Security is not optional in the field
Short answer A two-week trip and a twelve-month posting are not the same security problem. The traveller carries a clean device and returns. The diplomat or expat builds a life in the country. Local contacts, local accounts, local infrastructure. That accumulation is what adversaries find useful. The problem that duration creates In a short deployment,…
Short answer Office security protocols assume office conditions. Stable internet. Organisational devices. Staff who have been through training. Time to verify contacts before responding. Field conditions are none of those things. Connectivity drops. Devices get shared. Networks are unfamiliar and often hostile. Local partners use personal accounts for operational communications because there is no alternative….
Short answer Generic privacy advice is written for generic threats. The threat profile for NGO workers in the field is not generic, and the advice that follows from it is different. The specific risks: access by partner government authorities who are formally cooperative and operationally hostile; surveillance by actors with a direct interest in what…
Short answer A VPN protects your network traffic. It does not protect you from spyware, compromised accounts, or mistakes already made. If your device has spyware, the VPN is irrelevant. The spyware operates above it. If you are logged into accounts that identify you, you are not anonymous. A VPN is one layer of a…
Short answer Pegasus doesn’t require a malicious link or a compromised attachment. It exploits vulnerabilities in apps already installed on your phone — iMessage, WhatsApp, FaceTime — and installs without any action from you. No link, no notification, nothing out of the ordinary. The most dangerous thing about Pegasus is not what it does once…
Short answer The device had no sensitive messages on it. The worker had been careful. The search lasted 40 minutes. What the agents found was not in the messages. It was in everything else. This is a composite account built from documented cases and the experience of digital security trainers working with humanitarian organisations. The…
Short answer Proton VPN is the most audited, most transparent VPN at consumer price. Swiss jurisdiction. Open source. No connection logs, verified under real Swiss court requests. Not the fastest. Not the lightest. The one we would trust if our connection logs could end up in court. We affiliate with Proton. We say that upfront….
Short answer Mullvad is the most anonymous consumer VPN available. No email required. No identity attached at any stage. Cash payment by post accepted. Swedish police visited their servers with a warrant in 2023 and found nothing, because nothing is stored. Mullvad does not run an affiliate programme. We make no money from recommending it….
Short answer Six hours is a conservative estimate. With a Cellebrite UFED and an unlocked device, it is faster. What they extract: message history, deleted files, EXIF metadata from photos, browser history, app databases, cloud account access via active sessions. What limits them: a strong alphanumeric passphrase, USB Restricted Mode enabled, Signal with disappearing messages,…
Short answer A personal threat model answers five questions: What are you protecting? From whom? How likely are they to try? What are the consequences if they succeed? How much friction will you actually sustain? Answer these honestly and your tool choices become obvious. Skip them and you will spend effort in the wrong places….