For a long time, cyber attacks were associated with governments, big corporations, and major institutions. Small civil society organisations were often overlooked. They were seen as too small to matter, too insignificant to target.
That reality has changed.
Across Uganda and the wider region, Defenders Protection Initiative (DPI) is witnessing a steady rise in cyber attacks against small and medium-sized CSOs. These organisations, often operating with limited budgets and small teams, have become attractive targets for a wide range of actors.
Understanding why this is happening is the first step toward defending against it.
Small CSOs hold powerful information
Even the smallest organisation often manages sensitive data:
- Lists of beneficiaries
- Testimonies from survivors
- Reports on abuses
- Donor records
- Financial documents
- Contact details of activists
- Internal strategies
For adversaries, this information is valuable. It can be used to intimidate individuals, disrupt projects, discredit organisations, or manipulate communities.
An attacker does not need to break into a ministry database if they can access the same information through a poorly protected NGO system.
Limited resources create easy entry points
Most small CSOs operate under serious financial pressure. They prioritise programme delivery over infrastructure. As a result:
- Old laptops remain in use for years
- Software updates are delayed
- Free hosting is used without security support
- Shared passwords become normal
- Backups are neglected
- Technical support is outsourced irregularly
These conditions create weak points that attackers easily exploit.
In many cases, a simple phishing email is enough to compromise an entire organisation.
Digital attacks are cheaper than physical repression
Targeting an organisation physically attracts attention and international scrutiny. Digital attacks are quieter and cheaper.
With minimal resources, an attacker can:
- Take over email accounts
- Delete important files
- Monitor communications
- Spread false information
- Block access to systems
- Leak internal documents
These actions weaken organisations without creating obvious evidence of repression.
For hostile actors, this is efficient and low-risk.
Small organisations are closer to communities
Grassroots CSOs often work directly with affected populations: land defenders, women’s groups, journalists, informal workers, and displaced communities.
This closeness makes them strategically important.
When a small organisation is compromised:
- Communities lose trust
- Beneficiaries become afraid
- Documentation stops
- Advocacy slows down
- Networks fragment
By targeting small organisations, attackers disrupt entire ecosystems of activism.
The human factor remains the biggest risk
Most successful attacks do not begin with advanced hacking tools. They begin with human interaction.
We commonly see:
- Fake donor emails requesting documents
- Impersonation of partners
- Messages pretending to be from management
- “Urgent” compliance notices
- Fake job offers or training invitations
Staff members, under pressure and working with limited support, respond quickly. One click can open the door to attackers.
This is not carelessness. It is a result of overwork and inadequate training.
Why awareness alone is not enough
Many organisations are now aware of cyber risks. Awareness, however, does not automatically translate into safety.
Without systems, awareness fades.
Effective protection requires:
- Clear digital security policies
- Defined access levels
- Regular training
- Incident response procedures
- Secure backups
- Leadership commitment
- Budget lines for security
Security must be institutionalised, not improvised.
DPI’s approach to protecting small CSOs
At DPI, our work goes beyond emergency response. We focus on building long-term resilience.
Our approach includes:
- Digital security assessments
- Tailored trainings
- Website and infrastructure hardening
- Incident response support
- Staff mentoring
- Policy development
- Network-based protection models
We work with organisations to strengthen their systems in ways that fit their realities.
There is no one-size-fits-all solution.
What small CSOs can start doing today
Every organisation, regardless of size, can begin with these steps:
- Use strong, unique passwords and a password manager
- Enable two-factor authentication on all major accounts
- Separate personal and organisational devices
- Update systems regularly
- Set up automatic backups
- Limit access to sensitive files
- Document who controls what
- Train staff at least once a year
- Create a simple incident response plan
- Know where to seek help
These actions are practical, affordable, and effective.
Conclusion: Security is now part of sustainability
Sustainability is not only about funding and programmes. It is also about protection.
An organisation that cannot protect its data, staff, and communications cannot sustain its work.
As digital threats continue to evolve, small CSOs must adapt. With the right support, systems, and mindset, they can remain strong, credible, and resilient.
DPI remains committed to walking this journey with civil society organisations, ensuring that defenders are not left alone in the digital battlefield.
