Africa's cyber diplomacy trajectory has been shaped by a hybrid governance landscape in which external partnerships simultaneously enable capacity development but reinforce regional asymmetries. Will this have implications for an African positioning at the UN Global Mechanism on ICTs.
1. The African Union and Evolution of Cyber Governance
Africa's engagement with cyber governance can be periodised into three phases. The first phase, broadly spanning the late 1990s to approximately 2010, is characterised by concerns about the digital divide and internet access rather than a substantive cybersecurity agenda. The second phase, approximately 2011 to 2020, is defined by the drafting, adoption, and slow ratification of the Malabo Convention. The third phase, from 2020 to the present, is characterised by a more assertive continental posture. The African Union Digital Transformation Strategy (DTS) 2020-2030 reconfigured the normative architecture by linking connectivity and cybersecurity within a development-framed continental strategy.
The adoption of the Common African Position on the Application of International Law to the Use of ICTs in Cyberspace in 2024, marked another achievement signifying a move from a peripheral posture towards one characterised by assertive continental positioning and norm contestation.
2. A Regional Context of Cyber Diplomacy
The tension with the Malabo Convention may be yardstick to define Africa's cyber diplomacy reality as an ambition constrained by structural capacity asymmetries, competing external governance models, and fragmented political commitment. The Convention’s trajectory illuminates the hybrid and contested cyber diplomacy landscape in Africa.
Clear gaps manifest across three dimensions. The first is legal, the absence of cybercrime and cybersecurity legislation aligned with international standards in many African states creates enforcement deficits that undermine cybersecurity and cross-border legal cooperation. The second is technical and institutional, the absence of national CERTs, cybersecurity strategy frameworks, and adequately resourced national cybersecurity agencies means that normative commitments cannot be operationalised. The third is representational, the historical inclusion of African states in the foundational deliberations of global cyber norms, particularly the UNGGE process, has meant that the normative architecture that governs cyberspace was substantially shaped without significant African input.
3. Algeria’s Normative Agency?
A useful case of African norm-shaping is Algeria's leadership of the UN Ad Hoc Committee on the Cybercrime Convention. Algeria's chairing role was substantive for Africa. The Convention had signatures from twenty-one African countries at its opening in 2025, many of which are yet to ratify the Malabo convention. The treaty's explicit prioritisation of international cooperation, and technical assistance and capacity building in developing countries reflects the African negotiating position systematically advanced through the process. This constitutes a demonstration of reciprocal inter-regionalism dynamic, an African state using multilateral procedural authority to reconstitute the normative content of a global instrument in a direction aligned with African governance priorities.
While such ‘diplomatic’ achievement cannot yet be institutionally generalised, on the other hand, the strategic leadership of the UN cybercrime convention process by Algeria whilst not yet ratified the continent's own cybersecurity instrument may still undermine Africa's credibility as a norm-shaping actor.
4. International Cooperation and Limits of Continental Coherence
It would be misleading to represent Africa as a unitary multilateral actor. External cooperation significantly defines the region’s cyber diplomacy landscape. The EU's engagement with Africa operates across three mutually reinforcing channels, normative dialogue, legal harmonisation, and capacity-building. The EU-Africa Cyber Diplomacy Dialogue, institutionalised through the EU Cyber Direct initiative hosted by the EUISS, has provided a structured platform for inter-regional exchange, for example, the EU-Africa Track 1.5 Cyber Diplomacy Dialogue convened in Stellenbosch in February 2026. At the level of legal harmonisation, the EU's influence has been exercised principally through the Budapest Convention on Cybercrime. Thirteen African countries have ratified the Budapest Convention. Through the GLACY+ and now the GLACY-e programme, the EU's programme continues to pursue normative alignment over co-designed governance solutions.
The Commonwealth's contribution to cyber governance in Africa has been exercised principally through implementing its Cyber Declaration Programme across the Commonwealth with the support of the United Kingdom’s Foreign and Commonwealth Office. With Twenty-One African countries among its Member States, the Commonwealth’s regular training of the judiciary in Kenya, Malawi, Ghana and South Africa, the Commonwealth CERT Toolkit for Africa 2025 designed to support the establishment of CERTs in resource-constrained African environments represents a prioritisation of national capacity needs.
The United Kingdom has primarily engaged with cyber governance in Africa through its Africa Cyber Programme, delivering capacity building and policy development for the African Union Commission, and a £2.68 million contribution to INTERPOL's African Joint Operations against Cybercrime (AFJOC). However, the programme's bi-lateral three-country concentration reflects UK strategic priorities, the choice of Nigeria, Kenya, and South Africa, the continent's largest economies and closest UK strategic partners, illustrates the dynamic approach through which capacity-building asymmetry operates in Africa.
China's Digital Silk Road (DSR) represents the most consequential bilateral engagement with Africa's digital infrastructure. The DSR's governance implications for Africa's cyber diplomacy operate through two distinct mechanisms. The first is a technical dependency channel where Chinese-manufactured infrastructure creates long-term maintenance and upgrade dependencies. The second is a normative alignment channel which has seen China link its infrastructure support with diplomatic reciprocity, diffusing a conception of digital sovereignty and state control over the internet. This has found resonance amongst African governments for whom state control over cyberspace is understood as a national security interest. The recent Rights Con 2026 ‘disaster’ witnessed is an example. The consequence is seeing African states with deep Chinese infrastructure dependencies face disincentives to adopt governance frameworks that challenge Chinese normative preferences. This creates intra-African divisions that complicate continental positions in cyber governance.
Russia’s influence also shapes cybersecurity ideologies in Africa. In November 2024, the Foreign Ministers of Russia, African States, and the African Union Commission issued a Joint Statement on Russia-Africa Partnership on measures to create a fair and equitable system of International Information Security. Russia's engagement with Africa has operated through bilateral agreements. The 2017 Russia–South Africa Agreement on Cooperation in Information Security reflects such diplomatic positioning.
5. Fragmentation vs. Reciprocity?
Africa's engagement with external cyber governance partnerships has produced neither broad norm adoption nor general resistance, but a selective appropriation that has progressively shifted the terms of inter-regional dialogue.
The concurrent engagement of African states with EU, Chinese, Russian, UK, and other cyber governance partnerships does not only produce institutional complexity, it generates structural fragmentation risks with consequences for regional cohesion, infrastructure interoperability, and strategic autonomy. This is not merely about diplomatic challenges, but incompatibility produced when competing external partners embed divergent technical standards, legal frameworks, and governance assumptions in institutional settings in ways that cannot be simultaneously maintained without dependencies and challenges. This has also encouraged an individualistic and nationalistic approach to cyber governance unlike the harmonized model of the EU and its member countries.
The Malabo Convention's failure to attract the fifteen ratifications required for entry into force until May 2023 is not simply a story of political disinterest. It reflects a landscape created by competing demands. African governments were simultaneously being advised, funded, and incentivized to adopt the Budapest Convention, and external partners offering investment in exchange for alignment with digital governance ideologies. For many governments, ratifying the Malabo Convention imposed institutional compliance costs. Since its adoption in 2014, only twenty African countries out of the AU’s Fifty-Five Member states have ratified the Convention.
The fragmentation risk is however not a problem purely imposed from outside on passive African states. Some African governments have actively instrumentalised external partnerships as a strategy for managing geopolitical dependencies and maximising benefits. This pattern has implications for regional cohesion within the framework of the UN Global Mechanism on ICTs and the participation of states is not simultaneously influenced by the African Union, like the European Union.
6. Reciprocal Inter-Regionalism and the Global Mechanism on ICTs Security
Reciprocal inter-regionalism will support structured engagement between regions characterised by the co-production of normative frameworks and institutional capacity, rather than a unidirectional transfer of norms from a dominant exporting region to a passive receiving one.
Africa can shape the multilateral process by exercising normative agency, not just a capacity to receive or resist externally propagated norms but to instrumentalise inter-regional relationships as a platform for projecting its governance preferences. This also means supporting institutional conditions which enhance participation of all Fifty-Five AU Member States rather than decisions left to the contingent leadership of a few diplomatically strong African states through the so-called ‘Africa Group’.
The African Group at the first substantive plenary session articulated three mutually reinforcing priorities: (1) strengthening implementation through capacity-building and operational cooperation; (2) leveraging regional and continental frameworks as implementation pathways; and (3) understanding the evolving ICT threat landscape and identifying cooperative measures to address it. These priorities are well-founded but require consolidation into a coordinated continental input to the Global Mechanism's Dedicated Thematic Groups (DTGs).
Three conditions make consolidated continental input more valuable now than at any future point. First, DTG 1 and DTG 2 agendas are still being set, co-facilitators are working with delegations, and proposals are being submitted. Second, the mechanism is still in its formation period: working methods, output formats, and the style of engagement have not yet calcified. Third, perhaps, the African co-facilitation of DTG 1 (Egypt) creates a direct channel, but that channel delivers value only if the input it carries is consolidated continentally.
For Africa's fifty-four delegations, engaging without a common position will present fifty-four separate perspectives, or more likely, the perspectives of a dozen delegations from Africa with sufficient technical capacity to engage consistently. The result is that African formulations may arrive uncoordinated.
7. Implementing Pillars for Reciprocal Inter-Regionalism
With the commencement of the Global Mechanism, it is important to consider a forward-looking framework grounded on the three pillars of mutual learning, policy co-creation, and balanced partnerships.
1. Mutual learning would require inter-regional dialogue formats that feed African implementation insights back into Global Mechanism programme. It is important to institutionalise mechanisms through which African states and external partners exchange governance experiences and co-develop solutions to shared challenges, rather than reproducing ‘unidirectional’ knowledge flows from donor to recipient in the context of capacity building. A primary challenge is that capacity building financing entails donor governments whose strategic interests, however benign, inevitably shape diplomacy.
2. Policy co-creation relates to the development of normative instruments, capacity-building programmes, and institutional frameworks through processes in which African actors exercise agenda-setting authority rather than mere involvement in drafted designs.
3. Balanced partnerships demand a reorientation towards multi-directional engagement in which African states are principals rather than recipients in the construction of global cyber governance mechanism. There is also value in engaging Africa’s Regional Economic Communities such as ECOWAS, SADC, EAC.
Finally, reciprocal inter-regionalism would also require the African Union to exercise practical alignment with external and regional partnerships, aim at developing and enhancing coordinated continental positioning at the Global Mechanism and developing clear ‘continental criteria’ for evaluating the normative and institutional implications for ICTs security in member states. This will enhance the collective influence and capacity of African states to shape outcomes within the UN Global Mechanism.
