Authored by Sean Brooks, Research Fellow with the Center for Long-Term Cybersecurity (CLTC), this paper “Defending Politically Vulnerable Organizations Online,” provides an overview of cybersecurity threats to civil society organizations targeted for political purposes, and explores the ecosystem of resources available to help these organizations improve their cybersecurity. The report details how media outlets, human rights groups, NGOs, and other politically vulnerable organizations face significant cybersecurity threats—often at the hands of powerful governments—but have limited resources to protect themselves.
To compile this report, Brooks and his colleagues at CLTC undertook an extensive open-source review of more than 100 organizations supporting politically vulnerable organizations, and they conducted more than 30 interviews with activists, threat researchers, and cybersecurity professionals. The report details the wide range of threats that politically vulnerable organizations face—from phishing emails, troll campaigns, and government-sanctioned censorship to sophisticated “zero-day” attacks—and it exposes the significant resource constraints that limit these organizations’ access to expertise and technology.
“Politically vulnerable organizations, and civil society at large, are facing online adversaries who have an increasingly sophisticated toolkit,” the report says. “Part of what makes these threats so insidious is that they can increasingly be carried out by actors with limited purchasing power and low levels of technical sophistication. Without additional resources and methods for building under-resourced organizations’ cybersecurity capacity, governments, hate groups, and private spyware companies will further disrupt the ability of civil society to operate online.”
The report highlights the urgent need for additional technical expertise to help civil society organizations protect themselves online, as most of the organizations currently providing support are based in North America and Europe and provide assistance primarily in the form of analysis and advocacy. The report suggests that new direct assistance models are needed that will, for example, tailor support to match the risks and capabilities of each organization’s context, provide long-term support and partnership, and document and distribute lessons learned to inform the broader ecosystem of politically vulnerable organizations around the world. To address this challenge, the UC Berkeley Center for Long-Term Cybersecurity is developing a new technical assistance model dedicated to supporting civil society organizations’ cybersecurity; more information about this initiative will be available soon.
“Politically vulnerable organizations will likely always have the scales tilted toward their adversaries,” the report concludes. “But if the community of organizations providing cybersecurity support can continue to grow and evolve, they will help advance the online safety and security—and the missions—of journalists, human rights organizations, NGOs, and other members of civil society for generations to come.”
