or transfer.

You can also reassess the threats with new likelihood and impact scores in light of the mitigation measures that you are implementing. The revised ratings will represent the residual (or remaining) risk to you. Be mindful that some of these may still sit above your risk threshold and will require further attention to lower therisk to an acceptable level.

Risk_reduction_plan.docx

716KB

Binary

Risk reduction plan

2. Maintain awareness of what is going on around you and be alert to any changes to the people and things in your environments.

Our minds instinctively seek to quickly normalise changes in the world around us. This can be very positive from a wellbeing perspective. But, from a security perspective, it means that we can miss, or even dismiss, changes that may indicate an increased risk to us or our work.

To counter this, be mindful of the people and things around you and look out for what is known in military circles as the ‘absence of the normal, presence of the abnormal’. You are seeking to maintain a state of relaxed alertness. Be mindful of individuals appearing in or disappearing from your daily routine or changes in the behaviour of those around you. This can include changes in the tone or frequency of harassment or anescalation in the attacks against you and co-workers. Likewise, be aware of new objects in your surroundings, such as vehicles or devices, or items in unusual or unexpected places. Maintaining this situational awareness may help you anticipate actions against you and give you time to react appropriately.

If you think changes in your surroundings or in the behaviour of your adversaries may indicate a new threat or an increased risk, you should take preventative actions. These could include, for example, discussing the changes with friends, family and co-workers to try and better understand the situation; changing your travel plans or moving to a safer location; or alerting your support networks that you feel at greater risk and asking them to help you.

3. Ask a trusted and capable friend, co-worker or family member to be your safety contact. At times of heightened risk, tell them in advance where you are going, what you are doing, and when you will return. Check in with your safety contact at pre-agreed regular times throughout the day. Agree with them what they will do and who they will contact should they not hear from you.

Agreeing set times when you will contact a nominated safety contact each day reduces the time between anything happening to you and your support network realising and raising the alarm or mobilising support.

In very high-risk locations or at times of significant risk, these ‘check ins’ could be as frequent as every 30 minutes. In lower-risk locations or times of reduced risk, check ins might be just once a day, in the evening. You and your safety contact need to agree what is realistic and appropriate. It is important that the check-in schedule is pegged to regular times during the day rather than when you are due to arrive or depart certain locations. This avoids any delays in your journeys resulting in missed check ins and unnecessarily worrying your safety contact.

It is essential that you and your safety contact agree the actions that they will take if you do miss a check in. It is sensible to have a phased set of responses that increase in magnitude and severity based on the number of hours since a missed check in. It is helpful for your safety contact to have access to your schedule, so that they can establish your last known location if possible. If your safety contact is an international partner, be mindful of time zone differences and the possibility of any connectivity issues causing a false alarm. International safety contacts should also be able to mobilise your local support network to try and locate you.

Check-in_plan.docx

716KB

Binary

Check-in plan

4. At high-risk times or locations, travel with friends, family members or co-workers or request international protective accompaniment.

Adversaries may be more likely to attack or harass you if they think you are vulnerable or an easy target. One practical way that your local allies can support you is by staying with you during times of heightened risk or travelling with you in high-risk locations. As an adversary’s actions may be blocked by others around you, or at least will not go unnoticed, it might raise the stakes for them enough to deter them in the short term.

Be mindful that co-workers and others staying or travelling with you may be placing themselves at risk. If you face consistent and considerable threats, you may want to instead consider requesting international protective accompaniment from a specialist organisation, such as

. Protective accompaniment is a non-violent but overt strategy for protecting human rights defenders and threatened communities. The volunteer accompaniers personify the international concern for human rights. Adversaries know that any attacks against defenders accompanied by international volunteers will not only be witnessed but will likely result in legal, political, diplomatic or economic repercussions.

Peace Brigades International

5. Prepare your family and co-workers so that they are better able to cope should the worst happen:

a. Make a will and ensure that your family knows where your important financial and legal documents are stored.

If you are detained, kidnapped or harmed, your family or nominated others may need access to your financial and legal documents or to know your wishes in these and other important areas. You should therefore write or update a will or testament and store it together with other relevant documents in a safe place that trusted others can access under agreed circumstances. Consider the relative importance of security, ease of access, and the possibility of accidental or malicious deletion or destruction when deciding whether your safe place should be a physical location, such as a lockable drawer or safe, or an encrypted digital file.

b. Develop a continuity plan with co-workers so that they can continue working in your absence.

If you are unable to work for any reason, it may be difficult for your co-workers and partners to continue activities and operations in your absence. To address this, you should together create a plan that sets out your main responsibilities and identifies who would take over each and the information and resources that they would need in order to do so. You should then share this plan with co-workers and other relevant stakeholders to reduce the possibility of conflict or confusion among them.

Delegated_responsibilty_plan.docx

717KB

Binary

Delegated responsibility plan

c. Help your family and co-workers draw up plans for them to relocate, seek sanctuary or asylum, or otherwise keep themselves safe from any further reprisals.

If you are detained or worse, adversaries may threaten your family and co-workers in your absence. It is important that your security and contingency planning takes this into account. Those close to you may need to go into hiding, seek sanctuary in an embassy or elsewhere, move to another part of the country, or leave the country altogether. It is essential that they make realistic plans for each of these options in advance so that they can take the most-appropriate actions at short notice to ensure their own safety.

Individual_contingency_plan.docx

724KB

Binary

Individual contingency plan

6. If possible, complete holistic security training designed for human rights defenders. Also consider completing advanced first aid training and purchase individual trauma kits for your home, vehicle, and office.

The security training that is appropriate for human rights defenders is very different to the hostile environmental awareness training that is standard in the humanitarian or corporate sectors. Security training of that nature is usually designed for the international staff of organisations with significant resources who may face indirect threats from violent criminals or armed groups. In contrast, human rights defenders and those defending land, environmental and indigenous rights are more likely to be local community members with limited resources and face direct threats from highly-capable adversaries, often with state or corporate backing.

Security training for human rights defenders should focus on building an understanding of personal risk and be mindful of gender and other personal identity factors. Trainers should seek to co-develop the security strategies and tactics with participants and include many of the measures put forward in the guidance here on situational awareness, check-in schedules, accompaniment, and contingency planning, for example. It is important that the training is holistic, and goes beyond physical safety and security and includes digital security and wellbeing and resilience issues.

You may also want to consider advanced first aid training if you face a consistent and considerable threat of physical harm or live and work in areas with limited medical facilities. Appropriate training should include the essential first aid skills, such as basic life support, but focus on more-advanced skills, such as treating catastrophic bleeding and safely moving casualties. It should cover the contents of trauma kits and how to use them correctly. Crucially, it should also include how to treat yourself and how to improvise basic equipment. You should choose a course that is run over several days, and includes scenarios and practical exercises. Once you have completed the training, you should purchase individual trauma kits for your home, vehicle and office if possible.

With both security and first aid training, it is important to complete a refresher course every year and a full course at least once every three years in order to maintain and improve your skills.

7. Understand the level of risk to you and your family that you are prepared to accept. Do not be afraid to ask for help or pause your work if the situation becomes riskier than you are comfortable with.

Each of us has a different level of risk that we are prepared to accept in order to achieve our goals. In risk management, this is referred to as our ‘risk appetite’. Those who defend and promote human and environmental rights often have higher risk appetites than others. But even within the same organisation – or family – there will be different personal risk appetites. For each of us, though, there is a point beyond which the risk – to ourselves or others – simply becomes too great to accept.

When considering your own risk appetite, it is important to consider the impact on your friends, family, and co-workers should you be detained or worse. It may be entirely valid for you to accept extremely high personal risk to further your cause, but it is usually only responsible to do so if you, or your support network, have the capacity to respond effectively should an incident occur.

It is important to understand that your own risk appetite will likely change over time. This may be following a major life event, such as the birth of a child, getting married or the death of a family member. Or it may follow an incident or near miss that affects you or a co-worker. Whatever the reason, it is important to recognise, understand and communicate to others any changes in your risk appetite.

Risk_appetite_exercise.docx

858KB

Binary

Risk appetite exercise The Defender’s Protocol The Holistic Security Protocol for Human Rights Defenders

The Holistic Security Protocol for Human Rights Defenders (the Defender’s Protocol) helps us advance our physical safety, digital security, and wellbeing and resilience. By following the Protocol, we enhance our individual and collective security, and can reduce the burden of attacks, harassment, and censorship on us and our communities. The Defender's Protocol was created by Open Briefing.

1. Safety and security

1.1 Seek to better understand and manage the risks that you face:

1.1.1 Consider who your allies and adversaries are. Understand the resources and networks that your allies might leverage in your defense. Understand the capabilities and intentions of your adversaries so that you can better judge the threat that they pose.

1.1.2 Consider how your work, identity, tactics, and other factors and characteristics increase or decrease your vulnerability or exposure to the threats.

1.1.3 Assess the likelihood of an attack or other incident occurring and the impact should it occur, in order to understand the level of risk to you.

1.1.4 Take concrete steps to reduce the likelihood and/or impact of each of your risks.

1.2 Maintain awareness of what is going on around you and be alert to any changes to the people and things in your environments.

1.3 Ask a trusted and capable friend, co-worker or family member to be your safety contact. At times of heightened risk, tell them in advance where you are going, what you are doing, and when you will return. Check in with your safety contact at pre-agreed regular times throughout the day. Agree with them what they will do and who they will contact should they not hear from you.

1.4 At high-risk times or locations, travel with friends, family members or co-workers or request international protective accompaniment.

1.5 Prepare your family and co-workers so that they are better able to cope should the worst happen:

1.5.1 Make a will and ensure that your family knows where your important financial and legal documents are stored.

1.5.2 Develop a continuity plan with co-workers so that they can continue working in your absence.

1.5.3 Help your family and co-workers draw up plans for them to relocate, seek sanctuary or asylum, or otherwise keep themselves safe from any further reprisals.

1.6 If possible, complete holistic security training designed for human rights defenders. Also consider completing advanced first aid training and purchase individual trauma kits for your home, vehicle, and office.

1.7 Understand the level of risk to you and your family that you are prepared to accept. Do not be afraid to ask for help or pause your work if the situation becomes riskier than you are comfortable with.

2. Digital security

2.1 Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms.

2.2 If it has to be shared, communicate sensitive information with co-workers face-to-face or using communication tools that allow end-to-end encryption and disappearing messages.

2.3 Ensure that any computer or mobile device that you use:

2.3.1 Cannot be physically accessed by unauthorized persons.

2.3.2 Requires a password or passcode to unlock.

2.3.3 Is running the latest available versions of the operating system and all installed apps/software.

2.3.4 Has full disk encryption enabled, if legal in your country.

2.3.5 Has antivirus software and a firewall installed, updated and configured correctly.

2.3.6 Is not rooted or jailbroken and does not have any pirated software installed on it.

2.3.7 Is shut down and powered off as frequently as possible, rather than just put into sleep or hibernate state.

2.4 Ensure that any online service that you use:

2.4.1 Requires a complex, unique password to access.

2.4.2 Has two-factor authentication (2FA/2SV) enabled, if available.

2.5 Use a privacy-focused VPN if accessing the internet through a public or untrusted network.

2.6 Securely delete sensitive information in all its forms and variations as soon as it is no longer needed, and ensure that it is not recoverable.

3. Wellbeing and resilience

3.1 Maintain good sleep hygiene, including establishing a regular nightly routine and a pleasant sleep environment, if possible.

3.2 Eat regular meals and maintain a healthy diet.

3.3 Regularly walk, exercise or play sport.

3.4 Address physical illness or injury, and give yourself time to heal.

3.5 Engage daily in self-reflection and contemplative practices.

3.6 Do not use drugs or alcohol as a way of coping with stress or trauma.

3.7 Maintain relationships with friends, family, co-workers and community members who can support you.

3.8 Understand what stressors might trigger changes in your health and wellbeing and learn to recognize the signs and symptoms of stress in yourself.

EN | English

Safety and security

Guidance notes

1. Seek to better understand and manage the risks that you face:

a. Consider who your

allies

and

adversaries

are. Understand the resources and networks that your allies might leverage in your defence. Understand the

capabilities

and

intentions

of your adversaries so that you can better judge the

threat

that they pose.