Yayasan Tifa

You Can’t Download Resilience: Building Digital Resilience Has to Be Grown, Not Installed

Communication and Campaign Officer Tifa — Mon, 24 Aug 2026 09:20:53 +0000

Arie Mega

Project Research and Learning Specialist for the Digital Democracy Initiative at Tifa Foundation

You Can’t Download Resilience: Building Digital Resilience Has to Be Grown, Not Installed

Every time a digital security training is held, a classic question almost always arises in the minds of the participants: “Is the gadget I am using safe? Which app is the safest to use?”

This question is entirely understandable. As digital platforms now serve as the lifeblood of advocacy for activists, journalists, and community organisers, the same cyberspace has also become a hunting ground for surveillance and repression. It is only natural to crave a quick fix, a supposedly foolproof solution. Advice often sounds the same: get the best VPN, switch to encrypted chats, or lock down your account settings.

Yet, can digital security truly be reduced to just swapping one app for another?

This mindset was thoroughly challenged at the Young Tech Collective (YTC) onsite training in late May 2026 in Kuala Lumpur, where 20 Focal Points from across Southeast Asia gathered. YTC, as part of the Digital Democracy Initiative (DDI) led by the Tifa Foundation and Digital Defenders Partnership (DDP), set out to show that digital resilience is not something you can download. Instead, it must be cultivated from within the very heart of an organisation.

“It is like wanting a single silver bullet for everything."

The Trap of “Instant Solutions”

The myth of instant digital security was stripped away from day one. RS, one of the facilitators from the Digital Defenders Partnership (DDP), explained that the expectation of a “magic solution” is the biggest challenge frequently encountered in the training room.

“Usually, the common assumption among participants when they come to a training is that they want to be able to apply something immediately, they want tools right away,” RS said. “It is like wanting a single silver bullet for everything. In reality, the approach should be based on measuring their own capacities and understanding their specific risks. Security must be grounded in the needs and contextual conditions of each organisation.”

When digital security is mistaken for a single “safe zone” reached by simply switching apps, disappointment is almost inevitable. Participants may light up with excitement in the classroom when they discover a shiny new tool, but back in the real world, that app often gathers dust, too complex, too demanding for their devices, or simply out of reach for the communities they serve.

That is why YTC chooses a four-month intensive mentoring journey instead of a one-off workshop. The aim is to nurture awareness and skills slowly, allowing them to take root and flourish over time.

How the Method Works

In concrete terms, the YTC method runs as a single connected cycle rather than a series of standalone sessions. Each partner organisation first completes a risk assessment that maps the threat profile specific to its own context, and it is that assessment which determines the content of the accompaniment, not the other way around. From there, every focal point develops an action plan that is deliberately pushed to be broken down to a level that can actually be implemented, ranging from securing social media accounts and managing access rights to shared documents, to onboarding and offboarding protocols for staff, volunteers and interns, and the drafting of internal security policy. That plan is then accompanied over the following four months through mentoring sessions, regular check-ins, and support to strengthen technological infrastructure. In this way, the five days in Kuala Lumpur serve as a measurable starting point rather than the end of the process.

The Foundations of Holistic Security

DDP’s approach within YTC weaves security into an interconnected ecosystem, where three dimensions fit together like puzzle pieces, rather than existing as isolated training modules:

Physical Security: Protecting the body, workspace, and physical documents from risks such as raids or detention.

Digital Security: Protecting information and communication by identifying what data is most sensitive, where it is stored, and who holds access.

Psychosocial Security: Protecting mental health and emotional capacity so that human rights defenders can sustain their work over the long term without burning out.

These three dimensions are inseparable. Even the most advanced password manager or layers of encryption are powerless if an organisation’s staff is worn down by exhaustion and unable to think clearly. On the other hand, the strongest physical safety measures will spring leaks if trust does not bind the team together.

“When they realise their password is not secure ... we do not need to blame them or amplify the mistake,”

Restoring Control Without Judgment

A standout feature of this training is how it gently eases the panic that can set in when participants discover just how many vulnerabilities lurk in their devices. RS explains that facilitators must strike a careful balance when discussing threats, steering clear of fear-mongering and empowering participants instead.

“When they realise their password is not secure because it is recycled across multiple platforms, we do not need to blame them or amplify the mistake,” RS noted. “Let them know that this is a common practice that many people do. Only then do we help them see that they have full control to fix it using features that are already available, such as enabling two-factor authentication (2FA).”

Ultimately, digital security is not defined by the latest or most advanced app on our devices. True security is a living process of becoming safer, starting with the resources at hand, the capacities we nurture, and the shared habits we intentionally grow within our organisations.

About the Young Tech Collective (YTC)

As DDI’s non-financial support mechanism, Tifa implements YTC together with DDP to address the pressing needs of civil society organisations (CSOs), which often face limited resources and technical capacity in digital protection. Field experience shows that one-off training is frequently not enough: knowledge gained in the classroom rarely survives the return to daily work routines, and the security practices introduced are easily abandoned when no further accompaniment follows. Adopting a holistic, community-based and intersectional approach, YTC therefore provides four months of accompaniment designed around each partner organisation’s contextual risk profile, facilitating them to strengthen their holistic security capacity through a series of trainings, the strengthening of technological infrastructure and internal policy, and mentoring. The programme currently works with 13 organisation CSOs across Southeast Asia. Through this process, focal points connect with a network of young tech activists in the region and become part of the digital protection infrastructure for civil society.

Written as part of the learning documentation for the Young Tech Collective (YTC), a non-financial support mechanism under the framework of the Tifa Foundation’s Digital Democracy Initiative (DDI).

From One Room to One Network: A Tech Collective Built in Response to Transnational Threats

Communication and Campaign Officer Tifa — Mon, 24 Aug 2026 09:09:16 +0000

Arie Mega

Project Research and Learning Specialist for the Digital Democracy Initiative at Tifa Foundation

From One Room to One Network: A Tech Collective Built in Response to Transnational Threats

On the final day of the training, just before everyone parted ways, the facilitator made a request that sounded simple but carried a great deal with it. Anyone holding photos taken with participants from the highest-risk contexts was asked to delete them before leaving the room. Not because documentation does not matter, but because for some people in that room, a single photo left in a phone gallery could mean a long line of questioning at a checkpoint on the way home.

It was a fitting close to five days of the Young Tech Collective (YTC) onsite training in Kuala Lumpur in late May 2026. Twenty focal points from across Southeast Asia sat in the same room, yet each arrived carrying a very different map of threats.

“If they look and find a VPN application on your phone, you will be arrested.”

Different Threats, One Room

For one focal point from Myanmar, digital security began long before she arrived in Kuala Lumpur. She cleaned her devices, curated her social media so that it carried only neutral topics such as social entrepreneurship and career counselling, and deliberately left her organisation’s invitation letter behind. To the officers, she entered as an ordinary tourist.

“I never post anything related to non-profit work,” she said. In her country, phone inspections are routine, and the answer she must give has become a reflex. “We always answer, we have no money, so we can only use a keypad phone.”

Another participant from Myanmar, PH, faces the same problem in a different form. He now works across borders, and every time he has to return home, he goes through the same ritual. “I have to delete it. If I do not bring another device, I have to delete all the email. I have to delete Facebook as well,” he said. The reason is both simple and heavy: “If they look and find a VPN application on your phone, you will be arrested.”

On the other side of the room, LJ, a focal point from a labour and human rights institution in the Philippines, brought a story with a different texture again. Since the anti-terror law was passed, the organisation has repeatedly been linked to terrorist groups, a practice known there as red-tagging. Its social media accounts are flooded with comments and messages from anonymous accounts, complete with AI-generated images. In 2024, the threat moved into physical space. “My phone was telling me that an air tag was being tracked. So they can see where I am going. Like the full map,” he recalled.

The Same Pattern After All

Over five days, those stories met one another, and that is where something shifted. Participants from the countries that had felt their situation was the heaviest found that they were not alone, while those from contexts that felt relatively safe realised the distance was not as wide as they had assumed.

LJ admitted it was the first time he had heard that using a VPN or certain messaging apps could lead to arrest. Yet he immediately connected it to news at home, where proposals to block several messaging applications had surfaced earlier this year. Participants from Indonesia recognised the same pattern in the daily obligation to surrender identity data for official documents, against a backdrop of repeated data breaches.

The conclusion that emerged was not that every context is identical, but that the pressure works in similar ways and travels from one country to the next. “We must learn from other countries, the best practices of other countries in terms of securing themselves,” LJ said. “If one human rights defender is affected by risk or threats, it is also a threat for other human rights defenders. So as Asian countries, we need collective care and collective digital security.”

From a Room to a Network

This is why a community of practice is one of YTC’s objectives rather than a pleasant side effect of a training. After those five days, the focal points remain connected through an encrypted cross-country messaging group, a shared repository for materials and working documents, and regular check-ins with the accompaniment team throughout the four months of mentoring. Some connections bore fruit immediately, such as a focal point from Yogyakarta who was linked to a community technology organisation in his own city, something he had not known existed so close by.

For DF, a focal point from a regional youth network organisation, what stayed with her most was how the room itself felt. “Everyone here was mindful and open-minded, which made the safe space genuinely tangible,” she said. “It feels like these friendships can continue, not just at this event.”

Her hopes are concrete. “I want this friendship, this network, to keep going, so that we can support each other,” DF said. “Whether that is mental support, or as we discussed, international support, movements and campaigns that back each other up.”

“Even when the topic is security policy, the essence is still collective work,”

What Keeps a Network Alive

Infrastructure alone is never enough. A messaging group and a shared drive will remain quiet rooms if there is no strong reason for people to stay engaged. According to RS, one of the facilitators from the Digital Defenders Partnership (DDP), what keeps a community alive is when security is understood as shared work rather than the duty of the one person who knows technology best. “Even when the topic is security policy, the essence is still collective work,” he said, “how they make this organisation safer together.”

That collective work does not always take the form of a policy or a protocol. Sometimes it is as simple as that request on the final day, when twenty people from different countries opened their phone galleries at the same time and deleted photographs, for the safety of someone they had met only five days earlier. That is where a network truly begins.

About the Young Tech Collective (YTC)

From Participant to Champion: Empowering Youths to Lead Their Organization’s Digital Resilience

Communication and Campaign Officer Tifa — Mon, 24 Aug 2026 09:09:01 +0000

Arie Mega

Project Research and Learning Specialist for the Digital Democracy Initiative at Tifa Foundation

From Participant to Champion: Empowering Youths to Lead Their Organization’s Digital Resilience

Midway through the training in Kuala Lumpur, LJ, a focal point from a labour and human rights institution in the Philippines, messaged his executive director with a simple question. Did the organisation have a digital security plan, and if so, could he see it? The document arrived. He opened it, and then fell quiet.

“Upon reviewing it, we only have just like one paragraph,” he said. Elsewhere in the same document, the assessment of their digital security situation ran on at length. There was awareness of the problem, but almost nothing in the way of a plan to address it.

Moments like that repeated across many organisations during the five days of the Young Tech Collective (YTC) onsite training in late May 2026. And it is precisely from that kind of honest starting point that the focal point model does its work.

“Prevention is actually better than cure.”

An Honest Starting Point

Almost every participant arrived in a similar condition. Not without security, but with security that had grown reactively, always one step behind the incident.

GL, a focal point from a youth organisation working on sustainable development issues in the Philippines, described it candidly. Her organisation began backing up documents digitally only after their paper archives were damaged by a leak in their old office. They began enforcing two-factor authentication only after an officer’s social media account was hacked and the organisation’s page was taken down.

“Everything we have done so far with security has been reactive. Danger usually happens before we did something,” she said. “Prevention is actually better than cure.”

At the organisation where AC works, a Yogyakarta-based institution accompanying networks of young activists, the assessment was equally blunt. “The state of our digital security was, in my view, quite low,” he said, largely because they had no digital security policy at all, while managing a website, social media accounts, and shared document storage.

What LJ faced was more structural still. The security knowledge his institution once held had never been passed on, because a colleague died and the staff member responsible for security was retiring. “The transfer of knowledge has not been done,” he said.

Why It Has to Be an Insider

This is where YTC’s design choice sits. Rather than sending in an external consultant to train an entire team over a day or two, the programme selects one person from inside each organisation, equips them, and then accompanies them for four months.

RS, one of the facilitators from the Digital Defenders Partnership (DDP), explained the reasoning. “With a one-off training, the awareness only lasts a moment. During the session they are aware, and once they walk out, they forget again,” he said. “That is why we use a long accompaniment model, because building awareness and capacity is a slow process.”

Some of the work can only be done by an insider, and it is not technical work. One focal point from Myanmar faces colleagues who consider digital security an overreaction. Many of them are senior activists and politicians who feel experienced enough already. “They feel they do not need to use a VPN, digital security is not important for them,” she said. “I always try to change their mindset.”

A consultant who arrives one day and leaves the next will never win against that kind of resistance. The person who can is the one sitting in the same room every day, who knows who needs to be approached and how, and who has the time to repeat the same conversation until it turns into a habit.

From Participant to Facilitator

The clearest shift over those five days came when participants began speaking not as people learning something, but as people preparing to teach it.

GL recognised that the knowledge gap between herself and her colleagues was wide. Most staff were familiar only with ordinary email and common messaging apps, and had never received a basic introduction to digital security. Asked whether she felt ready to facilitate an internal session, she did not hesitate. “Yes, I think I am about ready, because I already have the situation down,” she said.

Her plans are specific. Beyond introducing more secure communication channels, she wants to close a gap that had been overlooked: two-factor authentication was required only of those holding the main accounts, and had never extended to interns and volunteers. “We really have to include it in our onboarding next time,” she said.

The focal point from Myanmar plans to run tutorial sessions for her colleagues and volunteers, including the password management she learned at this training and set up for herself that same night. LJ is planning internal training for his entire staff, and deliberately wants to invite representatives from other organisations to sit in. AC is starting from mapping. “We want to do a more comprehensive risk assessment first, look at what they actually need, and only then build a more concrete action plan,” he said.

“The commitment of each individual will become an obstacle, because we have everyday tasks,”

The Obstacles They Name Themselves

What makes these plans credible is that the focal points are equally clear-eyed about what stands in the way.

For LJ, the first obstacle is funding, because his institution is small and improving digital infrastructure carries recurring costs. But she named a second obstacle that is harder to measure. “The commitment of each individual will become an obstacle, because we have everyday tasks,” he said. When there is a picket to document that same day, the internal training schedule is the first thing to move.

For GL, the obstacle is more basic still: the quality of internet connections across their regional offices, which makes some of the more secure applications impractical for daily use. For AC, the challenge is scale, with only around 20 office staff but hundreds of beneficiaries outside.

None of these obstacles is solved by a five-day training. But naming them openly is part of the work itself, and it is exactly where four months of accompaniment finds its purpose.

Protecting Those Who Protect

DF, a focal point from a regional youth network organisation, closed her reflection with the line she intends to bring home to her colleagues. “Do you realise we are not as safe as we think? Our information is highly accessible to anyone with bad intentions towards us.”

For LJ, the reason returns to the most basic premise of their work. “While we are securing the rights of other people, we also need to secure ourselves against those threats,” he said. “We need collective care and security in order to persist, in order to become resilient, in order to do our daily jobs without worrying so much.”

This is what it actually means for a focal point to stand at the front line. Not because they are the most technically skilled person in the organisation, but because they are willing to be the first to raise the issue, and to keep tending to it long after the training ends.

About the Young Tech Collective (YTC)

Building A Network of Young Tech Activists for Southeast Asian Civil Society

Communication and Campaign Officer Tifa — Mon, 24 Aug 2026 09:08:48 +0000

Arie Mega

Project Research and Learning Specialist for the Digital Democracy Initiative at Tifa Foundation

Building A Network of Young Tech Activists for Southeast Asian Civil Society

A training usually ends when its participants go home. The materials sit in a folder, the photos are uploaded, and slowly the daily grind takes over until what was learned fades away. The Young Tech Collective (YTC) is designed precisely to resist that pattern.

When 20 focal points from across Southeast Asia left Kuala Lumpur in late May 2026, they did not simply carry notes home. They stayed connected within a network deliberately built to outlive the final day of training. This is where one of YTC’s core objectives lies: building a community of practice, a cross-country community in digital security for civil society.

More Than Training Alumni

The critique behind YTC’s design is simple: one-off training rarely sticks. The awareness that surfaces in a classroom usually evaporates once participants return to their piles of daily work. That is why the five days in Kuala Lumpur are treated not as the main event, but as one point within a longer process.

After the training, the focal points remain connected through an encrypted cross-country messaging group and a shared repository for materials and working documents. Over the four months of accompaniment, they take part in regular check-ins with the Tifa programme team and in mentoring sessions, with each organisation working from an agreed action plan. The network, in other words, is not just a chat group that happened to form because people once shared a room. It is a planned part of the programme.

“I hope this network keeps going, so that we can support each other,”

A Network Already at Work

For some participants, the network bore fruit even before the training ended. AC, a focal point from an organisation in Yogyakarta, was connected by the facilitator to a community technology initiative in his own city, something he had not known was so close by.

“The hope is that we can collaborate much more,” AC said. “We already had a chance to talk, and there are a few opportunities we could combine so the impact is greater.” For a small organisation with limited resources, connecting with others facing similar problems is often worth more than any single new tool.

The network also works by widening the circle. GL, a focal point from a youth organisation in the Philippines, plans not only to train her own staff but to open the door to other organisations. “We want to invite other organisations too, one representative each, to sit in with us,” she said. That way, the capacity she brought home from Kuala Lumpur does not stop at one institution, but spreads into a wider network.

Strength in Different Contexts

The twenty focal points came from very different contexts, from Myanmar, the Philippines and Indonesia to other countries in the region. That difference is precisely what makes the community strong. What is a routine security habit in one country can be genuinely new knowledge for a participant from another, and the other way around. A best practice from one context can be borrowed, tested, and then adapted to another.

For DF, a focal point from a regional youth network organisation, this is the value she most wants to protect. “I hope this network keeps going, so that we can support each other,” she said. “Whether that is mental support, or international support, movements and campaigns that back each other up.” Collective care of that kind is hard to grow from a training that ends in a day, but it can grow from a network that stays connected.

What Keeps a Network Alive

Infrastructure alone is never enough. A messaging group and a shared repository can easily turn into quiet rooms if there is no strong reason for people to stay engaged. The real question is not about the tools, but about the people who tend to them.

According to RS, one of the facilitators from the Digital Defenders Partnership (DDP), what keeps a community alive is when security is treated as shared work that is continually maintained. “How they build security collectively, who has the technical capacity, and who is willing to keep reminding the group to keep talking about it,” he said. A network endures not because its app is sophisticated, but because there are people willing to keep opening the conversation.

“Security is the most fundamental aspect of an organisation. Without security, what can you do?”

Towards a Regional Protection Infrastructure

Looking ahead, YTC imagines this network growing into something more than a place to exchange news. One direction being prepared is the development of shared digital security learning materials that can be translated into the region’s various languages and paired with hands-on guides, so that knowledge which once lived only in a training room can be accessed and reused by other organisations over the long term.

At that point, the focal points’ network is no longer merely a by-product of a training, but part of the digital protection infrastructure for civil society in Southeast Asia. For GL, the stakes really are that high. “Security is the most fundamental aspect of an organisation. Without security, what can you do?” she said. And security, as this training insisted throughout, can never be built alone.

About the Young Tech Collective (YTC)

Facing Terror in Cyber Space: The Real Stakes for Young Activists

Communication and Campaign Officer Tifa — Fri, 21 Aug 2026 11:18:09 +0000

Arie Mega

Project Research and Learning Specialist for the Digital Democracy Initiative at Tifa Foundation

Facing Terror in Cyber Space: The Real Stakes for Young Activists

On paper, security threats fit into tidy boxes: digital here, physical there, psychosocial somewhere else. But for civil society activists and journalists in Southeast Asia, these dangers never stay separate. Instead, they bleed together, amplifying each other and casting a shadow over daily life.

Picture this: an investigative journalist masters encryption, yet finds their courage to write slowly drained by creeping anxiety. An organisation guards its database fiercely, but all the data lives on one laptop, always at risk if its carrier is stopped at a checkpoint. Or a female activist, well-versed in digital risks, faces her greatest fear not online, but when strangers appear at her door.

This tangled web of daily vulnerabilities is exactly why the Young Tech Collective (YTC) onsite training, hosted by the Tifa Foundation and Digital Defenders Partnership (DDP) in Kuala Lumpur in May 2026, feels so urgent. Over five days, twenty focal points from across the region shared their stories, and those stories underscored one thing: terror in cyberspace rarely stops at the screen.

"The risks are incredibly real.”

The Threat That Follows You Home

AC, Website Coordinator from a youth-led organisation in Yogyakarta, brought this digital-physical spillover to life. As a Focal Point guiding networks of outspoken young activists, AC has seen just how thin the line is between digital safety and real-world danger.

“Our youth actor friends have repeatedly faced cyber attacks on their social media,” AC shared. “Recently, someone faced mass hate comments, another was harassed with continuous food delivery orders they never placed, and someone’s family was even doxxed. The risks are incredibly real.”

For AC, this situation is exacerbated by the digital ecosystem in Indonesia, which he describes as highly vulnerable. “Whether we like it or not, we live under surveillance. We are forced to share our personal identity data digitally just to get official documents, while on the other hand, we know that national ID data can easily be bought and sold on the dark web,” he stated critically.

Often, these vulnerabilities grow from tiny, overlooked habits: using one email for everything, keeping sensitive contacts unprotected on a phone, or leaving old coordination groups full of strangers on messaging apps.

When Crossing a Border Means Deleting Yourself

If in Indonesia the threat reaches the front door, for focal points from Myanmar the line between digital threat and physical danger barely exists at all. There, digital security is not a matter of convenience, but of whether a person can pass a checkpoint without being arrested.

PH, a focal point from Myanmar who now works across borders, described the ritual he goes through every time he crosses. Not simply locking apps, but deleting them entirely. “We never bring those kinds of applications. We have to delete everything,” he said. A single wrong app on a phone can mean detention. “If the government gets stricter, my advice is, do not use it at all. Because of that application, many, many activists are arrested.”

A female focal point from Myanmar, who asked not to be named, said the heaviest burden was not technical at all. “Mentally, it is very difficult,” she said, describing what it is like when officers ask to inspect her phone at a checkpoint. The room to hide has narrowed further. She noted that since 2023, the Myanmar government has been collecting citizens’ biometric data comprehensively, making a person’s trail far harder to erase.

Preparation before travelling has therefore become part of the work itself. Devices are wiped clean, social media is curated to carry only neutral topics, and any document linking a person to their organisation is deliberately left behind. For them, securing data and safeguarding the body have long been one and the same job.

“The government links us with terrorist groups freely,”

The Fear That Stays in Your Head

If in Myanmar the threat is felt most sharply at the checkpoint, in the Philippines it takes the form of a pressure that settles in the mind. LJ, a focal point from a labour and human rights institution in the Philippines, recounted how his organisation has been labelled a terrorist group ever since the anti-terror law was passed, a practice known there as red-tagging. “The government links us with terrorist groups freely,” he said. Since then, the attacks have come almost daily.

“Suspicious accounts comment on our posts, send us AI-generated photos accusing us of being terrorists, and even send threats to our staff’s personal accounts,” LJ said. Some of his staff have experienced direct surveillance. That relentless pressure leaves a mark that is invisible, yet very real.

That is why, throughout the training, LJ repeatedly raised the dimension people most often forget when they talk about digital security. “We need to consider care, psychosocial intervention,” he said. “Because it produces mental stress for everyone.” This is the third dimension the holistic security approach insists on, that protecting the mind matters as much as protecting data and the body.

"... We need to develop a simple digital security brief that can easily be applied by our young peers according to their actual needs.”

Security as a Collective Practice

These three dimensions, digital, physical, and psychosocial, cannot be safeguarded in isolation, and just as importantly, cannot be safeguarded alone. A key lesson from the YTC risk assessment is that digital security is never just a solo effort. One person’s discipline means little if teammates or the wider communication network let their guard down. The whole organisation stays exposed.

For AC’s organisation, with 20 staff and hundreds of external beneficiaries, the real challenge is weaving security into the fabric of their daily culture.

“Securing and educating hundreds of people is a struggle in itself,” AC admitted. “Our concrete plan moving forward is not to rush into changing things or forcing complicated new tools. Instead, we want to conduct a comprehensive risk assessment internally first. We need to develop a simple digital security brief that can easily be applied by our young peers according to their actual needs.”

In the end, there is no single answer to the question of which app is safest. Security always depends on the situation: the threats at hand, the team’s skills, and how well the group looks out for each other. In a world of constant surveillance, only a culture of shared vigilance can help activists endure.

About the Young Tech Collective (YTC)

Embedding Capacity, Sustaining Practice: DRAPAC 2026 and the Case for YTC’s Focal Point Model

Communication and Campaign Officer Tifa — Tue, 28 Jul 2026 05:13:50 +0000

Khant Khant Zar Nyi

Project Officer for the Digital Democracy Initiative project at Tifa Foundation,
Lead of the Young Tech Collective for Change (YTC)

Embedding Capacity, Sustaining Practice: DRAPAC 2026 and the Case for YTC's Focal Point Model

This article is part of the DDI at DRAPAC 2026 series.

DRAPAC 2026 unfolded just weeks after Tifa Foundation closed its five-day on-site training for the Young Tech Collective for Change (YTC) in Kuala Lumpur. YTC is Tifa Foundation’s non-financial support mechanism, implemented in partnership with the Digital Defenders Partnership under the Digital Democracy Initiative, running across 14 Host Organizations in East and Southeast Asia. Joining the sessions to reflect on YTC’s work, three key insights stood out and continue to shape how to proceed with the next accompaniment ahead: what digital security trainers in Southeast Asia are struggling with, what community members and activists are struggling with, and what the shrinking funding landscape means for both.

Two sessions carried most of this learning. The first was “From Risk to Resilience: Bringing Communities and Trainers Together for Digital Safety”. Rather than a panel, participants were split into two groups: trainers and incident responders in one, community members and activists in the other, and they were asked to speak candidly about what is not working in the current model of digital safety.

The trainer community in Southeast Asia is small and getting smaller. Participants observed that the same practitioners circulate through every regional convening, and few new people are entering the field. Many are freelance without institutional support and with limited access to psychosocial support despite the emotional weight of the work. Threats, meanwhile, are becoming layered and hybrid, such as online surveillance combined with physical intimidation, data leaks paired with coordinated harassment, and platform-level violations reinforced by state campaigns. Trainers said clearly that they are keeping pace with the threats themselves. What is failing them is the surrounding infrastructure of short project cycles, restrictive legal environments, and donor expectations of quick, measurable outcomes on work that takes years to embed.

They also mentioned that tools and trainings on offer can feel overwhelming or disconnected from participants lived realities. People sit through workshops and rarely translate the content into practice. After a strong week of YTC onsite training in Kuala Lumpur, small moments surfaced that reminded us that awareness does not automatically translate into behavior. For the YTC accompaniment, the design challenge is creating space for Focal Points to practice, question, and internalize, rather than only revisiting what was already said.

The second group told a different story. Representing many activists and community members in the region, they mentioned that digital security is not the primary struggle in real-world situations. Rather, it is basic digital literacy, such as the ability to use online services safely every day. Participants from the Philippines described the rapid digitalization of government and social services without a matching investment in helping people navigate these platforms. Before communities can be protected from advanced threats, many still need support to open an account, verify an identity, or recognize a phishing message. They also spoke about the hidden cost of security in resource-scarce environments: safety practices demand time, cognitive space, and emotional energy, resources that are already stretched thin for people managing physical risk, economic precarity, or displacement.

Despite their different vantage points, both groups agreed that digital security has to be integrated into the ongoing work of activists, labor organizers, women's rights defenders, grassroots communities, and so on.

Khant Khant Zar Nyi

Despite their different vantage points, both groups agreed that digital security has to be integrated into the ongoing work of activists, labor organizers, women’s rights defenders, grassroots communities, and so on. A notable quote from the session is “The security landscape as a whole is rather broken, but I hope it’s not beyond repair.” For YTC, this is precisely why the Focal Point model matters. The accompaniment is designed to build lasting capacity inside Host Organizations so that Focal Points can sustain the work independently once the program closes.

The second session, Resourcing Digital Rights Advocacy in Southeast Asia, was co-organized by Tifa Foundation and partners. It gave the funding side of the same story. Across the discussion, a shared reality emerged: civil society organizations working on digital rights in the region are navigating shrinking, less predictable, and more politically constrained funding, and are searching for ways to hold their work steady while traditional grant pipelines contract. When civil society organizations contract, other actors (some corporations, some state-aligned, some openly hostile to rights) expand into the space they leave behind. This is where YTC’s design becomes meaningful. As a non-financial support mechanism, YTC is not a substitute for the direct funding these organizations continue to need, but it offers something complementary: capacity, accompaniment, and connection. These are more resilient to sudden funding shocks, and they help Host Organizations sustain their people and their work even in constrained environments.

Sitting with these conversations, a few implications become clear for YTC. The program responds directly to both problems raised at DRAPAC. By investing in Focal Points inside Host Organizations, it gradually widens the pool of people carrying digital safety forward, and because the support is non-financial, it is also less exposed to the sudden funding shocks that shape so much of this work. YTC must also design deliberately for the appreciation gap between awareness and practice. Strong training content is not enough on its own, and the accompaniment will need scenario walk-throughs, reflective check-ins, and honest spaces to surface challenges without punishment. Just as importantly, YTC does not stand outside the fragile ecosystem it supports. Several Host Organizations are themselves operating with reduced teams and constrained budgets, which means the accompaniment must listen for ecosystem signals such as funding shifts, legal changes, and staff turnover that shape whether a Focal Point can sustain the work back inside their organization.

DRAPAC 2026 was, in that sense, a reminder that the Digital Protection Accompaniment Model is not just a design choice. It is a direct response to what trainers, communities, and funders across the region are already telling us.

Share this article:

Rethinking Who We Build Digital Rights with

Communication and Campaign Officer Tifa — Tue, 28 Jul 2026 05:02:15 +0000

Sau Fong

Staff member at the Centre for Independent Journalism (CIJ), a feminist, freedom of expression watchdog and non-profit organisation that aspires to a society that is democratic, just and free, where all peoples will enjoy free media and the freedom to express, seek and impart information.

Rethinking Who We Build Digital Rights with

This article is part of the DDI at DRAPAC 2026 series.

Participating in DRAPAC Manila 2026 broadened my perspective on digital rights issues. From sessions on Foreign Information Manipulation and Interference (FIMI) to digital trade agreements to the blunt question of whether Big Tech serves people or profit, one thread ran through everything. The information we consume and the trail we leave behind carry consequences far beyond our daily lives.

At a personal level, it’s a reminder to be more aware of the information we exchange every day, to keep a healthy sceptical mindset, to question, clarify, verify, and search for the most objective truth. At an advocacy level, our cause must remain locally relevant, but we also have to consider its wider implications at the global level. The challenges we face in Malaysia don’t happen in isolation. They’re shaped by the same platforms and information battles playing out everywhere else in the region.

Fandom, youth, and shared stewardship

One of the sessions I found most memorable is “Stan Power to People Power: How Fandoms Power Digital Activism in the Philippines,” organized by K-pop Stans 4 Good Governance and DAKILA, where I heard how a youth advocate and a lawyer leveraged their fandom skills for advocacy and civic engagement. While the issues and operational models of commercial and nonprofit spaces differ significantly, they share certain core strategies and approaches. The ability of fandom communities to inspire people to participate, contribute, and take action is remarkably organic and vibrant, and that took a lot of hard work too.

One of the panellists added a comment that stayed with me. She spoke about the pressure young people carry from being told that “the world belongs to the youth,” and urged experienced advocates not to hand over leadership, like asking someone to lead a lion dance, without giving them the proper guidance and support first. It was less a call to hand over the reins and more a reminder that youth need mentorship and preparation, not just responsibility placed on their shoulders. “Shared stewardship” may be the right term, since it takes both generations working together to ensure the world remains viable.

"Shared stewardship" may be the right term, since it takes both generations working together to ensure the world remains viable.

Sau Fong

Rethinking who we sit across the table from

A three-hour workshop on multistakeholder models for digital platforms co-organized by CIJ, Tifa, and partners in Southeast Asia also challenged us to think outside the box and explore collaboration with unexpected partners, such as policymakers and platform owners. We should shift our assumption that authorities or certain stakeholders are unwilling to work with civil society organizations on AI and digital rights issues. In many instances, building trust-based relationships, instead of putting us in opposition, would work better. This ongoing “reimagining” process is more than a self-challenge in problem-solving. It gives us, especially those who have been advocating for decades, hope to continue the journey and the courage to dare to dream once more.

What this means for how we work

The session “Resourcing Digital Rights Advocacy in Southeast Asia,” co-organized by Tifa, CIJ, and FMA, spoke directly to a question we grapple with constantly. A collective approach, where a few organizations sharing the same vision, mission, and goals leverage strategic partnerships together, may be one of the more efficient paths for CSOs to consider. It has been tested and is still being worked on by some organizations in Malaysia and Indonesia. This allows us to borrow strength, not just to build internal resilience but also to amplify voices and multiply the impact we create. Working together also means not replicating work already being carried out by others. The limited resources we have now should be wisely spent on our cause and strategies within the ecosystem, complementing each other’s work rather than competing with one another. Narrative shaping is another key area worth investing in. There is definitely money in the market, but we first need to let people understand us and the impact we aim to create, our movement, by speaking a language they understand and that convinces them enough to buy in.

Looking ahead, a few things stay with me. Continuing to give staff the chance to step into regional and global spaces like this one matters because it really does change how we see our own work. So does bringing younger and older colleagues together to learn from each other, rather than drift apart. Our communications could stand to feel more human too, since advocating for change doesn’t always have to be heavy, and there’s room to keep finding better ways to tell our own story. And there’s value in continuing to look for the right partners to build with, instead of going it alone.

Share this article:

Tech accountability and digital rights resourcing advocacy should start upstream: Notes from DRAPAC 2026

Communication and Campaign Officer Tifa — Tue, 28 Jul 2026 04:31:07 +0000

Alfiana Qisthi

Project Officer for the Digital Democracy Initiative project at Tifa Foundation,
Lead of the DDI Financial Support Mechanism (Re-D Fund)

Tech accountability and digital rights resourcing advocacy should start upstream: Notes from DRAPAC 2026

This article is part of the DDI at DRAPAC 2026 series.

Attending DRAPAC26 in Manila was my first Digital Rights Asia-Pacific Assembly, and I came to it from a background rooted more in criminal justice and international development than in digital rights specifically. Sitting through these sessions was, in many ways, my first real exposure to watching human rights concerns get worked through in digital spaces rather than reading about them from a distance. What struck me across the sessions I attended was a single pattern: a widening gap between how quickly institutions adopt technology and how slowly they build the accountability structures meant to govern it.

That gap showed up first in a conversation about artificial intelligence in the judiciary, and it was the session where my own background gave me the most familiar footing. What stayed with me was how consistent the pattern was across very different judicial systems. Indonesia’s Early Case Detection system, designed to flag similar cases and reduce disparity in judicial decisions, sounded reasonable in principle, but when I pressed on whether any binding rule obliges judges to actually engage with its output, the honest answer was that nobody outside the system really knows. India’s Digital Future Lab presented similar ambitions around ethical AI adoption, and Taiwan’s Judicial Reform Foundation offered a civil-society vantage point on the same tension from a jurisdiction with far more mature technology governance. Hearing the same underlying problem, which tools introduced with a legitimate rationale but minimal transparency, recur across three quite different legal systems made it clear this is not an Indonesia-specific gap but a structural one across the region’s judiciaries. I recognized in it a familiar shape of the “pasal karet” problem I have spent years tracking in Indonesian law: a good-faith mechanism whose safeguards are undermined by the absence of disclosure norms.

The same shape reappeared, sharper, in the session on surveillance and migration, again playing out similarly beyond Indonesia alone. Spyware procured by law enforcement, biometric systems expanding under “smart city” branding, detention “alternatives” that in practice extend rather than shorten a person’s time under monitoring — in each case, a private vendor sits quietly behind the technology, earning revenue for as long as the system keeps collecting data. The OHCHR’s contribution reframed all of this for me: rather than treating each abuse as a downstream harm to document and respond to, they argued that a human rights impact assessment belongs at the procurement stage, before a system is ever deployed. That shifted where I now think the intervention point should be — upstream, in the purchasing decision, not after the fact. A related workshop in the same track, hosted by Engage Media, stayed with me for a more personal reason: Engage Media is one of Tifa’s Re-D Fund Cohort 1 partners, and here they were presenting their own work building and maintaining VPN tools for human rights defenders navigating censorship and blocked access. Watching a partner I already work with through a grant relationship demonstrate that work in real time made the funding relationship feel concrete in a way a narrative report never quite does — this is what the funding support is actually for.

If accountability in surveillance systems means intervening before deployment, I found myself asking whether funding needed its own version of "upstream" — building trust, flexibility, and coordination into a grant relationship from the start, rather than only reacting once funding tightens or a program ends.

Alfiana Qisthi

That connection carried directly into the resourcing session, which mattered most to me on two fronts at once: as the Re-D Fund lead, and as someone who came into Tifa from international development work where funding architecture was often designed far from the movements it was meant to serve. If accountability in surveillance systems means intervening before deployment, I found myself asking whether funding needed its own version of “upstream” — building trust, flexibility, and coordination into a grant relationship from the start, rather than only reacting once funding tightens or a program ends.

Listening to SIDA, Luminate, and DT Global describe what makes a funding relationship trustworthy — movement-led decision-making, flexibility, sustained presence on the ground, trust built over years rather than assumed on day one — I found myself measuring it against both the Re-D Fund and my earlier experience with bilateral programming. What stayed with me most was a reframing I had not expected: just as accountability needs to start upstream, so does the question of sustainability — in a period of shrinking funding across the region, the real question is not only how development partners sustain the funding itself, but how they help sustain the movement when funding contracts. Flexible grants and trust matter, but so does whether a donor’s exit or downsizing leaves behind functioning networks, retained expertise, and shared infrastructure — or just a gap. I also left with a genuinely new question: how do intermediaries and donors avoid duplicating support or working in silos around the same grantees? As our Cohort 1 (and now Cohort 2 too) partners increasingly sit at the intersection of multiple funders, that coordination question is not hypothetical for us, and it is one I want to raise more deliberately with our own donor counterparts.

Coming from criminal justice and development work into this space for the first time, I am leaving DRAPAC26 with a sharper sense of where advocacy needs to happen: not only responding to how technology is used, but pushing to be present when decisions about how it is built, bought, and funded — and how it is sustained once the funding shifts are made.

Share this article:

Reaching Across a Closing Space

Communication and Campaign Officer Tifa — Tue, 28 Jul 2026 04:18:35 +0000

Mi Eain Na Roi

Program Director at NRFF, a Youth-led Community Organization based in Myanmar.

Reaching Across a Closing Space

This article is part of the DDI at DRAPAC 2026 series.

Attending DRAPAC 2026 was one of the most valuable experiences of my career and of my organization’s journey so far. I came away with new knowledge and, just as important, a network I did not have before. Early in the event, though, I felt a quiet sadness. I kept thinking of colleagues on our local media team who do not have the proper documents to travel, who will likely never get the chance I was given.

In Myanmar, digital repression has become an everyday reality since the military coup. The junta uses surveillance technology, online monitoring, and internet restrictions to identify, intimidate, and arrest activists, journalists, and human rights defenders. In many resistance-controlled and remote areas, internet access is unreliable or simply absent, making it even harder for communities to get information or communicate during emergencies like airstrikes and displacement.

What encouraged me most was seeing how many international organizations back a bottom-up approach, one that strengthens local civil society organizations and community-led initiatives.

Mi Eain Na Roi

What the networks made possible

The connections I built at DRAPAC 2026 turned out to be one of the most valuable parts of the whole experience. I met both international and local organizations, and those relationships are already opening doors for future collaboration. Hearing from participants across different countries gave me a clearer sense of how international organizations approach digital rights challenges in contexts very different from ours. What encouraged me most was seeing how many international organizations back a bottom-up approach, one that strengthens local civil society organizations and community-led initiatives. That reinforced something I already believed. Empowering local actors is one of the most sustainable, context-sensitive ways to support communities, because they carry the knowledge, trust, and long-term commitment needed to respond when things go wrong.

Sessions that reframed how I think about our work

The sessions I joined covered a wide range of ground, from the intersection of digital rights and humanitarian action to the everyday challenges facing local CSOs, to ASEAN’s role in regional human rights issues, to how international organizations think about supporting digital rights and civic space. Listening to participants from other countries broadened my perspective, and I learned as much from their successes as from their ongoing struggles. These conversations pushed me to think more strategically about how NRFF can strengthen its partnerships, sharpen our digital security practices, and work more closely with regional and international networks to support conflict-affected communities in southeastern Myanmar.

Bringing it back to NRFF

At NRFF, I support research, humanitarian response, and local media work in southeastern Myanmar. Our media team documents human rights violations and reaches conflict-affected communities through printed bulletins and digital security training for marginalized Mon youth on the ground, while our humanitarian team depends on secure communication to coordinate emergency assistance for internally displaced people. The networks I built at DRAPAC 2026 have already started bearing fruit. I connected with humanitarian donors and with organizations interested in building joint initiatives, and we have already agreed to organize a dialogue between activists in NRFF’s operational areas and representatives of a Myanmar freedom fighter organization. It is a small but concrete reminder of what regional networking can do for work on the ground.

I am deeply grateful to DDI for making it possible for me to attend DRAPAC26, my first time representing our local organization and local media at an event of this scale. I look forward to bringing these lessons home and continuing to build the partnerships that will carry NRFF’s work on digital security, human rights, and community resilience forward.

Share this article:

Keeping Human Rights at the Center of Technology

Communication and Campaign Officer Tifa — Tue, 28 Jul 2026 04:11:38 +0000

Sarat Ruos

Project Coordinator for the Protecting Fundamental Freedoms Project of the Cambodian Center for Human Rights (CCHR).

Keeping Human Rights at the Center of Technology

This article is part of the DDI at DRAPAC 2026 series.

Participating in DRAPAC26 for the first time was inspiring. Through discussions on artificial intelligence (AI), digital resilience, democracy, corporate accountability, and digital governance, one message stood out clearly. Human rights must remain at the center of technological advancement.

For Cambodia, where civic space continues to face significant restrictions, these discussions were particularly relevant. As technology increasingly shapes public discourse and civic participation, civil society organizations must adapt their strategies to protect human rights defenders (HRDs), strengthen digital security, and promote fundamental freedoms in an evolving digital environment.

The discussions at DRAPAC26 strongly resonated with CCHR’s core focus areas: protecting fundamental freedoms, business and human rights, judicial and legal reform, and gender equality and diversity.

Investing in digital security, data protection, and cybersecurity capacity can help activists mitigate risks while continuing their work.

Sarat Ruos

AI as Both a Weapon and a Shield for Human Rights

A key lesson from DRAPAC26 is that technology can both advance and undermine human rights. Across the region, digital technologies are increasingly used to monitor online activity and silence dissenting voices. At the same time, they remain powerful tools for documenting abuses, amplifying marginalized voices, and advancing advocacy efforts.

For Cambodia, where HRDs, journalists, and critics continue to face legal harassment for exercising their rights, strengthening digital resilience is more important than ever. Investing in digital security, data protection, and cybersecurity capacity can help activists mitigate risks while continuing their work. Secure documentation of human rights violations remains essential for evidence-based advocacy and accountability.

Corporate Accountability in the Digital Sphere

The participation of major technology companies highlighted the growing influence of the private sector on civic space and human rights. Yet many platforms continue to struggle to meet their responsibilities under the UN Guiding Principles on Business and Human Rights.

For Cambodia, this reinforces the importance of engaging technology companies to improve transparency, safeguard user data, and prevent digital platforms from contributing to restrictions on freedom of expression. Social media remains a primary space for civic engagement and human rights advocacy, which makes stronger corporate accountability essential.

Looking Ahead

Two further threads ran through the assembly. One was the question of how to protect children online without compromising their rights to information, privacy, participation, and freedom of expression, a balance that governments and technology companies must ground in the Convention on the Rights of the Child and broader human rights principles. The other was the growing use of AI in judicial systems, which raises real questions about transparency, accountability, bias, and fair trial rights. Cambodia has begun using AI tools for public communication, though there is currently no indication that courts are using AI in judicial decision-making. As technology evolves, careful oversight will be needed to ensure any future use of AI within the justice system complies with international fair trial standards. Through its Fair Trial Rights Project, CCHR will continue monitoring court proceedings and advocating for greater compliance with these standards.

The funding crisis affecting civil society was also a recurring concern throughout DRAPAC26. Reductions in international assistance have placed additional pressure on organizations working in increasingly restrictive environments. At a time of shrinking civic space, resilience and innovation are critical. Civil society organizations will need to diversify their funding sources, explore alternative resource mobilization strategies, and strengthen solidarity across the region to sustain long-term human rights work.