<?xml version="1.0"?>
<feed xmlns="http://www.w3.org/2005/Atom" xml:lang="en">
	<id>https://writers.wiki.apc.org/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Tarryn</id>
	<title>APC Writer&#039;s Wiki - User contributions [en]</title>
	<link rel="self" type="application/atom+xml" href="https://writers.wiki.apc.org/api.php?action=feedcontributions&amp;feedformat=atom&amp;user=Tarryn"/>
	<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php/Special:Contributions/Tarryn"/>
	<updated>2026-04-29T17:55:04Z</updated>
	<subtitle>User contributions</subtitle>
	<generator>MediaWiki 1.43.7</generator>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=What_is_GenderIT.org&amp;diff=570</id>
		<title>What is GenderIT.org</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=What_is_GenderIT.org&amp;diff=570"/>
		<updated>2015-06-14T17:05:09Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:doc.jpg|thumb|200px]]&lt;br /&gt;
GenderIT.org is a project of the Association for Progressive Communications Women&#039;s Rights Programme.&lt;br /&gt;
&lt;br /&gt;
Launched in 2006, GenderIT.org is a seminal resource site that provides feminist reviews and commentary on internet policies and cultures. It maps the intersections between women’s rights and sexual rights with internet rights issues, concentrating on bringing voices from the global South on these issues, since the discourse is often dominated by those from the North.&lt;br /&gt;
&lt;br /&gt;
The site is meant to be a &#039;&#039;&#039;think-tank OF and FOR&#039;&#039;&#039; women&#039;s, sexual and internet rights activists, academics, journalists and advocates from a range of disciplines and contexts. GenderIT.org provides a space for reflection, influence and advocacy on internet policies and cultures so that they meet women&#039;s needs and do not infringe on their rights. Thus it also serves as a resource and reference tool, with information on the key players, evolving terms and current debates.&lt;br /&gt;
&lt;br /&gt;
It started as a site monitoring policy developments in ICT and gender, and from its beginnings has been unique. Initially it was one of the first sites looking at ICT policy developments through a gender lens. More sites and individuals are now doing this, reflecting both the growth of the internet and the growing awareness of online misogyny. However, GenderIT.org remains a unique space for its focus on the global South, its focus on those working at the grassroots level (that is grounded in the experience of the women in the society in which they live), and for its emphasis on both advocacy and social justice.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=What_is_GenderIT.org&amp;diff=569</id>
		<title>What is GenderIT.org</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=What_is_GenderIT.org&amp;diff=569"/>
		<updated>2015-06-14T17:01:00Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:doc.jpg|thumb|200px]]&lt;br /&gt;
GenderIT.org is a project of the Association for Progressive Communications Women&#039;s Rights Programme.&lt;br /&gt;
&lt;br /&gt;
Launched in 2006, GenderIT.org is a seminal resource site that provides feminist reviews and commentary on internet policies and cultures. It maps the intersections between women’s rights and sexual rights with internet rights issues, concentrating on bringing voices from the global South on these issues, since the discourse is often dominated by those from the North.&lt;br /&gt;
&lt;br /&gt;
The site is meant to be a &#039;&#039;&#039;think-tank OF and FOR&#039;&#039;&#039; women&#039;s, sexual and internet rights activists, academics, journalists and advocates from a range of disciplines and contexts. GenderIT.org provides a space for reflection, influence and advocacy on internet policies and cultures so that they meet women&#039;s needs and does not infringe on their rights. Thus is also serves as a resource and reference tool, with information on the key players, evolving terms and current debates.&lt;br /&gt;
&lt;br /&gt;
It started as a site monitoring policy developments on ICT and gender, and from its beginnings has been unique. Initially it was one of the first sites looking at ICT policy developments through a gender lens. More sites and individuals are now doing this, reflecting both the growth of the internet and the growing awareness of online misogyny. However, GenderIT.org remains a unique space for its focus on the global South, its focus on those working at the grassroots level (that is grounded in the experience of the women in the society in which they live), and for its emphasis on both advocacy and social justice.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=567</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=567"/>
		<updated>2015-06-07T19:40:05Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Feminist Talks (blog posts) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register create an account] and then navigate to [http://www.genderit.org/node/add/blog create feminist talk]. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/stripping-igf-bare-where-are-women-s-rights Stripping the IGF bare: where are women´s rights?]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/interview-nana-darkoa-adventures-bedroom-african-woman Interview with Nana Darkoa: Adventures from the bedroom of an African woman]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/lets-talk-about-gender-analysis-lac-igf Let&#039;s talk about gender analysis in the LAC IGF]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/women-igf-now-we-need-mainstream-gender Women at the IGF: Now we need to mainstream gender]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/digital-world-2012-stories-end-violence-against-women Digital World 2012: stories to end violence against women] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/azerbaijan-when-online-security-synonymous-personal-safety Azerbaijan: When online security is synonymous with personal safety]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: [https://www.apc.org/en/node/20266/ #SectionJ: From footnotes to headlines]  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/what-does-it-take-create-feminist-internet What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[https://storify.com/APC_News/day-3-sexual-right-privacy-and-technology-common-c Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america Gender peripheries of the Internet Governance Forum in Latin America]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Gender, sexuality and the internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 9th IGF: Feminist talks scale over the walls of internet governance]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=566</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=566"/>
		<updated>2015-06-07T19:37:16Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Feminist Talks (blog posts) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register create an account] and then navigate to http://www.genderit.org/node/add/blog. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/stripping-igf-bare-where-are-women-s-rights Stripping the IGF bare: where are women´s rights?]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/interview-nana-darkoa-adventures-bedroom-african-woman Interview with Nana Darkoa: Adventures from the bedroom of an African woman]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/lets-talk-about-gender-analysis-lac-igf Let&#039;s talk about gender analysis in the LAC IGF]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/women-igf-now-we-need-mainstream-gender Women at the IGF: Now we need to mainstream gender]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/digital-world-2012-stories-end-violence-against-women Digital World 2012: stories to end violence against women] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/azerbaijan-when-online-security-synonymous-personal-safety Azerbaijan: When online security is synonymous with personal safety]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: [https://www.apc.org/en/node/20266/ #SectionJ: From footnotes to headlines]  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/what-does-it-take-create-feminist-internet What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[https://storify.com/APC_News/day-3-sexual-right-privacy-and-technology-common-c Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america Gender peripheries of the Internet Governance Forum in Latin America]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Gender, sexuality and the internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 9th IGF: Feminist talks scale over the walls of internet governance]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=565</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=565"/>
		<updated>2015-06-07T19:36:07Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Newsletter edition */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog create an account]. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/stripping-igf-bare-where-are-women-s-rights Stripping the IGF bare: where are women´s rights?]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/interview-nana-darkoa-adventures-bedroom-african-woman Interview with Nana Darkoa: Adventures from the bedroom of an African woman]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/lets-talk-about-gender-analysis-lac-igf Let&#039;s talk about gender analysis in the LAC IGF]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/women-igf-now-we-need-mainstream-gender Women at the IGF: Now we need to mainstream gender]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/digital-world-2012-stories-end-violence-against-women Digital World 2012: stories to end violence against women] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/azerbaijan-when-online-security-synonymous-personal-safety Azerbaijan: When online security is synonymous with personal safety]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: [https://www.apc.org/en/node/20266/ #SectionJ: From footnotes to headlines]  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/what-does-it-take-create-feminist-internet What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[https://storify.com/APC_News/day-3-sexual-right-privacy-and-technology-common-c Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america Gender peripheries of the Internet Governance Forum in Latin America]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Gender, sexuality and the internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 9th IGF: Feminist talks scale over the walls of internet governance]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=564</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=564"/>
		<updated>2015-06-07T19:35:15Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Storify */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog create an account]. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/stripping-igf-bare-where-are-women-s-rights Stripping the IGF bare: where are women´s rights?]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/interview-nana-darkoa-adventures-bedroom-african-woman Interview with Nana Darkoa: Adventures from the bedroom of an African woman]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/lets-talk-about-gender-analysis-lac-igf Let&#039;s talk about gender analysis in the LAC IGF]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/women-igf-now-we-need-mainstream-gender Women at the IGF: Now we need to mainstream gender]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/digital-world-2012-stories-end-violence-against-women Digital World 2012: stories to end violence against women] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/azerbaijan-when-online-security-synonymous-personal-safety Azerbaijan: When online security is synonymous with personal safety]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: [https://www.apc.org/en/node/20266/ #SectionJ: From footnotes to headlines]  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/what-does-it-take-create-feminist-internet What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[https://storify.com/APC_News/day-3-sexual-right-privacy-and-technology-common-c Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Gender peripheries of the Internet Governance Forum in Latin America&lt;br /&gt;
&lt;br /&gt;
Gender, sexuality and the internet&lt;br /&gt;
&lt;br /&gt;
9th IGF: Feminist talks scale over the walls of internet governance&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=563</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=563"/>
		<updated>2015-06-07T19:34:24Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Twitter */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog create an account]. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/stripping-igf-bare-where-are-women-s-rights Stripping the IGF bare: where are women´s rights?]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/interview-nana-darkoa-adventures-bedroom-african-woman Interview with Nana Darkoa: Adventures from the bedroom of an African woman]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/lets-talk-about-gender-analysis-lac-igf Let&#039;s talk about gender analysis in the LAC IGF]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/women-igf-now-we-need-mainstream-gender Women at the IGF: Now we need to mainstream gender]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/digital-world-2012-stories-end-violence-against-women Digital World 2012: stories to end violence against women] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/azerbaijan-when-online-security-synonymous-personal-safety Azerbaijan: When online security is synonymous with personal safety]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: [https://www.apc.org/en/node/20266/ #SectionJ: From footnotes to headlines]  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Gender peripheries of the Internet Governance Forum in Latin America&lt;br /&gt;
&lt;br /&gt;
Gender, sexuality and the internet&lt;br /&gt;
&lt;br /&gt;
9th IGF: Feminist talks scale over the walls of internet governance&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=562</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=562"/>
		<updated>2015-06-07T19:31:39Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Articles/interviews */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog create an account]. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/stripping-igf-bare-where-are-women-s-rights Stripping the IGF bare: where are women´s rights?]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/interview-nana-darkoa-adventures-bedroom-african-woman Interview with Nana Darkoa: Adventures from the bedroom of an African woman]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/lets-talk-about-gender-analysis-lac-igf Let&#039;s talk about gender analysis in the LAC IGF]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/women-igf-now-we-need-mainstream-gender Women at the IGF: Now we need to mainstream gender]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/digital-world-2012-stories-end-violence-against-women Digital World 2012: stories to end violence against women] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/articles/azerbaijan-when-online-security-synonymous-personal-safety Azerbaijan: When online security is synonymous with personal safety]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: #SectionJ: From footnotes to headlines https://www.apc.org/en/node/20266/  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Gender peripheries of the Internet Governance Forum in Latin America&lt;br /&gt;
&lt;br /&gt;
Gender, sexuality and the internet&lt;br /&gt;
&lt;br /&gt;
9th IGF: Feminist talks scale over the walls of internet governance&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=561</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=561"/>
		<updated>2015-06-07T19:29:39Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Feminist Talks (blog posts) */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should [http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog create an account]. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-technology-informs-my-activism-conversation-gender-and-technology-activists-barcel How technology informs my activism: A conversation with gender and technology activists in Barcelona]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/video-feminist-talks-feminist-internet Video: Feminist talks on a feminist internet]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/never-mind-nipples-sex-gender-and-social-media Never mind the nipples: Sex, gender and social media] &lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/how-crucial-anonymity-sexual-exploration-and-promoting-sexual-rights-activism How crucial is anonymity for sexual exploration and promoting sexual rights activism]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/editorial/two-weeks-push-greater-recognition-our-rights Two weeks to push for greater recognition of our rights]&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Stripping the IGF bare: where are women´s rights?&lt;br /&gt;
&lt;br /&gt;
Interview with Nana Darkoa: Adventures from the bedroom of an African woman&lt;br /&gt;
&lt;br /&gt;
Let&#039;s talk about gender analysis in the LAC IGF&lt;br /&gt;
&lt;br /&gt;
Women at the IGF: Now we need to mainstream gender&lt;br /&gt;
&lt;br /&gt;
Digital World 2012: stories to end violence against women &lt;br /&gt;
&lt;br /&gt;
Azerbaijan: When online security is synonymous with personal safety&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: #SectionJ: From footnotes to headlines https://www.apc.org/en/node/20266/  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Gender peripheries of the Internet Governance Forum in Latin America&lt;br /&gt;
&lt;br /&gt;
Gender, sexuality and the internet&lt;br /&gt;
&lt;br /&gt;
9th IGF: Feminist talks scale over the walls of internet governance&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=560</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=560"/>
		<updated>2015-06-07T19:25:04Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Partners&amp;#039; relevant events */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/category/discussion-theme/genderitorg-12th-awid-forum-2012 AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should create an account http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
How technology informs my activism: A conversation with gender and technology activists in Barcelona&lt;br /&gt;
&lt;br /&gt;
Video: Feminist talks on a feminist internet&lt;br /&gt;
&lt;br /&gt;
Never mind the nipples: Sex, gender and social media &lt;br /&gt;
&lt;br /&gt;
How crucial is anonymity for sexual exploration and promoting sexual rights activism&lt;br /&gt;
&lt;br /&gt;
Two weeks to push for greater recognition of our rights&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Stripping the IGF bare: where are women´s rights?&lt;br /&gt;
&lt;br /&gt;
Interview with Nana Darkoa: Adventures from the bedroom of an African woman&lt;br /&gt;
&lt;br /&gt;
Let&#039;s talk about gender analysis in the LAC IGF&lt;br /&gt;
&lt;br /&gt;
Women at the IGF: Now we need to mainstream gender&lt;br /&gt;
&lt;br /&gt;
Digital World 2012: stories to end violence against women &lt;br /&gt;
&lt;br /&gt;
Azerbaijan: When online security is synonymous with personal safety&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: #SectionJ: From footnotes to headlines https://www.apc.org/en/node/20266/  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Gender peripheries of the Internet Governance Forum in Latin America&lt;br /&gt;
&lt;br /&gt;
Gender, sexuality and the internet&lt;br /&gt;
&lt;br /&gt;
9th IGF: Feminist talks scale over the walls of internet governance&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=559</id>
		<title>General orientation for events coverage</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=General_orientation_for_events_coverage&amp;diff=559"/>
		<updated>2015-06-07T19:24:20Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* APC&amp;#039;s projects related events */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:coverage.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews have both been recognised for the coverage done in events by readers and writers, becoming one of its substantial outputs when it comes to gender, internet rights and ICT policy arena. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What is the dynamic we propose to the team for an event coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
GenderIT.org and APCNews commits to keep the core writers informed about any upcoming event of relevance for coverage, so the team is available and ready to go. Team meetings and email contacts will be the spaces to have these discussions and updates.&lt;br /&gt;
&lt;br /&gt;
The editorial teams team will develop a communications plan before the event, to make sure we are all on the same page, adding background information on the event, why it is relevant to our advocacy goals, what are the responsabilities of each one of us, what are the outputs expected, and what are the expectations in general.&lt;br /&gt;
&lt;br /&gt;
This plan will include orientation for work previously, during and after the event. Many times the event itself is just the tip of the iceberg: many other things will be needed before, during and after the event in terms of coverage. Please refer to the CSW case linked to this document to use as an example of what we mean by this.&lt;br /&gt;
&lt;br /&gt;
Once the event its happening, weather we are carrying an on-site or an off-site coverage, the editors will be in touch and available for the writers as much as possible to provide orientation, feedback on whatever is necessary and to make suggestions.&lt;br /&gt;
&lt;br /&gt;
As mentioned before, sometimes after a big event we prepare a newsletter edition. The content of this edition can be composed by on-site produced content, or in some cases of special materials - usually in-depth articles – commissioned to complement the on-site delivered content. &lt;br /&gt;
&lt;br /&gt;
One of the ways that the APCNews/GenderIT.org teams have of assessing and monitoring the reach of these editions is through a website statistics report done one month after the edition went out. This search tell us which were the most read materials, the number of visits to the website, the impact on social media, among other indicators. And our experience with these reports has showed us so far that GenderIT.org events coverages are quite successful. These reports can be shared with the team of writers if you consider it is a relevant resource for your orientation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Events usually covered by GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Even though coverage opportunities change, and our advocacy objectives might give more importance to some events over the others, the coverage that GenderIT.org usually does relates to these spaces:&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;UN spaces:&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Global Internet Governance Forum (IGF)&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-2010 2010 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-2011-internet-governance-forum 2011 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/IGF2012 2012 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-indonesia 2013 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/9th-igf-feminist-talks-scale-over-walls-internet-governance 2014 IGF coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Regional and national IGFs&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-peripheries-internet-governance-forum-latin-america 2013 LAC IGF coverage condensed in special edition] (full coverage in [http://www.genderit.org/es/edition/periferias-del-g-nero-en-el-foro-de-gobernanza-de-internet-en-am-rica-latina Spanish])&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/asia-pacific-stakeholders-assert-human-rights-should-be-heart-internet-governance-disc 2014 Asia-Pacific IGF] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/feminist-talk/impacting-global-advocacy-tech-related-violence-against-women-through-regional-igfs Impacting global advocacy on tech-related violence against women through regional IGFs] (stand alone article)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Commission on the Status of Women&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/genderitorg-commission-status-women-2011-new-york 2011 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/end-violence-against-women-language-and-action-csw57th 2013 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/back-and-forth-advancement-womens-rights-csw58 2014 CSW coverage condensed in special edition]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;UN Committee on the Elimination of Discrimination against Women (CEDAW)&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/resources/cedaw-apcs-submission-commitee-general-recommendation-girls-women-s-right-education CEDAW: APC&#039;s Submission to the Commitee on the General recommendation on girls’/women’s right to education] (stand alone article/resource)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Universal Periodic Review&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Example:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/womens-human-rights-online-universal-periodic-review Human Rights Council&#039;s Universal Periodic Review (UPR)]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;APC&#039;s projects related events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On sexual and internet rights:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet-imagineafeministinternet Global Meeting on Gender, Sexuality and the Internet in 2014] (coverage in synch)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/gender-sexuality-and-internet Global Meeting on Gender, Sexuality and the Internet in 2014] (special edition)&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/erotics-all-over-constellations-debates-sexual-rights-privacy-and-technology EROTICS project meetings in India and United States in 2013] (special edition)&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;On violence against women:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
 &lt;br /&gt;
[http://www.genderit.org/edition/taking-control-technology-end-violence-against-women Take Back the Tech! campaign in 2011]&lt;br /&gt;
&lt;br /&gt;
[http://www.genderit.org/edition/power-stories-reclaim-womens-rights Take Back the Tech! campaign in 2012]&lt;br /&gt;
&lt;br /&gt;
===&#039;&#039;Partners&#039; relevant events&#039;&#039;===&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[AWID Forum in 2012]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other local, regional or global initiatives or events related to access, FLOSS, media, human rights, among others.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;CSW: A real case of coverage&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We have attached one report featuring as an example the coverage planned and executed (including final statistical reporting) of the 2013 Commission on the Status of Women (CSW) session in New York. This will be a good case to read through in order to get a sense of how GenderIT.org and APC communications team work like during a relevant event coverage. Check it out here: [[Media:File:CSW case example.pdf]]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;What kind of outputs do we expect from events&#039; coverage?&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers attending to key events on behalf of GenderIT.org/APCNews or following them remotely are expected to produce certain outputs that will later feed an edition (if that is the case) or be featured on GenderIT.org/APC.org websites, on other APC websites when relevant, and on social media.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Feminist Talks (blog posts)&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Feminist Talks doesn&#039;t have to be too long. Around 1500 words is perfectly fine, and we encourage to input as much insight and analysis as possible in the writing. It is usually personal and insightful.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; You can submit your inputs or engage in discussions around women&#039;s rights issues in GenderIT.org&#039;s Feminist Talk. To submit your blog you should create an account http://www.genderit.org/user/register and then navigate to http://www.genderit.org/node/add/blog. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Make sure you have chosen a profile picture for you and a short byline for the “about” field. Other information is optional.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; You can also send your reflections and photos directly to genderit@apcwomen.org and we will upload them for you. You do not need to be registered to send a comment on other posts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; Off-site team: Those following the event off-site can help with blogging by using the tweets sent by on-site team as input for their articles, as well as the webcasts when available. This is a good practice that allows us to produce more content and to help on-site team.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
How technology informs my activism: A conversation with gender and technology activists in Barcelona&lt;br /&gt;
&lt;br /&gt;
Video: Feminist talks on a feminist internet&lt;br /&gt;
&lt;br /&gt;
Never mind the nipples: Sex, gender and social media &lt;br /&gt;
&lt;br /&gt;
How crucial is anonymity for sexual exploration and promoting sexual rights activism&lt;br /&gt;
&lt;br /&gt;
Two weeks to push for greater recognition of our rights&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Articles/interviews&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; Writers attending the event are expected to write sessions chronicles, articles on hot topics, or interview key advocacy referents. This can be in text format, or video, or an audio interview. It will depend on the kind of material and its quality (you might have a great interview in recorded audio but if the sound quality is not good enough, it is possible that it might have to be turned into a text piece).&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Some of the articles/interviews will be prearranged with GenderIT.org editorial team before the event, having in mind the people attending to that space and the topics covered.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; Criteria for writing articles (extension, depth) is detailed in the GenderIT.org&#039;s payment squeme (link) and shall be coordinated with the editors beforehand.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Stripping the IGF bare: where are women´s rights?&lt;br /&gt;
&lt;br /&gt;
Interview with Nana Darkoa: Adventures from the bedroom of an African woman&lt;br /&gt;
&lt;br /&gt;
Let&#039;s talk about gender analysis in the LAC IGF&lt;br /&gt;
&lt;br /&gt;
Women at the IGF: Now we need to mainstream gender&lt;br /&gt;
&lt;br /&gt;
Digital World 2012: stories to end violence against women &lt;br /&gt;
&lt;br /&gt;
Azerbaijan: When online security is synonymous with personal safety&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Twitter&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. &#039;&#039;&#039;Make sure that you have a Twitter account.&#039;&#039;&#039; Make it open (otherwise people who are not following you – the ones we want to reach- won&#039;t be able to see your tweets). If you want to keep your Twitter account private you can create a new one for work. Make your user name as personal as you can, (eg: sonia_apc rather than womensprogramme_apc). People are more interested in personal opinions and views rather than organisational speech. Writers are expected to use their accounts for tweeting during events. &lt;br /&gt;
&lt;br /&gt;
2. &#039;&#039;&#039;We use the hashtags&#039;&#039;&#039;: #genderit and #genderitES for Spanish. APC Twitter accounts are @APC_News @APCNoticias @APCNouvelles @GenderITorg @GenderITorgES.&lt;br /&gt;
&lt;br /&gt;
3. &#039;&#039;&#039;Find out and send us the Twitter accounts of partners/members attending&#039;&#039;&#039;, so that we can follow them with the GenderIT.org and APC accounts.&lt;br /&gt;
&lt;br /&gt;
4. Sometimes, before an event, a set of predefined tweets is shared via email to facilitate the tweeting and the dissemination of our key messages.&lt;br /&gt;
&lt;br /&gt;
5. &#039;&#039;&#039;Once at the event, find out what hashtag people are using.&#039;&#039;&#039; Sometime there are various hashtags circulating. For instance, with CSW, tweeples could be using various tags — such as #CSW, #CSW59 or #CSW2012. Identify the most popular one. We&#039;ll use that hashtag for the box on APC.org.&lt;br /&gt;
&lt;br /&gt;
6. &#039;&#039;&#039;If this event does not have an active hashtag, we will set up one&#039;&#039;&#039;, probably using somehow the name of the conference, so all tweeples can relate to. This way, you can easily follow the conversation and then create one page with all posts from the event for easy reference (check Storify below). &lt;br /&gt;
&lt;br /&gt;
7. &#039;&#039;&#039;Tweet (in English and/or in Spanish)!&#039;&#039;&#039; You can quote panelists and participants (short, summarised and catchy phrases) and/or your reactions to what it&#039;s being said, about conversations you have or overhear, your observations, soundbytes, links to interesting resources or news, photos, reminders about events. You can also reply to other participants; many times real participation takes. &lt;br /&gt;
&lt;br /&gt;
8. &#039;&#039;&#039;Re-tweet interesting stuff from other people:&#039;&#039;&#039; this will help us build our Twitter audience. &lt;br /&gt;
&lt;br /&gt;
9. &#039;&#039;&#039;Blog.&#039;&#039;&#039; Many times you can cut and paste some tweets and replies and make an interesting post with little effort. You can also use tweets for reporting or as a way of taking notes. &lt;br /&gt;
&lt;br /&gt;
10. &#039;&#039;&#039;Invite people to share their own writings:&#039;&#039;&#039; You will not be alone in the coverage of an event, so this other people are your allies. Contact them via Twitter or email to give them a heads up on the coverage plans and ask them to send you their stuff.&lt;br /&gt;
&lt;br /&gt;
Example: Are you going to be writing at #IGF? If so, I would love to include your post(s) in our ongoing event coverage. Send me a DM with a link to your post, and we’ll get it added to our site. &lt;br /&gt;
&lt;br /&gt;
11. &#039;&#039;&#039;Remote team:&#039;&#039;&#039; Keep an eye out on tweets, re-tweet conversations, reply and join conversations, and conduct deeper research on tweeted links. Engage as much as possible – we know it is hard not being present physically to follow up what is going on at the event, but we promise you that it is completely possible and useful.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tips for live tweeting:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Make a plan:&#039;&#039;&#039; Choose your sessions in advance. If you are attending an event with multiple tracks, schedule which sessions you’ll be attending and covering in advance. If you don’t want to cover everything you sit in on, consider what your readers will benefit from the most. Once you decide what you will be covering, prep your posts with these basics to save time:&lt;br /&gt;
&lt;br /&gt;
- Name of the session and speaker: Make sure you can provide a bit of background about the speaker, including links to his/her company, Twitter handle, etc. &lt;br /&gt;
&lt;br /&gt;
- Details of the session: Is there a Slideshare or a programme available that you can review in advance? if so, it may help to type up the basic structure of the presentation and then fill in the details as you listen.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Be careful. Some events are more private that others; if it&#039;s a small event make sure that people are OK with your tweeting.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you have multiple people covering an event, set up a Google spreadsheet with the list of all sessions, times, and people covering the conference. From there, writers can indicate which sessions they are covering so they are not duplicating efforts.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Decide on a writing platform.&#039;&#039;&#039; In addition to deciding which sessions you want to cover, decide how you want to capture information from each session. Because internet connections can never be relied upon 100 percent, we suggest to write in a text editor so you don’t have to worry about connectivity.&lt;br /&gt;
&lt;br /&gt;
Decide what kind of content to produce: There are a number of ways you can cover sessions at an event, and you should decide what format will work best for your audience before you get on-site. Here are a few general options:&lt;br /&gt;
&lt;br /&gt;
1- &#039;&#039;&#039;Live blogging:&#039;&#039;&#039; This is reporting from a session in real time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can provide immediate coverage of an event.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; Depending on how many posts you publish, your audience may feel a bit overwhelmed.&lt;br /&gt;
&lt;br /&gt;
2- &#039;&#039;&#039;Daily wrap-ups:&#039;&#039;&#039; This is providing highlights from the conference from each day.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; These posts are easy to digest.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; It’s not a good option if your audience wants detailed information.&lt;br /&gt;
&lt;br /&gt;
3- &#039;&#039;&#039;Post-event coverage:&#039;&#039;&#039; Collect content that you can then use after the event. This content may be a bit more refined, and it could have a bit of a different spin than “straight coverage” of a session.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Pro:&#039;&#039;&#039; You can focus on the best content from the event and in essence be a filter for your audience.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Con:&#039;&#039;&#039; This is not a good option if the information is time sensitive, or there are a lot of other people covering the event quickly.&lt;br /&gt;
&lt;br /&gt;
Regardless of if you are publishing your content in real time or dripping it out, here are some ways to generate interest in your coverage:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Announce what you will cover.&#039;&#039;&#039; If you are going to be changing your regular posting schedule and publishing live blogs throughout a conference, it’s a good idea to let your readers know. You can also use this post to announce if someone from your organization will be speaking.&lt;br /&gt;
&lt;br /&gt;
Example: Check out what #genderit announced that will be covering at the #CSW59&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tease your session.&#039;&#039;&#039; If you are speaking at the event, you may want to write about your session before it occurs. Not only is this is a great way to repurpose content that you have spent a lot of time creating, but it also builds anticipation for your session.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx wrote about an internet intermediaries’ guide to social media and online VAW fighting strategy, which was a preview of the presentation she gave last year at #CSW58.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Step-by-step posts.&#039;&#039;&#039; One classic way to cover a session is to do a rundown of the ideas the speaker shared, following the same structure as the presentation. This is especially easy to do if the speaker is covering a process or another well-organized topic.&lt;br /&gt;
&lt;br /&gt;
Example: Susan Marx shared her wrap-up of a panel discussion on how to eradicate online violence against women at the #CSW59.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Bonus tip:&#039;&#039;&#039; If you are doing live tweeting, you can use this: “I put a live blogging disclaimer at the top of the post that says, ‘I’m live tweeting, excuse lapses of grammar, spelling errors, and typos‘” &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Summary of tweets.&#039;&#039;&#039; Another fun thing you can do is follow the Twitter stream during the presentation and record the most insightful and popular tweets and share them in a post (check Storify below).&lt;br /&gt;
&lt;br /&gt;
Example: Missed the event and looking for a compilation of debates? Check our most tweetable moments from #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;A compilation of Instagram photos.&#039;&#039;&#039; There are a lot of intangibles you experience when attending an event. Capture them by taking photos or curating what others have shared and post that on Twitter (always remember to respect people&#039;s right to privacy and anonymity).&lt;br /&gt;
&lt;br /&gt;
Example: 45 GenderIT.org insider Instagram pics from workshops at #CSW58&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Wrap-up posts.&#039;&#039;&#039; When necessary, instead of covering individual sessions, consider writing a wrap-up post that outlines the key points you found most valuable or compelling, and share the link with a tweet that is appealing and captures the best of the article.&lt;br /&gt;
&lt;br /&gt;
Example: #SectionJ: From footnotes to headlines https://www.apc.org/en/node/20266/  &lt;br /&gt;
&lt;br /&gt;
After you do all your thing on Twitter, and the event is almost finished, you need to give it a bit of love. Here are some easy ways to increase the distribution of your conference content on Twitter (and this can also apply by email):&lt;br /&gt;
&lt;br /&gt;
- Include the event hashtag in the title of the materials you are posting on Twitter, since it is an easy way to help spread the word about your post and to have it automatically included in the Twitter stream.&lt;br /&gt;
&lt;br /&gt;
- Send your content to the event’s organizers too, contacting them via Twitter or email. While your audience will hopefully benefit from your coverage of the event, the event organizers will likely want to see and share your post, as well.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Facebook&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Take Back the Tech (in English) and APC (in English, Spanish and French) pages are the only official Facebook pages APC uses. &lt;br /&gt;
&lt;br /&gt;
2. Writers are invited to post on Facebook using their personal accounts all links and photos considered relevant. &lt;br /&gt;
&lt;br /&gt;
3. Inviting people at the event to “like” the pages and to post relevant links as well is another possibility. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Pictures&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. We always appreciate having pictures to illustrate the articles or for some other purposes, so picture taking is more than encouraged.&lt;br /&gt;
2. You can upload them to a Flickr account and share them with the editors, also by email, or upload it yourself to illustrate your output.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Tip:&#039;&#039;&#039; Please remember that this entails security and privacy issues for the people in the pictures, so make sure that the people appearing in the image is fine with that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Storify&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
1. Storify has been successfully used during some events to compile relevant tweets, Facebook posts, YouTube videos and other social media posts. It&#039;s a fast and easy way to compose blog posts-like content.  &lt;br /&gt;
&lt;br /&gt;
2. Its also a very useful tool to condense and store in one place debates or interviews carried over Twitter, for instance (as in the first example below).&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
[What does it take to create a feminist internet?]&lt;br /&gt;
&lt;br /&gt;
[Day 3: Sexual Right, Privacy and Technology - Common Concerns Moving Forward]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=== &#039;&#039;Newsletter edition&#039;&#039; ===&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Usually, after a big event coverage, a special GenderIT.org/APCNews edition is released (this is not always the case) but it is quite a key and relevant moment in GenderIT.org&#039;s editorial timeline, since it spikes our readership interest and it keeps us as reference points on the gender lensed coverage of events that are usually (if covered at all) covered from other perspectives.&lt;br /&gt;
&lt;br /&gt;
&amp;lt;blockquote&amp;gt;Examples:&amp;lt;/blockquote&amp;gt;&lt;br /&gt;
&lt;br /&gt;
Gender peripheries of the Internet Governance Forum in Latin America&lt;br /&gt;
&lt;br /&gt;
Gender, sexuality and the internet&lt;br /&gt;
&lt;br /&gt;
9th IGF: Feminist talks scale over the walls of internet governance&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;One last word&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Before attending an event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Check all the publications/promotional material you can bring with you, and with staff members that live in your city. &lt;br /&gt;
&lt;br /&gt;
2. If you think the event is relevant enough for us to have some materials printed, let us know. &lt;br /&gt;
&lt;br /&gt;
3. Also check their luggage restrictions and if there&#039;s budget available to pay extra weight.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;During the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Remember to collect business cards of people you consider relevant.&lt;br /&gt;
&lt;br /&gt;
2. Offer attendees to sign up a sheet for our newsletters.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;After attending the event&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Report back to the team on how the event went and all relevant information.&lt;br /&gt;
&lt;br /&gt;
2. Type down the information you collected on the business cards and please send it to the team.&lt;br /&gt;
&lt;br /&gt;
3. Send us the suscribers email addresses for the newsletters and we will add them to our database. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Read more: Why are events&#039; coverages important for GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
From February to September of 2014, GenderIT.org team carried an evaluation process to respond, among others, to these questions:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Is GenderIT.org reaching the audience that it aims to reach?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;To what extent are our readers satisfied with GenderIT.org website and content?&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
We consider that it is relevant to feature this information in this section since it will give writers a better idea of the kind of use our readership and writers are making of the website content, and what they like the most, therefore orientate the materials produced during coverage.&lt;br /&gt;
&lt;br /&gt;
The evaluation data was collected through a readership survey, a survey and interviews with GenderIT.org writers, and an analysis of the website statistics since 2010 to date.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the readership survey [1]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Type of content: In-depth articles were pointed out as extremely useful, and about a quarter of all respondents ranked feminist talks as extremely important.&lt;br /&gt;
&lt;br /&gt;
* Type of content format: Half of respondents said that they prefer all the three formats named (audio, text, video). Among the remainder, text was the clear favourite.&lt;br /&gt;
&lt;br /&gt;
* What do readers get from GenderIT.org: Majority of respondents agreed and agreed strongly that when they read GenderIT.org I feel more informed on topics. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents disagreed with the affirmation that when they read GenderIT.org they find information similar to what they can get in other websites. &lt;br /&gt;
&lt;br /&gt;
* Majority of respondents agreed and agreed strongly with the affirmation that when they read GenderIT.org they get an alternative perspective on the issues.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;Some relevant highlights from the writers&#039; survey and interviews [2]:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* In terms of events coverage, all those who had covered events spoke of the experience as exhilirating if exhausting. There were no suggestions on improving how things are run during the events themselves. &lt;br /&gt;
&lt;br /&gt;
* It is clear that the events are significant in building the GenderIT.org &#039;family&#039;, making people feel connected and supported.&lt;br /&gt;
&lt;br /&gt;
* The articles coming from an event are staggered to maintain interest.&lt;br /&gt;
&lt;br /&gt;
* GenderIT.org needs more and better quality audio for the use in community radio stations.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;References:&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
[1] In mid-2014 GenderIT.org disseminated an online questionnaire, requesting that all users of GenderIT.org respond. By the closing date, a total of 162 people had submitted a full questionnaire response to GenderIT.org. &lt;br /&gt;
&lt;br /&gt;
[2] The writers survey was conducted in July 2014, with a pool of around 100 former and current contributors to GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=552</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=552"/>
		<updated>2015-05-29T13:05:53Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Virus protection */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members &#039;&#039;&#039;MUST&#039;&#039;&#039; use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;What should NOT be stored in APC OwnCloud&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is &#039;&#039;&#039;NOT&#039;&#039;&#039; encrypted. Team members &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaboration with external partners&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Shared calendars&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;OwnCloud and contact synchronisation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaborative document editing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Instant messaging and voice&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows &lt;br /&gt;
use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using wifi&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Backing up data&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Virus protection&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2. GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=551</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=551"/>
		<updated>2015-05-29T13:04:08Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Virus protection */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members &#039;&#039;&#039;MUST&#039;&#039;&#039; use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;What should NOT be stored in APC OwnCloud&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is &#039;&#039;&#039;NOT&#039;&#039;&#039; encrypted. Team members &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaboration with external partners&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Shared calendars&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;OwnCloud and contact synchronisation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaborative document editing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Instant messaging and voice&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows &lt;br /&gt;
use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using wifi&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Backing up data&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Virus protection&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2. GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=550</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=550"/>
		<updated>2015-05-29T13:02:51Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Backing up data */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members &#039;&#039;&#039;MUST&#039;&#039;&#039; use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;What should NOT be stored in APC OwnCloud&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is &#039;&#039;&#039;NOT&#039;&#039;&#039; encrypted. Team members &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaboration with external partners&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Shared calendars&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;OwnCloud and contact synchronisation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaborative document editing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Instant messaging and voice&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows &lt;br /&gt;
use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using wifi&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Backing up data&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=549</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=549"/>
		<updated>2015-05-29T13:02:04Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Online data storage and sharing */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members &#039;&#039;&#039;MUST&#039;&#039;&#039; use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;What should NOT be stored in APC OwnCloud&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is &#039;&#039;&#039;NOT&#039;&#039;&#039; encrypted. Team members &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaboration with external partners&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Shared calendars&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;OwnCloud and contact synchronisation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collaborative document editing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Instant messaging and voice&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows &lt;br /&gt;
use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using wifi&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=548</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=548"/>
		<updated>2015-05-29T12:57:21Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Online data storage and sharing */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=547</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=547"/>
		<updated>2015-05-29T12:56:58Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* APC Security Policy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
==&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;==&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=546</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=546"/>
		<updated>2015-05-29T12:53:15Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=545</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=545"/>
		<updated>2015-05-29T12:52:41Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* APC Security Policy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General rules for using encrypted lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=544</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=544"/>
		<updated>2015-05-29T12:48:46Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* APC Security Policy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=543</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=543"/>
		<updated>2015-05-29T12:48:17Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=542</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=542"/>
		<updated>2015-05-29T12:47:44Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Online data storage and sharing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Backing up data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypting back-up data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Using cloud storage&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Data on external devices&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Virus protection&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Malicious Scripts and Web Browsers&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Dealing with sensitive data&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Collecting sensitive data&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Secure data handling and sharing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Application choice&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web browser&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Office suite&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Instant messaging, audio and video conferencing&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=541</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=541"/>
		<updated>2015-05-29T12:43:06Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* APC Security Policy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they &#039;&#039;&#039;MUST&#039;&#039;&#039; be announced to the list. Footers of all APC mailing lists &#039;&#039;&#039;MUST&#039;&#039;&#039; include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Encrypted mailing lists&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
Online data storage and sharing&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
Backing up data&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
Encrypting back-up data&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using cloud storage&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Data on external devices&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Virus protection&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Malicious Scripts and Web Browsers&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Dealing with sensitive data&lt;br /&gt;
&lt;br /&gt;
Collecting sensitive data&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Secure data handling and sharing&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Application choice&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
Email client&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
Web browser&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
Office suite&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Instant messaging, audio and video conferencing&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=540</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=540"/>
		<updated>2015-05-29T12:39:37Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* APC Security Policy */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email and email list communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Email client security settings&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;General email communication&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you &#039;&#039;&#039;MUST&#039;&#039;&#039; state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others &#039;&#039;&#039;MUST NOT&#039;&#039;&#039; be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
Encrypted email communication&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they MUST be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
Mailing lists&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they MUST be announced to the list. Footers of all APC mailing lists MUST include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
Encrypted mailing lists&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
Online data storage and sharing&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
Backing up data&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
Encrypting back-up data&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using cloud storage&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Data on external devices&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Virus protection&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Malicious Scripts and Web Browsers&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Dealing with sensitive data&lt;br /&gt;
&lt;br /&gt;
Collecting sensitive data&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Secure data handling and sharing&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Application choice&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
Email client&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
Web browser&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
Office suite&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Instant messaging, audio and video conferencing&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=539</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=539"/>
		<updated>2015-05-29T12:38:06Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Purpose&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Scope&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;Perspective users of the policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
=&#039;&#039;&#039;APC Security Policy&#039;&#039;&#039;=&lt;br /&gt;
&lt;br /&gt;
Email and email list communication&lt;br /&gt;
&lt;br /&gt;
Email client security settings&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
General email communication&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you MUST state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others MUST NOT be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
Encrypted email communication&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they MUST be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
Mailing lists&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they MUST be announced to the list. Footers of all APC mailing lists MUST include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
Encrypted mailing lists&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
Online data storage and sharing&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
Backing up data&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
Encrypting back-up data&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using cloud storage&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Data on external devices&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Virus protection&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Malicious Scripts and Web Browsers&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Dealing with sensitive data&lt;br /&gt;
&lt;br /&gt;
Collecting sensitive data&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Secure data handling and sharing&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Application choice&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
Email client&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
Web browser&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
Office suite&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Instant messaging, audio and video conferencing&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=538</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=538"/>
		<updated>2015-05-29T12:23:25Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Purpose&lt;br /&gt;
This policy outlines the acceptable use of computer equipment and portable devices at APC. Inappropriate use of ICTs exposes APC to risks including virus attacks, compromise of network systems and services and disclosure of private information that can put APC, APC staff and its collaborators at risk. This policy is in place to protect both the organisation and individuals.&lt;br /&gt;
&lt;br /&gt;
Scope&lt;br /&gt;
This policy applies to APC staff, interns and other workers at APC. It also applies to all equipment, data and communications related to APC and its projects. This policy does not apply to devices used exclusively for personal communication, although applying a similar policy for such communication is highly recommended. The APC Security Policy forms part of APC&#039;s HR Resources Manual and all APC staff are asked to read it and sign it.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Perspective users of the policy&lt;br /&gt;
APC staff will be responsible for applying the guidelines in the APC Security Policy and it will be made available to the entire APC network with the expectation that some network members will be interested in applying some variant of the policy1. Once the policy is implemented and time tested, a generic version will be developed and disseminated online under an open licence.&lt;br /&gt;
&lt;br /&gt;
APC Security Policy&lt;br /&gt;
&lt;br /&gt;
Email and email list communication&lt;br /&gt;
&lt;br /&gt;
Email client security settings&lt;br /&gt;
&lt;br /&gt;
For choice of email client applications, see section Application choice. Some clients, such as Mozilla Thunderbird, have SSL/TSL as a default setting when configuring a new email account. Without a secure SSL/TSL connection, the content of your email communication is sent in plain text through several communication nodes between your computer and your mail server.&lt;br /&gt;
&lt;br /&gt;
The following principles apply to securely communicating over email:&lt;br /&gt;
&lt;br /&gt;
General email communication&lt;br /&gt;
&lt;br /&gt;
APC staff follows this policy for exchanging email communication:&lt;br /&gt;
&lt;br /&gt;
* Do not open email and attachments from people you do not trust.&lt;br /&gt;
* Use plaintext rather than html, when practical.&lt;br /&gt;
* Before forwarding any messages originating in APC lists, evaluate thoroughly whether the forwarded thread does not contain any information that was meant only for a given team or that might be considered private.&lt;br /&gt;
* Keep in mind that the participants in APC lists change and some project lists may also include people who are not part of the APC team or the wider APC network. Therefore, make sure to not share internal information on such lists.&lt;br /&gt;
* If you wish for your message to stay strictly internal, you MUST state clearly that it is internal in the body and the subject line of the message.&lt;br /&gt;
* Information that is potentially compromising for you or others MUST NOT be shared on APC lists but should be sent directly to the intended recipients, ideally in encrypted format. See the next section Encrypted email communication.&lt;br /&gt;
&lt;br /&gt;
Encrypted email communication&lt;br /&gt;
&lt;br /&gt;
While it is not expected that staff will encrypt all communications, they MUST be able to exchange encrypted communication when needed using an OpenPGP key1. Therefore, all APC staff must be equipped with an OpenPGP-compliant application that allows them to encrypt email communication and other data. For Mozilla Firefox users, the add-on Enigmail2 is a trusted option. APC staff should use the following checklist to determine whether email communication needs to be encrypted.&lt;br /&gt;
&lt;br /&gt;
* Not all emails exchanged by the team need to be encrypted.&lt;br /&gt;
* All sensitive information should be encrypted. Even mildly sensitive information, such as private details about others, or passwords to not-so-important accounts.&lt;br /&gt;
* All replies to and forwards of encrypted email messages should also be encrypted.&lt;br /&gt;
* The subject line of encrypted messages should be discreet, since this, along with other metadata3, is not encrypted.&lt;br /&gt;
* Avoid sending attachments. If you must, and those attachments must also be encrypted, ensure your email client supports and is using the PGP/MIME encryption standard.&lt;br /&gt;
* If links are pasted into an email then the email should be PGP-signed. The same goes for emails with attachments, which authenticates that neither the content nor link will harm the recipient.&lt;br /&gt;
* Team members sign messages when it is important that trust be established.&lt;br /&gt;
* Team members sign messages when there is a possibility that the content of the email could be compromising to someone (e.g. when specific instructions are given).&lt;br /&gt;
* The most sensitive information should be inserted in email body, not the attachments.&lt;br /&gt;
&lt;br /&gt;
Remember that email encryption is illegal in some countries. From countries where APC is active, these include Pakistan and Venezuela1. APC staff can consult local organisations and legal support groups to find out:&lt;br /&gt;
&lt;br /&gt;
* The legality of encrypted communication by individuals&lt;br /&gt;
* How encrypted communication is being prosecuted.&lt;br /&gt;
&lt;br /&gt;
Mailing lists&lt;br /&gt;
&lt;br /&gt;
Each time a new person joins an APC mailing list, they MUST be announced to the list. Footers of all APC mailing lists MUST include instructions on how to retrieve information about other subscribers, so that all list members can check at any time who else is subscribed to a particular list.&lt;br /&gt;
While neither of these conditions applies to distribution or broadcast lists such as APC News and APC Forum lists, each message of those lists must contain information about how to unsubscribe, usually in the footer. People should not be subscribed to broadcast lists without their knowledge and permission.&lt;br /&gt;
&lt;br /&gt;
Encrypted mailing lists&lt;br /&gt;
&lt;br /&gt;
Setting up encrypted mailing lists should be considered for projects that include very sensitive communication and where the following conditions can be met:&lt;br /&gt;
&lt;br /&gt;
* It is certain that all users of the list will be able to use PGP encryption.&lt;br /&gt;
* None of the list participants resides in a country where PGP encryption is illegal or is likely to be illegal in the near future.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;APC currently does not host its own encrypted lists but we plan to do so in future. When APC has the capacity to host encrypted mailing lists their usage will become mandatory for coordination of sensitive projects, such as projects dealing with Human Rights defense. There are some other activist groups that host encrypted mailing lists and can be approached (e.g. nadir.org).&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
General rules for using encrypted lists&lt;br /&gt;
&lt;br /&gt;
When sending information that is potentially dangerous for you or other people always give it a second thought before sending. Remember that even encrypted messages can be decrypted with a single subscriber&#039;s key. If you must send something that, if connected to you, could put you or other people in trouble, consider sending it to one or more individuals directly rather than to the list and PGP-signing the message.&lt;br /&gt;
&lt;br /&gt;
If you send something to the list asking others to do something for you, you MUST sign it so others can be sure that it is you!&lt;br /&gt;
&lt;br /&gt;
Do not obscure the subject line or divulge secret information in the subject line. The subject line and the metadata (e.g. headers) of a message sent to an encrypted list are NOT encrypted. You SHOULD make subject line informative because messages sent through an encrypted list do not show the sender, at least not until they are decrypted.&lt;br /&gt;
&lt;br /&gt;
Do not forward messages off-list without explicit permission from the sender and everyone who contributed to the forwarded thread.&lt;br /&gt;
&lt;br /&gt;
An encrypted list breaks one of the most important foundations of cryptography - know who you are talking to. When you send an encrypted message directly to one or more individuals, you must encrypt it with the public key or keys of each recipient, forcing you to carefully think about who you are sending it to and ensuring it can only be opened by that person.&lt;br /&gt;
&lt;br /&gt;
When you send an encrypted message to an encrypted list, you cannot be sure who is going to receive it. While we can rely on the trustworthy moderator to report new subscribers or even set-up the mail manager to report new subscriptions, by sending a message to an encrypted list you are sending your top secret message to a re-mailer that you don&#039;t control.&lt;br /&gt;
&lt;br /&gt;
Online data storage and sharing&lt;br /&gt;
&lt;br /&gt;
Online data storage, often referred to as “the cloud,” allows for greater collaboration and sharing of information but also introduces data security concerns since control of the data becomes shared with, or in some cases entirely handed over to, a third party. For internal sharing and online data storage, APC uses exclusively a self-hosted OwnCloud installation. All staff members MUST use OwnCloud, which works like other commercial services by installing an client1 or for use in a web browser. Use of the client and web interface is detailed in the APC OwnCloud Manual.&lt;br /&gt;
&lt;br /&gt;
What should NOT be stored in APC OwnCloud&lt;br /&gt;
&lt;br /&gt;
APC&#039;s OwnCloud instance is NOT encrypted. Team members MUST NOT use it to store highly sensitive data (see Appendix 2 for a definition of what is considered sensitive data).&lt;br /&gt;
&lt;br /&gt;
Collaboration with external partners&lt;br /&gt;
&lt;br /&gt;
Accounts on APC OwnCloud should be created for external collaborators working on APC projects. Project coordinators must request that the APC system administrator create these user accounts and any user group to which people working in a given project should be added. This safeguard prevents information from being shared with collaborators or team members for whom it is not intended.&lt;br /&gt;
Team members must be particularly careful when sharing information with a group of users via OwnCloud. It is very easy to make a mistake when selecting a user or user group.&lt;br /&gt;
&lt;br /&gt;
Shared calendars&lt;br /&gt;
&lt;br /&gt;
APC uses the shared calendar feature of its self-hosted OwnCloud installation to reduce the amount of data we share with third parties. Calendars can be shared among multiple users and user groups. The platform follows the open CalDav standard, which is compatible with the vast majority of calendar and task-management applications.&lt;br /&gt;
&lt;br /&gt;
OwnCloud and contact synchronisation&lt;br /&gt;
APC staff are encouraged to use APC&#039;s OwnCloud for backup of their personal contacts and for synchronisation across devices. This can fully replace synchronisation over gmail accounts and can help APC staff in getting their personal data off Google&#039;s servers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Collaborative document editing&lt;br /&gt;
&lt;br /&gt;
Share files in Owncloud for asynchronous, collaborative document editing. In cases when a real-time online collaborative editing is needed, use etherpads hosted by May First or Riseup. This applies both to text documents, as well as to spreadsheets.&lt;br /&gt;
Riseup&#039;s Etherpad: https://pad.riseup.net&lt;br /&gt;
MayFirst&#039;s EtherCalc (spreadsheet): https://calc.mayfirst.org&lt;br /&gt;
&lt;br /&gt;
Use Googledocs only in cases when an edited document must include synchronous editing in complex formats that are not available in etherpad.&lt;br /&gt;
Be aware that after you finish editing the document in Etherpad, you must download and store it locally. Riseup deletes unused pads after 30 days, unlike the way Googledocs are stored indefinitely.&lt;br /&gt;
&lt;br /&gt;
OwnCloud 6.0 will include an online collaborative editing feature, based on open document format (ODF). The functionalities will be very similar to those provided by GoogleDocs. Once the system is available and tested, APC will start using its OwnCloud for collaborative editing of documents with complex formatting.&lt;br /&gt;
&lt;br /&gt;
Instant messaging and voice&lt;br /&gt;
&lt;br /&gt;
For team&#039;s instant communication, APC uses Jitsi VoIP &amp;amp; instant messaging client1. As of January 2014, it is the only existing open source client that provides end-to-end encrypted communication through open communication protocols (xmpp/Jabber, SIP), and is available for all major platforms. Team members must create an account on jit.si (a xmpp/jabber account provided by Jitsi developers). &lt;br /&gt;
&lt;br /&gt;
Since APC uses Jitsi for calls and text messages over open protocols, you are welcome to use other open source clients to make calls through your jit.si account. However, for all types of sensitive communication, Jitsi client must be used as it is the only currently existing cross-platform client than provides full encryption.&lt;br /&gt;
&lt;br /&gt;
Since most of VoIP communication outside APC takes place over Skype as the dominant VoIP/texting option, APC team members are not expected to drop Skype altogether. However, be aware that Skype is not a secure communication option and it should not be used for highly sensitive communication.&lt;br /&gt;
always use jabber or SIP protocols (on Jitsi or other clients) when possible.&lt;br /&gt;
Inform your communication partners about the advantages of migrating to secure open protocols and applications.&lt;br /&gt;
If you, despite all, can not avoid having a chat over Skype, be aware that content of Skype text chats are stored locally on the machine from which you are chatting, in addition to being stored on Microsoft-controlled servers. Never chat about sensitive issues from computers that are not yours!&lt;br /&gt;
&lt;br /&gt;
To make secure VoIP calls from your android mobile to other smart phones or computers, use CSipSimple1 or Lumicall2. This VoIP application for android allows use of ZRTP encryption for calls made over SIP networks. That way you can make secure end-to-end encrypted calls to other people who are using CSipSimple, Lumicall, or Jitsi.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using wifi&lt;br /&gt;
&lt;br /&gt;
Wifi encryption security has known shortcomings. If possible, APC staff SHOULD use wired connection when you are connecting from your office or home. If you can not avoid using wifi, follow these rules for establishing a secure connection:&lt;br /&gt;
&lt;br /&gt;
* Never connect to anonymous open networks.&lt;br /&gt;
* Connect only to wifi networks that you trust.&lt;br /&gt;
* Password protect your home or office wifi network.&lt;br /&gt;
* Use WPA2 encryption (strongest) for your home or office wifi network.&lt;br /&gt;
* Disable WPA/WPA2 wireless access points.&lt;br /&gt;
&lt;br /&gt;
Some older hardware will not connect to an access point with WPA2 encryption. Where there is a choice only between WEP and WPA encryption, WPA must be chosen for its improved security.&lt;br /&gt;
&lt;br /&gt;
Backing up data&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
According to APC HR policy, all APC staff MUST periodically back up their work-related data1, preferably to . There are a number of free and open source back-up tools that can facilitate and automate the back-up process on team members&#039; computers and portable devices 2.&lt;br /&gt;
&lt;br /&gt;
Depending on one&#039;s email client settings and whether or not you are using IMAP or POP, all emails in an apc.org inbox are stored on GreenNet servers, which are automatically backed up nightly. Some versions of this backup are kept for up to one year. However, staff are encouraged to back up their emails themselves if not only for a much quicker recovery time.&lt;br /&gt;
&lt;br /&gt;
Encrypting back-up data&lt;br /&gt;
&lt;br /&gt;
It is recommended that all work-related data are backed up with encryption but there are types of data one doesn&#039;t need to encrypt such as documents that have no sensitive nature. There are a number of available open source tools that convert external hard drives or memory sticks into encrypted drives. Data backed up on CDs and DVDs should be encrypted prior to burning1.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Using cloud storage&lt;br /&gt;
&lt;br /&gt;
Backing up sensitive data in the cloud, or simply on a networked server, is generally not recommended due to the lack of control one has over a third-party cloud service. However, if you cannot avoid using cloud services for back up, use one that you trust, like APC&#039;s OwnCloud.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Data on external devices&lt;br /&gt;
&lt;br /&gt;
For principles of storage and management of data on portable devices, follow the section Secure data handling and sharing. Portable devices are particularly vulnerable to being compromised through loss or confiscation of the device or malware infection.&lt;br /&gt;
Transporting sensitive data in hostile environments&lt;br /&gt;
When carrying sensitive data in situations where associating such data with its carrier would be highly compromising, APC staff SHOULD:&lt;br /&gt;
&lt;br /&gt;
* Hide such data on your portable device in a secret encrypted drive1, or&lt;br /&gt;
* Hide such data inside another, seemingly innocent type of data using steganography. techniques&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Virus protection&lt;br /&gt;
&lt;br /&gt;
Every APC staff member is required use and periodically update anti-virus software on their computer. This applies also to staff members whose operating systems are currently not vulnerable to virus contamination, such as GNU/Linux or MacOS. Whether one&#039;s computer is directly infected or not, choosing to not use any anti-virus software can lead to spreading viruses by email or portable media among colleagues and collaborators, which represents a potential security threat.&lt;br /&gt;
&lt;br /&gt;
It is recommended that Windows users use the open source anti-virus software Clamwin with the Clam Sentinel add-on1. However, most free versions of commercially available anti-virus software provide very good protection as well, so the choice of anti-virus application is a personal one. See “AV comparative table” on Wikipedia for a list of details and features2.&lt;br /&gt;
&lt;br /&gt;
GNU/Linux and MacOS users are encouraged to use the open source Clamav anti-virus software. Other recommended anti-virus applications for Mac are Sophos (freeware) and ClamXav (free).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Malicious Scripts and Web Browsers&lt;br /&gt;
&lt;br /&gt;
It is highly recommended that team members configure their browsers in such a way so as to minimise risks of downloading and executing website-embedded malicious scripts.&lt;br /&gt;
&lt;br /&gt;
Recommended extensions for Firefox and Chrome browsers are:&lt;br /&gt;
&lt;br /&gt;
Firefox: NoScript, BrowserProtect, BetterPrivacy1&lt;br /&gt;
Chrome: NotScripts2.&lt;br /&gt;
&lt;br /&gt;
Note: Some of these extensions might inhibit some functionalities based on JavaScript, e.g. Facebook chat.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Dealing with sensitive data&lt;br /&gt;
&lt;br /&gt;
Collecting sensitive data&lt;br /&gt;
&lt;br /&gt;
For collection of personal data, APC is generally guided by terms 1-7 of UK data protection principles, without those being binding in any way legally.1It is the responsibility of project managers to ensure that plans for handling sensitive information such as logistics details like passport numbers are complied with. In messages in which we ask others to submit their data, in introductory pages of online surveys, etc., project managers must clarify what they will do with sensitive information, with whom it will be shared and for how long it will be stored. This applies to hard copies as well as data stored on desktops, files servers or online. When collecting sensitive personal data (e.g. logistics-related information), the project manager who is in charge should develop brief documentation that outlines how will the data be used, whether and how it will be shared and when it will be deleted from the APC server or local databases. If the data will be stored for later use (e.g. for the APC contact database) it must be clarified in the documentation which data will be stored, in what format, if it will be encrypted or whether and when it will be erased.&lt;br /&gt;
&lt;br /&gt;
Data that are considered even mildly sensitive MUST be collected using APC&#039;s LimeSurvey online survey tool, encrypted email communication, or other secure and encrypted means. Data that are not considered sensitive can also be collected using LimeSurvey as well as email questionnaires or by other means that facilitates data collection and manipulation.&lt;br /&gt;
&lt;br /&gt;
When collecting sensitive information with LimeSurvey, the person responsible for the integrity of the collected information should assure that:&lt;br /&gt;
&lt;br /&gt;
* No one besides selected team members and the APC system administrator has access to the collected data.&lt;br /&gt;
* Survey results are deleted from LimeSurvey database as soon as they are processed.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Secure data handling and sharing&lt;br /&gt;
&lt;br /&gt;
Encryption is particularly important in the case of data that contains private, personal information or information that could be compromising to you or other people. There are a number of ways in which data can be encrypted, for example with your OpenPGP key or with a standalone encryption application (see the section Encryption for more details). Data can be also stored in a secure, encrypted database such as KeePass1 (see the section Passwords).&lt;br /&gt;
&lt;br /&gt;
To share such sensitive data with others over the internet, APC staff MUST encrypt it with the recipients&#039; PGP key before sending. For particularly sensitive data it is better to share it as a Keepass database and to communicate the password by phone or an encrypted voice call, e.g. over a Jitsi call.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Application choice&lt;br /&gt;
&lt;br /&gt;
Free and open source software is generally more secure than proprietary software. Mainstream operating system applications whose code is regularly reviewed by independent reviewers are a guarantee that they do only what they are supposed to do and do not perform any other actions, such as unwanted collection of user data.&lt;br /&gt;
&lt;br /&gt;
APC staff SHOULD consider using one of the many open source operating systems. Particularly, Ubuntu (GNU/Linux) users can find solid support from other APC team members and there is ample experience with other GNU/Linux distributions within the wider APC community. GNU/Linux facilitates secure data handling and storage very well 1. Users of proprietary operating systems can nevertheless use open source software for most of their computing needs, which significantly improves the safety of their data and hardware.&lt;br /&gt;
&lt;br /&gt;
Email client&lt;br /&gt;
&lt;br /&gt;
One of the best-supported and most feature-rich email clients currently available is Mozilla Thunderbird2. Thunderbird works with Windows, Mac and GNU/Linux and it is widely used and supported by APC team and members.&lt;br /&gt;
&lt;br /&gt;
Web browser&lt;br /&gt;
&lt;br /&gt;
Mozilla Firefox1 is one of the most feature-rich, extensible and secure internet browsers. As compared to Internet Explorer (IE), it also supports a wider range of industry-accepted protocols such as HTML5. Using Mozilla Firefox with the appropriate add-ons or plug-ins will make your internet browsing significantly safer. See the section Secure Internet browsing for more details. Another recommended browser for GNU/Linux users with KDE desktop environment is Konqueror.&lt;br /&gt;
&lt;br /&gt;
Those team members who cannot avoid using IE (e.g. because it is required for administration of APC finance system) SHOULD use Sun&#039;s Java Virtual Machine (JVM), not the insecure Microsoft JVM environment2.&lt;br /&gt;
&lt;br /&gt;
Office suite&lt;br /&gt;
&lt;br /&gt;
Despite occasional compatibility issues with open source alternatives, Microsoft Office is typically not needed for APC work or most other office tasks. Since APC team shares documents in open document standards (ODF), team members MUST install LibreOffice or other office package that supports open format standards1. If you can not avoid using Microsoft Office applications, saving and sharing documents in odf format is recommended for compatibility and also as a means to avoid embedding malicious content.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Instant messaging, audio and video conferencing&lt;br /&gt;
&lt;br /&gt;
Jitsi is the main VoIP chatting application used by APC team. Team uses jit.si xmpp/jabber service as the main service where all APC team members have to create an account (see Instant messaging, chat and voice section for more details). &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anti-virus, anti-spyware and back-up applications&lt;br /&gt;
&lt;br /&gt;
For recommendations on application choice, see Virus protection and Backing up data sections.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other software&lt;br /&gt;
&lt;br /&gt;
There are reliable, free and open source software (FOSS) applications for all of your computing needs. Well-supported projects with rapid development include Gimp1 for image manipulation, Audacity for audio editing, Open Shot Video editor, Scribus for desktop publishing and many others. If you are using proprietary software and you are interested in replacing it with a FOSS alternative, ask the APC team mailing list or look up an alternative on www.osalt.com.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Document sharing standards&lt;br /&gt;
&lt;br /&gt;
Unless there is a specific need to use a proprietary format (e.g. use of automated donor forms designed in Microsoft Word), APC team members MUST share documents in open format standards1.&lt;br /&gt;
&lt;br /&gt;
The reasons include greater compatibility, accessibility and also security, since documents in open standard formats are less likely to execute malicious scripts on your computer.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Passwords&lt;br /&gt;
&lt;br /&gt;
[Basic information and why you shouldn&#039;t use the same password for everything]&lt;br /&gt;
&lt;br /&gt;
If any team member cannot remember all of her/his passwords, s/he SHOULD use reliable password manager! A reliable open source password manager is Keepass, which is available for all platforms, including those used by most smartphones1. This will decrease the risk that your passwords or other sensitive information will be compromised, e.g. through an infection by spyware software, and allow users to:&lt;br /&gt;
&lt;br /&gt;
* Carry passphrases encrypted on a portable device, between devices&lt;br /&gt;
* Store passwords securely in an encrypted format&lt;br /&gt;
* Store passwords along with other sensitive data such as private PGP/GPG keys, credit card details, sensitive documents, images&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Web browser password managers&lt;br /&gt;
Storing passwords directly in your browser&#039;s password manager is very risky, because the passwords are stored unencrypted and can be easily recovered by anyone who gains access to your computer, including both physical access and remote access, for example via a spyware program.&lt;br /&gt;
&lt;br /&gt;
Instead, use the above-mentioned standalone password manager to copy and paste passwords into online forms with just a few clicks, without exposing passwords in a way that they could be identified by spyware applications. Some password management applications allow integration with your browser, so the passwords that you chose to store in your browser are automatically and securely handled by the standalone password manager1.&lt;br /&gt;
Secure web browsing&lt;br /&gt;
Using https protects APC staff not only from eventual echelons who might want to monitor what content they are accessing, but also from intruders intercepting passwords and other sensitive data when they are transferred unencrypted. Particularly if you cannot avoid connecting to a public wifi network, the risk of interception of unencrypted communication and leakage of your passwords is extremely high.&lt;br /&gt;
&lt;br /&gt;
Team members MUST take the following measures (depending on the web browser they use):&lt;br /&gt;
&lt;br /&gt;
* Install the Https Everywhere extension for your browser, available for Mozilla Firefox and Google Chrome.2&lt;br /&gt;
* Check the security/privacy preferences of your browser and if such option is available, choose connecting via secure connection (https).&lt;br /&gt;
* For third-party services that you use for APC-related work, such as Google, Facebook and Twitter, , look for and enable the “always use secure connection” option in the preferences of your account. You did this successfully if the next time you connect to given service the URL of that particular service start with https (secure/encrypted http). You SHOULD do this for all your online services that offer this option, thus minimising significantly the chance that someone will hijack your account.&lt;br /&gt;
&lt;br /&gt;
When connecting to above-mentioned third-party services from a portable device such as phone, avoid using specialised “apps”. These usually communicate with the service through an unencrypted connection regardless whether or not you configured your browser-based service to always communicate via https. When possible, use these services via your mobile browser.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online privacy&lt;br /&gt;
&lt;br /&gt;
Basic privacy measures when browsing online&lt;br /&gt;
&lt;br /&gt;
When browsing the internet, the user leaves many traces behind on visited websites as well as on the computer one is using. Browser extensions also make it impossible for visited services to ‘profile’ you based on your online behavior and monetise this information. The following extensions/plug-ins enable APC staff to prevent unwanted parties from tracking them:&lt;br /&gt;
&lt;br /&gt;
* Firefox: BetterPrivacy, Ghostery1&lt;br /&gt;
* Google Chrome: Ghostery, Disconnect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Anonymous browsing and circumvention&lt;br /&gt;
&lt;br /&gt;
Those team members who need to connect to websites anonymously, or who need to access websites that are blocked in their countries SHOULD use an anonymisation software such as TOR 3. Users of Android and iOS-based portable devices can install Orbot – an implementation of TOR for portable devices and Orweb (browser that enables anonymous web browsing using TOR service)4.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Other anonymous communications&lt;br /&gt;
&lt;br /&gt;
Use of TOR is also recommended for other communication that is generally legitimate and ethical, but conflicts with legislation of the country from which the communication is made, or in cases when associating the communication with team members might put them or other people at risk. All staff&#039;s connections to the internet can be anonymised if needed by routing them through TOR including chat, email, P2P networking.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Generating and sharing images, video, audio and digital stories&lt;br /&gt;
&lt;br /&gt;
APC work dealing with to audiovisual (A/V) recordings and digital stories is governed by following policies:&lt;br /&gt;
&lt;br /&gt;
Informed, verbal consent MUST be obtained from anyone whom APC staff member records on audio or video, unless such recording is made in a public space where such recordings are common and expected, e.g. a conference or lecture. The same policy applies to taking photographs.&lt;br /&gt;
&lt;br /&gt;
Informed, written consent with using images or A/V recordings on APC websites or for other purposes MUST be obtained in writing from all individuals who are captured in that material. Unless these individuals clearly licence APC to re-purpose such material freely in the future, such consent must be requested and granted every time APC plans to use the material.&lt;br /&gt;
&lt;br /&gt;
If images or A/V material that includes one or more individuals is to be stored on team member&#039;s equipment or APC&#039;s online spaces, it MUST be accompanied by the documentation on how the material can be used in the future.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Storing A/V material and images&lt;br /&gt;
&lt;br /&gt;
Principles described in the section Dealing with sensitive data apply fully to audiovisual material and images containing work-related footage, pictures, or audio recordings of other people. Such material MUST NOT be stored on third-party online services, e.g. Flickr, Facebook. APC&#039;s OwnCloud may be used for storing work-related A/V material and images of other people only when such material does not contain compromising information.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Sharing A/V material and images&lt;br /&gt;
&lt;br /&gt;
A/V footage or pictures of other people MUST NOT be shared with people outside the APC team without consent of those who have been photographed or filmed. Such material may be shared with colleagues n APC team for specific purposes. However, the material MUST be accompanied by sufficient information on how it can be used and whether APC was granted permission for any public display of such footage or images.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Phones and Other Portable Devices&lt;br /&gt;
&lt;br /&gt;
All points of this policy apply to mobile phones and other portable devices in the same way as they apply to personal computers, as long as they are used for work-related communication or as a storage device for work-related data.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Threats Resulting from Social Engineering Activities&lt;br /&gt;
&lt;br /&gt;
A frequently used strategy for extracting sensitive data is social engineering. Social engineering, in the context of information security, refers to psychological manipulation of people into performing actions or divulging confidential information1. The only possible defense is awareness and sound judgment when dealing with suspicious communication.&lt;br /&gt;
&lt;br /&gt;
If a message is suspicious, even when staff members know the alleged sender, attachments should not be opened and clicking on links included in the messages should be avoided. Even some massively distributed fraught messages are designed in a way that makes the content look trustworthy and sender to seem like someone who knows the addressee. Hijacking of Skype and social networking identities is another common method of information extraction. When sharing sensitive information, team members MUST confirm the identity of the person they are sharing with.&lt;br /&gt;
&lt;br /&gt;
APC staff MUST NOT disclose any even mildly sensitive information to any unknown person or anyone whose identity is in doubt. This is particularly important in case of team members who are involved in human rights work. Leaking sensitive information to an impostor can result in unrepairable damages.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Managing Organisational Infrastructure&lt;br /&gt;
&lt;br /&gt;
The following principles apply to management of organisational infrastructure:&lt;br /&gt;
&lt;br /&gt;
General&lt;br /&gt;
&lt;br /&gt;
* Administrative passwords to all APC mailing lists will be changed twice a year.&lt;br /&gt;
* Only the APC systems administrator and one selected team member have access to recordings of online meetings in APC&#039;s online meeting system.&lt;br /&gt;
* Only APC system administrator, technical support and the communications manager have superadmin privileges to APC servers, including FTP access, database manipulation, OwnCloud administration, content management systems, and other server applications. When needed, the APC system administrator can grant specific privileges to other team members, but this MUST be documented and such privileges should be downgraded as soon as this access is no longer needed (e.g. end of a specific project).&lt;br /&gt;
* Only the APC system administrator and the executive director have administrative privileges to make changes to APC-owned DNS records.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Staff exit management&lt;br /&gt;
&lt;br /&gt;
* When a staff member leaves APC, their access to private lists and online spaces is deactivated within two days, unless there are specific reasons why such access should be maintained. Posting privileges to some of the lists might be preserved, if needed.&lt;br /&gt;
** APC system administrator is responsible for disabling ex-staff&#039;s access to lists and their access to other spaces and systems. &lt;br /&gt;
** The staff member responsible for administering staff&#039;s contacts in APC&#039;s contact database must make sure that exiting staff member is removed from the “APC Staff” contact group. &lt;br /&gt;
* When a staff member leaves APC, their administrative privileges to lists and spaces are handed over to their supervisor or to a person(s) previously identified by the supervisor. This MUST happen before such staff member leaves.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Agreement with organisational partners on sensitive information&lt;br /&gt;
&lt;br /&gt;
When a new project starts, the project coordinator SHOULD sign an agreement on information sharing principles with all project partners. This agreement should include:&lt;br /&gt;
&lt;br /&gt;
* List of all expected types of information that will be exchanged between collaborating organisations and which of those types are to be considered sensitive information.&lt;br /&gt;
* Details on how sensitive information will be exchanged and what exact security measures will be taken to protect the information (e.g. Sending encrypted email, exchanging encrypted databases, using secure voice communication).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Activity-specific security policies&lt;br /&gt;
&lt;br /&gt;
When organising an event that is of a sensitive nature such as when participants&#039; identities must be kept private, a specific security policy MUST be in place and participants must be informed about it. It must address:&lt;br /&gt;
&lt;br /&gt;
* Principles of communication on coordination lists or email loops (e.g. Do people disclose their identity? How much should they share about themselves and their work? Which email addresses should they use for such communication?).&lt;br /&gt;
* Principles of sharing information about the event outside of the event (e.g. Can they inform others that they are attending the event? If so, who can be informed and who cannot. Can people tweet from the event?).&lt;br /&gt;
* A/V documentation (e.g. Can people take photos or make audio or video recordings? Can these photos and recordings be shared? How and with whom?).&lt;br /&gt;
* Access to information about venue and participants (e.g. Who has access and where is it stored?). This includes all documentation from the event such as notes, photos, audio and video documentation.&lt;br /&gt;
* Reporting from the event (e.g. What will be included in the report? Who will have access to the report? Will donors receive detailed information about the event?).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Online Databases and Access to Servers&lt;br /&gt;
&lt;br /&gt;
When designing online databases that are meant to host sensitive content such as personal information, the following rules must be followed by the server administrator:&lt;br /&gt;
&lt;br /&gt;
* The database web browser interface will be hosted on a server that is separate from the server where the database is hosted.&lt;br /&gt;
* Data-at-rest must be encrypted. A system must be put in place that automates this or facilitates management of such encryption.&lt;br /&gt;
* All data for all websites, both external and internal, must be retrieved and posted using a secure connection and a secure protocol such as https.&lt;br /&gt;
&lt;br /&gt;
Only SFTP and SSH protocols are permitted for direct access to APC servers.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Reference_guide&amp;diff=491</id>
		<title>Reference guide</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Reference_guide&amp;diff=491"/>
		<updated>2015-05-22T08:11:48Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:style.jpg|thumb|200px]]&lt;br /&gt;
APC uses an adapted version of the American Psychological Association (APA) style of referencing. The key difference is APC&#039;s use of footnotes rather than in-text citation of author and date. We take into consideration the impracticality of scrolling backwards and forwards to the bibliography. Footnotes are better suited to documents that are likely to be read on a digital device. Please take into account the following recommendations when writing and editing for APC.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;APC guide to reference listing&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Please note that the superscript number used to indicate the placement of a footnote comes after any punctuation marks, including commas, full stops and quotation marks: &lt;br /&gt;
In 2014 the group launched a new website.3&lt;br /&gt;
“We have also launched a new website,”3  she added.&lt;br /&gt;
&lt;br /&gt;
The only exception is when the punctuation mark is a dash:&lt;br /&gt;
The new website 3 – launched in 2014 – provides a wide range of resources.&lt;br /&gt;
&lt;br /&gt;
The format for the footnote is the same format used for a reference list in APA style, with a few minor modifications, which means you can use free online tools like www.bibme.org/apa-bibliography  to make referencing faster and simpler. &lt;br /&gt;
&lt;br /&gt;
However, since all the necessary information is provided in the footnotes, there is no need to compile a separate list of references.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Special notes on URLs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
URLs (links) should be hyperlinked and the http:// and https:// notation should be removed. If a link is available with a secure connection (https), always use that as the target of the hyperlink (e.g. www.apc.org). In the case of print publications, where hyperlinking is not possible, please always &lt;br /&gt;
remove http:// but leave https:// so that readers are aware that a secure connection to the link is possible.&lt;br /&gt;
&lt;br /&gt;
URL links should also not contain tracking tokens, which are often present if the URL has been copied from an online dissemination platform like Twitter or ShareThis!. As an example, extraneous tracking information in the URL sometimes follows “html” and often begin with “?utm_”. Delete it &lt;br /&gt;
and then test to make sure the URL still works without it.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Guidelines and examples by reference type&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Books and reports&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Author, A. (year). Title of Work. Location: Publisher. URL (if the publication is available online)&lt;br /&gt;
Gurumurthy, A. (2004). Gender and ICTs: Overview Report . Brighton: BRIDGE. www.bridge.ids.ac.uk/go/bridge-publications/cutting-edge-packs/gender-and-icts/gender-and-icts&amp;amp;id=52909&amp;amp;type=Document&amp;amp;langid=1&lt;br /&gt;
WomenAid Collective. (2008). CEDAW and Accountability to Gender Equality in Nigeria: A Shadow Report. Enugu: WACOL.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;More than one author&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Fascendini, F., &amp;amp; Fialová, K. (2011). Voices from Digital Spaces: Technology-related violence against women. Johannesburg: APC WNSP. www.genderit.org/node/3539&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Chapter in a book&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Author, A. (Year of publication). Title of chapter. In A. Editor (Ed.), Title of book. Location: Publisher. URL&lt;br /&gt;
Moawad, N. (2013). Dot feminist resistance: Online disobedience, sabotage and militancy. In A. Finlay (Ed.), Global Information Society Watch 2013. johannesburg: APC and Hivos. www.giswatch.org/en/womens-rights-gender/dot-feminist-resistance-online-disobedience-sabotage-and-militancy &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Government documents&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Department/Agency. (year). Title . URL or Location: Publisher.&lt;br /&gt;
Department of Communications. (2013). South Africa Connect: National Broadband Policy. www.doc.gov.za/documents-publications/broadband.html&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Journal article&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Author, A. (Year). Title of article. Title of Periodical, volume number (issue number), pages (if available). URL (if online)&lt;br /&gt;
Coleman, S. (2005). The lonely citizen: Indirect representation in an age of networks. Political Communication, 22(2), 197-214.&lt;br /&gt;
Salas, M. (2010). Internet, power and politics: Gender and ICTs in the movement against CAFTA. The Journal of Community Informatics, 6(1). ci-journal.net/index.php/ciej/article/view/530/468&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Newspaper article&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Author, A. (Date month year 1 published). Article title. Newspaper Title. URL&lt;br /&gt;
Chemaly, S., Friedman, J., &amp;amp; Bates, L. (21 May 2013). An Open Letter to Facebook. Huffington Post. www.huffingtonpost.com/soraya-chemaly/an-open-letter-to-faceboo_1_b_3307394.html&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Presentation, paper, etc.&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Author, A. (Year). Title of paper. Description. URL&lt;br /&gt;
Defensor-Santiago, M. (2010). The praxis of gender justice in the Philippines: Implications for lawmaking. Paper presented at the Parliamentarians for Global Action (PGA) Panel on Gender Justice and Women’s Rights, Istanbul, Turkey, 24 October. miriam.com.ph/newsblog/?p=489&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Blog post&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Author, A. (Year, date month published). Article title. Name of Blog. URL&lt;br /&gt;
Milstein, S. (2013, 24 March). I have a few things to say about Adria. Dogs and Shoes. www.dogsandshoes.com/2013/03/adria.html&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Web page&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you are citing information about an organisation, programme, campaign, etc. from a website, you can simply provide the URL.&lt;br /&gt;
www.takebackthetech.net/page/about-campaign&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Online video (YouTube, Vimeo, etc.)&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If the video is mentioned in the text, simply provide the URL.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Personal communication (interview, email, etc.)&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Brief description, Date. Interview with APC Executive Director Anriette Esterhuysen, 21 March 2014.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;If the same reference is cited more than once...&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If the reference is the same as the one cited right before it: Ibid.&lt;br /&gt;
If the reference is the same as one cited earlier: Author, A. (Year or Year, date month). Op. cit.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;[http://www.apc.org/en/system/files/APC_ReferenceGuide_2-0.pdf Read or download the Reference guide in pdf format]&#039;&#039;&#039;&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=490</id>
		<title>Secure online communications</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Secure_online_communications&amp;diff=490"/>
		<updated>2015-05-22T07:55:25Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:security.jpg|thumb|200px]]&lt;br /&gt;
&lt;br /&gt;
The Association for Progressive Communications (APC) Security Policy governs the use of computer equipment and portable devices by APC staff, and provides cursory guidance on how to maintain privacy and manage sensitive information when handling work-related data.&lt;br /&gt;
&lt;br /&gt;
Below is an overview of some of the DOs, DON&#039;Ts and best practices, “CONSIDERATIONS,” that are covered more in depth beginning on page four. The DOs and DON&#039;Ts are baseline obligations for APC staff, which must be followed in compliance with APC policy.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Executive Summary&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DOs&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Configure your email client to communicate with the server via secure SSL/TSL connection.&lt;br /&gt;
*Have a PGP/GPG key that can be used for encrypting email or other sensitive data stored on your computer. PGP/GPG keys should have a passphrase which is, at minimum, two words long. Encrypt sensitive data on portable devices.&lt;br /&gt;
*Follow APC&#039;s staff policy for exchanging email communication and guidelines for encrypting emails. When accessing your email with a web browser (e.g. APC webmail) connect through a secure interface using the protocol https.&lt;br /&gt;
*Follow APC&#039;s guidelines for mailing lists and encrypted mailing lists.&lt;br /&gt;
*Use OwnCloud for cloud data storage and data sharing&lt;br /&gt;
*Use OwnCloud calendaring to host shared calendars (replacing Google Calendars)&lt;br /&gt;
*Share documents via OwnCloud (for asynchronous collaboration) or use Etherpads for (synchronous) collaborative document editing.&lt;br /&gt;
*Use Jitsi for messaging/VoIP communication whenever possible. Use Jitsi for all messaging/VoIP communication in APC team. &lt;br /&gt;
*Delete your chat history in Skype as soon as you end a chat that contains compromising information. Consider switching off your chat history altogether so it is never logged.&lt;br /&gt;
*Use and periodically update anti-virus software on your computer.&lt;br /&gt;
*Clearly state what you will do with any sensitive information you are collecting, such as logistics details (passport numbers), and how it will be stored.&lt;br /&gt;
*Install LibreOffice or other office package that supports open format standards1.&lt;br /&gt;
*Employ a passphrase protected screensaver that automatically activates after 10 minutes of inactivity (applies both to computer and portable devices). &lt;br /&gt;
*Create an OpenID account on the apc.org website to use as an authentication mechanism for all APC online spaces. &lt;br /&gt;
*Install and be able to use anonymisation software such as TOR or Orbot for anonymous web browsing on your desktop and portable devices. &lt;br /&gt;
*Follow APC’s policy for work relating to A/V recordings and digital stories. &lt;br /&gt;
*Treat suspicious email communication as potentially hazardous to our equipment and data. Don’t disclose even mildly sensitive information to anyone about whose identity you have a least doubt.&lt;br /&gt;
*Ensure that no unauthorized entity has access to your computing devices or data stored on them, including back up devices. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;DON’Ts&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Use Skype on other people&#039;s machines for conversations that contain highly compromising information or conversations that involve participants whose identify must be kept secret.&lt;br /&gt;
*Use Skype for communication within APC team, unless it is absolutely necessary.&lt;br /&gt;
*Collect data that are considered even mildly sensitive without using APC&#039;s LimeSurvey online survey tool, encrypted email communication or other secure and encrypted means.&lt;br /&gt;
*Use Microsoft Outlook or other email clients shipped with Windows or with the Microsoft Office package. Additionally, don’t use Microsoft Internet Explorer or other browsers packaged with Windows, unless it is absolutely necessary.&lt;br /&gt;
*Store passphrases for access to APC services, APC online spaces or other APC data in email messages, text files, in your browser&#039;s password manager, etc., or on paper sheets or post-it notes. Only store passphrases on your computer in an encrypted format.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;CONSIDER&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
*Finding out whether or not the use of encryption in internet communication is legal in your country of residence.&lt;br /&gt;
*Educating yourself on issues of privacy related to communication in encrypted lists.&lt;br /&gt;
*Following this guide to increase security when using “the cloud” or an online storage system such as Dropbox.&lt;br /&gt;
*Using an open source password management software such as Keepass if you can not remember all your passphrases.&lt;br /&gt;
*Backing up your data at least once per week, if not more often. Back up media must be stored in a safe place. Additionally, all confidential or sensitive *APC-related back up data should be encrypted. &lt;br /&gt;
*Prioritising free and open source software whenever possible.&lt;br /&gt;
*Connecting to web content via https connection whenever possible. &lt;br /&gt;
*Follow APC&#039;s guidelines for establishing a secure connection if you cannot use a wired connection to get online from your office or home.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=375</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=375"/>
		<updated>2015-05-20T12:39:42Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Technical tips for using the picture in GenderIT.org */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:photo.jpg|thumb|200px]]&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, have a look at [http://photo.net/equipment/digital/basics/ this]. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available [https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People here]. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event can be found [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tools&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An [http://www.gimp.org/ open source alternative] to Photoshop is available, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the [https://guardianproject.info/apps/obscuracam/ ObscuraCam app] to protect the identity of those whose pictures you take. This free app removes location and other identifying material from the photos.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Methods&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see [http://www.hongkiat.com/blog/force-perspective-photos/ HongKiat]).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using an [http://www.webresizer.com/resizer/ online tool] You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=374</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=374"/>
		<updated>2015-05-20T12:38:44Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Checklist */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:photo.jpg|thumb|200px]]&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, have a look at [http://photo.net/equipment/digital/basics/ this]. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available [https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People here]. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event can be found [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tools&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An [http://www.gimp.org/ open source alternative] to Photoshop is available, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the [https://guardianproject.info/apps/obscuracam/ ObscuraCam app] to protect the identity of those whose pictures you take. This free app removes location and other identifying material from the photos.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Methods&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see [http://www.hongkiat.com/blog/force-perspective-photos/ HongKiat]).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=373</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=373"/>
		<updated>2015-05-20T12:37:00Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Technical tools */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:photo.jpg|thumb|200px]]&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, have a look at [http://photo.net/equipment/digital/basics/ this]. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available [https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People here]. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event can be found [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tools&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An [http://www.gimp.org/ open source alternative] to Photoshop is available, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the [https://guardianproject.info/apps/obscuracam/ ObscuraCam app] to protect the identity of those whose pictures you take. This free app removes location and other identifying material from the photos.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Methods&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see http://www.hongkiat.com/blog/force-perspective-photos/).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=372</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=372"/>
		<updated>2015-05-20T12:36:15Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Technical tools */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:photo.jpg|thumb|200px]]&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, have a look at [http://photo.net/equipment/digital/basics/ this]. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available [https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People here]. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event can be found [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tools&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An open source alternative to Photoshop is available at http://www.gimp.org/, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the [https://guardianproject.info/apps/obscuracam/ ObscuraCam app] to protect the identity of those whose pictures you take. This free app removes location and other identifying material from the photos.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Methods&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see http://www.hongkiat.com/blog/force-perspective-photos/).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=371</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=371"/>
		<updated>2015-05-20T12:35:07Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Overview */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:photo.jpg|thumb|200px]]&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, have a look at [http://photo.net/equipment/digital/basics/ this]. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available [https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People here]. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event can be found [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tools&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An open source alternative to Photoshop is available at http://www.gimp.org/, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the ObscuraCam app to protect the identity of those whose pictures you take. This app removes location and other identifying material from the photos. Available free at https://guardianproject.info/apps/obscuracam/.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Methods&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see http://www.hongkiat.com/blog/force-perspective-photos/).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=370</id>
		<title>How to deal with vulnerable interviewees</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=370"/>
		<updated>2015-05-20T12:29:53Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: /* Overview */&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;[[File:aid.jpg|thumb|200px]]&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
This guide contains resources and important considerations to be put in place when conducting interviews, particularly with survivors of violence and sexual harassment.&lt;br /&gt;
&lt;br /&gt;
At GenderIT.org, our priorities include giving space to voices from the global South and to the voices of marginalised communities, including victims of violence and sexual harassment. This means an awareness of both our own power and the power of others – including ways in which our actions can enhance or detract from the power of the person whose voice is being heard.&lt;br /&gt;
&lt;br /&gt;
This means an awareness of the vulnerabilities of those who have experienced sexual or other violence or harassment – giving them the power to decide how anonymous they wish to be, for example, allowing them to choose how to refer to themselves (as a survivor, as a victim etc.), giving them ample space and time to tell, write or edit their story, and time for them to be happy about how it will be shared (if it is to be shared).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
A key resource here is the [http://blog.witness.org/2013/08/new-how-to-guide-for-interviewing-survivors-of-sexual-and-gender-based-violence/ Witness guide] to interviewing survivors of sexual assault. Violence survivors include those in positions of power and authority and if you are speaking to them about their experience of violence, particularly sexual violence or assault, it is still important to follow these principles.&lt;br /&gt;
&lt;br /&gt;
Another important document is the [http://www.who.int/gender/documents/violence/who_fch_gwh_01.1/en/ WHO guide] on research on domestic violence available in English, French and Spanish.&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;WHO Guiding Principles for Domestic Violence Research&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
a. The safety of respondents and the research team is paramount, and should guide all project decisions.&lt;br /&gt;
&lt;br /&gt;
b. Prevalence studies need to be methodologically sound and to build upon current re- search experience about how to minimize the under-reporting of violence.&lt;br /&gt;
&lt;br /&gt;
c. Protecting confidentiality is essential to ensure both women’s safety and data quality.&lt;br /&gt;
&lt;br /&gt;
d. All research team members should be care fully selected and receive specialized training and on-going support.&lt;br /&gt;
&lt;br /&gt;
e. The study design must include actions aimed at reducing any possible distress caused to the participants by the research.&lt;br /&gt;
&lt;br /&gt;
f. Fieldworkers should be trained to refer women requesting assistance to available local services and sources of support. Where few resources exist, it may be necessary for the study to create short-term support mechanisms.&lt;br /&gt;
&lt;br /&gt;
g. Researchers and donors have an ethical obligation to help ensure that their findings are properly interpreted and used to advance policy and intervention development.&lt;br /&gt;
&lt;br /&gt;
h. Violence questions should only be incorporated into surveys designed for other purposes when ethical and methodological requirements can be met.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Drawing from these principles&#039;&#039;&#039;, Athar, Rima  &amp;quot;VI. Ethics in the Research Process&amp;quot; In: Research Design for “From impunity to justice: Exploring corporate and legal remedies for technology-related violence against women” research  (APC, November 2013) &#039;&#039;&#039;drew up these guidelines&#039;&#039;&#039;:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Obtaining Informed Consent&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Interviewees are treated as human beings with agency-capable of determining and deciding what is best for them and not mere subjects or as means to extract data.&lt;br /&gt;
* As with respect to their self-determination, a.) the nature of the interview, b.) any risks and benefits which might result from their participation, c.) their rights to refuse to participate or to end their participation without penalty, and d.) the means by which they can contact the writer shall be first explained to potential interviews in language they understand. &lt;br /&gt;
* It is imperative to stress that consent is voluntary, and as such can be withdrawn at any time prior to publication. Writers must ensure the possibility for interviewees to withdraw their consent (at minimum by providing a way to contact the writer)&lt;br /&gt;
* Only those who shall express willingness shall be interviewed.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing support&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees stand to face positive as well as negative effects from their involvement/participation. The writer shall ensure that interviewees not only benefit from the publication of the interview but also from the actual conduct of the interview itself. A good interviewer pays careful attention to the interaction with interviewees as this is critical in remaining aware of potential hierarchies and associated power dynamics that may arise.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;During the interview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Use sensitive and appropriate methods. The writer shall be in close collaboration with the interviewee and is enjoined not just have an instrumental but genuine relationship with them, recognising that there is no ‘detachment’ from the interviewee’s problems. Treating all people as human beings will entail a degree of emotional involvement and create bond between the interviewer and respondent that can potentially empower both, without creating or fostering dependence.  &lt;br /&gt;
&lt;br /&gt;
It entails listening to the interviewee with sensitivity. Those who have experienced violation and trauma may react poorly to questions around their experiences, and the writer should be able to recognize this and provide an appropriate response.  &lt;br /&gt;
&lt;br /&gt;
During the course of the interview, the interviewer should introduce any section enquiring about violence carefully, forewarning the respondent about the nature of the questions and giving her the opportunity to either stop the interview, or not to answer these questions.&lt;br /&gt;
&lt;br /&gt;
Collaboration means also that the interviewer is willing to self-disclose- to share her/his experience if the interviewee requests.&lt;br /&gt;
&lt;br /&gt;
At all times refrain from any conduct or statement that has the effect or impact of blaming the woman for the violence she has experienced. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Boundaries&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers shall take steps to address other needs of the interviewee such as counselling, psycho-social and emotional support through referrals to local and culturally appropriate resources. However, be explicit about limitations and do not make promises that cannot be fulfilled.&lt;br /&gt;
Interviewers should not take on a role as counsellor.&lt;br /&gt;
&lt;br /&gt;
Interviewers should be open to assisting the respondent if asked, within the limits of these protocols, but should not tell her what to do or to take on the personal burden of trying to “save her”. &lt;br /&gt;
&lt;br /&gt;
Variations in individual and cultural understandings of what constitutes violence against women (including rape, marital rape, assault, harassment, etc.), are to be expected. The writer’s role in working with victims/survivors of violence (as well as all other interviewees) is to bring out their own understandings of the violence they experienced (or witnessed or participated in), through questions and sharing of perspectives that provide room for conversation around different views; rather than try to stick with a pre-determined definition/understanding of what constitutes violence, rape, harassment, assault, etc. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Providing referrals to social support services&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Prior to conducting the interview, research potential providers of support, which may include existing health, legal and social services and educational resources in the community, and less formal providers of support (including community representatives, religious leaders, traditional healers and women’s organizations).&lt;br /&gt;
&lt;br /&gt;
A list of such resources should be made available to the interviewee, but only provided if and when asked for. Such a list should be framed as resources for “women’s heath” broadly, to miminize risks to interviewees that may result from possessing such a list. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Ensuring confidentiality&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
All involved, from the interviewer to the editor, have the duty to assure the women that their identities will be protected, if this has been agreed upon. &lt;br /&gt;
Confidentiality means that participants’ cannot be identified by others, so any identifying information (such as location etc) is to be stripped from all materials pertaining to the interview, including photographs and recordings.&lt;br /&gt;
Interviewers shall determine what kind of information and details to share, no matter how crucial the women’s revelation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Location of interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviews cost the interviewee time and energy. Therefore, they should be carried out in settings that are most convenient for them.&lt;br /&gt;
Logistics planning should include consideration of respondent safety. &lt;br /&gt;
&lt;br /&gt;
Interviews should be conducted in complete privacy. In cases where privacy cannot be ensured, interviews should be rescheduled or relocated. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Recording the interview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Audio-recordings should be made for in-depth interviews with survivors of violence.&lt;br /&gt;
&lt;br /&gt;
The permission of the respondents should be sought before taping. The name of the respondent should not be included in the audio-recording at any stage. &lt;br /&gt;
&lt;br /&gt;
Respondents should be informed of who will have access to the tapes and for how long they will be kept. &lt;br /&gt;
&lt;br /&gt;
1. In this case, only interviewer (&amp;amp; transcriber, if different from the interviewer) will have access to the audio-recording. &lt;br /&gt;
&lt;br /&gt;
2. The audio-recordings should be kept in encrypted file1on an external hard drive, in a locked cabinet, with limited access. &lt;br /&gt;
&lt;br /&gt;
3. The audio-recording should be destroyed after publication. &lt;br /&gt;
&lt;br /&gt;
Extreme caution must be taken to securely transport raw data from locations of interviews to places where data are processed. That applies to all recoding media.&lt;br /&gt;
An encryption software must be used during all data storage to ensure security of the data. (2) &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Transcribing the interviews&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
The importance of recording and transcribing the interviews is to ensure that women’s experiences and perspectives are shared in their own words. Relying on the interviewers’ notes/memories may be insufficient to ensure quality of data and its analysis. &lt;br /&gt;
&lt;br /&gt;
Transcribing the interviews also enables the respondents the option of reviewing the information they have provided if they wish, and choosing which information they consent to share. &lt;br /&gt;
&lt;br /&gt;
Particular care should be taken to ensure that no one community or individual can be identified.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Think before you upload your story to the internet and if your security or the security of others could be compromised by others seeing it or not.&lt;br /&gt;
&lt;br /&gt;
* If you or the interviewee don&#039;t want your face shown, or your voice clearly recognisable, you can use tools to help guarantee anonymity (Audacity has tools for audio, ObscuraCam for video).&lt;br /&gt;
&lt;br /&gt;
* Never use an image of a person without that person&#039;s permission, regardless of who owns the image.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;(1) Use encryption software (Truecrypt) to ensure security of the file.&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;(2) Truecrypt is a recommended free open source application that can be used for encrypting data on your computers and portable devices.&#039;&#039;&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=363</id>
		<title>How to deal with vulnerable interviewees</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=363"/>
		<updated>2015-05-20T12:06:59Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;br /&gt;
== &#039;&#039;&#039;Introduction&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
This guide contains resources and important considerations to be put in place when conducting interviews, particularly with survivors of violence and sexual harassment.&lt;br /&gt;
&lt;br /&gt;
At GenderIT.org, our priorities include giving space to voices from the global South and to the voices of marginalised communities, including victims of violence and sexual harassment. This means an awareness of both our own power and the power of others – including ways in which our actions can enhance or detract from the power of the person whose voice is being heard.&lt;br /&gt;
&lt;br /&gt;
This means an awareness of the vulnerabilities of those who have experienced sexual or other violence or harassment – giving them the power to decide how anonymous they wish to be, for example, allowing them to choose how to refer to themselves (as a survivor, as a victim etc.), giving them ample space and time to tell, write or edit their story, and time for them to be happy about how it will be shared (if it is to be shared).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Overview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
A key resource here is the Witness guide to interviewing surivors of sexual assault&lt;br /&gt;
(http://blog.witness.org/2013/08/new-how-to-guide-for-interviewing-survivors-of-sexual-and-gender-based-violence/). Violence survivors include those in positions of power and authority and if you are speaking to them about their experience of violence, particularly sexual violence or assault, it is still important to follow these principles.&lt;br /&gt;
&lt;br /&gt;
Another important document is the WHO guide on research on domestic violence (http://www.who.int/gender/documents/violence/who_fch_gwh_01.1/en/) available in English, French and Spanish.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;WHO Guiding Principles for Domestic Violence Research&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
a. The safety of respondents and the research team is paramount, and should guide all project decisions.&lt;br /&gt;
&lt;br /&gt;
b. Prevalence studies need to be methodologically sound and to build upon current re- search experience about how to minimize the under-reporting of violence.&lt;br /&gt;
&lt;br /&gt;
c. Protecting confidentiality is essential to ensure both women’s safety and data quality.&lt;br /&gt;
&lt;br /&gt;
d. All research team members should be care fully selected and receive specialized training and on-going support.&lt;br /&gt;
&lt;br /&gt;
e. The study design must include actions aimed at reducing any possible distress caused to the participants by the research.&lt;br /&gt;
&lt;br /&gt;
f. Fieldworkers should be trained to refer women requesting assistance to available local services and sources of support. Where few resources exist, it may be necessary for the study to create short-term support mechanisms.&lt;br /&gt;
&lt;br /&gt;
g. Researchers and donors have an ethical obligation to help ensure that their findings are properly interpreted and used to advance policy and intervention development.&lt;br /&gt;
&lt;br /&gt;
h. Violence questions should only be incorporated into surveys designed for other purposes when ethical and methodological requirements can be met.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Drawing from these principles&#039;&#039;&#039;, Athar, Rima  &amp;quot;VI. Ethics in the Research Process&amp;quot; In: Research Design for “From impunity to justice: Exploring corporate and legal remedies for technology-related violence against women” research  (APC, November 2013) &#039;&#039;&#039;drew up these guidelines&#039;&#039;&#039;:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Obtaining Informed Consent&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Interviewees are treated as human beings with agency-capable of determining and deciding what is best for them and not mere subjects or as means to extract data.&lt;br /&gt;
* As with respect to their self-determination, a.) the nature of the interview, b.) any risks and benefits which might result from their participation, c.) their rights to refuse to participate or to end their participation without penalty, and d.) the means by which they can contact the writer shall be first explained to potential interviews in language they understand. &lt;br /&gt;
* It is imperative to stress that consent is voluntary, and as such can be withdrawn at any time prior to publication. Writers must ensure the possibility for interviewees to withdraw their consent (at minimum by providing a way to contact the writer)&lt;br /&gt;
* Only those who shall express willingness shall be interviewed.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing support&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees stand to face positive as well as negative effects from their involvement/participation. The writer shall ensure that interviewees not only benefit from the publication of the interview but also from the actual conduct of the interview itself. A good interviewer pays careful attention to the interaction with interviewees as this is critical in remaining aware of potential hierarchies and associated power dynamics that may arise.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;During the interview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Use sensitive and appropriate methods. The writer shall be in close collaboration with the interviewee and is enjoined not just have an instrumental but genuine relationship with them, recognising that there is no ‘detachment’ from the interviewee’s problems. Treating all people as human beings will entail a degree of emotional involvement and create bond between the interviewer and respondent that can potentially empower both, without creating or fostering dependence.  &lt;br /&gt;
&lt;br /&gt;
It entails listening to the interviewee with sensitivity. Those who have experienced violation and trauma may react poorly to questions around their experiences, and the writer should be able to recognize this and provide an appropriate response.  &lt;br /&gt;
&lt;br /&gt;
During the course of the interview, the interviewer should introduce any section enquiring about violence carefully, forewarning the respondent about the nature of the questions and giving her the opportunity to either stop the interview, or not to answer these questions.&lt;br /&gt;
&lt;br /&gt;
Collaboration means also that the interviewer is willing to self-disclose- to share her/his experience if the interviewee requests.&lt;br /&gt;
&lt;br /&gt;
At all times refrain from any conduct or statement that has the effect or impact of blaming the woman for the violence she has experienced. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Boundaries&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Writers shall take steps to address other needs of the interviewee such as counselling, psycho-social and emotional support through referrals to local and culturally appropriate resources. However, be explicit about limitations and do not make promises that cannot be fulfilled.&lt;br /&gt;
Interviewers should not take on a role as counsellor.&lt;br /&gt;
&lt;br /&gt;
Interviewers should be open to assisting the respondent if asked, within the limits of these protocols, but should not tell her what to do or to take on the personal burden of trying to “save her”. &lt;br /&gt;
&lt;br /&gt;
Variations in individual and cultural understandings of what constitutes violence against women (including rape, marital rape, assault, harassment, etc.), are to be expected. The writer’s role in working with victims/survivors of violence (as well as all other interviewees) is to bring out their own understandings of the violence they experienced (or witnessed or participated in), through questions and sharing of perspectives that provide room for conversation around different views; rather than try to stick with a pre-determined definition/understanding of what constitutes violence, rape, harassment, assault, etc. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Providing referrals to social support services&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Prior to conducting the interview, research potential providers of support, which may include existing health, legal and social services and educational resources in the community, and less formal providers of support (including community representatives, religious leaders, traditional healers and women’s organizations).&lt;br /&gt;
&lt;br /&gt;
A list of such resources should be made available to the interviewee, but only provided if and when asked for. Such a list should be framed as resources for “women’s heath” broadly, to miminize risks to interviewees that may result from possessing such a list. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Ensuring confidentiality&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
All involved, from the interviewer to the editor, have the duty to assure the women that their identities will be protected, if this has been agreed upon. &lt;br /&gt;
Confidentiality means that participants’ cannot be identified by others, so any identifying information (such as location etc) is to be stripped from all materials pertaining to the interview, including photographs and recordings.&lt;br /&gt;
Interviewers shall determine what kind of information and details to share, no matter how crucial the women’s revelation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Location of interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviews cost the interviewee time and energy. Therefore, they should be carried out in settings that are most convenient for them.&lt;br /&gt;
Logistics planning should include consideration of respondent safety. &lt;br /&gt;
&lt;br /&gt;
Interviews should be conducted in complete privacy. In cases where privacy cannot be ensured, interviews should be rescheduled or relocated. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Recording the interview&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Audio-recordings should be made for in-depth interviews with survivors of violence.&lt;br /&gt;
&lt;br /&gt;
The permission of the respondents should be sought before taping. The name of the respondent should not be included in the audio-recording at any stage. &lt;br /&gt;
&lt;br /&gt;
Respondents should be informed of who will have access to the tapes and for how long they will be kept. &lt;br /&gt;
&lt;br /&gt;
1. In this case, only interviewer (&amp;amp; transcriber, if different from the interviewer) will have access to the audio-recording. &lt;br /&gt;
&lt;br /&gt;
2. The audio-recordings should be kept in encrypted file1on an external hard drive, in a locked cabinet, with limited access. &lt;br /&gt;
&lt;br /&gt;
3. The audio-recording should be destroyed after publication. &lt;br /&gt;
&lt;br /&gt;
Extreme caution must be taken to securely transport raw data from locations of interviews to places where data are processed. That applies to all recoding media.&lt;br /&gt;
An encryption software must be used during all data storage to ensure security of the data. (2) &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Transcribing the interviews&#039;&#039;&#039; ==&lt;br /&gt;
 &lt;br /&gt;
&lt;br /&gt;
The importance of recording and transcribing the interviews is to ensure that women’s experiences and perspectives are shared in their own words. Relying on the interviewers’ notes/memories may be insufficient to ensure quality of data and its analysis. &lt;br /&gt;
&lt;br /&gt;
Transcribing the interviews also enables the respondents the option of reviewing the information they have provided if they wish, and choosing which information they consent to share. &lt;br /&gt;
&lt;br /&gt;
Particular care should be taken to ensure that no one community or individual can be identified.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
== &#039;&#039;&#039;Checklist&#039;&#039;&#039; ==&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
* Think before you upload your story to the internet and if your security or the security of others could be compromised by others seeing it or not.&lt;br /&gt;
&lt;br /&gt;
* If you or the interviewee don&#039;t want your face shown, or your voice clearly recognisable, you can use tools to help guarantee anonymity (Audacity has tools for audio, ObscuraCam for video).&lt;br /&gt;
&lt;br /&gt;
* Never use an image of a person without that person&#039;s permission, regardless of who owns the image.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;(1) Use encryption software (Truecrypt) to ensure security of the file.&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;(2) Truecrypt is a recommended free open source application that can be used for encrypting data on your computers and portable devices.&#039;&#039;&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=329</id>
		<title>How to deal with vulnerable interviewees</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=329"/>
		<updated>2015-05-20T11:40:19Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Dealing with vulnerable interviewees&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
This guide contains resources and important considerations to be put in place when conducting interviews, particularly with survivors of violence and sexual harassment.&lt;br /&gt;
&lt;br /&gt;
At GenderIT.org, our priorities include giving space to voices from the global South and to the voices of marginalised communities, including victims of violence and sexual harassment. This means an awareness of both our own power and the power of others – including ways in which our actions can enhance or detract from the power of the person whose voice is being heard.&lt;br /&gt;
&lt;br /&gt;
This means an awareness of the vulnerabilities of those who have experienced sexual or other violence or harassment – giving them the power to decide how anonymous they wish to be, for example, allowing them to choose how to refer to themselves (as a survivor, as a victim etc.), giving them ample space and time to tell, write or edit their story, and time for them to be happy about how it will be shared (if it is to be shared).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
A key resource here is the Witness guide to interviewing surivors of sexual assault&lt;br /&gt;
(http://blog.witness.org/2013/08/new-how-to-guide-for-interviewing-survivors-of-sexual-and-gender-based-violence/). Violence survivors include those in positions of power and authority and if you are speaking to them about their experience of violence, particularly sexual violence or assault, it is still important to follow these principles.&lt;br /&gt;
&lt;br /&gt;
Another important document is the WHO guide on research on domestic violence (http://www.who.int/gender/documents/violence/who_fch_gwh_01.1/en/) available in English, French and Spanish.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;WHO Guiding Principles for Domestic Violence Research&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
a. The safety of respondents and the research team is paramount, and should guide all project decisions.&lt;br /&gt;
&lt;br /&gt;
b. Prevalence studies need to be methodologically sound and to build upon current re- search experience about how to minimize the under-reporting of violence.&lt;br /&gt;
&lt;br /&gt;
c. Protecting confidentiality is essential to ensure both women’s safety and data quality.&lt;br /&gt;
&lt;br /&gt;
d. All research team members should be care fully selected and receive specialized training and on-going support.&lt;br /&gt;
&lt;br /&gt;
e. The study design must include actions aimed at reducing any possible distress caused to the participants by the research.&lt;br /&gt;
&lt;br /&gt;
f. Fieldworkers should be trained to refer women requesting assistance to available local services and sources of support. Where few resources exist, it may be necessary for the study to create short-term support mechanisms.&lt;br /&gt;
&lt;br /&gt;
g. Researchers and donors have an ethical obligation to help ensure that their findings are properly interpreted and used to advance policy and intervention development.&lt;br /&gt;
&lt;br /&gt;
h. Violence questions should only be incorporated into surveys designed for other purposes when ethical and methodological requirements can be met.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Drawing from these principles&#039;&#039;&#039;, Athar, Rima  &amp;quot;VI. Ethics in the Research Process&amp;quot; In: Research Design for “From impunity to justice: Exploring corporate and legal remedies for technology-related violence against women” research  (APC, November 2013) &#039;&#039;&#039;drew up these guidelines&#039;&#039;&#039;:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Obtaining Informed Consent&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* Interviewees are treated as human beings with agency-capable of determining and deciding what is best for them and not mere subjects or as means to extract data.&lt;br /&gt;
* As with respect to their self-determination, a.) the nature of the interview, b.) any risks and benefits which might result from their participation, c.) their rights to refuse to participate or to end their participation without penalty, and d.) the means by which they can contact the writer shall be first explained to potential interviews in language they understand. &lt;br /&gt;
* It is imperative to stress that consent is voluntary, and as such can be withdrawn at any time prior to publication. Writers must ensure the possibility for interviewees to withdraw their consent (at minimum by providing a way to contact the writer)&lt;br /&gt;
* Only those who shall express willingness shall be interviewed.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing support&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees stand to face positive as well as negative effects from their involvement/participation. The writer shall ensure that interviewees not only benefit from the publication of the interview but also from the actual conduct of the interview itself. A good interviewer pays careful attention to the interaction with interviewees as this is critical in remaining aware of potential hierarchies and associated power dynamics that may arise.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;During the Interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Use sensitive and appropriate methods. The writer shall be in close collaboration with the interviewee and is enjoined not just have an instrumental but genuine relationship with them, recognising that there is no ‘detachment’ from the interviewee’s problems. Treating all people as human beings will entail a degree of emotional involvement and create bond between the interviewer and respondent that can potentially empower both, without creating or fostering dependence.  &lt;br /&gt;
&lt;br /&gt;
It entails listening to the interviewee with sensitivity. Those who have experienced violation and trauma may react poorly to questions around their experiences, and the writer should be able to recognize this and provide an appropriate response.  &lt;br /&gt;
&lt;br /&gt;
During the course of the interview, the interviewer should introduce any section enquiring about violence carefully, forewarning the respondent about the nature of the questions and giving her the opportunity to either stop the interview, or not to answer these questions.&lt;br /&gt;
Collaboration means also that the interviewer is willing to self-disclose- to share her/his experience if the interviewee requests.&lt;br /&gt;
At all times refrain from any conduct or statement that has the effect or impact of blaming the woman for the violence she has experienced. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Boundaries&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Writers shall take steps to address other needs of the interviewee such as counselling, psycho-social and emotional support through referrals to local and culturally appropriate resources. However, be explicit about limitations and do not make promises that cannot be fulfilled.&lt;br /&gt;
Interviewers should not take on a role as counsellor.&lt;br /&gt;
&lt;br /&gt;
Interviewers should be open to assisting the respondent if asked, within the limits of these protocols, but should not tell her what to do or to take on the personal burden of trying to “save her”. &lt;br /&gt;
&lt;br /&gt;
Variations in individual and cultural understandings of what constitutes violence against women (including rape, marital rape, assault, harassment, etc.), are to be expected. The writer’s role in working with victims/survivors of violence (as well as all other interviewees) is to bring out their own understandings of the violence they experienced (or witnessed or participated in), through questions and sharing of perspectives that provide room for conversation around different views; rather than try to stick with a pre-determined definition/understanding of what constitutes violence, rape, harassment, assault, etc. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing referrals to social support services&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Prior to conducting the interview, research potential providers of support, which may include existing health, legal and social services and educational resources in the community, and less formal providers of support (including community representatives, religious leaders, traditional healers and women’s organizations).&lt;br /&gt;
A list of such resources should be made available to the interviewee, but only provided if and when asked for. Such a list should be framed as resources for “women’s heath” broadly, to miminize risks to interviewees that may result from possessing such a list. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Ensuring Confidentiality&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
All involved, from the interviewer to the editor, have the duty to assure the women that their identities will be protected, if this has been agreed upon. &lt;br /&gt;
Confidentiality means that participants’ cannot be identified by others, so any identifying information (such as location etc) is to be stripped from all materials pertaining to the interview, including photographs and recordings.&lt;br /&gt;
Interviewers shall determine what kind of information and details to share, no matter how crucial the women’s revelation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Location of interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviews cost the interviewee time and energy. Therefore, they should be carried out in settings that are most convenient for them.&lt;br /&gt;
Logistics planning should include consideration of respondent safety. &lt;br /&gt;
Interviews should be conducted in complete privacy. In cases where privacy cannot be ensured, interviews should be rescheduled or relocated. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Recording the Interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Audio-recordings should be made for in-depth interviews with survivors of violence.&lt;br /&gt;
&lt;br /&gt;
The permission of the respondents should be sought before taping. The name of the respondent should not be included in the audio-recording at any stage. &lt;br /&gt;
Respondents should be informed of who will have access to the tapes and for how long they will be kept. &lt;br /&gt;
&lt;br /&gt;
1. In this case, only interviewer (&amp;amp; transcriber, if different from the interviewer) will have access to the audio-recording. &lt;br /&gt;
&lt;br /&gt;
2. The audio-recordings should be kept in encrypted file1on an external hard drive, in a locked cabinet, with limited access. &lt;br /&gt;
&lt;br /&gt;
3. The audio-recording should be destroyed after publication. &lt;br /&gt;
&lt;br /&gt;
Extreme caution must be taken to securely transport raw data from locations of interviews to places where data are processed. That applies to all recoding media.&lt;br /&gt;
An encryption software must be used during all data storage to ensure security of the data. (2) &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Transcribing the Interviews&#039;&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
The importance of recording and transcribing the interviews is to ensure that women’s experiences and perspectives are shared in their own words. Relying on the interviewers’ notes/memories may be insufficient to ensure quality of data and its analysis. &lt;br /&gt;
Transcribing the interviews also enables the respondents the option of reviewing the information they have provided if they wish, and choosing which information they consent to share. &lt;br /&gt;
&lt;br /&gt;
Particular care should be taken to ensure that no one community or individual can be identified.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* think before you upload your story to the internet and if your security or the security of others could be compromised by others seeing it or not.&lt;br /&gt;
* if you or the interviewee don&#039;t want your face shown, or your voice clearly recognisable, you can use tools to help guarantee anonymity (Audacity has tools for audio, ObscuraCam for video).&lt;br /&gt;
* never use an image of a person without that person&#039;s permission, regardless of who owns the image.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;(1) Use encryption software (Truecrypt) to ensure security of the file.&#039;&#039;&lt;br /&gt;
&#039;&#039;(2) Truecrypt is a recommended free open source application that can be used for encrypting data on your computers and portable devices.&#039;&#039;&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=328</id>
		<title>How to deal with vulnerable interviewees</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=328"/>
		<updated>2015-05-20T11:36:24Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Dealing with vulnerable interviewees&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
This guide contains resources and important considerations to be put in place when conducting interviews, particularly with survivors of violence and sexual harassment.&lt;br /&gt;
&lt;br /&gt;
At GenderIT.org, our priorities include giving space to voices from the global South and to the voices of marginalised communities, including victims of violence and sexual harassment. This means an awareness of both our own power and the power of others – including ways in which our actions can enhance or detract from the power of the person whose voice is being heard.&lt;br /&gt;
&lt;br /&gt;
This means an awareness of the vulnerabilities of those who have experienced sexual or other violence or harassment – giving them the power to decide how anonymous they wish to be, for example, allowing them to choose how to refer to themselves (as a survivor, as a victim etc.), giving them ample space and time to tell, write or edit their story, and time for them to be happy about how it will be shared (if it is to be shared).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
A key resource here is the Witness guide to interviewing surivors of sexual assault&lt;br /&gt;
(http://blog.witness.org/2013/08/new-how-to-guide-for-interviewing-survivors-of-sexual-and-gender-based-violence/). Violence survivors include those in positions of power and authority and if you are speaking to them about their experience of violence, particularly sexual violence or assault, it is still important to follow these principles.&lt;br /&gt;
&lt;br /&gt;
Another important document is the WHO guide on research on domestic violence (http://www.who.int/gender/documents/violence/who_fch_gwh_01.1/en/) available in English, French and Spanish.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;WHO Guiding Principles for Domestic Violence Research&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
a. The safety of respondents and the research team is paramount, and should guide all project decisions.&lt;br /&gt;
&lt;br /&gt;
b. Prevalence studies need to be methodologically sound and to build upon current re- search experience about how to minimize the under-reporting of violence.&lt;br /&gt;
&lt;br /&gt;
c. Protecting confidentiality is essential to ensure both women’s safety and data quality.&lt;br /&gt;
&lt;br /&gt;
d. All research team members should be care fully selected and receive specialized training and on-going support.&lt;br /&gt;
&lt;br /&gt;
e. The study design must include actions aimed at reducing any possible distress caused to the participants by the research.&lt;br /&gt;
&lt;br /&gt;
f. Fieldworkers should be trained to refer women requesting assistance to available local services and sources of support. Where few resources exist, it may be necessary for the study to create short-term support mechanisms.&lt;br /&gt;
&lt;br /&gt;
g. Researchers and donors have an ethical obligation to help ensure that their findings are properly interpreted and used to advance policy and intervention development.&lt;br /&gt;
&lt;br /&gt;
h. Violence questions should only be incorporated into surveys designed for other purposes when ethical and methodological requirements can be met.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Drawing from these principles&#039;&#039;&#039;, Athar, Rima  &amp;quot;VI. Ethics in the Research Process&amp;quot; In: Research Design for “From impunity to justice: Exploring corporate and legal remedies for technology-related violence against women” research  (APC, November 2013) &#039;&#039;&#039;drew up these guidelines&#039;&#039;&#039;:&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Obtaining Informed Consent&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees are treated as human beings with agency-capable of determining and deciding what is best for them and not mere subjects or as means to extract data.&lt;br /&gt;
As with respect to their self-determination, a.) the nature of the interview, b.) any risks and benefits which might result from their participation, c.) their rights to refuse to participate or to end their participation without penalty, and d.) the means by which they can contact the writer shall be first explained to potential interviews in language they understand. &lt;br /&gt;
&lt;br /&gt;
It is imperative to stress that consent is voluntary, and as such can be withdrawn at any time prior to publication. Writers must ensure the possibility for interviewees to withdraw their consent (at minimum by providing a way to contact the writer)&lt;br /&gt;
Only those who shall express willingness shall be interviewed.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing support&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees stand to face positive as well as negative effects from their involvement/participation. The writer shall ensure that interviewees not only benefit from the publication of the interview but also from the actual conduct of the interview itself. A good interviewer pays careful attention to the interaction with interviewees as this is critical in remaining aware of potential hierarchies and associated power dynamics that may arise.  &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;During the Interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Use sensitive and appropriate methods. The writer shall be in close collaboration with the interviewee and is enjoined not just have an instrumental but genuine relationship with them, recognising that there is no ‘detachment’ from the interviewee’s problems. Treating all people as human beings will entail a degree of emotional involvement and create bond between the interviewer and respondent that can potentially empower both, without creating or fostering dependence.  &lt;br /&gt;
It entails listening to the interviewee with sensitivity. Those who have experienced violation and trauma may react poorly to questions around their experiences, and the writer should be able to recognize this and provide an appropriate response.  &lt;br /&gt;
During the course of the interview, the interviewer should introduce any section enquiring about violence carefully, forewarning the respondent about the nature of the questions and giving her the opportunity to either stop the interview, or not to answer these questions.&lt;br /&gt;
Collaboration means also that the interviewer is willing to self-disclose- to share her/his experience if the interviewee requests.&lt;br /&gt;
At all times refrain from any conduct or statement that has the effect or impact of blaming the woman for the violence she has experienced. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Boundaries&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Writers shall take steps to address other needs of the interviewee such as counselling, psycho-social and emotional support through referrals to local and culturally appropriate resources. However, be explicit about limitations and do not make promises that cannot be fulfilled.&lt;br /&gt;
Interviewers should not take on a role as counsellor.&lt;br /&gt;
Interviewers should be open to assisting the respondent if asked, within the limits of these protocols, but should not tell her what to do or to take on the personal burden of trying to “save her”. &lt;br /&gt;
Variations in individual and cultural understandings of what constitutes violence against women (including rape, marital rape, assault, harassment, etc.), are to be expected. The writer’s role in working with victims/survivors of violence (as well as all other interviewees) is to bring out their own understandings of the violence they experienced (or witnessed or participated in), through questions and sharing of perspectives that provide room for conversation around different views; rather than try to stick with a pre-determined definition/understanding of what constitutes violence, rape, harassment, assault, etc. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing referrals to social support services&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Prior to conducting the interview, research potential providers of support, which may include existing health, legal and social services and educational resources in the community, and less formal providers of support (including community representatives, religious leaders, traditional healers and women’s organizations).&lt;br /&gt;
A list of such resources should be made available to the interviewee, but only provided if and when asked for. Such a list should be framed as resources for “women’s heath” broadly, to miminize risks to interviewees that may result from possessing such a list. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Ensuring Confidentiality&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
All involved, from the interviewer to the editor, have the duty to assure the women that their identities will be protected, if this has been agreed upon. &lt;br /&gt;
Confidentiality means that participants’ cannot be identified by others, so any identifying information (such as location etc) is to be stripped from all materials pertaining to the interview, including photographs and recordings.&lt;br /&gt;
Interviewers shall determine what kind of information and details to share, no matter how crucial the women’s revelation.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Location of interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviews cost the interviewee time and energy. Therefore, they should be carried out in settings that are most convenient for them.&lt;br /&gt;
Logistics planning should include consideration of respondent safety. &lt;br /&gt;
Interviews should be conducted in complete privacy. In cases where privacy cannot be ensured, interviews should be rescheduled or relocated. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Recording the Interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Audio-recordings should be made for in-depth interviews with survivors of violence.&lt;br /&gt;
&lt;br /&gt;
The permission of the respondents should be sought before taping. The name of the respondent should not be included in the audio-recording at any stage. &lt;br /&gt;
Respondents should be informed of who will have access to the tapes and for how long they will be kept. &lt;br /&gt;
&lt;br /&gt;
1. In this case, only interviewer (&amp;amp; transcriber, if different from the interviewer) will have access to the audio-recording. &lt;br /&gt;
&lt;br /&gt;
2. The audio-recordings should be kept in encrypted file1on an external hard drive, in a locked cabinet, with limited access. &lt;br /&gt;
&lt;br /&gt;
3. The audio-recording should be destroyed after publication. &lt;br /&gt;
&lt;br /&gt;
Extreme caution must be taken to securely transport raw data from locations of interviews to places where data are processed. That applies to all recoding media.&lt;br /&gt;
An encryption software must be used during all data storage to ensure security of the data. 2 &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Transcribing the Interviews&#039;&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
The importance of recording and transcribing the interviews is to ensure that women’s experiences and perspectives are shared in their own words. Relying on the interviewers’ notes/memories may be insufficient to ensure quality of data and its analysis. &lt;br /&gt;
Transcribing the interviews also enables the respondents the option of reviewing the information they have provided if they wish, and choosing which information they consent to share. &lt;br /&gt;
&lt;br /&gt;
Particular care should be taken to ensure that no one community or individual can be identified.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* think before you upload your story to the internet and if your security or the security of others could be compromised by others seeing it or not.&lt;br /&gt;
* if you or the interviewee don&#039;t want your face shown, or your voice clearly recognisable, you can use tools to help guarantee anonymity (Audacity has tools for audio, ObscuraCam for video).&lt;br /&gt;
* never use an image of a person without that person&#039;s permission, regardless of who owns the image.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=327</id>
		<title>How to deal with vulnerable interviewees</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_deal_with_vulnerable_interviewees&amp;diff=327"/>
		<updated>2015-05-20T11:34:13Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: Created page with &amp;quot;&amp;#039;&amp;#039;&amp;#039;Dealing with vulnerable interviewees&amp;#039;&amp;#039;&amp;#039;   &amp;#039;&amp;#039;&amp;#039;Introduction&amp;#039;&amp;#039;&amp;#039;  This guide contains resources and important considerations to be put in place when conducting interviews, part...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Dealing with vulnerable interviewees&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
This guide contains resources and important considerations to be put in place when conducting interviews, particularly with survivors of violence and sexual harassment.&lt;br /&gt;
&lt;br /&gt;
At GenderIT.org, our priorities include giving space to voices from the global South and to the voices of marginalised communities, including victims of violence and sexual harassment. This means an awareness of both our own power and the power of others – including ways in which our actions can enhance or detract from the power of the person whose voice is being heard.&lt;br /&gt;
&lt;br /&gt;
This means an awareness of the vulnerabilities of those who have experienced sexual or other violence or harassment – giving them the power to decide how anonymous they wish to be, for example, allowing them to choose how to refer to themselves (as a survivor, as a victim etc.), giving them ample space and time to tell, write or edit their story, and time for them to be happy about how it will be shared (if it is to be shared).&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
A key resource here is the Witness guide to interviewing surivors of sexual assault&lt;br /&gt;
(http://blog.witness.org/2013/08/new-how-to-guide-for-interviewing-survivors-of-sexual-and-gender-based-violence/). Violence survivors include those in positions of power and authority and if you are speaking to them about their experience of violence, particularly sexual violence or assault, it is still important to follow these principles.&lt;br /&gt;
&lt;br /&gt;
Another important document is the WHO guide on research on domestic violence (http://www.who.int/gender/documents/violence/who_fch_gwh_01.1/en/) available in English, French and Spanish.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;WHO Guiding Principles for Domestic Violence Research&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
a. The safety of respondents and the research team is paramount, and should guide all project decisions.&lt;br /&gt;
&lt;br /&gt;
b. Prevalence studies need to be methodologically sound and to build upon current re- search experience about how to minimize the under-reporting of violence.&lt;br /&gt;
&lt;br /&gt;
c. Protecting confidentiality is essential to ensure both women’s safety and data quality.&lt;br /&gt;
&lt;br /&gt;
d. All research team members should be care fully selected and receive specialized training and on-going support.&lt;br /&gt;
&lt;br /&gt;
e. The study design must include actions aimed at reducing any possible distress caused to the participants by the research.&lt;br /&gt;
&lt;br /&gt;
f. Fieldworkers should be trained to refer women requesting assistance to available local services and sources of support. Where few resources exist, it may be necessary for the study to create short-term support mechanisms.&lt;br /&gt;
&lt;br /&gt;
g. Researchers and donors have an ethical obligation to help ensure that their findings are properly interpreted and used to advance policy and intervention development.&lt;br /&gt;
&lt;br /&gt;
h. Violence questions should only be incorporated into surveys designed for other purposes when ethical and methodological requirements can be met.&lt;br /&gt;
&lt;br /&gt;
[[Drawing from these principles]], Athar, Rima  &amp;quot;VI. Ethics in the Research Process&amp;quot; In: Research Design for “From impunity to justice: Exploring corporate and legal remedies for technology-related violence against women” research  (APC, November 2013) [[drew up these guidelines]]:&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Obtaining Informed Consent&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees are treated as human beings with agency-capable of determining and deciding what is best for them and not mere subjects or as means to extract data.&lt;br /&gt;
As with respect to their self-determination, a.) the nature of the interview, b.) any risks and benefits which might result from their participation, c.) their rights to refuse to participate or to end their participation without penalty, and d.) the means by which they can contact the writer shall be first explained to potential interviews in language they understand. &lt;br /&gt;
&lt;br /&gt;
It is imperative to stress that consent is voluntary, and as such can be withdrawn at any time prior to publication. Writers must ensure the possibility for interviewees to withdraw their consent (at minimum by providing a way to contact the writer)&lt;br /&gt;
Only those who shall express willingness shall be interviewed.  &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing support&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviewees stand to face positive as well as negative effects from their involvement/participation. The writer shall ensure that interviewees not only benefit from the publication of the interview but also from the actual conduct of the interview itself. A good interviewer pays careful attention to the interaction with interviewees as this is critical in remaining aware of potential hierarchies and associated power dynamics that may arise.  &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;During the Interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Use sensitive and appropriate methods. The writer shall be in close collaboration with the interviewee and is enjoined not just have an instrumental but genuine relationship with them, recognising that there is no ‘detachment’ from the interviewee’s problems. Treating all people as human beings will entail a degree of emotional involvement and create bond between the interviewer and respondent that can potentially empower both, without creating or fostering dependence.  &lt;br /&gt;
It entails listening to the interviewee with sensitivity. Those who have experienced violation and trauma may react poorly to questions around their experiences, and the writer should be able to recognize this and provide an appropriate response.  &lt;br /&gt;
During the course of the interview, the interviewer should introduce any section enquiring about violence carefully, forewarning the respondent about the nature of the questions and giving her the opportunity to either stop the interview, or not to answer these questions.&lt;br /&gt;
Collaboration means also that the interviewer is willing to self-disclose- to share her/his experience if the interviewee requests.&lt;br /&gt;
At all times refrain from any conduct or statement that has the effect or impact of blaming the woman for the violence she has experienced. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Boundaries&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Writers shall take steps to address other needs of the interviewee such as counselling, psycho-social and emotional support through referrals to local and culturally appropriate resources. However, be explicit about limitations and do not make promises that cannot be fulfilled.&lt;br /&gt;
Interviewers should not take on a role as counsellor.&lt;br /&gt;
Interviewers should be open to assisting the respondent if asked, within the limits of these protocols, but should not tell her what to do or to take on the personal burden of trying to “save her”. &lt;br /&gt;
Variations in individual and cultural understandings of what constitutes violence against women (including rape, marital rape, assault, harassment, etc.), are to be expected. The writer’s role in working with victims/survivors of violence (as well as all other interviewees) is to bring out their own understandings of the violence they experienced (or witnessed or participated in), through questions and sharing of perspectives that provide room for conversation around different views; rather than try to stick with a pre-determined definition/understanding of what constitutes violence, rape, harassment, assault, etc. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Providing referrals to social support services&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Prior to conducting the interview, research potential providers of support, which may include existing health, legal and social services and educational resources in the community, and less formal providers of support (including community representatives, religious leaders, traditional healers and women’s organizations).&lt;br /&gt;
A list of such resources should be made available to the interviewee, but only provided if and when asked for. Such a list should be framed as resources for “women’s heath” broadly, to miminize risks to interviewees that may result from possessing such a list. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Ensuring Confidentiality&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
All involved, from the interviewer to the editor, have the duty to assure the women that their identities will be protected, if this has been agreed upon. &lt;br /&gt;
Confidentiality means that participants’ cannot be identified by others, so any identifying information (such as location etc) is to be stripped from all materials pertaining to the interview, including photographs and recordings.&lt;br /&gt;
Interviewers shall determine what kind of information and details to share, no matter how crucial the women’s revelation.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Location of interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Interviews cost the interviewee time and energy. Therefore, they should be carried out in settings that are most convenient for them.&lt;br /&gt;
Logistics planning should include consideration of respondent safety. &lt;br /&gt;
Interviews should be conducted in complete privacy. In cases where privacy cannot be ensured, interviews should be rescheduled or relocated. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Recording the Interview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Audio-recordings should be made for in-depth interviews with survivors of violence.&lt;br /&gt;
&lt;br /&gt;
The permission of the respondents should be sought before taping. The name of the respondent should not be included in the audio-recording at any stage. &lt;br /&gt;
Respondents should be informed of who will have access to the tapes and for how long they will be kept. &lt;br /&gt;
&lt;br /&gt;
1. In this case, only interviewer (&amp;amp; transcriber, if different from the interviewer) will have access to the audio-recording. &lt;br /&gt;
&lt;br /&gt;
2. The audio-recordings should be kept in encrypted file1on an external hard drive, in a locked cabinet, with limited access. &lt;br /&gt;
&lt;br /&gt;
3. The audio-recording should be destroyed after publication. &lt;br /&gt;
&lt;br /&gt;
Extreme caution must be taken to securely transport raw data from locations of interviews to places where data are processed. That applies to all recoding media.&lt;br /&gt;
An encryption software must be used during all data storage to ensure security of the data. 2 &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Transcribing the Interviews&#039;&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
The importance of recording and transcribing the interviews is to ensure that women’s experiences and perspectives are shared in their own words. Relying on the interviewers’ notes/memories may be insufficient to ensure quality of data and its analysis. &lt;br /&gt;
Transcribing the interviews also enables the respondents the option of reviewing the information they have provided if they wish, and choosing which information they consent to share. &lt;br /&gt;
&lt;br /&gt;
Particular care should be taken to ensure that no one community or individual can be identified.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist:&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
* think before you upload your story to the internet and if your security or the security of others could be compromised by others seeing it or not.&lt;br /&gt;
* if you or the interviewee don&#039;t want your face shown, or your voice clearly recognisable, you can use tools to help guarantee anonymity (Audacity has tools for audio, ObscuraCam for video).&lt;br /&gt;
* never use an image of a person without that person&#039;s permission, regardless of who owns the image.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=326</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=326"/>
		<updated>2015-05-20T11:24:02Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, take a look at http://photo.net/equipment/digital/basics/. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available at https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event are available [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An open source alternative to Photoshop is available at http://www.gimp.org/, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the ObscuraCam app to protect the identity of those whose pictures you take. This app removes location and other identifying material from the photos. Available free at https://guardianproject.info/apps/obscuracam/.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see http://www.hongkiat.com/blog/force-perspective-photos/).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=325</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=325"/>
		<updated>2015-05-20T11:22:42Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, take a look at http://photo.net/equipment/digital/basics/. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available at https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event are available [http://photography.tutsplus.com/series/photojournalism—photo-8677 here]&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An open source alternative to Photoshop is available at http://www.gimp.org/, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the ObscuraCam app to protect the identity of those whose pictures you take. This app removes location and other identifying material from the photos. Available free at https://guardianproject.info/apps/obscuracam/.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see http://www.hongkiat.com/blog/force-perspective-photos/).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are &#039;&#039;png gif jpg jpeg&#039;&#039; &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=324</id>
		<title>How to work with images</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_images&amp;diff=324"/>
		<updated>2015-05-20T11:20:34Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: Created page with &amp;quot;&amp;#039;&amp;#039;&amp;#039;Introduction&amp;#039;&amp;#039;&amp;#039;  Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Photographs can illuminate a story, but also present risks for information they may inadvertently provide about the location and identities of those in the photographs. This guide addresses these questions of safety, security and ensuring anonymity.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you&#039;re looking for a fairly simple how-to for digital photography, take a look at http://photo.net/equipment/digital/basics/. It includes information on choosing a camera, as well as guiding readers through the vocabulary of a digital camera.&lt;br /&gt;
&lt;br /&gt;
A really beautiful online guide to portrait photography is available at https://archive.org/details/The_Perfect_Portrait_Guide_How_to_Photograph_People. This is really practical for taking one-on-one shots, less practical in the chaotic atmosphere of a conference.&lt;br /&gt;
&lt;br /&gt;
Perhaps more practical tips for the type of photographs you might be taking if you go to a conference or event are available here http://photography.tutsplus.com/series/photojournalism—photo-8677.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Obviously, you&#039;ll need a camera. The quality of most point-and-shoot cameras is usually sufficient for the website.&lt;br /&gt;
&lt;br /&gt;
However, you may need to change the quality or otherwise edit your photo. An open source alternative to Photoshop is available at http://www.gimp.org/, which has tutorials on the same site.&lt;br /&gt;
&lt;br /&gt;
If you&#039;re taking photos with your phone, make sure you use the ObscuraCam app to protect the identity of those whose pictures you take. This app removes location and other identifying material from the photos. Available free at https://guardianproject.info/apps/obscuracam/.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Aside from the technical tips covered above, as always make sure that you respect people&#039;s privacy. At conferences, ensure that those in photographs are happy with the image being made public – in many conferences people may wear some form of identification to show that they don&#039;t want their photographs taken. It is vital that this is respected. If you aren&#039;t sure, or don&#039;t get to ask, don&#039;t upload the shot – or anonymise their picture (see the link to ObscuraCam above).&lt;br /&gt;
&lt;br /&gt;
If you have done an interview and the interviewee wants to remain anonymous, you could take photos of hands, a sillhouette or other means that protect their identity. Check out the resources at gbv.witness.org for ideas and suggestions. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Before going out, make sure you have spare batteries and a notepad (and a camera!).&lt;br /&gt;
&lt;br /&gt;
2. Get the permission of everyone you photograph to use their pictures. Explain the context of the site and if possible, the context of the story.&lt;br /&gt;
&lt;br /&gt;
3. Before taking the shot, check the lighting, check that everything is to scale (see http://www.hongkiat.com/blog/force-perspective-photos/).&lt;br /&gt;
&lt;br /&gt;
4. If the photo is taken with a smart device, make sure you strip identifying data from the shot.&lt;br /&gt;
5. Make sure that the image in in the right format before uploading.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tips for using the picture in GenderIT.org&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Please make sure the file size does not exceed the 25 MB. If this is the case, you can easily reduce the size by using this online tool: http://www.webresizer.com/resizer/ You can also crop them if you need to.&lt;br /&gt;
&lt;br /&gt;
2. Allowed file extensions are png gif jpg jpeg &lt;br /&gt;
&lt;br /&gt;
3. On the HOW to upload them, please refer yourself to the technical guide about how to upload content in GenderIT.org.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Reference_guide&amp;diff=289</id>
		<title>Reference guide</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Reference_guide&amp;diff=289"/>
		<updated>2015-05-19T09:18:37Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&lt;br /&gt;
&#039;&#039;&#039;APC Reference Guide&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
APC uses an adapted version of the American Psychological Association (APA) style of referencing. The key difference is APC&#039;s use of footnotes rather than in-text citation of author and date. We take into consideration the impracticality of scrolling backwards and forwards to the bibliography. Footnotes are better suited to documents that are likely to be read on a digital device. Please take into account the following recommendations when writing and editing for APC.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;[http://www.apc.org/en/system/files/APC_ReferenceGuide_2-0.pdf Read or download the Reference guide in pdf format]&#039;&#039;&#039;&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=Our_code_of_ethics&amp;diff=236</id>
		<title>Our code of ethics</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=Our_code_of_ethics&amp;diff=236"/>
		<updated>2015-05-18T12:48:46Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;The GenderIT.org code of ethics is based on feminist theory and praxis and is a work in progress. We have developed this bearing in mind that most codes of ethics for journalists have been developed primarily for print media, in an era prior to the connectivity made possible by the internet. They have also largely been inherited from organisations steeped in patriarchy and while there are lots of positive examples of incorporating gender into these codes, we feel that a code of ethics that has a feminist starting point and which takes into account some of the complexities occasioned by the internet can contribute not only to achieving the [http://www.genderit.org/articles/feminist-principles-internet feminist principles of the internet], but also in debates and discussion on codes of ethics in journalism more broadly.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;1.&#039;&#039;&#039; &#039;&#039;&#039;Respect&#039;&#039;&#039; should be the underlying principle in all communications on this site. This includes comments on posts and posts themselves. It includes respect for a diversity of identities, cultural experiences and political contexts. It includes respect for the integrity of the individual(s) behind the posts, regardless of how they choose to identify, if at all.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;2.&#039;&#039;&#039; Comments and posts should contribute to debate and discussion. Those that do not will be deleted. If we feel that the issue warrants it, we will post justifications.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;3.&#039;&#039;&#039; &#039;&#039;&#039;Power relations&#039;&#039;&#039; are fundamental to persistent inequalities. This is a site aimed at providing a space for marginalised and queer voices to address these inequalities. Therefore, voices from the Global South, from marginalised and queer communities will be privileged over other voices.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;4.&#039;&#039;&#039; We recognise that &#039;&#039;&#039;violence online&#039;&#039;&#039; is real and has tangible real-world impacts. This is an extension of misogyny that attempts to silence feminist voices regardless of medium. It is a key part of the site&#039;s advocacy to address this issue and the gap in understanding and knowledge that surrounds gender-based violence online and through the use of new technologies.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;5.&#039;&#039;&#039; GenderIT.org recognises &#039;&#039;&#039;the principle of fluidity of identity and the right to be forgotten&#039;&#039;&#039;. In practical terms this means that GenderIT.org safeguards the privacy of both formal and informal contributors to the site, and allows them control over the manner in which they are represented, if they choose to reveal an identity and what identity they choose to reveal. &#039;&#039;&#039;We expect honesty in all dealings with GenderIT.org&#039;&#039;&#039;. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;6.&#039;&#039;&#039; Resistance to the neoliberal, capitalist order is fundamental to realising a feminist space. We manifest this in our commitment to &#039;&#039;&#039;open source technology, to copyleft licensing of our articles&#039;&#039;&#039;. Complementary to this, we recognise the historic burdens placed on women and marginalised communities in terms of unpaid or poorly paid labour and resolve to be part of the solution to women&#039;s multiple burdens as far as is possible.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;7.&#039;&#039;&#039; &#039;&#039;&#039;Access to knowledge&#039;&#039;&#039; is a fundamental human right. We commit to this through the licensing of our material and in a commitment to translate as broadly as resources allow. We also believe that access to knowledge in a digital context is only possible by &#039;&#039;&#039;demystifying technology and using plain language&#039;&#039;&#039; as much as possible.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;8.&#039;&#039;&#039; We recognise the &#039;&#039;&#039;rights of survivors&#039;&#039;&#039; to their own story, and recognise that sharing this story is a brave and often empowering act. We also recognise that sharing a story opens up survivors to further abuse. We attempt to balance competing interests in a manner that puts the rights of the individual to their own story at the heart of our decision.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;9.&#039;&#039;&#039; The team behind GenderIT.org are fallible. We attempt to be transparent in our decision-making processes, and will attempt to address conflicts that arise as a result of our decisions within the spaces on the website.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=A_guide_for_new_editors&amp;diff=230</id>
		<title>A guide for new editors</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=A_guide_for_new_editors&amp;diff=230"/>
		<updated>2015-05-18T12:15:53Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Guide for editors&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
This is a guide to help editors new to GenderIT.org to understand the priorities for the site and provide a quick reference to important documents that you may need in your work.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The editor is the link between the writer and the audience, and the main aim of the editor is to improve communication between the two. While all stories should follow GenderIT.org style and editorial guidelines, and be in line with the core principles of the site, as far as possible, the editor keeps the words and flow of the original writer. The writer is usually an expert in their field, often with many years of campaigning or struggle in their own country – often in languages that are not English. It is important to respect the writer, and ask them questions and permission for any substantive changes.&lt;br /&gt;
&lt;br /&gt;
It is not always easy to follow these guidelines! &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Editing tips&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Read through the entire piece first. This gives some sense of what the story is about, and often points that are confusing can be clarified later on.&lt;br /&gt;
&lt;br /&gt;
Use a lighter touch for blogs such as Feminist Talk. Just check for spelling and readability – only if something is very confusing, make an amendment. Always track changes.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Check for points that are made more than once. If there is new information, try to meld the two together for brevity, and readability.&lt;br /&gt;
&lt;br /&gt;
Make sure that language is as simple as possible. Writers, especially those fluent in English, may use colloquialisms or long words. It is particularly important for readers whose first language is not English to simplify these. &lt;br /&gt;
&lt;br /&gt;
Example: &#039;&#039;&#039;Time seemed to fly&#039;&#039;&#039;, the conference was &#039;&#039;&#039;so packed&#039;&#039;&#039; with exciting speakers. &lt;br /&gt;
Instead: The conference had lots of exciting speakers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
As far as possible check accuracy. If there was an event, check the dates, that names are spelt correctly etc. Google is definitely your friend!&lt;br /&gt;
&lt;br /&gt;
Check footnotes and references, for both style and completeness. If you think something needs to be referenced, ask for the writer to put that in.&lt;br /&gt;
&lt;br /&gt;
For some writers (but certainly not all), this may be the first time they are publishing something in English. Your role MAY be to guide and advise them. It is usually clear from the text itself if this is the case. Always phrase guidance respectfully and positively.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Its important that you encourage the writers to provide as many links within the text as possible. Some writers might not be used to write in online platforms, so we should try to make the text as fluid and rich as possible. The articles can&#039;t cover all the contextual information that understanding the content of the article might require, but links can be quite useful for that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Editors should also help writers understand how important is to save some time to search in the website and select related articles and resources as much as possible. This way we build on previous writings and we offer the readership a much prolific reading experience. And we increase our chances of readers to get interested in related materials and to stay on the website!&lt;br /&gt;
&lt;br /&gt;
Some pieces may need two or three edits. Be prepared!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Editing a translation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Many of GenderIT.org articles are translations (from English to Spanish or viceversa). Editing translations has its own challenges, since the mediation of the translator is a second voice that shows in the final article. Always edit the translated article with the original in hand, so you can double-check that the translator didn&#039;t misunderstand any phrase or word. In some cases, when translators do not understand a very specific word or expression, they might highlight it for your consideration, so be ready to solve that quiz.  Going back to the author and asking for  synonyms or alternative ways of saying it might help.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Quick links&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Link here to [[Our code of ethics]]; [[Style guide]]; Editorial guide; Citation guide.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Does the piece as a whole make sense? Is the argument/ are the points clear? Is there any repetition, and if so, does it serve a purpose?&lt;br /&gt;
&lt;br /&gt;
2. Is the language clear? Are there any colloquialisms? Are there any words or phrases that a person whose first language is not English may have difficulty understanding?&lt;br /&gt;
&lt;br /&gt;
3. Are the grammar and spelling correct?&lt;br /&gt;
&lt;br /&gt;
4. Are all quotes or other materials adequately referenced, following the house style?&lt;br /&gt;
&lt;br /&gt;
5. Is there anything missing? Is there an argument or idea that the writer could have followed up on that would strengthen the article? Are there any suggestions you&#039;d like to make to the writer?&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=A_guide_for_new_editors&amp;diff=229</id>
		<title>A guide for new editors</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=A_guide_for_new_editors&amp;diff=229"/>
		<updated>2015-05-18T12:13:56Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Guide for editors&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
This is a guide to help editors new to GenderIT.org to understand the priorities for the site and provide a quick reference to important documents that you may need in your work.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The editor is the link between the writer and the audience, and the main aim of the editor is to improve communication between the two. While all stories should follow GenderIT.org style and editorial guidelines, and be in line with the core principles of the site, as far as possible, the editor keeps the words and flow of the original writer. The writer is usually an expert in their field, often with many years of campaigning or struggle in their own country – often in languages that are not English. It is important to respect the writer, and ask them questions and permission for any substantive changes.&lt;br /&gt;
&lt;br /&gt;
It is not always easy to follow these guidelines! &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Editing tips&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Read through the entire piece first. This gives some sense of what the story is about, and often points that are confusing can be clarified later on.&lt;br /&gt;
&lt;br /&gt;
Use a lighter touch for blogs such as Feminist Talk. Just check for spelling and readability – only if something is very confusing, make an amendment. Always track changes.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Check for points that are made more than once. If there is new information, try to meld the two together for brevity, and readability.&lt;br /&gt;
&lt;br /&gt;
Make sure that language is as simple as possible. Writers, especially those fluent in English, may use colloquialisms or long words. It is particularly important for readers whose first language is not English to simplify these. &lt;br /&gt;
&lt;br /&gt;
Example: &#039;&#039;&#039;Time seemed to fly&#039;&#039;&#039;, the conference was &#039;&#039;&#039;so packed&#039;&#039;&#039; with exciting speakers. &lt;br /&gt;
Instead: The conference had lots of exciting speakers.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
As far as possible check accuracy. If there was an event, check the dates, that names are spelt correctly etc. Google is definitely your friend!&lt;br /&gt;
&lt;br /&gt;
Check footnotes and references, for both style and completeness. If you think something needs to be referenced, ask for the writer to put that in.&lt;br /&gt;
&lt;br /&gt;
For some writers (but certainly not all), this may be the first time they are publishing something in English. Your role MAY be to guide and advise them. It is usually clear from the text itself if this is the case. Always phrase guidance respectfully and positively.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Its important that you encourage the writers to provide as many links within the text as possible. Some writers might not be used to write in online platforms, so we should try to make the text as fluid and rich as possible. The articles can&#039;t cover all the contextual information that understanding the content of the article might require, but links can be quite useful for that. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Editors should also help writers understand how important is to save some time to search in the website and select related articles and resources as much as possible. This way we build on previous writings and we offer the readership a much prolific reading experience. And we increase our chances of readers to get interested in related materials and to stay on the website!&lt;br /&gt;
&lt;br /&gt;
Some pieces may need two or three edits. Be prepared!&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Editing a translation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Many of GenderIT.org articles are translations (from English to Spanish or viceversa). Editing translations has its own challenges, since the mediation of the translator is a second voice that shows in the final article. Always edit the translated article with the original in hand, so you can double-check that the translator didn&#039;t misunderstand any phrase or word. In some cases, when translators do not understand a very specific word or expression, they might highlight it for your consideration, so be ready to solve that quiz.  Going back to the author and asking for  synonyms or alternative ways of saying it might help.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Quick links&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Link here to Code of ethics; Style guide; Editorial guide; Citation guide.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Does the piece as a whole make sense? Is the argument/ are the points clear? Is there any repetition, and if so, does it serve a purpose?&lt;br /&gt;
&lt;br /&gt;
2. Is the language clear? Are there any colloquialisms? Are there any words or phrases that a person whose first language is not English may have difficulty understanding?&lt;br /&gt;
&lt;br /&gt;
3. Are the grammar and spelling correct?&lt;br /&gt;
&lt;br /&gt;
4. Are all quotes or other materials adequately referenced, following the house style?&lt;br /&gt;
&lt;br /&gt;
5. Is there anything missing? Is there an argument or idea that the writer could have followed up on that would strengthen the article? Are there any suggestions you&#039;d like to make to the writer?&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=A_guide_for_new_editors&amp;diff=228</id>
		<title>A guide for new editors</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=A_guide_for_new_editors&amp;diff=228"/>
		<updated>2015-05-18T12:11:05Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: Created page with &amp;quot;&amp;#039;&amp;#039;&amp;#039;Guide for editors&amp;#039;&amp;#039;&amp;#039;  This is a guide to help editors new to GenderIT.org to understand the priorities for the site and provide a quick reference to important documents tha...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;Guide for editors&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
This is a guide to help editors new to GenderIT.org to understand the priorities for the site and provide a quick reference to important documents that you may need in your work.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The editor is the link between the writer and the audience, and the main aim of the editor is to improve communication between the two. While all stories should follow GenderIT.org style and editorial guidelines, and be in line with the core principles of the site, as far as possible, the editor keeps the words and flow of the original writer. The writer is usually an expert in their field, often with many years of campaigning or struggle in their own country – often in languages that are not English. It is important to respect the writer, and ask them questions and permission for any substantive changes.&lt;br /&gt;
&lt;br /&gt;
It is not always easy to follow these guidelines! &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Editing tips&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Read through the entire piece first. This gives some sense of what the story is about, and often points that are confusing can be clarified later on.&lt;br /&gt;
&lt;br /&gt;
Use a lighter touch for blogs such as Feminist Talk. Just check for spelling and readability – only if something is very confusing, make an amendment. Always track changes.&lt;br /&gt;
&lt;br /&gt;
Check for points that are made more than once. If there is new information, try to meld the two together for brevity, and readability.&lt;br /&gt;
&lt;br /&gt;
Make sure that language is as simple as possible. Writers, especially those fluent in English, may use colloquialisms or long words. It is particularly important for readers whose first language is not English to simplify these. &lt;br /&gt;
&lt;br /&gt;
Example: &#039;&#039;&#039;Time seemed to fly&#039;&#039;&#039;, the conference was &#039;&#039;&#039;so packed&#039;&#039;&#039; with exciting speakers. &lt;br /&gt;
Instead: The conference had lots of exciting speakers.&lt;br /&gt;
&lt;br /&gt;
As far as possible check accuracy. If there was an event, check the dates, that names are spelt correctly etc. Google is definitely your friend!&lt;br /&gt;
&lt;br /&gt;
Check footnotes and references, for both style and completeness. If you think something needs to be referenced, ask for the writer to put that in.&lt;br /&gt;
&lt;br /&gt;
For some writers (but certainly not all), this may be the first time they are publishing something in English. Your role MAY be to guide and advise them. It is usually clear from the text itself if this is the case. Always phrase guidance respectfully and positively.&lt;br /&gt;
&lt;br /&gt;
Its important that you encourage the writers to provide as many links within the text as possible. Some writers might not be used to write in online platforms, so we should try to make the text as fluid and rich as possible. The articles can&#039;t cover all the contextual information that understanding the content of the article might require, but links can be quite useful for that. &lt;br /&gt;
&lt;br /&gt;
Editors should also help writers understand how important is to save some time to search in the website and select related articles and resources as much as possible. This way we build on previous writings and we offer the readership a much prolific reading experience. And we increase our chances of readers to get interested in related materials and to stay on the website!&lt;br /&gt;
&lt;br /&gt;
Some pieces may need two or three edits. Be prepared!&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Editing a translation&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Many of GenderIT.org articles are translations (from English to Spanish or viceversa). Editing translations has its own challenges, since the mediation of the translator is a second voice that shows in the final article. Always edit the translated article with the original in hand, so you can double-check that the translator didn&#039;t misunderstand any phrase or word. In some cases, when translators do not understand a very specific word or expression, they might highlight it for your consideration, so be ready to solve that quiz.  Going back to the author and asking for  synonyms or alternative ways of saying it might help.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Quick links&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Link here to Code of ethics; Style guide; Editorial guide; Citation guide.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Does the piece as a whole make sense? Is the argument/ are the points clear? Is there any repetition, and if so, does it serve a purpose?&lt;br /&gt;
&lt;br /&gt;
2. Is the language clear? Are there any colloquialisms? Are there any words or phrases that a person whose first language is not English may have difficulty understanding?&lt;br /&gt;
&lt;br /&gt;
3. Are the grammar and spelling correct?&lt;br /&gt;
&lt;br /&gt;
4. Are all quotes or other materials adequately referenced, following the house style?&lt;br /&gt;
&lt;br /&gt;
5. Is there anything missing? Is there an argument or idea that the writer could have followed up on that would strengthen the article? Are there any suggestions you&#039;d like to make to the writer?&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=227</id>
		<title>How to work with audio</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=227"/>
		<updated>2015-05-18T11:58:54Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;The GenderIT.org guide to producing audio&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The aim of this guide is to provide information and resources that will provide a road-map for those new to the medium of audio, while also providing quick links and reference for those with some experience who want a refresher on particular topics or questions.&lt;br /&gt;
&lt;br /&gt;
Voice can be an immensely warm media, bringing stories into your office, living room or car. It&#039;s also a great medium for feminists. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Unesco publishes a guide on how to do community radio. While the first section deals with setting up a station, the second section is on how to make programmes. It is available [http://www.unesco.org/new/en/communication-and-information/resources/publications-and-communication-materials/publications/full-list/how-to-do-community-radio-a-primer-for-community-radio-operators/ online].&lt;br /&gt;
&lt;br /&gt;
The first thing is to make great sound recordings. You can fix audio that has some mistakes, but it&#039;s much easier to make sure that the recording is as &#039;clean&#039; as possible. A simple guide that covers most of the important points can be found [http://www.soundportraits.org/education/how_to_record/ here] but keep in mind the points below about power and respect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you plan on doing a lot of audio, download an audio editor – [http://sourceforge.net/projects/audacity/?source=directory Audacity] is one of the most popular, free, open-source sound editors out there, and it can do most of what can be done by far more costly software packages. A fairly simple to follow tutorial is available [https://www.youtube.com/watch?v=lrPGMjZORCM here] – but there are loads of videos to help guide you through any issues you may have. The Audacity community is also quite active, so post any problems you face and you&#039;re bound to get some help.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
With Audacity, you can record sound from Skype, but the quality can be too poor for broadcast, if you&#039;re hoping that stations will pick up the story. It is fine for the website. You can also use it to record conversations using any mic plugged into your computer, including the internal mic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the reasons GenderIT encourages contributors to make audio is because the airwaves, including both mainstream and community radio, are still dominated by male voices, issues and concerns. Feminist audio is different from malestream audio in that:&lt;br /&gt;
&lt;br /&gt;
1) It privileges female voices, to address existing power imbalances.&lt;br /&gt;
&lt;br /&gt;
2) It is always conscious of the power involved in any interview or discussion. Generally, if you are interviewing somebody, you hold more power than they do. It is your responsibility to ensure that their voice is heard in a way that is empowering for them. This means you allow them time to feel comfortable, to review what they have said, to restart or redo what they have said. Obviously there are exceptions – politicians and other prominent personalities may have more power than the interviewer. But, as a general rule, check whether these are voices that need to be heard on GenderIT. Do they have other ways of reaching a wide audience? If so, maybe we need to be looking for someone else.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
Follow these guidelines, bearing in mind what is written in the code of ethics and the manifesto, and you&#039;ll be producing radio-worthy audio in no time.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Other resources&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Some useful resources:&lt;br /&gt;
&lt;br /&gt;
1. Transom.org – a radio specialists&#039; guide to tools and tips for using sound editing software, including Audacity.&lt;br /&gt;
&lt;br /&gt;
2. [http://audacity.sourceforge.net/community/users The Audacity user community]&lt;br /&gt;
&lt;br /&gt;
3. The [http://www.amarc.org/index.php?p=Gender_Policy_entrance_page AMARC Gender Policy] is a useful document that looks at the issue of power and women&#039;s voices. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Listen back to the audio recording. Sometimes strange things creep in without you noticing!&lt;br /&gt;
&lt;br /&gt;
2. Are all sound effects and/ or music licensed under an appropriate copy-free license?&lt;br /&gt;
&lt;br /&gt;
3. Make sure you can spell all names that are mentioned, for tagging online, and to make sure that any transcript is accurate.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=226</id>
		<title>How to work with audio</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=226"/>
		<updated>2015-05-18T11:58:08Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;The GenderIT.org guide to producing audio&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The aim of this guide is to provide information and resources that will provide a road-map for those new to the medium of audio, while also providing quick links and reference for those with some experience who want a refresher on particular topics or questions.&lt;br /&gt;
&lt;br /&gt;
Voice can be an immensely warm media, bringing stories into your office, living room or car. It&#039;s also a great medium for feminists. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Unesco publishes a guide on how to do community radio. While the first section deals with setting up a station, the second section is on how to make programmes. It is available [http://www.unesco.org/new/en/communication-and-information/resources/publications-and-communication-materials/publications/full-list/how-to-do-community-radio-a-primer-for-community-radio-operators/ online].&lt;br /&gt;
&lt;br /&gt;
The first thing is to make great sound recordings. You can fix audio that has some mistakes, but it&#039;s much easier to make sure that the recording is as &#039;clean&#039; as possible. A simple guide that covers most of the important points can be found [http://www.soundportraits.org/education/how_to_record/ here] but keep in mind the points below about power and respect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you plan on doing a lot of audio, download an audio editor – [http://sourceforge.net/projects/audacity/?source=directory Audacity] is one of the most popular, free, open-source sound editors out there, and it can do most of what can be done by far more costly software packages. A fairly simple to follow tutorial is available [https://www.youtube.com/watch?v=lrPGMjZORCM here] – but there are loads of videos to help guide you through any issues you may have. The Audacity community is also quite active, so post any problems you face and you&#039;re bound to get some help.&lt;br /&gt;
&lt;br /&gt;
With Audacity, you can record sound from Skype, but the quality can be too poor for broadcast, if you&#039;re hoping that stations will pick up the story. It is fine for the website. You can also use it to record conversations using any mic plugged into your computer, including the internal mic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the reasons GenderIT encourages contributors to make audio is because the airwaves, including both mainstream and community radio, are still dominated by male voices, issues and concerns. Feminist audio is different from malestream audio in that:&lt;br /&gt;
&lt;br /&gt;
1) It privileges female voices, to address existing power imbalances.&lt;br /&gt;
&lt;br /&gt;
2) It is always conscious of the power involved in any interview or discussion. Generally, if you are interviewing somebody, you hold more power than they do. It is your responsibility to ensure that their voice is heard in a way that is empowering for them. This means you allow them time to feel comfortable, to review what they have said, to restart or redo what they have said. Obviously there are exceptions – politicians and other prominent personalities may have more power than the interviewer. But, as a general rule, check whether these are voices that need to be heard on GenderIT. Do they have other ways of reaching a wide audience? If so, maybe we need to be looking for someone else.&lt;br /&gt;
&lt;br /&gt;
Follow these guidelines, bearing in mind what is written in the code of ethics and the manifesto, and you&#039;ll be producing radio-worthy audio in no time.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Other resources&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Some useful resources:&lt;br /&gt;
&lt;br /&gt;
1. Transom.org – a radio specialists&#039; guide to tools and tips for using sound editing software, including Audacity.&lt;br /&gt;
&lt;br /&gt;
2. [http://audacity.sourceforge.net/community/users The Audacity user community]&lt;br /&gt;
&lt;br /&gt;
3. The [http://www.amarc.org/index.php?p=Gender_Policy_entrance_page AMARC Gender Policy] is a useful document that looks at the issue of power and women&#039;s voices. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Listen back to the audio recording. Sometimes strange things creep in without you noticing!&lt;br /&gt;
&lt;br /&gt;
2. Are all sound effects and/ or music licensed under an appropriate copy-free license?&lt;br /&gt;
&lt;br /&gt;
3. Make sure you can spell all names that are mentioned, for tagging online, and to make sure that any transcript is accurate.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=225</id>
		<title>How to work with audio</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=225"/>
		<updated>2015-05-18T11:55:02Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: &lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;The GenderIT.org guide to producing audio&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The aim of this guide is to provide information and resources that will provide a road-map for those new to the medium of audio, while also providing quick links and reference for those with some experience who want a refresher on particular topics or questions.&lt;br /&gt;
&lt;br /&gt;
Voice can be an immensely warm media, bringing stories into your office, living room or car. It&#039;s also a great medium for feminists. &lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Unesco publishes a guide on how to do community radio. While the first section deals with setting up a station, the second section is on how to make programmes. It is available online at http://www.unesco.org/new/en/communication-and-information/resources/publications-and-communication-materials/publications/full-list/how-to-do-community-radio-a-primer-for-community-radio-operators/.&lt;br /&gt;
&lt;br /&gt;
The first thing is to make great sound recordings. You can fix audio that has some mistakes, but it&#039;s much easier to make sure that the recording is as &#039;clean&#039; as possible. A simple guide that covers most of the important points is http://www.soundportraits.org/education/how_to_record/ but keep in mind the points below about power and respect.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you plan on doing a lot of audio, download an audio editor – Audacity &amp;lt;http://sourceforge.net/projects/audacity/?source=directory&amp;gt; is one of the most popular, free, open-source sound editors out there, and it can do most of what can be done by far more costly software packages. A fairly simple to follow tutorial is available at https://www.youtube.com/watch?v=lrPGMjZORCM – but there are loads of videos to help guide you through any issues you may have. The Audacity community is also quite active, so post any problems you face and you&#039;re bound to get some help.&lt;br /&gt;
&lt;br /&gt;
With Audacity, you can record sound from Skype, but the quality can be too poor for broadcast, if you&#039;re hoping that stations will pick up the story. It is fine for the website. You can also use it to record conversations using any mic plugged into your computer, including the internal mic.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the reasons GenderIT encourages contributors to make audio is because the airwaves, including both mainstream and community radio, are still dominated by male voices, issues and concerns. Feminist audio is different from malestream audio in that:&lt;br /&gt;
&lt;br /&gt;
1) It privileges female voices, to address existing power imbalances.&lt;br /&gt;
&lt;br /&gt;
2) It is always conscious of the power involved in any interview or discussion. Generally, if you are interviewing somebody, you hold more power than they do. It is your responsibility to ensure that their voice is heard in a way that is empowering for them. This means you allow them time to feel comfortable, to review what they have said, to restart or redo what they have said. Obviously there are exceptions – politicians and other prominent personalities may have more power than the interviewer. But, as a general rule, check whether these are voices that need to be heard on GenderIT. Do they have other ways of reaching a wide audience? If so, maybe we need to be looking for someone else.&lt;br /&gt;
&lt;br /&gt;
Follow these guidelines, bearing in mind what is written in the code of ethics and the manifesto, and you&#039;ll be producing radio-worthy audio in no time.&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Other resources&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Some useful resources:&lt;br /&gt;
&lt;br /&gt;
1. Transom.org – a radio specialists&#039; guide to tools and tips for using sound editing software, including Audacity.&lt;br /&gt;
&lt;br /&gt;
2. The Audacity user community - http://audacity.sourceforge.net/community/users&lt;br /&gt;
&lt;br /&gt;
3. The AMARC Gender Policy is a useful document that looks at the issue of power and women&#039;s voices. http://www.amarc.org/index.php?p=Gender_Policy_entrance_page&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Listen back to the audio recording. Sometimes strange things creep in without you noticing!&lt;br /&gt;
&lt;br /&gt;
2. Are all sound effects and/ or music licensed under an appropriate copy-free license?&lt;br /&gt;
&lt;br /&gt;
3. Make sure you can spell all names that are mentioned, for tagging online, and to make sure that any transcript is accurate.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
	<entry>
		<id>https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=224</id>
		<title>How to work with audio</title>
		<link rel="alternate" type="text/html" href="https://writers.wiki.apc.org/index.php?title=How_to_work_with_audio&amp;diff=224"/>
		<updated>2015-05-18T11:54:10Z</updated>

		<summary type="html">&lt;p&gt;Tarryn: Created page with &amp;quot;&amp;#039;&amp;#039;&amp;#039;The GenderIT.org guide to producing audio&amp;#039;&amp;#039;&amp;#039;  &amp;#039;&amp;#039;&amp;#039;Introduction&amp;#039;&amp;#039;&amp;#039;  The aim of this guide is to provide information and resources that will provide a road-map for those new t...&amp;quot;&lt;/p&gt;
&lt;hr /&gt;
&lt;div&gt;&#039;&#039;&#039;The GenderIT.org guide to producing audio&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Introduction&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
The aim of this guide is to provide information and resources that will provide a road-map for those new to the medium of audio, while also providing quick links and reference for those with some experience who want a refresher on particular topics or questions.&lt;br /&gt;
&lt;br /&gt;
Voice can be an immensely warm media, bringing stories into your office, living room or car. It&#039;s also a great medium for feminists. &lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Overview&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Unesco publishes a guide on how to do community radio. While the first section deals with setting up a station, the second section is on how to make programmes. It is available online at http://www.unesco.org/new/en/communication-and-information/resources/publications-and-communication-materials/publications/full-list/how-to-do-community-radio-a-primer-for-community-radio-operators/.&lt;br /&gt;
&lt;br /&gt;
The first thing is to make great sound recordings. You can fix audio that has some mistakes, but it&#039;s much easier to make sure that the recording is as &#039;clean&#039; as possible. A simple guide that covers most of the important points is http://www.soundportraits.org/education/how_to_record/ but keep in mind the points below about power and respect.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Technical tools&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
If you plan on doing a lot of audio, download an audio editor – Audacity &amp;lt;http://sourceforge.net/projects/audacity/?source=directory&amp;gt; is one of the most popular, free, open-source sound editors out there, and it can do most of what can be done by far more costly software packages. A fairly simple to follow tutorial is available at https://www.youtube.com/watch?v=lrPGMjZORCM – but there are loads of videos to help guide you through any issues you may have. The Audacity community is also quite active, so post any problems you face and you&#039;re bound to get some help.&lt;br /&gt;
&lt;br /&gt;
With Audacity, you can record sound from Skype, but the quality can be too poor for broadcast, if you&#039;re hoping that stations will pick up the story. It is fine for the website. You can also use it to record conversations using any mic plugged into your computer, including the internal mic.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Methods&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
One of the reasons GenderIT encourages contributors to make audio is because the airwaves, including both mainstream and community radio, are still dominated by male voices, issues and concerns. Feminist audio is different from malestream audio in that:&lt;br /&gt;
&lt;br /&gt;
1) It privileges female voices, to address existing power imbalances.&lt;br /&gt;
2) It is always conscious of the power involved in any interview or discussion. Generally, if you are interviewing somebody, you hold more power than they do. It is your responsibility to ensure that their voice is heard in a way that is empowering for them. This means you allow them time to feel comfortable, to review what they have said, to restart or redo what they have said. Obviously there are exceptions – politicians and other prominent personalities may have more power than the interviewer. But, as a general rule, check whether these are voices that need to be heard on GenderIT. Do they have other ways of reaching a wide audience? If so, maybe we need to be looking for someone else.&lt;br /&gt;
&lt;br /&gt;
Follow these guidelines, bearing in mind what is written in the code of ethics and the manifesto, and you&#039;ll be producing radio-worthy audio in no time.&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Other resources&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
Some useful resources:&lt;br /&gt;
&lt;br /&gt;
1. Transom.org – a radio specialists&#039; guide to tools and tips for using sound editing software, including Audacity.&lt;br /&gt;
&lt;br /&gt;
2. The Audacity user community - http://audacity.sourceforge.net/community/users&lt;br /&gt;
&lt;br /&gt;
3. The AMARC Gender Policy is a useful document that looks at the issue of power and women&#039;s voices. http://www.amarc.org/index.php?p=Gender_Policy_entrance_page&lt;br /&gt;
&lt;br /&gt;
&lt;br /&gt;
&#039;&#039;&#039;Checklist&#039;&#039;&#039;&lt;br /&gt;
&lt;br /&gt;
1. Listen back to the audio recording. Sometimes strange things creep in without you noticing!&lt;br /&gt;
&lt;br /&gt;
2. Are all sound effects and/ or music licensed under an appropriate copy-free license?&lt;br /&gt;
&lt;br /&gt;
3. Make sure you can spell all names that are mentioned, for tagging online, and to make sure that any transcript is accurate.&lt;/div&gt;</summary>
		<author><name>Tarryn</name></author>
	</entry>
</feed>