Common Good Cyber Fund

Criteria breakdown

Red flags

• Fund targets public-interest cybersecurity nonprofits delivering operational services (DNS/routing, threat intel, incident response) — outside ETC's intervention-design wheelhouse.
• Operating grants conflict with ETC's constraint favoring applied research, prototyping, and researcher/staff time over general overhead.
• ETC is a university research collaboration, not a standalone cybersecurity nonprofit; eligibility and mission framing are a poor match.
• Applicant pool of specialized cyber-defense organizations makes ETC uncompetitive.

Key aspects to lead with

• Training and capacity building for high-risk actors

  The fund explicitly lists 'training' as a fundable activity and prioritizes protecting NGOs, journalists, and human-rights defenders — this is the one funded category where ETC has genuine, demonstrable capability (capacity building for nonprofits and public-interest technologists).

• Serving high-risk digital actors via anti-trafficking work

  ETC's technology-to-combat-human-trafficking focus area involves organizations and populations that are high-risk digital actors, giving a concrete, non-invented population and a credible 'direct services' angle the eligibility rules require.

• Community-centered design and stakeholder engagement

  Differentiates ETC from purely technical cybersecurity providers; the funder's 'technology for good' and human-rights framing rewards approaches grounded in the needs of the people being protected, not just infrastructure.

• Open-source tooling and published outputs

  Aligns with the Internet Society Foundation's ethos of shared public-interest infrastructure and the fund's 'common good' framing — ETC can commit to openly licensed training materials and threat-model templates that scale beyond the grant.

Suggested outline

1. 1
   Organizational overview and eligibility

   Confirm 501(c)(3) status and a bank account able to receive US foundation funds. Clearly frame ETC as a public-interest technology organization and state upfront which funded activity (training / protecting high-risk actors) you are delivering — do not overclaim infrastructure work.

2. 2
   Statement of need

   Document the digital-safety gap facing under-resourced NGOs, journalists, HRDs, and anti-trafficking organizations. Cite the mismatch between sophisticated threats these actors face and their limited security capacity — the layer ETC addresses.

3. 3
   Program design and activities

   Detail a concrete two-year workplan: threat-model assessments, tailored digital-safety training curricula, secure-tooling selection guidance, and open publication of methods. Be explicit that ETC delivers the human/organizational layer, partnering out or referring for infrastructure-level services (DNS/routing, incident response).

4. 4
   Target beneficiaries and reach

   Name the high-risk actor communities you will serve and how you will recruit them through existing ETC relationships in the anti-trafficking, arts, and nonprofit sectors. Give realistic numbers for a small senior team.

5. 5
   Team and organizational capacity

   Present the senior team honestly, emphasizing applied research, community engagement, and capacity-building track record. Address the bandwidth constraint by scoping deliverables tightly.

6. 6
   Budget and use of operating funds

   Allocate the two-year budget primarily to staff time for training delivery, assessments, and materials development — matching ETC's preference for funding applied work over overhead. Justify against the $100K–$300K range.

7. 7
   Sustainability and common-good contribution

   Explain how open-licensed curricula and templates create lasting public value beyond the grant, and how capacity-building support from the fund would help institutionalize the program.

Gaps to shore up

• Core capability gap: ETC does not provide cybersecurity infrastructure (DNS/routing, threat intel, incident response); the proposal must credibly narrow to training/capacity building or the application risks being scored out of scope.
• This is a two-year OPERATING grant that 'expects an established program' — ETC has not run a standing digital-safety program, so reviewers may see this as a new initiative rather than an established one; consider whether prior related work can be reframed as an existing program or whether a partner lead is wiser.
• Eligibility hinges on providing 'cybersecurity infrastructure and/or direct services for high-risk digital actors' — ETC must demonstrate concrete direct-service delivery, not just research, or risk being deemed ineligible.
• Tight deadline (4 August 2026) against ETC's limited grant-writing bandwidth — assess whether the ~15% win probability justifies the effort, or whether partnering with an established cyber provider (e.g., via Global Cyber Alliance network) as a training subcontractor is a higher-ROI path.
• Thin direct evidence: ETC should confirm it has demonstrable digital-safety training deliverables or case examples before committing; if none exist, this is a weak fit for an operating grant.