Cybersecurity critical to Africa’s digital development

“Africa should think big on digital development,” declares the World Bank, asserting that digital technologies unlock new pathways for rapid economic growth. The AU goes further still. The organisation’s Digital Transformation Strategy proclaims that digitalisation will address poverty, reduce inequality and help the continent achieve Agenda 2063 and the Sustainable Development Goals.

Indeed, from Kenyan entrepreneurs to Washington-based economists, digital development is increasingly viewed as the solution to Africa’s protracted development challenges — and for good reason. Without legacy infrastructure, African nations can quickly adopt cutting-edge technologies, thereby leapfrogging their way to growth. But now, the digital development craze may have gone too far. Are artificial intelligence (AI)-enabled tutors and gig platforms for housecleaning services really the best path to sustainable growth?

Of course not — and digital development advocates would be quick to argue that while such examples point to a healthy start-up ecosystem, they are not cases of digital development. Instead, they would offer new agriculture, health and finance ventures as evidence of the true promise of digital development.

They are right to do so: Twiga Foods provides smallholder farmers with a stable income, M-Pesa has lifted as many as 2% of Kenyans out of poverty, and a partnership between the University of Helsinki and the Kinondo Health Centre used AI to catch abnormal cells before cancer develops.

Nevertheless, the emphasis on digital solutions for specific sectors overlooks the critical foundation of any fledgling digital ecosystem: cybersecurity. In a recent Organisation for Economic Co-operation and Development (OECD) survey of policymakers, digitalisation experts and private sector representatives, cybersecurity ranked fifth as a priority area for African digital development.

Improved digital infrastructure and more affordable digital services must take precedence. Cybersecurity becomes a concern only after people have access to the internet. This logic is flawed and irresponsible. Cybersecurity is not a problem to address later down the line. It must be prioritised now.

Two cases make Africa’s need for improved cybersecurity abundantly clear. In 2016 a distributed denial of service attack brought Liberia to its knees: half the country was cut off from banking services, farmers could not check crop prices, and infectious disease specialists, still reeling from the aftermath of the deadly Ebola outbreak, lost contact with international health agencies.

In SA, meanwhile, the second-largest private hospital operator was hit by a devastating ransomware attack in June 2020. The breach forced Life Healthcare Group, which operates 66 hospitals in the country, to switch to manual backup systems and caused significant administrative delays — in the midst of the Covid-19 pandemic.

Indeed, cyberattacks impose substantial costs on African economies. Kenyan cybersecurity firm Serianu estimated that the continent lost $3.5bn to cybercrime in 2017. Because firms are hesitant to report cyberattacks, the true figure is likely much higher — and has only grown since. Any developing nation cannot afford to lose such huge sums, much less those attempting to develop through digitalisation.

Hacks also impose indirect costs. Take attacks against physical infrastructure like the 2019 ransomware attack against Johannesburg’s City Power which left some residents without electricity. Left in the dark, the city’s industrious residents could not contribute to SA’s economic output. But the damage endured well beyond the restoration of power.

The real cost of such attacks is that they discourage future investment. Consider the perspective of a World Bank country director. Will they continue to advocate for future infrastructure projects if persistent cyberattacks will merely render them inoperative? The money might be better spent elsewhere.

It is thus clear that cybersecurity is a pressing development issue for Africa. So what would prioritising cybersecurity in digital development look like? First, it is important to state upfront that this shift will require a substantial concerted effort. In the latest Global Cybersecurity Index report the International Telecommunication Union found the continent was the least committed region to cybersecurity. In fact, only eight countries have ratified the AU Convention on Cybersecurity and Personal Data to date.

Outside observers might be tempted to prescribe creating regulatory frameworks as the first step to closing this gap. Yet nonexistent legislation is not the issue here. Africa actually comes second only to Europe in terms of the prevalence of cybersecurity legislation. 

Instead, policymakers must focus on building cybersecurity capacity. At a high level this requires proliferating national computer emergency response teams, of which there are only 19 in Africa, all across the continent. It also translates to participating in regional cyber-drills and prosecuting cybercriminals.

But at a fundamental level, building capacity means investing in people. More African universities ought to offer degrees in cyber operations, as does the University of Mauritius. NGOs should replicate the Africa Teen Geeks model to check the growing digital divide in African classrooms. And national governments must take up public awareness campaigns to educate their citizens on the dangers of emerging digital tools.

In this way, cybersecurity can be reframed from a nuisance to a cultivator of human capital; cybersecurity becomes part of the solution. Digital development promises to fast-track the continent’s development, but only if cybersecurity is put at the centre.

• Schatz is a Washington-based technologist and international development researcher.