Chapter

Can the African Peer Review Mechanism Effectively Govern Cybersecurity and Accountability?

Championing cyber governance and sustainable development in Africa through peer review and capacity building

The African Peer Review Mechanism (APRM) is a unique initiative under the African Union (AU) that has been promoting political stability, economic growth, and sustainable development since 2003. With 42 participating states, the APRM encourages conformity to agreed values, codes, and standards, leading to accelerated subregional and continental economic integration.

As a model for regional cooperation as well as the peer-review system and its impact for capacity building, this case study explores the potential for APRM to be leveraged for cyber accountability and capacity building. It also explores the broader role than regional coordination and informal peer review among states can play as a policy mechanism, instead of ‘hard’ or legally binding regulations

This case study is part of the recently released report, Advancing Accountability in Cyberspace: Models, Mechanisms, and Multistakeholder Approaches

What is the African Peer Review Mechanism?

The African Peer Review Mechanism (APRM) has served as a regional peer review mechanism since 2003 under the African Union (AU) to oversee monitoring and evaluation in all key governance areas of the continent. It enables its 42 participating states to conform to agreed values, codes, and standards that lead to political stability, high economic growth, and sustainable development, as well as accelerated subregional and continental economic integration.¹ Member states share their experiences and best practices, including identifying deficiencies and assessing the needs for capacity building.² AU member states have taken pride in their distinctive regional peer review mechanism, from developing a self-assessment tool and process to evaluate African governance strengths and weaknesses, to attaining membership by more than half of the AU’s countries. As a result, economic opportunities and human development indicators of good governance improved between 2012-2021, according to the Ibrahim Index of African Governance. Nine out of the top 10 countries showing governance improvement in the Index are APRM member states, which speaks to the impact of the organization.³

As recently as 2017, positive signs of governance initiatives were becoming apparent and the APRM was given an expanded dual mandate of monitoring and evaluating the AU’s Agenda 2063 as well as progress toward achievement of the Sustainable Development Goals by 2030. The APRM now plays a more prominent role in defining the governance framework landscape in democratic, political, economic, and management processes, as well as in socioeconomic and corporate areas. In 2023, the APRM celebrated 20 years under the theme “Accelerating and Deepening Governance Reform, Measures, and Intervention.”⁴

The success of the APRM is particularly interesting in the context of Africa’s subregions that are composed of developing countries; such countries have governance deficits and leaders that might be unwilling or unable to change their country’s political systems in response to global good governance efforts.⁵ Numerous conditions, such as enhanced coordination, monitoring of assessments in a more timely manner, make regional peer review mechanisms rather than continent-wide ones attractive. Nonetheless, the APRM offers significant benefits, which compels many states and partners to use a broader lens in supporting regional initiatives. A reading of the APRM Legacy Report organized by South African President Cyril Ramaphosa, the 2020-2022 APRM Chair, identified several pillars that contribute to the APRM’s success. Two are particularly relevant for this chapter: 1) Assistance to member states with governance monitoring and evaluation (M&E) activities; and 2) providing APRM tools, such as the African Union Governance Atlas.⁶ Certain aspects of these two pillars interact with one another to create a virtuous cycle.

Governance M&E: A well-crafted national programme of action (NPoA) provides critical information for the government as well as nongovernmental stakeholders to remedy the challenges identified during the baseline review and identify legislative, capacity, or resourcing gaps alongside the necessary resources to address them.⁷ In its original conception, the NPoAs could be used by investors and partners when making investment decisions, especially in areas of weak governance. The findings and NPoA could be used as governance assessments. The APRM has convened capacity-building workshops on the integration of APRM national programs of action into national development plans.⁸

APRM Tools: The fact that the APRM is already undertaking several types of country reviews creates a hub of governance indicators and indices on the continent. For example, in 2019, APRM’s members decided to create an African Union Governance Atlas to communicate to policymakers and the public data on aspects such as elections, the rule of law, the delivery of public goods, access to information, judicial and legislative independence, economic governance, corruption, and civil society participation.⁹ In 2020, the APRM completed profiles of all 55 AU countries for the Governance Atlas. Once produced, the atlas will serve as a platform for investors and partners to engage with African states in several ways. First, it will provide background information for investors and partners, who often require governance assessments before making investment decisions. Second, it will highlight demonstrable progress across governance indicators and capabilities, which can be highly advantageous.

Assessments and Oversight: Notably, the APRM has several layers of institutional oversight, including the APRM Forum, the Committee of Focal Points, and the Panel of Eminent Persons.¹⁰ The forum participants are heads of states, as well as leaders of all APRM member states, who serve a two-year tenure and produce and review reports. The committee is composed of focal point representatives from participating states and tasked with, among other responsibilities, oversight over the budget and the professionalism and accountability of the Secretariat. The first seven-member member panel of eminent persons, appointed in 2003, comprised distinguished Africans from participating states with integrity, impartiality, and moral stature—qualities needed to oversee “governance and performance of the Country Review Process as well as other processes that need partnerships and to safeguard African ownership of the Country Review Process.”

Drawbacks and Limitations

Distinct factors create a compelling advantage for the APRM for internal and external parties (mainly international organizations), including improvement in the quality of governance, deepening of democracy and national institutions, and the cultivation of national consensus and political trust. Yet other factors hold the APRM back from reaching its full potential. AU member states still have a way to go in terms of fully supporting the APRM, due to funding constraints. Of the 42 participating states, 25 have had a baseline review since 2006. Fewer than 10 have conducted their second-generation peer reviews (subsequent reviews to monitor progress against the programme of action and shared objectives identified in first review) owing to lack of funds and an overstretched Secretariat.¹¹ This could be a major missed opportunity. Increasing the share of countries that undertake second-generation reviews has the potential to fuel significant, measurable improvements in positive governance.

The APRM strategic plan report highlighted the need for a financially sustainable and credible Secretariat.¹² For example, the APRM Trust Fund, established and managed by the UN Development Programme (UNDP), has run dry due to non-payment of membership contributions. Funds were mostly from contributions by participating African countries, with each country expected to contribute USD $100 000 per year. The Development Bank of Southern Africa maintained an account on behalf of the APRM.¹³ When the APRM was incorporated as an AU organ, the assembly decided “to integrate the APRM budget in the statutory Union budget funded by Member States.”¹⁴ Resource mobilization remains a priority for the APRM.

Different Paths to Scale

Intergovernmental peer review mechanisms take varied paths to success, but they share certain common elements, especially on specific concerns of states, such as accountability and transparency. A special area of potential is digital governance and global cooperation as outlined by the APRM at the 18th Annual Internet Governance Forum in 2023.¹⁵ The APRM can share key lessons on African governance in different domains to enhance and optimize the use of technology in key governance areas such as elections, citizen engagement, access to information, and technology security.¹⁶

The APRM has four types of reviews: 1) a review specifically for State parties undertaken 18 months after signing the declaration to provide a national action plan to adhere to the declaration; 2) a review requested by a state party for its own reasons; 3) periodic reviews every two-to-four years; 4) an early signs review that are topic specific reports that cover a theme or sector of interest for governance in African states. Based on the analysis of the APRM’s distinct elements, the author of this paper recommends the following three strategies to promote accountability and transparency in international cyber and international communication technology (ICT) security governance.

Post Accession Review

Peer review mechanisms establish post-accession reviews to identify gaps and opportunities after a state has acceded to or joined an instrument. The use of this type of review for ICT security is intended to generate significant insights pertaining to how civil society groups and governments interact. Civil society organizations can participate in this type of review at different levels: in the national governing council, which sets the rules and plans for the review at the national level and supervises the research, consultation, writing and editing of the Country Self-Assessment Report; through a panel, which supervises the peer review system as a whole and guides individual country assessments; and last, by participating in the country review teams, which are interdisciplinary teams of experts from academia and business who visit each country and write the final assessment and recommendations.¹⁷ For example, a cyber-related review mission could assess accountability and transparency, including obtaining clarity from states on operating standards, principles, and what constitutes responsible behavior; how states prioritize cybersecurity investments and measure dividends; and how they collaborate to call out malicious behavior.¹⁸

Reviews Requested by A State Party For Their Own Reasons

In the realm of ICT security, the willingness of countries to submit to constructive criticism by their peers on issues linked to such areas as public safety online would testify to the value that countries attach to guaranteeing a safe online environment for their populations. Although a cyber treaty does not exist, to mandate such reviews, existing governance bodies, including at the UN, could explore how to approach or manage a peer review request process. The UN could, for instance, consider to what extent states are pursuing some of the positive commitments contained in the 11 voluntary norms for responsible state behavior in cyberspace, endorsed by the UN General Assembly. The review could also be focused on assessing the effectiveness of the existing national and local mechanisms developed to prevent and manage selected thematic areas¹⁹ or in meeting recommendations set out by the UN Open-ended Working Group (OEWG) on ICTs.

Early Signs Review

This kind of review could be initiated to identify the challenges related to, for instance, the role of ICT in future conflicts. The focus of such an effort could be to review the experiences of countries that have encountered problems pertaining to ICT during conflicts and consolidate the findings. An early signs review could also make recommendations in accordance with international law on the promotion of human rights and fundamental freedoms and help to establish a relationship between peace and security on the one hand and ICT security governance on the other. It could also explore the nexus between governance and development and the role of regional organizations and UN agencies in international ICT security governance. The APRM has conducted reviews on unconstitutional changes of government (UCGs) with recommendations on how AU member states can invest efforts toward preventing, managing, and responding to UCGs with the ultimate objective of promoting peace, security, and stability.

What Happens Now?

Despite some concerns about global accountability and transparency in the international cybersecurity realm, there is ample reason to be optimistic about the potential for peer review mechanisms — either developing new ones specifically for cyber issues or integrating cyber and digital security into existing peer review mechanisms.

From a leadership perspective, meeting the twin challenge of capacities and capabilities while developing harmony between traditional peer review themes and cyber activities will require a new approach. Establishing a relationship between regional peer review mechanisms and the OEWG, or a future UN intergovernmental body, will be crucial. The latter can encourage states to be transparent regarding their activities in peer review self-assessments. Likewise, in a new mechanism with oversight from a UN intergovernmental body, leveraging the UN Secretariat and adding an oversight role to the chairperson’s responsibilities will be critical for states to hold each other accountable in implementing the rules, norms, and principles of responsible state behavior. Moreover, states will be well positioned to promote a common understanding of threats to information security and to work cooperatively to prevent and counter such threats, as well as others.

In addition to the advantages of the peer review process, such as providing governance assessments for external partners and investors, there are other reasons for optimism. The process helps to foster the political will for an improvement in cyber governance. The experience of the APRM has demonstrated that many African governments are willing to participate in such review processes. As with accountability measures, a crucial key to success is ambition. In the current geopolitical environment, several areas of international cyber governance, both voluntary and binding, have the potential to be pursued. Such efforts can promote bold ambitions while encouraging the adoption of context-specific intergovernmental peer reviews and increasing cyber resilience. The author of this chapter makes the following recommendations:

Establish a consolidated international ICT security plan to create a conducive political, economic, legal, and social environment in countries to achieve agreed-upon levels of cybersecurity maturity and foster support for enforcement mechanisms.
Engage with relevant UN agencies and other entities on annual progress reports to the UN Open-ended Working Group and implementation measures and foster international support for funding.
Develop an intergovernmental peer review mechanism, to ensure that progress on norms, rules, and principles of responsible state behavior, international law, confidence-building measures, and sound international security practices highlighted in the ICT security plan become irreversible.²⁰
Include the envisaged peer review mechanism in regional governance and oversight structures.

Notes

1
The African Union is comprised of 55 Member States, 42 of which participate in the APRM.
2
African Union, African Peer Review Mechanism, “Organs,” Accessed May 27, 2024, https://au.int/en/organs/aprm.
3
MO IBRAHIM FOUNDATION, “‘2022-Index-Report,” (2023), 2022 Ibrahim Index of African Governance.
4
African Peer Review Mechanism, APRM at Internet Governance Forum 2023: Shaping Africa’s Digital Governance Future, 20 (October 20, 2023, Accessed May 27, 2024, https://aprm.au.int/en/news/press-releases/2023-10-20/aprm-igf-2023-shaping-africas-digital-governance-future.
5
Carnegie Endowment for International Peace, Aiding Governance in Developing Countries: Progress Amid Uncertainties, Thomas Carothers and Diane de Gramont, (2011), accessed 3 26, 2024. http://carnegieendowment.org/2011/11/29/aiding-governance-in-developing-countries-progress-amid-uncertainties.
6
Carnegie Endowment, Aiding Governance, 44.
7
African Peer Review Mechanism, “Guidelines for Reporting Progress in the Implementation of the National Programme of Action,” SAIIA APRM Toolkit, (2008), https://www.aprmtoolkit.saiia.org.za/documents/official-documents/489-guidelines-for-reporting-on-progress-in-implementing-of-the-national-programme-of-action/file.
8
African Peer Review Mechanism, “Guidelines for Reporting Progress,” 45.
9
African Peer Review Mechanism, “MapAfrica,” (2019). https://www.afdb.org/en/projects-and-operations/mapafrica/.
10
APRM, “‘UNCONSTITUTIONAL CHANGES OF GOVERNMENT IN AFRICA,” (2023), Accessed May 27, 2024, https://aprm.au.int/en/documents/2023-07-12/africa-governance-report-2023-unconstitutional-change-government-africa.
11
APRM, A Vision Plan for the Future: Strategic Plan 2016-2020, under the Coordination of His Excellency President Cyril Matamela Ramaphosa of the Republic of South Africa and Chairperson of the APR Forum of Heads of State and Government, (2020).
12
APRM, A Vision Plan for the Future, (2016), 26.
13
Institute for Security Studies (ISS), ISS PROFILE: AFRICAN PEER REVIEW MECHANISM (APRM), (no date), accessed February 6, 2024. https://issafrica.org/profile-african-peer-review-mechanism-aprm.
14
APRM, A Vision Plan for the Future: Strategic Plan 2016-2020, under the Coordination of His Excellency President Cyril Matamela Ramaphosa of the Republic of South Africa and Chairperson of the APR Forum of Heads of State and Government, (2020).
15
APRM, APRM at APRM at Internet Governance Forum 2023: Shaping Africa’s Digital Governance Future, 20 (October 20, 2023, page numbers or access date if accessed online. https://aprm.au.int/en/news/press-releases/2023-10-20/aprm-igf-2023-shaping-africas-digital-governance-future. 2023: Shaping Africa’s Digital Governance Future, October 20, 2023, Accessed May 27, 2024, https://aprm.au.int/en/news/press-releases/2023-10-20/aprm-igf-2023-shaping-africas-digital-governance-future
16
APRM, APRM at IGF 2023.
17
ISS, The African Peer review Mechanism: Lessons from the Pioneers, R. Herbert and S. Gruzd, (2008); APRM, ISS PROFILE: AFRICAN PEER REVIEW MECHANISM, Accessed May 27, 2024, available at: https://issafrica.org/profile-african-peer-review-mechanism-aprm (Accessed: 6 February 2024).
18
Stimson Center, Fostering Accountability in Cyberspace, R. Herbert and S. Gruzd, available at: https://www.stimson.org/2023/fostering-accountability-in-cyberspace/ (Accessed: 21 February 2024).
19
Togo Officially Launches The Targeted Review On Urban Resilience, December 5, 2023, Accessed May 27, 2024, https://aprm.au.int/en/news/press-releases/2023-12-05/togo-officially-launches-targeted-review-urban-resilience.
20
ISS, The African Peer Review Mechanism.