securityopsactivists

Operational Playbook: Secure Wallets for NGOs and Activists Under Censorship

UUnknown

2026-03-01

11 min read

A security operations playbook for NGOs and activists: hardware, opsec, multisig, offline signing, recovery and Starlink‑aware comms for 2026.

Hook: You cannot assume the network — or the state — will play fair

When the network goes dark and opponents come knocking, losing access to funds or exposing keys can endanger people and operations. This operational playbook is written for technical leads running NGO or activist crypto operations in 2026: engineers, devs, security officers and admins who must design resilient custody and comms under censorship and physical threat. It provides a compact, actionable set of controls for hardware choices, opsec, multisig, offline signing, recovery and secure communications routing so teams can operate safely when networks and institutions are compromised.

Understand your threat model — think like an adversary

Effective defenses start with a clear threat model tailored to your context. In 2026, state and non‑state actors can combine sophisticated digital surveillance, supply‑chain manipulation and physical coercion. Define the threats you want to mitigate:

Network shutdowns — ISP or cellular blackouts, DNS blocking, targeted throttling or satellite terminal seizure.
Device seizure — physical confiscation of phones, laptops and hardware wallets during raids or at borders.
Remote compromise — malware, SIM swaps, phishing, or supply‑chain tampering of devices and firmware.
Insider risk — coerced staff or compromised volunteers revealing secrets or keys.
Legal and financial pressure — subpoenas, frozen accounts or compliance actions that affect custodial providers.

Make explicit assumptions: which team members can be compelled, which devices are safe, and which jurisdictions you can rely on. Document this in a one‑page threat summary that you review quarterly.

Hardware choices: build from tamper‑evidence and compartmentalization

Hardware decisions are foundational. In 2026 the ecosystem includes mature hardware wallets, open‑source secure elements, and widely used cloud HSM/MPC offerings. Choose devices and procurement strategies that reduce supply‑chain and seizure risk.

Recommended device classes

Air‑gapped hardware wallets (Coldcard, Keystone, similar): excellent for offline signing and verifiable PSBT flows. Verify firmware using vendor signatures and community audits.
Tamper‑evident hardware‑security modules (HSMs) or certified devices: for organizational custody where automated uptime and audited access controls are required.
MPC / Threshold custody providers: modern MPC allows distributed signing without a single seed phrase; choose vendors with transparent threat models and audited libraries.
Burner devices & secure phones: inexpensive, replaceable phones for field comms with full‑disk encryption and ephemeral accounts.

Procurement & supply‑chain hygiene

Prefer in‑person acquisition from trusted resellers. If shipping is necessary, use long‑standing vendor reputations and tamper‑evident packaging.
Validate device firmware and boot chains where possible (check signatures, hash firmware images, verify vendor attestations).
Record serial numbers, procurement receipts and an independent inventory to detect replacements or tampering.

Operational security (opsec): practical field controls

Good opsec reduces the probability of compromise. Adopt simple, repeatable rules that non‑technical volunteers can follow.

Device hygiene

Use compartmentalized operating systems: Qubes OS for laptops (work vs. signing), and hardened Android builds or secure phones for field comms.
Keep signing devices minimal: remove apps, disable wireless where possible, and set strict USB rules for air‑gapped wallets.
Use two devices for sensitive workflows: a signing device (air‑gapped) and a separate connectivity device to relay transactions.

Identity & account hygiene

Issuer‑specific identities only where required. Avoid re‑using personal accounts for operational tasks.
Use ephemeral emails and phone numbers for registrations; protect recovery channels with multi‑factor offline verifiers.

Operational discipline

Enforce least privilege. Grant signing rights only to roles that need them.
Rotate keys periodically and after any personnel change or suspected incident.
Run tabletop exercises for seizures, network outages and key compromise at least twice per year.

Multisig and threshold architectures: design for resilience

Multisig reduces single‑point failure but must be implemented with an operational mindset. In 2026 two patterns dominate: on‑chain multisig (smart contract wallets, Gnosis Safe etc.) and threshold signatures / MPC (no single seed held by a party).

Practical multisig recommendations

Prefer a 2‑of‑3 or 3‑of‑5 distribution for field operations. Example: one air‑gapped hardware wallet, one HSM or MPC shard in a friendly jurisdiction, and one mobile signer for rapid approvals.
Place signers in different physical and legal jurisdictions to reduce coordinated seizure risk.
Use smart contract wallets to enforce policy (daily limits, delegate modules, whitelists) and enable easier emergency drains to designated recovery addresses.
Document and automate signing workflows where possible to avoid manual errors under stress.

Pros and cons: on‑chain multisig vs MPC

On‑chain multisig: transparent, auditable, compatible with existing tooling and EOA‑centric flows. However it exposes signer addresses publicly and can be limited by gas costs or lack of native threshold support for some chains.
MPC / threshold: hides signer distribution, eliminates plain seed phrases and is increasingly performant in 2026. But it relies on complex software stacks and requires careful vendor selection and audits.

Offline signing workflows: minimize attack surface during transactions

Offline signing is a core capability for high‑risk environments. The goal is to create transactions on a connected host, sign on an air‑gapped device, and then broadcast via a separate network path.

Bitcoin: PSBT and air‑gap best practices

Create the transaction unsigned on an online machine that has no keys (PSBT ready).
Transfer the PSBT to the air‑gapped signer via QR, USB with strict whitelist rules, or SD card. Avoid adb or untrusted OTG adapters.
Verify inputs/outputs and addresses on the hardware wallet display. Sign and export the partially signed PSBT.
Return the PSBT to the online machine for final assembly and broadcast via a relayer or satellite link.

Ethereum & EVM chains: typed data, relayers and EIP‑4337

Use EIP‑712 typed data for off‑chain approvals where possible. For contract wallets, pre‑authorize relayers (and whitelist relayer keys) so users can sign an intent offline and authorize a trusted relay to submit transactions when network connectivity resumes. Account abstraction (EIP‑4337 and its matured successors in 2025–2026) enables better UX for social recovery and gas abstraction but introduces a different trust surface: relayers and paymasters.

Verification step — never skip

Always verify the transaction summary (amount, destination, nonce, gas limits) on the signer display. Treat off‑chain transaction proposals as untrusted until you can verify the signed payload on the device.

Emergency recovery: seed strategy, Shamir splits and rehearsal

Recovery planning is about reducing blast radius and ensuring continuity. In 2026, simply writing down a seed phrase on paper is inadequate for many NGOs. Consider stronger primitives.

Use threshold backups — SSKR / SLIP‑0039

Shamir‑based splits (SSKR / SLIP‑0039) allow you to split a seed into multiple shares with threshold reconstruction. Distribute shares across trusted nodes and jurisdictions.
Pick thresholds intentionally: a 2‑of‑3 is a balance between survivability and coercion resistance; a 3‑of‑5 adds redundancy for attrition.

Metal backups & physical security

Store critical shares in fireproof, tamper‑resistant metal backups in geographically separate locations.
Use sealed envelopes with notarized timestamps or third‑party escrows where legal protections exist.

Social recovery smart contracts allow designated trustees to assist account holders in recovery without revealing private keys.
Pre‑stage emergency transactions (time‑locked or multisig) that can be broadcast when a quorum is available. Keep signed payloads offline and rotate them periodically.

Rehearse recovery

Run a full recovery drill at least annually. Test reconstructing SSKR shares, rotating keys, and executing emergency drains. Document gaps and update SOPs.

Secure communications and routing: Starlink, Tor and layered redundancy

Reliable connectivity under censorship is critical. Satellite internet has become a force multiplier in recent years. As reported in January 2026, activists have used thousands of Starlink terminals to resist blackouts — a vivid example of satellite tech changing the game.

"About 50,000 Starlink terminals are now in the country, according to digital activists." — The New York Times, Jan 2026

Starlink: benefits and operational caveats

Starlink provides resilient last‑mile bandwidth when terrestrial networks are shut down. Keep a compact, portable terminal for rapid deployment.
Operational risks: terminals can be geolocated; registration requirements may expose identities; hardware can be seized. Use physical concealment and transport plans.
Always pair Starlink with traffic‑level privacy measures (VPN to a trusted host, Tor over VPN, encrypted tunnels to a remote relay in a safe jurisdiction).

Layered routing and metadata minimization

Use Tor or an internal onion service for sensitive control channels. Tor protects content and obscures endpoints from local observers.
When Tor latency is unacceptable, run a private WireGuard tunnel to a vetted relay host in a safe third country. Enforce DNS over TLS/HTTPS.
Use traffic shaping and padding sparingly to reduce fingerprinting. Consider delay‑tolerant options for bulk operations (signed transactions queued offline).

Offline metadata mitigations

Broadcast transactions through multiple relays and mix services where available to obscure origin metadata.
Do not reuse IP addresses across different operational personas; use ephemeral endpoints for high‑risk broadcasts.

Operational playbook: step‑by‑step checklists

Onboard a new signer (quick checklist)

Issue a dedicated identity and burner device.
Provide an air‑gapped hardware wallet and verify firmware in person.
Generate key(s) on the device; split seed using SSKR to create backup shares.
Record signer metadata in encrypted team vault (only metadata, never full seeds) and deposit backup shares to assigned custodians.

Daily transaction flow (field‑friendly)

Create unsigned transaction on a staging host (minimal online tools).
Transfer to air‑gapped signer and verify on device.
Sign offline and return signed blob to broadcasting host.
Broadcast via at least two relays (primary Starlink+VPN and secondary cellular/Wi‑Fi) when possible.

Incident response: seized device or compromised signer

Immediately rotate to backup signers; freeze funds via on‑chain policy (if contract wallet) or move high‑value assets using pre‑authorized emergency transactions.
Reconstruct SSKR shares to recover keys if necessary; run integrity checks for additional compromises.
Audit logs and reputational channels; notify trusted partners and legal counsel as appropriate.

Real‑world examples & lessons learned

Two illustrative scenarios highlight applied tradeoffs:

In a country facing repeated blackouts, an NGO paired portable Starlink terminals with a small multisig (2‑of‑3) architecture. One signer was a secured HSM in a friendly embassy, one was an air‑gapped hardware wallet in country, and the third was an MPC shard with a diaspora partner. This distribution balanced fast access with survivability.
Another activist collective used social recovery contract wallets for individual operators, giving trusted community guardians the ability to help recover accounts without ever knowing private keys. They combined this with periodic live drills and a legal escrow for backup shares.

2026 trends and where to invest your time

Key developments through late 2025 and into 2026 change the calculus for custody and comms:

MPC & threshold ECDSA matured into mainstream custodial choices, reducing dependence on single seed phrases and enabling easier jurisdictional distribution.
Account abstraction on major EVM chains enabled richer policy control inside wallets — social recovery, gas sponsorship and on‑chain whitelists are now practical.
Satellite internet adoption by activists rose sharply after 2023–2025; expect operators to refine tactical use of terminals and hybrid routing strategies.
Regulatory focus on crypto for NGOs increased. Maintain clear, auditable logs for finance and compliance while minimizing data exposure.

Actionable takeaways — what to implement this month

Define your threat model and publish a one‑page operations summary.
Deploy at least one air‑gapped signing device per operational cluster and verify its firmware.
Move away from single seed backups: adopt SSKR or MPC shards and rehearse recovery.
Establish an emergency relay strategy: reserve a portable Starlink terminal, a vetted VPN host, and a Tor fallback.
Run a recovery drill and a seizure tabletop exercise within 90 days.

Closing: build repeatable, survivable ops — not magic

Security under censorship is not one singular tool; it's a set of repeatable processes, tested hardware choices and clear responsibilities. By combining tamper‑evident devices, compartmentalized multisig, air‑gapped signing, robust recovery plans and layered comms (including satellite fallback), NGOs and activist teams can retain access to critical funds and communications even when networks and institutions are turned against them.

Start small: designate an op‑lead, secure a signing device, and run a single PSBT or EIP‑712 signing drill this week. Repeat and document. Resilience is built in iterations, not overnight.

Call to action

Download our free Operational Checklist for Secure Wallets (designed for NGOs and activist teams) or contact our security team for a short onboarding audit tailored to your threat model. If you need a playbook adapted to a specific country context, we’ll help you map a low‑friction, high‑assurance plan.

Unknown

Contributor

Senior editor and content strategist. Writing about technology, design, and the future of digital media. Follow along for deep dives into the industry's moving parts.