Make your security plan

Start with what you value. Usually it is information: emails, contacts, messages, documents, your location. Your phone and computer count too. EFF says that trying to protect all your data from everything, all the time, is "impractical and exhausting". The list helps you choose.

1. Write down what you keep: accounts, devices, chats, contacts, documents, photos, where you live and go, and your bank accounts.
2. For each one, note where it is kept, who has access to it, and what stops others getting in.
3. Ask what would happen to you, your family and, if you are a journalist, your sources, if it were exposed, lost or changed.
4. Add how you communicate: who you talk to, through which apps, and what you share.

The list protects nothing by itself, and it can become a target. If it names people or places, keep it somewhere safe or destroy it when you have finished.

A person or organisation that could harm what you protect is called an adversary. EFF's examples include your boss, the police, a former partner, a business competitor, a government, or a hacker on a public network. It can also be someone you trust who is careless. Their skills vary widely: some use advanced spyware, others simply screenshot your private messages.

1. Write down who might want your information, and what they would do with it.
2. For each, note what they can actually do. Someone who has held your phone or shares your mobile plan can see a lot without any technical skill. Your mobile operator has your call records.
3. Remember that attackers may target a colleague or family member to reach you.
4. Even when messages are end-to-end encrypted, the company can often see who you talk to and when: see Know what each app can read.
5. What you post can be used to write convincing fake messages to you, and attackers may use cloned voices: see Stop before you act.

Naming an adversary doesn't tell you what they are actually doing. Keep apart what might happen and what is likely to happen: that is the next item.

For each threat, weigh two things: how likely it is, and how bad it would be if it happened. The threats that are both likely and serious come first.

1. For each threat, ask how likely it is and how bad the consequences would be, for you and for the people around you.
2. Write down which threats you will take seriously, and which are too rare, too harmless or too hard to fight to worry about now.
3. Check your conclusions with someone you trust. Another person may see a risk you missed or one you overrate.

Your ratings are guesses and can be wrong. Some people choose to protect against a threat whatever the odds, and that is a valid choice. Feeling safe is not the same as being safe: check that what you already do matches the threats you found.

Every protection costs something: time, money, convenience or features. Some steps also draw attention, or can make things worse.

1. Note your limits: money, technical skill, time, and people who would notice if you changed things.
2. The strongest settings switch features off. Lockdown Mode on iPhone limits some apps, websites and features. Some services fall back to SMS when you recover an account, so SMS can't always be avoided.
3. Some tools, such as those that hide what you do online, are illegal in some countries, or can be seen as a sign that you are doing something wrong. Ask whether another way reaches the same goal.
4. Back up your files before you erase or reset a device, or you will lose them. If you think it has spyware, get expert help first: a reset deletes the evidence, and restoring a full backup can bring the problem back.
5. Before you report or delete abusive messages, take screenshots: reporting can remove them.

Acting slowly and quietly lowers the risk of a reaction, but leaves their access in place for longer. Against an attacker far away who can't see your phone, changing things quickly costs nothing.

Pick the guides that answer the threats you wrote down. Start with the ones that are likely and serious.

1. Someone could get into your accounts: protect your accounts and passwords, recognise fake messages and calls and keep If your account was hacked at hand. Then make your accounts hard to take over.
2. Someone could get hold of your phone or computer, or attack it from afar: lock down your phone and your computer, then harden your phone against targeted attacks. If a device may be taken or searched, see if your phone or computer may be taken. If you fear spyware, see spyware aimed at you.
3. Someone could read your messages or learn who you talk to: messaging apps, then keep sensitive conversations private and use email when it's sensitive. If you work with sources or sensitive files, see protect sources and sensitive documents.
4. Someone could find out where you are: location and photos. If you need to read or publish without revealing who you are, see go online without revealing who you are.
5. Your posts could be used against you: social media. If you are harassed or your details are published, see handle online harassment and doxxing.
6. You could lose your data: backups.
7. You are going to a protest: protect your phone and others at a protest.
8. You are travelling or crossing a border: travel and cross borders with your devices.
9. You work in a newsroom, NGO or group: keep a small team secure.

A guide covers common threats, not your exact situation. If a mistake could put you or others in danger, get expert help: see the next item.

If you are being attacked, think your phone has spyware on it, or a mistake could put someone in danger, contact experts instead of improvising. Contact them from a device the other person hasn't had access to.