Although Senegal has Law no. 2008-11 on cybercrime of 25 January 2008, this raises questions and has its own shortcomings, making it less effective. It refers partly to the Criminal Code and partly to the Criminal Procedural Code, for example, which have not themselves been kept up to date with the environment and trends observed in Senegal. 2.1.1.2 'Hacktivism' Hacktivist groups are generally motivated by a political and social agenda and work on a decentralised basis: so they tend to attack their targets in the interests of specific causes or in pursuit of apparent demands. Although most hacktivist attacks are disturbing by their very nature and include attacks such as DDoS and hijacking websites, they have not mostly caused any major or lasting damage to their targets to date. 2.1.1.3 Internal threats Internal threats are one of the main risks to any organisation, including those in Senegal. An organisation's staff can access systems and critical data, which is a threat in itself, as they can cause financial and reputational damage by stealing sensitive data. Such staff can also use their knowledge of their organisation to enable or commit attacks designed to stop it working properly. As well as acting deliberately, staff can cause damage unintentionally by not knowing about their organisation's security procedures, particularly by downloading unprotected content, using infected peripherals and opening phishing e-mails. They may also become victims of social engineering via which they may unwittingly allow access to their networks or execute instructions which appear harmless in themselves but which benefit cyber-criminals. With this in mind, the President of the Republic's office, via the National Cryptology Commission (CNC) has taken the offensive and prescribed detailed measures for the security policy for Government information systems in Senegal (PSSI-ES). 2.1.1.4 Cyberterrorism and extremism Global trends suggest terrorist groups are still considering conducting cyberattacks against countries they target and continue to use the Internet to recruit and radicalise individuals online, be it against Senegal or other countries. Senegal could be a target for such groups one day, so we need to be aware of this threat. Although terrorist groups continue to prefer physical attacks, as economies and societies become increasingly digital worldwide, the probability of highly-qualified terrorist groups or 'lone wolves' increases likewise; and Senegal's reputation could suffer should it turn out that Senegalese acting alone are involved in attacking third countries. All this could be a major threat to Senegal and its interests in the future, so it is vital that we consider this in our strategy. 2.1.1.5 Direct and indirect threats from States Current trends in cyberespionage and cyberattacks amongst others indicate amongst other things that countries believe increasingly they are targeted, becoming the targets of Statesponsored terrorists seeking to penetrate their governments' systems and networks for political, technological or economic purposes. It is essential that Senegal should be aware of this threat and take steps to mitigate it. 8