You Can’t Firewall a Country Alone

Written by Charlotte Horore Bell Bebga (Cameroon), Michael J. Heavey (Chile), Muhamad Fahru Rozi (Indonesia) and Eric Kobia (Kenya) who participated in the 2025 and 2026 Tallinn Cyber Capacity-Building Fellowship programmes.

A country can invest in cybersecurity technology, pass ambitious legislation and build sophisticated digital infrastructure. But what happens when the institutions responsible for protecting it do not talk to one another? Or when citizens do not trust the systems designed to serve them?

These questions followed us home from the Tallinn Cyber Capacity-Building Fellowship. Coming from Cameroon, Chile, Indonesia and Kenya, we face different challenges. Yet our experiences in Estonia brought us to a shared conclusion: a country’s cyber resilience depends as much on trust, governance and people as it does on technology.

You cannot protect what you do not govern

One of the most striking lessons came from Estonia’s once-only principle: citizens should not have to provide information the state already holds. Behind this seemingly simple idea is X-Road, a secure data exchange system where transactions are authenticated, logged and traceable.

For Chile, this raises an uncomfortable question. The country has made significant legislative progress, establishing a national cybersecurity agency and strengthening its legal framework. Yet public institutions still struggle with fragmented data governance, unclear ownership and inconsistent standards.

As Michael J. Heavey, a former parliamentary adviser involved in Chile’s legislative reforms, argues, laws alone are not enough. You cannot protect data you have not mapped, govern information nobody owns or audit exchanges that leave no trace.

In Indonesia, the problem takes another form. Muhamad Fahru Rozi describes government agencies working in silos, with limited coordination and reluctance to collaborate with the private sector over concerns about sensitive information.

Estonia demonstrated what is possible when institutions understand not only their own responsibilities but also how they connect with others.

For Rozi, the lesson goes deeper than institutional reform. Indonesia is investing in national data centre infrastructure, yet developing the expertise to operate it effectively remains a challenge. Technology, he argues, is only an enabler. Without skilled people and strong leadership, even the most advanced infrastructure has limited value.

Trust is not a feature you can install later

In Kenya, rapid digital transformation has brought another challenge into focus: public confidence.

Eric Kobia points to the tension surrounding digital identity and online public services. Governments may see efficient digital infrastructure, while citizens may see questions about privacy, surveillance and political influence.

Estonia’s emphasis on legally recognised digital identity, decentralised data exchange and transparent access records offers a valuable lesson. Citizens need to know how their information is used and who can access it.

Kobia argues that digital identity should be treated as a citizen-centred public good, not a political project. Legal safeguards, data protection assessments and inclusion must therefore be considered before deployment, not after controversy emerges.

This is where cybersecurity becomes inseparable from public trust. A system can be technically secure and still fail if people have no confidence in the institutions operating it.

Who takes responsibility when something goes wrong?

For Cameroon, Charlotte Horore Bell Bebga brings the discussion to an even more fundamental question: who is responsible when a national cyber crisis occurs?

Cybersecurity responsibilities have historically been concentrated within one ministry, while coordination with other government institutions remains limited. In a major incident affecting essential services, such fragmentation can become a serious vulnerability.

Horore Bell sees Estonia’s coordinated approach to national resilience as a model worth adapting. Her proposed priorities for Cameroon include a high-level interministerial coordination body, a national cyber crisis management plan and volunteer networks that involve citizens and technical experts in preparedness.

The ambition is not simply to respond better to cyberattacks. It is to ensure that everyone knows their responsibilities before an emergency begins.

This connects all four perspectives. Whether the challenge is fragmented data, institutional silos, public distrust or crisis preparedness, the answer requires cooperation beyond a single agency or ministry.

From a shared ambition to actual cooperation

Cybersecurity discussions frequently call for a whole-of-society approach. But the phrase means little unless governments, businesses, universities and citizens have practical ways to work together.

For Cameroon, that could mean national crisis exercises and volunteer networks. For Indonesia, stronger cooperation with universities and industry. For Kenya, open dialogue that builds public confidence in digital transformation.

Chile offers an example of what happens when these ideas move beyond discussion. Following the 2025 Fellowship, Heavey helped organise a Cyber Policy Summit in the Chilean Senate in January 2026. It brought together policymakers, businesses, universities and international experts, including Hannes Astok, Executive Director of the eGA.

A connection first established in Tallinn had become an opportunity for cooperation at home.

Yet Heavey also acknowledges that progress is rarely straightforward. Legislation moves slowly, political and technical priorities differ, and cooperation requires more than good intentions. It needs a concrete problem and someone willing to bring people together.

That may be the Fellowship’s most valuable contribution. Beyond introducing us to Estonia’s cybersecurity experience, it created relationships and challenged us to consider how lessons from one country could be adapted to another.

None of us expects to copy Estonia. Our countries have different institutions, histories and priorities. But the questions we brought home are universal.

Do our institutions know who is responsible for protecting national digital assets? Can citizens trust how their data is handled? Are we developing the people who will operate our systems? And, when a crisis occurs, have we built the relationships needed to respond together?

Cyber resilience is not measured only by the systems a country can build. It is tested by the people and institutions that must make those systems work, especially when they fail.

And no country can achieve that alone.