Holistic and Organizational Security Strategy

Security is often viewed through a narrow lens of technical tools—VPNs, encryption, and secure phones. While vital, these digital measures are only one pillar of protection. The Islamic Republic's security apparatus employs a strategy that targets not just devices, but the physical safety and psychological resilience of individuals and groups.

Holistic Security is an integrated approach that recognizes the deep connections between digital security, physical security, and psycho-social well-being. A breach in one area often leads to vulnerabilities in the others. For example, extreme stress (psycho-social) can lead to careless password management (digital), which can result in arrest (physical).

This guide provides a framework for individuals and organizations to build resilience against comprehensive state surveillance and repression.

---

1. The Holistic Framework

To survive and thrive in a high-threat environment, security strategies must address three interconnected domains:

1. Physical Security: Protection of your body, home, office, and physical assets from raids, detention, and violence.
2. Digital Security: Protection of data, communications, and online identity from interception, hacking, and surveillance.
3. Psycho-social Well-being: Maintenance of mental health, emotional resilience, and healthy group dynamics to prevent burnout and manipulation.

The Cycle of Vulnerability

State actors often exploit stress and trauma. Interrogators use psychological pressure to extract digital passwords. Conversely, digital harassment (doxxing) causes real-world anxiety and physical danger. Your strategy must break this cycle by strengthening capacities in all three areas simultaneously.

---

2. Situational Monitoring and Analysis

Security is not a static state; it is a response to an ever-changing environment. You must regularly analyze the context in which you operate to anticipate threats before they manifest.

PESTLE Analysis for Iran

A structured way to monitor changes is the PESTLE framework. Regularly ask how developments in these areas affect your security:

• Political: Are there new hardline appointments? Has rhetoric against "foreign agents" intensified?
• Economic: Is inflation driving social unrest? Are sanctions affecting access to secure hardware?
• Social: Are public protests shifting? Is there increased polarization or solidarity?
• Technological: Is the "National Information Network" (halal internet) expanding? are new blocking protocols being tested?
• Legal: Are there new bills criminalizing online speech or encryption?
• Environmental: Do floods or earthquakes create physical vulnerabilities or cover for state crackdown?

Security Indicators

A security indicator is any anomaly that suggests a change in your threat landscape. Trust your intuition, but verify with allies.

• Digital: Unexpected password resets, strange noises on calls, 2FA codes you didn't request, rapid battery drain.
• Physical: Unfamiliar cars parked near your home, increased police presence, being followed.
• Psycho-social: Sudden onset of insomnia, hyper-vigilance, team arguments, or an unexplained sense of dread.

Action: Create a secure log of these indicators. Share them with trusted partners to determine if they are isolated incidents or part of a coordinated campaign against your network.

---

3. Organizational Security Strategy

Groups and organizations face complex challenges. You must balance openness (to grow the movement) with secrecy (to protect members).

Assessing Capacities and Vulnerabilities

Before creating new rules, evaluate what you already have:

• Capacities: Strengths that reduce risk (e.g., a lawyer on retainer, technical expertise, strong trust bonds).
• Vulnerabilities: Weaknesses that increase risk (e.g., an unencrypted office server, a member prone to panic, reliance on insecure funding channels).

Building a Security Culture

Policies are useless if ignored. To build a culture of security:

1. Participatory Design: Involve all members in creating security protocols. Rules imposed from the top are often ignored by field staff who find them impractical.
2. Safe Spaces: Create environments where staff can admit mistakes (e.g., clicking a phishing link) without fear of punishment. Early reporting saves lives.
3. Regular Review: Security plans are living documents. Review them after every major incident or political shift.

Managing Infiltration and Mistrust

The fear of informants is a potent weapon used by intelligence agencies to paralyze groups.

• Avoid Paranoia: Constant suspicion destroys group cohesion. Assume surveillance exists but focus on mitigation rather than witch-hunts.
• Compartmentalization: Not everyone needs access to everything. Use the "Need to Know" principle.
• Behavioral Red Flags: Be cautious of individuals who push for violent or illegal actions that endanger the group (agent provocateurs), or who consistently ignore security protocols.

---

4. Psycho-social Resilience and Stress Management

Activism in Iran is inherently stressful. Long-term exposure to threats, interrogation, or the trauma of witnessing violence can degrade cognitive function, making you vulnerable to mistakes.

The Impact of Stress on Security

• Hyper-vigilance: Seeing threats where none exist, leading to exhaustion and isolation.
• Numbness/Denial: Ignoring real warnings because the brain cannot process more fear.
• Rigidity: Refusing to adapt tactics despite changing circumstances.

The Stress Table Exercise

Map your personal stress indicators to recognize when you are entering the "Red Zone."

Group Dynamics Under Threat

When a group is threatened, it often becomes more authoritarian and rigid. Decision-making centralizes, and dissent is silenced.

• Counter-measure: Establish clear decision-making protocols before a crisis hits.
• Counter-measure: Practice "Non-violent Communication" to resolve internal conflicts preventing security discussions.

---

5. Creating Security Plans and Agreements

A security plan transforms analysis into action. It should cover prevention, response, and recovery.

Prevention

• Digital Hygiene: Mandating 2FA, encryption, and secure communication channels (e.g., Signal).
• Physical Hardening: Secure office access, clear desk policies, and counter-surveillance drills.
• Vetting: Protocols for onboarding new members and volunteers.

Emergency Response (Crisis Management)

When prevention fails (e.g., an arrest or raid), you need an immediate, pre-rehearsed plan.

• The Panic Button: Is there a mechanism to alert the team immediately if a raid begins?
• Data Destruction: Who is responsible for wiping devices? (See Data_Encryption_Storage_and_Destruction.md).
• Legal Support: Do you have a lawyer's number memorized or written on your body?
• Communication Tree: Who calls whom? Ensure family members know what to do without revealing sensitive info.

Information Classification

Not all data is equal. Categorize your information assets:

1. Public: No harm if released (e.g., published articles).
2. Internal: Harmful if leaked (e.g., draft strategies, financial logs).
3. Restricted: Grave danger if leaked (e.g., source identities, victim testimonies, private keys).

Apply strict access controls to Restricted data.

---

6. Actionable Checklist for Iranian Activists

1. Map Your Ecosystem: Identify where your physical, digital, and emotional vulnerabilities lie.
2. Secure Your Circle: Form "Affinity Groups" (small, trusted teams) for protests and high-risk work. Care for each other.
3. Formalize Protocols: Write down your security agreements. Don't rely on unspoken understandings.
4. Drill Your Plan: A plan that hasn't been tested will fail. Roleplay a raid or device seizure scenario.
5. Prioritize Health: Treat rest and mental health support as critical operational tasks, not luxuries.
6. Stay Agile: The repressive tactics of the state evolve; your security strategy must evolve faster.

---

Further Reading & Resources

• Tactical Tech's Holistic Security Manual – The foundational text for this approach.
• Front Line Defenders Workbook on Security – Practical steps for risk assessment.
• Digital First Aid Kit – For immediate troubleshooting during digital emergencies.