Small organisations, real data: AI and cybersecurity for civil society

In June I represented COMoG at the Ghana Civil Society Forum 2026. One of the themes was the responsible integration of artificial intelligence and cybersecurity in civil society work. As someone who builds software, that theme stayed with me most, and I have kept thinking about what it means in practice for the organisations I know.

This post is my own take, as an engineer who also works alongside civil society groups. It is not a summary of the forum’s sessions.

Why civil society is a target

Civil society organisations (CSOs) often hold some of the most sensitive information in a country: reports from election observers, stories from survivors, details of whistleblowers, the names and phone numbers of community volunteers. They also hold something attackers value just as much: public trust. A CSO’s Facebook page or email account, once taken over, can spread misinformation with the organisation’s credibility attached.

Yet most CSOs are small. They rarely have an IT team, let alone a security team. Laptops are shared, passwords are shared, and the organisation’s main social media account is often logged in on several personal phones.

That combination of valuable data, public trust and thin defences is exactly what attackers look for.

A baseline that fits a small budget

You don’t need an expensive tool to make a big difference. These four areas cover most of the risk I see.

1. Accounts

• Turn on two-factor authentication for the organisation’s email and every social media account. Prefer an authenticator app over SMS where possible (here’s why).
• Stop sharing passwords by WhatsApp or on paper. A password manager lets a team share access without everyone knowing the password, and makes it easy to remove someone who leaves.
• Keep a list of who has access to what, and review it whenever someone joins or leaves.

2. Data

• Collect less. Every field on a form is data you now have to protect. If you don’t need someone’s date of birth or home address, don’t ask for it.
• Know where your data lives: which spreadsheet, which phone, which shared drive, which WhatsApp group.
• Delete it on a schedule. Ghana’s Data Protection Act, 2012 (Act 843) expects organisations not to keep personal data longer than they need it. Old data you no longer use is pure risk.

3. AI tools

AI tools can genuinely help small teams: drafting reports, translating materials into local languages, summarising long documents. But they need rules.

• Don’t paste personal or sensitive information into public AI chatbots: names of beneficiaries, survivor testimonies, unpublished findings. Depending on the service and its settings, what you type may be stored or used to improve the product. Read the data terms, or assume it is not private.
• Check every output. AI can produce confident, well-written text that is simply wrong, including invented facts and sources. For an organisation whose value is credibility, publishing an AI error can do real damage.
• Be honest about AI use in your publications where it shaped the content.
• Expect AI to be used against you too: more convincing phishing emails in perfect English, and fake audio or video of public figures, especially around elections. Verify before you share.

4. People

Most successful attacks still begin with a person being tricked.

• Verify before you click, pay or share. Urgent requests for money, passwords or documents, even ones that seem to come from a director or a partner, should be confirmed through a second channel, such as a phone call to a number you already have.
• Make reporting easy and blame-free. A volunteer who clicked a bad link should feel safe saying so within minutes, not hide it for weeks.
• Report incidents. In Ghana, the Cybersecurity Act, 2020 (Act 1038) established the Cyber Security Authority, which receives reports of cyber incidents.

Where builders like me come in

Most security guidance is written for companies with security budgets. Civil society needs something different: tools and defaults that are secure without needing an expert to configure them, and training in plain language, in local languages, built around the phones and shared laptops people actually use.

That gap, between how security is designed and how small organisations actually work, is one I care about closing. It is part of why I want to keep studying cybersecurity, not only as a technical field, but as something that protects democratic and community work.

If your organisation would like to talk through any of this, get in touch.