Digital Activism: Do’s and Don’ts to Keep Yourself Safe Online

As the student movement to end the genocide in Gaza has shown, protestors in the U.S. and worldwide face increasing obstacles. Social media and the internet are powerful tools for organizing, with platforms like Instagram and TikTok becoming instrumental in bolstering social movements. However, the threat of online harassment, surveillance, and doxing is ever-present, and can cause significant mental and physical harm, prompting many young activists to reconsider the ways they use and experience social media. 

Canary Mission, for example, targets student and youth activists online, spurring efforts to conceal activists’ identities for safety reasons. Some such efforts, like wearing masks at a protest, are being banned in some states. Given the increased risks that come with organizing, activists in the digital age must know how to keep themselves safe online. In this blog, we offer a primer on what not to share on social media, how to avoid and handle doxing, how to protect your personal information, and how to protect yourself from harm from the social platforms themselves. We also share additional resources you can reference to help ensure that you and those in your movement can safely organize online.

What Not To Share on Social Media

When organizing on social media, there are several things that you should avoid sharing to protect yourself and your community members. Here is what NOT to post:

• Faces and other identifiable features of protestors (both yourself and others!): faces and identifiable features, such as tattoos, make it easier to identify and dox protestors. Protesters risk being targeted by bad private actors, law enforcement, and intelligence agencies. Once someone’s name and personal information is attached to their image, it becomes very difficult to scrub this information and maintain their privacy online. This is why it is incredibly important to gain the consent of other protestors before sharing their image or tagging them in a social media post. Only share a person’s image if you know they have given their permission for their image to be public, with an informed understanding of the risks involved. This includes an understanding that online photos and videos are considered rights-free and may be used by the press or other publishers.
• Time and location of certain actions: if you or your organization are planning an action, such as civil disobedience, that you don’t want either your opposition or the broader public to know about in advance, do not share the time or location in public forums. This can put the action at higher risk of counter-protest, surveillance by law enforcement, or other violent pushback. Instead, consider sharing the time and location with folks you trust only in encrypted channels such as Signal. If you wish to gain press coverage of your event, but again want to protect your location beforehand, select only members of the press that you trust and communicate with them privately and under embargo. Further, once at the action, be sure your live location is turned off on your device. If you wish to share images or content of a collective action, wait until the action is over and you are in a new location. 
• Personal information: don’t post or share the personal information of individuals in your organization or movement, such as full legal name, personal email address, phone number, or mailing address, without permission. If bad-faith actors get access to this information, they could use it to harass these individuals. Instead, try sharing only first names when possible, and only use email addresses, phone numbers, and mailing addresses associated with your organization or business. If your organization does not have a phone number, you can register for one on Google Voice to protect your personal information.
• Video and livestreaming: livestreaming or recording a protest can serve as a valuable tool for documenting human rights violations, capturing identification information of police and surveillance methods, and preventing the spread of misinformation. But, as noted above, sharing identification information of other protestors can bring on the risk of doxing to those individuals and sharing your live location through video can bring on the threat of physical harm. If you do plan on recording or streaming a protest, make sure to take some things into consideration:
  • First, are other protestors ready to be livestreamed? If you start streaming the initial phases of a blockade or sit-in, for instance, you might risk alerting officials about the action before it is at its target capacity, thereby limiting its effectiveness. Recording a video and then posting it later may be a better option. 
  • Second, on a personal level, have you assessed your own risk tolerance? By holding a video camera, you are taking on an extra risk of being targeted by physical violence, and sharing your location with other people can bring harm to those around you. 
  • Third, are you prepared to capture content that will help other protestors later on, if they were to be targeted or arrested? Capturing content such as police badge numbers, street signs, and instances of aggression or brutality, while making an effort to protect the identification information of other protestors, can help build the evidence base for protestors that are arrested or targeted. Livestreaming episodes of violence can help draw immediate attention to a violation, but recording a video and blurring the faces of other protestors before dissemination will add an extra layer of privacy and security for these individuals.

How To Avoid and Handle Doxing

Doxing (or “doxxing”) is “the action or process of collecting and disseminating someone’s personal information in order to shame, embarrass, expose, or intimidate them. This information can come from private sources but is often obtained from public records. The term derives from the phrase ‘dropping dox (documents)’ and describes a tactic that has evolved into a form of online harassment that can escalate into stalking or other criminal conduct.” 

Doxing can be a frightening experience, but there are many ways to avoid getting doxed—and also for handling it if you do experience doxing. The following tips for doxing prevention are taken from Equality Labs’ Anti-Doxing Guide for Activists: 

• Make social media accounts private: if you are affiliated with an organization that has public social media accounts, making your personal accounts private will decrease your risk of harassment on an individual level. You can still share information that is necessary for the public through your organization’s accounts, but this way your personal information is more protected and you are less likely to receive threatening messages and comments directed toward you individually. If your organization does not have such accounts, or if you wish to maintain a professional public profile, consider creating a secondary public account for your professional work and keep your activism tied to your personal account. There is no hard and fast rule here, but in order to protect your personal privacy, do not share your personal email or phone number publicly, as noted above.
• Use strong passwords on all online accounts: a good, strong password should be 18-24 characters and a mix of uppercase and lowercase letters, numbers, and special characters. If you don’t want to come up with passwords yourself or if you struggle to remember passwords, consider using a password manager like Keeper or BitWarden. A password manager can generate and store passwords for all your accounts and protect you from hackers. Think of it this way: if even you don’t know your banking password, there’s no way a bad actor should be able to figure it out either! Adding two-factor authentication (“2FA”) will also provide an additional layer of security.
• Scrub personal information from websites: you can remove some of your information from public websites by utilizing this guide, created by Yael Grauer. Organizations can further protect staff by paying for a scrubbing service like DeleteMe to remove employees’ personal information. While these methods may not be able to get rid of everything, the less information about you that is publicly available, the less likely you are to get doxed. 

I’ve been doxed; now what?

In the case that you have already been doxed, as indicated by a sudden surge of harassing or threatening emails, phone calls, direct messages, or social media comments from people you do not know, there are several next steps you can take. 

• First, immediately report the incident to the social platform, and flag any posts that are sharing your public information. Consider keeping a record of all posts that are doxing you to build a case of evidence if necessary, including by taking screenshots of harmful posts before reporting them to be taken down. This can also help you decide your next steps.
• Second, make your social media accounts private in order to minimize the ways in which you can be reached and change all of your passwords. This should help provide an extra layer of security if the information that was published about you was found through hacking one of your social accounts. 
• Third, scrub as much information as possible about yourself online, using a platform such as DeleteMe mentioned previously. 
• Finally, reach out to a trusted community of support. This can include your organization’s HR and leadership, supportive family and friends, or communities of other activists. Doxing is an emotionally tolling experience, and it is important to take time to process the trauma and decide how you are going to proceed. If you wish to take a step back from being online, you can ask a trusted person to maintain your email and social media accounts while you are away to help mitigate your exposure to continued attacks.

Protecting Personal Information 

It is also vital to protect your personal information while using social media platforms. As individuals often commenting on sensitive and controversial topics, activists can be targeted for the content we put out online. Thus, you should take measures to protect yourself and your personal information online—for your own sake, as well as the safety of your family, friends, and colleagues. 

1. Complete regular software updates, both for your devices and for any apps you use. General software updates help to patch any security errors that might cause your personal information to be shared, so staying on top of these is very important.
2. Enable two factor authentication (2FA). Many social media sites provide the option to add two-factor authentication to your log-in process, providing another check after your password to confirm you are the one logging in. Since passwords aren’t always the most foolproof security measure (though remember: you should already be using a strong password), it is great to add additional layers of security whenever possible. Further, particularly while at protests, be sure to turn off facial and fingerprint recognition for passwords and device unlocking, as police may use these to force you to unlock your phone.
3. Change the default privacy settings on your social media apps. Most social media users will never take additional steps to alter their experience on a platform. Social media companies are aware of this and purposefully leave the security as open as possible to maximize their advertising revenue. Thus, it is on you to go into the settings of your social media and limit what information that company has access to, such as your physical location, your birthday, your friends and their contact information, and more.
4. Consider using a VPN. This is particularly relevant for activists in regions without access to certain social platforms or who are concerned for their safety based on their physical location. A VPN will hide your real location and IP address from websites and apps, including social media. This does not mean that it will prevent those social media sites from continuing to track the rest of your information, but it provides another layer of security. There are many options for VPNs, so when considering which one to choose, make sure to select one with a ‘no-log’ policy, meaning that your VPN provider will not itself log and store your online activity. Not sure where to start? We recommend NordVPN or TunnelBear.
5. Consider using a private search engine to protect your search history. Traditional search engines like Google collect massive amounts of data on its users, such as your IP address and search terms, in order to build unique user profiles and track user locations. Private engines such as DuckDuckGo do not collect such information, meaning you can browse and prepare for your online activism without the fear of being tracked.
6. Consider using encrypted messaging apps instead of directly messaging on a social platform. While convenient, social media accounts are susceptible to hacking, which means your private conversations might become shared. Therefore, it is useful to use an app like Signal for messaging, which focuses on the data security of its users.

You have agency when using social media. Whether restricting the rights of an app to access your photos and videos or changing the cookie settings on websites and apps, it is valuable to pause and confirm that you are only sharing the information you feel comfortable sharing online.

Protecting Yourself and Your Audience 

While outside actors may use social media to cause harm, the social platforms themselves cause additional harm through their intentionally addictive design. 

Social platforms make more money the longer you use their app each day, so they design features that encourage continued use. This includes the notifications we receive at unpredictable times all day, web design that encourages endless scrolling, and the hyper-personalized, easily digestible content on those pages. Each of these features triggers dopamine releases in our brains that make us want to continue to use the platform. And this ‘hacking’ of our minds works: an October 2023 poll from Gallup found that 51% of U.S. teenagers spend at least four hours on social media every day.

While social platforms can serve as great spaces for activism and mobilization, we must also recognize that engaging with them can be harmful to our own personal development. Outside of simply being aware that these platforms are designed without our best interests in mind, there are ways to mitigate the impacts of the dopamine-inducing features on social media. 

• Turn off your notifications. While this might seem counterintuitive, as we want to stay on top of new content and breaking trends, this is one of the best ways to retrain your brain out of addiction by removing one of the primary triggers.
• Put a time limit on particular apps, or use the “focus” feature on your device. Most smartphones will let users set individual time limits for each app on their phone, and setting up these limits can remind us to take breaks from social media if we have been scrolling for a long time.
• Use specific apps only in designated spaces or at designated times. If we see our activism as work, which many of us do, we should treat it as such. Just as we travel to an office and set aside space and time for work, we should set aside space (and boundaries!) for social media activism. This helps remove social media from being a primary force in our lives and reminds us that it is only one tool in our toolbox as activists.

As activists, we must remember to take care of ourselves as we engage in our work. We cannot control the fact that these platforms were designed unethically, but we can control how we utilize them to our best advantage. 

And if you do decide to leave social media to protect yourself from mental hacking or from doxing, there are still many ways to engage in activism. There are plenty of nonprofit organizations leaving social media due to disagreements with those platforms’ ethics and values, including NPR and NTEN, and they are still engaged in incredibly meaningful work. Activism can take many shapes and forms, so remember to prioritize spending your energy in the spaces in which you feel most comfortable and empowered.

Additional Resources:

• Activist Handbook: Digital security for activists
• Electronic Frontier Foundation: How to Identify Visible (and Invisible) Surveillance at Protests 
• Surveillance Self Defense: Attending a Protest
• Surveillance Technology Oversight Project: Protest Surveillance
• Witness: Basic Practices for Capturing, Storing, and Sharing Video
• Wired: Physical Measures to Amp Up your Digital Security