In this edition of Telecoms Clinic@ITREALMS, REMMY NWEKE investigates Nigeria’s cybersecurity funding and digital safety, and using FOI will uncover how investments align or fail to align with real national protection outcomes.
In today’s hyperconnected world, the integrity of Nigeria’s digital landscape stands as a defining marker of national resilience. From online banking to e-government platforms, from voter registration databases to smart transportation grids, the nation’s future is increasingly written in code and hosted in cyberspace. Yet, as dependency on digital systems grows, so too does vulnerability, and so must accountability. 
Over the past decade, Nigeria has witnessed a surge in both government and private-sector spending on cybersecurity. Reports of multimillion-naira allocations appear annually in national budgets, alongside initiatives labeled “cyber defense,” “digital safety,” “critical infrastructure protection,” or “national security modernization.” Unfortunately, the same reports rarely show detailed outcomes or impact metrics.
This opaqueness raises a fundamental question: How secure is Nigeria, really, and where exactly is the money going?
This opaqueness raises a fundamental question: How secure is Nigeria, really, and where exactly is the money going?
A Billion-Naira blind spot:
Cybersecurity funding has become one of the most ambiguous entries in Nigeria’s public expenditure ledger. While physical infrastructure projects like roads, bridges, or schools leave visible traces, cyber investments are intangible; encrypted servers, proprietary software, capacity-building sessions, or private contractor engagements.
In the 2024 national budget, for example, cybersecurity and ICT-related allocations collectively exceeded ₦70 billion across ministries, departments, and agencies (MDAs). Some of these funds were justified as part of “Digital Nigeria” goals or “e-governance enhancement.”
Others were nested under defense, intelligence, or communications votes. However, beyond line items and political announcements, few Nigerians can confidently point to how these funds were utilized, or how they translated into better digital safety for citizens and institutions.
That opacity is not just a bureaucratic gap; it is a national risk. When cybersecurity spending becomes untraceable, the country’s ability to evaluate its own resilience is compromised. A nation that cannot measure its protection cannot manage its exposure.
That opacity is not just a bureaucratic gap; it is a national risk. When cybersecurity spending becomes untraceable, the country’s ability to evaluate its own resilience is compromised. A nation that cannot measure its protection cannot manage its exposure.
FOI: Citizen’s lens into digital shadows:
This is where the Freedom of Information (FOI) Act 2011 becomes vital. The Act empowers any Nigerian to request details about how public funds are allocated, disbursed, and accounted for.
In a domain as sensitive and technical as cybersecurity, FOI provides a democratic counterweight; ensuring that secrecy justified by “national security” does not become a convenient cover for inefficiency or corruption.
Through FOI requests, civil society organizations, researchers, and professional journalists, could demand transparency in the implementation of cybersecurity programmes.
Through FOI requests, civil society organizations, researchers, and professional journalists, could demand transparency in the implementation of cybersecurity programmes.
For instance, one might ask the National Information Technology Development Agency (NITDA) or the Office of the National Security Adviser (ONSA) for detailed expenditure reports on cybersecurity training, digital forensic labs, or data protection initiatives.
Such scrutiny not only tracks fiscal responsibility but also promotes policy learning. By mapping where resources flow and whether they produce measurable outcomes, stakeholders can identify overlaps, funding leaks, or capacity gaps.
The FOI Act essentially becomes a digital audit trail; one that allows citizens to connect budget promises with operational realities.
Such scrutiny not only tracks fiscal responsibility but also promotes policy learning. By mapping where resources flow and whether they produce measurable outcomes, stakeholders can identify overlaps, funding leaks, or capacity gaps.
The FOI Act essentially becomes a digital audit trail; one that allows citizens to connect budget promises with operational realities.
Between cybersecurity and national security:
Critics often argue that cybersecurity funding should remain classified to prevent sensitive intelligence leaks. While there is merit to protecting operational details, the pendulum has swung too far toward opacity. Nigeria’s cybersecurity spending, in many instances, is treated as though transparency itself were a threat.
Yet, in mature democracies, governments routinely publish sanitized versions of cybersecurity budgets and outcomes. For example, the United States’ Cybersecurity and Infrastructure Security Agency (CISA) releases annual performance reports, while the United Kingdom’s National Cyber Security Centre (NCSC) issues public updates on progress and spending efficiency. These disclosures do not compromise national safety; they enhance public trust and justify taxpayer investment.
In Nigeria’s case, the absence of similar accountability frameworks breeds skepticism. It blurs the line between national defense and administrative secrecy. Worse still, it deprives local innovators and cybersecurity professionals of valuable insights into policy priorities and funding opportunities.
From budget to broadband:
Let us imagine tracing a single cybersecurity line item, say, ₦2 billion allocated for “Digital Threat Intelligence Systems.” An FOI-driven investigation might reveal that only ₦1.2 billion was released, out of which ₦800 million went to a subcontractor, ₦200 million to hardware procurement, and ₦100 million to capacity building.
That granular visibility allows both policymakers and the public to assess performance and identify weak links. If multiple MDAs fund overlapping threat-monitoring platforms, the FOI process can expose duplication and prompt consolidation.
The same principle applies to cybersecurity-related initiatives in the private sector that benefit from government grants or partnerships. Telecoms companies, fintechs, and data processors often collaborate with ministries or agencies under “public-private partnerships.” Citizens deserve to know whether those collaborations are truly securing networks or merely recycling budgetary allocations.
Transparency, in this sense, becomes the bridge between digital development and digital integrity.
Let us imagine tracing a single cybersecurity line item, say, ₦2 billion allocated for “Digital Threat Intelligence Systems.” An FOI-driven investigation might reveal that only ₦1.2 billion was released, out of which ₦800 million went to a subcontractor, ₦200 million to hardware procurement, and ₦100 million to capacity building.
That granular visibility allows both policymakers and the public to assess performance and identify weak links. If multiple MDAs fund overlapping threat-monitoring platforms, the FOI process can expose duplication and prompt consolidation.
The same principle applies to cybersecurity-related initiatives in the private sector that benefit from government grants or partnerships. Telecoms companies, fintechs, and data processors often collaborate with ministries or agencies under “public-private partnerships.” Citizens deserve to know whether those collaborations are truly securing networks or merely recycling budgetary allocations.
Transparency, in this sense, becomes the bridge between digital development and digital integrity.
From digital safety to digital trust:
Every successful cybersecurity system rests on trust, between government and citizens, regulators and operators, users and platforms.
When people trust that their personal data, online transactions, and digital identities are protected, they participate more fully in the digital economy. Conversely, when breaches occur and accountability falters, confidence evaporates.
Nigeria has suffered its share of high-profile breaches, from compromised government portals to stolen citizen data. Yet post-incident reports are seldom made public. Victims rarely receive official notification or compensation, and lessons learned are buried in bureaucratic silence.
The FOI Act can disrupt this pattern by enforcing transparency after cyber incidents. Demanding disclosure of response timelines, forensic findings, and mitigation costs ensures that cybersecurity becomes not just a technical reaction but a public accountability process.
Transparency, in this regard, is not an optional virtue, it is a strategic defense mechanism.
Nigeria has suffered its share of high-profile breaches, from compromised government portals to stolen citizen data. Yet post-incident reports are seldom made public. Victims rarely receive official notification or compensation, and lessons learned are buried in bureaucratic silence.
The FOI Act can disrupt this pattern by enforcing transparency after cyber incidents. Demanding disclosure of response timelines, forensic findings, and mitigation costs ensures that cybersecurity becomes not just a technical reaction but a public accountability process.
Transparency, in this regard, is not an optional virtue, it is a strategic defense mechanism.
Accountability gap:
Across Africa, the gap between cybersecurity investments and actual outcomes remains wide. Nigeria’s experience mirrors that of several developing nations that commit large budgets but see limited measurable improvement in threat detection, response time, or citizen awareness.
Part of the problem is input-based reporting, officials announce how much was “spent” rather than what was “achieved.” Without performance indicators, such as the reduction of phishing incidents in government networks or the number of trained cybersecurity professionals, funding becomes performative.
Through FOI, stakeholders can request progress indicators tied to each expenditure. How many incidents were prevented after investing ₦1 billion in intrusion detection? How many agencies achieved compliance with the Nigeria Data Protection Act (NDPA)? How much of the cybersecurity budget goes to human capacity building versus software licensing?
By tracking both inputs and outputs, FOI transforms passive oversight into active performance monitoring.
Role of civil society and media:
Civil society organizations, academia, and investigative journalists play an indispensable role in bridging the awareness gap. Groups like Paradigm Initiative and SERAP have already used FOI tools to uncover irregularities in ICT spending. Their work demonstrates how citizen vigilance can drive systemic reform.
The media, particularly specialized platforms like Telecoms Clinic@ITREALMS, serve as translators; decoding technical jargon for public understanding. Journalists can spotlight inconsistencies, compare agency responses, and amplify calls for reform. When such stories gain traction, they compel bureaucracies to evolve from secrecy to accountability.
Moreover, collaborative journalism, combining data analysts, legal experts, and technologists; can strengthen FOI-based inquiries into cybersecurity expenditure.
Imagine an annual “Cybersecurity Accountability Index” tracking how transparent various MDAs are in responding to FOI requests. That alone could incentivize compliance and set new standards for governance.
FOI meets data protection:
Interestingly, the FOI Act and the Nigeria Data Protection Act (NDPA) share a common philosophical foundation, the right to know and the right to be protected. While FOI empowers citizens to access information held by the state, NDPA ensures their personal data is processed responsibly by both public and private entities.
Together, these instruments can create a holistic framework for digital rights: one emphasizing both transparency and security. By integrating FOI-based accountability into NDPA enforcement, Nigeria could pioneer a model of “open cybersecurity” one that aligns fiscal disclosure with data protection ethics.
In practice, this means cybersecurity agencies not only safeguarding national networks but also reporting clearly on how they handle personal data and how public funds are used to protect it.
From secrecy to shared responsibility:
Cybersecurity is not just a government responsibility; it is a shared ecosystem. Telecom operators, fintech startups, cloud service providers, and even ordinary citizens all play roles in maintaining digital hygiene.
However, the ecosystem thrives only when trust and transparency flow in both directions. Government must disclose how public funds are deployed, while private actors must adhere to disclosure standards in their partnerships.
The FOI Act provides the framework for this equilibrium; transforming citizens from passive observers into informed participants in digital nation-building.
Securing trust in digital republic:
As Nigeria navigates its path toward a fully digital economy, cybersecurity stands as the invisible scaffolding holding everything together. Yet no matter how sophisticated the technology, the system collapses without transparency and accountability.
The road to a secure digital nation does not begin with more firewalls or bigger budgets; it begins with fairness and openness. The FOI Act is more than a legal instrument, it is the moral infrastructure of Nigeria’s cybersecurity architecture.
By using FOI to track investments against results, Nigeria can turn cybersecurity from a secretive expenditure into a public covenant; one that protects not just networks and data, but democracy itself.
No comments:
Post a Comment