# đđź Welcome to DigiSafe
A step-by-step digital safeguarding guide. For charities designing new services or taking existing ones online.
## Contents
### :rocket: [1. Start here](/chapters/start-here)
What DigiSafe will do for you. How to use it.
### :deciduous\_tree: [2. Build foundations](/chapters/build-foundations)
How to integrate digital risks and safety into your existing safeguarding policy. The groundwork for your DigiSafe journey.
### :scales: [3. Assess risk](/chapters/assess-risk)
How to assess and mitigate risk as you design and deliver an online service. The best tool for designing a safe service.
### :clipboard: [4. Apply principles](/chapters/apply-principles)
Universal digital safeguarding principles you need to design for. These apply to any service delivered in part or in whole via any digital platform.
### :reminder\_ribbon: [5. Design for safety](/chapters/design-for-safety)
Different online service types. The particular risks and issues of each.
### :mortar\_board: [6. Educate everyone](/chapters/educate-everyone)
How to teach your users to stay safe and your staff to identify abuse.
## About
Published by [Catalyst](https://www.thecatalyst.org.uk/). Written and designed by four organisations working together to the[ Catalyst charter](https://www.thecatalyst.org.uk/charter): [AVA Project](https://avaproject.org.uk/), [CAST](https://wearecast.org.uk/), [SIDE Labs](https://www.sidelabs.org/) and [Working with Joe](https://workingwithjoe.co.uk/).
#### DigiSafe is...
* Currently in Alpha. That means we are testing it out and expect to iterate it further. Please [feed back on your experience](https://docs.google.com/forms/d/e/1FAIpQLSf7JR3uaM9LFBoqCorilfspXVY6DasFCpO09MKj_WJZ8E1wGQ/viewform).
* Published using [GitBook](https://www.gitbook.com/), which offers [discounts for non-profits](https://docs.gitbook.com/pricing/non-profit-and-open-source-discounts).
* Released under a Creative Commons license ([Attribution-ShareAlike 4.0 International](https://creativecommons.org/licenses/by-sa/4.0/)).
* Evolved from AVAâs [Digital Safeguarding Guide](https://avaproject.org.uk/wp-content/uploads/2020/05/Digital-Safeguarding-Resource-Pack-FINAL.pdf) (April 2020).
* Funded by The Clothworkers' Foundation.
June 2020
# 1. Start here
What DigiSafe will do for you. How to use it.
## Your new digital safeguarding guide
DigiSafe will help you build safeguarding measures into the design and delivery of your digital services. And itâll help you do it in a way that cares for your usersâ wellbeing and mental health.
Weâve written it because since April 2020 thousands of charities have been migrating their face-to-face services online. This explosion of new digital services demands new digital safeguarding guidance.
Guidance on how to design services with safety, privacy and consent in mind.
And guidance on how to recognise safeguarding and privacy issues when delivering any service online.
DigiSafe addresses:
* Risk assessing any service you intend to offer online
* Designing new or existing online services with safety in mind
* Recognising safeguarding issues when delivering services through digital platforms
## A design-first approach
DigiSafe takes a [design-first approach](http://www.thecatalyst.org.uk/blog/design-more-important-than-digital-for-charities). It works best if you are following an intentional process to identify safe, accessible and impactful ways to deliver the services your users need, online.
There are many reasons to deliver online. While this guide focuses on the risks, we encourage you to also [learn about the benefits](https://medium.com/@wearecast/bringing-digital-into-service-delivery-c66aefc11d9a). That way you can make informed and balanced decisions on how to deliver your service both safely and impactfully.
## Your digital safeguarding journey
DigiSafe will help you at any stage of your journey, from having no digital safeguarding policy, to designing and delivering specific services. At each stage itâll make it easier for you to learn the ropes and take action.
Itâll also help you teach your staff how to recognise and understand safeguarding issues when delivering online.
And itâll help you do all of this while continuously assessing risk. Your risk assessment will become a live dashboard that you revisit at each journey stage.
## How to use DigiSafe
You donât need to read all of DigiSafe to get started. But we do suggest following all the advice that applies to your services and keeping your risk assessment updated throughout the process.
* **Got a digital safeguarding policy?** You can probably skim or skip [Chapter 2](/chapters/build-foundations).
* **Already risk assessed your online services?** You might not need to implement all the advice in [Chapter 3](/chapters/assess-risk).
* **Designing a new service or changing an existing one?** Read all of [Chapter 4](/chapters/apply-principles) and [Chapter 5](/chapters/design-for-safety).
* **Need to be aware of how to recognise abuse when delivering through digital platforms?** Then [Chapter 6](/chapters/educate-everyone) is for you.
# 2. Build foundations
How to integrate digital safeguarding into your existing safeguarding policy.
## Why you need a policy
You have a duty of care to ensure your beneficiariesâ, your usersâ, safety and wellbeing when supporting them online. Just like you would in any other context. So your organisation must have a safeguarding policy that reflects this. One that covers digital safeguarding, is regularly reviewed and is publicly available.
This policy provides the foundations of your digital safeguarding work.
## Integrate with your existing safeguarding policy
You could choose to develop one integrated safeguarding policy covering offline and online activities. Childrenâs charity [Barnardoâs](https://inside.barnardos.org.uk/sites/default/files/uploads/Safeguarding%20%26%20Protecting%20Children%20Policy%20and%20Procedure.pdf) and grass roots charity [Safe & Sound](https://safeandsoundgroup.org.uk/safeguarding-policy/) do this.
Or you may decide you need a specific digital safeguarding policy, such as [Amnesty International UK](https://www.amnesty.org.uk/issues/safeguarding) or [Oxfam UK](https://www.oxfam.org.uk/what-we-do/about-us/plans-reports-and-policies).
Your policy should complement your Data Protection Policy and comply with the General Data Protection Regulation (GDPR).
## Policy functions
Your safeguarding policy should provide guidance for your staff and volunteers on:
* Their safeguarding responsibilities
* How to recognise and report safeguarding concerns
It should also:
* State the different online platforms you use to deliver services, and their risks
* Describe procedures for mitigating identified risks, and identifying and reviewing new ones
* Describe procedures for responding to safeguarding concerns that arise during the course of online service delivery
* Reflect the input of your users, staff and volunteers
## Minimum contents list
Tailor your policyâs level of detail to the work your organisation does. But as a minimum, include:
* Purpose
* Scope: who the policy applies to
* Legal framework
* Your organisationâs beliefs on protecting vulnerable users
* Contact details for your safeguarding lead
* Reporting procedures
{% hint style="info" %}
:pencil2: **Policy templates:** [Ann Craft Trust](https://www.anncrafttrust.org/resources/safeguarding-adults-policy-procedures-templates/) and the [National Society for the Prevention of Cruelty to Children](https://learning.nspcc.org.uk/safeguarding-child-protection/writing-a-safeguarding-policy-statement).
{% endhint %}
## **Put policy into practice**
Implement your policy through:
* [Digital safeguarding training](https://avaproject.org.uk/training/#Upcoming)
* Regular discussions with staff
* Providing easy access to digital safeguarding advice and procedures (e.g. via a shared document or webpage)
* Visual aids within your organisation (e.g. posters, leaflets, etc.)
* Policy review sessions
* Providing a variety of digital routes for users to disclose safeguarding concerns (e.g. one-to-one sessions or anonymous surveys)
{% hint style="info" %}
:link:**Link:** [Safeguarding Day-to-Day](https://knowhow.ncvo.org.uk/safeguarding/steps-to-a-safer-organisation/safeguarding-day-to-day) (NCVO)
{% endhint %}
# âď¸ 3. Assess risk
How to assess and mitigate risk as you design and deliver an online service.
## Why you need a risk register
You should assess the risks of every online service or digital method you use to engage your users. You should do this before any risks arise, then design in such a way as to reduce or prevent those risks. If you donât, then you canât have confidence in your ability to fulfill your duty of care when delivering online.
A policy alone isnât enough. You must be more proactive. Risks change and new ones emerge. So carry out a risk assessment and generate a risk register. Then use this register as a live, proactive dashboard to track all risks in a dynamic, real-time way.
Your register will generate a list of mitigations. Use these mitigations to inform your serviceâs design requirements and the digital tools you choose to run it with.
You should also use what you learn in your risk assessment to update your safeguarding policy.
And as your service design gets clearer it will make you aware of risks you hadn't considered before. So cycle back and add these to your register. In this way youâll be building a culture of risk management as a dynamic, iterative process rather than a singular event.
## How to assess risk
Use an identical process to that used when assessing offline risks. Read [What a youth trip to Dartmoor can teach us about digital safeguarding](https://medium.com/p/ad503ae9fc51) and [How to risk assess your preferred platform for online service delivery](https://medium.com/p/d4909c10e0a4).
Risk assessment is a process not an event. It should run in parallel to your service design process and continue after the service has gone live. It will influence your delivery plans, generating design requirements and items for your safeguarding policy. As your plans evolve youâll need to cycle back and check, add or adjust risks and mitigating actions. In this way your risk register will become a live dashboard. It wonât ever be a finished document.
### Step 1: Research the risks
Set up a document to record your risk assessment activities. That way you are evidencing your process from the beginning. This could be a tab on your risk register or a note somewhere else.
#### List all the risks you can think of:
* Use Chapter 4 to identify universal risks of using digital technology to run your services
* Use Chapter 5 to identify the specific risks your service will create. It's OK if you donât have a clear idea of its design yet. As the design becomes clearer keep cycling back to assess and add risks to your register
* Chapter 6 will help you think about how to mitigate some risks through educating your staff
* Involve your colleagues, and research outside your organisation. Use DigiSafeâs case studies and âDive Deeperâ links
#### Risks are likely to fall into three main categories:
* Delivery practice: protecting people when using online technology to engage them. Think video calls, messaging apps, interactive chat spaces etc.
* Privacy and consent: respecting and ensuring peopleâs privacy and choice when engaging them digitally. Because activity and details can be more visible online
* Information security: protecting your systems and peopleâs data from misuse and unauthorised access. Technical security is important but staff behaviour makes the biggest difference
### Step 2: Assess the risks
Take your list and create a risk register. We recommend doing this in a shareable drive like Google Drive or Microsoft OneDrive so others can collaborate dynamically and in real time.
There are many different ways of recording a risk assessment. Your column headings could include:
* Risk (description of something going wrong)
* Impact (rating 1-5)
* Likelihood (rating 1-5)
* Risk rating (Impact x Likelihood)
* Existing control measures (mitigation activities already being done)
* Control measures (mitigation activities you will do)
* Who is responsible?
* Accepted? (whether the risk, with its control measures in place, has been accepted by your organisation)
* Actioned (date you implemented mitigations)
* Review date
Keep cycling back to your register as your service design evolves.
{% hint style="info" %}
:pencil2:**Template:** Use this [Risk Assessment Matrix Template](https://docs.google.com/spreadsheets/d/1UYyN8-zX6bioyNfqXaEZEW7-VsBecg8mLe1tcRysawk/edit?usp=sharing) to help you get started.
{% endhint %}
### Step 3: Make decisions and document them
Your risk assessmentâs outputs will help you decide which tools to use to deliver your service. As you make decisions, note each one and your rationale. State the reasons why, in the context of your risk assessment, you are choosing to deliver in this way.
Make sure you are not the only one making big decisions. Get sign off from senior managers in your organisation. If you are a senior manager ask another to sign off with you.
### Step 4: Describe your approach
You need to create a working protocol describing your approach. This will help your staff understand how to deliver the service in a safe, effective way. Some of the protocol may also form part of your safeguarding policy.
#### Include the following as a minimum:
* Summary of platforms to be used and how the service will work
* What you or staff will do to minimise risk (look at the mitigation actions on your risk register)
* The guidance and support you will give staff in relation to safe practice (e.g. passwords, policy briefing, training etc.)
* Any new policies you will be creating
There are many ways of doing this. Youâll find an example at the end of [this article](https://medium.com/wethecatalysts/safeguarding-online-how-young-somerset-digitised-their-1-to-1-therapy-service-in-just-one-week-d2c33c04c7cb).
### Step 5: Review as often as necessary
Describe your risk review process. Review more often early on. Add the process to your safeguarding policy.
In your protocol state your Plan B for if this platform doesnât work out. State Plan C if you have one.
Revisit your risk register as your service design and planning evolve.
# 4. Apply principles
Universal digital safeguarding principles and common issues that you need to design for.
## Why we need principles
Whether youâre creating a new service, iterating an existing one or taking an offline service online youâll be carrying out the process of design. This guide wonât show you how to do that ([other guides will](https://www.thecatalyst.org.uk/resources/service-delivery)). But this chapter and the next will show you how to design with the safety of your users and staff in mind.
This chapter is about common principles and universal issues you should always consider when assessing risk and making decisions. You donât need to be an expert in any of them, but you do need to understand the basics of each.
Each one applies similarly to any digital service - both in terms of how itâs delivered to the user and how itâs enabled and supported via back office functions.
Use them to inform your risk assessment - whether you are writing it for the first time or reviewing it.
Then use Chapter 5 ([Design for safety](/chapters/design-for-safety)) to identify specific risks that may apply to your service.
## 1. Design for online behaviour
There are some differences between working face-to-face and working online. Online support may create a barrier for some and an enabler for others. Interactions can be quite different. Think about what this means for contact styles, communication and the steps you take to safeguard your users. The best way to do this is to [involve them in your decision-making](https://www.thecatalyst.org.uk/blog/how-to-get-your-users-involved-in-shaping-your-services).
### The online disinhibition effect
Sometimes peopleâs social inhibitions loosen when they are online. Even when they arenât anonymous. They might disclose or share personal things more quickly and directly than they would in a face-to-face setting. This can be empowering and therapeutic for some, but lead to regret for others.
This effect can also lead to people posting abusive comments or bullying/trolling others: toxic disinhibition.
{% hint style="info" %}
:link: **Link:** [The online disinhibition effect](https://www.onlinetherapyinstitute.com/2009/02/25/the-online-disinhibition-effect/) (Online Therapy Institute)
{% endhint %}
### Lack of facial cues or body language
It can be hard to gauge peopleâs emotions online. Non-verbal signs may be lacking and interactions can feel disjointed and uncertain.
Consider how:
* You might pick up on usersâ emotions and mental states when you are not able to see them
* You might honour their feelings
### Access to technology and confidence to use it
Some users will lack confidence in using technology. Staff may feel the same. And not everyone will have access to devices and data/WiFi. Some may have previously had traumatic experiences of using tech.
Consider providing:
* Reassurance and extra support
* Information about your data security, data sharing and confidentiality policies
### Anonymity
Online itâs often possible to shield or hide oneâs identity. This can make it easier for people to reach out for support in stages. However, it also creates the risk of impersonation and sometimes makes it difficult to support people in a crisis, because they canât be identified.
### Accessing support from home
Many people experience home as a sanctuary and safe place. Others may not. Consider it from their point of view. Do they have a safe and confidential space? Think about how interacting with you from this place might be for them. Consider how they might feel after leaving an interaction with your service. Is there anything you can do to help make this moment easier for them? Ask your users what they need.
## 2. Design for privacy
Privacy is about your usersâ ability to control access to information about themselves. Maintaining privacy is crucial to keeping your users safe because it means they can reveal personal details and information autonomously, at their own pace.
You put your users at risk when you donât protect their privacy. Privacy should never be substituted for functionality.
{% hint style="info" %}
:woman\_judge: **Laws:** Most laws and regulations regarding privacy and security fall under [The Data Protection Act (2018)](https://www.gov.uk/data-protection) and the [General Data Protection Regulation (2018). ](https://gdpr-info.eu/)
{% endhint %}
#### Privacy may relate to:
* Information you store about your service users
* Information service users share with you in conversation
* Data stored on a platform you run or facilitate
Your risk assessment should detail potential privacy risks. That way you can put measures in place to reduce or eliminate them.
#### Do:
* **Inform your users:** tell them what data of theirs you will be collecting and storing and for what purpose
* **Secure their data:** store usersâ information in a secure, password protected file or other secure database or server. See âDesigning for information securityâ, below
* **Ask for consent:** be sure they are aware of where their data is stored (so they can make an informed decision) and where and/or with whom it may be shared if a safeguarding risk arises. See âDesigning for consentâ, below
* **Preserve anonymity:** when passing a userâs information on to a third party, ensure it is adequately anonymised unless a safeguarding risk is identified. This might be relevant when you are seeking advice on a piece of casework
* **Respect boundaries:** respect your usersâ individual preferences and limits they place on what they choose to share with you
Samaritans are famous for their work with anonymous callers in crisis. Their [privacy statement](https://www.samaritans.org/privacy-statement/) provides insight into how they manage anonymity and data.
{% hint style="info" %}
:link: **Link:** [Privacy Project](https://www.nytimes.com/spotlight/privacy-project-data-protection) (The New York Times)
{% endhint %}
## 3. Design for consent
Consent is defined as âpermission for something to happen or agreement to do somethingâ (Oxford English Dictionary). Valid consent must be obtained before providing care or support and storing usersâ information. Consent is only valid when each party is informed and aware of their rights and obligations.
The [UK legal age of consent](https://ico.org.uk/media/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr-1-0.pdf) for accessing online services is 13. [GDPR Article 8](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr/what-are-the-rules-about-an-iss-and-consent/) offers more guidance around consent when working with children.
#### Do:
* **Use opt in consent:** offer âopt inâ rather than âopt outâ options to help users actively choose to give consent
* **Use simple and clear language:** this helps users understand what they are consenting to. Keep consent forms short and to the point
* **Create an engaging consent process:** consider language, style and format to reduce the chance of users skimming information. Read [Understanding Digital Consent](https://mobileecosystemforum.com/programmes/personal-data/whitepaper-understanding-digital-consent/) (MEF)
* **Undertake a** [**DPIA**](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/)**:** when offering online services to children. Design forms to be engaging
{% hint style="info" %}
:link:**Links:**
* [GDPR and consent](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/how-should-we-obtain-record-and-manage-consent/) (ICO)
* [Consent when working with children](https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/children-and-the-gdpr/what-are-the-rules-about-an-iss-and-consent/) (ICO)
* [Gaining consent when involving users in service design](https://www.girleffect.org/stories/digital-safeguarding/) (Girl Effect)
{% endhint %}
## 4. Design for information security
Information security is important because it ensures your usersâ data is kept safe from third parties. It also gives your users confidence to share information that will help you to help them.
While there are many technical controls you can implement, staff behaviour is the biggest risk to your information security. Your risk assessment should document risks and list both technical and procedural ways in which you will keep data secure.
#### To ensure your information security, consider the following:
* **Provide staff training:** so they understand the procedures required of them to keep data safe
* **Review your internal security:** where are you keeping your data and in what format? Consider your offline storage practices, security of data in transit, cloud storage and data wiping procedures. Implement the National Cyber Security Centreâs [Five Technical Controls](https://www.ncsc.gov.uk/cyberessentials/advice).
* **Review access to data:** consider who has access to what information and what limits should be in place
{% hint style="info" %}
:link: **Link:** [Designing a secure digital service](https://www.ncsc.gov.uk/collection/digital-service-security/digital-services-designing-secure-digital-service) (NCSC)
{% endhint %}
## 5. Design for accessibility
Designing for accessibility is about making a service usable for as many people and their needs as possible. Lack of accessibility increases the risk of digital platforms being used incorrectly, because their function or purpose isnât clear to users.
When designing, consider needs based on: age, race, ethnicity, gender, sexuality, ability, religious belief, socio-economic status and location. Think about these through the twin-lenses of function and content.
### Content
* **Clear and structured content**
* **Language for all abilities**
* **Alt text for images**
* **Hyperlinks with descriptive tags** for easy navigation
* **Clear heading and paragraphs** in any descriptive content
* **Font-size options**
* **Use colour carefully:** consider using toned down colour palettes for websites and apps catering to those with experiences of trauma
* **Diverse and inclusive images**
* **Diverse and inclusive language** (for example, inclusive gender pronouns)
### Function
* Comfort: ask users which platforms they feel comfortable and capable of using
* Easy set up: consider software that is easy for users with lower digital literacy to set up
* Clear functions: use applications with clear functions and layouts for service users with lower digital literacy
* Less is more: limit the number of software platforms you use to communicate with each user. Using too many can create confusion and overwhelm
{% hint style="info" %}
:link: **Links:**
* [Easy Checks â A First Review of Web Accessibility](https://www.w3.org/WAI/test-evaluate/preliminary/) (W3C)
* [Tips for getting started](https://www.w3.org/WAI/tips/) (W3C)
* [How to Meet WCAG](https://www.w3.org/WAI/WCAG21/quickref/) (W3C)
{% endhint %}
## 6. Guide your staff
You need to apply your organisationâs moral framework to the design and delivery of your digital services. This means building a workplace culture - as well as individual and team capacity - to take the initiative, handle risk and safeguard when delivering services this way.
You need to provide adequate policies and guidance, and include digital safeguarding in your safeguarding training. This is imperative for staff who are less comfortable with tech or less digitally literate, because they will expose their service users and themselves to potential harm by creating unsafe digital interactions.
#### Teach staff how to:
* **Identify key risks:** so they have a basic confidence in their awareness. Technology Safetyâs [website](https://www.techsafety.org) provides various resources and toolkits to assist both in identifying and mitigating risk, especially their [Toolkit for Survivors](https://www.techsafety.org/resources-survivors)
* **Identify key considerations:** when using any new communication tool or software. This might include asking:
* Is this tool accessible (both in terms of function and content) for the service user group for whom itâs intended?
* How is the data held and stored by owners of this platform?
* What are the security implications of using this tool?
* Are service users already using another tool which they feel more comfortable with?
* **Apply their skills to a digital space:** affirming that they must apply their existing talents to digital by understanding new risks and adopting new communication styles
* **Secure devices:** so the hardware they use and the information it stores is as secure as possible. Show them how to update settings, spyware and virus protection on a regular basis
* **Collect consent:** so that staff/client relationships are open and equal
* **Protect confidentiality:** understanding required standards and when it is acceptable to break confidentiality
* **Adapt communication styles:** so they make it easy for users to engage through online services
* **Understand a userâs situation:** so they know to consider risks, benefits and implications of a userâs chosen device and the space they are using it in
* **Discuss digital safety and security with users:** so they pass on their good practice and knowledge to those they support
# 5. Design for safety
Different online service types. The particular risks and issues of each.
## Thinking about specific services
Chapter 4 ([Apply principles](/chapters/apply-principles)) introduced common principles and universal issues. This chapter outlines the risks and considerations for specific types of online service.
Use your risk assessment process to document and mitigate these risks, then decide which you are willing to accept in order to offer an accessible, useful and impactful service to your users.
## Types of service
{% content-ref url="/pages/-MA6fq1gf3oxuwZh5Hzh" %}
[Video-based services](/chapters/design-for-safety/video-based-services)
{% endcontent-ref %}
{% content-ref url="/pages/-MA6jLr6L5uR5UCzMHTw" %}
[Messaging-based services](/chapters/design-for-safety/messaging-based-services)
{% endcontent-ref %}
{% content-ref url="/pages/-MA6hQ\_Y5rw\_-YCwTK7H" %}
[Live chat and chatbot services](/chapters/design-for-safety/live-chat-and-chatbot-services)
{% endcontent-ref %}
{% content-ref url="/pages/-MA6jqEskHMuS0rpFcYI" %}
[đđź Online groups and forums](/chapters/design-for-safety/online-groups-and-forums)
{% endcontent-ref %}
{% content-ref url="/pages/-M9TgHJzLmPVdPIQ7AVM" %}
[6. Educate everyone](/chapters/educate-everyone)
{% endcontent-ref %}
# Video-based services
Safeguarding when using video calling software (e.g. Zoom) to run 1-1 or group sessions with your users.
## Take action
1. Choose video calling software that has an acceptable level of security and adequate privacy settings. Consider accessibility needs too
2. Check your users have a safe, quiet and private space from which to talk
3. Take action to reduce the risks listed below
## Key risks
#### Ranked by likelihood.
**1. Call quality is poor or call disconnects:** user becomes confused and unsettled and staff fail to hear important things they are saying.
* *Q. How might you ensure your users have strong enough wifi or data connections for a video call?*
**2. Inadequate security settings:** leave conversations vulnerable to being hacked or traced.
* *Q. What security settings does this software offer?*
* *Q. Does it ensure the privacy of everyone on the call?*
**3. Being witnessed leads to further harm:** a user (or users) who is at risk of abuse or harm is overheard/seen contacting others in such a way as to increase harm and risk to that individual.
* Q. Can any party on the call be overheard or witnessed calling by others in a way that might compromise their privacy?
* Q. Can any party on the call be overheard or witnessed by others in a way that might lead to threat from a perpetrator?
**4. User discomfort at being visible:** users with poor mental health or experiencing trauma or body dysmorphia may feel uncomfortable being visible. This is more likely when the user and worker have not previously met or established trust.
* *Q. What can we or the software offer users who do not want to be visible on the call?*
**5. Overwhelmed by group work in an unfamiliar setting:** the nature of video calling where delays might occur, social cues are different and individuals risk speaking over one another leaves individuals feeling distressed and upset.
* *Q. Does the software include functionality (e.g. break-out rooms) that allow for one-to-one support during group sessions?*
**6. User discloses abuse in a group setting:** member makes a disclosure witnessed by others.
* *Q: Are procedures in place to identify risk and provide support when disclosures are made in a group video setting?*
* *Q: Can my chosen platform enable one-to-one conversation (e.g. a break-out room feature)?*
## Take more action
1. Establish a safe word or code in case your user needs to end the call suddenly (e.g. because someone who poses a risk enters a room/house). This makes it easier for them and alerts you to the risk.
2. Introduce vulnerable users to â[Signal for Help](https://www.youtube.com/watch?v=nUJV-9wvdB8)â a one-handed gesture that anyone can use to communicate when they are at risk of harm.
3. Set up shared agreements for group calls. That way users know what to expect, how to speak up and how to ask for support away from the group.
4. If using break-out rooms then ensure facilitators are available to support them.
5. Find out whether your platform allows users to hide their own image from themselves. This can help people experiencing body dysmorphia to feel more comfortable. Tell users about this feature.
6. Group working over video can be intense and emotionally draining. Always encourage reflection and debriefing for both group members and facilitators to ensure people feel supported and not left feeling triggered or traumatised when working remotely.
### See it in action
* [Providing group support sessions online](https://recipes.thecatalyst.org.uk/recipes/providing-group-support-sessions-online) (We Are With You)
* [Providing group support using video meetings](https://recipes.thecatalyst.org.uk/recipes/providing-group-support-using-video-meetings) (Scope)\
[Making the decision to move therapy sessions online](https://recipes.thecatalyst.org.uk/recipes/how-young-somerset-made-the-decision-to-move-their-therapy-sessions-online) (Young Somerset)
### Dive deeper
* [Video conferencing services: security guidance for organisations](https://www.ncsc.gov.uk/guidance/video-conferencing-services-security-guidance-organisations) (National Cyber Security Centre)
* [Keeping in touch using a video call](https://www.ageuk.org.uk/information-advice/work-learning/technology-internet/video-calling/) (AgeUK) - for charities supporting service users with low digital literacy to set up video calling applications.
# Messaging-based services
Safeguarding when using messaging tools to communicate with users who are known to the service.
## Take action
1. Use encrypted messaging apps to ensure that messages are not being intercepted or accessed by anyone other than the intended recipient
2. Check and agree user preferences about what time they are comfortable receiving messages
3. Take action to reduce the risks listed below
### Key risks
**1. Messages read by others leads to further harm:** a perpetrator finds out a victim is reaching out for support, and inflicts further harm
* *Q. What is the best software for reducing the chance of messages being viewed by others?*
* *Q. Have user and staff member both agreed to use this tool to communicate? Have they agreed what times of day to make contact? This is particularly relevant when service users are living at risk of harm.*
**2. Third party impersonates user:** lack of visual or vocal cues in messaging allows third party to reply to service messages, leading to misinformation.
* *Q. How might staff check they are communicating with the user and not a third party?*
**3. Worker or user misunderstands message:** leading to distress, confusion or harm.
* *Q. What is the best mode of communication for the content of each conversation at hand? For example, is an emotional check-in appropriate via a messaging app as opposed to a phone call?*
## Take more action
* Agree a safe word that at-risk users can use to alert staff to a problem without raising suspicion.
* Articulate your policy about giving staff mobile numbers to users. Support those staff who do to manage boundaries appropriately. Be clear about times when users can expect a service.
* Use encrypted messenger apps to minimise risk. Avoid using personal social media profiles.
### See it in action
* [Delivering trauma support safely](https://recipes.thecatalyst.org.uk/recipes/delivering-trauma-support-safely) (Chayn)
* [Law Centres Network messaging service](https://medium.com/wethecatalysts/opinion-julie-bishop-its-never-about-the-tech-it-s-about-people-f8598be12a57) (Julie Bishop)
* [Collecting consent by text message](https://recipes.thecatalyst.org.uk/recipes/collecting-consent-by-text-message) (Settle)
### Dive deeper
* [The Best Encrypted Messaging Apps You Should Use Today](https://heimdalsecurity.com/blog/the-best-encrypted-messaging-apps/) (Heimdal)
# Live chat and chatbot services
Safeguarding when using phone, live chat, or chatbots to provide instant support or advice. Usually to anonymous users.Safeguarding when using phone, live chat, or chatbots to provide instant support
## Take action
1. Keep all software up to date. Design chatbotsâ user journeys and decision trees to identify safeguarding risks
2. Consider the needs of your users when choosing which messaging tool to use. For example, chatbots can be useful but automated responses can create risk too. Consider what works best for complex problems or those that require critical thinking
3. Take action to reduce the risks listed below
## Key risks
**1. Being witnessed or overheard leads to further harm:** a user (or users) who is at risk of abuse or harm is overheard/seen contacting others in such a way as to increase harm and risk to that individual
* *Q. Are exit options available and obvious to the user?*
**2. User receives bad information:** chatbots or call handlers give inappropriate or incorrect information because they havenât been updated
* *Q. Are all services and organisations to which users are being signposted still functioning and appropriate?*
* *Q. Is the chatbot updated regularly with relevant and useful information?*
**3. Chatbot fails to identify safeguarding issue:** because they werenât kept up to date or safeguarding journeys werenât designed in
* *Q Is the chatbotâs journey and decision making process able to notify the organisation of a safeguarding concern?*
**4. Communication style distresses user:** inappropriate online communication styles from chatbots or staff upsets users
* *Q. Is it clear to the user who or what they are speaking with?*
* *Q. Do staff or chatbot use appropriate communication styles when responding to a userâs emotional states?*
* *Q. Is language used validating and empathetic?*
## Take more action
Staff should limit complex or sensitive conversations which cannot be resolved or adequately discussed in the time available for the call.
### See it in action
* [Little Window chabot](https://medium.com/hack-for-chayn/were-trying-something-new-say-hello-to-little-window-our-chatbot-36a65ac44fda) (Chayn)
* [Using web chat to support clients](https://recipes.thecatalyst.org.uk/recipes/how-we-are-with-you-use-webchat-to-support-clients) (We Are With You)
* [How to replace your drop-in service with an online chat](https://www.thecatalyst.org.uk/blog/how-to-replace-your-drop-in-service-with-an-online-chat-version) (Catalyst)
### Dive deeper
* [Safeguarding girls and boys - when chabots answer their private questions](https://www.unicef.org/eap/media/5376/file) (UNICEF)
# đđź Online groups and forums
Safeguarding when using online platforms, including social media group functionality, to host asynchronous groups or forums.
## Take action
1. Create ground rules and codes of conduct to ensure that individuals are kept safe during group interactions.
2. Pre-moderate all forums quickly and effectively with clear escalation policies for when risk is identified.
3. Take action to reduce the risks listed below.
{% hint style="info" %}
:pencil: **Note:** Groups may be moderated, or function independently. This includes online games where users can interact.
{% endhint %}
### Key risks
**1. User overshares personal information:** member shares personal information in a way that compromises their security or privacy
* *Q: How will groups and forums be moderated?*
* *Q: Are group formats the safest or most suitable medium of providing this service to this group of users?*
**2. User discloses abuse:** member discloses to the group
* *Q: Are procedures in place to identify risk and provide support when disclosures are made in a group setting?*
* *Q: Does the chosen platform enable staff to directly contact users when they are at risk or following a disclosure?*
**3. User shares triggering content:** member shares content that distresses rather than supports other members
* *Q: Is there a policy around acceptable content? Is it clear to all users?*
* *Q: Have ground rules including encouraging the use of trigger warnings (TW) and content notes (CN) been established when using an open/unmoderated forum?*
**4. Inappropriate behaviour towards other members:** this may include discussing inappropriate topics, using offensive language or bullying others, causing upset and distress
* *Q: Is there a conduct policy and is it clear to all users? What discussion topics are acceptable?*
* *Q: Does the platform make it possible to display ground rules in a visible and easy to find place?*
* *Q: Are group members able to contact each other outside of the social media group? Can this be restricted or group rules established?*
**5. Anonymity leading to ineffective safeguarding:** forums that allow users to create an avatar or pseudonym limit a serviceâs ability to provide support or escalate risk. Anonymity may also provide an opportunity for impersonation
* *Q: Is there an organisational policy for accessing the IP address of an individual who has posted content anonymously?*
**6. Fake profiles aka âcatfishingâ:** perpetrators impersonate others or use a false profile to gain access to a private group
* *Q: How might staff check they are speaking with the individual(s) they think they are?*
**7. Grooming and inappropriate contact: unrestricted access allows for inappropriate contact from potential perpetrators of harm. Particul**arly relevant when running groups or creating interactive games for children and young people
* *Q: Is it possible to restrict access to this application or game?*
* *Q: Is it possible to moderate interaction on this application or game?*
* *Q: Is it possible to create a flagging system for particular words/phrases or conversations?*
## Take more action
* Always create a group agreement or ground rules. Create it in partnership with your users. Consider including: language, information sharing, communication style, image sharing, off-platform contact
* Create a policy for managing content that suggests a user is at risk. Include:
* A flagging system for posts that present risk (of any form)
* A procedure for postremoval, responding to the member who posted and escalating where necessary
* Also include definitions of risk:
* High risk: threats of suicide/self-harm, threats to harm someone else, breach of a court order, child abuse, child protection concerns, domestic abuse
* Medium risk: where you feel uncertain whether to reply or escalate e.g. a discussion about legal issues
* Low risk: swearing, discussing irrelevant and somewhat inappropriate content (if you just want a second opinion but there is no risk)
* Consider the risk and benefits of running groups on social media platforms. They increase the risk of users encountering inappropriate content and receiving inappropriate contact. However, they also offer greater reach to potential users who may not otherwise seek help, and many users already know how to use them
* Plan how you will manage the situation when a member does not turn up or stops appearing in the group. Discuss with the group and include this in the group agreement. Ensure you have a safe way of contacting each group member independently
* Consider the use of codewords or actions that group members can use to indicate they do not feel safe to talk
* If moving a face-to-face group online consider what support your users might need to manage the change and continue participating comfortably
### See it in action
* [Working alongside young people to help them deliver peer-to-peer support](https://recipes.thecatalyst.org.uk/recipes/working-alongside-young-people-to-help-them-deliver-peer-to-peer-support) (Barnardoâs)
### Dive deeper
* [How to start and run a forum](https://www.webhostingsecretrevealed.net/blog/blogging-tips/starting-and-running-a-forum-for-your-website/) (Web Hostings)
* [Internet forums - how to take a safety first approach to connecting vulnerable people online](https://www.thecatalyst.org.uk/blog/forums-a-safety-first-approach-to-connecting-people-online) (Catalyst)
* [Risks of online gaming](https://www.nspcc.org.uk/keeping-children-safe/online-safety/online-games/) (NSPCC)
* [Facebook Groups as Therapy (The Atlantic)](https://www.theatlantic.com/technology/archive/2018/10/facebook-emotional-support-groups/572941/)
# âď¸ Content
Safeguarding when creating content to guide and support users. This advice applies to any digital service content, including your website.
## Take action
1. Consider language, tone of voice, image selection and usability to ensure content is accessible and appropriate.
2. Include an exit button and crisis contact information on any page aimed at users who may be at risk of harm.
3. Update all information and advice regularly.
### Key risks
**1. Content or images upset user:** users become upset and/or triggered after viewing inappropriate images, words, videos or sound clips
* *Q: Is the content appropriate for the users? Is it age appropriate?*
* *Q: Should trigger warnings be included with the content?*
**2. User misled by information:** information causes harm because it is incorrect, misleading, outdated or inappropriate
* *Q: How often will content be reviewed for relevance and suitability?*
* *Q: Is there an easy way for users to flag misinformation or suggest content changes?*
**3. User is witnessed viewing content:** perpetrator witnesses user reading content or views their browsing history, increasing risk of harm
* *Q: Does content include unexpected pop-ups? Can these be limited?*
* *Q: Is there an easy access exit button and crisis contact information for users?*
**4. User-generated content puts them at risk:** content isnât properly anonymised, or includes sensitive or legal information
* *Q: Is user-generated content (e.g. blogs) properly anonymised?*
* *Q: Is support in place for service users writing content for service use that may produce emotional responses upon writing?*
## Take more action
* Avoid overloaded page and app content that could disorientate or confuse users in need of help
* Ensure content is empathetic and validating of usersâ experience
* Advertise your content sensitively, reducing the chance of perpetrators learning of it
### Dive deeper
* [Content strategy 101: managing risk](https://contentstrategy101.com/contents/developing/managing-risk/) (Content Strategy 101)
* [How to use design better content](https://www.thecatalyst.org.uk/blog/why-content-design-is-important-for-your-online-engagement) (Catalyst)
* [Building a self referral process for service users](https://recipes.thecatalyst.org.uk/recipes/building-a-self-referral-process-for-service-users) (Macmillan)
# Data and devices
Safeguarding when gifting or loaning digital devices to users.
## Take action
Carry out due diligence: check devicesâ safety and ensure that users are adequately skilled to protect their device and themselves.
1. Educate users about privacy and security settings and assist them to set these up before giving them a device.
2. Agree standards for acceptable use with each user before giving a device.
3. Update devices with spyware protection and check for security breaches before giving to users. Advise them to regularly do the same.
Once they have received a device the onus falls on the user to maintain a safe and secure device and use it in a manner that does not increase risk.
### Key risks
**1. User receives breached device:** putting a service userâs privacy and security at risk
* *Q: Are staff updating settings, spyware and virus protection before giving devices?*
**2. Existing risk of abuse is increased:** user experiencing offline abuse becomes at risk of online abuse from an existing perpetrator
* *Q: Does the user have the ability to safely and securely use the device in their home?*
* *Q: Are extra precautions being taken for individuals vulnerable to online abuse and harm?*
**3. User fails to maintain device security or take precautions:** makes them vulnerable to privacy breaches, scams and abuse
* *Q: Has the user been educated on how to protect their online privacy and security?*
* *Q: Does the service user understand their responsibility to keep themselves safe once they have received the device?*
**4. User uses device in a way that creates risk:** poor awareness of how to communicate and handle information online puts the user at risk of harm from others or harm to themselves through oversharing or inappropriate behaviour
* *Q: Does the service user understand the nature of digital communication and privacy settings of platforms they intend to use (e.g. social media, messaging apps)?*
### Dive deeper
* [The essential digital skills framework](https://media.futuredotnow.uk/wp-content/uploads/2020/03/Essential-Digital-Skills-1.pdf) (Futures.now)
* [Secure your devices](https://www.ncsc.gov.uk/guidance/securing-your-devices) (NCSC)
* [Providing devices and training to increase digital inclusion](https://recipes.thecatalyst.org.uk/recipes/how-being-woman-are-providing-devices-and-training-to-increase-digital-inclusion) (Being Woman)
# 6. Educate everyone
How to teach your users to stay safe and your staff to identify abuse when delivering online services.
## Why education is important
This chapter explains how to act on your duty of care to:
* Educate users and staff around the risks and safety of digital tech
* Train and empower staff to recognise and respond to signs of online and offline abuse when delivering via digital channels
It will also help you think about how to apply your usual working practices to digital and remote working environments.
## How tech can be used to harm and abuse
Although technology offers charities and their beneficiaries opportunities for support and safeguarding, they also offer perpetrators many new ways to exploit, isolate and control, sometimes covertly. Many of these new ways can be defined as âcyber stalkingâ and include threats to impersonate, harm reputation and cause physical injury.
Forms include:
* Cyber-stalking, threatening reputation and physical injury
* Demanding passwords
* Constant checking of a victimâs phone and social media accounts
* Threats and bullying via messaging, email and/or social media
* Identity theft and impersonation
* Malicious comments to discredit
* Removal of technology to isolate a victim
* Using apps to gain access to a victimâs webcam
* Threats to share images e.g. ârevenge pornâ
* Using spyware to monitor a victimâs online behaviour
* Setting up alias accounts
* Repeated and constant messaging
* Hidden cameras (inserted in the property of a victim or their family)
* Using GPS technology to track a victimâs whereabouts
* Using geo-tagging technology in photos
* Using the Internet of Things to monitor, control and abuse victims. [UCLâs IoT abuse guide](https://www.ucl.ac.uk/research/domains/sites/research_domains/files/gender-iot-tech-abuse.pdf).
This list is not exhaustive. As technology develops, so do means of abuse and control. Organisations should consider the needs and context of their client group and their technology habits.
* [What is digital abuse?](https://www.loveisrespect.org/pdf/What_Is_Digital_Abuse.pdf) (Love is Respect)
* [Online Harms White Paper](https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/811923/EASY_READ_Online_Harms_White_Paper.pdf) (DCMS and Home Office)
* [Technology and Violence Against Women â Helping or Harming?](https://avaproject.org.uk/wp-content/uploads/2019/04/Tech-and-Abuse-Good-Practice-Briefing.pdf) (AVA)
* [Cyberstalking in the United Kingdom](https://paladinservice.co.uk/wp-content/uploads/2013/12/ECHO_Pilot_Final-Cyberstalking-in-the-UK-University-of-Bedfordshire.pdf) (University of Bedfordshire)
## How to recognise online harm and abuse
Itâs not always easy to recognise it. And victims may not feel safe or comfortable to disclose, or even be aware of the harm.
Risk assess as you would in an offline situation. Your staff need to apply a similar level of vigilance to digital settings. Signs of potential abuse include:
* User with known risk factors refusing to take phone and/or video calls, or to reply to messages
* User afraid to show their face or provide personal information
* User only accepting phone or video calls when not at home, or only taking calls when others are not at home
* User speaking in hushed tones when receiving phone or video calls
* Harm to individual or to property is visible in video call
* Individual loitering or visible in the background of all video calls
* Change of tone in messages received from user and/or sudden disconnection of contact - suggesting impersonation or a perpetratorâs intervention
### Recognising spyware use
Remember that a userâs devices may be compromised or contain spyware. Signs of this happening include:
* User tells you a perpetrator or third party has access to information that they shared only with you
* User canât understand how a third party has access to information they have not shared
You should analyse online discussion content in the same way as analysing face-to-face discussion content.
Be aware that users may have suffered online abuse previously. Look out for individualsâ discomfort or anxiety around using digital technologies.
If abuse becomes apparent you may be involved in supporting the user to gather evidence. Where possible you should:
* Stop the device from being used, if it is safe and possible to do so. Do not delete any evidence e.g. images, messages.
* Ensure the device is placed in a secure place so evidence cannot be destroyed or the user further abused through it.
* Write down what has been seen or sent.
* Not copy, download or send any evidence to another device. Instead screenshot or print it.
* Seek advice from [CEOP](https://www.ceop.police.uk/safety-centre/) or the police if you discover evidence of any illegal images e.g. pornograpy involving illegal acts or indecent images of children.
{% hint style="info" %}
:link:**Link:** [Digital safeguarding tips and guidance](https://www.girleffect.org/stories/digital-safeguarding/) (Girl Effect) for information on ethical evidence collection.
{% endhint %}
## Give advice on how to stay safe online
Online safeguarding includes educating users in how to stay safe online. This might involve giving advice on:
* privacy and security
* safe online conduct
* mitigating digital harm
This process starts with educating your staff. Once they feel confident in their own understanding they can advise your users.
They can also help your users stay safe by doing the following:
1. Support users to review their digital identity. This includes what information exists about them online and what level of visibility they feel comfortable with. Help and educate users on how to check and maintain their devices. Check that spyware is updated, passwords updated and location settings turned off.
2. Discuss additional security measures such as anonymity (where necessary), turning off GPS tracking, activating wireless router security settings and avoiding posting photos with easily identifiable locations.
3. Discuss the importance of personal boundaries when using online spaces. Frame this within a conversation about privacy and security.
4. Explain to users at risk of online abuse how to save and record conversations with perpetrators, and how to document and report abuse.
This list is not exhaustive. Staff should consider the needs and context of your users and their technology habits.
Keep your users informed and updated in a way that facilitates their safety and a mutual understanding of your working relationship. Futures.nowâs [essential digital skills framework](https://media.futuredotnow.uk/wp-content/uploads/2020/03/Essential-Digital-Skills-1.pdf) can help you assess your usersâ digital competency and online vulnerability.
* [Staying safe online (Safelives)](https://safelives.org.uk/sites/default/files/resources/Staying%20safe%20online%20guide.pdf)
* [Tech safety and privacy: a toolkit for survivors](https://www.techsafety.org/resources-survivors) (Tech Safety)
* [Cover your tracks online](https://www.womensaid.org.uk/cover-your-tracks-online/) (Womenâs Aid)
* [Do-it-yourself Online Safety Kit](https://chayn.co/safety/) (Chayn)
* [Digital safety online - video](https://www.getsafeonline.org/video/) (Get Safe Online)
## Support your staff
Supporting people online can be draining, and can impact on your staffâs mental wellbeing. Risks include vicarious trauma and online exhaustion. Because of this teaching and expecting self care from your staff is important.
Consider your organisation and your staffâs experience of using digital technologies. Think about what works best for them, how to help them set boundaries, and how to maintain them when working remotely.
Then implement your organisationâs culture of care into your digital environment. When you do this the culture will trickle through to your users in ways that facilitate a better and safer digital experience for all.
* [Vicarious trauma: signs and strategies for coping](https://www.bma.org.uk/advice-and-support/your-wellbeing/vicarious-trauma/vicarious-trauma-signs-and-strategies-for-coping) (BMA)
* [Vicarious Trauma](https://www.lawcare.org.uk/information-and-support/vicarious-trauma) (LawCare)
* [Why 'video call fatigue' might be making you tired during lockdown - and how to beat it](https://www.weforum.org/agenda/2020/05/zoom-fatigue-video-conferencing-coronavirus/) (WEF)
* [Our Frontline](https://www.samaritans.org/how-we-can-help/workplace/our-frontline/) - round-the-clock one-to-one support service for health, care, emergency and key workers (Samaritans).
# âď¸ Afterword
How DigiSafe came to be.
## Give feedback on DigiSafe
DigiSafe is currently in Alpha. That means we are testing it out and expect to iterate it further. Please [feed back on your experience](https://forms.gle/L6aXqpzzZ3SVvUn29); let us know if you think anything is missing or needs updating.
{% hint style="info" %}
:envelope: **Email:**
{% endhint %}
## Credits
#### DigiSafe was created for [Catalyst](https://www.thecatalyst.org.uk/) by:
* CharnĂŠ Tromp of [CAST](https://wearecast.org.uk/), a UK charity accelerating use of technology across the social sector.
* Cordelia Ruck and Jo Sharpen of [AVA](https://avaproject.org.uk/), a UK charity committed to ending gender based violence and abuse.
* Joe Roberson of [Working with Joe](http://workingwithjoe.co.uk/), a content design agency for the social sector.
* Noam Sohachevsky of [SIDE Labs](https://www.sidelabs.org/), a user-research and no-code design agency for the social sector.
It was funded by the [Clothworkers Foundation](https://www.clothworkersfoundation.org.uk/).
DigiSafe builds on AVAâs [Digital Safeguarding Guide](https://avaproject.org.uk/wp-content/uploads/2020/05/Digital-Safeguarding-Resource-Pack-FINAL.pdf) which was funded by Comic Relief.