“There is a fraud risk in 50% of cases,” a Ukrainian hacker starts a cybersec business in Nigeria

A cybersecurity specialist from Kharkiv, Mykyta Knysh, worked at a Counterintelligence Department of the Security Service of Ukraine when the Anti-terrorist operation in the east of Ukraine began. He also served as an advisor for the President’s Office and founded one of the biggest hacker conferences in Eastern Europe — HackIT. He and his business partners currently build a cybersecurity business in Lagos, Nigeria.

In the interview for AIN.Capital, he told how things are going in this country. Mykyta said there is a high demand for cybersecurity and infosecurity services because there is a fraud risk in 50% of cases in the local market.

How I got started in IT

My career has begun pretty early. My first job was carrier. Then I quickly understood that was not my way, so I started to think about how to work using my head. I liked to play online games, especially LineAge and DotA 2, so I wrote cheats and maphacks for those lovely games. When programs arose to ban cheaters like me on the servers, I learned to avoid them. It was my first step in software reverse engineering.

Then I did a lot of different stuff: traffic arbitrage, CPA networks, etc. After that, I went to the Kharkiv Aviation University, the Faculty of Radio Systems and Flying Machines. Then, as a student, I visited the USA for the first time within the Work and Travel program. Finally, I attended a few conferences in America that gave me more than five years of studying at the university. After graduating, I had to do with arbitrage, doorways, etc… I took any order regarding the traffic if it was legal.

In 2013, the Security Service of Ukraine had organized the Counterintelligence Department for Protection of the State Interests in the Informational Security (CDIS) that I joined in 2014 to work on infosecurity. Then I was in the ATO. I asked my supervisor to transfer me from the headquarter in Kyiv to Kharkiv to be closer to the front and my home. The tasks I performed on the frontline were secret.

After two years, I left the Security Service and started my own projects. I founded the ProtectMaster company and organized one of the largest hacker conferences in Eastern Europe — HackIT (for example, Steve Wozniak and Nick Bilogorskiy were speakers). I was a co-founder of Hacken, but later, I sold my share to another founder, Dmytro Budorin, and quit the business.

How I decided to build a business in Nigeria

I have another cybersec company, E-discovery. It is a subsidiary of HackControl in Nigeria. Kostiantyn Naryzhnyi was among its founders. He provides an export fertilizer business in Nigeria.

Kostiantyn described this region as one of the fastest-growing in Africa. He showed us diagrams and growth statistics. He told the country is fully covered with the LTE, and citizens can get a SIM card using their fingerprints. But at the same time, they have big problems with fraud. That’s how he offered us to run a cybersecurity company in that country.

Kostiantyn already has had an IT consulting company, G.I.T., in business security and risk management. We worked together for a while and decided to launch the cybersecurity consulting business in Lagos. First, we created E-discovery, a daughter company of HackControl. Then we made an agreement with local lawyers to register our business in Lagos and start working there.

We provide the following services: collecting digital proofs for a lawsuit through contracted lawyers and cybersecurity consulting. Nowadays, we are getting a license for specialized software use within several countries. However, it is a bit complicated because there are also data protection standards in Nigeria like GDPR.

How the Nigerian market works

We have been doing consulting business in Europe for a long time; its profitability is about 30%. But the actual number after allocated costs (taxes, marketing, etc.) is about 10%. So, the low profitability in high-competitive markets like the USA or the UAE forced us to look at more dynamic markets.

By analyzing the cybersecurity in Nigeria, we discovered that there are 3-4 companies in this area. We tried to contact all of them to test their services, but their websites could not work, or they did not answer our phone calls. So there was no competition despite the demand.

Another thing was the information we have got after speaking with the local police, lawyers, and other authorities. We learned that now Nigeria is about to reform its security authorities; all their agents study in the USA. However, according to Nigerian citizens, the security authorities do repressions and only protect some local businesses, and the army units can be rented to guard, for example, an enterprise.

Now their president wants to transform their security services and other authorities into fundamental independent institutions that will function like those in America. It is a sign that society is moving in the right direction. And that there will be demand for cybersecurity educational services and international certification.

What product do we sell them?

We plan to develop different cybersecurity directions. First, Nigerians import a lot of American products. But suppose you want to work with an American business in Nigeria. In that case, you need to have ISO 27001 certification (the international standard that lays out specifications for implementing an information security management system). So, our company now is getting certified. We have our lead auditors and lead implementors of ISO 27001.

This country is also characterized by growing fintech, credit, and microcredit services. All fintech companies in Nigeria, like in the whole world, must be PCI DSS certified. It means there should be two to four penetration tests during a year [Editor’s note: during a penetration test, an attack is modeled to see weaknesses of the corporate protection, networks, etc.]. We provide such services as well.

Nevertheless, local intelligence services and police don’t have any automated software for people search or any automated OSINT tools. For instance, Cellebrite is a market leader in smartphone hacking. But there are only 4-5 offers in the market as far as we were informed. In Ukraine, however, the same number of service providers can be found just within the city of Kharkiv. This African country shows high demand for digital criminalistics education. Still, Nigerian law enforcement officers cannot document digital proofs they get from notebooks and smartphones. And we want to teach them how to do it.

The big businesses here are also interested in fraud and insider deal investigation. We can do it too. We can collect digital evidence and send them to lawyers to open a criminal case and go to court.

There is also an online trading platform like our OLX — Jiji powered by Genesis. Now we negotiate a joint business with them to sell hackers’ “toys”: specially equipped testing computer rooms to check if it’s possible to hack their platform, of course, if it’s legal in Nigeria. We need to pass compliance with local lawyers to know if we may sell specific goods there.

By the way, it is better not to use the word “hacker” in Nigeria. Here, hackers are criminals doing corporate raids. So we call ourselves high-skilled cybersecurity professionals or cybersecurity engineers.

Market and culture specifics

First, you need to know that foreigners always attract attention. However, there is a district in Lagos, Victoria Island, populated chiefly by white businessmen and local celebrities.

One of the main contras of this market is extreme corruption. Ninety seven percent of the population is abysmal, and 3% enjoy the king’s life. You can feel it already at the airport. For example, to leave any Ukrainian airport, you must go through the pass control. In the worst case, they can ask you to pass exit scanning, and you are free. But in Lagos, between the moment you land and the moment you leave the airport can be up to 17 checks. Every single clerk finds it an obligation to check your documents. It’s not to follow the rules but to get a bribe.

At the airport, a foreigner can often hear the phrase “What did you get for me?” They ask you for money. For example, they check your PCR test and tell you that they don’t have it in their databases. At every stage, the principle of “Give me money to move on” applies.

Speaking of fixes, you can solve 99% of problems at the airport for 500 nairas ($1). I am not a fan of bribes and hate them. In Ukraine, I can call the police for anyone who would demand money from me. But here, it is just a routine. For example, here, you can rent rooms to save cash. It’s not a joke. Any local who could save $100,000 in the local currency has such a “safe” room; I am 100% sure of that because such an amount requires a lot of space.

If you have a business with the website on the .ng domain, the clerks surprisingly change their attitude and let you go without any problems. They respect such businessmen because they know that you work in the local market and create new jobs.

The country is fixing its problems step by step. In some cases, the Nigerian people evolve faster than Ukrainians. For example, despite the remaining chaos on the roads, local authorities managed to clean the streets from tuk-tuks. They replace auto rickshaws with old Volkswagens continuously replaced with buses (it seems all yellow Volkswagens go here to die). In the city of Abuja, I saw roads far better than in Kyiv (but it was only in rich quarters, I didn’t drive out to check slums).

To understand something about the culture, before start selling something, you need to learn a remarkable Nigerian saying: “Why do you sell me medicine from the headache if I have no headache?  Why do you sell me food if I am not hungry?”. It means that Nigerians won’t do a business or buy something if they don’t need it. So, it is hard to discover an opportunity for a completely new market. It would help if you felt what people’s needs are.

Another important thing is your reputation and internal contacts that determine your success in this market. They do not write text messages. You can manage everything via a phone or video call. WhatsApp and Facebook are favorites here.

If you try to sell something in Nigeria remotely, it likely won’t work. If you want to do business here, you need to come to the country, meet and learn honored people, and they will take you everywhere and open all doors for you. Nigerians trust only the physical meetings being closed for external partners and acquaintances.

How to register a business in Lagos

All business registration issues here are possible only through the local lawyers, including opening bank accounts. If you are a good lawyer, you may be almost a god here because you know complicated local laws and can enter all the offices of honored people from the police, army, and fiscals. Launching a big business without such contacts is unreal for a European guy.

Our first agreement with a lawyer was a memo about creating a company. We told him what we do, provided him with all licenses and certificates, documents, IDs, and references usually required in any country you want to open a business. Then the lawyers named us the cost of company registration — $5,000. The more complicated way would cost us up to $15,000.

The fun thing is that there are no state registers of enterprises in Nigeria like Ukraine. Moreover, the road police have no digital database. In case of an accident, it is merely impossible to check a car’s registration by its license plate because every city has its own paper database.

If a Ukrainian is ready to develop digital registers for the local authorities from scratch, they are doomed to become a millionaire in Nigeria. Our ministers who fucked up with cybersecurity can go to Nigeria and train themselves. I am joking, sure, but to be honest, they won’t be accepted because Nigerians require an American diploma.

The population of the Lagos urban area is over 27 mln people. It is more than in New York or Shanghai. But they are entirely undigitalized. No real estate register. No centralized criminal case register. If someone committed a crime in Lagos, nobody would know it in Abuja. But the most wonderful thing is that the businesses don’t care. It was a cultural shock for me.

Another problem the foreigners may have here is that it’s not easy to withdraw money from the accounts in the local currency because the locals are interested in reinvestment. It is not impossible; still, you need to do some “magic.”

How to rent an office and hire workers

It’s worth mentioning that half of the managing board of any company must consist of Nigerian nationals. For instance, we initially had six persons on the board: three Ukrainians and three Nigerians. We found them pretty quickly. We didn’t need super qualified cybersecurity engineers (their salaries are about $150 per month). Basically, their task is to connect devices, and then our remotely working engineers do all the routines.

To establish an office in Lagos, you must find a separate building or rent an entire floor because you need 24/7 security. There are business districts entirely surrounded by fences where outlanders work. You can’t rent a flat or an office in such an area for a day or a month, only for years, and pay for two years in advance.

The prices vary from $3,000 to $5,000 because of the security services. In any case, it is high-quality real estate with all infrastructure you may need: laundry, pools, and concierge service. If you buy or rent an apartment in a good district, there is everything you need.

What I like in Nigeria and what not

It is a country full of contrasts. Locals love bright clothes, and they are friendly and open. Almost everyone speaks English. They even have a local hybrid of their native language and English. If you speak English on the level like London is the capital of Great Britain, you will feel fine here.

An interesting cultural feature about Nigerians is that they are very religious and do not talk about sex. And under no circumstances, talk about sex, religion, or politics should not be allowed in business conversations.

The incredible thing is that there is real democracy in Nigeria — despite all the corruption, there is a two-parties system where candidates compete and depend on 1% or 2% of votes. Indeed, the Nigerians elect people to the government and then forgive them because they know “this guy was not so honest, but we like him.” It looks pretty similar to Ukraine, isn’t it? In Kharkiv, we call it a dawn of social-Darwinistic order. They respect only the might and say, “everybody is stealing, but this one is doing something at least.”

There are many religious denominations in the country. There are Christians, Muslims, and other believers. If you want to be successful here, you should respect their beliefs.

Among the disadvantages: I would not recommend a foreigner to brush their teeth with tap water, better with mineral water, because you can catch an infection. Although with the pandemic, the attitude to sanitary standards in the country has changed a lot: gloves, sanitizers, masks are everywhere.

There are severe security issues: it’s better to watch your drinks if you visit an unknown bar. Otherwise, someone could put something in your glass. It is not the case in good restaurants. Just imagine you need to Radisson in Lagos: The building is protected with barbed wire on the perimeter; at the entry is a checkpoint where you and your vehicle are inspected; they will scan you from the foot to the head and only then allow you to drink a coffee in the hotel.

However, generally, we are excited about the chances of this market. In a few years, Lagos can become the world’s largest city, and there are plenty of niches for IT entrepreneurs to succeed.