How to organize safely in the age of surveillance

For all of these methods, from the general public to the paranoid, the same principle applies as in a Signal conversation: information is only as secure as the least secure device accessing it. So, when you think about your threat model whose devices and accounts within your group have access to your most sensitive data, make sure they’re locked down appropriately: This means full disk encryption — here’s a breakdown for Windows and Mac — strong passwords (we recommend a password manager), and multi-factor authentication on all accounts for both cloud and self-hosted services.

TLDR: A growing range of collaboration methods offers a range of options: from insecure but accessible Google Docs, to end-to-end encrypted or self-hosted tools like Proton and CryptPad, to storing and editing files locally and sharing via Signal. Choose what works best for you based on your threat model.

Get to know IRL safely

If you’re in the same area as the people you’re organizing with, does it make sense to skip all this digital sports and just move on? In many cases the answer is a resounding yes, experts told WIRED, but there are caveats here, too. First, you should perform the same threat model assessment for in-person meetings that you did for your digital organization: Is the relationship between you and the people you will meet already public? Or is it a secret that you know each other and work together? Make the same assessment of where you’ll meet and anywhere else you’ll go together, just as you would with where and how sensitive data will be hosted.

If you cannot be seen together or seen coming or leaving a confidential or sensitive location, meeting in person may not provide the benefits of privacy. You can be observed by bystanders, tracked by law enforcement, tracked via cell phone data, surveillance cameras, facial recognition, automatic license plate readers, or any of the countless ways you can be monitored in the physical world.

Just as with your threat model evaluating your data, there are undoubtedly plenty of situations where your affiliation is generic or insensitive already — like meeting people you know from your area, for example, or people you regularly volunteer with through a religious group, labor union, or other non-classified organization. If you can be seen together without revealing anything sensitive, experts confirm that meeting in person is one of the most valuable and safest ways of cooperation.

“Connection that brings people together physically can never be replaced, and I support it,” says Holmes of the Freedom of the Press Foundation. “I would say the best encryption is a loud tape where you’re whispering to someone. But we always have to think about surveillance architecture, which is incredibly prevalent.”

TLDR: Meeting in person eliminates many technical vulnerabilities that could put your organization’s privacy and security at risk. But think about your threat model: If the reality of your meeting is to remain secret, physical surveillance can make in-person meetings just as dangerous as, or even more dangerous than, digital communications.

Evaluate, then act

The truth, says Distribute Aid’s Taylor Fairbank, is that all regulation that conflicts with the interests of the powerful, whether digital or physical, carries the threat of surveillance and its consequences. “Unfortunately, there will always be some risks inherent in helping others,” Fairbank says. “This is the reality we live in, so think about what you’re doing. Build your own threat model. If you’re not willing to accept the risks inherent in doing something, don’t do it.”

But Fairbank also says these considerations shouldn’t stop people from acting. “Look at risks in context, make informed choices, and try to be as safe as possible,” Fairbank says. “But gosh, go out there and help people. Because we need it.”