Why these standards matter in practice
Documenting CRSV and SGBV – whether online or offline – is not simply a technical exercise. It demands rigorous, deliberate steps to ensure that investigations do not amplify harm. Even with strong guidance, it is hard for investigators to absorb long, detailed protocols and apply them flawlessly every time. This work is challenging, nuanced, and an ongoing process of learning and adaptation.
At CIR, our SGBV Safeguarding & Working Protocols outline the minimum standards we aim to meet for safe, ethical, and effective investigations. They draw on international best practice and standards, including the Berkeley Protocol and, more recently, the Murad Code. But written guidance alone is not enough. One of our key lessons learned is that protocols must be lived, revisited, tested, and continually reinforced within teams – not treated as static documents.
Below, we reflect on the considerations shaping our CRSV investigations – including the ongoing challenges we face, the lessons we’re learning, and how we’re working to integrate the Murad Code more deeply into our processes.
Pre-planning: laying the groundwork for safe investigations
- Ask: Should this investigation be carried out at all?
The Murad Code’s first principle is unequivocal: “Add value, or don’t do it.”
We’ve found that OSINT tends to be most valuable in CRSV investigations when it complements other sources of evidence. It is rare for us to come across, for example, footage showing CSRV being committed. However, we have been able to use remote sources including social media footage and satellite data to monitor locations, such as detention sites which had been identified by survivors as centres for CSRV. Next, we can work to identify and document the presence of units and commanders who could be held responsible for those crimes.
Before any project begins, CIR team members must outline:
- why the investigation is necessary
- what our value add is
- its potential benefit for survivors or at-risk groups
- whether another organisation is better placed to conduct the work
After these questions are answered, our investigators then fill in a ‘Terms of Reference’ form to define objectives, data collection parameters, skills and expertise needed in the investigation team and try to identify the risks and mitigations.
- Understand the landscape
We added recommended extra steps to our research processes based on the Open-Source Practitioners Guide, like expanded information environment mapping and bias challenge sessions. But creating time for busy teams working in fast-moving environments to complete all the steps remains a challenge, and something we are prioritising.
A thorough assessment of the information environment helps us avoid unsafe assumptions regarding:
- how survivors communicate
- how perpetrators operate
- cultural, social, and legal contexts
- censorship and digital surveillance risks
- biases introduced by our own identities or research choices
This ensures that methods are contextually appropriate, safe, and culturally informed.
- Build the right team
Only trained, senior, or specialist investigators should handle SGBV-related material, and exposure to traumatic content must be limited to what is genuinely necessary. Researchers with contextual insight and language skills are essential to understanding cultural and linguistic nuance and risks involved with investigations, identifying what is relevant and understanding what it means.
- Take a trauma-informed approach
This includes:
- using sensitive and non-graphic language
- avoiding unnecessary detail
- providing mental health support for researchers
- scheduling regular welfare check-ins
Trauma-informed practice protects both survivors and investigators.
Managing sensitive data: Protecting survivors at every stage
Think about the use case before you collect the data
For us, that has generally meant identifying and speaking to those institutions – whether it’s the UN, national officials or local NGOs – who are already reporting or working on CSRV issues, understanding where the evidence gaps are that can be potentially addressed through OSINT, and setting up secure data sharing pathways to pass data over to them to be used appropriately.
Strict data segregation and controlled access
SGBV-related material carries heightened risk. We store such data in restricted-access locations, ensuring that only essential team members can view it.
Do Not Touch high-risk materials
We have a “Do Not Touch” protocol in place to protect researchers if they come across illegal content, such as potential child abuse content, in the course of the investigation, with a process for reporting domains to the appropriate authorities.
A presumption against publication
CIR does not publish SGBV-related data unless there is a compelling, survivor-centred justification. Even then, publication is rare, carefully scrutinised, and typically done in partnership with specialist organisations.
Clear limitations on receiving data
We do not:
- request or solicit survivor testimony
- accept medical or legal case files
- collect personal data of survivors without explicit justification
- contact survivors directly, except in rare, carefully managed TFGBV cases with strict safeguards
These restrictions minimise the risk of collecting dangerously sensitive material.
Ethical partnerships: Ensuring survivors are not placed at further risk
We collaborate only with partners who uphold survivor-centred practice
Where possible, we work with partners on the ground to support joint investigations and knowledge sharing. But it’s important to be careful in choosing partners, and we’ve adapted our due diligence and partnership arrangements to make sure we’re working with organisations who’ve got the experience, expertise and systems in place to do this work in line with the standards set out in the Murad Code.
Due diligence includes assessing whether partners:
- have effective safeguarding policies
- conduct gender-sensitive interviews
- ensure meaningful consent
- manage data securely
- have referral pathways for psychosocial, medical, or legal support
CIR never asks partners to collect testimony on our behalf.
Clear data-sharing agreements
We also developed detailed data-sharing agreements to protect survivors. Our agreements define:
- what data may be shared
- what must never be shared
- anonymisation requirements
- how data will be stored, accessed, and used
This prevents transmission of sensitive information, such as audio or video testimony, where it is not required for our work to add value. .
Knowing our place in the ecosystem
We realised that we can help organisations with digital security, information systems and in using OSINT methods to complement existing information gathering methods. But we don’t have the expertise or resources to support direct work with survivors, be that interviewing or service provision, or preparing legal case files. It’s essential to be clear on our own limitations, to ourselves and to others.
Conclusion: Strengthening the field together
As digital investigations evolve, so must the ethical standards that guide them. The Open-Source Practitioners Guide to the Murad Code is a landmark moment in aligning global OSINT practice around survivor-centred, trauma-informed, and ethically rigorous approaches.
