Illegal Eavesdropping in West Africa: Risks, Law and Liability

Electronic eavesdropping is not a victimless act of curiosity. It is, in most circumstances, unlawful — and the exposure it creates does not stop with the person holding the receiver. For the organisation whose information leaks, and for the directors who were supposed to protect it, an interception incident can become a governance failure, a regulatory problem and a liability question all at once. This article sets out the risk categories in general terms and makes the fiduciary case for treating countermeasures as routine rather than reactive. It is not legal advice; specific matters should be taken to qualified counsel.

Eavesdropping is a legal wrong, not a grey area

It is easy to imagine that covertly listening to a rival, an employee or a counterparty occupies some ethical middle ground. In law and in professional practice, it generally does not. Intercepting private communications without authority engages several well-established categories of legal wrong at once — privacy and confidentiality obligations, protections around communications and data, and the duties that attach to anyone handling another party’s information.

The precise statutes, penalties and enforcement mechanisms vary between jurisdictions across West Africa, and they evolve. What does not vary is the direction of travel: privacy and data-protection regimes across the region have been strengthening, and the categories of conduct they capture have been widening. Rather than lean on any specific citation, the safer working assumption for a business is simple — if a communication was meant to be private, intercepting it is a legal risk, and the burden of that risk is real.

Who carries the liability

The person who plants the device is the obvious wrongdoer. But liability rarely stays with them alone.

An organisation that benefits from intercepted information — that acts on a competitor’s leaked strategy, for instance — risks being drawn into the wrong itself, exposing it to civil claims and reputational damage. An organisation that fails to protect the confidential information entrusted to it may breach obligations owed to clients, counterparties, employees or regulators, quite independently of who did the intercepting. And the individuals charged with stewardship — directors and officers — can find that a preventable breach becomes a question about the adequacy of their oversight.

In other words, both sides of an eavesdropping incident carry exposure: the party that listened, and the party that failed to keep its own space secure. That second category is where most legitimate businesses actually sit, and it is the one most often overlooked.

The regional business context

West Africa’s commercial environment sharpens the incentive to eavesdrop. Deals are relationship-driven and frequently negotiated face to face, which means the most valuable information is spoken long before it is documented. Competition for major contracts, concessions and cross-border transactions is intense. Leadership transitions, joint ventures and disputes create moments where the value of knowing a counterparty’s true position spikes.

At the same time, physical access to sensitive spaces is often easier to obtain than executives assume — through contractors, temporary staff, shared buildings and informal visits. The combination of high-value spoken information and imperfect access control is precisely the environment in which technical surveillance thrives. Understanding the specific threats you actually face is the starting point for managing them, rather than assuming the risk is someone else’s problem.

Fiduciary duty makes countermeasures a governance issue

Here is the reframe that matters. Protecting confidential information is not merely prudent housekeeping — for those who run an organisation, it is an extension of the duty they already owe.

Directors and senior officers hold a fiduciary duty to act in the organisation’s best interests and to exercise reasonable care in safeguarding its assets. Confidential information — deal terms, strategy, client data, privileged material — is an asset. Left undefended, its loss can inflict damage as severe as the loss of any physical or financial asset. Viewed this way, verifying that your most sensitive spaces are secure is not an optional extravagance; it is part of discharging the duty of care.

This is why serious TSCM programmes are built to satisfy due-diligence and fiduciary obligations. A documented sweep — what was searched, what was found, what was mitigated — is evidence that the organisation took reasonable steps to protect what was entrusted to it. Should a breach ever be litigated or investigated, the difference between “we swept quarterly and documented it” and “we never checked” is stark.

Why regular sweeps beat reactive ones

Most organisations only think about eavesdropping after something has already leaked — which is the worst possible moment. By then the damage is done, the evidence may have been removed, and the response looks like panic rather than governance.

A single sweep secures a moment; a programme secures the calendar. A device planted the week after a one-off inspection can sit undetected until the next crisis. Recurring sweeps — quarterly is typical for high-value environments — close that window and, just as importantly, create the standing record that demonstrates diligence. This is the logic behind structured TSCM inspection and survey programmes: they turn countermeasures from a reactive scramble into a routine control, the way financial audits or fire inspections already are.

What to take from this

Eavesdropping is unlawful, its liability reaches beyond the person who did it, and West Africa’s deal-making environment makes spoken information unusually exposed. For directors and officers, protecting that information sits inside an existing duty of care rather than outside it. The practical response is neither alarm nor complacency: it is to treat regular, documented TSCM as a normal governance control, and to take any specific legal question to qualified counsel. If you would like to understand your own exposure, a confidential consultation is the place to start — handled in strict confidence, with no obligation.