It is easy to say that organizations are safer when they defend each other. In October 2024 we had the chance to prove it, in federal court, against a hacking group run by Russian intelligence.

What happened

For nearly two years, a hacking group linked to Russia’s Federal Security Service, known as Star Blizzard, spear-phished more than 30 civil society organizations: journalists, think tanks, and nonprofits working on democracy and human rights. The emails were careful. They impersonated colleagues and conference organizers, and they were built to steal the credentials of people whose work the Russian government wanted to see.

Any one of those organizations, on its own, would have seen a strange email and deleted it. Inside NGO-ISAC, members had been reporting the same lures and the same infrastructure to one another for months, and comparing notes made the pattern visible in a way no single organization could have seen alone. That record, and the relationships the community had built with Microsoft’s Digital Crimes Unit, made what came next possible.

Microsoft’s account · The Department of Justice announcement

What it proves

Star Blizzard was stopped because three things were true at the same time. Members had been comparing notes for months, so a pattern that no single organization could have seen on its own became visible. The NGO-ISAC Code of Conduct gave them enough confidence to share the details that made that record useful. And a partner with the resources to act on it, Microsoft, was in the room to hear it. Without any one of those, the group would still be running.

A community that grows because it delivers

In 2018, NGO-ISAC had 49 member organizations, a dozen partner companies, and no staff; volunteers ran everything. Today it has more than 500 member organizations and more than 80 technology partners, a weekly threat briefing, and a professional staff for the first time. Most of that growth came the same way it always has: a security person at one organization told a security person at another that this works.

The work is supported by foundations that understand civil society cannot do its work if it cannot do it safely, including the William and Flora Hewlett Foundation, the Spitzer Charitable Trust, the Klarman Family Foundation, and the Energy Foundation, and by technology partners who give the community their time, their tools, and their attention.

Most of what this work accomplishes never makes the news, because the point is that nothing happens: the password is not stolen, the ransom is not paid, the newsroom keeps publishing. Star Blizzard was one campaign out of many aimed at civil society every year, and most of the organizations being targeted are still not part of this community. The work ahead is to bring more of them in, so that an attack on one of them becomes a warning for all of them, and so that the people doing the attacking learn to expect an answer.