Digital Security
We can't eliminate all risk — and as abolitionists we wouldn't want to pretend we can. These guides take a harm reduction approach: practical, accessible steps to strengthen your digital security muscles over time.
We start by accepting that risks exist. Perfect security isn't the goal — building collective resilience is.
Digital security is collective work. These practices are meant to be adopted together, not just individually.
We all engage from different entry points. Start with what's accessible, and build from there over time.
Baseline Practices
These are baseline practices for staff, volunteers, and members of abolitionist organizations. They cover the four core areas of digital protection.
Keep your devices in your control at all times.
Know where they are and ensure nobody can access them without your permission. Lock your screen whenever you step away.
Use antivirus, anti-malware, and ad-blocking software.
Free options include Malwarebytes (anti-malware) and uBlock Origin (ad-blocking). Security in a Box has a full guide to choosing antivirus software.
Keep all software updated — at least monthly.
Enable automatic updates on all devices. Unpatched software is one of the most common attack vectors.
Use a secure web browser for sensitive work.
Firefox with uBlock Origin is a solid baseline. For higher-risk work, consider Tor Browser (Windows/macOS/Linux/Android) or Onion Browser (iOS).
Never use public Wi-Fi for sensitive work.
If you must work on public Wi-Fi, use a VPN. Free values-aligned options include RiseUp VPN, Algo VPN, and Outline VPN.
Turn on full-disk encryption.
FileVault for Mac · BitLocker for Windows · Encryption settings for Android. This protects your data if a device is seized or stolen.
Clear your browser history monthly.
This removes saved passwords, cookies, and browsing data. Do this on both desktop and mobile browsers.
Never send sensitive information over email.
This includes passwords, financial info, immigration status, gender identity, org strategy, or anything sensitive about another person. Use Signal instead.
Switch to Signal for movement communications.
Signal is end-to-end encrypted. Download it for phone and desktop. Use it with everyone you're in movement with — for both individual and group chats.
Set disappearing messages on Signal.
Set messages to disappear after 1 week for all movement-related contacts and group chats. Also periodically delete your message history — if your device is seized, there won't be a long record.
Always log into email from a private connection.
Never check work email on public Wi-Fi without a VPN. Keep your inbox clean — delete emails with sensitive info or attachments after storing what matters securely.
Protect yourself from phishing.
Be suspicious of any email that pressures you to act quickly or appeals to your emotions. When in doubt, ask a colleague before clicking a link or downloading an attachment.
Consider a more secure email provider.
Options include ProtonMail, Tutanota, and RiseUp. Note: encryption only works end-to-end when both parties use an encrypted system. Follow secure email practices regardless of provider.
Delete old data instead of storing it.
The most secure data is data that doesn't exist. Unless you have a reason to keep a file, delete it. Use secure deletion tools for sensitive files.
Minimize your use of Google Drive for sensitive work.
Google Drive is not secure for sensitive org data. For sensitive documents, use encrypted alternatives. Check in with coalition partners about shared agreements for data storage.
Use encrypted alternatives to Google.
CryptPad — encrypted forms, spreadsheets, documents, and collaboration tools. OnlyOffice — documents, spreadsheets, and presentations. CognitoForms — encrypted forms.
Be thoughtful about what you store on personal devices.
Avoid storing sensitive org data — member info, legal strategy, financial records — on personal phones or laptops where it could be accessed if a device is seized.
Use a password manager.
Free, values-aligned options: BitWarden (open source, highly recommended), KeePassXC (fully local), Strongbox (iOS/macOS). Use it to generate and store strong unique passwords for every account.
Use strong passwords on all devices.
At minimum 12–15 characters, alphanumeric. This means your computer, phone, and any device you use for org work or communication.
Remove biometric login from devices.
Fingerprint and Face ID can be compelled by law enforcement. Remove them from all your devices. Use a strong PIN or password instead. Instructions: Android · iOS · macOS · Windows.
Enable two-factor authentication (2FA).
Turn on 2FA for email, file storage, and any account that holds sensitive information. Use an authenticator app (like Aegis or Raivo) — not SMS, which is unencrypted and can be intercepted.
Never share passwords via email or SMS.
If you must share a password via Signal, enable disappearing messages, add it to your password manager immediately, and delete the message.
Additional Topics
Before attending a protest: remove biometrics, enable full-disk encryption, know your rights around device searches, and consider leaving devices at home for high-risk actions.
Protest Safety Guide by Digital Defense Fund →If you or someone in your organization is targeted by doxing or political harassment, there are resources and steps to take immediately for protection and aftercare.
Doxcare Guide by CrimethInc →Crossing the US border with devices creates specific legal and security risks. Know your rights and how to prepare your devices before traveling.
EFF Digital Privacy at the Border →Trusted Sources
These organizations produce high-quality, movement-oriented digital security resources. We trust them and refer to their work regularly.
Guides on protest safety, social media, data security, and more — created specifically for reproductive justice and social movement orgs.
Comprehensive, step-by-step guides for activists and human rights defenders worldwide. Covers tools, tactics, and threat modeling.
Practical digital security resources and checklists designed for grassroots organizers and movement groups.
Free, confidential digital security support for activists, journalists, and organizations. Covers encrypted email, safer travel, messaging apps, and more.
Nonprofit defending digital rights. Excellent resources on surveillance, privacy law, and how to protect yourself at the US border.
Doxcare guide and other resources on protecting yourself and your community from political harassment and targeted attacks.
Resources
Print these, share them with your team, or use them as a starting point for your own org's security practices.
Baseline practices for staff, team members, and volunteers. Collaboratively created. Revised January 2026.
Download PDFThe threat modeling form we use in organizational security consultations. Download to review before booking a consultation with us.
Download PDFWork With Us
We offer tailored digital security consultations for grassroots organizations — from a single threat modeling session to ongoing monthly support. We'll work with you on what your org actually needs, at a pace that works for your capacity.
Download and review the Security Intake Form above before reaching out — it'll help us make the most of our time together.
Questions? Email connect@alfservices.net or call 510-400-6038