Closing the gap between a regional cybersecurity strategy adopted in 2021 and the institution that must deliver it.
Komlan Messie, MBA, Polytechnician, CEO of NovaHub Consulting • 2026 • 8 min read
In January 2021, ECOWAS adopted a Regional Cybersecurity and Cybercrime Strategy. Five years later, Ghana holds a Tier 1 global cybersecurity ranking while Nigeria, Côte d'Ivoire and Senegal sit two tiers lower, inside the same Community. That gap is the story.
ECOWAS's cybersecurity problem is no longer strategic design. The 2021 Strategy, built on the 2011 Cybercrime Directive, is sound in structure. The problem is institutional: fifteen national systems of unequal maturity, no fully operational regional coordination body, and a threat landscape that now evolves faster than the Community's capacity to respond. Closing that gap, not writing a new strategy, is the work ahead.
ECOWAS adopted its Regional Cybersecurity and Cybercrime Strategy through Directive C/DIR.1/01/2021, instructing member states to adopt national cybersecurity strategies, create dedicated authorities, protect critical infrastructure and strengthen judicial cooperation on cybercrime.1,2 It builds on the ECOWAS Cybercrime Directive of 2011, which set out to align national criminal law and procedure across the region.3 The missing piece has been institutional follow-through. In 2025, ECOWAS experts validated a feasibility study for a Regional Cybersecurity Coordination Centre (RCCC), designed to support coordinated efforts and mutual assistance without duplicating national authorities or CSIRTs.4 That the region is only now validating the feasibility of its coordination backbone, four years after adopting the strategy that calls for one, is the clearest evidence that implementation has lagged design.
The ITU's 2024 Global Cybersecurity Index shows the disparity starkly. Ghana scored 99.27 and holds Tier 1, a global role-model status.8,9 Within the same Community, Nigeria, Côte d'Ivoire and Senegal sit in Tier 3, reflecting partial advancement and serious gaps in critical cybersecurity areas, while Benin and Togo occupy Tier 2.8
This unevenness is structural risk. Digital infrastructure, payment rails and telecommunications networks cross ECOWAS borders freely, so a weak link in one member state's legal or technical framework becomes a regional exposure. ECOWAS's own strategic documentation says as much: the heterogeneity of systems across member states considerably limits regional cooperation, and harmonised requirements and penal provisions are needed to protect transnational infrastructure and enable efficient mutual assistance.2,3
INTERPOL's most recent continental data makes the urgency concrete. Artificial intelligence now enables 55 percent of reported cybercrimes across Africa, making attacks faster, more scalable and harder to detect.5,7 With more than 1.1 billion mobile subscribers recorded in 2025, Africa's digital transformation is expanding rapidly, while cybercrime legislation remains fragmented and AI readiness in law enforcement agencies remains alarmingly low.5
The financial trajectory confirms the pace. AI-enabled scam losses in Africa rose from $192 million in 2024 to $484 million the following year.5 West Africa is not a peripheral actor: three-quarters of participating countries reported scam centres, with Southern and West Africa the most likely to host them.5 INTERPOL's 2025 assessment also found that cybercrime accounts for more than 30 percent of all reported crime in Western and Eastern Africa, and that 90 percent of African countries need significant improvement in law enforcement or prosecution capacity.6
The African Union's Malabo Convention on Cyber Security and Personal Data Protection, adopted in 2014, entered into force in June 2023 after reaching the fifteen ratifications required under Article 36, following Mauritania's ratification.10,11 It offers a continent-wide legal architecture across cybercrime, electronic transactions and data protection, one that ECOWAS's own instruments can plug into rather than duplicate. Yet several regional blocs, ECOWAS among them, had already built their own frameworks, which reduced the perceived urgency of ratifying Malabo in a number of member states.3,10 The result is two credible legal architectures, continental and regional, operating with only partial alignment.
ECOWAS does not need a new strategy. It needs a delivery mechanism, sequenced, financed and measured.
For African decision-makers, sequencing matters more than ambition. Coordination without harmonized law produces information sharing with no enforcement path. Harmonized law without sustainable financing produces frameworks that lapse when donor-funded projects end. The three horizons remove each failure mode in order.
“The real question for leaders is not whether West Africa understands the cybersecurity challenge. The 2021 Strategy and the 2011 Directive prove that it does. The question is whether the region will finish building the institution the strategy already called for, before the threat it describes outgrows the response it authorized.”
NovaHub Consulting advises governments, regulators and regional institutions on cybersecurity governance, national CSIRT design, legal harmonization and AI-threat readiness across ECOWAS.
Book a conversation
A career built at the intersection of business, diplomacy and civic leadership.
Komlan Messie, MBA, is an international executive, entrepreneur and strategic advisor with more than two decades of experience across management, technology, institutional development, strategic transformation and international development. His work focuses on helping organisations, institutions and leaders navigate transformation, innovation, public policy and complex strategic challenges.
Mr. Messie is the founder and Chief Executive Officer of NovaHub Consulting and the Regional Executive Director of WACSOF-FOSCAO, the West African civil society network spanning ECOWAS member states. He is also the cofounder and chairman of the Réseau des Entrepreneurs et Professionnels Africains (REPAF) and the chairman of the Forum Afrique Expansion Canada, and he co-founded Aliments Frunil in Canada. He is a former Vice President of the Project Management Institute Montreal (PMI Montreal) in Canada.
He holds an MBA from HEC Montréal, an M.Sc. in Computer Science and Operations Research from École Polytechnique de Montréal, and a B.Eng. in Electrical Engineering from École Polytechnique de Thiès (Senegal), and is PRINCE2 certified. He works across Canada, Africa and especially the ECOWAS region in French, English, Ewe and Wolof.
Read offline or share with your team, including all charts and the executive checklist.
1. ECOWAS Parliament, ECOWAS Adopts a Regional Strategy for Cybersecurity and the Fight Against Cybercrime (2021), parl.ecowas.int.
2. Diplo Foundation, Digital Watch Observatory, ECOWAS Regional Cybersecurity and Cybercrime Strategy (2023), dig.watch.
3. Diplo Foundation, Regional Cybersecurity and Cybercrime Policies in Africa (2024), diplomacy.edu.
4. News Ghana, ECOWAS Experts Validate Feasibility Study on Regional Cybersecurity Coordination Centre (2025), newsghana.com.gh.
5. INTERPOL, African Cyberthreat Assessment Report 2026 (2026), interpol.int.
6. INTERPOL, Africa Cyberthreat Assessment Report, 4th Edition (2025), interpol.int.
7. Infosecurity Magazine, AI Accounts for Over Half of Cybercrime in Africa, Says Interpol (2026), infosecurity-magazine.com.
8. International Telecommunication Union, Global Cybersecurity Index 2024, summarized in Web Security Lab, Cybersecurity in Africa: Rankings and Insights from the 2024 Global Index, websecuritylab.org.
9. Ministry of Communication, Digital Technology and Innovations, Ghana, Ghana Ranked Tier 1 Status in Latest ITU Global Cybersecurity Index (2024), moc.gov.gh.
10. Diplo Foundation, What Is the Malabo Convention? (2025), diplomacy.edu.
11. African Researchers Magazine, The Malabo Convention: Africa's Cybersecurity and Data Protection Framework Explained (2025), africanresearchers.org.
← Back to Blog & OpinionsMore than $2 trillion moved through mobile wallets in 2025, and Sub-Saharan Africa generated 66% of it. Four of fifteen West African states still have no data-protection law.
Read the articleNinety percent of West Africa's trade already moves by sea. Illegal fishing and piracy drain more than $4 billion a year. Why the blue economy is still not part of the conversation.
Read the articleGuinea exported 145 million tonnes of raw bauxite in 2024. Its only refinery processed 0.6 million tonnes. A 15-country map of West Africa's mineral wealth and the missing factories.
Read the article