By Waithera Wambugu
Introduction.
According to the International Telecommunications Union, digitization across the world heightened at the onset of the COVID-19 pandemic as a result of increased use of virtual workspaces, online marketplaces and e-governments. As much as this presented opportunities to remodel economies and modernize the public service delivery, it also escalated the exposure to cybercrime as cybercriminals exploited this opportunity to attack vital digital infrastructure. African countries’ dawdling digital capacity positioned the continent as an ideal target for cybercriminals.
Cyberattacks Across Africa.
In June 2020, the Ethiopian Information Network Security Agency routed a cyberattack from the Egyptian Cyber_Horus Group. The attack was intended to create significant economic, psychological, and political pressure on Ethiopia over the filling of the Nile River’s Grand Ethiopian Renaissance Dam. Though the Ethiopian authorities claimed to have warded off a broader attack, the hackers managed to access government web pages, posting messages threatening war if Ethiopia began filling the dam. Also in June 2020, the second-largest hospital operator in South Africa was hit by a cyber-attack in the midst of the COVID-19 outbreak, paralyzing them and forcing them to switch to manual back-up systems. In October 2020, Uganda’s telecoms and banking sectors were thrust into crisis due to a major system hack that compromised the country’s mobile money network whose usage had remarkably increased during the pandemic. The hackers stole at least $3.2 million by gaining access to around 2,000 mobile SIM cards and their mobile money payment systems.
The Corresponding Response from African Countries and the AU.
In light of the increased attacks, institutions such as the Central Bank of Nigeria and national cyber-response organizations in Tunisia, Morocco, and Kenya reverberated the alarm to their businesses and citizens, urging them to bolster their cyber security measures. The African Union, as part of its “Agenda 2063” for transforming Africa, also identified cybersecurity as a key priority to ensure that emerging technologies are used for the benefit of African individuals, institutions, and nation-states and to guarantee data protection and safety online. The agenda is guided by the African Union Convention on Cyber Security and Personal Data Protection (Malabo Convention), whose purpose is to establish a “credible framework for cybersecurity in Africa through organization of electronic transactions, protection of personal data, promotion of cyber security, e-governance and combating cybercrime.”
CyberSecurity Best Practices in Africa; A Case Study of Mauritius.
Mauritius is one of the eight African countries to have ratified the Malabo Convention, with which their Computer Misuse and Cybercrime Act is aligned, along with the Budapest Convention on Cyber Crime. The country is often cited as a reference on the continent in terms of cyber capacity, because of its legal and technical infrastructure, its national cybersecurity agency, its national training and awareness initiatives, and the involvement of public and private actors in these efforts. Mauritius ranks first among African countries and 14th globally, in the most recent International Telecommunications Union global cybersecurity index report. They have set up a National Disaster Cybersecurity and Cybercrime Committee that includes both public and private sectors and facilitates the monitoring, control, and transmission of decisions during cyber crisis situations. They have also built a centralized portal to report cyber incidents and a security operations center to detect and monitor malicious traffic in real-time to enhance the country’s cyber threat preparedness.
Despite Mauritius’s success in curbing cyber crimes, only 13 African Countries have completed national cybersecurity strategies which lay out strategic objectives and assign government-wide responsibilities for cyber threat monitoring and response. According to the UNODC Strategic Vision for Africa 2030, many states across Africa still lack a dedicated public cybersecurity strategy to monitor threats, collect digital forensic evidence and prosecute digital-based crimes because of the economic strain caused by the ongoing pandemic. African governments can strengthen their national cyber-response plans through the establishment of well-resourced and fully functional regional and national Cyber Emergency Response Teams. They must perform regular drills to assess plans and improve the cyber emergency response teams, for example by participating in the national or regional cyber-drills carried out by the International Telecommunication Union.
Recommendations for Improved Cybersecurity Measures in Africa.
- Build Capacity to Combat Cyberattacks. Cybersecurity capacity building provides the basis for countries to both improve their digital economies and boost their resilience against cyber threats. African Institutions and states should inaugurate these global cybersecurity capacity initiatives that include the Global Cyber Security Center, the Global Forum on Cyber Expertise, and the International Telecommunication Union with the global cybersecurity index. These initiatives will consequently promote international cooperation, which is key to global and national cybersecurity. Additionally, they will provide a benchmark and reference for governments building their national cybersecurity policies and strategies. There are several frameworks available for capacity building initiatives, with the cybersecurity capacity maturity model from the global cyber security capacity centre being the most comprehensive one. This model suggests that the five following dimensions are crucial to building a country’s cybersecurity capacity: policy and strategy, culture and society, education and training, legal and cooperation, standards and technologies. Capacity building is a long-term objective that states need to plan well, resource adequately, and monitor regularly in order to achieve efficiently. Greater state capacity enables better policy and cybersecurity implementation.
- Delineate cybersecurity policies and resources. According to the African Centre for Strategic Studies, in order to foster resilience and strengthen cybersecurity, African governments should additionally delineate medium and long-term cybersecurity policies and strategies that consolidate cybersecurity into government initiatives and that state the resources required to achieve them. These policies and strategies should describe what immediate nation-wide actions governments would take, as well as digital fall-back alternatives, to ensure that governments and organizations would still be able to operate even with a sudden loss of digital tools and networks. National and regional stakeholders should be involved in the response plan and take into account African nations’ cybersecurity maturity and capability levels, in order to adapt the responses to the local contexts and to available financial, human, and technology resources.
- Promote a responsible cybersecurity culture. National actors must also promote a responsible societal cybersecurity culture to subsequently strengthen the confidence of citizens and organizations in the cyber economy, digital services, and the broader internet. They must set up awareness-raising and training programs in cybersecurity for the public, private, academic, and civil society sectors to equip Africans with the skills and knowledge necessary to respond to cybersecurity risks.
- Establish Legal Frameworks. Legal frameworks that leverage nongovernmental expertise are vital to regulate the use of cyberspace and to sanction cyber crimes. African governments must respect digital rights, which are essential to safeguarding citizen security.
Conclusion
African states, institutions, and civil society must not only demonstrate their commitment to cybersecurity, but also work in close collaboration and partnership toward the shared objective of protecting citizens, businesses, and organizations in the digital era. This will be imperative to prevent more damaging cyber-attacks, which on the heels of the COVID-19 pandemic could have devastating impacts. Given that cybercrime has no borders, international and cross-stakeholder collaboration and coordination, cooperation between public and private sector leaders, will be of great importance in mitigating the cybersecurity threats in Africa. With all these mitigation measures in place, Africa will be at a better place to curb cyber attacks on critical infrastructure.
