01 – Digital security

Because technology is constantly changing and digital safety safeguards may become antiquated as a result, we want to ensure we’re always adding the latest resources to the database

Help us by sharing tools you’ve used or created

Assess

To assess your digital security risk, begin by inventorying the data you want to protect, which will vary based on the phase you’re in: development, pre-production, production, post-production, or distribution. Moving away from the abstract to a detailed list may help to make it feel less overwhelming.

We recommend inventorying your data at the beginning of each phase of filmmaking and, each time, to be as specific as possible.

During development, you may want to protect source identities, the contact information of potential funders, participants and partners, pitch documents and other project descriptions, and budgets. During pre-production, it's likely you'll want to protect shooting location details, travel itineraries, and interview questions. During production, you will need to protect — among other data — footage, audio, interview notes, and communication with participants, partners, and funders. During post-production, the list of data may include transcripts, rough cuts, and notes. During distribution, you'll want to ensure the safety of participant contact and location information and recordings from private Q&As and other events, among other data.

Being able to think clearly about the data that needs to be protected will make it easier to answer these questions we've culled from the Electronic Frontier Foundation and the Freedom of the Press Foundation to guide your digital security plan:

• Who is most likely to target our data?
• How likely is it that we'll need to protect it from them?
• What resources do they have — money, time, equipment, expertise — to target our data?
• What is their objective? Do they want money, incriminating information, access, or knowledge that could be used to shut us down?
• How much trouble are we willing to go through to try to prevent potential consequences?
• What could happen to me, my team, our participants, partners, and funders if those who want to access or steal our data are successful?

But that’s not all! Take a close — and critical — look at how you and your team, partners, participants, and funders communicate. Do you make voice calls or video calls? Do you use digital messaging services, shipping or mail services, e-mail and/or file sharing to communicate? Do you use encrypted services with rigorous privacy policies, or do you use consumer options made by corporations like Apple and Google? 

Where are you most vulnerable to attack? Do you use public WIFI in cafes or hotels? Do you post regularly to social media? Do you allow social media to track your location? Do you mail drives to an editor or collaborator? Do you speak on unsecured phone lines? Are there people on the team who take more risks than others?

We’ve gathered these questions and others in the Digital security checklist

to help you to assess — and mitigate — your risk.

Throughout each phase of filmmaking, assess the film’s presence online, as well as the online presence of all team members and participants. Are there comments or content that would put you, participants, the team, or the film at risk if they were found? Are past projects that are listed or accessible online going to contribute to unsafe situations? Do you have personal information that might be sold to data brokers? Is personal information already publicly available due to website domain registrations, real estate purchases or political donations?

Visit Legal Security for more legal guidance

Mitigate

Once you’ve identified the data you want to keep secure, as well as the types and extent of risk you face, you can develop a digital security plan to keep yourself, your team, and your film safer, as safe as you can be.

While each film’s digital security plan will differ based on your situation and the answers to your risk assessment, here are some core ideas and recommendations to keep in mind.

Secure communications are an imperative.

• Keep your operating systems and apps — mobile and desktop — updated to benefit from the security measures they provide. 
• Utilize the security and privacy settings that your mobile devices provide.
• Use end-to-end encrypted apps for secure communications. Note that in a number of countries around the world, law enforcement has the right to access encrypted communications. Global Partners Digital maintains a world map of encryption laws and policies that’s easily searchable by country.
• Consider leaving your regular mobile devices at home and investing in a travel phone that's less vulnerable to attack and houses less compromising information. Ideally, a travel phone would contain only essential contacts and apps necessary for production.
• Know the laws where you're traveling. The Freedom House puts out an annual Freedom on the Net report that's a good starting point to get a sense of the atmosphere where you'll be filming. Reporters without Borders maintains a global index of press freedom that is valuable as well. Note that, in the United States, laws can vary from state to state.
• Use a password manager to generate hard to crack passwords.
• Disable biometrics (like Apple’s Face ID) to unlock your phone or computer.
• Use an alpha numeric passcode of at least 7 or 8 digits for your phone.
• If you use Apple products, consider using Lockdown Mode, which is designed to protect against “highly sophisticated” cyber-attacks. Make sure you understand how it could affect your phone and computer habits.

Physical theft of data and hardware is just as important. Back up, back up, back up — and don’t store each back up in the same place. Also, remember, while a pen and paper are undoubtedly digitally secure, they can be confiscated or stolen.

Our friends at Digital Security for Filmmakers have outlined best practices for ensuring the security of your footage and communications while you travel and for both your mobile and desktop devices. 

They advocate for moving raw footage off your camera’s memory card as soon as possible and onto a secure storage advice while still out in the field. And while you may be inclined to store footage “in the cloud,” Digital Security for Filmmakers urges you to understand the tradeoffs, including the willingness of some service providers (like Google and Amazon) to hand over data in response to legal orders. Instead, seek out end-to-end encrypted cloud storage providers, so you can be more confident that you're the only one with access.

Big picture? Think about digital security as a shift in mindset versus a list of apps you need to download and that might become overwhelming. How can you limit the number of prying eyes by choosing different platforms to speak to your colleagues, and even your family and friends?

We’ve gathered additional helpful resources that cover everything from best practices to training to recommended apps and software and what settings to use on your mobile devices and computers — and we will continue to gather resources to ensure that we are directing you to the most appropriate, timely, and valuable help you need to keep you safer.