In Senegal, politicians are almost never short of pompous speeches. Some of the most audacious have even sold us the idea of digital sovereignty as a horizon already reached, almost a national given. Yet, recent events tell a rougher, less controlled story, where the country's critical infrastructure seems to progress at the erratic pace of computer incidents and successive restarts.

The Directorate of Public Accounting and the Treasury is "gradually resuming its services following the incident that affected part of its IT infrastructure." This perfectly polite administrative phrase implicitly states that the system has broken down and that they are attempting to get it working again piece by piece, in a gradual, almost artisanal, repair of a system presented as strategic.

This is not an isolated case. The Directorate General of Taxes and State Property (DGID) already experienced a paralysis of its information systems for approximately two weeks in October 2025. During those two weeks, the tax administration operated at a reduced capacity, or even at a standstill, hampered by procedures that were impossible to execute. The Directorate of File Automation (DAF), responsible in particular for identity documents, also suffered a prolonged interruption of its services, with direct consequences for users, who were forced to wait for the system to be restored after it suddenly became unavailable.

In addition to these incidents, the banking sector has also been affected on several occasions, notably the Housing Bank of Senegal (BHS), whose IT system was disrupted by intrusions that paralyzed its operations. Taken individually, these events might be perceived as typical technical incidents. However, their repetition, their concentration over time, and their impact on vital infrastructure now raise broader questions about the robustness of the national digital ecosystem.

Because, at the same time, official discourse emphasizes strong ambitions: data centers, digital sovereignty, information system resilience, and modernization of the state. The "Technological New Deal," whose second year is being celebrated with emphasis, presents a structured vision: protection of sensitive data, strengthening of confidentiality, mandatory incident reporting, widespread adoption of advanced security protocols such as multi-factor authentication and end-to-end encryption, not to mention the implementation of integrated cyber resilience from the design stage of projects.

On paper, the architecture is coherent, almost reassuring. It portrays a state aware of cybersecurity challenges, seeking to equip itself with modern tools to protect its critical infrastructure and regulate digital practices. But between strategy and operational reality, a gap is widening, evident with each new incident that forces an administration to suspend its activities, then restart them urgently.

This discrepancy raises a simple but essential question: at what point does digital sovereignty become effective, and no longer merely declarative? Because sovereignty is not measured solely by the quality of texts or the ambition of plans, but by the concrete capacity to maintain essential services in operation, even in a crisis situation.

There is also the issue of digital literacy, often cited as a safeguard. Raising user awareness, promoting best practices, and empowering public officials are necessary levers. But they cannot, on their own, compensate for the structural vulnerabilities of the systems. Making citizens the first line of defense is useful; making them the primary shield would be a reversal of responsibility.

Given the repeated incidents, a certain degree of realism is necessary. The country is not lacking in digital ambition, nor even in the development of existing systems. However, it finds itself in an intermediate phase where the infrastructure exists, the strategies are formulated, but where real resilience is still being built.