Thu Dec 18 15:47:59 UTC 2025: News Article:
Somalia’s E-Visa Website Riddled with Security Flaws, Al Jazeera Investigation Reveals
Mogadishu – Somalia’s electronic visa website is plagued with critical security vulnerabilities, potentially exposing the sensitive personal data of thousands of applicants to malicious actors, an Al Jazeera investigation has found.
The investigation, triggered by a tip from a web development expert, revealed that anyone could download a trove of e-visas containing passport details, full names, and dates of birth. Al Jazeera successfully replicated the vulnerability, retrieving data from dozens of individuals from Somalia, Portugal, Sweden, the United States, and Switzerland within a short period.
This alarming revelation comes just a month after Somali officials announced an inquiry into a previous data breach on the same platform. Despite the initial breach and warnings from concerned experts, the Somali authorities failed to address the security flaws.
“The government’s push to deploy the e-visa system despite being clearly unprepared for potential risks… is a clear example of how disregard for people’s concerns and rights… can erode public trust and create avoidable vulnerabilities,” stated Bridget Andere, Senior Policy Analyst at digital rights group Access Now. She criticized the lack of formal notification regarding the previous breach.
The US and UK governments issued warnings last month about a prior data breach that compromised the information of over 35,000 e-visa applicants. Leaked information included names, photos, birthdates, email addresses, marital status, and home addresses. In response, Somalia’s Immigration and Citizenship Agency (ICA) moved the e-visa website to a new domain, but the latest findings demonstrate that the underlying security issues remain unaddressed.
Somalia’s Defence Minister Ahmed Moalim Fiqi had previously praised the e-visa system, claiming it effectively prevented ISIL fighters from entering the country. However, experts warn that rushing the implementation of such systems often leads to insecure outcomes, prioritizing expediency over security.
Al Jazeera has refrained from disclosing specific technical details of the vulnerability to prevent further exploitation. The sensitive data obtained during the investigation has been securely destroyed to protect the privacy of those affected.
As of press time, the Somali government has not responded to Al Jazeera’s inquiries regarding the security flaws.
First Piper 