Digital Security
Resource Hub
for Civil Society

Frequently check the App Privacy Report

The App Privacy Report feature shows apps that are collecting sensitive data. Disable or remove apps that you no longer use. Surveillance companies buy location data from advertising companies to enable targeted surveillance.

Enable Lockdown Mode

Lockdown Mode is an enhanced protection feature introduced by Apple following the 2021 Pegasus Project revelations (Amnesty International’s Security Lab was a technical partner in this investigation). It prevents many forms of advanced attacks and should be enabled on iPhones and Apple devices belonging to at-risk users.

Turn off Location Services and delete Significant Locations

Location Services allows apps and websites to use information from various kinds of networks to determine your approximate or precise location. If you are a high-risk user, you can turn off Location Services in your devices and delete your significant locations.

Activate Stolen Device Protection

Stolen Device Protection adds a layer of security when your iPhone is away from familiar locations, such as home or work, and helps protect your accounts and personal information in case your iPhone is ever stolen by preventing critical operations to be performed.

Disable Install Apps from Unknown Sources

Most Android spyware is deployed by malicious apps installed outside the Play Store. Disabling this feature prevents external apps being installed.

Enable Enhanced Safe Browsing

Google Chrome offers an optional Enhanced Safe Browsing feature to scan links and browser history for phishing, malware and advanced targeted attacks. This sends additional information to Google about your internet browsing activity but can help protect your device from new threats.

Turn on Always use secure connections

Some advanced attacks can be triggered by browsing an unencrypted web page. The risk can be reduced by enabling the Always use secure connections option in Chrome.

Run a Safety Check on your Android device

Google Chrome on Android offers a Safety Check feature to confirm if your browser and accounts are safe from common threats including known compromised passwords, your safe browsing status and if Chrome updates are available.

Enable two-factor authentication (2FA) on online accounts

Enable two-factor authentication (2FA) on all online accounts and services that allow it (see 2fa.directory). It is more secure to use a 2FA app (such as Microsoft Authenticator, Aegis, Authy) or physical security key (e.g. Yubikey) rather than SMS.

Make sure to frequently review your recovery email addresses or phone numbers, as these could also be used maliciously.

Review privacy settings on social media accounts

Social media profiles and networks can be leveraged to conduct malicious activities, such as virtual and physical surveillance, doxing, information gathering, hacking and smearing. Minimise any personal data shared on social media, keep your accounts private if possible, and disable visibility of accounts via search engines.

Enable two-factor authentication (2FA) on messaging apps and use disappearing messages

Messaging apps such as WhatsApp and Signal are key to our communications. Both are offer end-to-end encryption and a two-factor authentication (2FA) or Registration Lock feature to prevent an attacker with access to your messages from hijacking your accounts and impersonating you.

Some apps offer disappearing messages as an optional feature for more privacy. This feature ensures your message disappears after a specified period unless it is kept.

Use a Password Manager

Password reuse is the easiest way for an attacker to compromise an organisational or individual account. Billions of email and password combinations are included in public leaks and your favourite password is likely public already (see Have I Been Pwned?). Use a Password Manager, which creates a unique password for each account: KeepassXC, 1Password or BitWarden are all relevant options.