今年早些时候，黑客以塞内加尔负责签发护照和身份证的机构为目标发动攻击。攻击者声称从这个西非国家窃取了敏感数据，包括生物特征信息和移民记录。当局告知公民称其数据安全。但部分被盗数据似乎已流向暗网。这并非该国近期遭遇的唯一成功网络攻击。5月，犯罪分子以国家财政部为目标。去年，黑客在攻破税务机关后勒索1000万美元赎金。
EARLIER THIS year hackers targeted Senegal’s agency for issuing passports and identity cards. The attackers claim to have stolen sensitive data from the west African country, including biometric information and immigration records. The authorities told citizens that their data were safe. But some of the loot seemingly ended up on the dark web. It was not the only successful recent cyber-attack on the state. In May, criminals targeted the national treasury. Last year hackers demanded a ransom of $10m after breaching the tax authority.
塞内加尔并非孤例。随着非洲各国政府推进政务服务数字化并扩充国家身份数据库，它们在保护公民数据方面举步维艰。近期发现PHP（一种政府常用的编程语言）存在漏洞等事件表明，这一问题并不局限于非洲。但该大陆在资金和人才方面相对匮乏，难以强化网络安全。随着人工智能（AI）扩充攻击者的工具箱，非洲各国政府将迫切需要寻找保障系统安全的途径。
Senegal is not alone. As African governments digitise government services and grow their national-identity databases, they are struggling to protect citizens’ data. Incidents such as the recent discovery of a vulnerability in PHP, a programming language commonly used by governments, show that the problem is not limited to Africa. But the continent has less money and talent to bolster its cyber-security. And as artificial intelligence (AI) expands attackers’ toolkits, African governments will urgently need to find ways to secure their systems.
这些问题往往源于改善公共服务的努力。全球8亿缺乏合法身份证明的人中，超过一半生活在撒哈拉以南非洲。没有正式身份，许多人无法参加福利项目或医保计划、送子女入学、拥有土地、开设银行账户或激活SIM卡。乌干达等国近80%的人口拥有数字身份证，如今能更便捷地追踪人口并弥补服务短板。（约十年前，不足10%的乌干达人拥有某种合法身份证明。）数字化转型成熟的国家更有能力识别欺诈、征收税收和维护选举安全。
Their problems often stem from efforts to improve public services. Of the 800m people worldwide who have no legal proof of who they are, more than half live in sub-Saharan Africa. Without a formal identity many find it impossible to join welfare programmes or health-insurance schemes, send children to school, own land, open bank accounts or activate sim cards. Countries like Uganda, where almost 80% of people have a digital ID, can now more easily track their people and close gaps in provision. (Around a decade ago fewer than 10% of Ugandans had some legal proof of their identities.) A digitally savvy state is better equipped to spot fraud, collect taxes and safeguard elections.
然而，各国政府却未能确保黑客日益增多的接入点的安全。这主要是因为缺乏足够能够协助他们做到这一点的合格人才。支付巨头万事达卡估计，非洲有20万个网络安全岗位空缺，约相当于现有劳动力总数的四分之一。银行和电信公司争相抢购为数不多的合格工程师和安全分析师。随着人工智能的加速发展，非洲的技能差距正在拉大。
Yet governments are failing to secure the growing number of access points for hackers. That is mainly because there are not enough qualified people who can help them do it. Mastercard, the payments firm, reckons that Africa has 200,000 unfilled cyber-security jobs, equivalent to about a quarter of the current workforce. Banking and telecommunications firms snap up the few qualified engineers and security analysts. As ai accelerates, Africa’s skills gap is widening.
资金是另一个问题。根据国际刑警组织的一项调查，几乎所有非洲成员国都将“资源匮乏”列为改善网络安全的一大障碍。保护数据库代价高昂。由于缺乏合格的本地工程师，软件往往由外国公司安装和管理。进口这些服务会消耗稀缺的外汇。计算机需要可靠的电力，而许多非洲电网无法提供这一点。
Money is another problem. According to a survey by Interpol, nearly all African members cited “resource constraints” as an obstacle to improving cyber-security. Protecting databases is expensive. Software is often installed and managed by foreign firms because there are too few qualified local engineers. Importing these services uses scarce foreign currency. Computers need reliable power, which many African grids do not provide.
一些国家正在努力加强其防御能力。在加纳，企业必须在发现重大违规事件后的一天内向网络安全管理局报告，否则将面临罚款或老板入狱的风险。肯尼亚拥有一个事件响应中心，定期发布有关网络威胁的报告。但其他国家则落后了。非洲大陆只有16个国家批准了旨在鼓励泛非数字标准的非盟《马拉博公约》。
Some countries are trying to bolster their defences. In Ghana, firms must report major breaches to the Cyber Security Authority within a day of spotting them or risk fines or the imprisonment of bosses. Kenya has an incident-response centre that regularly publishes reports on cyber threats. But other countries are lagging behind. Only 16 on the continent have ratified the African Union’s Malabo Convention, which is supposed to encourage pan-African digital standards.
在短期内，各政府正试图鼓励公民更加谨慎。加纳的“保持网络聪明”运动敦促人们保护密码、避免可疑链接并对私人信息保密。负责管理乌干达身份认证工作的罗斯玛丽·基森博表示，“人们在脸书上分享的个人信息”比向政府透露的还要多，在她看来，这表明乌干达人对数据安全采取了松懈的态度。
In the short term, governments are trying to encourage citizens to be more careful. Ghana’s “Be cyber smart” campaign urges people to protect their passwords, avoid dodgy links and keep private information private. Rosemary Kisembo, who runs Uganda’s identity, says that “people share more about themselves on Facebook” than with the government, a sign she takes as Ugandans’ lax approach to data security.
资金和技能方面的差距很难弥合。非洲国家之间在网络连接、计算能力和数字素养方面的巨大差异阻碍了合作。但各国政府本可以采取更多措施来开展合作。共享有关攻击的情报可以帮助它们预测脆弱性。然而，疲软超国家机构以及国家自尊心阻碍了相关努力。
The gaps in funding and skills are difficult to close. Wide variation in connectivity, compute capacity and digital literacy among African countries hinders collaboration. But governments could do more to work together. Sharing intelligence about attacks could help them anticipate vulnerabilities. But weak supranational institutions—and national pride—have hampered efforts.
一些国家否认存在问题。例如，尼日利亚的身份管理机构仍然声称其数据库未受破坏，尽管记者们自2024年以来已经在黑市上发现有国民身份证号出售。如果不首先识别出问题，就很难将其解决。
Some countries deny there is an issue. Nigeria’s identity-management body, for example, still claims that its database was not compromised, even though journalists have found national-identification numbers for sale on the black market since 2024. It is hard to solve the problem unless it is identified first. ■