For more information about security culture, start here.

Security Culture

Because what they don’t know can hurt them.

Security culture is a set of shared practices that minimize risk. Even in an increasingly dangerous time, we can still organize and act—we just have to be prudent.

Share sensitive information on a need-to-know basis. If someone does not need to know something, they should never hear anything about it. Don’t speak about anyone’s participation in high-risk activities. Don’t brag, gossip, or speculate. The more people know something that can put someone at risk, the greater the chance that it will reach the wrong ears. That goes for the identity of a person responsible for an action, the legal status of a member of your community, the location of a private meeting, or a plan for future activity. Sharing such information with people who do not need it puts them in the position of being able to endanger others with a single error.

Identify your goals and the threat models you are concerned about so you can pick the security measures that meet your needs. When making a plan, start by agreeing on the appropriate security practices so everyone is on the same page. At the beginning, err on the side of caution: it’s easier to shift from a higher level of security to a lower level than vice versa.

Trust your gut. Don’t let anyone talk you into doing something you don’t feel good about. If you take a risk and something goes wrong, you’ll feel better knowing that you trusted your intuition and took every reasonable precaution.

Don’t leave a trail. Credit cards, cell phones, and other electronics create a record of your purchases, movements, and contacts. Use Signal for messaging. Lock your phone and computer with a long alphanumeric passcode. Don’t take them to demonstrations, through border crossings, or into other high-risk situations.

Build confidence. Foster a community of people with longstanding friendships and experience acting together. Learn and abide by the security expectations of each person you interact with. If questioned, never give up any information that could endanger anyone else without their explicit consent. Remember, you have the right to remain silent!

In the long run, secrecy alone cannot protect us—real safety will come from so many people taking action that our oppressors cannot go after all of them. But security culture can help us get there.

There is good news—it’s just a secret.