In October 2019, Ecuador was the epicenter of one of the largest social mobilizations in its recent history. Thousands of people took to the streets to demand social justice, and the entire country experienced a state of unrest that highlighted vulnerabilities not only politically and economically, but also digitally. While social leaders and collectives defended their rights, cyberattacks, disinformation campaigns, and digital surveillance.
For many social organizations, that moment was a wake-up call: Strengthening digital security is not optional, it is an urgent necessity..
In this context, it is necessary to systematize experiences of supporting groups defending human rights and nature in Ecuador. Their message resonates throughout Latin America: countries such as Colombia, Mexico, and Brazil have faced Persecution of social leaders, digital espionage, and coordinated attacks on social mediaThis article is a roadmap for organizations to build digital resilience from their communities.
1. Digital security as a political and organizational strategy
Talk about digital security for social organizations It's about sovereignty and the defense of collective rights. In Latin America, digital threats intersect with political and economic interests. Governments and extractive companies have used technology to monitor social leaders or curb protests.
Security is not just technical: it is organizational and communityAdopting strong digital protocols is just as important as protecting physical spaces. Inspired by Indigenous and community experiences, this guide proposes a collective approach to digital defense: When one person is vulnerable, the entire organization is vulnerable.
2. Main digital threats faced by organizations
Identifying risks is essential before designing defenses. According to research and reports from organizations such as Access Now and R3D Mexico, the main challenges are:
-
External attacks: phishing, malware, and credential theft, common in movements that challenge power.
-
Technological vulnerabilities: outdated software, open Wi-Fi networks and computers without antivirus.
-
Unforeseen incidents: loss or theft of devices, human error and technical failures.
-
Data leaks and exposure: databases with information on community leaders, territories or donors that could fall into the wrong hands.
-
Disinformation and digital harassment campaigns: coordinated attacks to discredit organizations.
Case: In Peru, environmental groups reported phishing attacks after opposing mining projects (Latin American Observatory of Environmental Conflicts, 2022).
3. Basic cybersecurity practices to start today
The cybersecurity It doesn't require being an expert; it's about adopting habits that organizations or social groups commit to strengthening sustainably:
Constant training: Internal workshops on phishing, password management, and safe network use.
Risk analysis: assess vulnerabilities according to context.
Information encryption: use tools like VeraCrypt or LUKS.
Regular backups: external storage and cloud encryption (e.g. Nextcloud).
Secure communications: Signal, Session or GNUPG for emails.
Regular updates: systems and apps always up to date.
4. Recommended tools and technologies
NGOs and groups need solutions tailored to their needs, many of which are free or open source:
Password Management: KeePassXC, Bitwarden.
Encrypted messaging: Signal, Element, Threema.
Secure storage: CryptPad, Proton Drive, Nextcloud.
Malware protection: ClamAV, Malwarebytes.
Multi-factor authentication: applications like Authy or YubiKey hardware.
Vulnerability Scanning: OpenVAS, Lynis.
5. Digital planning and resilience
It is advisable to create a Digital Security Plan based on standards such as ISO/IEC 27000 and includes:
Identify digital assets: databases, emails, audiovisual records.
Classify them by sensitivity: public, internal, confidential.
Protect them: encryption, passwords, differentiated access.
Monitor vulnerabilities: semi-annual audits, penetration tests.
Respond quickly: clear protocols for leaks, loss of equipment or attacks.
During the protests in Chile in 2019, NGOs reviewed their digital plans to protect members from arbitrary detention, demonstrating that Digital security is an integral part of activism.
6. Organizational safety culture
The human factor remains the weakest link; creating a strong cybersecurity culture in organizations and groups requires:
Internal awareness: workshops and periodic campaigns.
Clear protocols: from the use of public networks to incident reporting.
Collective work: support networks between organizations to share alerts and threats.
Protection of activists: digital support for leaders at risk.
Example: In Mexico, R3D trains journalists to detect spyware like Pegasus. In Brazil, Amazonian organizations encrypt deforestation monitoring data in real time.
7. Resources and bibliography for further study
For organizations wishing to go deeper:
Access Now – Digital Security Support Line: free support for activists.
Front Line Defenders – Security in a Box: A comprehensive guide for human rights defenders and collectives.
Tor Project: Browsing with privacy and without online surveillance.
Amnesty International Security Lab: reports on global surveillance.
6 basic questions about cybersecurity for social organizations and human rights groups.
Not necessarily. Many basic cybersecurity practices These can be learned through community workshops, online guides, and internal training. However, if the organization handles highly sensitive information, such as data on human rights defenders or disputed territories, it is advisable to seek specialized advice.
If you or your organization would like to learn more about protecting your members' online presence, please complete this form and we will be in touch shortly.
-
Never open links or attachments from unknown senders.
-
Always confirm the authenticity of the sender through direct contact.
-
Regularly train the team to recognize signs of phishing and keep your antivirus software up to date.
It depends on the service. Platforms like Google Drive and Dropbox are convenient, but they don't always guarantee complete privacy. Recommended alternatives include Nextcloud, CryptPad or Proton Drive, which allow end-to-end encryption and greater control over data.
-
Create support networks between organizations to share alerts and defense strategies.
-
Document threats, harassing messages, or false posts.
-
Don't respond impulsively; prioritize internal communication and strategic coordination.
Enable encryption and secure PIN/password lock.
Set up remote wipe on mobile devices.
Avoid saving unprotected passwords and disable automatic access to sensitive accounts.
-
Create a Digital Security Plan based on international standards such as ISO/IEC 27000.
-
Identify and classify information assets according to their sensitivity.
-
Periodically review vulnerabilities, update protocols, and provide ongoing team training.
Bibliographic resources
Major: Digital defense for social organizations. The free
-
Access Now. (2023). Digital Security Helpline. Recovered from https://www.accessnow.org/help
-
Front Line Defenders. (2020). Tools and Tactics for Digital Security Security in a Box: A Guide for Human Rights Defenders. https://securityinabox.org
-
Electronic Frontier Foundation (EFF). (2022). Surveillance Self-Defense. https://ssd.eff.org
-
Amnesty International. (2019). Digital Security Lab Reports. https://www.amnesty.org/en/latest/research/
-
Network in Defense of Digital Rights (R3D). (2021). Digital Security Guides for Journalists and Activists in Mexico. https://www.r3d.mx
-
ISO/IEC. (2018). ISO/IEC 27000 – Information Security Management Systems.
-
Latin American Observatory of Environmental Conflicts. (2022). Report on cyberthreats to environmental groups in Peru.
-
Google. (2023). Security in Google Workspace for NGOs. https://workspace.google.com/security/
-
Tor Project. (2023). Tor Project: Anonymous Browsing and Privacy. https://www.torproject.org
-
Clauß, S., & Müller, R. (2020). Cybersecurity for Nonprofits: Risks and Practical Guidelines. Springer.
TO LOVE IS TO SHARE
ES_ES 
EN