Personal Security for High-Risk Individuals Guide: Journalists, Activists and Public Figures

Journalists, activists, human rights defenders, politicians and other public figures are targeted by attackers with far more patience and money than the scammers ordinary security advice is built for, and the consequences of a breach can include exposed sources, harassment, physical danger and prosecution. CISA's High-Risk Communities programme and the UK NCSC's guidance for high-risk individuals both start from the same point: these people are targeted because of who they are or what they do, often with limited budgets and no security team. This guide sets out a practical programme for them: build a threat model, lock down the accounts that matter, harden devices with the modes designed for targeted users, shrink the information that enables doxxing and impersonation, travel safely, and know who to call. It is for the individuals themselves, and for newsrooms, NGOs, campaigns and offices that support them. It goes beyond the Doxxing Prevention Guide and links to deeper guides rather than repeating them.

Key takeaways

• Start with a threat model, not a product. The Electronic Frontier Foundation's six questions (what to protect, from whom, how bad failure is, how likely, how much effort, who your allies are) decide which of the measures below you need.
• Phishing-resistant sign-in is the single biggest upgrade. Passkeys or hardware security keys on email, cloud and messaging accounts stop most account takeovers; Google's Advanced Protection Program requires them.
• Use the modes built for targeted people. Apple Lockdown Mode and Android Advanced Protection reduce the attack surface that mercenary spyware relies on, at a real cost in convenience.
• Your public footprint is the attacker's research. NCSC notes that personal information on social media is used to craft spear-phishing; addresses, family details and routines also enable physical threats.
• Know your emergency contacts before you need them. Access Now's Digital Security Helpline offers free 24/7 support to civil society, and Apple directs threat notification recipients to it.

Who is high-risk and what they face

CISA describes high-risk communities as activists, journalists, human rights defenders, academics and staff of civil society organisations. The NCSC's definition adds political figures and their staff and legal professionals: people whose work or status gives them access to, or influence over, information that nation state actors might want. Public figures such as executives, celebrities and influencers face many of the same techniques from criminals and harassers. CISA's High-Risk Communities Protection threat report, published through the Joint Cyber Defense Collaborative in May 2024, documents state-linked targeting of civil society.

Build a threat model in an hour

The EFF's Surveillance Self-Defense project frames a security plan as six questions. Working through them with a colleague, an editor or a security volunteer takes about an hour and prevents both under-protection and exhausting over-protection.

1. What do I want to protect? List the data that matters (sources, contacts, drafts, location, family details, finances) and where each one lives: which devices, which cloud accounts, which messaging apps.
2. Who do I want to protect it from? Name specific adversaries, including careless trusted people, such as a colleague who forwards a document or a relative who posts photos.
3. How bad are the consequences if I fail? Distinguish embarrassment from exposure of a source or a physical threat.
4. How likely is it? Separate what could happen from what probably will. A government that has jailed journalists in your field is a likely adversary; a theoretical attack on your router is not.
5. How much trouble am I willing to go through? Match measures to your budget, skills and daily work.
6. Who are my allies? Agree with colleagues how you will look out for each other and what you will share.

Revisit the plan when your situation changes: a new investigation, an election, a period of unrest, or colleagues reporting that they are being targeted (a trigger the Committee to Protect Journalists specifically calls out).

Lock down the accounts that matter

For most high-risk people, the accounts that would do the most damage if taken over are the primary email account (it resets everything else), the cloud account holding phone backups and photos, the main messaging apps, and public social media accounts. Lock these down first.

• Separate identities: NCSC and CPJ both recommend keeping professional and personal accounts apart. A public-facing account should not share an email address or phone number with private accounts or with family.
• Delegate public accounts properly: for social media run by a team, NCSC suggests a management service so staff can post without sharing the password.
• Review sessions: CPJ advises regularly checking each account for unrecognised devices and logging them out, and checking whether your addresses appear in known breaches.
• Treat unexpected sign-in prompts as an attack: NCSC says not to approve an unexpected 2SV request, and to change the password on that account and any other account where it was reused.
• Delete what you do not use: dormant accounts with old passwords are easy targets. CPJ recommends removing content and deleting unused accounts.

The phone and carrier side (SIM swap protection, encrypted calling, taking the phone number out of authentication) is covered in depth in the Mobile Communications Protection for High-Risk Individuals Guide, which builds on CISA's mobile communications best practice guidance. See also the Phishing-Resistant MFA Guide.

Harden devices for targeted attack

Mercenary spyware and targeted exploits usually arrive through complex features: message attachments, link previews, web technologies and connections to accessories. The platform modes designed for targeted users switch many of these off.

Apple Lockdown Mode

Apple describes Lockdown Mode as an optional, extreme protection for the very small number of people who might be personally targeted by highly sophisticated threats such as mercenary spyware. It is in Settings, then Privacy and Security, then Lockdown Mode on iPhone and iPad (iOS 16 or later), and in System Settings on a Mac (macOS Ventura or later). It must be enabled on each device. Its main effects:

• Messages: most attachment types are blocked except certain images, video and audio; links and link previews do not work.
• Web: complex web technologies are blocked, so some sites load slowly or break.
• FaceTime: incoming calls are blocked unless you have called that person in the previous 30 days.
• Connections: the device must be unlocked to connect to accessories or computers; it will not auto-join non-secure Wi-Fi, and 2G and 3G are turned off.
• Management: configuration profiles cannot be installed and the device cannot enrol in device management, which matters if your employer uses MDM.
• Exclusions: you can exclude trusted apps, websites or contacts, but Apple notes this lowers protection.

Android Advanced Protection

On supported Android devices, Advanced Protection is in Settings, then Security and Privacy, then Advanced Protection. Google's documentation lists what it enforces: Play Protect cannot be disabled, apps from unknown sources are blocked, accessibility services are limited to verified tools, 2G connections are blocked on supported devices, USB is protected while the screen is locked, the device reboots automatically after 72 hours locked, Chrome enforces HTTPS and turns off its JavaScript optimiser and WebGPU, and an optional Intrusion Logging feature stores encrypted security logs in the cloud for later investigation. A separate Account protection step enrols the Google account in Advanced Protection.

Everyday hygiene that still matters

• Update fast and replace old devices: NCSC advises automatic updates and replacing devices that no longer receive security updates. Restarting regularly can also clear some non-persistent spyware, a point CPJ makes for people at risk.
• Encrypt and lock: full-disk encryption (FileVault, BitLocker) and a strong passcode required at power-on.
• Avoid unknown USB: NCSC advises avoiding public USB charging points; CPJ warns against free USB drives at events.
• Enable remote wipe in advance: Find My or Find My Device, understanding that it only works when the device can reach a network.
• On Windows: NCSC suggests S mode, which only allows apps from the Microsoft Store.

Choosing a level

Shrink the footprint that enables doxxing and impersonation

Attackers research targets before they act: MITRE ATT&CK lists Gather Victim Identity Information (T1589) and Search Open Websites/Domains, including Social Media (T1593.001), as reconnaissance techniques. CPJ's guidance for journalists is concrete:

• Search yourself regularly: name, address, phone number and date of birth, and record what you find. Set up alerts for your name and personal details.
• Remove and restrict: lock down social media, including old photos, and ask family and friends to remove information they have posted about you.
• Close the less obvious gaps: internet archives, your home on online map street views (most map services allow blurring), and data broker listings. CPJ suggests data-removal services for US-based journalists and right-to-be-forgotten requests in Europe.
• Prepare for impersonation: NCSC warns high-risk people about fake profiles, voice clones and deepfakes. Tell colleagues and contacts how you will and will not contact them, and verify new contacts by calling first. See the Spotting Deepfake Scams Guide.
• Protect family: relatives' accounts and posts are often the weakest link. Include them in the plan.

The step-by-step removal process is in the Doxxing Prevention Guide and the Social Media Privacy Settings Guide.

Travel and border crossings

Travel concentrates risk: devices can be searched or taken at borders, hotel rooms are not private, and local networks may be monitored. CPJ's advice for journalists:

1. Decide what travels: assume devices may be searched as closely as printed notes. Back up and remove anything you would not want officials to see, or travel with clean devices that hold only what the trip needs.
2. Prepare the device: log out of sensitive accounts, uninstall apps you do not need on the trip and clear browsing history.
3. At the border: power devices off so disk encryption is fully active, keep them in sight during checks, and turn off biometric unlock where devices may be seized, because a face or fingerprint can be used without your cooperation.
4. After a seizure: if a device was taken out of your sight or altered, assume it is compromised. Do not reconnect it to your main accounts; have it examined or replace it, and change passwords from a clean device.

Laws on compelled device access differ by country, so get legal advice before travelling to places where your work is sensitive. For general traveller precautions, see the Travel Cybersecurity Guide.

Threat notifications and getting help

Apple sends threat notifications when it detects activity consistent with a mercenary spyware attack against an individual, describes them as high-confidence alerts to be taken very seriously, and does not explain what triggers them. They appear on the iPhone Lock Screen and in Settings, by email from [email protected], and as a banner at account.apple.com. Apple never asks you to click links, install anything or share your password or a code in these messages, so verify by signing in to account.apple.com directly. Apple recommends Lockdown Mode and contacting Access Now's Digital Security Helpline.

For organisations supporting high-risk people

• Fund the basics: buy two security keys per person, pay for a password manager, and replace devices that are out of support. These cost little next to a compromised source.
• Cover personal accounts: attackers go after personal email and messaging because they are outside corporate controls. Offer help securing them.
• Plan for MDM conflicts: Lockdown Mode blocks device management enrolment, so decide in advance how high-risk staff with managed devices are handled.
• Measure coverage: track the share of high-risk staff with phishing-resistant MFA on primary email, with Lockdown Mode or Advanced Protection enabled, on supported device versions, with a completed threat model reviewed in the last 12 months, and the time from a reported incident to expert help.

Common failure patterns

• Buying tools before a threat model: people adopt complex tools for unlikely threats while their primary email still uses SMS codes.
• One phone number everywhere: the same number on public profiles, recovery settings and family chats makes SIM swap and doxxing easy.
• Clicking the "threat notification": attackers imitate security alerts; only the alert visible at account.apple.com after signing in yourself is proof.
• Ignoring the family: a relative's public post reveals the home address the target worked hard to hide.
• Reusing a seized device: a phone returned after a border inspection goes straight back into daily use.
• Excluding everything from Lockdown Mode: each exclusion reopens a path the mode was meant to close.

Framework mapping

Practitioner checklist

• Write a threat model using the EFF's six questions and review it at every major change of work.
• Put passkeys or two security keys on primary email, cloud and messaging accounts; consider Google's Advanced Protection Program.
• Separate public and private accounts, email addresses and phone numbers, and remove the phone number from account recovery where possible.
• Turn on Lockdown Mode (iOS 16 or later) or Android Advanced Protection on the main phone if state actors are plausible adversaries.
• Keep devices updated, encrypted and in support; restart phones regularly; avoid unknown USB.
• Search yourself, remove exposed details and brief family on what not to post.
• Prepare travel devices and turn off biometric unlock before border crossings; treat any seized device as compromised.
• Save Access Now's helpline, CISA or NCSC contacts and your organisation's security contact before you need them.

Standards and references

• CISA: High-Risk Communities
• National Cyber Security Centre: Guidance for high-risk individuals
• Apple: About Lockdown Mode
• Apple: About Apple threat notifications and protecting against mercenary spyware
• Google: Android Advanced Protection
• Google: Advanced Protection Program
• Electronic Frontier Foundation: Your Security Plan (Surveillance Self-Defense)
• Committee to Protect Journalists: Digital Safety Kit

Related NHI Mgmt Group resources: Doxxing Prevention Guide · Mobile Communications Protection for High-Risk Individuals Guide · Commercial Spyware Guide · Phishing-Resistant MFA Guide · Travel Cybersecurity Guide