The jury is still out on whether Nigeria has technically or tactically won the war against the Boko Haram insurgents. The government is also in frantic in its efforts to recover money approved for arms purchase but was allegedly diverted to other uses. While our budget for bomber jets, guns, bombs and other military hardware are on an upward swing, it is necessary to state that the warfare of the 21st century is going from hardware to software.
As the harsh economic realities become more biting, unemployment is growing, racial and religious pejoratives becoming more pronounced so also would the dimensions of conflict, terror and brigandage become more unpredictable. These conclusions do not come from a cryptic globe reader, but the prophecies of tomorrow are in the history books already.
The nation has creditably developed capacity for conventional warfare, so also are disgruntled elements developing capacity and deploying unconventional tactics to hamstring the government. This is possible because of the boundless intellectual capacity and growing angst of the average Nigerian youth. In a cyber-based subversive attack, borders need not be crossed, no need to throw bombs, no hostage needs to be kidnapped and terrorists do not need to be blown to shreds. Cyber terrorism targets critical national information infrastructure to cripple economy, cause massive deaths and create a sense of siege. This is the potential of a cyber-terrorist attack.
Cyber terrorism is a conglomeration of cybernetics and terrorism. The US Federal Bureau of Investigation (FBI) in a 2004 report, defined cyber terrorism as the premeditated, politically motivated attack against information, computer systems, computer programs and data which result in violence against non-combatant targets by sub-national groups and clandestine agents. Statutory definition of cyber terrorism in Nigeria can be gotten by a combined reading of Section 18. (1) of the Cybercrimes Act 2015 and section 1(2) of the Terrorism Prevention Act of 2011.
Section 18. (1) of the Cybercrimes Act 2015 says- Any person that accesses or causes to be accessed any computer or computer system or network for purposes of terrorism, commits an offence and is liable on conviction to life imprisonment.
Section 1(2) of the Terrorism Prevention Act of 2011 is rendered thus-
(2) In this section, “act of terrorism” means an act which is deliberately done with malice, aforethought and which:
(a) may seriously harm or damage a country or an international organization; (b) is intended or can reasonably be regarded as having been intended to—
(i) unduly compel a government or international organization to perform or abstain from performing any act; (ii)seriously intimidate a population; (iii)seriously destabilize or destroy the fundamental political, constitutional, economic or social structures of a country or an international organization; or (iv)otherwise influence such government or international organization by intimidation or coercion…
From the foregoing, I define cyber terrorism as the illegal use of computer or computer network to deliberately harm, damage, unduly compel, seriously intimidate, destabilise or coerce a government or international organisation to do or refrain from doing a particular thing in furtherance of the terrorists soci0-economic, political or religious agenda.
Cyber warfare incidents against countries started gaining prominence after Estonia attack in 2007, Georgia in 2008 and the most prominent being the Stuxnet attack on the Iranian Nuclear reactor complex in 2010. The software, with more than 4 000 functions, was developed to focus on computer systems running software that is usually used to control critical infrastructure. The attack almost succeeded in ending the Iranian Uranium enrichment program. Fingers have been pointed at the United State’s CIA and Israel’s MOSSAD as the brain behind the virus, however, no investigative report has given a categorical answer to who was behind the attack.
It is necessary to understand the implication and ramification of Critical National Information Infrastructure (CNII). Section 3 (1) of the Cybercrime Act empowers the President, on the recommendation of the National Security Adviser to designate certain computer systems, and/or networks, whether physical or virtual, and/or the computer programmes, computer data and/or traffic data vital in Nigeria, that the incapacity or destruction of or interference with such system and assets would have a debilitating impact on security, national or economic security, national public health and safety, or any combination of those matters as constituting Critical National Information Infrastructure. This designation takes effect only upon being gazetted.
The nature of a CNII according to the above provision includes-
- a) Computer systems, cyber networks or traffic data;
- b) The infrastructure is vital to Nigeria;
- c) Incapacity or destruction of the CNII would affect security, public health and safety or any of its combination.
Permit me to suggest some information infrastructure we can consider critical to our nation today – Nigcomsat control centre, Galaxy Backbone, NITEL and private telecoms operators infrastructure, Transmission Company of Nigeria control centre and base stations, internet service stations etc.
Our cyber security preparedness is undoubtedly at the lowest ebb; however, we must now fast-forward to cover sufficient grounds. The first issue to be addressed is the designation of critical national infrastructure. This is not a walk-in-the-park assignment that could be dictated by a smart administrator ensconced in his cosy office. It takes a lot of technical, legal and administrative input from all stakeholders. To designate infrastructure as critical to the nation, it is best to identify our most critical sectors. The European Union identified 11 sectors it considers critical. They are: i) Energy; ii) Information, Communication Technologies (ICT); iii) Water; iv) Food; v. Health; vi) Financial; vii) Public & Legal Order and Safety; viii) Civil Administration; ix) Transport; x) Chemical and Nuclear Industry; xi) Space and Research.
The European recommended list is not even accepted by all EU members as it varies according to national priorities. For example, apart from dreamy notions by some academics and politicians, Nigeria has no nuclear industry, so that may not be a critical sector to be protected at the moment.
Imagine the gory prospect of some hot-headed separatist insurgents who write software to hijack the air control system of our major airports during a major international football tournament. Imagine aircrafts crashing into another, fire engines whirling and confused people running around, it is an unpleasant picture indeed. Consider another possibility of a, Manitoba, the consultants engaged to manage the Transmission Company of Nigeria (TCN), recruiting a computer analyst who doubles as an insurgent, with access to the control room, using a flash drive which automatically installed a deadly virus that succeeded in shutting down power transmission. The effect of this would be loss of hundreds of lives, billions of naira among many others.
What the nation does in the light of these realities is what would make it a true giant of Africa or an over-bloated balloon structure. Since the National Security Adviser is charged with coordinating our cyber response, that office should prioritise the designation of critical national information infrastructure. Furthermore, at least 20,000 computer savvy youths should be recruited from the large pool of talented white-hat and black-hat operators to monitor our cyberspace and act as our cyber army. The Police and other security agencies should be retrained and retooled to be cyber-crime and cyber-warfare ready.
The question is not if it would happen, it’s when it would.
- Daniel is the author of Introduction to Computer Law in Nigeria
