Policy Brief: How African States Are Undermining the Use of Encryption

By Lillian Nalwoga |

Encryption enables internet users to protect their data and communications from unauthorised access. Accordingly, anonymity and the use of encryption in digital communications are key enablers of citizens’ enjoyment of the right to privacy.

Worryingly, many African countries have passed legislation that limits anonymity and the use of encryption, purportedly to aid governments’ efforts to combat terrorism and crime. Other governments in the region limit the use of encryption to enable them to monitor the communications of critical journalists, human rights defenders, and opposition politicians.

In commemoration of the inaugural Global Encryption Day, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) has published a policy brief that highlights restrictions to encryption and what needs to be done by governments in Africa to promote the use of encryption. The brief shows that encryption laws and government practices in several countries undermine the privacy rights of citizens, which in turn hampers their right to free expression and to secure use of digital technologies.

The importance of the right to anonymity in the digital era has been recognised in the Declaration of Principles on Freedom of Expression and Access to Information in Africa of the African Commission on Human and Peoples’ Rights. Principle 40(3) provides that: “States shall not adopt laws or other measures prohibiting or weakening encryption, including backdoors, key escrows, and data localisation requirements unless such measures are justifiable and compatible with international human rights law and standards.”

However, encryption is under threat from governments in Africa, as indeed in other parts of the world. Among the concerns cited by the brief are legislation and regulations that require registration and licensing of encryption service providers before they can offer cryptographic services. This is the case in Benin, Chad,  Cameroon, Congo Brazzaville, Democratic Republic of Congo (DR Congo), Ethiopia, Guinea, Ivory Coast, Malawi, Mali, Morocco, Senegal, South Africa, Tanzania, Tunisia and Zambia, among others. Offering encryption services without a license attracts penalties, as does failure to hand over secret encryption codes to state authorities, or using prohibited encryption tools.

Encryption in Africa

The requirement for registration of encryption services providers makes it easy for regulators and other government agencies to access information held by these service providers, including decryption keys and encrypted data. This undermines best practices which require governments to reject laws, policies, and practices that limit access to or undermine encryption and other secure communications tools and technologies. 

Further, the brief points to how governments in Africa prohibit the use of some types of encryption and require disclosure to regulators of the characteristics of cryptology. Crucially, governments should not prohibit the use of encryption by grade or type. Further, governments should not mandate insecure encryption algorithms, standards, tools, or technologies. 

Meanwhile, laws on interception of communications across the continent including in Benin, Cameroon, Chad, Ivory Coast, Malawi, Mali, Niger, Nigeria, Rwanda, Senegal, Tanzania, Togo, Tunisia, Uganda, Zambia and Zimbabwe require communication service providers to put in place mechanisms, including the installation of software, which facilitates access and interception of communications by state agencies. Indeed, state agencies in several countries can request for decryption of data held by service providers, which poses a big concern. 

For instance, Zimbabwe’s Interception of Communications Act requires cryptography services providers to decrypt data at judicial authorities’ request or provide them with the codes allowing the decryption of data they have encrypted (article 78). Section 11(1)(d) permits security agents to demand that information is decrypted before it is handed to them, where the disclosure is necessary for national security, to prevent or detect a severe criminal offense, or in the interests of the country’s economic well being. Failure to comply is punishable with up to five years’ imprisonment, a fine not exceeding USD 373, or both. Similar provisions are found in the laws of several other countries.

Such compelled assistance from service providers has been reinforced with mandatory SIM card registration of phone users around the continent, as well as data localisation requirements amidst ineffective safeguards.

 In some countries, if the private communications of human rights defenders and opposition politicians fall into the hands of state agencies, the consequences can be dire. The brief cites Rwanda, where the private communications of musician Kizito Mihigo, opposition leader Diane Rwigara, and two former army officers were used in their separate prosecutions. In Ethiopia, the Zone 9 bloggers were detained and prosecuted, among others, for using encrypted communications.

Meanwhile, Uganda instituted a ban on use of Virtual Partial Networks (VPNs) in the face of internet taxes and network disruptions. For its part, Zimbabwe barred telecom operator Econet Wireless from introducing the Blackberry Messenger service, which provided encrypted messaging, arguing that it contravened the southern African country’s interception of communications law which bars provision of services which the communications regulator can not intercept. Another example cited is Mauritius, which this year attempted to introduce a controversial lawful interception mechanism that would decrypt and re-encrypt all social media traffic. 

In light of the above concerns, the CIPESA brief is urging governments to repeal or amend provisions that place undue restrictions on the use of encryption tools; cease blanket compelled service providers and intermediary assistance to state agents and instead provide for clear and activity-bound assistance; and enact data protection and privacy laws that robustly promote the use of strong encryption. 

The full brief can be accessed here.

Why are African Governments Criminalising Online Speech? Because They Fear Its Power.

By Nwachukwu Egbunike |
Africa’s landscape of online free speech and dissent is gradually, but consistently, being tightened. In legal and economic terms, the cost of speaking out is rapidly rising across the continent.
While most governments are considered democratic in that they hold elections with multi-party candidates and profess participatory ideals, in practice, many operate much closer dictatorships — and they appear to be asserting more control over digital space with each passing day.
CameroonTanzaniaUgandaEthiopiaNigeria, and Benin have in the recent past witnessed internet shutdowns, the imposition of taxes on blogging and social media use, and the arrest of journalists. Media workers and citizens have been jailed on charges ranging from publishing “false information” to exposing state secrets to terrorism.
At the recent Forum of Internet Freedom in Africa (FIFA) held in Accra, Ghana, a group of panelists from various African countries all said they feared African governments were interested in controlling digital space to keep citizens in check.
Many countries have statutes and laws which guarantee the right to free expression. In Nigeria, for example, the Freedom of Information Act grants citizens the right to demand information from any government agency. Section 22 of the 1999 Constitution provides for freedom of the press and Section 39 maintains that “every person shall be entitled to freedom of expression, including the freedom to hold and to receive and impart ideas and information without interference…”
Yet, Nigeria has issued other laws that authorities use to deny these aforementioned rights.
Section 24 of Nigeria’s Cybercrime Act criminalises “anyone who spreads messages he knows to be false, for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred, ill will or needless anxiety to another or causes such a message to be sent.”
Making laws with ambiguous and subjective terms like “inconvenience” or “insult” calls for concern. Governments and their agents often use this as a cover to suppress freedom of expression.
Who determines the definition of an insult? Should public officials expect to develop a thick skin? In many parts of the world, citizens have the right to criticise public officials. Why don’t Africans have the right to offend as an essential part of free expression?
In 2017 and 2016, Nigerian online journalists and bloggers Abubakar Sidiq Usman and Kemi Olunloyo were each booked on spurious charges of cyber-stalking in connection with journalistic investigations on the basis of the Cybercrime Act.

Don’t suffer in silence — keep talking

The very existence of these legal challenges tells citizens that their voices matter. From Tanzania’s prohibition on spreading “false, deceptive, misleading or inaccurate” information online to Uganda’s tax on social media that is intended to curb “gossip”, the noise made on digital platforms scares oppressive regimes. In some cases, it may even lead to them to rescind their actions.
The experience of the Zone9 bloggers of Ethiopia provides a powerful example.
In 2014, nine Ethiopian writers were jailed and tortured over a collective blogging project in which they wrote about human rights violations by Ethiopia’s former government, daring to speak truth to power. The state labeled the group “terrorists”for their online activity and incarcerated them for almost 18 months.

Zone9 members Mahlet (left) and Zelalem (right) rejoiced at the release of Befeqadu Hailu (second from left, in scarf) in October 2015. Photo shared on Twitter by Zelalem Kiberet.

Six members of the now liberated group made their premier international engagement in Ghana during FIFA conference: Atnaf Berhane, Befeqadu Hailu Techane, Zelalem Kibret, Natnael Feleke Aberra, and Abel Wabella were all in attendance. Jomanex Kasaye, who had worked with the group prior to the arrests (but was not arrested) also attended.
Several members had collaborated with Global Voices to write and translate stories into the Amharic. As members of the community, Global Voices campaigned and mobilised the global human rights community to speak out about their case from the very first night they were arrested.
After months of writing stories and promoting their case on Twitter, international condemnation of their arrest and imprisonment began to flow from governments and prominent human rights leaders, alongside hundreds of thousands of online supporters. From the four-compass points of the world, a mighty cry arose demanding the Ethiopian government to free the Zone9 bloggers.
In their remarks at FIFA, the bloggers said that their membership in the Global Voices community was key to visibility during their time in prison. In their panel session, they credited Global Voices’ campaign for keeping them alive.
Berhan Taye, the panel moderator, asked the group to recount their prison experiences. As they spoke, the lights on the stage dimmed. Their voices filled the room with a quiet power.
Abel Wabella, who ran Global Voices’ Amharic site, lost hearing in one ear due to the torture he endured after refusing to sign a false confession.
Atnaf Berhane recalled that one of his torture sessions lasted until 2 a.m. and then continued after he had a few hours of sleep.
One of the security agents who arrested Zelalem Kibret had once been Kibret’s student at the university where he taught.
Jomanex Kasaye recounted the mental agony of leaving Ethiopia before his friends were arrested — the anguish of powerlessness — the unending suspense and fear that his friends would not make it out alive.

Zone9 bloggers together in Addis Ababa, 2012. From left: Endalk, Soleyana, Natnael, Abel, Befeqadu, Mahlet, Zelalem, Atnaf, Jomanex. Photo courtesy of Endalk Chala.

With modesty, the Zone9 bloggers said: “We are not strong or courageous people…we are only glad we inspired others.”
Yet, the Zone9 bloggers redefined patriotism with both their words and actions. It takes immense courage to love one’s country even after suffering at its hands for speaking out.
Ugandan journalist Charles Onyango-Obbo, also in attendance at FIFA, shared an Igbo proverb popularised by Nigerian writer Chinua Achebe which says:

Since the hunter has learned to shoot without missing, Eneke the bird has also learnt to fly without perching.

In essence, he meant that in order to keep digital spaces free and safe, those involved in this struggle must devise new methods.
Activists on the front lines of free speech in sub-Saharan Africa and across the globe cannot afford to work in silos or go silent in frustration and defeat. With our strength and unity, online spaces will remain free to deepen democracy through vibrant dissent.