By William Song-Aabo
A government can spend millions on a surveillance system aimed at its own citizens and still control none of it: not the source code, not the encryption keys, not the schedule for its own updates. Sovereignty was bought, then signed straight back to the vendor. Many developing nations are now in exactly that position, running spyware, forensic extraction tools, and city-wide camera networks bought from foreign vendors who answer to someone else’s law, not theirs. Ghana has acquired all three over the past decade, each one binding it a little further to systems it did not build and cannot inspect. The spyware came first: Pegasus, bought from the Israeli firm NSO Group, ostensibly to fight terrorism. What makes Ghana’s case unusual is not the purchase itself, since most governments in this position are never made to explain themselves. It is that this one ended up in a courtroom.
In May 2020, a Ghanaian court convicted three former officials over that purchase. It was the first known case anywhere of state officials jailed over a deal with the company. NSO Group maintained the sentences were for internal financial misconduct, not the software itself. Matthew William Tetteh Tevie, former Director-General of Ghana’s National Communications Authority (NCA), received five years; board chairman Eugene Baffoe-Bonnie got six after admitting he pocketed $200,000; Alhaji Salifu Mimina Osman, then Deputy National Security Coordinator, received five years. Justice and accountability were weakened when President Akufo-Addo pardoned Osman in August 2023 on health grounds, following a petition from Kpembewura Haruna Dari Bismark Banbange Ndefoso I, Paramount Chief of the Kpembi Traditional Area, three years into his sentence (Graphic Online, 2023).
The conviction was for causing financial loss, not illegal spying. The payment chain revealed a striking asymmetry. The NCA transferred $4 million to Infralocks Development Limited, a little-known Accra firm, to acquire Pegasus for counter-terrorism. Infralocks sent only $1 million to NSO and kept $3 million. Its owner, George Derek Oppong, was acquitted. The public servants who authorised the payment went to prison; the middleman who took three-quarters of the money did not (R v Bonnie and Others, 2020).
The dependency is architectural, built into how Pegasus works at every stage: how it gets onto a phone, what it can do once there, and who controls whether it ever gets fixed. Pegasus is built around zero-click exploits capable of compromising a fully updated phone with no action from the target at all, though the precise capability shifts with each exploit chain, device, and operating-system version. Once installed, it can operate deep enough to read messages before encrypted apps like WhatsApp process them, activate a phone’s microphone, and pull data from across the device. Each of those capabilities is a direct intrusion into the privacy rights of whichever Ghanaian citizen the tool is turned against, reading their messages, listening through their microphone, and combing their files without their knowledge or consent. Every patch and version update comes from NSO, on NSO’s schedule. Lacking source code, Ghanaian technicians had no way to audit the tool on their own, check for backdoors, or confirm whether data was being mirrored abroad. A state’s intelligence apparatus sat inside binaries only the vendor could read (Citizen Lab, 2018).
The pattern repeats with Cellebrite, the phone-extraction tool Ghana acquired next: how it reached the country, what it can pull from a seized phone, and whether anyone in Ghana can trust the software doing the pulling. In 2017, Ghanaian police first gained access to Cellebrite UFED devices through Interpol-run training, with further units delivered directly by the US ambassador in Accra in 2019 (Committee to Protect Journalists, 2020). Cellebrite’s tools require physical possession of a phone; they exploit vulnerabilities in a device’s software and hardware to bypass locks and produce a full forensic extraction. Ghana gained this capability with no means of its own to verify the integrity of the extraction software.
A third layer arrived in 2012, when Ghana signed a roughly $176 million contract with Huawei and the Chinese firm Beijing Everyway to install around 800 cameras with facial-recognition capability across Accra, forty times the cost of the Pegasus deal (Institute of Development Studies & African Digital Rights Network, 2021). As with Pegasus, Ghana had no access to the underlying source code, and nothing to confirm who else, if anyone, could reach the data the network collected.
All three systems exploit legal lacunae, gaps between what Ghana’s laws were written to cover and what these tools actually do: a warrant law built for phone carriers, a search-and-seizure law built for one device at a time, and a surveillance network no law anticipated at all. Ghana’s Cybersecurity Act 2020 requires a High Court warrant for interception but was designed for carrier-level tapping (Cybersecurity Act, 2020). Pegasus bypasses carriers, compromising the device directly. A warrant may be procedurally valid yet largely detached from the actual surveillance tool. Cellebrite extraction falls under search-and-seizure rules, built for a world where an officer examines one seized device at a time, not a tool that can pull years of a person’s data in minutes. The camera network sits outside both frameworks, because nobody drafting interception law was thinking about a permanent, searchable biometric archive of who moves where across an entire city. Each technology was built for its vendor’s home jurisdiction. The firmware, cryptographic libraries, and communication protocols remained closed to Ghana. The Ghanaian state bought sealed black boxes.
Ghana’s first president, Dr Kwame Nkrumah, described this precise arrangement six decades ago and called it neocolonialism: a state that is independent and holds official sovereignty in theory, while its economic system and political policy are directed from outside, a flag, a parliament, a court, all intact, but decisive control over security and economy sitting elsewhere, held by capital and technology it did not build and cannot redirect. He called it the worst form of imperialism, because the exploitation continues without the foreign power ever holding responsibility for how the country it dominates is actually governed (Nkrumah, 1965). Ghana’s courts could convict the officials who signed the Pegasus contract; they could not rewrite NSO’s code, could not choose what Huawei’s cameras recorded, could not compel Infralocks to return the three million United States dollars it kept rather than pass on. The Ghanaian state retained the power to punish its own citizens and none at all over the vendors and intermediaries that power was actually about. That gap between formal authority and practical control is not a side effect of one bad contract. It is the shape dependency takes when the commodity is no longer cocoa or bauxite but code. Nor is the dependency accidental: Israel’s cyber-surveillance industry has functioned for years as an instrument of its own foreign policy in Africa, trading spyware access for diplomatic support at the UN and African Union, a pattern researchers call spyware diplomacy (Dadoo, 2022). Israeli academics and activists petitioned their own government for a criminal investigation into the Ghana sale in 2022. In 2026, Israeli police closed the case, citing insufficient evidence, without charging anyone on the selling side (The Wire, 2026).
Put in local parlance, the waste is stark. At Ghana’s 2020 daily minimum wage of GH₵11.82, the $4 million paid out under the Pegasus deal represents hundreds of thousands of days of minimum-wage labour. That scale raises an obvious public-finance question: what domestic technical capacity, forensic training, or independent auditing infrastructure a comparable sum might otherwise have funded. Instead, three-quarters of it went to a broker’s account, not even to the vendor whose product the contract was meant to buy.
The European Union had every advantage Ghana lacked, and it still failed. Its year-long PEGA committee inquiry documented Pegasus abuses against journalists, lawyers, and opposition politicians inside several of its own member states, Poland, Hungary, Greece, and Spain chief among them (European Parliament, 2023). It found national controls on commercial spyware fragmented and inadequate across the bloc, a step short of the coordinated export blacklist the United States had already applied to NSO Group in 2021. If a bloc of wealthy democracies could not fully contain the misuse of tools it merely permitted onto its own soil, Ghana could not have been expected to do so alone.
The tool Ghana bought has a body count. Saudi operatives murdered journalist Jamal Khashoggi inside his country’s Istanbul consulate in 2018. Forensic analysis found Pegasus had been installed on the phone of Omar Abdulaziz, a close friend and fellow dissident, in the months before the killing; his fiancée Hatice Cengiz’s phone was found infected days afterward (The Wire, 2021). In Rwanda, Paul Rusesabagina was lured onto a plane and arrested in 2020; his daughter’s phone was later found infected with Pegasus, deployed by the same government that had just seized her father (Pegasus Project/Citizen Lab, 2021). Rwanda is named, alongside Ghana, among the countries that bought the tool.
Western governments are implicated too. Former NSA and CIA director Michael Hayden said in 2014, “We kill people based on metadata” (Cole, 2014). These tools harvest precisely that metadata: GPS locations, call records, movement patterns. This is not court evidence; it is targeting data. Ghana faces genuine threats, and many democracies use identical tools under secrecy. The failure is not the technology itself but the absence of a domestic governance layer that can audit code, verify updates, and monitor network behaviour. Where independent judicial oversight and technical audit bodies exist, imported tools can be governed. The barrier is political will, not technical impossibility.
That governance layer is buildable, and none of it requires new technology, only different questions asked earlier. A contract could require Ghana to know, before signing, where its data would live, who held the encryption keys, and whether the vendor could reach into the system remotely. That is the kind of disclosure that would have surfaced the Infralocks arrangement years before a courtroom did. The Cybersecurity Act itself could be amended to name device compromise and biometric camera networks explicitly, instead of a warrant clause nobody thought to ask about them. And procurement could answer to an independent parliamentary committee with the power to subpoena the agencies making the purchase, rather than to the National Communications Authority or the National Security Council policing themselves. Ghana never lacked the capacity to ask these questions, only a rule requiring anyone to ask them before the money moved instead of after.
When developing nations buy unauditable surveillance technology, they inherit foreign regulatory priorities, drain public funds, and expose citizens to risks local institutions cannot manage. By relying on borrowed eyes, a state forfeits the ability to verify its own intelligence, handing its sovereignty to vendors who, like the systems they sell, answer to someone else’s law, not the country buying them. Digital sovereignty cannot be bought; it must be built, through the domestic capacity to audit, control, and govern every device on critical infrastructure. Without that capacity, a government watches its most sensitive data through a lens it cannot clean and cannot regulate, on terms it never had the standing to negotiate.
References
Citizen Lab. (2018). Hide and seek: Tracking NSO Group’s Pegasus spyware to operations in 45 countries. University of Toronto. https://citizenlab.ca/2018/09/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/
Cole, D. (2014, May 10). “We kill people based on metadata.” Just Security. https://www.justsecurity.org/10311/michael-hayden-kill-people-based-metadata/
Committee to Protect Journalists. (2020, July). US, UK, Interpol give Ghana phone hacking tools, raising journalist concerns on safety and confidentiality. https://cpj.org/2020/07/us-uk-interpol-give-ghana-phone-hacking-tools-raising-journalist-concerns-on-safety-and-confidentiality/
Cybersecurity Act, 2020 (Act 1038) (Ghana).
Dadoo, S. (2022, September 15). Israel’s spyware diplomacy in Africa. OrientXXI. https://orientxxi.info/magazine/israel-s-spyware-diplomacy-in-africa,5859
European Parliament. (2023). Report on the investigation of alleged contraventions and maladministration in the application of Union law in relation to the use of Pegasus and equivalent surveillance spyware. PEGA Committee. https://www.europarl.europa.eu/news/en/press-room/20230505IPR84901/spyware-meps-sound-alarm-on-threat-to-democracy-and-demand-reforms
Graphic Online. (2023, August). Ghana news: Akufo-Addo pardons former Deputy National Security Coordinator.https://www.graphic.com.gh/news/general-news/ghana-news-akufo-addo-pardons-former-deputy-national-security-coordinator.html
Institute of Development Studies & African Digital Rights Network. (2021). Mapping the supply of surveillance technologies to Africa: Case studies from Nigeria, Ghana, Morocco, Malawi and Zambia. https://www.ids.ac.uk/publications/mapping-the-supply-of-surveillance-technologies-to-africa-case-studies-from-nigeria-ghana-morocco-malawi-and-zambia/
Nkrumah, K. (1965). Neo-Colonialism: The Last Stage of Imperialism. Thomas Nelson & Sons.
Pegasus Project (Forbidden Stories / Amnesty International Security Lab, forensics verified by Citizen Lab). (2021). Israeli spy tech used against daughter of man who inspired “Hotel Rwanda.” OCCRP. https://www.occrp.org/en/project/the-pegasus-project/israeli-spy-tech-used-against-daughter-of-man-who-inspired-hotel-rwanda
R v Bonnie and Others, Suit No. CR/904/2017, [2020] GHAHCCrimD 1 (12 May 2020). https://cddgh.org/corruptionwatch/wp-content/uploads/2022/01/NCA-case-final-judgment.doc
The Wire. (2021, July 18). Hacking software was used to spy on Jamal Khashoggi’s wife months before his murder.https://m.thewire.in/article/world/pegasus-hacking-jamal-khashoggi-wife
The Wire. (2026, May 24). Why Israel closed the Pegasus deal probe for which Ghana convicted its officials.https://m.thewire.in/article/world/why-israel-closed-the-pegasus-deal-probe-for-which-ghana-convicted-its-officials