Here is the content summarized and humanized into six paragraphs, roughly 2000 words, in a direct, practical voice.
—
Digital safety advice usually starts with locks: strong passwords, two-factor authentication, encryption, and all the other ways to keep people out. But what happens when someone gets through? What happens when the attack actually arrives — the fake account, the manipulated screenshot, the coordinated pile-on, the lie that starts spreading through WhatsApp groups before you have even finished reading it? This is where documentation becomes the single most undervalued skill in digital defence, and it is the subject of this third guide in the digital safety series from BBYDI and FactCheck Africa, prepared with women in Nigerian politics in mind. The previous articles laid out the threat landscape and the account-hardening steps that close most attack vectors. This one is about the moment the threats become real. Most women in public life already know to take screenshots. That is not enough. A screenshot alone rarely survives the journey from your phone to a platform reviewer, a fact-checker, or a court. What matters is a structured practice: a way of capturing, archiving, and logging evidence that is consistent enough to be trusted, organised enough to be acted on, and robust enough to withstand the inevitable attempts to dismiss or delete it. The good news is that this does not require special training or hours of daily labour. With about an hour of setup work, you can build a documentation habit that quietly runs in the background of your political career — and when something ugly happens, you will be the one holding the proof, not the one scrambling to explain why you did not keep it.
Why does documentation matter more than it feels like it should? There are five reasons, and they compound. The first is that evidence disappears. Attackers delete posts when they realise they have been noticed. Platforms remove content under moderation rules. Accounts are suspended, renamed, or repurposed. URLs change without warning. If you wait until you need the evidence to try to collect it, you may find that the thing you wanted to capture has simply vanished, along with any chance of recourse. The second reason is that verification requires evidence. Fact-checkers cannot verify a claim from your description of it; they need to see the original. Platforms cannot review content from a description either. Every referral, every complaint, every request for action begins with something you captured at the time. The third reason is that patterns only become visible through accumulation. A single nasty post can be written off as an unfortunate incident. But a series of documented attacks, collected over weeks and months, tells a different story. That pattern is what convinces civil-society partners to push for systemic platform response, what helps journalists cover coordination rather than isolated episodes, and what allows funders and international bodies to recognise a broader phenomenon. The fourth reason is the Liar’s Dividend. When perpetrators are caught, they often claim the evidence is fabricated, AI-generated, or manipulated. The only defence against that is provenance: time-stamped, metadata-preserved, chain-of-custody-documented capture from the very first moment the content appeared. You have to build that defence before the argument begins, not after. If you wait until your evidence is challenged, you have already lost. The fifth reason is more personal. Documentation is empowering. One of the most demoralising parts of sustained harassment is the feeling that things are happening to you and you have no record of them happening. When you document, you shift from being someone who is acted upon to someone who holds the evidence. Women who have weathered attacks well consistently describe this psychological shift as making a real difference. It is not a small thing. It is the difference between feeling like a victim and feeling like a witness.
The practical method has three components: capture, archive, and log. They must be done in that order, and they must be done quickly. Capture is the first response to any significant incident. For a post, that means a full-screen screenshot with the platform interface visible so the platform is identifiable; a screenshot of the author’s profile page so the account is identifiable; a screenshot of visible engagement metrics like likes, shares, comments, and views; the URL copied as plain text; and, if the content is video or audio, a screen recording of it playing. If the content is a thread, screenshot the whole thread, not just the offending post. Move fast. Attackers often delete content within minutes of realising they have been noticed, especially when the target starts screenshotting. The window between attack and disappearance can be shockingly short. Archive is the second step. Web-archive services preserve content at a specific moment in time, independent of whether the original is later removed. The two that matter most are the Wayback Machine at web.archive.org, where you click “Save Page Now” and paste the URL, and archive.today, also known as archive.ph, which is useful as a second copy because the Wayback Machine sometimes cannot save pages from social-media platforms with anti-scraping measures. The archived snapshot is often more authoritative than a screenshot because it is harder to manipulate and independently verifiable by anyone. Archive every significant piece of content within the first 48 hours of capture. That is not overcautious. During a Nigerian election cycle, platform-moderation churn is fast, and content archived a week later is routinely gone. Log is the third component. Maintain a running log of every incident in a simple spreadsheet. Each entry should include the date and time you first saw the content; the date and time it was posted where visible; the platform; the account that posted it, including handle, display name, and follower count; the URL; the web-archive URL; file paths to your local screenshots and recordings; a brief description in your own words of what the content is and why you are logging it; and a severity rating from one to five, along with any immediate action you took. The point is consistency. The same fields, the same place, every time. Scattered notes across different documents do not allow patterns to emerge. A single spreadsheet, maintained every time, turns a pile of incidents into a story.
Two concepts from forensic practice determine how seriously outsiders take your documentation: timestamping and chain of custody. A timestamp is proof that content existed at a particular moment. Three timestamps matter. The platform timestamp records when the content was posted and is usually preserved in archive captures. Your capture timestamp records when you took the screenshot and is recorded automatically by your device. The web-archive timestamp comes from the third-party service that saved the page and is the most independently verifiable of all. When authenticity is later contested, the convergence of these three timestamps is far stronger than any single one in isolation. Chain of custody is the documented record of who has handled the evidence between capture and presentation. In digital documentation, the principles are simple. Keep originals in a write-once location that you do not edit. Make edits and annotations on copies, never on originals. Record every time evidence is shared, with whom, and for what purpose. For most day-to-day documentation, this does not need to be more rigorous than “originals here, copies for sharing there, log of who got what.” For legal proceedings it becomes more demanding, and a legal-aid partner can guide you through the additional steps. Related to this is the two-copy principle. For every piece of documented content, keep two copies. The evidentiary copy has full metadata and lives in your write-once archive. The sharing copy has sensitive metadata stripped and is used for any public or external sharing. This matters because modern phones embed information in every photograph and screenshot: your location, your device, your movements. If you share a raw screenshot publicly, you may inadvertently reveal where you were and what you were using. The sharing copy protects you without weakening your evidence. The evidentiary copy is the one that matters if authenticity is challenged. These protocols do not need to dominate your life. They are habits, built in advance, that make the difference between evidence that is dismissed and evidence that holds.
Fact-checkers can be powerful allies against disinformation, but they are not investigators you hand a vague complaint to. They need a documentation package. If you want a fact-checker to debunk a claim about you, give them the specific claim expressed as a single factual assertion; the URLs and archive URLs where the claim appears; your evidence that the claim is false, whether documents, photographs, witness statements, or official records; your clear consent for the verdict to be published, with clarity about what personal information can be referenced; and an honest assessment of urgency, because an upcoming event or escalating threat may require faster verification. The smoother the handoff, the faster the verdict. Nigerian fact-checking organisations are members of the Nigerian Fact-Checkers’ Coalition, including Dubawa, FactCheck Africa, AFP Fact Check, TheCable Fact-Check, Nigerian Democratic Report, PRNigeria CableCheck, CDDFactCheck, and FactCheckHub. Any of them can act on a well-documented submission. For a serious incident — one significant enough that you might bring it to a fact-checker, a lawyer, a journalist, or law enforcement — assemble a single documentation file. It should contain a cover note in your own words, three to five sentences describing the incident and why it matters; all screenshots ordered chronologically and labelled; any screen recordings as separate video files; a text file with the URLs of the original content; a text file with the URLs of the web-archive captures; any related communications you have had about the incident, such as emails from supporters, platform reporting confirmations, or correspondence with civil-society partners; and your incident log entry exported as a single-page PDF or text file. Compress the whole thing into a single zipped folder, name it with the date and platform, for example “2026-11-15_Facebook_impersonation,” and store it in your write-once archive. When you need to share it, share the whole folder rather than piece by piece. This preserves the integrity of the package and makes it easier for the recipient to assess. It also sends a signal: you are organised, you are serious, and your evidence is not a random collection of screenshots.
The best way to build this discipline is not to wait for an attack. Do one thing this month: run a documentation drill on an ordinary post. Pick any recent post on your public account — one of your own, if you like. Screenshot it, archive it on the Wayback Machine, and enter it into your log. The whole exercise should take under ten minutes. The first time will feel slow and slightly silly. The second time will be faster. By the third time, the muscle memory will be there. When a real incident lands — and one likely will — the process will run automatically rather than requiring you to remember each step under stress. The drill matters not because the ordinary post needs documenting, but because the discipline needs to exist before it is tested. Keep your tools handy: the Wayback Machine at web.archive.org, archive.today as a backup, the Nigerian Fact-Checkers’ Coalition for professional verification, and the BBYDI Rapid Response Desk at [email protected] for routing documented incidents to the appropriate consortium partner. From November 2026, response hours will be expanded for the peak election period. A full BBYDI Digital Safety Toolkit, including documentation templates and step-by-step protocols, is also available on request. Next month, this series will walk through the first 24 hours when an attack lands: what to do in the first five minutes, when to call whom, and the three things never to do in the first hour that make almost every situation worse. This explainer is part of the Strengthening Digital Integrity and Inclusive Participation for Nigeria 2027 project, implemented by Brain Builders Youth Development Initiative and FactCheck Africa, with support from the Digital Democracy Initiative and CIVICUS. It is distributed under a Creative Commons Attribution-NonCommercial 4.0 licence, so please share, translate, and adapt it, with credit. To receive the series by email each month, write to [email protected] with the subject line “Digital Safety Series Subscription.” The point of all of this is not to live in fear. It is to live in readiness. Documentation is how you make sure that when someone tries to rewrite what happened to you, you have the receipts to tell the truth.