Do Know Harm

The NDItech team recently wrapped up a meeting of private sector security professionals advising on some of our work in difficult countries. It was a fascinating experience; while our team has got a pretty good grasp of the fundamentals, these people have to protect some of the world's most at-risk networks or write software that is proof against determined, well-funded adversaries.

Technology for international development is all too often segregated into its own little silo. That's sad when we can't tap into the innovation and expertise of the private sector for our work in general, but it could be tragic when it comes to the challenges of keeping democracy activists safe. Our people are up against well-funded and highly aggressive governments who are among the most dangerous forces in the world for stealing passwords, hacking servers, and dropping viruses on laptops; it is imperative that development organizations bring as much firepower as possible to bear from the other side.

My favorite quote from the event: "Do know harm."

We all know that perfect security is impossible, and that activists working with any form of electronic communication are putting themselves in jeopardy. One of the participants suggested that we needed to keep them away from any potentially risky technology and do no harm. No, rejoined another; it's "do know harm" - we need to make sure activists are aware what they're doing and what the dangers and consequences are. Different people have different tolerances for risk, and are using different tools in different ways. Simply trying to scare the pants off of everyone is likely to lead to two possible outcomes: either they panic and avoid tech all together, or they become entirely fatalistic, think that nothing matters in the face of an omnipotent evil regime, and give up on all precautions. That's a complete fail in either direction.

Calculated risk is the name of the game for these activists. To do the calculations you have to know the facts on threats, consequences and probabilities so they can make up their own mind in an informed way.

Over the next year NDI is going to be working to embed these principles of professional, localized risk assessment into the development of our technology programs in dangerous regimes. We'll share the stories we can along the way.