Africa’s Biggest Ever Data Leak?
On Thursday, the 20th of June, 2024, Paradigm Initiative, a non-governmental organisation advocating for digital inclusion and the protection of digital rights in Africa, blew the lid on the largest-ever data leak in Nigerian history and African history. What’s more? They claim to have the sensitive personal details of Olatunbosun Tijani, Nigeria’s Minister of Communications, Innovation, and Digital Economy, as evidence of the humongous data leak.
According to the NGO, the mother of all databases in Nigeria, the National Identity Database, which is run by the National Identity Management Commission, NIMC — a government body, has been compromised, giving rouge websites like AnyVerify.com.ng access to the personal data of 104.16 million people.
We are talking name, sex, phone number, home address, fingerprint, email address, National Identity Number, NIN — that’s Nigeria’s version of social security number — Bank Verification Number, BVN — which is necessary to be banked in Nigeria, driver license, voter card, international passport, Tax Identification Number, TIN of 104.16 million people.
For context, 104.16 million people are 10 million shy of Ethiopia’s population — Africa’s second-largest; that’s, of course, second to the continent’s giant Nigeria, which boasts over 200 million people.
And what did rogue sites like AnyVerify.com.ng do with the treasure trove of data they found in Nigeria’s biggest data vault? They sold it!
According to Paradigm Initiative, the NGO whose investigations uncovered the conspiracy, AnyVerify.com.ng and other rogue websites over the internet sold, to any willing buyer, personal data which 104.16 million Nigerians and foreigners alike entrusted the Nigerian government with, for as low as 100 naira, about 7 cents.
Hold the thought that foreigners’ personal information was also leaked; I will shed more light on it sooner than later.
Spicing up the scandal, Paradigm Initiative claimed that AnyVerify.com.ng, which seems to be the focus of their investigation, was set up in November 2023 and has been visited about 567,000 times. By who? Who knows? Maybe Paradigm Initiative, the NGO that uncovered and exploited the rogue website to buy the Minister’s sensitive information for “investigation” purposes.
Trolling aside, there are countless bad actors out there, like scammers who need the personal data of unsuspecting victims for their own malevolent selfish gains.
Interestingly, before Paradigm Initiative came out about AnyVerify.com.ng in June 2024, the Foundation for Investigative Journalism on 16th March 2024 raised alarm over XpressVerify.com. Sound familiar? That’s because it is. XpressVerify.com had the same business model as AnyVerify.com.ng. They both had unrestricted access to Nigeria’s National Identity Database in the custody of NIMC, and both exploited their access to it for money.
They, however, differed in price: XpressVerify.com was twice as pricy as its successor, AnyVerify.com.ng. With 200 naira, about 13 cents which can be used to purchase gala — a famous street snack — on the streets of a busy motor park somewhere in Lagos, a fraudster or other malicious actors like terrorists could have bought from XpressVerify.com whichever personal data of whomsoever they desired from a menu of 104.16 million people. An internet fraudster obviously would be more inclined to obtain an unsuspecting victim’s Bank Verification Number, BVN, to complete an elaborate online bank scam. A terrorist, on the other hand, may be more concerned with their potential victim’s home address or phone number to carry out whatever act of terror on them.
Before we go forward, we need to understand Nigeria’s National Identity Database, its significance, and how it operates.
Nigeria’s National Identity Database is the government’s most remarkable attempt to date to amass comprehensive amounts of data on people within its borders, such as its citizens and foreigners who have been resident in Nigeria for two years and upward. Why? One of the objectives spelled out in the law establishing NIMC’s identity database is harmonizing Nigeria’s existing identity card schemes, such as driver’s licenses, voter cards, international passports, etc. I think the idea is that the Multipurpose Identity Card that is to be issued by the NIMC can, as the name suggests, be used for multiple purposes like voting, driving, traveling, etc.
Another reason NIMC’s database was established is to provide a secure and reliable method for ascertaining, obtaining, maintaining, and preserving information about Nigerian citizens and other registrable persons like foreigners resident in Nigeria for two years or more. It then begs the question, who is being provided access to Nigeria’s most comprehensive database?
Interestingly, aside from providing the police and courts access to NIMC’s database when it is considered to be in “public interest,” the law leaves the Commission, that’s, NIMC, with the discretion to decide who and who to license access to the database. Because of the nature of their operations, banks, fintechs, and government agencies like the Corporate Affairs Commission CAC are known to have licenses to access NIMC’s identity database. Banks and fintechs need access to the database to verify their customers’ BVN and NIN details. At the same time, CAC requires NIN verification to register a person as an accredited CAC agent.
Nevertheless, when alarm was raised in March 2024 about XpressVerify.com’s data for money scandal, NIMC inadvertently denied that XpressVerify.com was a “licensed partner” without expressly denying that XpressVerify.com had access to the personal data of 104.16 million people. The Nigeria Data Protection Commission, NDPC, Nigeria’s data protection authority, immediately swung into action to investigate the leak and the possible perpetrators. To date, the NDPC has not come forward to the public about the source of the leak, so much for transparency.
However, in response to the first XpressVerify.com scandal that broke out in March 2024, the NIMC first restricted all entities’ access to the national identity database before reinstating access specifically to entities that provide “essential services.” As I’m writing this, I can’t register as an agent with CAC because CAC is apparently not considered to be providing an essential service to warrant providing them with access to the identity database.
Nevertheless, when the second and most recent data for money scandal, that’s AnyVerify.com.ng, broke out in June 2024, the Nigerian government, through the NIMC, took a different, more shrouded approach of blatantly denying Paradigm’s claims that rogue websites like AnyVerify.com.ng had access to the national identity database and are monetizing such access for money.
NIMC’s theory to explain away the data exposure is that rogue sites like AnyVerify.com.ng are “data harvesters” who gather and sell the personal information of people who sign up on their websites for their services — that’s illicit data sale.
Of course, speaking hypothetically, the implications of NIMC’s data leak in Nigeria would indeed be far-reaching. First and foremost is the breach of privacy and trust. I don’t think anyone would ordinarily want their sensitive personal data like their name, age, sex, phone number, and house address out on the internet unless they are making money off it or trading them for services like social media. Forgive the redundancy. I digress.
The monetization of the personal data entrusted to the Nigerian government by entities that are neither the Nigerian government nor are licensed by the Nigerian government would be a great betrayal to the Nigerian people and a massive sign of incompetence on the part of the Nigerian government.
There’d be the pervasion of crimes, especially bank scams, to worry about, with the leak of data as sensitive as those sold by rogue websites like XpressVerify.com and AnyVerify.com.ng.
More so, it would be a chink in Nigeria’s national security to have such copious amounts of its citizens’ sensitive personal data as that contained in NIMC’s identity database out there on the internet to be exploited by local and foreign malicious actors like terrorists or a hostile foreign government for economic, diplomatic or political advantage.
Additionally, and just as significant is the reputational damage a data leak the size of the AnyVerify.com.ng scandal could cost Nigeria. You may think reputation don’t mean much, but a bad reputation can easily translate to business costs, especially in the digital economy. A perfect illustration is the 2015 nullification by the European Court of Justice of the Safe Harbor Agreement, which facilitated the free flow of data between the European Union and the United States. The European Court’s decision was made because the United States government — as it was then revealed by Edward Snowden — had unauthorized access to European personal data.
It is worth remembering that Nigeria’s identity database contains not only the information of its citizens but also that of foreigners who have been residents in Nigeria for two years or more. Paradigm’s claim that Nigeria’s identity database has been compromised would weigh heavily on the Nigerian government and Nigeria as a country. How? A scandal as big as AnyVerify.com.ng could impact the development of Nigeria’s digital economy as other countries would be hesitant to trust the Nigerian government to protect their citizen’s personal data. Without data, the stuff the digital economy is predicated upon, investments in the technology sector, which have in recent years been a major earner of foreign direct investment in Nigeria, will wane.
As you’d expect, the jewel-in-the-crown of the nightmarish scenario of the identity database leak brought forward by Paradigm Initiate would be the economic loss. First, as explained above, malicious actors like scammers, terrorists, and hostile foreign governments could cost the Nigerian government and citizens actual money. Also, as analysed in the preceding paragraph, the AnyVerify.com.ng scandal could scare off much-needed investment in the technology industry, which has been earmarked by the Bola Ahmed Tinubu administration as an avenue for job creation and revenue generation.
Poverty and Artificial Intelligence Adoption in Nigeria, Africa, and the Developing World
Against the backdrop of the recent advancements in artificial intelligence, the dearth of data in a developing country like Nigeria, and the lack of digital infrastructure to store, process, and transmit the data, I second the IMF’s fear that global inequality would rise as much richer countries with the capability will leverage artificial intelligence technology to leapfrog further ahead of poorer countries like Nigeria.
However, as a Pan-Africanist whose life condition reflects that of the broader global south, the poorer parts of the world, I’m not so concerned about the futuristic fourth industrial revolution and all its new shiny technologies like artificial intelligence and blockchain. I’m more concerned about the ports, trains, and big factories that marked the second industrial revolution and the ubiquity of information and connectivity that highlights the third industrial revolution.
I have long maintained that investing money is like climbing a flight of stairs — you are not to jump over many stairs all at once; otherwise, you may swagger across the staircase and gash your forehead or knee or something.
Currently, and into the foreseeable future, sub-Sahara Africa, with the exception of South Africa, remains the poorest and least industrialised region in the world despite its natural resource wealth which has proven to be more detrimental than beneficial. Also, added to the fact that about half of Africa’s population is off the internet, I think it’s too early to sell the idea of artiphisial intelligensi to African countries.
Why do you think about half of Africa’s population is off the internet? Because they have genetic mutations that give them restraint to stay off the internet, which people in the much richer industrialised parts of the world lack? Maybe…
