Curbing cybercrime

As the information technology (IT) revolution continues to gather pace in Nigerian business, the country must become more aware of the growing dangers of cybercrime and ensure that comprehensive measures are taken to reduce its negative impact to the barest minimum.

Even for a developing nation like Nigeria, the deleterious effects of cybercrime are far too significant to be ignored. It is estimated that 60 per cent of businesses in the country suffer at least one cyber-attack annually. This has resulted in annual losses of about N127 billion, according to the Cyber Security Experts Association of Nigeria (CSEAN).

The attacks take a variety of forms, including phishing attacks (fraudulent attempts to obtain sensitive information online), the installation of malicious software (malware) and ransomware, as well as cryptojacking (using victims’ computers to mine cryptocurrencies). These attacks come in addition to older crimes like spoofing (hacking emails to obtain money or sensitive information), identity theft, love scams and cyber Ponzi schemes.

They are being perpetrated by Nigeria’s ever-growing army of unemployed and underemployed youth. Intelligent, frustrated and determined to gain access to the wealth being flaunted openly by their more successful peers, these youths have taken advantage of cybercrime’s anonymity, stealth and extreme profitability.

The situation is further aggravated by the surprising naivety of many local businesses to the cybercrime threat, especially small and medium-scale enterprises (SMEs). Organisations that routinely take comprehensive steps to secure their physical security apparently cannot understand that cybersecurity requires even greater levels of attention.

The 2017 Nigerian Cyber Security Report found that over 95 per cent of the country’s businesses do not have a specific budget for tackling cyber threats. IT units in many firms often have to make specific demands for cyber solutions before company managements approve them. Such arbitrary responses only make it easier for hackers and other cybercriminals to perpetrate their crimes.

Any robust response to the country’s increasing cybersecurity threat must begin at the level of policy formulation. In 2015, Nigeria promulgated a Cybercrimes (Prohibition, Prevention, Etc.) Act which sought to regulate the use of the Internet and computer-based information in order to deter cybercrime. Hacking is punishable by a fine of up to N10 million or a five-year prison term. Identity theft carries a N7 million fine, or three years’ imprisonment, or both.

It is doubtful whether these relatively small penalties can deter criminals from the huge amounts they can realise from cybercrime, but efforts must be made to ensure that they are properly enforced. Too often, law-enforcement agents seem to be merely content to extort money from many of the so-called “Yahoo Boys” they apprehend. If that trend is not halted, cybercriminals will simply write off such shakedowns as an operational expense.

Enlightenment is another important anti-cybercrime strategy. Businesses and institutions need to be fully aware of the nature of the threat they are up against. Groups like CSEAN, the Nigeria Computer Society (NCS), the Institute of Chartered Accountants of Nigeria (ICAN), and the Chartered Institute of Bankers of Nigeria (CIBN) must be more proactive in educating their members about the dangers of cybercrime. When businesses and professionals understand exactly how cybercrime can negatively affect their operations, they will be more amenable to securing themselves against it.

Initiatives like the Central Bank of Nigeria’s (CBN) Risk-Based Cybersecurity Framework and Guidelines for Deposit Money Banks (DMBs) and Payment Service Providers (PSPs) are a good response to the cybercrime menace. The framework outlines the minimum requirements DMBs and PSPs must establish in their cybersecurity programmes, and by so doing, compels them to recruit the requisite personnel, meet laid-down standards of cybersecurity and enforce them throughout their organisations.

If other regulatory bodies can ensure that similar standards are put in place for other sectors of the economy, Nigeria will be better able to fight off a danger which could severely affect its ability to do business.