security culture

Article

25 May

Security culture refers to shared practices activists use to disrupt state surveillance and interference in our organisations. Basic security culture aims to avoid authorities accessing incriminating information, and can extend to masking organisational structure, identities of participants and plans for future actions.

Effective security culture prevents activists from being arrested or charged with crimes, and helps actions proceed without forewarning the police.

how do the police gather intelligence?

The following is not an exhaustive list, but covers key threats that security culture aims to disrupt.

Undercover police - These officers adopt a cover identity and infiltrate activist groups. While undercover, they will have limited contact with other police and will not wear any clothing or equipment that identifies them as a police officer. Undercover police gather information and may act as an “agent provocateur” encouraging others to break the law. Undercover police are expensive and thus rare.
Informants - These are civilians who provide information to the police. While some informants are paid or acting for ideological reasons, many are coerced into spying in exchange for dropping charges or reducing prison time (1). Police may threaten to expose private information to blackmail informants, for example Israeli police threatening to “out” queer Palestinians (2). Informants are far more common than undercover police.
Corporate agents - Corporations hire informants to infiltrate activist groups that threaten their profits (3). For example, this may occur with the fossil fuel, logging, animal agriculture and arms industries. Corporate agents may pass information on to police and attempt to sabotage activist campaigns. In Australia, former military and intelligence officers have been employed as corporate agents (4).
Interviews and conversations - Typically interviews take place at the police station after an arrest, but they may be voluntary. Police don’t just rely on formal interviews, but will use any conversation with activists to gather intelligence.
Searches - Depending on your jurisdiction police may be able to search your person, home or vehicle with or without a warrant.
Social media - Police monitor event attendance and public posts. Police and informants attempt to join closed groups, email lists and Zoom meetings (5).
Traditional surveillance - Police film protests, may “tail” activists and bug homes and vehicles. Surveillance of individual activists is resource-intensive and rare.
Digital surveillance - Beyond social media, police spy on activists through requests to internet service providers and other companies, mobile phone “pings” and app location data, malware, false phone towers (international Mobile Subscriber Identity catchers/Stingrays) (6) and phishing. Read our flyer on countering digital surveillance here.

examples of security practices

Sensitive information should be discussed on a “need-to-know” basis. Most security practices stem from this basic rule.
Don’t talk to police. If police ask you questions, ask if you’re free to leave. If you cannot leave, ask for your lawyer.
Don’t discuss plans in public - online or in “real life”
Don’t film potentially illegal actions. If you do film a protest, seek permission of everyone you have filmed before publishing the footage.
Wear masks, costumes or uniforms to actions to make individuals harder to identify
Have an agreed-upon process for vetting new people before they are added to group chats or meetings
Use codewords when discussing sensitive information - police might be less interested in your picket if you call it a “party”
Having specific roles for individuals during actions helps reduce the number of people who “need to know” information, reducing risk. For example, activists blocking a coal train may designate a driver, spotter, police liaison, media spokesperson and the people actually blocking the train. Each of these people only needs to know certain information to fulfill their role, preventing them from accidentally incriminating others.
Avoid lying to friends and family but beware that they can become informants, even inadvertently. Set boundaries with others in your life who aren’t involved in activism eg. tell them ahead of time that you might be involved in sensitive activities that you cannot discuss.
An extreme version of “need-to-know” security, clandestine cells can be set up where members of a particular cell have severely limited knowledge of other cells and the broader organisation. If one cell is compromised, other cells may be unaffected.

culture is collective

Security culture is a collective practice, not individual. Your organisation is only as secure as its weakest link - so all members must follow security culture practices. To ensure that people stick to this, try to reach a collective consensus on the level of security culture suitable for your organisation.

downsides

Most security culture practices have downsides, making communication and organising more challenging.

For example:

While filming actions can incriminate activists, it can also publicise your cause and record police brutality. Consider the recordings of police brutality during the Black Lives Matter protests, or inciting incidents themselves which were filmed like the murders of George Floyd and Eric Garner, or the beating of Rodney King.
Organising actions on social media can provide intelligence to the police, but it is also an effective way to reach a mass audience and build attendance at actions.
Wearing masks to protests can hide your identity, but may lead police to target you.
Vetting new members slows down the growth of your organisation

You should decide collectively what level of security culture is appropriate for your organisation. A small, clandestine group involved in direct action will benefit from a higher level of security culture. A large, membership-based non-government organisation involved in charity or policy work will need basic security to prevent data leaks, but otherwise may not benefit from tight security culture.

Paranoia about informants and undercover officers can be more harmful to your organisation than the presence of police themselves. Suspicion, accusations and interrogations can create a hostile culture that drives members away. Effective security culture aims to make your organisation less vulnerable to surveillance, avoiding the need for witch-hunts.