Cybersecurity is also about protecting rights

Translated by Laura Pérez Carrara. Also available on the APC website.

Every October, Cybersecurity Awareness Month highlights a number of recommendations that we have heard repeatedly, such as using secure passwords, activating two-step authentication, updating our devices and not clicking on suspicious links. These are all necessary measures for protecting accounts and devices, but they are not enough when it comes to threats faced by anyone who uses the internet to report abuses, investigate corruption cases, defend their territories or support victims of violence. A secure password, for example, does not prevent a journalist from being targeted by a harassment campaign or an environmental defender from receiving threats because of her work.

These threats also have a differentiated impact depending on the group targeted. According to a global survey conducted by UN Women, seven in 10 women human rights defenders, activists and journalists report having suffered online violence while carrying out their work. Technology-facilitated gender-based violence includes threats, harassment, surveillance, non-consensual dissemination of intimate images, doxxing (posting personal information of the targeted person) and smear campaigns that seek to intimidate, discredit and silence those who participate in public life.

Women and LGBTQIA+ persons, especially rights defenders, journalists or individuals who participate actively in public life, can face attacks that target them specifically because of their gender or their sexual orientation or identity. A harassment campaign can go as far as exposing where an environmental defender lives, compromising a journalist’s sources and putting someone who reports an abuse at risk.

Therefore, in addressing cybersecurity, we need to go beyond individual precautions. Different people face different threats and not everyone has the same resources to protect themselves. Recognising these differences is critical for developing digital security strategies that meet the needs of those who face the greatest risks.

Digital threats have offline consequences

In Latin America, digital technologies are part of the everyday work of social organisations and human rights defenders. They allow them to document abuses, coordinate actions, disseminate reports and maintain support networks. However, they can also be used for watching, intimidating and persecuting anyone engaged in social organisation processes, especially in contexts of territorial or political conflict.

The research study In Focus 2: An overview of digital threats in Latin America, conducted by Derechos Digitales in the framework of the Latin American Observatory on Digital Threats (OLAD), documented over a hundred cases of digital threats in Latin America that occurred between June 2024 and May 2025. The study addresses surveillance, censorship, data breaches, election-related disinformation and technology-facilitated gender-based violence, all of which impact privacy, freedom of expression and public engagement.

In this scenario, it is increasingly pointless to distinguish physical safety from digital security. Threats can begin in social media, continue with the disclosure of private information and spill over onto the spaces where the targeted persons live, work or organise. According to the UN Women survey mentioned above, four in 10 respondents reported having experienced offline attacks connected with online abuse.

Encryption protects our rights

End-to-end encryption, used by some messaging apps, makes it possible for the content of a communication to be accessible only to the message’s sender and intended recipient, provided it is correctly implemented and the devices are not compromised. This is particularly important for journalists who need to protect their sources, organisations that help victims of violence and communities that coordinate territorial defence actions.

However, encryption does not eliminate all risks. If someone (a criminal, the police or an intelligence agency using spyware) gains access to an unblocked phone, they can read the conversations directly. Moreover, encryption does not necessarily prevent messaging companies and internet providers from mining metadata, that is, information about the exchange, such as the time and date on which it took place, the devices the message was sent from and received on and, depending on the service, who took part in the exchange. Such data can also be obtained by government officials through requests to service providers or by way of surveillance mechanisms. Hence the importance of supplementing encryption with other security measures.

Protection and promotion of encryption also depend on each country’s legislation. In Chile, for example, the Framework Cybersecurity Act (Law No. 21,663) expressly recognises, as one of its principles, the right of every individual to take any computer security measures they consider necessary, including encryption. In Brazil, both the Constitution and the Internet Civil Framework protect confidentiality in communications, but neither expressly recognises encryption, and its scope has been debated in a case brought before the Federal Supreme Court in response to court-ordered measures to block WhatsApp access. As we examined in the regional report on policies and freedoms in the use of encryption, the differences in legal frameworks in Latin America pose major challenges for the protection of communications. That diversity can also be observed at the international level in the Global Map of Encryption Policies developed by Global Partners Digital.

Digital security is a collective responsibility

The responsibility of finding the right protection mechanisms begins with the organisations themselves. Before choosing applications or changing settings, an organisation needs to identify the information it wants to protect, as well as who could attempt to access it and what the consequences of disclosing that information would be – in short, what in digital security is known as risk analysis.

An environmental defence organisation, for example, may store testimonies, photographs, background information on reports and contact information of community members. In such cases, protecting information involves assessing where it is stored, who can access it and how long it needs to be stored. At Derechos Digitales, we have addressed the difficulties of implementing general recommendations in organisations that have limited resources, shared devices and multiple responsibilities, as well as the need to build on the safety practices that such organisations already have.

These decisions are connected with a broader discussion on technological autonomy. The choices regarding where to store data, what services to use and how much control an organisation retains over its information have implications for the organisation’s independence and security. Not every organisation can manage its own infrastructure, but they all need to assess the dependencies and risks associated with technology-related decisions.

Derechos Digitales provides tools to support these processes, including MicroSD, a guide for journalists and social communicators that contains practical tips for protecting data, devices and communications, and a free course on digital security with resources to teach people how to protect themselves online.

Digital security also requires resources and ongoing support. As the Internet Society noted, the organisations on the front lines fighting for a safer internet need funding to sustain their work. Without that support, many protection initiatives are forced to rely on isolated efforts and on capacities that are not always available.

However, the responsibility does not lie with organisations alone. Platforms must offer effective mechanisms for reporting and addressing abuses, without giving up point-to-point encryption protection. States, for their part, have the obligation to protect people’s rights in the digital sphere. This entails enhancing privacy and security guarantees, not demanding backdoors or other ways of bypassing encryption, as well as preventing cybersecurity policies from becoming an excuse to expand surveillance or to persecute those working for a safer internet.

The Ola Bini case shows that the latter risk is not hypothetical. In early October, Ecuador deported the digital security expert after revoking his visa because the government claimed he posed a threat to national security, while a habeas corpus action was still pending.

Cybersecurity Awareness Month and Global Encryption Day provide an opportunity to take this discussion beyond the usual recommendations. The question is not only what tools are available to protect us, but also what conditions are necessary to enable that protection. Because a safer internet is not built with better technologies only. It also requires decisions that focus on people’s rights.