ECOWAS ID cards in Senegal: ten years to prepare, an extension rushed through

Some crises come out of nowhere; others have their date printed on millions of cards. In Senegal, the first ECOWAS biometric national ID cards were issued from October 2016. Law no. 2016-09, which created them, gave them ten years of validity. The October 2026 deadline was therefore known to everyone from day one.

Yet in September 2026, a few weeks before the fateful date, the Ministry of the Interior announced a legislative process to extend the cards’ validity, itself specifying that “neither the length of the extension nor the exact scope of beneficiaries” had yet been set (our translation). The specialist outlet Afrique IT News summed up the situation in one line: ten years to prepare, one month to panic.

A law, then a decree

The process did not start yesterday. Bill no. 21/2026 was adopted by the Council of Ministers on 29 April and put on the plenary agenda on 18 September. It mentions adapting to “new technological developments”, better protection of personal data and the gradual renewal of expired documents. But the machinery remains heavy: a vote by MPs, promulgation by the president, then an implementing decree, which will finally set who benefits from the extension and for how long.

In the meantime, citizens whose card is expiring find themselves with a document whose legal validity is uncertain. And official communication adds to the confusion: while the extension is being announced, the Directorate for the Automation of Files (DAF) launched renewal operations on 25 September for cards issued between 4 October and 31 December 2016, in Senegal and in the diaspora.

What should citizens do? Queue at an enrolment centre, or wait for an extension that has not yet been voted? If everyone renews, the extension is pointless. If everyone waits, it mainly masks a lack of production capacity. Either way, when it comes to identity, uncertainty is costly. An ID card is used to open a bank account, collect a money transfer, board a flight, sit an exam or sign an employment contract: doubts about its validity ripple through all these procedures, and each counter risks applying its own interpretation.

A system weakened by a cyberattack

The timing could not have been worse. In January 2026, hackers signing as Green Blood Group claimed to have stolen 139 gigabytes from the DAF, fingerprints and photos included. The result: no cards left the workshops between 5 February and 1 April. Nearly two months lost, as the country approached the biggest renewal peak it has seen since the 2016 launch.

Officially, the files were not altered: that is what the authorities keep repeating. Yet no outside audit has publicly confirmed it. And it is this system, barely back up and running, that will have to process hundreds of thousands of renewal applications in the coming months.

What a biometric identity file contains

A biometric card is only the visible part of a far more sensitive system. Behind each card is a record in a central database: name, date and place of birth, address, photo, and above all fingerprints. Unlike a password, a fingerprint cannot be changed. If it is stolen, it is stolen for good, and can be used for identity theft or to get around checks that rely on biometrics.

That is why the claimed theft of 139 gigabytes in January is so worrying, even if the authorities say the integrity of the data was preserved. An independent audit, published at least in outline, would make it possible to say what was affected, how the hackers got in and what measures have been taken. The Personal Data Protection Commission, which oversees the application of Senegal’s data law, has a natural role to play in this exercise in transparency.

The original contract

To understand, you have to go back to 2016. In May that year, the card production contract was awarded to the Malaysian company Iris Corporation Berhad, for 50 billion CFA francs, by direct agreement, meaning without an open tender, for 10 million cards over five years. Even then, the press pointed out that the same contractor had been criticised by the Court of Auditors over the passport contract.

A decade later, the state has still not said publicly which company will produce the next generation of cards, under what contract or for how much. Will Senegalese citizens have to pay, when the first card cost them nothing? And will the parents’ names, missing from the start although they help to tell two namesakes apart, finally appear on the document?

The electoral and regional stakes

The matter is not just administrative. In Senegal, the same document serves as a voter card: without a valid ID, you cannot register on the electoral rolls or change your address on them. Opposition figure Adji Mbergane Kanouté warns of a risk of “mass electoral exclusion” (our translation) and is calling for more transparency about the cyberattack. The tone may seem alarmist; the question is legitimate, as long as the decree has not specified who will benefit from the extension.

The card is also a travel document within ECOWAS. Will an extension voted in Dakar be recognised without question at border posts, at Rosso towards Mauritania, at Kidira towards Mali or at Diaobé, a big market near Guinea? No official answer has been given so far, although thousands of traders and travellers cross these borders every day. Coordination with neighbouring countries, or even a statement from the ECOWAS Commission, would prevent travellers who are in order in Senegal from being stuck at the border.

To govern is to plan ahead

An extension is not scandalous in itself: other countries have used one to smooth out a renewal peak. What is shocking is the method: an improvised measure in the face of a deadline known for ten years, carried by a database still recovering from a hack, with no precise date and nothing said about the manufacturer or the bill.

Senegal champions digital sovereignty, digital identity and paperless public services. All these projects rest on a single foundation: a reliable, secure and up-to-date identity database. Successfully renewing the 2016 cards, with a clear timetable, a transparent contractor and security verified by an independent audit, would be the best signal the state could send about its ability to carry out these major projects.