Communications technology and humanitarian security
A notice on what changed when humanitarian teams began carrying smartphones, satellite messengers and social media accounts into the field, and on the two directions the change ran in.
Communications technology reached humanitarian operations in a short period and was adopted faster than any security policy could be written for it. The notice set out the change in both directions, because the same device that improves an organisation's ability to account for its staff also gives anyone with an interest in those staff a new way to observe them.
What it improved
- Accountability for staff. A team that can be located continuously is a team that does not have to be assumed lost when it misses a scheduled radio call. Tracking changed the meaning of a missed check-in.
- Speed of warning. A threat that used to take days to circulate through a coordination meeting now reaches everyone affected within the hour, and reaches them where they are.
- Access to information. Maps, road conditions, incident reports and local reporting are available in the vehicle rather than in the office.
- Contact with the people served. Complaint mechanisms, feedback and rumour tracking became possible at a scale that paper systems did not reach.
What it exposed
- The device identifies the person and the place. Location data, metadata and the pattern of a person's movement are held by a commercial operator whose obligations run to the state it is licensed in.
- Communications are readable. Unencrypted traffic is intercepted routinely in conflict settings, and an organisation that discusses movements and programme locations over an open channel has effectively published them.
- Social media profiles are an identity. A staff member's public account connects them to the organisation, and their network connects them to colleagues and to the communities they work with.
- Digital presence is target information. Programmes announced online, photographs carrying location data and posts from the field together describe where an organisation works and who is delivering the work.
- Data held on devices. A phone or laptop that is taken or lost carries beneficiary records, staff lists and security assessments, which is why encryption and remote wipe became a minimum standard rather than an optional measure.
What the notice recommended
A policy before a device. An organisation that issues equipment without deciding what may be stored on it, transmitted over it and posted to it has delegated a security decision to whoever is holding the phone. The notice argued for four things in particular: encryption on every device and every channel used for programme information, a clear rule on what may be published about staff and locations, a schedule for removing data that no longer needs to be held, and a briefing for staff that covers behaviour, because the technical controls fail at the point where a person decides what to type.
Practical guidance and research on the security of humanitarian staff, for the organisations that send them.