Despite steep losses suffered across Africa to cyber threats, spending towards the prevention of future cyber-attacks on the continent has not risen to meet the need for greater protection.
In October 2016, 1.5 million customers of Lonestar Cell MTN, a major local telecom service provider in Liberia, were unable to access network services. Internet connection was disconnected, leaving health providers, transportation, and financial institutions cut off from the network. Farmers were unable to check market updates and bank transactions repeatedly failed, which left businesses unable to fulfil demands and customers stranded. The country’s information minister, Eugene Nagbe, though in Paris at the time, attempted to remedy the situation but was unable to access his email or make any phone calls. As a last resort, he made an appeal on French radio, calling for international aid to resolve the issue.
Although service was eventually restored, what followed was an investigation and the apprehension of Daniel Kaye, a free agent British hacker, who claimed to have launched the attack at the behest of Cellcom, a rival company. The cyberattack, known as a Distributed Denial of Service or ‘DDoS’, would overwhelm Lonestar’s systems over a period of 6 months with requests until the network broke down.
AN OLD THREAT
Cyberattacks—any malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or information itself—have decimated large corporations and grounded even the most technologically capable countries. Unsurprisingly, African countries have faced prominent cyberthreats: as early as 1994, during South Africa’s decisive election, a hacker attempted to cause disruption by hacking into the election commission’s systems. While the attempted sabotage did not influence the final results, it significantly delayed the process.
Elsewhere, during the events leading up to the inauguration of Nigerian President Goodluck Jonathan in 2011, websites belonging to the National Poverty Eradication Programme and the Niger Delta Development Commission (NDDC) were hacked and defaced. A group called Niger Cyber Hacktivists claimed responsibility, citing the cost of the inauguration as motive for the attack. The NDDC was forced to shut down its website to stop the attack and repair damage done to its website. Additionally, in 2018, the National Bank of Kenya revealed that it had been the subject of an attempted cyberattack by fraudsters. While its systems were able to defend against the attack, the bank still lost Sh29 million (US$287,100 in 2018) to the fraudsters.
There are several attacks that are driven by political causes or that are crimes of opportunity, but the majority of these attacks are financially motivated, with financial institutions and corporate entities often being targets. Across the continent, these incidents are affecting both private and public entities due to weaknesses and flaws in their information systems.
Partly because of the COVID-19 pandemic (as organizations and businesses moved their operations online) such cyberattacks have been on the rise. Only a few businesses had the resources required to facilitate this digital transition, but the majority had to hastily set up and gradually adapt to running operations away from familiar and safe work environments.
As many companies suspended physical operations and opted to deliver business services virtually, newly remote workers had to rely on home systems and networks connected to the internet. This transition, while beneficial to workers and cost-effective for businesses, has increased the risk of cyberattack. Between 2020 and 2021 cyberattacks increased globally by 50 per cent. Figures estimate that 86 per cent of Nigerian companies surveyed were victims of cyberattacks in 2020, the highest percentage in Africa followed by South Africa with 61 per cent. The most common aim of these attacks is to mine as much data from users as possible by exploiting vulnerabilities in an organization’s system, the victims are often customers and clients. A ransomware attack on South African debt collector, Debt-IN, in September 2021 resulted in the theft of confidential information on 1.4 million customers and employees. The data stolen was subsequently published on the dark web.
Incidents such as these give insight into how frequently data is often stolen from large-scale businesses. They also highlight the real victims of these attacks: customers and clients who lose personal information to criminals and may bear the consequences of a breach long term.
THE CASE FOR CYBERSECURITY SPENDING
In 2021, according to Interpol’s 2021 African Cyberthreat Assessment Report, Africa lost over $4 billion to cyber risks. Despite the magnitude of the threat faced, the response has been constrained by the inadequate capacity of several African countries to defend against these threats due to limited resources. The inability to integrate cybersecurity protocols into often-outdated hardware such as firewalls and servers, and operating systems means a significant number of countries may not be equipped to withstand a largescale cybersecurity crisis.
Alarmingly, despite steep losses suffered on the continent, spending towards the prevention of future attacks has not risen to meet the need for greater protection. While some countries such as Ghana have resolved to address this by allocating dedicated budget lines to cybersecurity, others such as Botswana have not made such commitments. With the rapid evolution of technology, cybersecurity protocols and regulations, and without the financial resources to match, organizations and governments often find themselves playing catchup against a constantly revised playbook developed by bad actors.
The rising rate of cyberthreats has increased the need for higher cybersecurity spending. According to Cybersecurity Ventures, global spending on cybersecurity products and services is expected to hit to hit $1.75 trillion by 2025. This contrasts with a relatively conservative $280.5 billion spent between 2017 and 2021. This increased spending has become the ideal response to these threats as a significant number of companies see risks associated with cybersecurity as detrimental to their growth. However, this response has been more predominant in the West. According to a survey of 180 African Companies conducted by the Club of Information Security Experts in Africa between 2021 and 2022 1 in 2 companies felt unprepared to face a large-scale cyberattack.
The first step to preventing an attack is often the most basic. As such, one significant solution to preventing cybercrime, is educating the public. Most internet users are unaware of what red flags to look out for when faced with a phishing email or a suspicious website or link. Much of the support necessary to educate the public can only be provided by experts in the field. Reports indicate that there were less than 7,000 certified cyber security professionals in Africa in 2018. At an estimated rate of 1 cyber security expert to 177,000 people, this number sorely underserves the continent’s digital economy and its population. Bearing in mind that cybersecurity experts are in demand worldwide, with a global shortage of 2.72 million professionals, the shortfall in Africa raises concerns in comparison, for instance, with figures from Asia Pacific where there are 859,027 cybersecurity experts.
AFRICA’S REGULATORY RESPONSE TO CYBER ATTACKS
At present, the International Telecommunication Union ranks only five African countries (Ghana, Nigeria, Mauritius, Morocco, and Tanzania) as fairly achieving its most significant milestones necessary to defend against cyberattacks. Out of these countries, only Mauritius ranks in the Global Top 20. This low representation of African countries is attributable to the slow adoption of cybersecurity and data protection regulations.
Through its cybersecurity policies, Mauritius is a leader on the continent. Since 2018, Mauritius has maintained a strategy on cybersecurity developing an effective legal framework, sharing information, and creating awareness amongst other priorities. Ghana’s multi-sectoral strategy for cyber-governance also serves as a model for neighbouring countries and a few European countries including Ukraine. Ghana’s approach to cybersecurity incorporates two significant treaties concerning cybersecurity into its laws: the 2001 Budapest Convention on Cybercrime and the 2014 Malabo Convention seeking to harmonize cybersecurity law across the continent. Notwithstanding this resolve to address and provide the protections necessary in a cyber connected world, key differences in national legislation translate to potential difficulties in continent-wide enforcement. Countries who tow this line run the double risk of isolating their citizens and, by extension, their country by implementing internal policies which exclude other countries.
That said, several African countries are making progress. The Republic of Togo has signed a Memorandum of Understanding with the United Nations Economic Commission for Africa (UNECA) to build Africa’s first cybersecurity centre to promote cybersecurity and the investigation into cybercrimes. This move comes after the signing of the 2022 Lome Declaration, an undertaking by African Countries at the Cybersecurity Summit held in Lome in March 2022, to sign and ratify the Malabo Convention and implement legislation to fight against cybercrime.
Despite the urgent need for uniform regulation, countries must take care to not interfere with fundamental rights to privacy and freedom of expression. Experts argue that Zimbabwe’s present Cyber Security and Data Protection Act undermines human rights and gives security agencies powers to infringe on the rights of citizens. Specifically, the act is said to violate the country’s constitution by giving excessive surveillance powers to the police and its ministry of information. For human rights lawyers like Otto Saki, the act is being used as a cover to target and monitor journalists. In an increasingly technological world, a primary fear for many pressure groups and citizens is the manipulation of laws promoting data protection and cybersecurity.
The AU as the umbrella organization seeking to establish more uniform policies for African countries emphasizes the role of technology in driving that progress in its 2063 Agenda. On the continental level, agreements such as the African Union Convention on Cyber Security and Personal Data Protection aim to strengthen existing regulations on Information and Communication Technologies. Under Article 24, the Convention maps out a regional policy to be adopted by each member state as well as a strategy which involves, amongst others, public awareness, legislative reform, and the ‘effective management of cybersecurity incidents and international cooperation’. Adopted by the member states of the AU in 2014, only 10 countries have ratified the agreement so far, with some others opting to formulate legislation on cybersecurity without domesticating the Malabo Convention.
FIXING THE ISSUES
‘There are only two types of companies: those that have been hacked, and those that will be.’ —Robert Mueller
Admittedly, little can be done to avoid a cyberattack, and it is often not a matter of if an attack will happen, but of when one will happen. Moreover, as hackers continue to refine their methods, the risks further increase. This does not mean steps cannot be taken to mitigate the effects of an attack. While there are several commendable national strategies to curb the rapid increase in cyberattacks, a more cohesive approach led by intra-continental cooperation and sharing of resources is vital to addressing potential threats. Regional cooperation utilizes expert knowledge and skill from experts around the continent, while reducing the chances of criminals simply reoffending with the same tactics in a new country.
Commendable efforts have been made in acknowledging the need to address cyber issues through treaties and undertakings such as the Lome Declaration. However, these issues remain insignificant if countries on the continent do not follow proposals and strategies with tangible action.
Authorities must direct more consideration towards addressing the shortage of cybersecurity experts. More so, the dearth of talent and long-term solutions to retaining such talent within the continent is a challenge too big for public bodies to overcome alone. The private sector has a part to play. Ideally, government agencies should partner with private organizations to address this looming danger as private organizations are typically in a better position to provide resources both human and financial to identify and assist in responding to incidents.
Key to this training is ensuring that problems unique to the African cyber ecosystem are put in focus. This is a strategy which must be implemented continent-wide. A region better prepared to overcome these risks will find that the potential economic and social benefits of a clear strategy against cyberattacks are justifiable when weighed against the economic losses incurred due to these threats. Regulators and private businesses alike must realize that the risks of a possible cyberattack are not borne by a single country and to effectively combat it, regional cooperation through the exchange of knowledge and ideas must be considered the prime objective to achieve an effective solution in the fight to keep Africa secure⎈
The views, thoughts, and opinions published in The Republic belong solely to the author and are not necessarily the views of The Republic or its editors. We want to hear what you think about this article. Submit a letter to the editors by writing to [email protected].