DIGITAL SAFETY EXPLAINER | Issue 04 | August 2026
BY: Olasupo Abideen
The tested response playbook that women in Nigerian politics need to know before they need it
BBYDI × FactCheck Africa | Strengthening Digital Integrity and Inclusive Participation for Nigeria 2027 | August 2026
The instinct to react is the enemy of the response.
Picture the moment. You open your phone in the morning to a flurry of notifications. A screenshot of a fabricated post attributed to you is circulating on X. The comments are already dozens deep and climbing. A cousin has texted you asking if it’s really you. Your campaign manager has left three voice notes on WhatsApp. Someone has already tagged you into a thread saying you should resign.
Almost every instinct you will have in the next thirty seconds is wrong. The instinct to reply and refute — wrong, because it amplifies the content and gives the attackers the engagement they wanted. The instinct to delete or hide your own accounts — wrong, because it destroys evidence and looks like an admission of something. The instinct to call every ally at once for reassurance — wrong, because it fragments your attention across a dozen conversations when what you need is one clear plan. The instinct to lash out at the visible attackers — wrong, because most of them are peripheral and the coordinated network sits behind them, waiting for you to amplify it.
This month’s article walks through the tested response protocol — the 24-hour playbook that women in Nigerian politics, journalists, and activists globally have found makes the difference between an incident that resolves and one that escalates. It applies whether the attack is a single threatening message, a coordinated harassment campaign, or a full-scale gendered disinformation operation. Read it now, before you need it. Read it again in October. Save it somewhere you can find it under stress.
| The five-second rule Before you do anything — before you reply, delete, screenshot, or call anyone — pause for five seconds and run through this checklist. Am I in physical danger right now? Is anyone I love in physical danger? Is this happening in multiple places or just one? Have I documented anything yet? Five seconds. Then act. The pause is not weakness or indecision — it is the single most useful thing you can do in the first minute of an incident. |
The 24-hour playbook
Work through this in order. Do not skip steps. Do not improvise. The whole reason a playbook exists is so that under stress you can execute a plan you agreed with yourself in calmer moments, rather than making decisions in a state you would not trust yourself to make them in.
| Time | Action | What this looks like in practice |
| 0 – 5 min | Pause | Do not reply. Do not delete. Do not call anyone yet. The first five minutes are for absorbing what is happening and not making it worse. Breathe. Sit down if you need to. Notice what your instincts are telling you to do, and do not do those things yet. |
| 5 – 30 min | Document | Capture every piece of the attack — screenshots, URLs, screen recordings, account information. Archive the URLs to the Wayback Machine (see July’s article for the full method). Log everything. The documentation must be complete before you take any external action; without it, everything downstream is weaker. |
| 30 – 60 min | Tell one person | Contact your designated incident-response contact — not to fix it, but to share the cognitive load. Brief them, share the documentation folder, and decide together what the next steps should be. If you do not yet have a designated contact, this month is when to appoint one (see the closing section). |
| 1 – 4 hrs | Triage and report | Assess the severity. Is this a single incident, the start of a coordinated campaign, or a security threat with physical-safety implications? File platform reports on the specific pieces of content. If the criminal threshold is met, brief your legal-aid partner. If physical safety is implicated, consider temporary relocation or a heightened-security posture at home. |
| 4 – 12 hrs | Escalate strategically | If platform reports are unlikely to suffice, escalate through accredited civil-society partners (Dubawa, FactCheck Africa, CDD-WA, FIDA Nigeria, NAWOJ). If the content is fact-checkable disinformation, request a verification verdict from a Nigerian Fact-Checkers’ Coalition member. Continue documentation as the attack evolves — new pieces of content, new amplifying accounts, new engagement patterns. |
| 12 – 24 hrs | Communications | Decide whether and how to make a public statement. If you do, work with women journalists where possible. Do not respond to the attackers directly. Do not amplify the content by quoting it. Frame the statement in your own terms — what happened, what is documented, what you are doing about it. Keep the length short; long statements invite more attack. |
| 24 hr+ | Aftercare | Check in on yourself. Check in on family members, especially any who have been named or implicated. Schedule a follow-up with your counsellor if you have one. Update your documentation file with everything that has happened. Plan the next 72 hours of monitoring — attacks like this often come in waves rather than as single events. |
Three things never to do in the first 24 hours
Every element of the playbook above matters. But three specific mistakes are common enough, and consequential enough, that they warrant separate attention.
Never reply directly to the attacker
Direct engagement — even to refute — amplifies the content algorithmically. Platform ranking systems reward posts that generate replies, particularly from targets. Your reply signals to the platform that the content is interesting; the platform then shows the content to more users. The satisfaction of setting the record straight, in this specific setting, is bought at the cost of expanding the reach of the attack. If a response is warranted at all, it belongs in a separate post from your own platform, not as a reply to theirs.
Never delete your own content in panic
The instinct in the first hour is often to purge — to make your public accounts smaller, less exposed, less findable. This is almost always the wrong move. First, it destroys the evidence base of what you actually said and did, which is what your defence rests on. Second, it looks like you are hiding something, particularly to anyone paying attention. Third, once content is deleted, it can be selectively reconstructed in bad-faith formats that you can no longer rebut with the original. If some of your content really is now unsafe, archive it (download a copy for your own records) before deleting anything, so you retain the record even if the public version goes away.
Never make consequential security decisions alone in the first 24 hours
The single reason the designated incident-response contact role matters so much is that the first 24 hours are the worst possible time to make decisions unilaterally. Adrenaline compresses your options. Fear makes cautious moves look like the safest available choice when in fact they may make things worse. A second mind — one that shares your stakes but is not the one being attacked — is a corrective. Consequential decisions in the first 24 hours (whether to go to the police; whether to make a public statement; whether to relocate temporarily; whether to escalate through media) should be made with your contact, not by yourself.
Building your circle of support before you need it
The most consistent finding in research on women who have weathered sustained online attacks is this: the women who came through best were the ones who built their support structure before they needed it. The women who suffered the most acute harm were typically the ones operating alone.
Your circle should include five roles. They can be filled by one person each, or — better — by more than one.
- The incident-response contact: the person who picks up the phone when an attack lands. Their role is to share the cognitive load, hold the documentation folder, and help you decide on next steps. This is not a casual friend; it is someone whose specific commitment is to be reachable in a crisis.
- The legal contact: a women’s-rights lawyer or civil-society legal-aid partner who you have already met and briefed, so that if you need to file a complaint or seek a restraining order, you are calling someone who already knows you.
- The mental-health contact: a counsellor, therapist, or trusted advisor whose role is your wellbeing rather than your campaign. Strategic clarity under attack comes from being emotionally regulated; the mental-health contact’s job is to help you stay so.
- The peer contact: another woman in Nigerian politics or civil society who has weathered something similar. The shared experience is, for many women, the most important single source of strength. Find her before you need her.
- The family contact: the family member who knows what you are doing and why, who will not panic, and whose role is to be the steady presence. If you have a partner or close family, this is usually them. Brief them in advance.
Build the circle in the months before the peak campaign window. Have one explicit conversation with each person about what their role would be. It is uncomfortable; the conversation is also one of the most valuable single things you can do for yourself in this period.
One thing to do this month
| Appoint your incident-response contact and brief them Identify the one person whose role is to pick up the phone when an attack lands. This is not the person you would call anyway for emotional support; this is the person whose specific commitment is to be reachable in the moment, help you think, hold your documentation folder, and share the load of consequential decisions. Sit down with them this month — not by text — and walk them through what the role involves. Share this article with them. Agree how you will contact them, what they will do first, and what you expect from each other. Ten minutes of preparation now saves hours of confusion in a crisis. |
Resources for this month
- Access Now Digital Security Helpline — accessnow.org/help — 24-hour multilingual response for civil-society and politically-active individuals; particularly strong for cases requiring technical security support.
- BBYDI Rapid Response Desk — brainbuilderedu@gmail.com — from November 2026, expanded response hours during the peak election period; for routing to consortium partners and civil society support.
- FIDA Nigeria — fidanigeria.org — free initial legal consultation; state chapters across the country.
- Mentally Aware Nigeria Initiative (MANI) — for mental-health support if the incident affects your wellbeing.
- BBYDI Digital Safety Toolkit — the full incident-response playbook (Section 6) with the printable quick-reference cards for the first 30 minutes of an incident; available on request.
| Coming in September Next month’s article walks through the escalation pathways in depth — how to work with the Nigerian Fact-Checkers’ Coalition, when to approach civil-society legal partners, when and how to engage with law enforcement, and when to bring in media. The what-to-do-after-24-hours companion to this month’s what-to-do-in-24-hours playbook. |
This explainer is part of the Strengthening Digital Integrity and Inclusive Participation for Nigeria 2027 project, implemented by Brain Builders Youth Development Initiative (BBYDI) and FactCheck Africa, with the support of the Digital Democracy Initiative (DDI) and CIVICUS. The series is distributed under a Creative Commons Attribution-NonCommercial 4.0 licence — please share, translate, and adapt, with credit.
To receive the series by email each month, write to brainbuilderedu@gmail.com with the subject line “Digital Safety Series Subscription.”
