The adversaries targeting civil society work together. The people defending it should too.Why it existsA think tank gets a phishing email on Monday. A foundation gets the same one on Tuesday. A relief agency gets it on Wednesday. Each one has a single person, or no one, deciding whether it is real, and each decides alone. The attacker ran one campaign. The defenders fought three separate battles, and none of them learned from the others. That is how civil society has been defended for most of its history, and it is why the people who target it keep coming back. The weakness was never the size of the team. It was the isolation. The NGO-ISAC community exists so that the person defending a nonprofit is never alone with the problem.
What we believeDefense is collective or it is not defense. When one organization is hit, every other organization should learn from it the same day. When something looks wrong, there should be a trusted room to ask in, where someone has already seen it. And a room like that runs on trust, built deliberately: every member agrees to the Community Code of Conduct, what is shared in the room stays in the room, and nothing is attributed to a member organization unless it chooses. That is why members describe incidents in detail, and detail is what makes the next organization safe. What that means
Where this goesEvery organization that joins makes every other organization safer, because the community sees what each member sees. More than 500 organizations are in the room today, alongside more than 80 technology partners who come to listen. Most of civil society is still outside it. Our aim is a room large enough that no U.S. civil society organization under threat is ever more than one message away from someone who has seen it before, and strong enough that the people who target civil society have to assume it will answer together. |