Mission
Evidence-Led Digital Action
This task force supports cyber incident assessment, digital evidence handling, and investigative coordination where online harm intersects with humanitarian risk, institutional disruption, or transnational abuse.
Its work emphasizes defensible forensic workflows, rapid triage, and cross-border information support so partners can document incidents, protect affected populations, and strengthen accountability.
Capabilities
Core Operational Functions
Incident Triage
Rapid assessment of cyber incidents, compromise indicators, and immediate containment priorities for affected teams.
Digital Evidence
Structured preservation of logs, devices, and artifacts to support defensible forensic review and reporting.
Threat Mapping
Analysis of attack patterns, actor behavior, and infrastructure relationships across complex digital environments.
Field Forensics
Portable investigative support for austere or disrupted settings where secure evidence handling is critical.
Partner Support
Coordination with NGOs, institutions, and response teams to improve cyber readiness and investigative continuity.
Protection Planning
Recommendations that reduce exposure, strengthen response procedures, and protect sensitive operational data.