Anyone who speaks for your organisation online, whether director, campaigner, spokesperson or fundraiser, will at some point get hostile replies. Usually it stays at unpleasant comments. Occasionally it escalates to threats, or to someone publishing a colleague's home address. As an employer you have a duty of care here: the Arbowet counts aggression and intimidation as a psychosocial risk you must manage. A short plan agreed in advance is the difference between a tiring week and a crisis.
This article runs from basics to serious cases. Most organisations only ever need the first two levels.
Level 0: Prevention
Do this once, ideally when someone takes on a public role.
- Know who is public-facing in your team. Ask them to close the most common gaps in their personal exposure:
- Use an authenticator app or passkey for MFA, not SMS. SMS codes can be intercepted and phished. Your password manager can generate the codes.
- Search yourself. Look up your name in a private browser window and check what comes up for your home address, phone number and family. Remove what you can: old profiles, people-search sites, forgotten accounts.
- Review your personal social media. Turn off location tagging. Don't post your street, front door, license plate or children's names. Set unused profiles to private, or delete them.
- Turn off message previews on your phone's lock screen. If you can read it without unlocking, so can anyone next to you.
- Use Signal for sensitive conversations. End-to-end encrypted, and disappearing messages mean there is less to leak later.
- Use the office address wherever a public record or registration asks for one, never a home address.
- Agree one contact person for incidents. This is usually the same person who is your reporting point for security incidents.
Level 1: Unpleasant comments
- Don't argue back. Take a screenshot with date and URL, then mute, block or report the account on the platform.
- Tell the contact person, even if it feels minor. The manager checks in with the colleague: being targeted is tiring even when it is "just words".
- For public webinars and livestreams: require registration, use a waiting room, and let only hosts share screen or unmute others.
Level 2: Targeted and persistent, or personal details published
- One person owns the response. The colleague being targeted does not have to handle it alone.
- Keep an incident log: date, platform, what was said, screenshot. You will need it for the police and the platform.
- File a police report (aangifte). Threats, defamation and publishing someone's personal data to intimidate them (doxing) are criminal offences in the Netherlands.
- Ask the platform or website host to remove the content, using the log.
- Pause the colleague's public posting for a while. Check the privacy settings and MFA on their personal accounts, not just the work ones.
- Brief the team in a few sentences, so nobody unwittingly gives out information to a caller who claims to be a journalist.
- Offer support: the Confidential adviser (vertrouwenspersoon) , the bedrijfsarts, and Slachtofferhulp Nederland (free).
Level 3: Threats to someone's safety
- Call 112 if there is an immediate threat. Otherwise file a report with the full log.
- Let the colleague work from another location for a period, and decide whether planned public events go ahead.
- Get legal advice, and keep the board informed.
If it gets serious
Most organisations never pass level 1. If you do, Moral Fabric can connect you with specialists: digital security hotlines, lawyers experienced in online harassment, and psychosocial support. Contact your Moral Fabric lead.