Cybersecurity and cybercrime in Africa: Continental and regional policies

Cybersecurity and cybercrime are also tackled in several initiatives at the level of the African Union (AU) and regional economic communities (RECs). At the core of AU’s cybersecurity initiatives lies the 2014 Convention on Cyber Security and Personal Data Protection (Malabo Convention). Several RECs have developed strategies, policies, or model laws on cybersecurity, critical infrastructure protection, and cybercrime. Some of these policies and strategies include elements of foreign policy.

Read full report Stronger digital voices from Africa: Building African digital foreign policy and diplomacy.

Twiter Facebook LinkedIn

Cybersecurity features as a flagship programme under the African Union’s (AU’s) Agenda 2063, as ‘a clear indication that Africa needs to not only incorporate in its development plans the rapid changes brought about by emerging technologies, but also to ensure that these technologies are used for the benefit of African individuals, institutions or nation states by ensuring data protection and safety online’.¹

Cybersecurity and cybercrime are also given a prominent place in AU’s Digital Transformation Strategy, which includes several policy recommendations and proposed actions in these two areas. While most of them are related to strengthening cybersecurity at the national and continental level, there are also a few elements related to international processes. One recommendation is for the AU and its member states to ‘support the UN-led process for the establishment of the Global Cybersecurity Framework under the UN’.²

In 2018, the AU decided to establish a Cybersecurity Expert Group (AUCSEG) tasked with advising the AUC and policymakers on cybersecurity-related issues. The group, which started working in 2019, is also expected to support the AUC and member states on matters of international cooperation regarding cybersecurity, personal data protection, and combating cybercrime.³

At the core of AU’s cybersecurity initiatives lies the 2014 Convention on Cyber Security and Personal Data Protection (Malabo Convention). The instrument covers more than cybersecurity and cybercrime and includes provisions on electronic transactions and personal data protection. This gives the Malabo Convention a unique and innovative character among cybersecurity-related regulations and policies. It is, however, also the reason for some of the challenges regarding its ratification.

The convention contains several provisions related to international cooperation. It encourages state parties to conclude agreements on mutual legal assistance in dealing with cybercrime and to enable the exchange of information on cyberthreats and vulnerability assessments through institutions such as computer emergency response teams (CERTs). Countries are also mandated to use international cooperation mechanisms – be they based on private or public partnerships – when it comes to responding to cyberthreats, improving cybersecurity, and stimulating multistakeholder dialogue.

The convention has not come into effect yet. Out of 55 AU members, 14 have signed the convention, and 13 ratified it and deposited instruments of ratification with the AU (as of March 2022).⁴ This falls short of the 15 instruments of ratification required for the convention to come into force.

Some observers underscore the fact that the Malabo Convention is an important instrument supporting continental e-commerce and urgently needs to be ratified, while others warn against over-regulation.⁵ While the convention is significant given its scope, this lack of ratification takes away from its potential impact.⁶ This rather slow pace of ratification may be explained by multiple reasons: from political ones (rooted in the region’s political, cultural, and historical diversity),⁷ to lengthy processes within countries, limited awareness among policymakers on the importance of cybersecurity and its relevance for national security, and limited capacity within the countries to take up and conclude the necessary processes.⁸ It remains to be seen whether countries will overcome these and other challenges and follow up on the commitment they have taken at the March 2022 Cybersecurity Summit to sign and ratify the convention as an important step towards the ‘development of a safe African cyberspace’.⁹

There is an overlap in membership between the Malabo and Budapest Conventions. The Budapest Convention is the Convention on Cybercrime of the Council of Europe, and it focuses on defining cybercrime, related legal provisions, and cross-border cooperation. Twelve African countries are parties, signatories, or have been invited to accede to the Budapest Convention: Cabo Verde, Ghana, Mauritius, Morocco, Nigeria, and Senegal are parties to the convention; South Africa signed the convention; while Benin, Burkina Faso, Côte d’Ivoire, Niger, and Tunisia were invited to accede.¹⁰ Of these countries, Cabo Verde, Ghana, Mauritius, and Senegal have signed or ratified both the Malabo and the Budapest Conventions (Figure 38).

Figure 38. Malabo Convention and Budapest Convention across Africa (October 2022).

In August 2022, UN Economic Commission for Africa and the Republic of Togo announced an agreement to jointly establish the African Center for Coordination and Research in Cybersecurity. The centre, to be based in Lomé, is intended as a regional hub for cybersecurity information and intelligence and to contribute to building capacities and frameworks at a national and regional level for assessing and mitigating cyberthreats.¹¹

AU Peace and Security Council

Cybersecurity issues are also addressed by the AU Peace and Security Council (PSC). For instance, in May 2019, at a meeting on mitigating the threats of cybersecurity to peace and security in Africa, the PSC encouraged AU member states to ‘enhance national, regional and continental harmonisation, among others, through harmonising and updating national cybersecurity strategies, cybersecurity emergency responses and policies’.¹² In August 2022, at a meeting on emerging technologies and new media, the PSC noted the importance of having the ‘AU Commission and the member states develop a strategic approach to implement the UN norms on responsible state behaviour in cyberspace at regional and continental levels’.¹³

Regional economic communities (RECs) have also initiated various cybersecurity-related policies and programmes. In 2021, the Economic Commission of West African States (ECOWAS) adopted its Regional Cybersecurity and Cybercrime Strategy, outlining actions to be taken in particular at national level to strengthen cybersecurity and fight cybercrime (e.g. adoption of national cybersecurity strategies, establishing dedicated authorities, prioritising cybersecurity efforts in the area of critical infrastructures and essential services, enhancing cybersecurity skills development, and building capacity against cybercrime). When it comes to foreign policy issues, member states and the ECOWAS Commission are invited to promote and develop regional and international cooperation through actions such as sharing alerts and cybersecurity information (in particular between CERTs and similar institutions) and ensuring international judicial cooperation on cybercrime and transnational access to digital evidence.¹⁴

ECOWAS’s Regional Critical Infrastructure Protection Policy proposes preventive, reactive, and proactive measures that countries could take to ensure the protection of their critical infrastructures and essential services. Noting that there are ‘interdependencies between countries’ in relation to telecommunication networks, internet connectivity, and other infrastructure and services, the policy calls on countries to cooperate in identifying transitional critical infrastructures and essential services, exchange information on threats and risks, and harmonise protection measures.¹⁵

ECOWAS also has a Cybercrime Directive (adopted in 2011); its objective is to ensure that the criminal law and criminal procedures of ECOWAS member states are adequately equipped to address cybercrime.¹⁶

The East African Community’s (EAC’s) Model ICT Policy Framework from 2015 encourages member states to establish mechanisms for regional and international cooperation on cybersecurity.

Several RECs have adopted model laws and/or policies on cybercrime and cybersecurity. COMESA has a Cyber Crime Model Bill (2011),¹⁷ as well as a model policy, a model bill, and an implementation roadmap for cybersecurity. ECCAS¹⁸ has a model law on cybersecurity, while SADC has a Model Law on Computer Crime and Cybercrime (2012).¹⁹

Across the continent, cybersecurity and cybercrime issues are also addressed within several other settings:

AfricaCERT. Focused on assisting African CERTs in improving cyber readiness and enhancing the resilience of ICT infrastructures, and fostering regional and international cooperation on related issues, the forum includes CERTs and CIRTs from 26 African countries; Côte d’Ivoire, Ghana, Kenya, Nigeria, Rwanda, and South Africa are among them.
African Union Mechanism for Police Cooperation (AFRIPOL). Dedicated to fostering police cooperation at the continental level, AFRIPOL has among its objectives the development and implementation of a harmonised African approach to fight against cybercrime. To this aim, a strategy for the period 2020–2024 outlines four strategic priorities related to strengthening the capacity of AFRIPOL’s and member states’ cybercrime teams, developing harmonious and coherent regulation, and ensuring constant threat assessment. The strategy also envisions the strengthening of cooperation frameworks at regional, continental, and international levels, participation in international bodies such as the International Telecommunication Union (ITU) and the Internet Corporation for Assigned Names and Numbers (ICANN), and coordination on fighting cybercrime with bodies such as Interpol, the UN Office on Drugs and Crime (UNODC), and Europol.
African Capacity Building Foundation (ACBF). Advancing cybersecurity culture and skills and building capacities related to the development and implementation of cybersecurity policies are among the topics tackled by this AU specialised agency for capacity development.
Several civil society organisations that work on raising awareness and building capacities on issues related to cybercrime, child online protection, and online safety and security. Examples include the Africa Cybersecurity and Digital Rights Organisation and the African Civil Society on the Information Society.