For the third time in a month, the fledgling pan-African antitrust enforcer’s web site has been disabled by hackers

As competition-law attorneys counseling clients on the necessity of notifying mergers in the COMESA jurisdiction, we view these developments with – put mildly – shock.  This is especially true as confidential party data and documents would appear to be at risk of involuntary and malicious disclosure to third, unauthorized parties.  As reported at AfricanAntitrust.com, the COMESA enforcement agency’s web site has previously been hacked and later simply disabled.

COMESA leadership non-responsive

On both prior occasions, AAT’s editors wrote to the COMESA Competition Commission‘s webmaster, as well as the agency’s leadership (Messrs. George Lipimile and Willard Mwemba), to seek an explanation of the attacks.  We also asked them about the safety of data and other confidential party information submitted to the CCC via its extranet & online document repository.

Not only have we not received any response to date.  What’s more, in a – perhaps unsurprising, at this stage – turn of events, the Commission has now been subjected to its third hacking attack.

Hackers boast of achieving successful attack

This latest episode also embodies the most disconcerting hack, as it appears visually and substantively more malicious than the prior attacks (one of which featured an Indonesian love poem, whilst the second rendered the CCC’s page simply blank).  A visual example of the latest attack can be found below.  The hackers (identified as “Kinal Undetected” from SerdaduPerangCrew and SPCSO) [note: prior and subsequent links open hacker-related pages] acknowledge – for the first time – that it is an intentional event and not merely an accidental outage or otherwise unintended gaffe of the CCC’s webmaster.  Moreover, the perpetrators even submitted a screenshot of the intrusion to “Zone H“, a clearing-house of hackers, as evidence of the attack on Monday.  This means that the CCC’s site has been disabled for at least two full days (through 14 May — UPDATE: the regular COMESA site is back up and running at 16:00 CET, 14th May).  On the prior occasions, the site likewise remained compromised for several days in a row.

High risk of data security breach & next steps

We are in the process of sending yet another follow-up e-mail to the CCC’s executives to obtain further information about this unsettling and embarrassing security breach/failure, including: (1) risks to confidential corporate information, (2) the impact on the private deliberative process of the Commission, as well as (3) steps the CCC intends to take to prevent future replication of these embarrassing and dangerous attacks, including (we propose) the retention of a professional data-security firm for advice and potentially management of the web interface.

 

Call for parties to CCC proceedings to take action

Especially in light of COMESA staff’s unsettling silence in response to alerts to these attacks, and as we have done before, we are notifying our readership (and particularly current or potential future parties to CCC merger reviews) regarding the deficiencies in the competition enforcer’s electronic systems. These may impact the timetable and resulting deadlines of pending merger investigations, and it is advisable that all such interested parties enquire with the Competition Commission about the procedural effect of the outage.