Shout out to Baron Oldenburg and Eleanor Saitta for feedback on this post!
Information is flying around fast and loose as you try to help people in need. Anyone who has capacity to help has been added to a spreadsheet tracking needs. If you’re in the thick of it, this piece isn’t for you yet. But even in those moments, be careful about who you share sensitive data with – there are big ramifications later if you get it wrong.
But when you can come back and slow down a little bit to think about the longer-term ramifications of data, you should come back and investigate this. Because while getting people the immediate help they need as quickly as possible is more important than keeping their data safe, the long term impacts of a data leak could put people already in harm’s way further in harm’s way. Example: collecting immigration status when determining which shelters will work for which folk could open you up to a subpoena or backdoor that leaks the data.
So far, I don’t know of any data breaches from community-led crisis response, but it’s frankly a second disaster waiting to happen. People offer admin access to EVERYONE involved in order to feel equitable. People are then scared to remove admin access to things because they don’t want to upset anyone. This leaves a very large attack surface for something to go wrong even beyond the flaws of the tool itself. So limit how many administrators you have, and have a regular cadence to check in on who has access as an admin and otherwise. Set up an impersonal rubric to remove access (“hasn’t accessed this data in x days” or “we’ll only have 3 admins, and we talk monthly about who is best in those roles” are two examples).
To limit the impact of a data breach, collecting ONLY necessary data is the best way to design. You don’t need to be collecting demographic data unless you’re running an equitability study later. Example: address and risk level shouldn’t be cross referenced unless absolutely vital.
Do not use one shared login for vital or administrative accounts. Most tools worth their salt will allow you to have multiple accounts log in for the same view, so set people up with individual accounts so the account access can be managed. Any person with a shared login will be able to change it for everyone else.
Retrofitting later is a pain, but is worth the pain. If you’re in a place where you can migrate to a new tool for a longer-term vision, I’d recommend mapping out tool options against group considerations. I do a grid with rows for technical options, and columns for things I care about. Things like longevity of data, alignment of the org with your group’s politics, who the data is visible to, if the data can be sold to external parties, relationship with law enforcement, etc. I then indicate how aligned with my goals each option is, and discuss the resulting grid with the rest of the tech team. Here’s an example grid for picking which messaging platform to use with each other:
If you’re able to turn on multifactor authentication (MFA), that’s another point where you can limit who the admins are. Doing this can slow some things down and be at odds with people being able to take the day off, but it’s another vector along which security can be tightened up as things slow down in the response.
As an individual thing, Google Advanced Protection is worth turning on if you’re using Google tools. If you’ve got a workspace domain that’s being used in the response, all the admins should have it on, even if you’re just using people’s personal ad hoc accounts for most of the response work. We’re generally in favor of keeping data in Workspace even for many sensitive NGOs in complex situations because it keeps it off of individual devices and out of chats/email where it’s hard or impossible to purge, update, or track access. This of course presumes you have good connectivity, but so do most of these tools.
If you do have to have shared accounts for some things, using a password safe that gives you shared vaults can let folks log in without having direct access to the password if they’re willing to install the plugin — mostly for third party logistics or data feeds or whatever, not for the primary collaboration tools.
What else should folks be doing?
I waited. And waited. My flight began to board. I was still on the other side of security. Finally, I went to the airline desk and told them what was going on, and they changed the name on the ticket to match the ID I had on hand. I made my flight. I’m not sure if the airline did a legal thing, so I’m not naming them, but holy shit am I grateful.
