Norway stands up for high-risk communities with Operation Pro Bono
Norway stands up for high-risk communities with Operation Pro Bono
Over the last few years, Norway has actively participated in domestic and international efforts to combat election interference; prevent the proliferation of commercial spyware; and defend civil society groups under threat of transnational repression. Documents obtained through a public records request last week illustrate how the Norwegian National Security Authority (NSM) has supported elected officials, political parties, and non-profit organizations since early 2017.
In an email to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) in September, following a discussion about existing initiatives to protect high-risk communities, NSM detailed its own efforts and takeaways NSM reached out to elected officials and political parties ahead of the general election in 2017. The purpose of the outreach, according to NSM, was not to tell anyone what to do or how to work, but simply to offer guidance on digital security, general risks and threats, and to raise awareness. The agency has had “an ongoing dialogue with the parties” since then, with “an extra effort ahead of the elections in 2019 and 2021.” (And in 2024.)
In March 2021, NSM launched a new effort dedicated to civil society organizations titled “Operation Pro Bono.” The agency modeled this project after the election dialogues, with the same focus on security best practice and awareness. Sharing how the agency selected which organizations to reach out to, NSM wrote “[t]he main criterion for the selection was voluntary organizations which are of great importance to society and which must be expected to be of interest to foreign state threat actors.”
NSM said it received “an immediate and positive response” from 16 organizations.
The agency wrote that “all organizations wanted to meet” and “there has been a consistently light and free tone, even though the themes are of course serious.” The topics covered include information about NSM, general risks and threats, security culture and behavior, travel, mobile, and social media. (I hope this project continues with a holistic approach and mention of free tools for high-risk individuals, such as Apple’s Lockdown Mode.)
In early September, CISA’s advisory council/committee delivered a report with recommendations for the agency’s High-Risk Community Protection (HRCP) initiative. (I contributed to this report.) Among other things, the report encourages CISA to engage directly with high-risk communities, individuals who have been targeted by nation states, and those who support them. Doing so will help CISA learn more about their concerns and needs – and how the agency can best assist them. NSM told CISA that its outreach helped convince a board to prioritize the implementation of two-factor authentication.
Reflecting on the impact of Operation Pro Bono, NSM said that “[m]any of the organizations have been surprisingly open about their security challenges. In one case, the general manager was able to say that our planned visit was what made the board finally agree that the organization should adopt multi-factor authentication. Professionals in the organization had recommended this for a long time, but did not gain traction.”
NSM found that while “safety is high on the agenda,” the organizations “have varying degrees of resources and expertise to improve security.” I’m not surprised, I’ve seen the same in my work with high-risk groups over the years. Civil society organizations frequently have to do a whole lot with very little. (I’ve also written about the need for more guidance for high-risk communities.)
In a statement published in late September, CISA highlighted that the U.S., U.K., and Norway have all established initiatives dedicated to securing high-risk communities. Other nations have invested in security awareness campaigns and training materials for society as a whole. According to the agency, Estonia, Canada, New Zealand, and Australia aim to reach high-risk communities “by translating materials into multiple languages which reflect the diversity of each country.”
NSM, for its part, concluded that its outreach in Norway was a success.
“Operation Pro-Bono is a low-cost offer from NSM which, judging by the feedback, provides significant value for the organizations we have visited.”