Recorded now, decrypted later

The encrypted traffic leaving African banks, ministries, and hospitals today is being copied and stored. It cannot be read yet. It will be, once quantum computers can break the keys protecting it, which NIST and its peers put between 2030 and 2035. This is the harvest-now-decrypt-later attack. For Africa, the recording has already started, we are already too late.

A policy brief for African central banks and digital regulators

Electric Sheep Africa · v0.1 · May 2026

Encrypted data is not safe forever. It is safe until someone has two things: a copy of the traffic, and the key. Intelligence agencies have been collecting and storing encrypted traffic for years on the bet that the key will come later. For the cryptography that protects almost all African internet traffic today, the key is now expected between 2030 and 2035, when quantum computers can break RSA and elliptic-curve encryption.

So the recording happening today becomes readable then. The industry name for this is harvest now, decrypt later. It is why we need to have this conversation now and not in a 2030s committee.

We measured how exposed African infrastructure is. The short version: very, and nobody here is watching.

Why our study matters

African governments are digitizing their most sensitive data right now. Bank rails, national IDs and biometrics, tax records, health systems, voter rolls. This is the data with the longest secrecy requirement. A citizen’s biometric does not stop being sensitive in 2035. Neither does a bank’s customer ledger or a hospital’s patient records.

That data is being protected with cryptography that has the shortest remaining life of anything in the stack. And most of it leaves the continent to get where it is going, carried and stored on infrastructure owned by other governments. The window to fix this quietly, on your own schedule, is the next five years. After that the schedule is set by whoever holds the recordings.

Our findings by the numbers

These are first-pass measurements from public data, taken in May 2026. Sources and limits are at the end.

• 0 of 54 African countries have published any post-quantum cryptography guidance. The US, UK, EU, Germany, Canada, and Australia all have dated migration plans. (data)
• 1,032 live Nigerian and Ghanaian government hosts, found by reading every certificate ever logged for their domains, run key exchanges a quantum computer can break. None have started moving to post-quantum encryption. 8% do not support TLS 1.3 at all. (data)
• 0 of 30 high-value African endpoints we looked at closely (banks, government, health) use post-quantum encryption. Every one runs RSA or elliptic-curve, the two things the 2030 deadline is about. (data)
• 25 of 30 of those endpoints get their certificate from a foreign authority. None use an African one. (data)
• 23 of 30 hand their encryption off to a foreign company before it reaches their own servers. The good security you see belongs to Cloudflare or Imperva or Amazon, not to the bank. (data)
• 0.8% of African government certificates come from an African certificate authority, out of 5,781 we checked. The trust anchor for 99.2% of African government websites sits almost entirely abroad. (data)
• 10 African countries have every submarine cable landing in a foreign jurisdiction that authorises bulk interception. Every cable serving Ghana lands in the EU or UK, and so do all but one of Nigeria’s eight. (data)
• 12 African countries have no internet exchange point at all. Their domestic traffic leaves the continent and comes back. (data)

What is actually happening

Three things are true at once, and together they make our case.

The recording is real and admitted. This is not a theory about what spies might do. GCHQ’s Tempora program tapped 200 fibre-optic cables and shared the take with the NSA; the Snowden documents laid it out in 2013. South Africa’s own intelligence service admitted in court in 2019 that it taps the undersea cables landing on its coast. The NSA hacked the operator of the SEA-ME-WE-4 cable, which carries North and East African traffic, and its own documents said more operations were planned. Bulk interception of cable traffic is a normal, ongoing activity of states, including on this continent.

African traffic leaves the continent to be carried. When Lagos talks to Nairobi and neither network peers locally, the packets route through London or Frankfurt and back. Twelve African countries have no internet exchange, so all their inter-city and inter-country traffic exits. Every cable that reaches Ghana comes ashore in Europe, and all but one of Nigeria’s do too. The same physical paths that carry the traffic are the paths the taps sit on.

The cryptography is old and foreign. The encryption protecting African banks and ministries is the kind the global timeline is retiring. None of the endpoints we checked have started moving. Most of them do use forward secrecy, which is good classical hygiene, and it does not help here. A quantum computer recovers the session key straight from the handshake in the recording, so a captured session is readable whether or not the server ever loses its long-term key. Forward secrecy was built to survive a stolen key, not a broken algorithm. The certificates that vouch for these hosts are issued abroad. And most of these institutions do not run their own encryption at all; they rent it from a foreign content-delivery network. That last point cuts two ways. It means the front door often looks fine. It also means the institution cannot see or control its own cryptographic posture, and a foreign company can.

Recording a country’s traffic sounds expensive. It is not.

Nigeria moves roughly an exabyte of data a month. Most of it is video served from caches inside the country and never leaves. The part that crosses the submarine cables, where a foreign tap would sit, is on the order of ten petabytes a day. Nearly all of it is encrypted, which is exactly what makes it worth keeping.

An adversary does not store all of it. They store what they will want to read later: the banking sessions, the government logins, the messaging handshakes. That is a few hundred terabytes a day. At bulk storage rates, holding that slice for a year costs one to two million dollars. Holding it until quantum computers arrive costs the low tens of millions, and storage gets cheaper every year.

So the recording is a rounding error in a signals-intelligence budget. The expensive part is the quantum computer, and other governments are already paying for that.

The gap

Everyone else has a deadline. Africa does not.

Nigeria is not negligent. Nigeria’s 2025 regulatory year was great: anti-money-laundering rules, agent banking, digital lending, AI governance. Post-quantum risk simply has not gotten on the agenda yet. The cost of it arriving late is that our migration happens on someone else’s clock, after the recordings are already made.

What we measured, and what we didn’t

This brief is v0.1, built from public data aggregation and open tools so anyone can check it. Two honest caveats.

The national scan is close to a census, not a hand-picked sample. We read every certificate ever logged for the two governments’ domains, found 2,708 hostnames, and tested the 1,032 that were live. That is most of Nigeria’s and Ghana’s public government web surface. The deeper certificate and CDN findings come from a closer look at 30 high-value institutions, which is a sample. Other countries and the private sector are next.

The routing claim is structural, not yet clocked. We have confirmed the conditions that force African traffic abroad: the missing exchange points and the foreign cable landings. We have not yet published the millisecond detour measurements, though the probes to do it are in place. That is the next dataset.

Everything else (the cable jurisdictions, the certificate authorities, the regulatory gap, the migration cost on local networks) is measured or documented and stands on its own.

What we need to do

Five moves.

1. Publish a position this year. One page is enough to start. State that you recognize the 2030–2035 window and that migration is coming. NITDA, the CBN, and the AU each saying this in public moves the whole region off zero.

1. Put it in procurement. Require new systems to support TLS 1.3 and hybrid post-quantum key exchange. Old systems running TLS 1.2 face two migrations instead of one, because TLS 1.2 cannot be upgraded to post-quantum at all. Stop buying the second migration.

1. Count what you have. You cannot migrate cryptography you have not inventoried. Ask banks and government systems for a cryptographic bill of materials: what algorithms, what key sizes, what protocol versions, where. This is cheap and it is the prerequisite for everything else.

1. Protect the long-life data first. Biometrics, citizen registries, health records, and financial ledgers stay sensitive for decades. Treat them as already harvested and move them to the front of the migration queue.

1. Build domestic trust. Two long projects worth starting now: an African certificate authority that browsers actually trust, and finishing the internet-exchange buildout so traffic stays on the continent. Both reduce how much of African security is rented from abroad.

What’s next

The datasets behind this brief are open and on Hugging Face for any regulator, researcher, or journalist to verify and extend. They sit in one collection: African Cryptographic Exposure & Post-Quantum Risk. Electric Sheep Africa will take this from v0.1 to a full technical report: national-scale TLS scans, measured routing detours, and a per-country regulatory readiness score for all 54 states. The point of the data is to let African institutions close this gap on their own schedule, while there is still a schedule to keep.

Datasets

Eight open datasets, one collection: African Cryptographic Exposure & Post-Quantum Risk on Hugging Face. Each figure above links to the dataset it comes from.

Sources. Snowden / Tempora: The Guardian, 2013. South African cable tapping: Privacy International, 2019. SEA-ME-WE-4: Der Spiegel, 2013. NIST PQC standards (FIPS 203/204/205) and 2030/2035 timelines: NIST, 2024. NCSC migration timeline: NCSC, 2025. Submarine cable landings: TeleGeography, 2026. Certificate authorities and government host enumeration: Certificate Transparency logs via crt.sh, 2026. Government TLS posture: those hostnames tested with standard TLS handshakes, 2026. Endpoint certificate and CDN inventory: Censys, 2026. Internet exchanges: PeeringDB, 2026. Routing vantage points: RIPE Atlas, 2026. Migration cost model: NIST algorithm sizes against GSMA and USSD channel limits.

Method note. All collections are passive and use public data or standard TLS handshakes, the same a browser performs. No interception, no exploitation, no private access. Figures are v0.1 and reproducible from the open code.