Rethinking Cybersecurity Levy: A Case for Institutional Responsibility

…. By Dr. Nathaniel Atansuyi

“In cybersecurity, the true currency is not just in the bytes we safeguard, but in the trust we cultivate. Let us invest not only in defenses but in the resilience of institutions, for therein lies the true wealth of our digital future.”

 

Cybersecurity, once a peripheral concern, has swiftly vaulted into the spotlight as a critical aspect of national security and economic stability. Like many nations, Nigeria grapples with mounting cyber threats, necessitating robust strategies to safeguard digital infrastructures. Recently, the Central Bank of Nigeria (CBN) introduced a Cybersecurity Levy aimed at bolstering defenses against cyber-attacks. However, amidst economic uncertainties and public skepticism, questions loom over the efficacy and fairness of this approach.

Global Perspective on Cybersecurity Funding

Across the globe, nations grapple with the daunting task of financing cybersecurity initiatives. The prevailing approach varies considerably, reflecting diverse economic landscapes and governmental philosophies. Some countries adopt a centralized funding model, where the burden of financing cybersecurity efforts falls primarily on taxpayers. This model often entails the imposition of dedicated cybersecurity taxes or levies on electronic transactions, as witnessed in Nigeria. Conversely, other nations advocate for a decentralized approach, emphasizing institutional responsibility. Under this paradigm, businesses and organizations bear the onus of fortifying their cyber defenses, sparing taxpayers from additional financial burdens. Instead of levies, governments incentivize private entities to invest in cybersecurity through tax breaks, grants, or regulatory frameworks.

Best Global Practices

In best global practices, the responsibility for cybersecurity funding is often shared among various stakeholders:

• Government Funding: Governments allocate resources from the national budget to support cybersecurity initiatives. This ensures a baseline level of protection for critical infrastructure and national security interests.
• Industry Contributions: Businesses and financial institutions are expected to invest in cybersecurity as part of their operational risk management. This includes implementing robust cybersecurity protocols, investing in training and awareness programs, and participating in collaborative efforts to address cyber threats.
• Public-Private Partnerships: Collaborative efforts between government agencies, private sector entities, and cybersecurity experts can enhance cybersecurity capabilities through information sharing, joint research, and coordinated response to cyber incidents.
• Risk-Based Approach: Cybersecurity funding strategies should be based on a thorough assessment of risks, vulnerabilities, and potential impact. This allows resources to be allocated effectively, prioritizing areas of highest risk while optimizing cost-effectiveness.

The Nigerian Conundrum: Examining the Cybersecurity Levy

In Nigeria, the introduction of the Cybersecurity Levy has sparked intense debate and scrutiny.

While the intention to fortify defenses against cyber threats is commendable, concerns linger regarding its timing and implications for citizens and businesses. The economic landscape, marred by challenges and uncertainties, raises doubts about the feasibility and fairness of imposing additional financial burdens on the populace. Critics argue that the Cybersecurity Levy could exacerbate the tax burden on Nigerians, potentially stifling economic growth and hindering financial inclusion efforts. Moreover, the lack of transparency regarding the allocation and utilization of levy proceeds adds to public skepticism. Without a clear delineation of how funds will be utilized and assurances of stringent oversight, concerns over accountability and efficacy persist.

Institutions vs. Citizens: Who Bears the Responsibility?

One fundamental question arising from the Nigerian cybersecurity levy is whether the burden should fall on individual citizens or be shouldered by institutions. Rather than imposing additional taxes on citizens, a shift towards institutional responsibility offers a more sustainable and equitable solution. By holding businesses and organizations accountable for fortifying their cyber defenses, the burden is distributed more fairly, sparing individuals from undue financial strain.

Institutional responsibility entails fostering a culture of cybersecurity awareness and resilience, where businesses proactively invest in robust defense mechanisms and adhere to regulatory frameworks. Governments play a pivotal role in incentivizing and facilitating these efforts through regulatory oversight, capacity-building initiatives, and collaboration with the private sector.

Addressing Nigerian Context

As the Nigerian government navigates the complexities of cybersecurity funding, a nuanced approach is essential. While the need to bolster defenses against cyber threats is undeniable, the means to achieve this goal must be carefully calibrated to ensure fairness, efficacy, and fiscal prudence. By prioritizing institutional responsibility over blanket taxation, Nigeria can foster a more resilient and inclusive cybersecurity ecosystem, safeguarding its digital infrastructure for future generations. The Cybersecurity Levy underscores the urgency of addressing cyber threats in Nigeria. However, its implementation raises pertinent questions about the most equitable and effective means of financing cybersecurity initiatives. Embracing institutional responsibility offers a viable path forward, promoting fairness, accountability, and sustainability in the quest to secure Nigeria’s digital future.

Recommendations for the Nigeria Government:

• Transparency and Accountability: The government should provide clear explanations of how funds from the cybersecurity levy will be utilized and ensure robust mechanisms for accountability and oversight.
• Stakeholder Engagement: Consultation with relevant stakeholders, including businesses, financial institutions, cybersecurity experts, and citizens’ groups, is essential to ensure that cybersecurity funding mechanisms align with national interests and address legitimate concerns.
• Economic Considerations: The economic impact of any cybersecurity funding mechanism must be carefully evaluated to minimize unintended consequences.

 

Dr. Nathaniel Atansuyi, FCRSA, FIIM, MNCS, MCPN (C.itp), Information Technology, Artificial Intelligence, and Cybersecurity Consultant, Author, and Public Speaker with almost three decades of industry experience, proficiently delivers top-tier solutions on the following products and services; information technology, cybersecurity, cloud technology, and governance services across diverse sectors, including Consulting, Government Agencies, FMCG, Banking, Telecommunications, Marketing Communications, and Training.