Yesterday, if you opened a Ghana government ministry website on your phone, there was a chance you got redirected to a casino.
Not a metaphor. Not satire. The actual Ministry of Interior. The actual Ministry of Health. Mobile visitors bounced to gambling pages while the same sites looked perfectly clean on desktop.
Here is the technical detail worth understanding: this is called a conditional mobile redirect. Hackers know that IT administrators manage websites from desktop computers. So they write code that checks your device before deciding what to show you. Desktop gets the real site. Phone gets the trap. The admin never sees the problem because the admin never checks from a phone.
It is a clever hack in the most uncomfortable sense of that word.
Within 48 hours, Interior, Health, Agriculture were all compromised. The Ministry of Communications faced a DDoS attack on top of that. By evening, the sites were back. No data breach confirmed.
But the timing of all this is the part that matters.
Ghana is currently debating the NITA Bill. A draft that would require ICT businesses to hold licenses and tech professionals to carry certifications. The conversation in the ecosystem has been heated: why is the government focused on controlling and licensing the talent instead of investing in it?
Then this happens.
This is not about embarrassing the government. Governments everywhere get hacked. Kenya went through this. Nigeria went through this extensively. It is a pattern, and Ghana is not uniquely negligent for being on that list.
But the community's question deserves to be asked plainly: if the systems responsible for internal security and national safety can be redirected to slot machine pages, what does that tell us about where the priorities actually are?
Developers who can find these vulnerabilities exist in Ghana. They are in the same community being asked to go get licensed.
Before any licensing framework, audit the digital infrastructure those licenses are supposed to protect. A certification means nothing if the systems behind it are running exposed code.
Bug bounty programmes are not optional extras. They are a form of governance. Paying local talent to find problems before attackers do is cheaper than the alternative, and it builds exactly the pipeline that everyone agrees Ghana needs.
The regulation conversation and the infrastructure conversation cannot keep happening separately.
What should the government's first concrete to stopping this?