πŸ¦“beta
An illustration of four people with zebra heads crossing a zebra crossing in the same style and background as the Beatle's Abbey Road album cover except that there is a surveillance drone, Google Maps car and police robodog in the background Zebra Crossing: an easy-to-use digital safety checklist

πŸ¦“ Zebra Crossing: an easy-to-use digital safety checklist

πŸ€” Who this guide is for

πŸ—Ί Where this guide is from

🌱 How to use this guide

πŸ—£ This guide in other languages

β˜•οΈ Support this guide

πŸ•’ Last updated


🧐 Theory & science

🎯 Threat modeling

πŸ”— Weakest link

πŸ”‘ Encryption levels

  1. No encryption: Any third party who intercepts the data can read it as-is.
  2. Regular encryption: Data is encrypted so that third parties cannot read them. But the platform (e.g. Google or Facebook) still has access, and may hand the data over if they are required to do so by the courts.
  3. End-to-end encryption: the data can only be read by the original sender and receiver. This means not even the platform has access. So if the courts call, the service provider can't hand over the messages because they don't have them either.

🧩 Metadata


πŸ’¦ Level 1 recommendations

βœ… Things to do now

Strengthen passwords

Double lock important accounts

Use two-factor authentication (also known as 2FA and two-step verification) to add an extra lock on top of a typed password. Usually this takes the form of a short code that's sent to your phone via a specialized app or SMS.

Email

Encrypt your devices

Other

πŸ’ͺ🏽 Habits to cultivate

Email

Update all the things

Other


πŸ‘ Great job! You've covered the basics.
πŸ‘ Treat yourself to a cup of tea and a stretch.
πŸ‘ Now, ready for the next level?


πŸ’¦πŸ’¦ Level 2 recommendations

βœ… Things to do now

Enhance your privacy

Set up your home wifi router

Other

πŸ’ͺ🏾 Habits to cultivate

Enhance your privacy

Watch what you say in online groups

Don't say anything you'd regret on in a "private" Slack group, Facebook page, WhatsApp group chat or Telegram channel because:

Other


πŸŽ‰ Congratulations! You're now reasonably
πŸŽ‰ secure, which is more than most :)
πŸŽ‰ Take the rest of the day off, and
πŸŽ‰ come back tomorrow for Level 3.


πŸ’¦πŸ’¦πŸ’¦ Level 3 recommendations

βœ… To do

Lock up sensitive files

Upgrade your gear πŸ’°

Revisit old passwords

Use end-to-end encrypted apps


😲 Wow, you completed all three levels!
😲 Well done! Now quickly look below
😲 to see if any apply to you.


πŸ’¦β—οΈ Scenario-based recommendations

πŸ‘©πŸΏβ€πŸ’» Hosting a public event on a video calling platform (e.g. Zoom)


πŸ›« Crossing an international border


😭 Somebody took my phone/computer!


πŸ‘Ύ I think my computer has been hacked?


πŸ† Sexting & non-consensual image sharing


✊🏾 Attending a protest

In case of emergency

Store less share less

Minimize location tracking

Other


πŸ“° I'm a journalist working on a sensitive topic

Below are some basics that all journalists should consider. If you're working on/in a particularly sensitive story/region (e.g. a whisteblower story), you and your team should get an tailored training session from an expert.

Be prepared

Protect your sources

Protect yourself

Protect your data

For more information


πŸ•΅πŸΌβ€β™‚οΈ Online harassment & doxxing

Harassment and doxxing can get very specific and complicated based on the attacker, your position, the overall cultural context, etc. While we have some general suggestions below, we implore you to think about whether your situation has escalated sufficiently and whether it's time to find professional, one-on-one help.

Recruit a trusted friend

Search for public information about yourself (dox yourself)

Ask your trusted friend to:

For more information, see Access Now Digital Security Helpline's Self-Doxing Guide.

Monitor updates & collect receipts

Delete online information about you

Ignore/reply/report/block your harassers

Social media platform tools and features

Facebook has a few features to control your interactions, but ultimately relies on you setting limits on who can see and comment on your posts and profile:

Instagram has a set of nuanced features within its mobile app to filter and fine tune social interactions on its platform:

Twitter works with some pretty handy third-party tools and has a few features of its own:

Notify other parties

Be extra kind to yourself

Bonus tips for journalists and researchers

For more information


πŸ‘€ Remove information about you off of the internet

If you're about to become a public figure or are experiencing harassment, consider some of the suggestions below.

Clean up your social media presences

You might not need to delete your entire account, but consider deleting (or making private) posts that are old and/or reveal too much about where you live, where you go, and who you're with.

Facebook
Whatsapp
Instagram
Twitter
Reddit and other forums
LinkedIn

Delete your social media accounts... temporarily

Many social media companies let you restore your full account after deleting it if you restore after a specific period of time. This can be useful if you want to just hide for a while and wait for an event to pass.

Remove your information from other people's accounts or websites

Removing articles and press about you online

Obscure your personal information


πŸ’” I think my partner is spying on me through my phone (stalkerware)

If you're not sure and things between you and your partner aren't that bad yet:

If you're pretty sure they're spying on you and you're scared:

For more information


πŸ‘€ I don't want to give out my personal information for online dating/networking/organizing

For messaging apps that use phone numbers as the primary identifier/username (e.g. Signal, WhatsApp, Telegram), get a secondary number from:

For sites and services that use email as the primary identifier/username, either get a new email account or get an email alias that forwards to your main account from:

To mask what you've bought from your bank, get a virtual credit card from Privacy (US-only, feature only available for Pro accounts πŸ’°).

Keep in mind:

For true anonymity – create an untraceable online persona under a pseudonymn


🀐 Traveling to a place with weak data protection laws or internet censorship


😣 I need help now, my systems are under attack!

If you work as part of a civil society group, contact:

Or try these regional hotlines:

If you are being harassed online, contact:

Alternately, hotlines that don't focus on digital safety may still be able to help:

If someone else has taken control of your accounts:

If you've been a victim of an online scam, fraud or ransomware:


πŸ’¦β“ Other recommendations

This section is a catch-all for difficult or esoteric practices that do not fall under any of our scenarios above and might not lead to an immediate payoff for the casual user.

Emails

File storage & sharing

Messaging apps

Hosting/running a website

Other


πŸ† Oh my, you made it this far.
πŸ† You are a true champ!


🧠 Other resources

We consulted many sources and drew upon our own experiences in creating this resource. If you're not finding quite what you want here, we recommend checking out these other resources:


πŸ“ License

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.


πŸ‘‹πŸΎ Special thanks

Special thanks to the CryptoHarlem community, to the students at the School of Journalism and Communication at the Chinese University of Hong Kong, and to our GitHub contributors.

View this document on Github