Staying Safe and Resilient When Organizing

A short, practical guide for anyone starting or running a local group. No technical background needed. Most of it takes an evening to set up and a few minutes a month to keep up.

Why this matters

Most local groups — a food share, a repair circle, a reading group, a neighbourhood assembly — never face serious hostility. But groups that grow and become visible will reliably meet some friction: a hacked account, an online pile-on, a platform that suddenly removes a page, or a rumour that spreads faster than the truth. A little preparation means those moments become inconveniences rather than crises.

This guide is for lawful, peaceful work. Nonviolence is not a tactic here; it is absolute (see our principles). Nothing below is about hiding wrongdoing. It is about protecting people’s privacy, keeping a group working when something goes wrong, and making sure no one carries the risk alone.

1. Know your risks

Security experts call this threat modeling: thinking clearly about what could realistically go wrong, instead of worrying about everything. Sit down as a group and answer four questions:

1. What are we protecting? Usually: members’ names and addresses, our contact lists, our accounts, and our ability to keep meeting.
2. From whom? Be specific. A troll? A scammer? A hostile local figure? In some countries, authorities who restrict civic groups?
3. How likely is it? Be honest. For most groups, account takeovers and online harassment are far more likely than anything dramatic.
4. How bad would it be, and what can we do about it? Put your effort where likelihood and consequences are both high.

The Electronic Frontier Foundation’s guide Your Security Plan walks through this in more detail. Revisit your answers once a year, or whenever the group grows or the situation changes.

2. Collect less, protect what you keep

Information you never collect cannot leak. Before you add a field to a sign-up form, ask whether you truly need it.

• Ask only for what you use. A first name and one way to reach someone is often enough. Home addresses, workplaces and ID numbers rarely are.
• No public member lists without consent. Never publish who belongs to the group, or post photos that identify people, unless each person has clearly agreed. Offer quiet ways to take part for those who prefer not to be visible.
• Decide who holds the contact list. Two or three trusted people, not everyone. Agree where it lives, and delete entries when people leave.
• Clean up regularly. Old spreadsheets, forgotten shared folders and former members still in group chats are among the most common sources of leaks.

3. Communicate in more than one way

Any single channel can fail: an app goes down, a platform removes your page, a phone is lost, or the internet is cut. In 2024 Access Now and the #KeepItOn coalition documented 296 internet shutdowns in 54 countries, 74 of them in response to protests. Groups that keep working through disruptions are the ones with more than one way to reach each other — a pattern documented across many historical movements in our research on coordinated action.

Online

• Use an end-to-end encrypted messenger such as Signal for organizer conversations. End-to-end encryption means only the sender and the recipients can read a message — not the app company, not anyone in between.
• Turn on disappearing messages for routine chats, so old conversations do not pile up on everyone’s phones.
• Keep a backup channel, such as an email list, in case your main app or platform becomes unavailable.

EFF’s Communicating With Others explains the options and their limits in plain language.

Offline

• A phone tree: each person has two or three others to call or visit with news. It works without the internet and spreads quickly.
• Regular in-person meetings at a known time and place. If everything else fails, people know where to find each other.
• A printed contact sheet, kept by one or two coordinators in a safe place — not left in a shared space.
• A simple plan, agreed in advance: “If our chat is down for a day, we meet at the usual place at the usual time.”

4. Accounts and devices

Most real-world problems start with a stolen password, not a sophisticated attack. These basics close most of the gap:

• A strong, different password for every account. A password manager is an app that creates and remembers them for you, so you only need one strong master password. Several reputable ones have no-cost versions; see EFF’s Creating Strong Passwords.
• Turn on two-factor login (also called two-factor authentication): a second step, such as a code from an app, needed in addition to your password. A stolen password alone then is not enough. See EFF’s How to: Enable Two-factor Authentication.
• Install updates promptly on phones and computers. Updates fix security holes that attackers already know about.
• Separate personal and group accounts. Create group accounts with a shared group address, give at least two people access, and never run the group’s page from one person’s personal profile.
• Lock your phone with a PIN or passphrase, and be wary of unexpected links or attachments, even from people you know.

5. Openness as protection

For lawful, nonviolent work, secrecy is rarely your best defence. Openness usually is. A group whose principles are public and whose decisions are made in the open is very hard to provoke, discredit or take over from inside: there is nothing hidden to expose, and anyone who tries to push the group toward violence or wrongdoing stands out immediately. Our research notes that loosely organized movements are more vulnerable to disinformation and narrative hijacking, and that a published nonviolence policy is one of the simplest safeguards.

• Publish your principles in a few sentences: what you do, why, and how.
• State publicly that the group never uses or endorses violence, and will openly disown anyone who does or who urges it, whatever they claim to represent.
• Make decisions openly and keep simple notes, so no one can credibly misrepresent what the group decided.
• Be wary of anyone pushing for illegal or violent action. Say no clearly, record that you said no, and if it continues, ask them to leave.

6. Harassment, trolls and false information

Visible groups sometimes attract coordinated hostility. Automated accounts (bots) have been used to flood and disrupt protest conversations online — a study of a major Mexican protest hashtag found they played a critical role in disrupting it. Zeynep Tufekci’s Twitter and Tear Gas describes how opponents often aim less to silence a movement than to bury it in confusion, harassment and distraction. The goal of a calm response is not to win every argument, but to keep doing your work.

• Document first. Take screenshots that show the date, time, account name and link. Keep them in one place.
• Don’t amplify. Replying to or quoting an attacker usually spreads their message further. Block, mute and report through the platform’s tools.
• One agreed spokesperson. Decide in advance who speaks for the group in public, so there are no contradictory replies made in the heat of the moment.
• Correct false claims once. Publish one calm, factual correction with evidence, then point people to it rather than arguing repeatedly.
• Protect targeted members. If one person is singled out, others can take over their public roles for a while, help them tighten privacy settings and check in with them personally.
• Take credible threats seriously. Where there are threats of violence, or someone’s home address is published, involve trusted legal support and, where it is safe and appropriate in your context, the police.

7. Know your rights

Peaceful assembly and association are recognized human rights. The UN Human Rights Committee’s General Comment No. 37 sets out how governments should respect and facilitate peaceful assembly, including assemblies organized online. For workplace organizing, the International Labour Organization’s principles concerning the right to strike summarize international standards on freedom of association.

But laws and how they are enforced differ greatly from country to country, and this page is not legal advice. Before planning any public action, find out the local rules on gatherings, permits and data protection, and identify a legal-support organization near you — a legal aid clinic, a civil liberties group, a law school clinic or a lawyers’ association — before you need one.

8. Look after each other

The most common way groups fail is not attack but exhaustion. Shared responsibility is also a safety measure: when no single person holds every password, every contact and every public role, no single person becomes a target or a bottleneck.

• Rotate roles such as facilitator, spokesperson and coordinator, and write down how each one works so others can step in.
• Make sure at least two people can do every essential task, including access to every group account.
• Normalize rest. Stepping back for a while is healthy, not disloyal.
• Check in with one another, especially after a difficult event or a round of harassment.

Front Line Defenders keeps a collection of resources for wellbeing and stress management written for people doing this kind of work.

9. Where to get help

• Access Now Digital Security Helpline. A free-of-charge, 24/7 helpline for civil society groups and activists, with support in ten languages. They can help you improve your security or respond if you are already under attack.
• EFF Surveillance Self-Defense. Plain-language guides, starting with Your Security Plan.
• Front Line Defenders. If you are a human rights defender at risk, they offer a secure contact form for sharing sensitive information.
• Local legal support. The organization you identified under “Know your rights” above.