• Our Work
  • Services
      Digital Security
      Digital Defense Audit
      Digital Defense Retainer
      Security Procedures
      Doxing Audit
      Phishing Simulations
      WordPress Site Audit
      AI & Automation
      Ethical AI Implementation
      Web Portals & Workflow Integrations
      Data Intelligence
      Strategic Data Planning
      Annual Reporting
      Data Analysis
      Data Cleanup
      Relationship Management
      Salesforce On-Site
      Salesforce Overhaul
      Training
      Salesforce On-Site
      Custom Training

      View all our services!

  • Contact

OUR NEWSLETTER

Get the newsletter that helps nonprofits use tech with confidence. Stay supported and up to date—one email at a time.

Every few months, we’ll send you the nonprofit tools, tricks, and news that matter—so you can focus on the good work.

Your privacy matters. We never sell or share your information with third parties. Spam makes baby koalas cry.

Digital Self-Defense: Essential Privacy Steps for Social Justice Work

A woman with long locs stands with her fist raised at a women's rights march, looking ahead with a determined expression, as other demonstrators hold protest signs behind her.

This article explains how activists and at-risk teams can harden their devices and communications to reduce digital surveillance and data exposure. By adjusting privacy settings on smartphones and messaging apps, organizations can minimize location tracking, data harvesting, and unauthorized access. These practical steps create layered defenses that help protect individuals and the communities they serve in an increasingly hostile digital environment.

In a time where digital data can be weaponized in legal proceedings, securing your personal information is a vital step for activists and at-risk individuals.1 If your staff or volunteers may be targeted by the fascists, we recommend adjusting a few key settings in your devices and communication apps to reduce your digital footprint and increase your privacy.2

Locking Down Your iPhone

Your smartphone contains a treasure trove of sensitive data, including location, communications, and search history, which could be vulnerable to subpoena or breach. The iPhone has a lot of settings to bolster your privacy.

  1. Limit App Tracking and Location Sharing.
    Apps often request access to your precise location or track your activity across other websites for advertising. Turn off these features to minimize surveillance risk:
    1. Disable App Tracking: Go to Settings > Privacy & Security > Tracking, and toggle off Allow Apps to Request to Track. This automatically denies all new app tracking requests.
    2. Customize Location Services: In Settings > Privacy & Security > Location Services, review the list of apps.
      1. For apps that don’t need your location, set permission to Never.
      2. For necessary apps (like Maps), choose While Using the App instead of Always.
      3. Also, disable Significant Locations & Routes at the bottom of the System Services menu. Turning off your location can help prevent tracking when traveling to or from a healthcare facility.
  2. Manage Biometrics and Passwords.
    A strong device password is your first line of defense.
    1. Turn off Biometrics in High-Risk Situations: While Face ID and Touch ID are generally secure, they can potentially be used to unlock your device against your will, particularly at places like international borders or protests. Temporarily turn off Face ID or Touch ID in favor of a strong, difficult-to-guess passcode when in vulnerable situations.
    2. Enable Two-Factor Authentication (2FA): Set this up for your Apple ID to require a second device or text message code when signing in to a new device.
    3. Encrypt Your iCloud Backup: Set up Advanced Data Protection in Settings > iCloud. This enables end-to-end encryption for most of your iCloud data, meaning Apple cannot decrypt it, and only you and your trusted devices can access it.
  3. Secure Notifications and Photos.
    Prevent sensitive information from being visible at a glance.
    1. Hide Notification Previews: In Settings > Notifications, change Show Previews to When Unlocked or Never. This prevents sensitive alerts from being read on a locked screen.
    2. Keep Notes Local: By default, Apple Notes syncs to iCloud. To keep sensitive notes only on your device, enable the On My iPhone Account setting in the Notes app settings.

Click here for Apple’s official privacy and security guides.

Locking Down Your Android:

Your Android smartphone is a digital archive of your movements, associations, and private thoughts. Because Android is an open platform, it offers extensive customization for privacy, but it also requires more active management to prevent Google and third-party apps from harvesting your data. Use these steps to harden your device against surveillance and unauthorized access.

  1. Limit App Tracking and Location Sharing.
    Android apps often request “over-privileged” access to your data. Reducing these permissions is essential for minimizing your digital footprint and preventing data brokers from profiling your work.
    1. Delete Your Advertising ID: Unlike iPhones, which ask to track, Android assigns you a unique ID for advertisers. You should delete it entirely to stop most third-party profiling.3  Go to Settings > Security and privacy > Privacy Controls > More privacy settings > Ads and tap Delete advertising ID.
    2. Audit Location Permissions: Go to Settings > Security and privacy > Privacy controls > Permission manager > Location.
      1. For apps that don’t need your location, select Don’t allow.
      2. For essential apps (like Maps), choose Allow only while using the app.
      3. Disable Precise Location: For most apps, toggle off “Use precise location” so the app only sees your general vicinity rather than your exact GPS coordinates.
    3. Reset Unused App Permissions: Android can automatically revoke permissions for apps you haven’t opened in a while. Ensure this is active to prevent “forgotten” apps from spying in the background. Go to Settings > Apps > See all apps, from here you can enable this feature for the apps you want to limit permissions to.
  2. Manage Biometrics and Passwords.
    A strong device password is your first line of defense against physical searches. In the U.S., memorized passwords generally provide stronger legal footing against compelled unlocking than biometrics.4
    1. Use a Strong Passcode: Go to Settings > Security and privacy > Device unlock > Screen lock. Select a PIN or Password (ideally 8 – 12 characters). Avoid simple patterns.
    2. Disable Biometrics in High-Risk Situations: While convenient, fingerprints and face unlocks can be used to unlock your phone against your will at protests or borders. Use only a passcode when in vulnerable situations.
    3. Enable Two-Factor Authentication (2FA): Secure your Google account, the “keys” to your phone, by going to Settings > Google > Manage your Google Account > Security. Enable 2-Step Verification, preferably using an Authenticator app or a physical security key.
  3. Secure Notifications and “Private Space.”
    Prevent sensitive information from being visible at a glance or discovered during a casual inspection.
    1. Obscure Lockscreen Notifications: In Settings > Notifications > Notifications on lock screen, disable Sensitive notifications. This ensures that message contents stay hidden until the phone is unlocked.
    2. Set Up a Private Space: For highly sensitive work, use a “Private Space” (Android 15+). This creates a sandboxed area for apps like Signal or your browser that is isolated from the rest of the phone. Go to Settings > Security and privacy > Private space to set this up with a separate, unique PIN.
    3. Disable 2G Connectivity: To protect against IMSI catchers (Stingrays) that mimic cell towers to intercept data, go to Settings > Network & internet > SIMs > [Your Carrier] and toggle off Allow 2G.5
  4. Manage Your Backups.
    Backups are vital for data recovery, but they can also be a point of vulnerability if you are served with a subpoena.
    1. Check Encryption Status: Go to Settings > System > Backup. While some data is encrypted with your passcode, Google Photos and certain cloud backups are often not end-to-end encrypted.
    2. Local Backups: If your work is extremely high-risk, consider turning off cloud backups entirely and backing up your phone manually to a physical computer using a USB cable and the “File Transfer” setting.

Communicating with Signal

Signal is the recommended best practice for private conversations because it offers end-to-end encryption and stores minimal user data, meaning it has little data to share even if served with a subpoena. But, for those new to encrypted messaging, the most important thing to remember is that it’s not magic.

  1. Conceal Your Phone Number.
    Although you still need a phone number to sign up for Signal, you can control who sees it and who can find you with it.
    1. Create a Signal Username: You can create a unique username to share instead of your phone number, which can be done in Settings > Profile. The username is a non-permanent, non-searchable way to initiate contact without sharing your number. You can also set a new, optional privacy setting to require people to connect via username, meaning they cannot find you even if they have your phone number.
      1. To enable this, go to your Profile Icon > Privacy > Phone Number.
      2. Select the option “Who can find me by my number” and set it to “Nobody”.
    2. Use a Google Voice Number: If you prefer not to use your main mobile number for registration, you can use a Google Voice number instead (in the U.S.). Go to Google Voice in your browser, log in with a Google account, and select a number. You will use your actual number for verification, but then register your Signal account using the new Google Voice number. Keep in mind that you must place a call or receive a text on the Google Voice number every six months to keep it active.
  2. Use Disappearing Messages.
    To ensure your conversation is deleted on both your phone and the recipient’s device, use the “disappearing messages” feature.
    1. Set a Default Timer: Go to Settings > Privacy > Default Timer for New Chats to automatically set messages to disappear in all new conversations. You can choose a custom time or a preset option from 30 seconds to four weeks.
    2. Tweak Individual Chats: You can also adjust or disable disappearing messages for individual chats by tapping the contact’s name within the chat and toggling the feature on or off.
  3. Protect Your Calls.
    1. Hide Calls in Recents (iOS): If you are on an iPhone, within the Signal app go to Settings > Privacy and toggle off Show Calls in Recents. This prevents your Signal call history from syncing to iCloud, which creates an unnecessary record.
    2. Hide Your IP Address: For extra caution, go to Settings > Privacy > Advanced and toggle on Always Relay Calls. This routes your calls through Signal’s servers, hiding your IP address.
  4. Enable Signal PINs.
    A Signal PIN protects your account data, profile information, and contact lists when transferring devices.
    1. You can set a PIN in Privacy > Signal PIN.
  5. Take Photos Securely.
    1. Use the In-App Camera: If you take a photo from within the Signal app (using the camera icon inside a chat), it will not automatically save to your device’s camera roll. This prevents it from being backed up to a cloud photo library. You must manually tap the save icon if you wish to keep the image.

Conclusion

Most security is not about technology but you. It is about the steps you take. To keep yourself and your constituents safe, limit location tracking, turn off fingerprint and facial recognition when you might encounter law enforcement, use apps like Signal, and be extremely careful about what you share and who you share it with. 

Ultimately, security is not about any one thing you do. It is about setting up obstacles — layers of defense. Every action you take is a wall that an attacker (or a fascist) has to break through. The harder you make their job, the better you protect yourself and the people your work supports.

If you liked this article, we think you’ll also like Cybersecurity in the Age of Trump.

1 As the Electronic Frontier Foundation has reported, law enforcement uses tools like Locate X to digitally track people’s locations and activities. This allows agencies to essentially pay to bypass fourth amendment protections against unlawful search and seizure. And while Signal data may be encrypted, that encryption does not matter if the FBI can get everything they need off a person’s phone.

2 Parts of this article draw heavily from two Wired “how to” guides for optimizing iPhone and Signal privacy settings. We recommend reading both for more detailed information.

3 Deleting the AAID makes it significantly harder for data brokers to link your physical movements to your digital identity. Source: Surveillance Self-Defense

4 U.S. courts often distinguish between “something you know” (passcode) and “something you are” (biometric), giving passcodes higher protection under the Fifth Amendment. Source: EFF to Supreme Court: Fifth Amendment Protects People from Being Forced to Enter or Hand Over Cell Phone Passcodes to the Police

5 2G Networks lack mutual authentication, making them vulnerable to fake cell towers used by law enforcement to intercept communications. Source: Street Level Surveillance

Consultant, About David Dunn, Technology Consulting, Nonprofit Consulting

David J. Dunn

David is the founder of Undaunted Consulting. He specializes in data management system optimization and rapid app development for social service, social justice, and environmental justice nonprofits. Click here to learn more about David’s background and expertise!

Book with David