Joanne Esmyot: “Digital decolonisation in Africa is a two-way street”
Joanne Esmyot is a Director at Public Digital. She has 16 years of experience working both in the private and public sector. Before joining Public Digital, Joanne was the Executive Director of the National Computer Board (NCB) of Mauritius for 3 years. Under her leadership, the NCB successfully delivered several digital transformation initiatives for the Government of Mauritius such as the setting up of the first Mauritian Certificate Authority which enabled the launching of online birth certificates in Mauritius and laid the foundation for many more trusted digital services. She also notably led the national CIRT (Computer Incident Response Team) of Mauritius namely CERT-MU.
The views and opinions expressed in this interview are those of the interviewee and do not represent or engage in any way the Government of Mauritius, the National Computer Board, the people, institutions, or organisations that the interviewee may or may have been associated with in a professional or personal capacity.
This interview is also available in French.
Your work at the National Computer Board to build out the cybersecurity framework and digital economy of Mauritius led the country to be ranked 1st in Africa in the ITU Global Cybersecurity Index. How can other African governments especially of smaller countries strike partnerships with the private sector to build out cybersecurity infrastructure to achieve the heights Mauritius has? Are there any strategies of note?
First of all, Mauritius ranking first on the ITU Global Cybersecurity Index for Africa was not really of my doing; it was already ranked first when I joined the National Computer Board (NCB). It is true though that our scores on the assessment increased progressively over the time I was at the NCB. I would highlight two things that worked well for us. The first was starting small and incubating new projects and initiatives within the NCB as was the case for the CIRT team. It started small, first being incubated at the NCB, then gradually maturing them to work well. The Cybersecurity and Cybercrime Act 2021 establishes CERT-MU as a separate entity under the Ministry of ICT. This model of starting small, incubating the team and then gradually maturing the team worked well in the context of CIRT, but also for teams of other projects and initiatives .
The second point is that partnerships were key. I would say that what helped accelerate progress was mostly partnerships with international organisations and donor support. We received quite a lot of support through the Cyber 4D programme funded by the European Union. We had good ties and collaborations with other CIRT teams worldwide, mostly through the FIRST network. And we also had good collaboration with AfricaCERT more regionally. So, I think partnerships were key to help us lay down the cybersecurity strategy for the country and build the capabilities of the CERT team. Those international partnerships were even more critical to help the team mature and grow. That was extremely helpful.
That said, one point I must make is that the ecosystem in Mauritius was already conducive for these things to happen. Now that I work with other African countries, I am quite conscious that it may not be the case in other countries. The Mauritian government has for decades invested in a long-term vision to make ICT a pillar of the economy. That meant that some foundational elements were already in place, in terms of talent for example. While there is still competition for talent, compared to other countries, there has been some work already done around nurturing enough talent to have minimum viable teams within the government . In terms of infrastructure, since there is already a good ICT sector in Mauritius, there is already an ecosystem of partners that the government can engage with to implement the infrastructure, to outsource and complement the capabilities within the government—because it is impossible to do everything with the small teams present within government. Overall, the ecosystem was already very conducive to that. There were incentives from the government to attract investors in the sector to Mauritius early on and since then ongoing dialogue and partnerships.
Going back to the point around public-private partnerships, by the time I left the NCB, there was indeed a stronger partnership between the government's CIRT team and the private sector . For instance, in some sectors like banking, we did a lot of work to build capability, hold awareness sessions, and offer valuable services such as security assessments of certain banks and other private companies in the sector. We offered these to the private sector because as part of our national strategy we recognised that some sectors were part of the critical information infrastructure of the country. This made us work more closely with those sectors. Overall there was a good partnership with the private sector, though the starting point was working with international organisations in my view.
In what ways do you think that Mauritius and other countries that have excelled at digital transformation can share lessons and strategies towards digitalizing public services with other countries?
In Mauritius, we have always been inspired by what was being done in other countries and looked to adopt the best practices to inform the strategy of the country. I think that looking back on my experience, our strategy might have been slightly over-ambitious initially. When you see more mature, more advanced countries doing lots of things you are tempted to do the same . But it does not work that way. With time, we learnt to be more realistic and take into account our own capability. If you compare the latest version of the strategy to earlier ones, you can tell that in the recent revisions there are fewer focus areas, but these areas are better aligned with priorities and what would have the greatest impact based on where the country was at that time. In general, I would say there are loads of examples or best practices that are available depending on which sector you look at. It is important however to be realistic about where the country currently is. This involves understanding what the readiness factors are to achieve digital transformation. Start with the basics and set a reasonable number of priorities within the strategy for the next few years that you can focus on to make progress and impact.
How do you think the global rivalry geopolitical rivalry between China, the US and Europe affects the way some African governments, actors are establishing their strategies, and what is the best way to avoid being affected by this?
That is a good question albeit not easy to answer. What comes to mind immediately is the question of sovereignty but also digital decolonisation. These are not easy questions and I am not sure I have solutions to any of those.
Let us take the question of sovereignty. I think the good thing about Mauritius is that in general, there's political stability and the government has over the years consistently invested in a longer-term vision for digital transformation. One of the challenges with other countries is short-termism, i.e. governments not willing to invest in things that will yield longer-term returns. What has been done in Mauritius, again long before I joined the NCB, was investing into local data centre capabilities and capacity to be able to develop and host critical government digital services in-house . That does not mean that everything is necessarily developed in-house or hosted on the government cloud, but at least building that capability within the government to keep control of the things that you want to control is key. Of course, this does not happen overnight. It takes longer-term commitment and actions. Building local capability is foundational to sovereignty and this can only happen over time.
On the question of digital decolonisation, it is a two-way street. Digital decolonisation should not be considered only as dealing with the tendency for the most powerful so-called global North countries to impose their vision on lower-income countries or the so-called global South. We need to also consider it as dealing with the mindset of lower-income countries to make their own decisions around what works for them. I think there needs to be a culture shift both ways, not just in the West. I have been in places where because I am from Africa, I am less listened to than my colleagues coming from Europe even though we are working in the same team. A mindset change needs to happen. Granted, some noteworthy trends are promising in terms of digital decolonisation. The increased use of open source within government is one example of this, even though there's still scepticism and resistance in many areas. So that is one way to aim towards digital decolonisation. And then there is the ongoing discourse around digital public goods, digital public infrastructure and sharing and reuse of solutions among governments and countries. While these concepts are promising, they are not without obstacles. It can be much harder to put into practice, particularly where countries do not have the talent and do not have an ecosystem. A lot more attention and investment should be made into building capability to enable the adoption of a digital public goods or digital public infrastructure approach within governments especially in low settings.
What should governments or the private sector be doing to cultivate the growth of local talent and attract African diasporans to fill the human resource gap need to achieve this digital decolonisation, for example with regard to cybersecurity and open-source digital public goods and infrastructure?
Some longer-term actions must be made, and governments must invest in them even if the results are not going to be immediate. From my perspective, the reason there is a foundational level of digital skills or literacy within the Mauritian government is because of decisions that were made two decades ago at a point where Internet connectivity was not as widespread. Since we invested heavily in infrastructure over 10 - 20 years at least, we rank very highly in terms of access to the Internet. But when that was not the case , there were initiatives by the government and by the National Computer Board to offer training at the doorstep of citizens through cyber caravans initially and then gradually giving access to courses regionally to decentralise access to skills. Several policy decisions promoted the acquisition of digital skills or even required people to build those skills and gain knowledge. One remarkably successful example was the decision by the government to require entry-level civil servants to show evidence of a basic level of digital literacy. That compelled a lot of the people who wanted to join the public service to go forward with those courses which helped create a minimum foundational level of skills within government.
Other than that, there has been a strong public-private partnership for decades to forecast and plan for skills that are needed by the sector. The Human Resource Development Council is a body in Mauritius that holds sectoral committees with representatives of the private sector to make informed decisions and forecast future needs. These partnerships influence the courses for which the government will fund scholarships, future skills in demand and working with educational institutions to make sure that these are reflected in the curricula. There are even placements or training that are delivered by the private sector to make sure that graduates are more employable. So, there have been lots of different initiatives between the private sector and the government.
What is Mauritius’ position on issues related to internet governance, digital rights and data protection in international organisations? How can Africa’s voice be strengthened in these multilateral fora?
Mauritius enacted its revised data protection law after the GDPR, before the UK. I find it amusing that we did this even before the UK did after GDPR. We pay a lot of attention to making sure that we are implementing best practices. The laws are usually kept very up to date. In terms of cybercrime, Mauritius is a signatory to the Budapest and Malabo conventions. So usually, the laws and the policy are driven by what is happening internationally and what we think is relevant for the country. I can’t speak on behalf of the country but from my point of view, I don't think there is a particular bias towards one region or a type of international organisation over another. This might be one of the strengths of Mauritius as compared to other countries. We're always open to a lot of collaboration and cooperation with other countries and with other international organisations, irrespective of the region. This allows us to take good things from everywhere. While I was at the NCB, I recall there was one person from the CERT-MU team who was a member of the working group on cyber security for the UN. This was great as it was an opportunity for us to contribute to shaping more global policy. But this does not happen often enough.
To your question about Africa's voice, I do feel like more generally, there are a lot of growing success stories within Africa, but it's just that it doesn't get the kind of visibility that it should. I honestly don't know why that is. My best guess to positively influence that would be international organisations that work with governments, especially donor organisations like the UN or the World Bank or the African Development Bank to play a greater role in shedding light on those success stories. And not just success but highlighting things that work well in Western countries but do not work in Africa. Not enough is being done around really having locally-led development programmes as opposed to traditional programmes that are pretty rigid and dictated by the donor . To some extent, because African countries are dependent on funding, they have no choice. While this is not the full answer, I do believe that sharing more of what is being done in Africa is helpful. There are success stories like Irembo in Rwanda for instance that improves access to digital services in low settings and can be a source of inspiration for countries with similar context. Showcasing those examples more is a good way to create awareness on the alternatives available in my view.
This interview is part of the Negotiating Africa’s digital partnerships: interview series led by Dr Folashade Soule with African senior policymakers, ministers, private and civic actors to shed a light on how African actors build, negotiate and manage strategic partnerships in the digital sector in a context of geopolitical rivalry. The series is part of the Negotiating Africa’s digital partnerships policy research project hosted at the Global Economic Governance programme (University of Oxford) and supported by the Centre for International Governance Innovation (CIGI).