More than a decade after the adoption of the Malabo Convention, which provides a comprehensive framework on cybersecurity, electronic transactions, and personal data protection across the continent, many Cameroonians whose social media accounts have been hijacked remain unaware that the treaty offers a legal framework to protect them.
By Fawoh Nancy
Emeldine Yime has not been able to log into her Facebook account for four months after hackers seized control of it on March 5. For this 28-year-old hotel receptionist in Bamenda, capital of Cameroon’s North West Region, staying off the platform has meant being completely cut off from her community and the many opportunities that came with it.
“At first it was anxiety and anger – losing years of contacts, photos, and work hit hard. Right now it’s mostly frustration and the fear of missing out,” Yime recalls. “I was locked out immediately and denied any access to recovery options. The hacker has been messaging my contacts asking for money, claiming to be facing fake emergencies. I haven’t noticed any privacy breaches yet, but I can’t rule them out,” she says.
It was the first time Yime had lost a Facebook account to hackers, although she says she had previously experienced repeated WhatsApp spam attempts.
Her story is far from unique. Hardly a day passes in Cameroon today without reports of Facebook, WhatsApp, email or other digital accounts being compromised. In many cases, hackers impersonate victims and contact friends or relatives, asking for money to deal with an alleged emergency while promising to repay in the next day.
Countless unsuspecting Cameroonians have fallen prey to such scams. Yet, many simply move on after the ordeal instead of seeking legal redress, often unaware that legal frameworks already exist to protect them.
Laws Exist, but Enforcement Lags
One of such is the African Union Convention on Cyber Security and Personal Data Protection, better known as the Malabo Convention. Adopted on June 27, 2014, in Malabo, Equatorial Guinea, the Convention has so far been signed by 21 African Union member states, 16 of which have fully ratified it. It requires member states to enact laws criminalising hacking, identity theft, and unauthorised access to personal accounts.
The treaty also obliges governments to protect personal data, safeguard privacy rights, prosecute cyber offenses, punish hackers and establish independent data protection authorities to investigate violations.
Cameroon signed the Convention in 2014 and ratified it in 2019. Since then, implementation has gradually progressed through the National Agency for Information and Communication
Technologies, (ANTIC), although the pace remains “constrained by resource limitations and institutional capacity gaps,” according to Vianney Forewah, Cameroonian cybersecurity expert based in Buea.
“Beyond Malabo, Cameroon has Law No. 2010/012 on Cybercrime; Law No. 2014/007 on Data Protection; regulations issued by ANTIC governing online services, and various sectoral cybersecurity directives,” Forewah says. “These frameworks establish criminal penalties for unauthorised access, data breaches, and harassment.” He adds that the existing laws already provide legal remedies for victims of social media account theft.
“Citizens Lack Information About Their Rights”
“Unauthorised access constitutes a cybercrime under Cameroonian law. The challenge is that victims often do not know where to report such incidents or what legal remedies are available to them.”
Forewah attributes this gap to a combination of public ignorance and weak institutional communication. “Citizens lack accessible information about their rights and the mechanisms for reporting cybercrime. This is primarily a failure of advocacy and public communication,” he says. “State institutions and civil society organisations have not invested enough in translating legal protections into practical public understanding. Awareness campaigns, school curricula, and community outreach remain minimal. While personal responsibility matters, the greater burden rests on institutions to educate citizens about the protections that already exist on paper.”
Protection Gaps for Journalists and Activists
While the framework penalizes unauthorized access, civil society groups like Protege QV point out significant blind spots, especially for activists, journalists, and human rights defenders. Current Cameroonian legislation focuses heavily on penalizing offenders after a breach occurs, but offers little protection against state surveillance, targeted digital harassment, or arbitrary censorship.
Furthermore, neither the domestic law nor the Malabo Convention provides a clear mechanism to compel global tech monopolies like Meta to act swiftly when a critical voice is silenced online.
After repeatedly reporting to Facebook without success and being unable to create another account using her details, Yime is reluctant to open a new account. She is not considering taking legal action against the faceless hacker either.
“Globally, Facebook must comply with its own policies and GDPR-type standards for users in those regions,” she says. “I just pray that my Facebook account is recovered.”
168,000 Followers Lost Overnight
Renowned Cameroonian sports writer and researcher Ade Divine also lost his Facebook page, which had 168,000 followers, to hackers on July 18, 2024. He only regained full control two months later with the help of a digital technology and cybersecurity expert Felix Fomengia after weeks of persistent complaints and recovery requests. Today, the page has grown to more than 204,000 followers.
“The situation affected me significantly,” Ade recalls. “It felt like years of intense work had been wiped away. My page was, and still is, my voice in the media, so losing it was heartbreaking. My family, followers and well-wishers kept calling and sending messages. With every call, I realised even more how much people depended on that platform. It shattered me to the core.”
He says the hacker was remarkably brazen, going live on the page and showing off his face. “I could see the confidence in his eyes. He behaved as though there was no way I could ever recover it,” Ade recalls.
“He never demanded money. I even contacted the accounts he made admin and pleaded with him to return my page, promising to pay if that was what he wanted. He never replied.”
It was not Ade’s first encounter with cybercrime. Years earlier, he lost his first Facebook account after it was disabled and has never been able to recover it. And although he is aware that legal frameworks exist to protect users of digital platforms, he admits he has never taken the time to understand them fully. Like Yime, Ade has chosen not to pursue legal action against the hackers. “I have simply followed Meta’s advice on account and page safety, and I am doing just fine,” he says.