Building Africa's cyber-resilient future

By Aimable Niyikiza

Prior to the 30th summit of the African Union (AU) earlier this month, newspapers across the continent ran stories on confidential data stolen from the organization’s servers between 2012 and 2017.

The French newspaper Le Monde broke the story with an article titled “The African Union Headquarters in Addis Ababa spied on by Beijing!” It cited “anonymous insiders” and attributed the hack to the Chinese government.

Le Monde emphasized that the AU headquarters building was built by China “as a gift to the African Union,” hinting this could say something about the nature of Sino-African relations, a sentiment picked up by many observers.

Although strongly opinionated, the report was surprisingly lacking in technical details. The only technical evidence it cited is the fact that stolen data was forwarded to an IP address located in Shanghai.

However, there is a big gap between identifying an IP address based in China, and concluding the attacker was from China. The country is known to be a hub of proxy servers anyone can rent to pretend to be from China.

Cybercrime groups, including North Korea’s Lazarus Group, often run their “command and control” servers from China. Any attacker smart enough to launch such an advanced persistent threat (APT) would be smart enough not to launch it from their bedroom. The even bigger leap of logic from there was suggesting the attack was state-sponsored.

In “Game of Thrones,” Catelyn Stark believes that Tyrion Lannister is behind an assassination attempt on her son based on questionable information involving a dagger used in the attack, leading to a diplomatic disaster that costs the lady her life.

While I’m not ruling out the Chinese government’s involvement, the African Union should be careful not to endorse a conjectured accusation without a rigorous technical investigation, as that can have unintended diplomatic implications.

It is interesting to try to know who plotted the data leak, but it is even more interesting to ask ourselves how it happened for so long without anyone noticing.

I can think of two things that go wrong very often.

Firstly, organizations tend to ignore the danger of inside threats. The definition of an internal actor in this context extends to any employee, contractor or partner who can contribute to the data leak through malicious intent, negligence or just pure incompetence.

Secondly, organizations tend to allocate little to no budget for proper cybersecurity controls, policies and competent personnel. If you don’t have the right tools to control what comes in, moves around and escapes your network and applications, it won’t matter whether you built your own office building, paid a constructor or got it as a gift.

This lack of a solid budget is what makes organizations seeking cybersecurity turn to the lowest bidder, regardless of merit. This is a good approach for commodity items such as office paperclips but it can be dangerous when you are looking for something your organization’s security will depend on.

At the end of the day, although technical in nature, the overall cybersecurity stature of an organization is determined by its management.

In the specific case of the African Union, there is a reason to be optimistic especially with the reformist agenda by its new chairperson Paul Kagame, president of Rwanda.

Known for his hands-on leadership, Kagame has led Rwanda from being a country torn by the genocide against the Tutsi, to being a development model for Africa and one of its top destinations for investors through fast-paced socio-economic development similar to Korea’s “miracle on the Han River.”

His legacy of attention to details and requiring accountability for everyone in their respective responsibilities is what has inspired thousands of people across Africa to cheer for his inauguration as the head of the pan-African union.

What gives even more confidence in the future of technology in Africa is Kagame’s record of ambitious ICT initiatives such as the Smart Africa alliance, and the award-winning partnership between KT, Korea’s largest telecommunications provider, and the government of Rwanda.

The African Union with good leadership gives hope the organization is heading toward a cyber-resilient future not just at its headquarters but also in its member countries.

Aimable Niyikiza (niyimunyura@gmail.com) is a cybersecurity engineer born in Rwanda and living in Seoul.