1 of 1

The Protocol

The Holistic Security Protocol for Human Rights Defenders

The Holistic Security Protocol for Human Rights Defenders (the Defender’s Protocol) helps us advance our physical safety, digital security, and wellbeing and resilience. By following the Protocol, we enhance our individual and collective security, and can reduce the burden of attacks, harassment, and censorship on us and our communities.

The Defender's Protocol was created by Open Briefing and made possible thanks to the support of the National Endowment for Democracy, Ford Foundation, and Oak Foundation.

The Defender’s Protocol is based on Open Briefing’s experiences working with at-risk defenders all over the world; however, there will be important local differences that cannot be reflected in universal guidance, and you should adapt the Protocol to suit your situation, work, and profile.

Safety and security

Seek to better understand and manage the risks that you face:
1. Consider who your allies and adversaries are. Understand the resources and networks that your allies might leverage in your defence. Understand the capabilities and intentions of your adversaries so that you can better judge the threat that they pose.
2. Consider how your work, identity, tactics, and other factors and characteristics increase or decrease your vulnerability or exposure to the threats.
3. Assess the likelihood of an attack or other incident occurring and the impact should it occur, in order to understand the level of risk to you.
4. Take concrete steps to reduce the likelihood and/or impact of each of your risks.
Maintain awareness of what is going on around you and be alert to any changes to the people and things in your environments.
Ask a trusted and capable friend, co-worker or family member to be your safety contact. At times of heightened risk, tell them in advance where you are going, what you are doing, and when you will return. Check in with your safety contact at pre-agreed regular times throughout the day. Agree with them what they will do and who they will contact should they not hear from you.
At high-risk times or locations, travel with friends, family members or co-workers or request international protective accompaniment.
Prepare your family and co-workers so that they are better able to cope should the worst happen:
1. Make a will and ensure that your family knows where your important financial and legal documents are stored.
2. Develop a continuity plan with co-workers so that they can continue working in your absence.
3. Help your family and co-workers draw up plans for them to relocate, seek sanctuary or asylum, or otherwise keep themselves safe from any further reprisals.
If possible, complete holistic security training designed for human rights defenders. Also consider completing advanced first aid training and purchase individual trauma kits for your home, vehicle, and office.
Understand the level of risk to you and your family that you are prepared to accept. Do not be afraid to ask for help or pause your work if the situation becomes riskier than you are comfortable with.

Digital security

Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms.
If it has to be shared, communicate sensitive information with co-workers face-to-face or using communication tools that allow end-to-end encryption and disappearing messages.
Ensure that any computer or mobile device that you use:
1. Cannot be physically accessed by unauthorised persons.
2. Requires a password or passcode to unlock.
3. Is running the latest available versions of the operating system and all installed apps/software.
4. Has full disk encryption enabled, if legal in your country.
5. Has antivirus software and a firewall installed, updated and configured correctly.
6. Is not rooted or jailbroken and does not have any pirated software installed on it.
7. Is shut down and powered off as frequently as possible, rather than just put into sleep or hibernate state.
Ensure that any online service that you use:
1. Requires a complex, unique password to access.
2. Has two-factor authentication (2FA/2SV) enabled, if available.
Use a privacy-focussed VPN if accessing the internet through a public or untrusted network.
Securely delete sensitive information in all its forms and variations as soon as it is no longer needed, and ensure that it is not recoverable.

Wellbeing and resilience

Maintain good sleep hygiene, including establishing a regular nightly routine and a pleasant sleep environment, if possible.
Eat regular meals and maintain a healthy diet.
Regularly walk, exercise or play sport.
Address physical illness or injury, and give yourself time to heal.
Engage daily in self-reflection and contemplative practices.
Do not use drugs or alcohol as a way of coping with stress or trauma.
Maintain relationships with friends, family, co-workers and community members who can support you.
Understand what stressors might trigger changes in your health and wellbeing and learn to recognise the signs and symptoms of stress in yourself.

Disclaimer: To the fullest extent permitted by law, Open Briefing will not be liable for any loss, damage or inconvenience arising as a consequence of any use or misuse of this resource.

The Protocol

The Holistic Security Protocol for Human Rights Defenders

The Defender's Protocol was created by Open Briefing and made possible thanks to the support of the National Endowment for Democracy, Ford Foundation, and Oak Foundation.

Safety and security

Seek to better understand and manage the risks that you face:
1. Consider who your allies and adversaries are. Understand the resources and networks that your allies might leverage in your defence. Understand the capabilities and intentions of your adversaries so that you can better judge the threat that they pose.
2. Consider how your work, identity, tactics, and other factors and characteristics increase or decrease your vulnerability or exposure to the threats.
3. Assess the likelihood of an attack or other incident occurring and the impact should it occur, in order to understand the level of risk to you.
4. Take concrete steps to reduce the likelihood and/or impact of each of your risks.
Maintain awareness of what is going on around you and be alert to any changes to the people and things in your environments.
Ask a trusted and capable friend, co-worker or family member to be your safety contact. At times of heightened risk, tell them in advance where you are going, what you are doing, and when you will return. Check in with your safety contact at pre-agreed regular times throughout the day. Agree with them what they will do and who they will contact should they not hear from you.
At high-risk times or locations, travel with friends, family members or co-workers or request international protective accompaniment.
Prepare your family and co-workers so that they are better able to cope should the worst happen:
1. Make a will and ensure that your family knows where your important financial and legal documents are stored.
2. Develop a continuity plan with co-workers so that they can continue working in your absence.
3. Help your family and co-workers draw up plans for them to relocate, seek sanctuary or asylum, or otherwise keep themselves safe from any further reprisals.
If possible, complete holistic security training designed for human rights defenders. Also consider completing advanced first aid training and purchase individual trauma kits for your home, vehicle, and office.
Understand the level of risk to you and your family that you are prepared to accept. Do not be afraid to ask for help or pause your work if the situation becomes riskier than you are comfortable with.

Safety and security

Digital security

Consider the different types of information that you hold and seek to better understand both their value to your work and the harms to you and others that could result from an attacker accessing them. Put in place additional measures to protect those assets representing the greatest value or potential harms.
If it has to be shared, communicate sensitive information with co-workers face-to-face or using communication tools that allow end-to-end encryption and disappearing messages.
Ensure that any computer or mobile device that you use:
1. Cannot be physically accessed by unauthorised persons.
2. Requires a password or passcode to unlock.
3. Is running the latest available versions of the operating system and all installed apps/software.
4. Has full disk encryption enabled, if legal in your country.
5. Has antivirus software and a firewall installed, updated and configured correctly.
6. Is not rooted or jailbroken and does not have any pirated software installed on it.
7. Is shut down and powered off as frequently as possible, rather than just put into sleep or hibernate state.
Ensure that any online service that you use:
1. Requires a complex, unique password to access.
2. Has two-factor authentication (2FA/2SV) enabled, if available.
Use a privacy-focussed VPN if accessing the internet through a public or untrusted network.
Securely delete sensitive information in all its forms and variations as soon as it is no longer needed, and ensure that it is not recoverable.

Digital security

Wellbeing and resilience

Maintain good sleep hygiene, including establishing a regular nightly routine and a pleasant sleep environment, if possible.
Eat regular meals and maintain a healthy diet.
Regularly walk, exercise or play sport.
Address physical illness or injury, and give yourself time to heal.
Engage daily in self-reflection and contemplative practices.
Do not use drugs or alcohol as a way of coping with stress or trauma.
Maintain relationships with friends, family, co-workers and community members who can support you.
Understand what stressors might trigger changes in your health and wellbeing and learn to recognise the signs and symptoms of stress in yourself.

Wellbeing and resilience

Disclaimer: To the fullest extent permitted by law, Open Briefing will not be liable for any loss, damage or inconvenience arising as a consequence of any use or misuse of this resource.