Legal challenges and the accountability questions behind the system
Key Facts:
Part One showed how MACRA procured the social media monitoring system and why the contract attracted scrutiny.
Part Two examines what happened after the award: the legal challenges, institutional responses, and the accountability questions that remain unresolved.
Civil society challenges the procurement
The contract announcement prompted an unusually coordinated response from civil society organisations, digital rights advocates and regional networks. Their concerns were legal, economic and political.
None halted the procurement.
Digital Governance Associates Malawi was among the organisations that wrote to MACRA questioning the procurement. Correspondence raising concerns was copied to the Public Procurement and Disposal of Assets Authority (PPDA).
However, PPDA Public Relations and Communications Manager Mandy Pondani said the Authority has no record of receiving a formal complaint requesting a procurement review.
As a result, she said, PPDA neither initiated an investigation nor issued any findings, determinations or recommendations relating to the contract.
On Jan. 17, 2025, the Centre for Human Rights and Rehabilitation (CHRR) and Youth and Society (YAS) jointly wrote to MACRA’s board.
The organisations acknowledged that misinformation and disinformation present legitimate public interest concerns.
They argued, however, that deploying a surveillance-capable platform without adequate safeguards posed significant risks to privacy, freedom of expression and access to information.
Their letter cited Sections 21, 35 and 37 of Malawi’s Constitution, which protect the rights to privacy, freedom of expression and access to information.
It also relied on Article 19 of the International Covenant on Civil and Political Rights, Article 9 of the African Charter on Human and Peoples’ Rights, and Principle 41 of the African Commission’s Declaration of Principles on Freedom of Expression and Access to Information.
Principle 41 discourages the indiscriminate collection, storage and analysis of personal communications without prior judicial authorisation.
The organisations also cited African Commission Resolution 573 of 2024, which calls for transparency, judicial oversight and compliance with international human rights standards in the deployment of surveillance technologies.
They urged MACRA to suspend the procurement, disclose the contract’s scope and explain the safeguards governing the system.
MACRA acknowledged receiving the correspondence. It did not provide a substantive response to the concerns raised. On Jan. 21, CHRR and YAS escalated the matter to Parliament.
In a letter to Parliament’s Committee on Media, Information and Communication, the organisations invoked Parliament’s constitutional oversight role and cited Section 46 of the Public Procurement and Disposal of Public Assets Act, which permits procurement proceedings to be cancelled where doing so is considered to be in the public interest.
They asked the committee to direct MACRA to halt the procurement and disclose the system’s technical capabilities. Former committee chairperson Susan Dossi acknowledged receipt of the correspondence.
Pondani said PPDA’s position is that procuring entities should first be given an opportunity to explain their procurement decisions before the Authority intervenes.
According to Pondani, PPDA would initiate a formal review only if stakeholders first sought explanations from MACRA and subsequently produced evidence showing that the regulator had failed to account satisfactorily for the procurement.
“The Authority is willing to initiate a review of this procurement upon submission of a request… with evidence that MACRA has failed to account,” Pondani said.
The parliamentary committee subsequently engaged MACRA and other stakeholders.
According to CHRR, however, the committee issued no formal written determination, binding directive or public report requiring the procurement to be suspended.
The project continued.
On Jan. 27, the Net Rights Coalition, a pan-African digital rights network, also wrote to MACRA.
The coalition warned that the system’s reported technical architecture appeared capable of facilitating targeted mass communications surveillance and argued that the procurement should be viewed not simply as a technology acquisition but as a human rights issue.
Citing Principle 41 of the African Commission’s declaration, it called for stronger safeguards before the system was deployed.
An appeal to the Presidency
By February 2025, efforts to halt the procurement through MACRA and Parliament had produced no substantive outcome. CHRR and YAS therefore turned to the country’s highest political office.
In a letter dated Feb. 11, 2025, the organisations wrote to then-President Lazarus Chakwera, requesting that he intervene to suspend the procurement pending broader public consultation.
They argued that introducing surveillance capabilities in an election year raised significant democratic concerns and warranted independent scrutiny.
The organisations called for a review of the system’s necessity, legality and proportionality. They also sought public assurances that any deployment would comply with Malawi’s Constitution and the country’s international human rights obligations.
The Office of the President and Cabinet did not issue a substantive response.
CHRR Executive Director Michael Kaiyatsa said the organisation could only speculate as to why.
“The concerns may not have been prioritised,” he said. “Or perhaps they were considered to fall within MACRA’s mandate as an independent regulator. Any explanation for the lack of response would be best provided by the Office of the President and Cabinet itself.”
The correspondence marked the final formal attempt by civil society to halt the procurement before installation began.
A delegation visits Accra
As criticism of the procurement intensified, a multi-stakeholder delegation travelled to Accra in February 2025 to meet Hashcom representatives and inspect the company’s operations.
The delegation included parliamentarians, representatives of the ICT Association of Malawi, civil society organisations and journalists.
During the visit, Hashcom Marketing Manager Dorcus Kone said the platform processed only publicly available information and did not access private Facebook messages or WhatsApp communications.
The delegation also met Edmund Fianko, then acting director general of Ghana’s National Communications Authority (NCA). Fianko spoke positively about a separate broadcasting monitoring system that the NCA had procured from Hashcom.
CHRR did not participate in the visit.
Kaiyatsa said his organisation was therefore unable to comment on what the delegation observed, what assurances were given, or whether a formal report documenting the visit was ever produced.
The visit answered some technical questions. It resolved few accountability concerns.
A human rights review that reached its limits
The Malawi Human Rights Commission (MHRC) became involved in January 2025 after receiving a complaint from the Democracy and Governance Advocacy Group, which argued that the procurement threatened the rights to privacy and freedom of expression.
On Jan. 23, 2025, MHRC Chairperson Chikondi Chijozi publicly confirmed that the commission’s legal team was assessing the complaint.
In its response to this investigation, however, Chijozi clarified the scope of MHRC’s involvement. It did not conduct a technical inquiry into the system’s capabilities.
Following its preliminary legal review, MHRC wrote to MACRA in February 2025 recommending safeguards to protect human rights.
Those recommendations included stronger protections for privacy and freedom of expression, greater accountability and transparency in the system’s administration, and measures to strengthen data security.
MACRA replied that the procurement fell within its statutory mandate.
The regulator stated that the platform was intended solely to monitor trends in misinformation and disinformation using publicly available information and had not been designed to interfere with personal privacy.
MACRA also said it had consulted key stakeholders, including media organisations, the ICT Association of Malawi and civil society groups.
The regulator invited the MHRC to inspect the system through a due diligence visit. That inspection never took place.
According to the commission, MACRA initially proposed a visit on May 12, 2025, but repeatedly postponed the meeting. The commission ultimately discontinued its follow-up. No inspection was conducted. No findings were published.
In its response to this investigation, Chijozi acknowledged a significant institutional limitation.
He said MHRC lacks the specialist technical expertise required to investigate digital surveillance infrastructure of the type procured by MACRA.
Chijozi also said MHRC remains unaware of any changes to the system’s status, operation or management following the September 2025 general election and the subsequent change of government.
The review reached its institutional limits. The accountability questions remained.
Election day and its aftermath
By the time Malawians voted on Sept. 16, 2025, the controversy surrounding the monitoring system had largely faded from public debate.
Many of the questions raised when the procurement was announced remained unresolved.
No independent audit had been conducted. No public demonstration of the platform’s capabilities had been held. This investigation identified no public record establishing whether the system was fully commissioned and operational on polling day.
Whether it was used during the election remains unclear.
The Malawi Electoral Commission (MEC), which administered the election, said it had no role in procuring, implementing or overseeing the system.
In response to questions for this investigation, MEC Director of Media and Public Relations Sangwani Mwafulirwa said the commission was not a party to the procurement, implementation or operation of the platform.
“MACRA is an independent statutory body established under its own legal framework and is responsible for executing its mandate in accordance with the laws governing its operations,” Mwafulirwa said.
He added that telecommunications regulation, internet governance and communications monitoring fall within the mandates of other institutions established by law.
“The Commission therefore did not take a formal position on the operational aspects of the MACRA-HASHCOM system,” he said.
The MEC’s position reflects the limits of its statutory mandate, which is confined to administering elections and referendums.
Its response also illustrates a broader institutional gap.
A surveillance-capable system was installed in the months preceding a national election. Yet no public institution responsible for safeguarding the integrity of that election appears to have independently established how the system operated, what information it collected or what safeguards governed its use.
The election resulted in a decisive victory for Peter Mutharika of the Democratic Progressive Party, who defeated incumbent President Lazarus Chakwera with 56.8% of the vote.
The change of government brought new leadership at MACRA.
In October 2025, the new administration suspended Director General Daud Suleman pending investigations. The Office of the President and Cabinet announced the suspension but did not specify whether it included the Hashcom procurement.
On Feb. 4, 2026, Suleman was dismissed following findings of alleged financial and administrative misconduct. No public document reviewed for this investigation indicates whether those proceedings examined the Hashcom contract.
Mayamiko Nkoloma was confirmed as MACRA’s director general the following month after the regulator’s board was reconstituted.
Neither the leadership changes nor the transition in government was accompanied by a public accounting of the monitoring system.
By January 2026, a group calling itself the Concerned Citizens of Malawi People Power Movement publicly criticised MACRA for failing to honour what it described as a commitment to brief the public on the procurement.
Several members of the group had participated in the Accra delegation.
In a public statement, they described MACRA’s continued silence on the project as unacceptable. The questions persisted.
The legal framework and its gaps
The issues raised by MACRA’s procurement extend beyond procurement law and institutional accountability. They also expose unresolved questions within Malawi’s legal framework governing digital surveillance.
At the centre of that framework lies a continuing tension between two competing principles: the state’s authority to regulate communications in the public interest and the constitutional rights to privacy and freedom of expression.
Section 21 of Malawi’s Constitution guarantees every person protection against interference with private communications.
The legal framework governing digital surveillance, however, is less clearly defined.
The Electronic Transactions and Cyber Security Act of 2016 has attracted criticism from legal scholars and digital rights advocates who argue that several provisions grant broad state powers without establishing sufficiently robust safeguards.
Among those critics is University of Malawi senior lecturer Jimmy Kainja, writing in the African Human Rights Law Journal.
Kainja identifies Section 84(2) as a particular concern because it permits a Cabinet minister to determine the circumstances in which data interception may be authorised.
He argues that decisions of that nature should instead be subject to prior approval by an independent judicial authority.
That position is consistent with African Commission Resolution 573 of 2024, which calls for surveillance measures to receive advance judicial authorisation and to be subject to effective independent oversight.
Malawi is also a party to the International Covenant on Civil and Political Rights and the African Charter on Human and Peoples’ Rights, both of which recognise protections for privacy and freedom of expression.
This investigation identified no publicly available document indicating that judicial authorisation was obtained for MACRA’s social media monitoring system.
That absence should not be interpreted as evidence that no authorisation exists.
But neither MACRA nor any oversight institution has publicly clarified whether such approval was sought or granted.
In 2024, Malawi enacted the Data Protection Act. The following year, it established the Data Protection Authority. Both measures were widely welcomed as important steps toward strengthening privacy protections.
Kainja argues, however, that important gaps remain.
His analysis points to capacity constraints within the new authority and legislative exemptions that may permit state institutions to avoid certain data protection obligations on grounds of national security.
Whether those safeguards are sufficient to govern increasingly sophisticated surveillance technologies remains an open question.
A history that sharpens the concern
For critics of MACRA’s procurement, the unanswered legal questions cannot be viewed in isolation.
They are informed by a broader history of cases involving online expression, digital communications and allegations of state surveillance over the past decade.
In August 2019, private WhatsApp conversations involving members of the Human Rights Defenders Coalition were leaked and circulated publicly by supporters of the then-ruling Democratic Progressive Party.
How those communications were obtained has never been publicly explained. A series of prosecutions linked to online speech followed.
In 2018, activist Manes Hale was detained over Facebook posts concerning then-President Peter Mutharika.
The following year, Tumpale Mwakibinga was charged under the Electronic Transactions and Cyber Security Act after posting criticism of the first lady on Facebook.
In May 2021, Ignatius Kamwanje was convicted and sentenced to 18 months’ imprisonment over a Facebook post alleging financial misconduct at the National Bank of Malawi.
In January 2022, journalist Joshua Chisa Mbele was arrested after sharing on Facebook a document alleging corruption involving government officials.
That same month, musician and activist Bon Kalindo became the subject of an arrest warrant after allegedly insulting President Lazarus Chakwera. The warrant was later withdrawn following public criticism.
Also, in January 2022, police arrested 20-year-old Chisomo Makala after tracing a phone number allegedly used to share, in a WhatsApp group, a video interpreted as mocking the president.
Each case arose in different legal and factual circumstances.
Taken together, however, they have fuelled concerns among civil society organisations about how laws governing digital communications may be applied in practice.
Kaiyatsa drew a careful distinction.
“The procurement of a dedicated social media monitoring system,” he said, “amplified rather than introduced those risks.”
His point does not establish that the K2 system was used to monitor protected speech. It explains why civil society viewed the procurement through the lens of previous experiences.
Unanswered questions
More than a year after installation of the system began, the questions first raised by civil society in January 2025 remain unresolved.
Whether the platform was fully operational during the 2025 general election has not been publicly established.
No public record reviewed for this investigation identifies what information the system collected, who had access to that information, what safeguards governed its operation, or whether any independent authority exercised oversight.
The institutions best placed to answer those questions have provided only limited public disclosure.
The Malawi Human Rights Commission did not complete a formal inquiry, citing institutional capacity constraints after its planned inspection of the system did not proceed.
Parliament’s communications committee engaged the issue but issued no binding public determination.
The director general who oversaw the procurement was later dismissed on unrelated grounds. His successor has made no public statement addressing the system.
CHRR says it continues to monitor developments.
Kaiyatsa does not allege that any institution acted unlawfully. Instead, he argues that the procurement process could have been more transparent and more inclusive.
“We recognise that the institutions we engaged were operating within their respective mandates and may have reached conclusions different from those advocated by civil society,” he said.
“But there could have been greater transparency, broader public consultation, and more meaningful stakeholder engagement. Given the sensitivity of the technology involved and the proximity of the 2025 general elections, a more inclusive process could have strengthened public confidence in whatever decision was ultimately reached.”
CHRR has called for reforms, including legislation specifically governing surveillance technologies, judicial oversight before deployment, stronger independent accountability mechanisms, and meaningful public participation in decisions involving technologies with significant human rights implications.
Whether the current administration will pursue those reforms remains uncertain because the central question that emerged in January 2025 therefore remains unanswered.
With financial support from the HIVOS Connect! Defend! Act! Programme, this article is published under a Creative Commons license to ensure open, equitable access to information.
