You can deal with security incidents in three basic steps:

1. Register them. Every security incident noticed by a defender must be registered, either in a simple, personal notebook or one accessible to the whole group.

2. Analyse them. All registered security incidents should be properly analysed straight away or on a regular basis. It is better to analyse them as a team rather than individually because this minimises the risk of missing something. Someone should be put in charge of making sure this is done. Decisions must also be made about whether or not to maintain confidentiality about specific incidents (such as threats). Is it ethical and realistic to keep a threat hidden from colleagues and other people you work with? No single rule applies to every situation, but it is often best to be as open as possible in terms of sharing information and addressing logistical concerns, as well as fears.

3. React to them. Given that security incidents give feedback on the impact of your work, they could lead to the following:

• Reaction to the incident itself;
• Feedback, in security terms, about how you work, your work plans or your work strategy.

Example of an incident which provides feedback on working more securely:

For the third time somebody from your organisation has had problems passing through a police checkpoint because they frequently forget to carry the necessary documents. You therefore decide to compile a checklist which all staff members must consult before leaving the city. You might also change the route for these types of journeys.

Example of an incident providing feedback on how you plan for security:

At the same police checkpoint, you are detained for half an hour and told that your work is poorly regarded. Thinly veiled threats are made. When you ask for an explanation at police headquarters, the scene is repeated. You call a team meeting to revise your work plans, because it seems clear that changes have to be made in order to continue working. You then plan a series of meetings with Interior Ministry civil servants, change some aspects of your plans and arrange weekly meetings to monitor the situation.

Example of an incident which provides feedback for your security strategy:

When you start work as defenders in a new area, you immediately receive death threats and one of your colleagues is physically assaulted. You did not anticipate such opposition to your work, nor provide for it in your global strategy. You will therefore have to change your strategy in order to develop tolerance of your work locally and deter further attacks and threats. To do this you may have to suspend your work for a while, withdraw from the area and reconsider the entire project.