Device and Data Protection: Securing Devices and Files
Activists rely on phones, laptops, tablets, external drives and cloud-connected tools every day. This chapter explains how to secure devices, protect stored data, defend against malware, and reduce the damage if a device is lost, stolen, seized or compromised.
Overview
Devices are often the gateway to everything else: accounts, messages, documents, photos, contacts, backups and recovery codes. If one device is compromised, the damage can spread quickly across accounts, communications and organizational data.
Device protection is not about using complicated tools for the sake of it. It is about making sure that if a phone, laptop or drive is lost, stolen, searched or infected, the damage remains limited and recoverable.
Device security basics
Keeping devices secure starts with a small set of habits. These are basic, but they prevent many common attacks and reduce the impact of theft, loss or seizure.
Keep software updated
Install operating system, browser and app updates promptly. Updates often fix security vulnerabilities that attackers may already know how to exploit.
Use strong device locks
Use at least a 6-digit PIN or, better, an alphanumeric passcode. Avoid simple 4-digit PINs, obvious patterns or unlocked devices.
Enable auto-lock
Set phones and computers to lock after a short period of inactivity. Manually lock your device whenever you step away, even briefly.
Be careful with biometrics
Fingerprint and face unlock are convenient, but in some high-risk situations a memorized passcode may be safer than biometric unlocking.
If you expect a border check, protest arrest or device search, consider disabling Face ID or fingerprint unlock beforehand. A strong passcode gives you more control than a face or finger.
Encryption and backups
Encryption protects stored data when a device or drive is lost, stolen or seized. Backups protect your ability to recover if the device itself is damaged, wiped, infected or taken.
Full-disk encryption
Encrypt laptops, phones and drives so stored files cannot be read without the password.
File encryption
Use encrypted archives or containers for especially sensitive files and folders.
Encrypted backups
Back up important files, but make sure backup drives or cloud backups are also protected.
Secure deletion
Delete old sensitive files properly. Normal deletion may leave recoverable traces.
Full-disk encryption is especially important for laptops, phones, external drives and USB sticks. On Windows, this may mean BitLocker; on macOS, FileVault; on modern phones, storage encryption is usually tied to having a strong screen lock enabled.
Backups should not sit next to the only device they protect. If a laptop and its only backup drive are stolen together, the backup plan was mostly theatre. Keep at least one secure copy separate.
A stolen encrypted laptop is an operational problem. A stolen unencrypted laptop is a security incident.
Malware defense and safer software use
Malware can steal passwords, copy files, log keystrokes, spy on activity or give attackers remote access to a device. It often arrives through links, attachments, unsafe downloads, malicious apps, unknown USB devices or fake update prompts.
The goal is to reduce the number of ways malware can reach your device and limit what it can do if something gets through.
Patch quickly
Keep operating systems, browsers, communication apps and security tools updated.
Install carefully
Use official sources where possible. Avoid unknown APKs, cracked software and random utilities.
Verify attachments
Unexpected documents, ZIP files, PDFs or Office files should be verified before opening.
Avoid unknown devices
Do not plug in unknown USB sticks or use public charging ports without protection.
Disconnect the device from the internet. Do not log into important accounts from it. Use a clean device to change passwords, and seek expert help or wipe and rebuild the device if needed.
QR codes also deserve caution. A QR code can hide a phishing link, fake login page, fraudulent payment page or malicious redirect. If a code appears in a public space or unexpected message, treat it like any suspicious link.
Physical security of devices
Digital protections can fail quickly if someone gets physical access to an unlocked device. Theft, seizure, border checks, office raids, hotel-room tampering and crowded events all require practical preparation.
In high-risk situations, the safest device is the one that does not contain anything you cannot afford to lose. This may mean removing sensitive files, signing out of accounts, using a clean travel device, or carrying only the data needed for a specific task.
Keep devices with you or locked away when unattended.
Power off devices before high-risk checkpoints when appropriate.
Enable remote locate and remote wipe on phones and laptops.
Carry minimal sensitive data when traveling or attending risky events.
Use privacy screens or shield PIN entry in public spaces.
If a device was out of your control, treat it as potentially compromised.
Before crossing borders or entering sensitive environments, review what is stored locally. Remove unnecessary data, confirm backups, consider a clean device, and know the legal and personal risks of refusing access requests.
Device and data protection checklist
Use this checklist to review whether your devices, files and backups are protected against common risks.
All phones, computers and drives use strong passcodes or passwords.
Devices lock quickly when not in use, and I manually lock them when stepping away.
Full-disk encryption is enabled on computers, phones and sensitive external drives.
Important data is backed up securely and backups are encrypted.
I have tested that I can recover files from backups.
Operating systems, apps, browsers and security tools are updated regularly.
I avoid unknown links, suspicious files, random QR codes and untrusted USB devices.
Remote locate and wipe are enabled where available.
Before travel or high-risk events, I reduce the sensitive data stored on my device.
If a device is seized, stolen or out of my control, I treat it as potentially compromised.
Useful tools and references
These tools are practical examples. Choose tools based on your threat model, device type, team capacity and local context.
Test your understanding, then continue to phishing and social engineering
Take the short anonymous quiz for this chapter. Your individual result is not stored on the server. After that, continue with phishing, social engineering and how to avoid being tricked into exposing accounts or devices.
Download the full Digital Security Toolkit
Prefer reading offline or sharing the material with your team? Download the full PDF version of the Digital Security Toolkit.