Advice on Safeguarding Personal Information

• Whether you use a computer, tablet or smartphone, make sure the virus protection and firewall are working, and that the operating system is kept up to date. MORE
  
    Protecting your equipment

  Virus Protection
  
  Use reputable anti-virus software and malware protection and keep it up-to-date. This applies to all types of computer, including Macs which are not, despite urban myth, immune to viruses and malware. Run scans regularly. You can also get virus protection apps for mobile phones - look in the Apple or Google Play stores.
  
  Firewall
  
  A firewall protects malicious people accessing your computer through the internet. There will be one built into your computer's operating system. Check occasionally in the Security Centre that it is switched on and working.
  
  Operating System
  
  Set your computer to download system updates automatically where possible. This applies to all types of computers, tablets and mobile phones (including those produced by Apple). If it becomes impossible to update your operating system because it is no longer supported, you should not continue to use the computer for confidential information or important online activity such as banking. Yes, replacing a computer which still seems to be working well is in conflict with our commitment to sustainability. But how would you feel if your bank account were compromised because your computer was not secure, or if your personal information were made public because someone else was using an unsupported and insecure operating system?
  
  
  
• Be suspicious of any emails, text messages or website messages which you are not expecting. Only download from legitimate sources. MORE
  
  
    Using your computer

  Be wary of emails containing links to websites - if the email appears to be from a friend, check that it is genuine and that their email has not been compromised. If it is from a company, again err on the side of caution and check with the company's main website. Be particularly careful about emails which appear to come from financial institutions, HMRC, etc. and which ask you to enter your password or PIN. If there is anything unusual about the email such as bad grammar or the way you are addressed (are you named in the body of the text?), be particularly careful.
  
  Be very careful about downloads - only download from legitimate sources. Be aware that there are fake websites purporting to let you download programs such as Zoom with names similar to the genuine website. Do not follow links in pop-up windows, just close them, and check with the organisation's main website that the download is legitimate and necessary.
  
  On PCs and Apple Macs, you can create users who do not have full administrative rights (in Windows go to Control Panel - User Accounts). Use such an account for all day to day work and protect the main Administrator account with a strong password. If any program tries to change your computer, you will get a warning and be asked to enter the Administrator password.
  
• Consider who else might access your equipment. Do you need to protect files or the whole computer/mobile phone with a password? This is particularly important for portable equipment and usb sticks which might be lost or stolen. MORE
  
    Password protect files or the whole device

  Microsoft Office and Libre Office both allow you to protect individual files with a password and there are apps such a FileLocker which let you do the same on a mobile phone or tablet. You should particularly do this if you are sending a file by email and it contains sensitive information. If sending the file to someone else, send them the password separately - preferably by text or voice call.
  
  All portable devices should be protected with a password or PIN number, or (where available) use fingerprint recognition so that someone who finds or steals a device cannot easily access all the information you have stored on it. If you have sensitive information on such devices (and it's better if you don't), if you can set them up so that if they are lost or stolen you can track them, lock them remotely, and even wipe them remotely.
  
  Change default passwords on mobile phones etc. and on your home WiFi router if it has a standard password rather than a unique password label on the back of the router (which many routers now have).
  
  When using passwords to protect a file or for access to a website, always use strong (complex) passwords (not whole words that would be easy to guess). Use a different one for every site you use, and do not share passwords. You can use a password manager such as LastPass to save all your passwords securely. Strong passwords consist of random lower and upper case letters, numbers and, if the site allows them, symbols such as $ or §. You may find it easier to remember a complete phrase or sentence and use the initial letter of each word - for example "The Battle of Bannockburn in June 1314" = tBoBiJ1314.
  
  
  
• Do not download/send confidential information when connected to a public wi-fi hotspot such as a cafe or library. MORE
  
  
    Public wi-fi

  Be very careful if you use public WiFi hot spots (e.g. in hotels, cafés, libraries or on the train or bus). Do not use them if you are accessing or sending sensitive information. Use your home WiFi or, if using a mobile phone, a 3G or 4G network.
  
• Backup all important information on a regular basis. MORE
  
  
    Backup

  Back up all documents and pictures on your computer regularly. Ideally, back up to the cloud (a location on the internet such as Dropbox or Google Drive). If you back up to an external hard drive, that drive should not be permanently connected to your computer and ideally should not be kept in the same building: you could use two hard drives, alternating them, so that, if your computer and the attached external hard drive are compromised, you only lose recent documents.
  
  Use the backup facilities in your operating system or a commercial backup program. If there is an option to encrypt the backup, use it.
  
  There is more information on backup in the section for Quaker office holders.
  
• Before disposing of equipment, securely wipe all data. MORE
  
  
    Disposing of equipment

  If you need to dispose of your computer or other device (for instance, if you can no longer update the operating system), wipe the hard drive first (you can get programmes such as Disk Wipe to do this for you, or take your computer to a company like Currys or Simply Fixit) - deleting files in the normal way is not enough as they can still be recovered.

• Only use email addresses for purposes that the owner could reasonably have expected, keep them up to date and not for longer than necessary. MORE
  
  
    Email addresses

  Information about Members and Attenders, including postal and email addresses and telephone numbers as well as other personal details, should be treated as confidential and only used in a way that the subject would reasonably have expected when providing the information. This information must not be disclosed to more people than absolutely necessary. Care should also be taken to ensure that information is kept up to date.
  
  If emailing a group of Friends who will be having an email discussion about the topic in the email, then putting those email addresses in the “to” box is appropriate. You may reasonably assume that those Friends have given permission for their addresses to be shared by agreeing to undertake a joint task.
  
• When emailing a large group, send using bcc. MORE
  
  
    Emailing a large group

  If emailing a group of Friends something like a newsletter, then putting your own email address into the “to” box and all the other addresses in the “bcc” box reduces the risk of the email list being misused or compromised. Before circulating information on a particular subject to every address on your email list, ask yourself whether this is the best way. There are addons available for some email clients which will warn you if you are not using bcc when sending to more than a predefined number of people.
  
  Gmail has a limit of about 150 emails a day when sending out from a mail program and 500 per day when connected through a browser. Yahoo has similar limits and BT somewhat lower. If you encounter problems, try sending in smaller batches or use a mailing service such as MailChimp which allows 2000 recipients on a free account. 
  
• Don't put sensitive information in an email - put it in an encrypted attachment. MORE
  
  
    Avoid putting sensitive information in an email

  Do not share sensitive information by standard email. Emails are not secure unless they are encrypted. The easiest way of sending confidential information by email is to put it in an encrypted attachment.
  
  In Microsoft Office and Libre Office you can password protect a document or spreadsheet before saving it - for modern versions of the software this encryption is secure. Always send the password separately, preferably by text or phone. You can also use a program like 7-zip which will compress and encrypt any file or folder. This can be made self-extracting so the recipient does not need a copy of the program.
  
• If emails have previous exchanges attached, consider whether these should be deleted before replying or forwarding - they may contain confidential information. MORE
  
  
    Review email strings before replying or forwarding

  Emails often grow into long strings with earlier exchanges reproduced below the current email. When forwarding such emails or including new recipients in a reply, always review the whole of the email string to ensure that you are not disclosing email addresses or other confidential information which the author would not have expected to be disclosed. Consider deleting part or all of the email string.
  

• Dispose of old copies of the Book of Members securely.


• Shred confidential documents when disposing of them.

• There are a number of short, user-friendly videos warning you about a wider range of frauds and scams at https://www.getsafeonline.org/video/