By CSE Stephanie Fitswemila Philip, Economic and Financial Crimes Commission Academy, Abuja, Nigeria
At the 2023 Council of Europe Octopus Conference in Romania, themed "Cooperation on Cybercrime & Electronic Evidence", Nigerian delegate Mr. Abdul-Hakeem Ajijola remarked "Cybercrimes may be committed in Africa, but the evidence does not reside in Africa". His words capture what the investigators face in nearly every cybercrime case in Africa. Evidence often lies in an app, a transaction, a method, a route, a location, a forged document, a conspirator, a mule, or a victim frequently outside their jurisdiction. Beyond identifying facts, investigators must also extract, process, and preserve evidence for prosecution. This is not just an African problem but a global challenge demanding urgent action.
The Vanishing Evidence
In December 2024, the Economic and Financial Crimes Commission (EFCC) raided a cybercrime ring in Lagos operated by Chinese nationals. The suspects ran an elaborate scam centre, with schemes ranging from Investment scams to romance scams and cryptocurrency-related frauds targeting victims worldwide. (EFCC, 2024) Once news of the arrests went public; their cloud-hosted email accounts and crypto dashboards shut down automatically. Conversations that had taken weeks to track disappeared overnight, and Investigators scrambled to recover evidence for prosecution. It was a stark reminder, that in today’s investigations, cybercriminals utilise relevant technology to refine their fraud and conceal their tracks. Unlike physical files stored in a cabinet, today’s evidence often lives in the cloud its intangible, volatile and designed to disappear at a keystroke.
Why Electronic Evidence Matters
From romance scams to crypto laundering to organized phishing campaigns, almost every modern financial crime is digitally enabled.
- Digital footprints -emails, encrypted messages, IP logs, metadata and cloud storage records are the new fingerprints often stored on servers located outside the country where the crime was committed.
- Financial trails - bank transfers, crypto transactions, payment service records cross borders in seconds. Victims might be in Europe, the transactions routed through Asia, and the proceeds cashed out in West Africa and vice versa.
- Cloud storage and apps such as WhatsApp, Facebook, Telegram, or Gmail are frequently used, but their servers are outside Nigeria’s jurisdiction.
Even when a suspect device is seized, the corroborative data timestamps, backups, chats, account ownership often rests with foreign service providers. Courts increasingly demand electronic evidence to prove intent, establish links between suspects, and trace illicit funds. (The Nigerian Evidence Act, 2023). Yet unlike physical evidence, electronic evidence is volatile, intangible, and frequently outside national borders making it both critical and frustrating for investigators.
Challenges in the Field
Challenges of extracting, processing, and preserving evidence from cloud-based platforms, volatile and self-destructing data, technical gaps, and chain of custody dilemmas are daily challenges. Typically, the scam centre in Lagos relied on cloud-hosted accounts that were neither operated in Nigeria nor stored on Nigerian servers. Suspects also configure auto-delete triggers, encrypted vaults, or timed wipes. (Barret, 2020) In most cases, a mere invitation to interview the suspect or the announcement of arrests is enough to destroy accessible records. Oftentimes, Investigators are caught between balancing retrieval of evidence with breach of fundamental human rights of suspects. When official access is unavailable investigators sometimes rely on screenshots, manual captures, or volatile logs. (Provendata, 2025) While useful, such evidence faces admissibility challenges in court. Defense lawyers can argue tampering, lack of metadata, or breaks in the chain of custody.
Nigeria and much of West Africa have capable forensic labs, but many lack AI-powered tools that can process massive cloud-based datasets, decrypt communication, or analyze blockchain transactions in real time. While the EFCC Forensics Lab stood up to the task, analysing and extracting data from over 1,500 computers, 4,000 phones, and 3,399 SIM Cards, among others, from the Operation Eagle Flush was overwhelming. (Premium Times, 2025). Even when investigators seize devices, jurisdictional hurdles remain. While Law Enforcement Agency (LEA cooperation and Mutual Legal Assistance Treaties (MLATs) exist to help, they are often too slow. Without timely international collaboration, critical evidence is lost.
The Legal Tightrope: On course but not yet there
Investigators are not only battling criminals but also navigating conflicting international laws.
- The Budapest Convention remains the gold standard for cybercrime cooperation, with Article 18 of the Convention clearly mandating data preservation. Yet implementation still lags in some areas.
- The U.S. CLOUD Act compels American tech companies to provide data when requested by U.S. authorities but offers little direct relief to African investigators without U.S. collaboration. The standoff following the Binance Investigation in Nigeria with regard submission of information on Nigerian users requested by the EFCC is a test of the limitations of some of these provisions. (Punch, 2024)
- Regionally, the African Union's Malabo Convention sets a harmonised framework, but enforcement mechanism remain weak and cross border admissibility of evidence is inconsistent.
- In Nigeria, the Cybercrime Act, 2024, the Evidence Act, 2023, and the Data Protection Act, 2023 are significant leaps in the regulatory and prosecution landscape, expanding the scope of electronic evidence to include digital signatures, records retention, and data protection and preservation as well. These are significant steps forward but cannot replace the technical tools and skills needed for effective evidence retrieval and analysis.
Best Practices and Practical Lessons
The disruptive nature of tech and tech tools has eroded the traditional national sovereignty that once guarded national borders; hence, collaboration remains a relevant tool in this fight. A feat every framework tries to achieve, and it's working. Despite these hurdles, certain strategies can improve outcomes.
a. Early Preservation
Investigators must act swiftly by disconnecting devices, preserving volatile memory, and creating forensic images immediately. Delay is the enemy of electronic evidence.
b. Documentation Discipline
Document everything even screenshots or manual captures can be admissible if date, time, and method are properly logged.
c. Build Partnerships
Engage with global service providers (Google, Meta, Microsoft) through existing frameworks. Proactive liaison, not reactive requests, reduces delays.
d. Regional Cooperation
Africa needs an Economic Community of West African States (ECOWAS) or African Union (AU) led digital evidence protocol. A harmonised framework backed by implementation mechanisms would speed cross-border evidence sharing and reduce dependence on Western treaties.
e. Invest in Local Forensic Capacity
Labs must integrate AI and cloud-compliant tools to analyse large datasets, blockchain transactions, and encrypted communications. This reduces reliance on foreign agencies.
Conclusion
Electronic evidence is no longer “supporting material” but often the central pillar of modern prosecutions. (Chenoris & Parente LLC, 2024) Unless jurisdictions build capacity and harmonise legal frameworks, justice will continue to lag behind cybercriminals who adapt faster than law enforcement. The Chinese scam centre case taught us that beyond the arrest, seizures, and raids, preservation and presentation of the electronic evidence is key to a successful prosecution. Cybercrime syndicates are innovating daily, often exploiting legal and technical gaps across borders. If electronic evidence remains elusive, prosecutions will falter, and public confidence will be eroded. This is the time to invest in forensic independence, harmonise laws, and build a culture of rapid preservation.
Author Bio:
With over 15 years of frontline investigative experience, Stephanie Fitswemila Philip works at the intersection of governance, technology, and society, examining how corruption adapts in the digital age. A trainer at the Economic and Financial Crimes Commission Academy (EFCC) she specialises in cyber fraud, financial scams, and investment fraud, translating practitioner expertise into teaching and capacity building. Her research explores political financing, state capture, and the role of emerging technologies such as AI and blockchain in crime and governance, with a particular focus on the gendered impacts of cybercrime. Committed to bridging practice, policy, and research, Stephanie Fitswemila Philip aims to strengthen anti-corruption systems and safeguard vulnerable voices.
Sources:
Barret, D. 2020. Cloud Based Evidence Acquisitions in Digital Forensic Education. Information Systems Education Journal (ISEDJ). ISSN: 1545-679X. December 2020 18(6)
Convention on Cyber Security and Personal Data Protection (Malabo Convention). African Union, 2014
https://au.int/en/treaties/african-union-convention-cyber-security-and-personal-data-protection
Convention on Cybercrime (Budapest Convention) Council of Europe, 2001
https://www.coe.int/en/web/cybercrime/the-budapest-convention
Court Orders Binance to release data on Nigerian users. Punch, 2024
https://punchng.com/court-orders-binance-to-release-data-of-nigerian-users-to-efcc/
Court Orders forfeiture of 5,600 phones, laptops, SIM cards, and home appliances linked to cyber fraud syndicate. Premium Times, 2025 https://www.premiumtimesng.com/news/top-news/790220-court-orders-interim-forfeiture-of-over-5600-phones-laptops-sim-cards-home-appliances-linked-to-cyber-fraud-syndicate.html
Cybercrime (Prevention, Prohibition, etc) (Amendment) Act, 2024
https://cert.gov.ng/ngcert/resources/CyberCrime__Prohibition_Prevention_etc__Act__2024.pdf
EFCC Bursts 792 Cryptocurrency investment romance fraud suspects in Lagos… arrest 193 Chinese, Filipinos, Arabs, and others. https://www.efcc.gov.ng/efcc/news-and-information/news-release/10584-efcc-bursts-syndicate-of-792-cryptocurrency-investment-romance-fraud-suspects-in-lagos-arrests-193-chinese-arabs-filipinos-others
The Impact of Digital Evidence in Modern Criminal Trials. Cheronis & Parente LLC, 2024 https://www.cheronislaw.com/blog/2024/01/the-impact-of-digital-evidence-in-modern-criminal-trials/
What is Metadata Forensics and how it is used in Investigations. Proven Data, 2025. https://www.provendata.com/blog/what-is-metadata-forensics/