Front Line Defenders: Physical, emotional and digital protection while using home as office in times of COVID-19 Ideas & tips for human rights defenders

Imatge
Àmbits Temàtics

Origi­nal post publis­hed here

Upda­ted: 26 March 2020

digi­tal­pro­tec­tionatfront­li­ne­de­fen­ders [ punto ] org (Let us know of your protec­tion ideas or sugges­ti­ons) based on your expe­ri­ence that may bene­fit other HRDs or HROs at risk, we will deve­lop this guide further.

PDF version of this arti­cle avai­la­ble soon in Arabic, French, English, Russian, Spanish.

A global pande­mic is a new situ­a­tion for all of us. Most of us alre­ady are or soon may be forced to start working remo­tely. Many will use their home as an office. In some places, there is no doubt this crisis will be abused to further repress human rights defen­ders (HRDs) and human rights orga­ni­sa­ti­ons (HROs) like many other crisis situ­a­ti­ons have been used in the past. Physi­cal and emoti­o­nal envi­ron­ments are also very diffe­rent for each of us.

Howe­ver, Front Line Defen­ders has expe­ri­ence advi­sing HRDs working remo­tely and part of its own team has been working remo­tely – and secu­rely – for years. Below is some of our thin­king and lear­ning around the challen­ges of this moda­lity of work. It is hard to put down one size fits all solu­ti­ons, espe­ci­ally for physi­cal and emoti­o­nal protec­tion. This is offe­red as inspi­ra­tion to evalu­ate and improve protec­tion of your parti­cu­lar situ­a­tion. And if you are a HRD or HRO at risk in your country, you may always reach out to Front Line Defen­ders for help – the orga­ni­sa­tion is at work and fully opera­ti­o­nal during this time.

We encou­rage you to commu­ni­cate clearly and promptly with your donors and part­ners regar­ding your parti­cu­lar situ­a­tion. Donors in the human rights space are highly sensi­tive to the diffi­cul­ties this crisis is posing to its part­ners and gran­tees, even as they face a vari­ety of unpre­ce­den­ted challen­ges. We beli­eve it makes situ­a­tion much more mana­ge­a­ble if they know what is possi­ble and impos­si­ble at this moment for you and your orga­ni­sa­tion regar­ding your work or coope­ra­tion with them. They also may be able to help you with your speci­fic needs right now, things like porta­ble equip­ment to work from home or addi­ti­o­nal at-home secu­rity measu­res.

Physi­cal protec­tion

 

Consi­der which place or room is best to be working on sensi­tive issues. Is, for exam­ple, a base­ment a best option? How easy is it to get to your work space from entry doors to your apart­ment or house? Can people see your compu­ter screen or desk/papers from the outside? Do you want/can you avoid house-mates see you working? Or over­hear sensi­tive conver­sa­ti­ons on the phone or over the inter­net. You can try to talk quietly if neigh­bours can over­hear conver­sa­ti­ons, close windows when you talk, or use veiled/coded language.

Try not to leave your work around the house (leaving USBs & docu­ments around). Stay orga­ni­sed and protect sensi­tive infor­ma­tion. Think about getting locks on drawers, or locka­ble cabi­nets etc. Consi­der loca­ting some good hiding places (or some kind of safety box) for your valu­a­ble infor­ma­tion if you need to quickly hide them. Be crea­tive eg. taking out a brick or tile in the floor or wall, in the roof­top, under a floor­bo­ard, taped inside a shower drain, etc.

At the end of each day, put everyt­hing away in a safe space inclu­ding docu­ments, compu­ters and phones. Keep a clean desk policy. Turn off compu­ters, don’t just put them to sleep or leave them on.

Have a system for destroying sensi­tive infor­ma­tion and files. This could be shred­ding it, tearing into small pieces, burning it, etc.

Consi­der using a simple survei­llance system of the space at times when you are not there. This could be simple traps to detect if some­one has ente­red has the house or room, or opened a drawer. Alter­na­ti­vely, there are digi­tal solu­ti­ons such as mobile phone appli­ca­ti­ons such as Haven app which you could use with an old Android phone to moni­tor you work space.

Make sure you have a good ergo­no­mic set up of your work station. Reduce trip­ping hazards. Have first aid kits and suffi­ci­ent medi­ca­ti­ons. Have enough water for 4 days, and some hiber­na­tion kits.

If you share accom­mo­da­tion with others (family, friends, room-mates), have a meeting to make sure everyone is aware of the secu­rity rules you want to apply ( i.e. don’t open the door without first chec­king who it is, don’t touch the laptop, etc.) It is good to have a secu­rity check-in meeting with them every­day to see how situ­a­tion is chan­ging and if they notice anyt­hing new or out of place.

Prepare emer­gency numbers and have them handy such as writ­ten/prin­ted and stuck up on the wall, saved in your phone, and kept in your wallet. Consi­der having a house­hold commu­ni­ca­tion plan in case you need support. This means calling one or two people, and then they them­sel­ves know who to call and what to do to give you support.

Have an evacu­a­tion plan prepa­red, with diffe­rent exits and an outside meeting point. It is recom­men­ded that you prac­tice it. Some­ti­mes simply placing a ladder near a fence can make a big secu­rity impro­ve­ment in your home. Some people also have a pre-packed bag that they keep next to the exits, that contains copies of sensi­tive docu­ments, some cash, phone char­ger, torch/flash­light, medi­ca­tion and other items you would want to have with you.

If you are consi­de­ring having in-person meetings in your home, be aware of the restric­ti­ons in place and comply with health advi­so­ries. Prepare a cover story with your visi­tors, inclu­ding who are they and why are they visi­ting you, in case your neigh­bours or some­body else asks. Also, it can be a good idea for visi­tors not to tell taxis (inclu­ding ride-hailing apps) your exact address, but somew­here close like a well-known place of wors­hip, park, shop, etc. If they come in their own vehi­cle, it is better that they not park out the front of your house – they can park further down the street so they are not imme­di­a­tely connec­ted with you. Make sure you give very clear instruc­ti­ons so visi­tors do not have to ask anybody how to find you.

Always consi­der safety risks like fire in homes. You might be cooking more indo­ors, using more elec­tri­city outlets, smoking indo­ors, chil­dren might be more house­bound, and your neigh­bours will also be home, incre­a­sing the risk of them star­ting a fire. Have a fire plan. Consi­der things like woollen blan­kets as fire blan­kets, smoke detec­tors if possi­ble, manage your elec­tri­city usage and try to use surge protec­tors, reduce fuel load, etc.

Consi­der having a perso­nal alarm with you in the home and when you leave to attract atten­tion if you need, this could be somet­hing like a whistle.

Keep your doors locked, with the key in the lock on the inside of the door - unless some­one on the outside can reach through to open it. In this case, keep the key in a set loca­tion, away from the door (and out of sight) ready in case it is needed in an emer­gency. Consi­der what is a pattern of crimi­nal attacks in your area. Rates of home burgla­ries gene­rally fall when more people are at home, but other crime (against offi­ces or shops) may incre­ase. Protect (or take with you) the valu­a­ble infor­ma­tion from your office before leaving. Consi­der how your adver­sa­ries will try to bene­fit from you working from home and then miti­gate that.

Avoid regu­lar routi­nes espe­ci­ally in leaving and trave­lling around. When leaving your home to go shop­ping, consi­der the risks of leaving your devi­ces in the home vs taking the devi­ces with you. If you leave home, switch off devi­ces and hide them. When leaving, ensure that some­one knows where you are going, how you will get there (the route), what time you are expec­ted to return, how to contact you if there is any reason, etc. You may also use things like live loca­tion sharing, check-in proce­du­res («I’ve arri­ved», «I’m leaving now», «should be there in 20 minu­tes», etc.)

Be discreet and avoid being targe­ted by police or secu­rity forces by viola­ting any legal local rules.

It is easier said than done but try to plan for econo­mic secu­rity or sustai­na­bi­lity, this situ­a­tion could go on for longer than currently envi­sa­ged. If possi­ble discuss this with donors or suppor­ters. Try to iden­tify an emer­gency fund you can esta­blish or have access to – perhaps in coope­ra­tion with others. Connect online with your local commu­ni­ties to see what are possi­ble self-orga­ni­zing stra­te­gies for mutual support.

 

Emoti­o­nal protec­tion

It is impor­tant to recog­nise, indi­vi­du­ally and with people you work with, that this situ­a­tion has a big emoti­o­nal impact. Levels of produc­ti­vity won’t be the same, and each person will have to adapt to the new context at their own pace. Everyone will also feel an impact of redu­ced in-person inter­ac­ti­ons and not having colle­a­gues avai­la­ble to talk to as much as you perhaps used to.

If possi­ble, have some­one to talk to about your current state of being, to share some of your current thoughts and emoti­ons, that person can be anyone from your commu­nity with whom you have mutual trust and a posi­tive connec­tion. Have in mind, that this situ­a­tion can be diffe­rent from casual one and you may have diffe­rent feelings, emoti­ons, and thoughts coming up. Your needs and your reac­ti­ons to casual things can be chan­ged in the current situ­a­tion. Try to create some oppor­tu­ni­ties for your­self to take a step back and pause, when needed. Try to be a little bit more pati­ent and caring to your­self.

If you have work and care­gi­ver respon­si­bi­li­ties, try to orga­nize your day so that you do not over­work in one direc­tion or anot­her. You may want to have some plan in your head on how to deal with the situ­a­tion, yet expect the unex­pec­ted. There may be situ­a­ti­ons, where you will have to shor­ten your working day or respon­si­bi­li­ties, to be able to take care of other respon­si­bi­li­ties. You may have diffi­cult feelings connec­ted with these challen­ges. Try to take some moments of silence to come up to accep­tance and to possi­ble solu­ti­ons. Try to be crea­tive and forgi­ving to your­self, for not mana­ging everyt­hing. Most probably it is not about you, but the over­load of the respon­si­bi­li­ties. Make your­self ready to give up or post­pone some of the work-rela­ted or house­hold respon­si­bi­li­ties.

Make sure you eat healthy (inclu­ding snacks!) at the right time for you, sleep enough hours and at the right time for you, exer­cise daily enough for you. Consi­der that working from home and being cut-off from the world may be for longer than initi­ally expec­ted.

Set a clear time sche­dule of your work day and stick to it as much as you can. Try to avoid mixing work acti­vi­ties with perso­nal acti­vi­ties. Treat work time as if you are in the office. And perso­nal time as you would be away from the office. It will help you set clear boun­da­ries. Shut down your laptop at the time when you finish working, or at least close email programs/accounts, messa­ging programs, etc.

If you can, orga­nise a sepa­rate place at home which will be your work space and do not work all over the house. This will create a func­ti­o­nal place where you feel at work. This will ensure your work does not invade your private space and vice-versa. This may also be a clear signal to others with whom you share your house that when you are siting at «the work place» you are «at work» and you need not to be distrac­ted. Try to never work at places where you rest or eat!

If you are not under a quaran­tine, go outside each day for a walk, run, bike ride, etc. You can do it at any time. But it is best to have a routine, (eg. walk after lunch, run in the morning before you start working, etc.)

At least once an hour stand up, stretch, walk around your place, close your eyes few times.

Consi­der how the level of noise, music, radio going on at your place in the back­ground is helping or causing addi­ti­o­nal stress or tired­ness? Make appro­pri­ate adjust­ments to your needs (which may change daily!)

To manage anxi­ety, reduce expo­sure to COVID19 news by setting a speci­fic time and dura­tion in the day to get infor­ma­tion. Try not read news in the evening when you are prepa­ring your body and mind for sleep. If levels of anxi­ety rise up, consi­der prac­ti­sing and/or helping house­ma­tes to prac­tice stress manage­ment tech­ni­ques - medi­ta­tion, yoga, or praying may help as well.

If there are other people living in the house, make sure to have moments of silenceto recharge or relax, even if the only option is being locked in the toilet.

Many local networks are putting toget­her infor­ma­tion on well-being during the pande­mic, as well as online yoga, dancing, exer­ci­sing sessi­ons and webi­nars to help go through this diffi­cult times. Reach out to them!

Digi­tal protec­tion

Be aware of incre­a­sed attempts to use the current situ­a­tion to trick you (social engi­neer you) into giving access to your accounts, infec­ting your devi­ces, provi­ding pass­words, etc. through sending you fake links, mali­ci­ous docu­ments, phis­hing messa­ges and emails, etc. Be extra vigi­lant.

If the situ­a­tion in your loca­tion requi­res you to stay at home, you might want to use online food deli­very. Be aware that some of them require you to use apps that read your GPS loca­tion. If this is a risk in your situ­a­tion, plan care­fully or see if there are other opti­ons or call food service provi­ders rather than using an app.

Protect your wifi network: consi­der using a name for your wifi network that does not flag that it is your wifi or consi­der hiding the name. Set the wifi network access pass­word so you need to provide the pass­word to connect to it. Make this pass­word strong. Change it from time to time. Change the default admi­nis­tra­tor pass­word of your wifi router and disa­ble logins from outside of your network. You can make all those chan­ges if you log in to your wifi router and search for your router manual online to learn how.

Make sure your devi­ces have basic hygi­ene (both compu­ters and phones): this is espe­ci­ally impor­tant when you start using your private devi­ces for work. It is good that you review the hygi­ene of the device before you start working on it. Consi­der things like:

  • are you running latest opera­ting system version (on all compu­ters and phones you have)
  • remo­ving all unne­e­ded/unused programs (in parti­cu­lar Flash and Java)
  • upda­ting and upgra­ding opera­ting systems, all programs and all apps so only running latest versi­ons
  • proper opera­ting system setup – this will depend on which OS is being used (see links on the bottom with some instruc­ti­ons for speci­fic systems), but this inclu­des among others:
    • full disk encryp­tion (MS Windows: BitLoc­ker or VeraCrypt if you do not have BitLoc­ker, Mac OS: File­Vault, Linux: LUKS, Android: Go to Settings > Secu­rity > Encrypt, iOS devi­ces are encryp­ted once you set pass­word/pin)
    • have a strong pass­words or long PIN for login to the device
    • switch on your opera­ting system fire­wall and review its settings (WindowsMac)
    • use anti­vi­rus protec­tion (Windows: Micro­soft Secu­rity Essen­ti­als, also and for other opera­ting systems consi­der using Malwa­rebytes). You can use Virus­To­tal.com to scan links before opening them.

Use safe and upda­ted brow­sers. Front Line Defen­ders recom­mends Fire­fox (or Chrome or Chro­mium) with proper setup and add-once/exten­si­ons: uBlock OriginHTTPS Everyw­herePrivacy BadgerCookie Auto­De­leteFace­book Container, consi­der using NoScript. All those exten­si­ons are also avai­la­ble for Chrome/Chro­mium on web store.

Use pass­word mana­ger like KeePassXC to keep your pass­words safe offline (if you need to use online pass­word mana­ger consi­der Bitwar­den but make sure you set up 2-factor authen­ti­ca­tion to log in to your collec­tion of pass­words and note that there are new risks intro­du­ced by storing pass­words online).

If you need word proces­sing, spre­ads­he­ets and other office suite programsconsi­der using Libre­Of­fice.

Consi­der if you need to use a VPN or a proxy to protect your work rela­ted Inter­net acti­vity from your home Inter­net Service Provi­der. If you do not want your ISP knowing which servers you commu­ni­cate with, you may buy VPN access or use one of the free opti­ons:

Working from home means that you will be saving work rela­ted (some­ti­mes sensi­tive) infor­ma­tion on your devi­ces. Care­fully make a deci­sion which devi­ces you will be using for storing work infor­ma­tion. Ask ques­ti­ons like:

Should I use mobile phone for work? Do I need a sepa­rate phone?

Do I need a sepa­rate laptop?

Who has access to devi­ces I deci­ded to use for work apart from me?

How can I sepa­rate private and work infor­ma­tion? Shall I create a sepa­rate user account on a compu­ter for work rela­ted acti­vi­ties and sepa­rate for perso­nal acti­vi­ties?

Plan how long you will store the sensi­tive infor­ma­tion on your home devi­ces. How will you remove it secu­rely.

You may want to use secure end-to-end encryp­ted cloud storage to share files with people or maybe backup some infor­ma­tion. You can bene­fit from those recom­men­da­ti­ons:

  • Sync.com (up to 5GB free, end-to-end encryp­ted file cloud)
  • Mega.nz (up to 15GB free, end-to-end encryp­ted file cloud)
  • if you using not end-to-end encryp­ted file cloud consi­der using Cryp­to­ma­tor to inde­pen­dently encrypt files before storing them online
  • share.riseup.net can help you send up to 50MB with end-to-end encryp­tion. It will auto-delete your files after 12 hours.
  • send.fire­fox.com can help you send up to 1GB with end-to-end encryp­tion. It will auto-delete your files after one day or one down­load. You can add pass­word to addi­ti­o­nally protect your infor­ma­tion. It is best to share this pass­word by a sepa­rate means then a link, eg. you send link by email and pass­word by Signal.
  • send.treso­rit.com can help you send up to 5GB with end-to-end encryp­tion. It will auto-delete your infor­ma­tion after 7 days or 10 down­lo­ads.
  • OnionS­hare.org can help you secu­rely and anony­mously share files of any size directly from your compu­ter using Tor Network.

It is impor­tant to regu­larly backup your devi­ces (it is recom­men­ded to do it once a week or after inten­sive work). You can use programs avai­la­ble in your system (like opera­ting system backup option or use Free­Fi­leSync on Windows, Time­Ma­chine on Mac, Déjà Dup on Ubuntu). Front Line Defen­ders recom­mends backing up to local exter­nal disk and hiding this disk. Anot­her option is to use secure end-to-end encryp­ted cloud storage, but this intro­duce new risks. You should also backup your phones, we recom­mend backing up to a local compu­ter rather than cloud servi­ces.

Working remo­tely, you will most likely be in need of co-working on docu­ments and spre­ads­he­ets with other people. You may decide to conse­cu­ti­vely edit docu­ment on local compu­ter and exchange it over secure email or secure text messa­ging chan­nels menti­o­ned below. Or you may want to edit simul­ta­ne­ously with others same docu­ment using simply your brow­ser on servi­ces like:

  • Crypt­Pad - end-to-end encryp­ted service for editing docu­ments and spre­ads­he­ets or orga­ni­sing polls, etc. You can store up to 1GB infor­ma­tion for free. You can regis­ter for free to have your docu­ments store perma­nently (without regis­tra­tion docu­ments are dele­ted after 3 months of inac­ti­vity).
  • Riseup Pads - simple docu­ments co-editing. You can set that your docu­ment will be dele­ted after 1 day, 60 days or 1 year. It is using Ether­Pad soft­ware.

Note that both of above servi­ces allow every­body who knows the link to your docu­ment access and edit it! It is impor­tant to guard the link.

There are also commer­cial solu­ti­ons simi­lar to above like Google Docs or Micro­soft Office 365.

 

Working remo­tely, you will certainly what to secu­rely commu­ni­cate with others. Please note that all regu­lar mobile phone calls and SMS are not secure and your mobile phone company has full access to them. Instead of using those we recom­mend using one of blow end-to-end encryp­ted free opti­ons:

  • Signal: one-on-one text and voice commu­ni­ca­tion and group text commu­ni­ca­tion. We recom­mend swit­ching on: Settings > Privacy > Screen lock, Screen secu­rity, and Regis­tra­tion lock. Also we recom­mend that you set Disap­pe­a­ring Messa­ges for each conver­sa­tion you have.
  • Wire: one-on-one or small groups text and voice commu­ni­ca­tion. You can use email to regis­ter as well as phone number. Just consi­der that it is a company
  • Delta Chat: one-on-one and groups text commu­ni­ca­tion. It is well resis­tant against bloc­king it as it works over email, so regis­tra­tion with exis­ting email address is requi­red.

When you commu­ni­cate in groups,  always check the iden­ti­ties of all people parti­ci­pa­ting by asking them to speak. Do not assume you know who is connec­ted only by reading assig­ned names. Note that none of the opti­ons listed below are end-to-end encryp­ted. The encryp­tion goes to the server and from the server, so the server has access to all commu­ni­ca­tion.

Free opti­ons:

Paid opti­ons – keeping in mind the poli­tics, secu­rity and challen­ges of suppor­ting big US corpo­ra­ti­ons:

 

If you would like to orga­nise a webi­nar or online trai­ning, you can use tools outli­ned above in the group commu­ni­ca­tion. Some of best prac­ti­ces include:

  • make sure that you know who is connec­ted (if this is needed)
  • agree on ground-rules, like keeping came­ras on/off, keeping microp­hone on/off when one does not speak, flag­ging when parti­ci­pants would like to speak, who will be chai­ring the meeting, who will be taking notes – where and how will those notes be writ­ten and then distri­bu­ted, etc.
  • agree on clear agen­das and time sche­du­les. If your webi­nar is longer than one hour, it is probably best to divide it into clear one-hour sessi­ons sepa­ra­ted by some time agreed with parti­ci­pants, so they have time to relax and do other things needed. Do plan for the even­tu­a­lity that not all parti­ci­pants will return after a break. Maybe have alter­na­tive methods to reach back to them to make sure they are coming back, like Signal/Wire/Delta­Chat contacts for them.
  • it is of course easi­est to use a meeting service that parti­ci­pants connect to using a brow­ser without a need to regis­ter or install a special program, one that also gives webi­rar orga­ni­ser ability to mute microp­ho­nes and close came­ras of parti­ci­pants.

     

You will most likely want to keep using your regu­lar email. Do observe normal secu­rity best prac­ti­ces, like having good pass­word, swit­ching 2-factor authen­ti­ca­tion, revi­e­wing settings of your email account inclu­ding are your email not being forwar­ded to other addres­ses, what are devi­ces connec­ting to your email, what is acti­vity on your email account – when account was logged in, etc. – all this depen­ding on avai­la­bi­lity on your email account. Howe­ver, in case you need a new secure email address, FLD recom­mends using:

  • Proton­mail - addi­ti­o­nally set two-factor authen­ti­ca­tion (go to Settings > Secu­rity and enable two-factor authen­ti­ca­tion. You’d need to install appli­ca­tion andOTPDuo Mobile or Authy on your phone to complete this step and scan the code on the compu­ter screen with this app).
  • Tuta­nota - addi­ti­o­nally setup two-factor authen­ti­ca­tion (go to Settings > Login > Second factor authen­ti­ca­tion)

Be aware that only emails between accounts on the same service – Tuta­nota or Proton­mail – are end-to-end encryp­ted. Emails that are sent outside are not (usually).

If you need a shared calen­dar and you do not want to use a big corpo­ra­tion for this, see:

for ques­ti­on­nai­res see:

We would recom­mend to be cauti­ous mana­ging sensi­tive infor­ma­tion with online servi­ces.

 

Health trac­king devi­ces/apps: Some govern­ments have impo­sed requi­re­ments for inco­ming visi­tors to down­load an app and provide one’s mobile phone number so they could track you for public health reasons. These requi­re­ments may last longer than neces­sary. Check with airli­nes, minis­tries of foreign affairs or embas­sies of your desti­na­tion country, IATA and other autho­ri­ta­tive websi­tes before making a deci­sion to travel. If you can, consi­der running those type of app in a Shelter app profile.

Other guides:

Gene­ral digi­tal protec­tion guides: