OPINION: Building a cyber-resilient Africa, Ghana’s experience and Dunstan Guba’s perspective on future of cybercrime investigation

A feature on Africa’s changing cybercrime landscape, digital evidence, public safety and the future of policing

Africa is going digital at extraordinary speed. Criminals are moving just as fast.

More than 1.1 billion mobile subscriptions were recorded across Africa in 2025, according to INTERPOL. Phones now carry our money, conversations, businesses, identities and access to public services.

This transformation is opening enormous opportunities. It is also creating a crime scene that can exist everywhere at once: on a phone in Accra, a server abroad, a social-media account, a cryptocurrency wallet or data stored in the cloud.

That is why cybercrime can no longer be treated as a problem for “IT people” alone.

INTERPOL’s 2026 African Cyberthreat Assessment says artificial intelligence is enabling 55 per cent of reported cybercrimes across Africa, making attacks faster, easier to scale and harder to detect.

The assessment describes a threat environment that is increasingly organised, borderless and technology-enabled.

MEET DUNSTAN GUBA: WHERE TECHNOLOGY MEETS PUBLIC SERVICE

One Ghanaian practitioner working at that intersection is Dunstan Guba.

He is the Cyber Intelligence Lead of the Criminal Investigation Department, Ghana Police Service, with work spanning cybercrime investigations, digital forensics, cyber intelligence, training and international cooperation.

He lectures at the Wisconsin International University where teaches Ethical Hacking and Penetration Testing and he also host of Cybercrime Alert on Ghana Police TV owned by the Ghana Police Service, a programme focused on digital safety and cyber resilience.

That mix of investigation and education matters. Cybersecurity is often discussed as if it were only about systems and networks.

In practice, its consequences are human: a family losing money to fraud, a business locked out by ransomware, a child placed at risk online, or an investigator trying to preserve digital evidence before it disappears.

The same connection between technology and public safety is visible in Ghana’s AMBER Alert initiative where Dunstan Guba lead the initiative with Meta and serves as the lead admin of the system in Ghana.

The system uses Facebook, Instagram and Messenger to distribute targeted alerts when police determine that a missing or abducted child meets the alert criteria.

It is an example of digital platforms being used not only to investigate harm, but to mobilise communities quickly to protect people

THE CRIME SCENE HAS CHANGED

For generations, investigators have been trained to protect the physical crime scene: secure the area, photograph it, preserve fingerprints, collect exhibits and maintain the chain of custody.

Those principles remain essential.

But the modern investigator must also recognise another crime scene - the digital one.

A fraud investigation may depend on mobile-money records. A threat may begin on social media.

A kidnapping case may involve location and messaging data. A ransomware attack may leave traces in system memory, network logs and cryptocurrency transactions.

Evidence may be deleted, remotely wiped or moved across jurisdictions within minutes.

INTERPOL reported in 2025 that cybercrime represented more than 30 per cent of reported crime in Western and Eastern Africa.

Two-thirds of surveyed African member countries described cyber-related offences as a medium-to-high share of crime. Online scams, ransomware, business email compromise and digital sextortion were among the most reported threats.

The capacity gap is equally important: 90 per cent of surveyed African countries said law-enforcement or prosecution capacity required significant improvement.

Ninety-five per cent reported inadequate training, resource constraints or limited access to specialized tools.

GHANA: DIGITAL GROWTH, DIGITAL RISK

Ghana offers a useful case study.

The Cyber Security Authority recorded 2,751 actual cybersecurity incidents in 2024 and reported losses of GH¢23.33 million; online fraud represented 44 per cent of reported incidents.

By the first seven months of 2026, the Authority had recorded 3,876 cybersecurity incidents, with online fraud accounting for about 47 per cent.

Ghana’s Cybersecurity Act, 2020 (Act 1038) created the Cyber Security Authority and established a national regulatory framework.

But legislation alone cannot reconstruct an intrusion, examine a compromised phone or preserve volatile evidence.

That requires trained investigators, forensic laboratories, clear procedures, prosecutors who understand electronic evidence and strong cooperation between institutions.

FROM ENCRYPTED FILES TO ATTACKER BEHAVIOUR

Guba’s public interventions have focused heavily on this investigative capability.

At the Council of Europe Africa Forum on ransomware, he joined African lead specialists discussing digital forensics, darknet investigation, open-source intelligence, command-and-control infrastructure, data preservation, cryptocurrency analysis and suspect identification.

The lesson is that the encrypted files may be only the visible end of an attack.

Investigators need to understand how the attacker entered, what credentials were stolen, where the attacker moved, what data left the network, what infrastructure was used and where the money went.

That technical focus has been tested internationally. Guba also secured a silver medal after placing third at the 2025 INTERPOL Digital Security Challenge in Kuala Lumpur, where participants from law-enforcement agencies across more than 60 countries were tested in areas including digital-evidence analysis, malware, network security, vulnerability identification and incident response.

In the history of Ghana, he is the first Police officer to attainment such on the map of Ghana signifying that Ghana is doing well in cybersecurity excellence.

His public education work takes the same ideas beyond specialist rooms.

Through Cybercrime Alert, academic teaching and professional forums, the emphasis is on making digital risk understandable: people need to recognise threats, institutions need to preserve evidence, and investigators need the skills to follow the digital trail.

AFRICA CANNOT INVESTIGATE ALONE

A victim may be in Ghana, the offender in another country, the platform holding evidence somewhere else, and the criminal proceeds moving through several financial or cryptocurrency systems.

That makes international cooperation part of the investigation itself.

INTERPOL reported that 86 per cent of African countries surveyed in 2025 believed their international-cooperation capacity needed improvement.

Yet coordinated operations show what is possible. Operation Serengeti 2.0, involving authorities from 18 African countries and the United Kingdom, resulted in 1,209 arrests, USD 97.4 million recovered and 11,432 malicious infrastructures dismantled in 2025.

The lesson is simple: cybercriminals can collaborate, outsource services and cross borders quickly.

Law enforcement must be able to preserve evidence, share intelligence and coordinate lawful investigations with comparable speed.

AFRICA MUST BUILD ITS OWN CYBER INVESTIGATORS

According to Dunstan Guba, technology alone will not solve the problem.

A forensic tool is only as useful as the person who understands what it can prove, what it cannot prove and how its findings can be explained in court.

This is where Guba’s work as both practitioner and educator becomes relevant to the wider African conversation.

He also states that training police investigators and postgraduate cybersecurity students helps close the distance between theory and the real crime scene.

Africa needs more investigators who understand both crime and technology; more digital forensic examiners; prosecutors and judges comfortable with electronic evidence; and specialists in malware, mobile forensics, cyber intelligence, cryptocurrency tracing and incident response.

Artificial intelligence raises the stakes again. It can help criminals automate reconnaissance, improve phishing, imitate people and scale fraud.

It can also help defenders analyse information and identify patterns faster.

INTERPOL’s 2026 recommendations therefore include standardised digital-forensic capability, stronger cross-border cooperation and investment in AI literacy for law-enforcement officers.

The future of cybercrime investigation in Africa is therefore not simply about buying more technology. It is about building people, institutions and partnerships capable of turning digital traces into reliable evidence and reliable evidence into lawful action.

Africa’s digital transformation will continue.

The question is whether the continent’s investigative capacity will grow with it. Ghana’s experience shows both the urgency of the threat and the value of investing in skills, public awareness, digital forensics, child protection and international cooperation.

The crime scene has changed.

The criminal has changed.

The evidence has changed.

Africa’s investigations must change too.

Credit: Dunstan Guba, INTERPOL-OPs SENTINEL