By CIPESA Writer |
Encryption is increasingly caught between efforts to strengthen online safety and attempts by governments to expand access to private communications. For journalists, civil society organisations and opposition actors, weakening encryption can expose sensitive communications to surveillance and undermine their ability to work safely. As countries review laws and policies governing digital spaces, a key concern is how governments can address legitimate public safety concerns without undermining the security and privacy that encryption provides.
To mark Global Encryption Day on October 21, Global Partners Digital (GPD) has relaunched the World Map of Encryption Laws and Policies, an online tool that assesses and compares laws, policies and practices governing encryption across 100 countries. It shows how governments are protecting or restricting the use of the technology.
For African countries, where digital technologies increasingly shape civic participation, public debate, journalism and access to information, the map’s findings underscore the importance of treating encryption as a fundamental component of digital rights and security, especially as surveillance concerns rise.
The updated Map also examines the safeguards in place to prevent the abuse of government powers, helping users identify where national frameworks protect encryption and where they leave its use vulnerable to restrictions or interference.
The relaunch includes new research on 40 countries using an updated assessment framework. More than 30 assessments were available at launch, with the remainder expected in the following weeks, while 60 countries remain covered by the previous framework. Each country page states the methodology and when the assessment was done, helping users to understand how current the findings are.
The research points to growing tensions in global encryption policy. Countries including Australia, the United Kingdom and Canada have passed laws or tabled proposals that seek to bypass traditional lawful access mechanisms and build access into encrypted communications. At the same time, GDP found that although online safety measures are increasing, relatively few have so far directly affected encryption.
Ellie McDonald, Policy and Advocacy Lead at Global Partners Digital, who also led the research project, said: “On one hand, we are seeing ever greater adoption of encryption, and on the other, muscular attempts to undermine it.” She added that the refreshed map aims to “help separate the speculative from the certain and to back up the field with up-to-date analysis.”
The research also shows that the measures introduced in the name of safety or law enforcement can have implications that extend beyond their stated objectives, particularly when they weaken the security protections on which millions of people rely. This concern is echoed by African digital rights researcher Lilian Nalwoga, who notes, “Across Africa, efforts aimed at strengthening cybersecurity and digital sovereignty are eroding privacy, weakening encryption, expanding state surveillance, and enabling mass collection of sensitive biometric data. The map will serve as an advocacy tool for actors to demand stronger encryption in Africa.”
In African countries where human rights defenders, journalists, political opponents and dissidents, activists and civil society organisations may face surveillance, intimidation or restrictions on civic space, secure communications can be particularly important. Encryption can help protect sources, preserve the confidentiality of sensitive information and reduce the risk of communications being intercepted by unauthorised parties.
Research by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) has previously noted that many African countries have passed legislation that limits anonymity and the use of encryption, often citing the need to protect national security and to combat terrorism and crime. In practice, some governments have used these restrictions to monitor the communications of critical journalists, human rights defenders, and opposition politicians. For instance the GDP encryption map, Ethiopia ranks severe for encryption intensity and weak for procedural and institutional safeguards, while Zimbabwe and Nigeria rank severe for legislative and policy threats. Ethiopia in particular places a licensing requirement for providers of encryption products and services with importers of hardware and software containing cryptographic capabilities needing a security clearance certificate.
Weakening encryption therefore threatens not only the security of personal data, but also people’s willingness and ability to participate in public debate, report on matters of public interest and organise collectively. The challenge for policymakers is to address legitimate concerns about online safety and criminal activity without creating systemic weaknesses in digital security.
The right to privacy has come under increased attack in many African countries, with the proliferation of digital technologies being matched by state measures that negate this right. In the past few years, many countries across the continent have enacted various laws that permit surveillance, mandate telecommunication intermediaries to facilitate the interception of communication, stipulate the mandatory collection of biometric data, limit the use of encryption, require the localisation of personal data, and grant law enforcement agents broad search and seizure powers – Source: Privacy Imperilled: Analysis of Surveillance, Encryption and Data Localisation Laws in Africa
However, GPD’s updated research also identifies developments that demonstrate how policy can protect encryption and privacy. Chile has introduced a law that expressly protects the use of encryption, while Brazil’s Digital Statute of Children and Adolescents requires services used by children to have privacy by default. Meanwhile, several proposals that threatened encryption have been dropped or stalled in recent years. These include the European Union’s proposed ‘Chat Control’ proposal, a proposed encryption backdoor in Sweden and efforts to introduce VPN restrictions in the United Kingdom.
Engagement on encryption requires collaboration among civil society organisations, journalists, technical communities, policymakers and other stakeholders. It also requires clear, accessible evidence that distinguishes established law from proposals, and shows the potential consequences of weakening encryption. For African policymakers, regulators and civil society actors, comparative resources such as the World Map offer that evidence. They can help identify approaches that safeguard encryption, expose weaknesses in national legal protections and draw lessons from developments in other jurisdictions.
As artificial intelligence makes cyber threats increasingly sophisticated and scalable, strong encryption remains essential to protecting communications and personal data. Thus, African governments should ensure that efforts to address online harms and criminal activity do not weaken these protections.