Promoting Effective and Inclusive ICT Policy in Africa

Tag Archives: surveillance

  HomeCollaboration on International ICT Policy for East and Southern Africa (CIPESA)  /  surveillance
08Jul

Who Holds Digital Power Accountable? Lessons from Platform Governance in Africa

Author CIPESA Posted on

By CIPESA Writer |

Digital platforms have become central to how millions of Africans access news, organise politically, run businesses, and participate in public life. Yet the companies that operate these platforms make far-reaching decisions about what people see online, whose voices are amplified, and how public debate unfolds, often with limited accountability to the communities they affect.

As platforms increasingly rely on artificial intelligence and automated systems to recommend, rank, and moderate content, questions about transparency, oversight, and responsibility have become more urgent.

Governments across Africa are beginning to answer the question of who governs the platforms in different ways. CIPESA’s latest policy brief, Platform Governance in Africa: Emerging Models and Policy Priorities, examines how Nigeria, South Africa, and Uganda have confronted platform power, what their experiences reveal about the limits of national regulation, and why regional cooperation is becoming increasingly important.

Three Countries, Three Approaches

Nigeria has shown that African regulators can build credible cases and prevail in court. Following a joint investigation by the Federal Competition and Consumer Protection Commission and the Nigeria Data Protection Commission, Meta was found to have appropriated Nigerian users’ data without consent, abused its dominant market position, and treated Nigerian consumers less favourably than users elsewhere. In July 2024, regulators imposed a USD 220 million fine, which was later upheld on appeal.

Yet the case also illustrates the limits of enforcement. When the payment deadline expired in June 2025, neither Meta nor the regulator had publicly confirmed whether the fine had been paid. Nigeria demonstrated that regulators can win legal battles. Whether those victories translate into lasting changes in platform behaviour remains an open question.

South Africa has taken a different approach. Rather than relying primarily on financial penalties, the Competition Commission’s Media and Digital Platforms Market Inquiry sought to address how dominant platforms affect the sustainability of local journalism. The inquiry secured binding commitments from Google, Meta, TikTok, and Microsoft, including a ZAR 688 million (USD 41.6 million) media support package from Google. It represents one of Africa’s most ambitious efforts to address platform power through competition oversight, although its long-term impact will depend on sustained political commitment and regulatory capacity.

Uganda’s experience offers a different lesson. A government-ordered restriction on Facebook, imposed in January 2021 after Meta removed accounts linked to government-affiliated influence operations, has now lasted more than five years. The costs have largely been borne by Ugandan users and businesses, highlighting the wider social and economic consequences of unresolved disputes between governments and global platforms.

The Limits of Acting Alone

These cases highlight a central challenge of platform governance in Africa: legal authority does not always translate into practical leverage over global technology companies. Also, it is apparent that market size matters. Nigeria and South Africa, as two of Africa’s largest digital markets, secured stronger responses from platforms than Uganda did. Most African economies are considerably smaller than Meta’s annual profits, limiting the pressure individual governments can exert on multinational companies.

This reality is driving growing interest in regional approaches. The ongoing investigation by the Common Market for Eastern and Southern Africa (COMESA) Competition Commission into Meta’s practices across 21 member states reflects a shift towards collective oversight of platform power. By acting together, governments have greater potential to address competition, data governance, and digital market concerns than they do individually.

Why Platform Governance Matters

Platform governance is often discussed in terms of regulation and competition, yet users ultimately experience its consequences. During the conflict in Ethiopia’s Tigray region, platforms struggled to moderate harmful content in Tigrinya and Amharic. In one widely documented case, Facebook posts targeting university professor Meareg Amare remained online for days after being reported and were removed only after he had been killed.

Across Africa, women journalists, politicians, and activists continue to face technology-facilitated gender-based violence that platform governance systems have struggled to address effectively. These failures can discourage participation in public life and narrow the diversity of voices represented online.

Meanwhile, coordinated disinformation campaigns continue to spread faster than moderation and fact-checking systems can respond. A 2025 analysis in Kenya documented a coordinated campaign that generated more than 150,000 views in less than two weeks, illustrating how quickly harmful narratives can circulate before effective interventions are possible.

What Needs to Change

The policy brief argues that platform governance in Africa must extend beyond content moderation to broader questions of accountability, competition, data governance, and algorithmic transparency. Addressing these challenges will require governments to pursue rights-respecting regulation, regulators to strengthen oversight of platform systems, regional bodies to deepen cooperation, and platforms to provide greater transparency about how automated systems shape online experiences.

Platform governance in Africa is no longer only about removing harmful content. It is about who controls the infrastructure of public communication, on what terms, and with what accountability to the people who depend on it.

The experiences of Nigeria, South Africa, and Uganda show that African governments are increasingly willing to confront platform power. They also demonstrate that no African country can do so effectively in isolation. Building a more accountable digital future will require stronger institutions, deeper regional cooperation, and platforms that are genuinely responsive to the societies they serve.

To explore the evidence, country case studies, and policy recommendations in greater detail, read CIPESA’s full policy brief, Platform Governance in Africa: Emerging Models and Policy Priorities.

08Jul

What Global South Civil Society Wants from AI Governance

Author CIPESA Posted on

By CIPESA Writer |

As global discussions on the future of Artificial Intelligence (AI) governance take place at the AI for Good Global Summit and the Global Dialogue on AI Governance, questions about who shapes AI systems, whose interests they serve, and how affected communities can participate in decision-making are becoming increasingly urgent.

The Collaboration on International ICT Policy for East & Southern Africa (CIPESA) is pleased to share this joint statement by the Global Digital Justice Forum and the Global South Alliance, of which it is a member. The statement reflects concerns that CIPESA has consistently raised through its research and policy engagement, namely, current approaches to AI development risk deepening existing inequalities, and meaningful AI governance requires stronger corporate accountability, equitable data governance, and investment in public-interest AI infrastructure.

Through submissions to national AI strategies in Africa, analysis of AI governance trends across 14 African countries, and engagement with global AI policy discussions, CIPESA has consistently advocated for inclusive, rights-based approaches that ensure communities most affected by AI developments have a meaningful role in shaping its future.

The statement below brings together civil society perspectives from across the Global South and calls for an AI governance approach grounded in human rights, equity, public interest, and meaningful participation.

Joint Statement issued by the Global Digital Justice Forum and the Global South Alliance in the lead-up to the Global Dialogue on AI Governance

July 2026

The current trajectory of Artificial Intelligence (AI) innovation has consolidated the neocolonial structures of development. Today, a handful of US and Chinese transnational corporations dominate global AI systems. Driven by massive capital, semiconductor manufacturing dominance, and hyperscale cloud infrastructure, these companies control over 90% of global AI data center capacity. Their market capitalization exceeds the combined national income of many countries in the Global South. The wealth and power amassed by these corporations come at a staggering cost, borne disproportionately by the South. From the devalued, dehumanizing labor that is essential for training AI models to the critical minerals, land, energy, and water, communities in the South continue to provide the scaffolding for the AI economy and society, without the voice and power to shape and benefit from this paradigm. These systemic injustices also perpetuate deep dependencies on current and future infrastructures — over which communities lack control and sovereign agency.

The Global Digital Justice Forum (GDJF) and the Global South Alliance (GSA) believe that the emerging AI order lacks legitimacy; it grants unbridled impunity to powerful corporations, while reducing humanity and nature to objects of limitless extraction. The many summits and conversations about AI governance have failed to tackle these core issues. 

Against this backdrop, we exhort the UN Global Dialogue on AI Governance to deliver on a South-led AI paradigm, anchored in a vision of rights-based development, respectful of planetary boundaries, and committed to intergenerational justice and human rights. We urge that the Global Dialogue on AI Governance commit to the following.

  • End AI extractivism 

A ‘move-fast-break-things’ approach to digital innovation aids profit, not people. In particular, the systemic and collective risks and harms associated with the violation of human rights, the erosion of democratic processes, the abuse of the environment, and the discrimination and invisibility of marginalized citizens in AI-driven decision-making in public services remain consistently ignored and underplayed in international consensus declarations. AI innovation must embrace the precautionary principle. It must be ethically and transparently developed, democratically accountable, and grounded in a globally agreed minimum floor for meaningful and dignified work, pluralistic knowledge, diversified economies, and planetary flourishing.

  • Apply the Common But Differentiated Responsibilities (CBDR) principle in international AI cooperation

The reckless path of data and AI technologies, designed and controlled by a few, has led to predatory value capture, strengthening the geo-economic and geo-political power of a handful of corporate actors and countries. The human and planetary costs arising from such opportunism are indeed a common concern. However, power diff erentials in international economic law have led to a status quo where trade, taxation, and Intellectual Property regimes clearly disadvantage developing countries, disproportionately enabling a massive transfer of wealth from the South to the North. This seriously undermines the development of digital infrastructure and human and institutional capabilities in developing countries. Such asymmetry must be remedied through global commitments to underwrite the development of regenerative, locally-led, AI infrastructures and models in the South.

  • Address corporate impunity in data and AI value chains

A global moratorium on the sale and use of AI systems that pose a high risk to human rights (such as remote biometric recognition, social scoring, spyware, and AI-driven autonomous weapons) is urgently needed. The proposed UN Binding Treaty on Transnational Corporations (TNCs) to hold global businesses accountable for human rights violations and environmental degradation in supply chains needs to be adopted without delay and appropriately future-proofed against the specific risks of harms and abuses in data and AI value chains.

  • Design a data governance framework that delivers on global equity

A ‘one-size-fits-all’ policy playbook for cross-border data flows governance will not deliver on equitable development. Development sovereignty must be recognized as a core principle in the global governance of cross-border data flows. Furthermore, the governance of the non-personal data commons requires a societal approach that includes safeguards for collective privacy and the rights of communities to steward the use and re-use of their data resources in innovation ecosystems, together with strong personal data protection rights.

  • Invest in the development of global public compute

The foundational infrastructure of compute is controlled by a few corporations. Even open-source AI models are often dependent on closed/proprietary infrastructure systems for their hosting and distribution. To ensure that data science and AI innovation deliver on public innovation, a global facility for public compute is needed. A ‘CERN for AI’ could support a distributed network of AI research centers coordinated by a central hub and provide access to innovators and researchers from developing countries.

The current trajectory of AI innovation is not working for the majority. The Global Dialogue on AI Governance must move the needle with conviction and courage towards people’s participation, planetary wellbeing, and public value. Anything less will not do justice to the people of the South.

Please find the links to prior submissions from GDJF and GSA to official consultations of the Global Dialogue below:
● GDJF’s April 2026 submission
● GSA’s April 2026 submission

01Jul

Navigating Digital Rights in Africa amidst Increasing Foreign Malign Influence

Author CIPESA Posted on

By CIPESA Writers | 

On May 21, 2026, more than 300 delegates convened in Nairobi, Kenya, for the 19th edition of the Kenya Internet Governance Forum (KeIGF) to discuss the state of digital rights and internet governance on the continent.

The KeIGF was held three weeks after the continent’s digital landscape was jolted by the Zambian government’s decision to postpone RightsCon, the global digital rights forum, four days before it was scheduled to start. Efforts to resolve the issue yielded no positive results, and Access Now, the event organiser, decided to cancel the conference.

According to the Access Now statement, officials in Zambia’s Ministry of Technology and Science had reached out to them with concerns raised by diplomats from the People’s Republic of China, who were “pressuring” the Zambian government over the planned in-person participation of Taiwanese civil society.

Proceeding with the event while excluding some participants at the behest of certain countries would have set a bad precedent. The RightsCon cancellation, however, had a ripple effect. Several in-person sessions of the World Press Freedom Day 2026 Global Conference, which was to be held alongside the RightsCon conference at the Mulungushi International Conference Centre in Lusaka, were cancelled, while others were rescheduled to later dates.

These events highlight the growing influence of national governments on the success or failure of regional and international digital rights convenings. As Access Now explained, such convenings often involve extensive diplomatic engagement between conference organisers and host countries to secure their commitments, among other things, to respect the fundamental human rights of all participants and to ensure smooth logistical preparations. For example, in March 2026, the Zambian Ministry of Technology and Science issued a statement announcing that the government would be a co-host of the RightsCon conference.

Access Now’s decision was a timely reminder that fundamental human rights, including digital rights, are non-negotiable and interdependent, and that national governments should not be at liberty to choose which rights to respect.

Growing Incidents of Foreign Malign Influence in Africa

Foreign governments’ interference in the internal affairs of African countries is not new, and while incidents of foreign malign influence in Africa’s trajectory toward digital authoritarianism have been well documented, the RightsCon cancellation was possibly the first time a foreign entity worked so blatantly to influence the direction of a digital rights convening itself. This clearly demonstrated the dangers posed by the growing economic and power imbalances between African countries and their trading partners.

Because many African countries have turned to China and Russia for support for their economic and security agendas, respectively, they have inadvertently surrendered part of their sovereignty to these superpowers due to what is referred to as the “debt trap”. 

For example, in April 2026, China was reported to have scrapped tariffs on all African countries except Eswatini, which maintains diplomatic relations with Taiwan, a move that contributed to friction between Access Now and the Zambian government. Earlier in 2022, the Chinese government was reported to have “forgiven” 23 interest-free loans to 17 African nations after it had also cancelled more than USD 3.4 billion in debt and restructured around USD 15 billion in debt in Africa between 2000 and 2019.

Reports by the Institute for Security Studies (ISS) and the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) have shown that geopolitical interests have often crossed national boundaries, with powerful nations exerting influence on the legal landscapes and digital public infrastructure of many African countries. 

According to an Institute of Development Studies study that mapped smart surveillance technologies in 11 African countries, many African countries that have embraced smart city surveillance have tended to rely on China for financing their digital public infrastructure, including tools, software, and capacity-building, which are often deployed to conduct digital surveillance of their citizens. Digital rights actors and individual government critics have often borne the brunt of these surveillance practices.

Unfortunately, the deployment of these digital surveillance tools and software is often characterised by limited oversight and a lack of transparency regarding their purchases and operations, raising serious concerns about their intentions and their impact on human rights. 

In April 2026, a team of United Nations Experts raised serious concerns about the proliferation of digital surveillance technologies, including artificial intelligence (AI), noting that their misuse by states in law enforcement, counter-terrorism, border management, and national security and military contexts poses serious human rights risks. 

Disinformation and Information Warfare

Africa has also become a battlefield for disinformation campaigns as different superpowers scramble to expand their spheres of influence. Foreign disinformation campaigns are particularly prominent during periods of contestation, such as elections, protests, and civil strife. 

Because they are more covert, disinformation campaigns have become more insidious as they are rarely noticeable or easily associated with foreign actors. For example, in countries such as Kenya, Ethiopia, Ghana, and Nigeria, Russia has worked with locally based influencers and digital content creators to amplify pro-Kremlin narratives and messaging while keeping their connections to Russian-backed initiatives a secret. 

In 2024 alone, there were at least 80 documented cases of Russian-linked disinformation campaigns targeting more than 22 African countries. Indeed, several of Africa’s fragile autocracies, such as Burkina Faso, the Central African Republic (CAR), Mali, and Sudan, have come to rely on Russia’s well-coordinated digital propaganda to sustain their stay in power. 

Mitigating the Malign Influence

Foreign malign influence has continued to thrive in Africa, partly due to African countries’ overreliance on the “generosity” of superpowers seeking to shape Africa’s political, social, and economic landscape. While development partnerships and support are critical to a country’s development, these should be anchored in rights-respecting frameworks and geared towards benefiting ordinary citizens.

Taken together, the various aspects of foreign malign influence are undermining the democratic practices of many African countries, including electoral processes, while emboldening autocratic leaders to embrace digital authoritarianism.

For digital rights activists, especially in Africa, it is therefore important to understand and address the factors driving the expansion of foreign digital malign influence and to develop strategies to counter it, including mechanisms to hold governments accountable when they purchase and deploy digital surveillance tools and software. 

More specifically, digital rights actors should:

  • Strengthen Digital and Media Literacy

Because foreign malign influence most often thrives in contexts with limited media and information literacy, weak media systems, and digital inequalities, it is important that rights actors build systems that promote information integrity, such as media independence, fact-checking, and independent journalism, to counter information manipulation. In most of Africa, the media and information ecosystems are so integrated, enabling the viral spread of misinformation through influencers and digital content creators with large followings. Quite often, media houses amplify the disinformation tapped from influencers with large followings without verification.  

  • Build Stronger Coalitions and Regional Networks

In many African countries, governments have often used the tried-and-tested “divide and rule” approach, mischaracterising digital rights actors as either sympathetic to them or “enemies”. The main purpose is always to isolate certain actors deemed too critical. 

To mitigate the risks associated with engaging with less democratic governments, digital rights actors should aim to build synergies and support systems, ensuring that collective voices among like-minded organisations, such as academia, media, and telecom companies, can, among other things, challenge government excesses. This could include issuing joint statements, which is critical as it does not expose any entity; and providing technical and financial assistance to more at-risk organisations. 

  • Leverage Digital Rights Convenings

Digital rights convenings such as the Forum on Internet Freedom in Africa (FIFAfrica) and Internet Governance Forum have become strategic platforms for digital rights advocacy and engagements, especially with national governments. It is therefore important that digital rights actors use these platforms to continuously ask duty bearers the hard questions regarding the conduct of due diligence reports on any technologies imported into the continent and their impact on fundamental human rights. 

For example, Africa will host several international and regional digital rights convenings, including the 21st Global Internet Governance Forum, which will be held in Kenya in December 2026, the fourth time the event will be held on the continent. In September, Mauritius will host the 13th FIFAfrica edition, while Ghana will host the 15th Annual Africa Internet Governance Forum in November 2026. 

These events present great opportunities for digital rights actors to reflect on Africa’s digital rights record and the progress made so far, and to table concrete African positions on digital rights, including data sovereignty, Artificial Intelligence, and platform accountability.

23Jun

Towards Regulation of App-Based Health Data in Africa

Author CIPESA Posted on

By Edrine Wanyama |

Digital health technologies are reshaping healthcare delivery across Africa. App-based systems now connect patients, clinicians, pharmacies, laboratories, and public health agencies, creating new opportunities to improve access, efficiency, and coordination of care. At the same time, they generate large volumes of highly sensitive health data, much of it moving across platforms, providers, and in some cases, national borders.

A new Policy brief by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) examines the critical need for robust governance of app-based health data in Africa.

The brief highlights significant health data governance gaps, which include the lack of health-specific AI regulation, fragmented legal, policy and institutional frameworks, and the unresolved distinction between wellness tracking and clinical care. These gaps fundamentally undermine health data handling and management standards, with flaws in consent, accountability, and cross-border data management requirements.

Across the continent, digital health applications now span multiple functions within health systems, from clinical management systems and electronic medical records (EMR) platforms to pharmaceutical logistics and supply chains. Alongside these systems, AI-enabled and specialist care platforms are expanding diagnostic and treatment capacity. Patient-facing applications are also expanding, particularly in chronic care, maternal health, and home-based services.

While these innovations are improving access to services and efficiency, they also introduce significant governance risks. Health data is among the most sensitive categories of personal data, capable of revealing medical history, reproductive health, mental health status, and genetic information. In app-based systems, this data is often processed by multiple actors, including developers, health providers, cloud infrastructure providers, and third-party analytics firms, many of which are not visible to users.

In practice, consent is often weak or poorly understood, data sharing arrangements are opaque, and users have limited visibility or control over the use of their information. This creates risks not only to privacy, but also to trust in digital health systems.

These risks are compounded by fragmented legal and institutional frameworks. Although many countries have enacted data protection laws and digital health policies, enforcement remains uneven and coordination between health ministries, data protection authorities, and digital regulators is often weak. This creates a persistent governance gap between the rapid expansion of app-based health systems and the capacity of institutions to regulate them effectively.

At the continental level, emerging frameworks such as the Africa Centres for Disease Control and Prevention (CDC) and global guidance such as the World Health Organization (WHO) Digital Health Strategy set important normative directions for secure, rights-respecting health data governance. However, translating these commitments into enforceable national systems remains limited, particularly in relation to interoperability, cross-border data flows, and platform accountability.

The brief calls for the adoption of a strategic governance architecture grounded in seven data governance principles, namely:

  1. Data sovereignty that reflects African public health priorities, democratic oversight and defined accountability mechanisms;
  2. Cross-border data flows where adequate and comparable safeguards exist and support reciprocal recognition arrangements among Data Protection Authorities (DPAs);
  3. Consent, purpose limitation, and data minimisation that enable individuals to make informed decisions about participation and ensure secondary uses are subject to transparency and safeguards;
  4. Interoperability and standardisation of systems to ensure integration and portability;
  5. Governance of AI-based health tools that require algorithmic impact assessments, independent audits and ongoing monitoring;
  6. Equity and inclusion to ensure systems do not further exclude vulnerable and marginalised communities; and
  7. Accountability and institutional coordination through clear allocations of responsibilities across institutions, consistent oversight, enforcement, and compliance monitoring.

The principles are consistent with the CDC Health Data Governance Framework. Together with other continental instruments, they can support a harmonised, rights-respecting and secure health data governance in Africa.

The brief presents recommendations for various stakeholders which, if implemented, could foster a progressive and trustworthy digital health ecosystem in Africa. Among theses include:

For the African Union and Regional Bodies

  • Support implementation of the Africa CDC Continental Health Data Governance Framework through clear timelines, monitoring mechanisms, knowledge sharing platforms, and technical assistance for member states.
  • Develop a continental health-app certification framework, recognised across participating jurisdictions, covering consent requirements, interoperability standards, cybersecurity safeguards, data governance obligations, and algorithmic accountability.
  • Facilitate regional data trust zones through reciprocal recognition agreements among Data Protection Authorities, enabling secure and accountable cross-border health data flows for disease surveillance, research collaboration, and pandemic preparedness.

For National Governments and Health Ministries

  • Enact or strengthen health-specific data governance legislation that addresses the full data lifecycle in app-based health systems, including consent, purpose limitation, data minimisation, retention, breach notification, and cross-border transfers.
  • Establish regulatory sandboxes to assess the safety, effectiveness, and governance implications of emerging digital health technologies before large-scale deployment.

For  Data Protection Authorities

  • Conduct risk-based audits and impact assessments of high-impact health applications, including privacy, security, and algorithmic fairness, where AI systems are deployed.
  • Develop sector-specific guidance on the processing of health, biometric, and demographic data, including standards for research use, secondary use, and commercial processing.
  • Enter into reciprocal recognition arrangements with counterpart DPAs across Africa to support coordinated enforcement and trusted cross-border data flows.

For Health Service Providers

  • Formalise data processing agreements with health app vendors and third-party processors, including provisions on security, breach notification, audit rights, and liability.
  • Strengthen workforce capacity through regular training on health data governance, cybersecurity, incident reporting, and the responsible handling of sensitive health information.
  • Implement strong authentication, access-control, and encryption measures to protect patient information throughout its lifecycle.

For App Developers and Platform Operators

  • Embed privacy-by-design and security-by-design principles throughout the development, deployment, and operation of health applications.
  • Provide clear and accessible consent mechanisms that enable users to understand and control how their health data is collected, shared, retained, and reused.
  • Conduct regular testing and independent assessments of digital health tools to identify and address bias, accuracy concerns, and performance disparities across African populations.

For Health Service Consumers and App Users

  • Exercise rights over personal health data, including rights of access, correction, portability, and deletion where provided under applicable legal frameworks.
  • Use health applications that comply with relevant regulatory requirements and recognised data protection standards.
  • Report suspected data breaches, misuse of personal information, or harmful automated decision-making outcomes to relevant regulators and oversight bodies.

Please read the full Policy Brief here.

Donatien of the Integrated Refugee Organisation points to a flip-chart of verification tools while leading an OSINT session
20Jun

Building Digital Security and Verification Capacity Among Refugees

Author CIPESA Posted on

By Brian Byaruhanga |

In May 2026, CIPESA joined the World Organisation Against Torture (OMCT) and partners to conduct a three-day workshop on digital security and Open-Source Intelligence (OSINT) for Congolese human rights defenders and journalists  in exile in Uganda. 

The workshop addressed the various threats this community continues to navigate daily including account compromise, phishing-borne malware, surveillance by state and non-state actors, device confiscation, and exposure to coordinated disinformation operating across both home-country and diaspora information spaces.

The 23 participants were drawn from women’s rights organisations, community documentation initiatives, justice and accountability groups, and broader human rights defender (HRD) support structures. A pre-workshop participant assessment found that one in three respondents had received no prior digital security training, highlighting a significant gap between the threats faced and necessary skills and knowledge to mitigate them.

The findings underscored the need to begin with foundational digital security practices before moving on to more advanced verification and documentation techniques.

Reported incidents within the cohort included hacked accounts, phishing attempts, confiscation of phones by security agents, surveillance of digital communications, and impersonation. One respondent described documentation work conducted in close proximity to alleged perpetrators of human rights violations, with no possibility of relocating, and elevated personal risk attached to ordinary data collection. These conditions, common across conflict-affected zones as is the case in the Democratic Republic of Congo (DRC), shape the technical and ethical constraints under which any digital security training must be designed.

CIPESA’s contribution builds on the organisation’s broader work supporting at-risk communities across the region, including through the Level-Up programme, which has provided digital security support to HRD organisations in Kenya, Ethiopia, Tanzania, South Sudan, and Uganda.

It also draws on CIPESA’s wider efforts to strengthen the capacity of civil society actors to advance digital rights in Africa. Across these engagements, a consistent key insight is that defenders rarely need more tools than they already have. More often, they need a clearer  understanding of how those tools work, where the vulnerabilities lie, and which everyday habits can expose them to risks.

The workshop therefore began with the fundamentals of digital security: how information travels online, where vulnerabilities emerge, how accounts are compromised, and why stronger authentication practices matter. Participants explored common attack pathways and practical measures for reducing exposure in their day-to-day work. The tools and exercises were selected for compatibility with the devices and operating systems that participants already relied on.

Foundations of digital safety

Participants installed secure communication tools like Tor and Orbot on their devices, worked through phishing recognition exercises based on scenarios familiar to the cohort, and tested safer-browsing configurations. The goal was not to introduce defenders to a long list of tools but to build working familiarity with a few, including practices of opening, inspecting, and configuring in ways they could transfer the acquired skills and knowledge onto their communities’ and colleagues’ devices.

Building on these foundations, the workshop moved onto OSINT and verification techniques that help defenders assess contested information and strengthen the credibility of human rights documentation. Participants practised reverse image searching against cases of recycled imagery presented as fresh evidence; used ExifTool to extract and read image metadata; and verified short-form video using the InVID-WeVerify verification plugin, parsing keyframes and tracing material across platforms.

Secure OSINT Documentation

Effective documentation and digital security are increasingly interconnected skills. The session on secure documentation walked participants through eyeWitness to Atrocities, the camera application developed by the International Bar Association that embeds metadata to support evidentiary chain of custody. In 2018, footage captured with eyeWitness was admitted as evidence before a military tribunal in Bukavu town, which subsequently convicted two armed group commanders of murder and torture, constituting crimes against humanity. It was the first time eyeWitness footage had been used in court proceedings in the DRC. The session also demonstrated structured data collection and management using Uwazi and  KoBoToolbox, both open-source platforms widely adopted for field research and human rights documentation.

These tools strengthened participants’ capacity to document and verify human rights abuses while also helping them to understand how their digital footprints can be exploited by adversaries. They also helped participants assess potentially misleading or manipulated content without inadvertently amplifying false information.

Outcomes

The training was grounded in the recognition that participants understand their own operating environments better than external facilitators ever can. The sessions were designed to strengthen existing knowledge and support locally informed security practices.

According to pre- and post-workshop evaluations, participant capacity increased from a composite score of 2.27 to 3.69 on a five-point scale. The results reflected a shift from limited familiarity with core concepts to practical competence in applying digital security and verification tools within their own documentation and advocacy work.

To extend the impact of the workshop beyond the participants in the room, CIPESA adopted a Training of Trainers (ToT) approach. Participants were encouraged to cascade the knowledge, tools, and practices acquired during the training within their organisations and communities. The approach supports the development of locally embedded digital security capacity and reduces reliance on external technical support.

Beyond the training

CIPESA’s work with refugee and exiled defender communities will continue, in collaboration with OMCT and other partners with adjacent mandates. The next phase will build on this foundation through sequenced follow-up modules, applied casework on documented matters, and ongoing technical support for the organisations represented in the cohort.

The aim is not simply to transfer skills during a workshop, but to strengthen the long-term resilience of organisations and networks engaged in human rights documentation, advocacy, and accountability work in increasingly complex digital environments.

1 2 3 … 20