1. Results IGF African Survey United Nations Economic Commission for Africa (ECA)

2. African Survey Results  The World Conference on International Telecommunications (WCIT) organised in Dubai in December 2012 brought to light that spam was a major issue in developing nations.  Where the topic had lost some if not all of the interest of policymakers in developed nations.  The internet industry is very successful at filtering email traffic and keeping spam from their costumer’s inboxes.  Two realities emerged this way. As the facts and figures in this report shows, there is a third reality, as the problem of unsolicited communication has not gone away everywhere.

3.  How bad is the situation in developing nations?  This Forum decided to try and find grassroot data.  With the assistance of the African IGF secretariat a list of very basic questions was sent to the membership of the African IGF. This led to 15 responses.  Responses which are based on personal experience and knowledge of the current situation in a specific country.  The Forum does not claim that the results are scientifically sound and representative.  At best the answers tell the personal experience of the people who took the time to answer the questions. African Survey Results

4. Q1. Are unsolicited communications a problem in your country/institution? Yes/no African Survey Results

5. Q2. Does your country have an anti-spam law in place? Yes 0 No14 Planning 1 Q.3 Does your country have a computer crime law in place? Yes5 No6 Planning4 African Survey Results

6. Q4. Do Internet Service Providers implement best practices to prevent unsolicited communications from reaching end users? Yes 1 No 14 Q5. Are ISPs nationally owned or subsidiaries of larger, international corporations? Nationally10 Internationally 5 Q6. Are there any public awareness campaigns in your country concerning cyber security? Yes7 No6 Planning2 African Survey Results

7. Q7. What would you prefer to change first in your country where cyber security is concerned? African Survey Results

8. Q8. What does you country need foremost concerning cyber security? Next to the fact that the answer to this question on what needs action foremost is always subjective, the views really differ. Added to this is perhaps the realisation that the different solutions bring different time frames with them. Creating a CSIRT is very different from starting awareness campaigns, as starting education programs is different from starting a legal process. Standing out is one of the answer that is totally different from all others i.e. Most computers here are second hand, so always more insecure. The approach they advocate first also differs from who to target. The consumer/end user, lawmakers, the ICT industry? All come with specific choices of what has to be dealt with first.  What all answers point to, is that the participants point out that in their respective countries many first, basic steps still need to be carried out, but that all participants see and feel the urgency to act in one form or another. African Survey Results

9. Q9. If training were to be made available, who need this training? African Survey Results

10. Q10. What should in your opinion be part of this training program?  This questions was interpreted in two ways: Organisations and Topics. As the organisations were covered in Q9, the focus here is more on the topics that were identified is prime actions. The question was open, so answers are quite divers. Awareness programs range high, the intended recipients are diverse. From end users to government personnel or industry representatives. African Survey Results Several contributions mention very specific actions. People have to learn how to make a distinction between a spam message and a genuine one. To learn through internships and exchange programs. The balance between Privacy Protection and the Rights to Open Access to Information. In very different wordings the need for training is voiced by nearly all participants.

11. Q11 Are there multi-stakeholder cooperation initiatives in your country or regionally that deal with the mitigation of cyber security and/or unsolicited communications? Yes, nationally5 No8 yes, regionally2 African Survey Results Q12. Are there cyber education tracks in schools or universities in your country or specific digital training courses available?

12. Q13. Do you have one or more cases that could be presented as an example to the world where mitigation of unsolicited communication succeeded, failed or never started while it was intended to do so? Please provide details in the form of a limited sized case study. Cyber Usalama is an awareness raising website in Kenia, where threats are shown and explained and warnings issued. It works in cooperation with an industry CSIRT called tespok iCSIRT.. The National Telecom Regulator (Nigerian Communications Commission, NCC), gave a directive to all telecom operators in the country, stating that all network providers should not send more than 3 unsolicited short message service (SMS) message to users, in a day. This directive has been strictly adhered to, and this has resulted in a reduction in public complaints from network users. Others point to possible solutions, for e.g. introduce Port 25 closing or the need to fight fraud within a country. In Senegal the regulator actively fights unsolicited communications and is successful for the mobile environment. African Survey Results

13. Q14. Are there reports or statistics concerning unsolicited communications available from your country, e.g. from academia, industry, government, etc.? Most participants wrote that they are not aware whether there is local data available or that data is fully lacking. On the other hand it was reported that all regulators in Africa noshould have relevant data. Another table exceptions is the already mentioned website in Kenia: http://www.cyberusalama.co.ke/. It publishes cyber security reports which are publically available. One person mentioned that there is data on unsolicited communication in his country, but it has not been made publicly available. African Survey Results

14.  As the BPF has made clear, it is impossible to conclude much from so little, but quite motivated respondents.  If conclusions are allowed to be drawn here, it ought to be that all participants feel a need for change.  All receive unsolicited communication in different guises, most are aware of the many online threats and see them occurring in their respective nations.  They report that in most countries elementary measures are wanting and that there is a need for capacity building at the most basic levels.  Several wished for solutions are time consuming. A law drafting process is long and does not aid anyone in the meantime.  The same goes for the institution of a CSIRT. African Survey Results Results

15.  On the positive side the Forum could conclude that quick wins are for the taking. If the right people are brought into contact with each other, the solution for the more elementary challenges may be closer than we think today.  It may well be that mutual benefits could be identified simply by establishing contact. African Survey Results  There are several other actions possible that look at basic online sanitary measures at network level, awareness raising through a mobile, radio or tv adds to help people understand the difference between real and fraud.  Actions like this could be quick wins that all will profit from, while larger, more complex actions take place in the background. Results

16.  How to take first steps?  In what way can the right people be reached?  Can the continental, regional and national IGFs in the developing nations play a role in laying the first contact between stakeholders?  If so what could be next steps?  If not, what lines need to be cast? African Survey Results Results

17. Thank You!