🧾 Checklist for Media Publishing in Authoritarian Systems

Check metadata: Before publishing, check all documents, images, and PDFs for EXIF/author data/sources and anonymize them if necessary.
Use secure communication channels: Signal, ProtonMail, Matrix, etc. No WhatsApp, no unencrypted email traffic.
VPN & TOR security before publication (also for team members).
Advertising
Secure access rights: Who is allowed to post/publish? Is compromised access dangerous?
Check whistleblower mechanism: Is the source securely protected? Is there an emergency chain in case someone gets caught?
Keep backups encrypted, ideally outside the affected jurisdiction.

Analysis of Local Laws: What is "anti-state propaganda," "fake news," "extremism," "espionage," and "defamation"? in the respective state?
Analyze the limits of freedom of expression: What is officially permitted, what is prosecuted in practice?
Check legal coverage: Are there local lawyers/human rights organizations that can provide support?
Avoid criminal terms/phrases: Especially with terms like "regime," "Dictatorship," "war" -> use code words instead of direct statements.

Source evaluation: Is the source credible? Are there multiple independent confirmations?
Is the fact check carried out internally? Also for emotional or political topics?
Narrative comparison: Is a state agenda being unintentionally served or is opposing propaganda being adopted?
Is the language de-emotionalized? As factual as possible to avoid "inflammatory language." to become vulnerable.
Transparency notice added? (“This publication reflects the opinion of the editorial team...”)
Satire indicated? If satirical means are used.

Mirror server active outside the censorship zone?
Offsite copies via CDN/Cloud (e.g. Iceland, Switzerland, Norway, Panama)?
Alternative platforms active? (Mastodon, IPFS, Onion sites)
Document cases for international press freedom (Reporters Without Borders, EFF, PEN)?

Anonymization of authors? Pseudonyms, collective editorial accounts instead of real names.
Separation of private and media accounts?
Raising team awareness of digital repression, phishing, Surveillance.
Emergency contact lists in case of arrest, search, or technical seizure.

Regularly reflect on publication ethics: What am I allowed to say? And what should I say?
Recognize propaganda traps: Avoid oversimplification, scapegoat rhetoric, and binary worldviews.
Self-protection through an "editorial code": Shared values, rules, and boundaries for the team and content.
Recognize and flag PsyOps/disinformation: Even with (supposedly) "Own" sources.

Keep an eye on comments & reactions: Risk escalation? Threats? Countermeasures.
Monitor for network effects / shadowbanning / censorship measures.
Create a backup of the publication (text, screenshot, HTML export).
Conduct internal debriefings: What was risky? What was successful? What can be improved?

Never directly call for violence – not even metaphorically (“send them to hell” etc.)
No clear identification of individual officials or institutions without a legal basis.
No publication of private information of third parties (“doxing”).
No statements that could be misunderstood as “treason” or “espionage” could be interpreted.
No reproduction of third-party propaganda without your own commentary or context.

If the situation becomes acute:

Immediately "shut down" social media accounts
Hosting in emergency mode (e.g., via maintenance page or load switch)
Inform contacts in encrypted form: "Don't fall for reactions"
Back up internal documentation - but physically separated from the online access