POLICY BRIEF #1| African Cyber Law Conference 2026 important in low-capacity environments where underused facilities quickly become symbolic rather than operational assets. Risks: The main risks are political misuse, surveillance creep, vendor dependence, and reform fatigue. These should be mitigated through statutory limits, judicial or independent authorisation where appropriate, procurement transparency, periodic review, and public reporting in aggregated form. Bibliography Access Now, ‘A blow to human rights in Africa: internet shutdowns in 2024’ accessed 9 March 2026 AfricaCERT, Africa Computer Security Incident accessed 9 March 2026 Response Teams African Commission on Human and Peoples’ Rights, Resolution on Internet Shutdowns and Elections in Africa ACHPR/Res.580 (LXXVIII) (20 March 2024) accessed 9 March 2026 African Union, African Union Convention on Cyber Security and Personal Data Protection (adopted 27 June 2014) accessed 9 March 2026 Communications Authority of Kenya, KE-CIRT/CC accessed 9 March 2026 Computer Misuse and Cybercrimes Act 2018 (Kenya) Cybercrimes Act 19 of 2020 (South Africa) Cybersecurity Act 2020 (Act 1038) (Ghana) Data Protection Act 2012 (Act 843) (Ghana) International Committee of the Red Cross, ‘Cyber operations and harmful information’ accessed 9 March 2026 International Telecommunication Union, Global Cybersecurity Index 2024 (2024) accessed 9 March 2026 INTERPOL, ‘New INTERPOL report warns of sharp rise in cybercrime in Africa’ (23 June 2025) accessed 9 March 2026 North Atlantic Treaty Organization, Warsaw Summit Communiqué (9 July 2016) accessed 9 March 2026 Office of the Data Protection Commissioner (Kenya), Who accessed 9 March 2026 We Are Protection of Personal Information Act 4 of 2013 (South Africa) 7