Key Facts:
The Malawi Communications Regulatory Authority procured a social media surveillance platform in September 2024.
Civil society challenged the decision. Parliament was petitioned. The former president was asked to intervene.
The system was installed anyway. More than a year later, key questions about how it operated, what it collected, and who oversaw it remain unanswered.
By Collins Mtika
On the morning of Jan. 29, 2025, seven Ghanaian nationals arrived at Mpingwe Peak, a communications facility overlooking Malawi’s commercial capital, Blantyre.
Working inside the former Malawi Telecommunications Limited complex, they began assembling what procurement records described as an integrated social media monitoring system.
The installation had been commissioned by the Malawi Communications Regulatory Authority (MACRA).
Contract MACRA/IPDC/ISMDTM/2024/09/01 was awarded to Ghana-based Hashcom Ghana Limited for MK2.6 billion, approximately $1.5 million. According to the procurement documents, the contract covered the supply, installation, commissioning and testing of a platform designed to monitor misinformation and disinformation across Facebook, X and LinkedIn.
The contract award was announced just 15 days before work began. Malawi’s general election was scheduled for Sept. 16, 2025. The timing would shape everything that followed.
Within weeks of the announcement, civil society organisations questioned the procurement’s legality and called for it to be suspended. Parliament examined the matter but issued no binding directive.
The Malawi Human Rights Commission opened a review, sought to inspect the system, and later discontinued its follow-up. The Office of the President received a formal request to intervene but issued no substantive response.
The system was installed.
More than a year later, no public document reviewed for this investigation establishes whether the platform was fully operational during the 2025 general election, what information it collected, who had access to that information, or whether any independent authority oversaw its operation.
Neither MACRA, the Malawi Human Rights Commission nor Parliament’s committee responsible for communications has published a report addressing those questions.
The result is an accountability gap. What MACRA described as a tool to combat online misinformation has become one of Malawi’s least transparent public technology procurements.
A surveillance-capable platform costing MK2.6 billion was installed in the months preceding a general election, yet its operation has remained largely shielded from public scrutiny.
MACRA received detailed questions for this investigation on June 11, 2026.
In a written response dated July 16, 2026, MACRA Communications Manager Clara Ngwira said:
“MACRA is currently undergoing an audit, and the matter in question forms part of that audit process. It would therefore be appropriate to await the final audit report before providing a response.”
A regulator with contested independence
MACRA was established in 1998 following the dissolution of the state-owned Malawi Post and Telecommunications Corporation. Created under the Communications Act as an independent regulator, its practical autonomy has long been contested.
Research by Murendehle Juwayeyi argues that provisions of the Communications Act give the presidency significant influence over MACRA through appointments to its board and participation in its governance.
According to Juwayeyi, those arrangements weaken both the regulator’s formal independence and its ability to operate free from political influence.
Questions over MACRA’s powers long predate the Hashcom procurement.
In 2011, the regulator sought to introduce the Consolidated ICT Regulatory Management System, a platform intended to facilitate lawful interception of communications, internet monitoring, and GSM and CDMA interception.
GSM and CDMA interception refers to the digital surveillance techniques used to intercept, monitor, and record voice calls, SMS messages, and data transmitted over mobile networks. This type of surveillance involves tapping into either the widely used Global System for Mobile Communications (GSM) or Code Division Multiple Access (CDMA) networks.
A private citizen challenged the system on constitutional grounds, arguing that it violated Section 21(c) of Malawi’s Constitution, which protects individuals against interference with private communications.
The High Court initially blocked implementation on privacy grounds. In 2017, however, the Malawi Supreme Court of Appeal overturned that decision, allowing the system to proceed while directing that it must not be used to intercept the content of private communications.
The platform became operational later that year.
The judgment resolved the legal dispute but not the broader policy question: how far should a communications regulator be permitted to monitor digital activity?
That question resurfaced in September 2024 when MACRA announced plans to procure a new monitoring platform, this time focused on social media.
The contractor and the contract
The company awarded the contract attracted scrutiny almost immediately.
Hashcom Ghana Limited is a Ghanaian technology company whose registered principal is Baba Halidu Musa. Shortly after the award was announced, Digital Governance Associates Malawi questioned the company’s background, technical capacity and suitability to deliver a project of this scale.
In a formal letter to MACRA, copied to the Ombudsman, the Malawi Human Rights Commission and the Public Procurement and Disposal of Assets Authority (PPDA), the organisation called for greater transparency around the procurement.
Musa was also among the technicians observed at Mpingwe Peak during the installation in January 2025.
Subsequent reporting by local media linked Musa to another entity, Bahamus, whose clients reportedly include Ghana’s National Communications Authority (NCA). That association attracted attention because the NCA had previously been at the centre of one of Ghana’s most significant surveillance controversies.
In 2022, Ghana’s High Court found that the NCA had unlawfully procured Pegasus spyware from the Israeli surveillance company NSO Group. The case led to the conviction and imprisonment of the NCA’s former director general and a former national security official.
No evidence reviewed for this investigation links Hashcom Ghana Limited to the Pegasus procurement.
MACRA’s then Director General, Daud Suleman, maintained that the Malawi platform was designed to monitor only publicly available content and would not intrude on private communications.
Director of Legal Affairs Thokozani Chimbe said the procurement complied with Malawi’s public procurement law and that the notice of intention to award had been properly published through the PPDA portal.
MACRA also projected that the system would generate at least MK13.5 billion in revenue by the end of March 2025.
The basis for that projection remains unclear.
The authority has not publicly explained how it calculated the estimate, and this investigation found no publicly available evidence showing whether the target was achieved.
Questions were also put to PPDA about whether it had independently assessed the procurement’s compliance with competitive tendering requirements, transparency obligations and evaluation procedures under the Public Procurement and Disposal of Assets Act.
PPDA Public Relations and Communications Manager Mandy Pondani said the Authority had conducted no such review.
As a result, she said, PPDA had issued no advisory opinion, determination, compliance notice or sanction relating to the procurement.
Pondani added that, because no review had taken place, PPDA had made no assessment of concerns raised publicly about bidder evaluation, pricing, the supplier’s background or compliance with procurement procedures.
Hashcom also responded to detailed questions for this investigation.
Susan Tay, the company’s office manager, said Hashcom had fulfilled its contractual obligations by delivering, installing, commissioning and formally handing over the system to MACRA.
According to Tay, responsibility for the system’s custody, administration, operation and institutional oversight now rests with MACRA as the contracting authority.
She said Hashcom is bound by contractual confidentiality obligations and could not disclose project-specific contractual, technical or operational information to third parties without MACRA’s knowledge and approval.
Tay added that the company remains willing to provide technical clarification or supporting information should MACRA formally request or authorise its involvement through the contractual process.
She also asked that any publication accurately reflect that Hashcom’s role was limited to that of a contractor selected through a public procurement process, that it completed its contractual obligations, and that the project was formally handed over to MACRA.
The responses underscore a central feature of the procurement.
The contractor says it delivered the system. The regulator says the system formed part of its statutory mandate. Yet more than a year after installation began, the system’s operation, oversight and public accountability remain largely unexplained.
Procurement oversight questioned and defended
Questions about the procurement also focused on the role of the Public Procurement and Disposal of Assets Authority (PPDA) and whether it had exercised any oversight over the contract.
In response to questions for this investigation, PPDA Public Relations and Communications Manager Mandy Pondani said the procurement was never submitted to the Authority for review, approval or registration, either before or after the contract was awarded.
She said this was not because the procurement had been exempted under the Public Procurement and Disposal of Public Assets Act.
Rather, the contract fell within MACRA’s delegated procurement threshold, allowing the regulator’s Internal Procurement and Disposal Committee to complete the procurement without first obtaining a “No Objection” from PPDA.
According to Pondani, PPDA Circular Reference No. PPDA/01/22, issued on April 1, 2024, set MACRA’s procurement threshold for goods at MK5 billion.
Because the publicly announced contract value was approximately MK2.6 billion, she said, MACRA was legally entitled to award the contract internally, provided it complied with the procurement procedures prescribed under the then-applicable Public Procurement and Disposal of Public Assets Act, including publication of an Intention to Award Notice.
“This procurement was not exempted,” Pondani said. “It was within the threshold of MACRA’s Internal Procurement and Disposal Committee to proceed with the contract award.”
Her response clarifies an important distinction. PPDA did not approve the procurement because no approval was legally required.
Equally, however, the Authority did not independently examine whether MACRA complied with the procurement procedures governing bidder evaluation, value for money, transparency or contract administration.
Those questions therefore remain unresolved.
The distinction is significant because public criticism of the procurement often assumed PPDA had endorsed the contract. The Authority says it did not. Its role, in this case, was limited by the statutory procurement thresholds then in force.
That leaves the broader accountability questions elsewhere. Whether the procurement complied with the law was primarily MACRA’s responsibility.
Whether the resulting surveillance platform operated lawfully, proportionately and with adequate safeguards falls beyond PPDA’s procurement mandate and into the domains of communications regulation, constitutional rights and public oversight.
Those questions remain unanswered.
To be continued in Part 2.
With financial support from the HIVOS Connect! Defend! Act! Programme, this article is published under a Creative Commons license to ensure open, equitable access to information.
