Keypoints:
- CSA seeks new arrest and funding powers
- Critics warn of overreach and innovation risk
- Free speech and privacy concerns intensify
GHANA’S Cyber Security Authority (CSA) has come under growing public criticism over a proposed amendment to the 2020 Cybersecurity Act that would significantly expand its powers. The Authority says the changes are necessary to strengthen national cyber resilience, but critics argue the move risks excessive state control and could suppress innovation.
Created in 2020 to prevent and respond to digital threats, the CSA plays a central role in Ghana’s online safety strategy. The amendment, now before Parliament, seeks to give the regulator new enforcement and funding powers. Under the proposed Section 20B, the CSA’s Director-General, Deputy Director-General, and authorised officers would gain powers to arrest, search, and seize assets during cybercrime investigations, acting under the authority of the Attorney General. The bill also empowers the CSA to recover proceeds from cyber offences.
The proposal includes the formation of a Joint Cybersecurity Committee featuring the National Communications Authority, Bank of Ghana, and Financial Intelligence Centre, which will help coordinate national cybersecurity initiatives.
Industry fears regulatory overreach
Supporters of the bill say it will enable faster responses to cybercrime, but civil society groups and technology experts have raised alarm about possible overreach. They warn that the CSA’s expanded remit to set standards for emerging technologies such as artificial intelligence and blockchain could stifle experimentation and discourage investment.
‘While it’s important to secure our digital ecosystem, we must be careful not to suffocate innovation,’ one cybersecurity analyst told Africa Briefing.
Defining critical infrastructure raises concern
The amendment also grants the Minister for Communications the authority to designate what constitutes critical information infrastructure (CII), including defence, finance, utilities, and emergency services. Once designated, such systems would be subject to detailed regulations published in the Gazette.
However, the minister’s ability to classify ‘any other services’ as critical has raised concern about unchecked discretion. Transparency advocates have also criticised a subtle wording change: while designations ‘shall’ be published in the Gazette, withdrawals ‘may’ be published — a shift that could allow reclassification without public notice.
CSA’s new funding model questioned
The amendment introduces new funding streams that could significantly boost the CSA’s income. In addition to parliamentary allocations, the Authority would receive 50 percent of fines imposed under the Act, 9 percent of corporate tax, and 12 percent of the communications service tax. It would also collect levies on Bank of Ghana–licensed institutions and a share of government e-service fees.
According to Ghana’s Annual Tax Report, these provisions could generate more than GH₵3.53bn ($336 million) in additional revenue. Critics warn, however, that tying the Authority’s finances to fines could encourage over-enforcement.
Licensing and certification for professionals
Beyond institutions, the amendment regulates individual practitioners. Cybersecurity professionals will be prohibited from operating without CSA accreditation, and anyone offering paid services must obtain a licence. Even non-profit practitioners must be certified.
The Authority will also establish a national certification scheme for cybersecurity professionals and service providers, including those issuing local cyber hygiene certifications akin to ISO 27001 or NIST standards. The CSA will also set limits on certification fees.
Child protection and online harassment
Some proposals in the amendment have drawn praise. The bill introduces new provisions protecting children and vulnerable groups from cyberbullying, cyberstalking, and online harassment. It compels social media and gaming platforms to implement stronger safety protocols for minors.
Cyberbullying is defined as digital communication that undermines dignity or causes fear, distress, or harm. Parents are exempt from monitoring restrictions when acting to protect their children.
Misinformation clause sparks free speech alarm
Another controversial provision criminalises the spread of misleading information online. While the CSA argues it targets harmful disinformation, legal experts warn the vague language could be used to silence dissent.
‘I think it represents unhealthy state control and could clamp down on free speech,’ said Princess, a technology lawyer. ‘Without a clear definition of misleading information, enforcement could become arbitrary.’
Although the CSA insists that searches, seizures, and prosecutions will still require approval from the Attorney General and the High Court, some observers remain sceptical. Ghana’s overburdened courts, critics say, may struggle to provide the necessary oversight.
‘At the end of the day, both are government institutions,’ Princess added. ‘I’m not sure citizens’ rights would always be prioritised over administrative convenience.’
