Secure digital tools for Cameroon’s presidential work from abroad

The ability to review files, coordinate with teams, and approve administrative acts remotely is now technically feasible. However, when the head of state is involved, remote governance cannot rely on standard digital tools. It requires systems that guarantee information confidentiality, verify the leader’s identity, preserve document integrity, and track every instruction.

Recent remarks by Cameroon’s Minister of Higher Education, Professor Jacques Fame Ndongo, have reignited discussions about remote presidential governance. In a statement addressing concerns about a potential “vacancy” at the state’s helm, he confirmed that President Paul Biya continues to oversee files and issue directives—whether in person or via recognized electronic means. While this addresses political concerns, it raises a critical question: What secure digital infrastructure should a modern presidential office deploy to receive, review, validate, and archive sensitive documents when the head of state is outside national borders?

Publication on social media or official websites represents only the final step in communication—not the entire process. The path a document takes—from preparation to transmission, review, signing, registration, and storage—remains opaque.

Professional email under the @prc.cm domain

The first requirement is the systematic use of institutional email addresses tied to the official Presidency domain. Presidential staff should have personalized accounts, such as [email protected], along with functional addresses for the General Secretariat, Civil Cabinet, and other departments, like [email protected].

Personal accounts from providers like Gmail or Yahoo must never be used for transmitting draft decrees, confidential memos, appointment files, diplomatic correspondence, or state directives. Technical security capabilities alone do not address governance risks: the state cannot fully control the creation, device access, message retention, recovery, or deactivation of private accounts.

A professional email system under @prc.cm would enable:

• Centralized creation and revocation of staff accounts;
• Enforcement of multi-factor authentication;
• Secure retention of official exchanges;
• Detection of suspicious logins;
• Blocking automatic transfers to personal inboxes;
• Implementation of unified security and archiving policies.

Such a system must prevent identity theft and phishing through SPF, DKIM, and DMARC protocols, while encrypting server-to-server communications. However, even a secure institutional email should not send highly sensitive documents as attachments. Instead, it should notify recipients that a file is available in a presidential secure platform.

A presidential document management platform

The Presidency requires a dedicated electronic document management system for state affairs. Each file should be logged with:

• A unique reference number;
• The author’s identity;
• A confidentiality level;
• Authorized viewers;
• Document versions;
• Comments and approvals;
• Validation dates;
• A complete access history.

This allows the president to review documents from a secure terminal, add observations, request changes, or approve proposals without files being copied across devices or sent to personal emails. For highly sensitive files, the platform should block local downloads, printing, text copying, or unauthorized sharing. It must also log who accessed a document, when, from which device, and what modifications were made.

Verifiable presidential electronic signatures

Remote validation of decrees or decisions should not rely on scanned images of a signature. Instead, a digital signature based on cryptographic certificates ensures:

• Signatory identity verification;
• Document integrity;
• Timestamped validation;
• Post-signature tamper detection.

The cryptographic key for major acts should be stored in a hardware security module—not on a personal computer, USB drive, or mobile phone. Its use must require direct presidential authentication and generate a timestamped audit trail. For critical decisions, the process may include multiple checks: presidential approval, technical signature verification, legal review, official registration, and public release.

Zero Trust architecture for remote access

While a VPN secures connections between officials abroad and presidential servers, it should not be the sole safeguard. A Zero Trust approach assumes no user, device, or network is inherently trustworthy. Access requests should be verified based on:

• User identity;
• Device type;
• Connection location;
• Document sensitivity level;
• User permissions;
• Behavioral patterns during the session.

Access to presidential files may require an official device, digital certificate, encrypted connection, physical security key, and local biometric verification simultaneously.

Exclusively institutional devices

Presidential files must never be accessed from personal phones or computers. Staff in the Civil Cabinet, General Secretariat, and related departments should use institutionally owned and managed devices that are:

• Fully encrypted;
• Regularly updated;
• Limited to authorized applications;
• Separate from personal use;
• Remotely erasable if lost;
• Automatically locked after inactivity;
• Blocked from unsecured public Wi-Fi networks.

A centralized device management solution allows the administration to deploy updates, block risky apps, revoke devices, and remotely wipe data in case of theft or compromise.

Anti-phishing authentication

A strong password alone is insufficient for accessing presidential files. Authentication should combine:

• An official device;
• A personal PIN;
• A physical security key;
• Optional local biometric verification.

While SMS codes add security, they remain vulnerable to attacks. For sensitive accounts, physical keys and digital certificates offer stronger phishing resistance. Staff should also be trained to recognize fraudulent messages, urgent scams, malicious links, and impersonation attempts.

WhatsApp: useful for alerts, not document transmission

WhatsApp’s end-to-end encryption protects message content during transmission, but it cannot serve as an official document management platform. Risks include:

• Loss or espionage of devices;
• Screenshots or unauthorized transfers;
• Inadequately protected backups;
• Personal use of linked devices;
• Retention of files after staff departures.

WhatsApp cannot classify files, manage permissions, track versions, record approvals, or ensure administrative archiving. It may be used to alert staff that a file is available in a secure presidential space—for example: “The file referenced PRC/SG/2026/125 is ready for review in your secure workspace.” The document itself must never be attached.

Secure government videoconferencing

Remote interactions between the president and advisors should use dedicated, government-grade videoconferencing platforms that provide:

• Encrypted communications;
• Participant identity verification;
• Strict invitation controls;
• Restrictions on unauthorized recordings;
• Access logs;
• Exclusive use of institutional devices;
• Controlled data hosting.

Public links, free accounts, and unvetted apps should never be used for defense, diplomacy, appointments, or government arbitrations.

Classifying documents by sensitivity

Not all presidential documents carry equal risk. A classification policy could include four tiers:

• Public: intended for dissemination;
• Internal: restricted to state services;
• Confidential: disclosure could harm public action;
• Highly sensitive: relating to defense, intelligence, diplomacy, strategic appointments, or major decisions.

Each level determines transmission channels, authorized personnel, device restrictions, printing permissions, retention periods, and archiving methods. A public document may be sent via professional email, while a highly sensitive file should only be accessible in a tightly controlled platform.

Complete traceability of every decision

Every access, modification, validation, or transmission must be automatically logged. Security journals should detail:

• Who accessed the document;
• When and from which device;
• What changes were made;
• Who approved the final version;
• When the document was registered and published.

A security operations center could detect unusual logins, bulk downloads, access from unrecognized devices, or unauthorized modifications. This traceability aids investigations into leaks, intrusions, or authenticity disputes.

Distinguishing official decisions from social media posts

Presidential Facebook and X accounts enable rapid public communication but must not be confused with systems used to prepare and validate decisions. Before a decree is posted online, it must follow a secure process:

• Transmission through authorized channels;
• Authentication of the competent authority;
• Assurance that the final version is unaltered;
• Timestamped validation;
• Preservation of the original in official archives.

A visible signature on a published image does not constitute full digital proof. Security depends on the integrity of the entire process preceding publication.

Ten priority measures for the Presidency

The Republic of Cameroon’s Presidency could implement ten key actions:

1. Mandate professional email under the @prc.cm domain;
2. Ban personal Gmail, Yahoo, and similar accounts for official business;
3. Deploy a presidential electronic document management platform;
4. Introduce secure institutional electronic signatures;
5. Provide exclusively professional phones and computers;
6. Enforce multi-factor authentication resistant to phishing;
7. Limit WhatsApp to alerts and coordination;
8. Classify documents by sensitivity levels;
9. Centralize access logs in a security operations center;
10. Train staff regularly on espionage, phishing, and information leaks.

While no public evidence confirms the current use of these systems, they represent the minimum safeguards a presidential institution must adopt to handle remotely sensitive files affecting finance, diplomacy, security, and state continuity.

The challenges of secure document transmission, electronic signatures, data sovereignty, and digital continuity will be central to E-Gov’A 2026 – E-Gov Africa Summit, Expo & Awards, scheduled for October 14–16, 2026, at the Palais des Congrès in Yaoundé. The event, supported by Cameroon’s Ministry of Posts and Telecommunications, will explore the theme: “Artificial intelligence and e-governance: building efficient public services in a cashless, paperless Africa.”