As Cameroonian President Paul Biya conducts official duties from abroad, the question of secure digital tools becomes critical. Reviewing sensitive documents, coordinating with advisors, and signing decrees remotely require more than standard email or messaging apps. The integrity of state decisions, confidentiality of information, and traceability of instructions must be guaranteed.

The debate intensified after State Minister Jacques Fame Ndongo clarified that President Biya remains actively engaged in governance, whether in person or through electronic means. This raises a fundamental question: what secure digital infrastructure should the Presidency implement to handle classified documents when the Head of State is outside national borders?

While official decrees may eventually appear on government websites or social media, these platforms reveal nothing about the internal process—how the document was drafted, transmitted, reviewed, signed, or archived. The real challenge lies in securing the entire lifecycle of these sensitive materials.

Institutional email addresses: the first line of defense

Every presidential communication should originate from an official domain under the Presidency’s control. Collaborators must use institutional email addresses such as [email protected] instead of personal Gmail or Yahoo accounts. These official addresses ensure:

• Controlled access: accounts can be created, modified, or revoked by the administration
• Strong authentication: multi-factor authentication prevents unauthorized access
• Audit trails: all communications are logged and preserved
• Phishing protection: built-in mechanisms like SPF, DKIM, and DMARC block spoofing attempts
• Data segregation: prevents automatic forwarding to personal inboxes

Personal email accounts pose significant risks. State authorities cannot oversee their creation, security configurations, or data retention policies. When officials leave office, their personal accounts—and potentially years of correspondence—may become inaccessible, compromising institutional memory.

An official email system would ensure that presidential directives remain traceable, secure, and under government oversight at all times.

A presidential document management platform

A dedicated secure platform should serve as the central hub for all classified presidential documents. Each file would be tracked with:

• Unique identifiers for easy reference
• Author identification and version history
• Confidentiality levels (public, internal, confidential, highly sensitive)
• Access permissions for authorized personnel only
• Real-time collaboration tools for editing and approvals
• Tamper-proof auditing of all changes and consultations

This system would allow the President to review documents remotely, add annotations, request revisions, or sign off on proposals—without ever downloading files to insecure devices or personal accounts. For highly sensitive materials, features like download prevention, print restrictions, and automatic archiving would further enhance security.

Digital signatures: beyond scanned images

A simple scanned signature image provides no legal protection. Instead, certified digital signatures should be used to authenticate presidential acts. This technology verifies:

• The signer’s identity through cryptographic certificates
• Document integrity—ensuring no alterations after signing
• Timestamp authentication for legal validity
• Non-repudiation—preventing denial of authorship

High-security cryptographic keys should be stored in tamper-proof hardware modules—not on personal computers, USB drives, or mobile devices. Every use of these keys should require direct presidential authentication and generate timestamped audit logs.

Zero Trust architecture: verifying every access request

A Virtual Private Network (VPN) alone cannot secure remote presidential communications. A Zero Trust model assumes no user, device, or network is inherently trustworthy. Each access request must be verified through multiple factors:

• User identity verification
• Device authentication (institutional hardware only)
• Location validation to detect suspicious connections
• Document sensitivity classification
• Biometric authentication for high-level access
• Behavioral analysis to identify anomalous activity

For example, accessing a classified decree might require an institutional laptop, a digital certificate, an encrypted connection, a physical security token, and a local biometric scan—all simultaneously.

Exclusively institutional devices

No classified presidential documents should ever be accessed from personal smartphones or computers. All devices used by presidential staff must be:

• Fully encrypted with hardware-level security
• Regularly updated with the latest security patches
• Restricted to approved applications only
• Separated from personal use—no mixed browsing or file storage
• Remotely wipeable if lost or compromised
• Automatically locked after short inactivity periods
• Blocked from unsecured public Wi-Fi

A centralized device management system would allow the administration to enforce security policies, push updates, block dangerous applications, and remotely revoke compromised devices.

Multilayer authentication to prevent phishing

Complex passwords alone are insufficient. Multi-factor authentication should combine:

• Institutional device recognition
• Personal PIN or biometric scan
• Physical security token (hardware key)
• One-time codes (though SMS codes have vulnerabilities)

Regular staff training is essential to recognize phishing attempts, fake urgency requests, and impersonation scams. Even experienced officials can fall victim to sophisticated social engineering attacks.

WhatsApp: alert, but never transmit

While widely used in Cameroon, including among officials, WhatsApp’s end-to-end encryption does not make it suitable for transmitting classified presidential documents. Risks include:

• Device theft or espionage
• Screenshots or unauthorized sharing
• Backup vulnerabilities on personal accounts
• No document lifecycle management—no version control, signing, or archiving

WhatsApp’s proper role is limited to coordination: alerting that a document is ready for review in the secure platform. For example: ‘Document PRC/SG/2026/125 is available in your secure workspace for review.’ The actual file should never be attached.

Secure videoconferencing for government meetings

Remote presidential briefings require dedicated secure videoconferencing solutions with:

• End-to-end encryption of all communications
• Participant identity verification
• Strict invitation controls—no public links or open registrations
• Recording restrictions to prevent leaks
• Connection logging for audit purposes
• Institutional device enforcement
• On-premises or government-controlled data hosting

Consumer-grade videoconferencing apps lack the security controls required for sensitive discussions about defense, diplomacy, or high-level appointments.

Document classification: matching security to sensitivity

Not all presidential documents require the same level of protection. A four-tier classification system would standardize handling:

• Public: for official dissemination
• Internal: working documents for government use only
• Confidential: could harm public interests if leaked
• Highly sensitive: defense, intelligence, major appointments, or strategic decisions

Each level determines:

• Allowed transmission channels
• Authorized personnel
• Permitted devices and printing
• Retention periods
• Archiving requirements

A public document might use institutional email, while a highly sensitive file would only be accessible through the secure presidential platform.

Complete audit trails for every decision

Every interaction with a classified document should be automatically logged, including:

• Who accessed the document and when
• Which device and network were used
• What changes were made and by whom
• Who approved the final version
• When the document was published and by whom

A dedicated security operations center would monitor for anomalies: unusual access patterns, mass document downloads, connections from unrecognized devices, or unauthorized modifications. This traceability is crucial for investigating leaks, intrusions, or disputes about decision authenticity.

Distinguishing official decisions from social media posts

Government social media accounts (Facebook, X) serve public communication but cannot substitute for secure internal systems. Before any decree appears online, it must follow a verified process:

• Transmitted through authorized channels
• Authenticated by authorized officials
• Verified as the final unaltered version
• Timestamped upon approval
• Stored in official archives

A visible signature on a social media image proves nothing without the complete digital trail that preceded it.

Ten essential measures for presidential digital security

The Presidency should implement these priority actions immediately:

1. Mandate institutional email addresses under the @prc.cm domain
2. Ban personal Gmail, Yahoo, and similar accounts for official business
3. Deploy a presidential document management platform with full auditing
4. Implement certified digital signatures with hardware-secured keys
5. Provide exclusively institutional devices to all authorized staff
6. Enforce phishing-resistant multi-factor authentication
7. Restrict WhatsApp to alerts and coordination
8. Classify documents by sensitivity level
9. Centralize access logs in a security operations center
10. Conduct regular security training on espionage, phishing, and information leaks

While no public evidence confirms Cameroon’s Presidency currently uses all these measures, they represent the minimum standards for secure remote governance of state affairs involving finance, diplomacy, and national security.

The fundamental question isn’t whether a president can work from Geneva, Paris, or New York—it’s whether the tools used can authenticate decisions, protect state secrets, trace instructions, and prevent forgery or misuse in the president’s name.

In an era of artificial intelligence, cyberattacks, and digital forgeries, informal digital methods are no longer acceptable. Modern governance demands modern tools capable of leaving verifiable digital footprints for every critical decision: who sent what, approved what, when, through which channel, and with what security guarantees.