In the 2026/27 National Budget, Finance Minister Ndaba Gaolathe unveiled a vision to transform Botswana into a data-driven state, positioning the biometric Digital Omang as the central “infrastructure for trust” and government efficiency.
While the Minister frames this P4.05 billion rollout as a cornerstone of fiscal discipline and financial inclusion, a combined multiple sources on the current cybersecurity landscape such as The International Telecommunication Union Global Cybersecurity Index suggests the government may be building a singular point of failure that could compromise the very citizens it seeks to protect.
By integrating the national identity system with the National Retail Payment Switch to automate grants and financial services, the state is effectively creating a national “honeypot”—a centralised database so valuable that it becomes the primary target for increasingly sophisticated cybercriminals. This is a risk highlighted in the PwC 2026 Global Digital Trust Insights, which warns that identity and access management have now become the primary frontiers of strategic competition.
The risk of “identity scrubbing” and large-scale economic paralysis looms large as the system moves from pilot to full integration. According to the World Bank’s Identification for Development (ID4D) Primer, unlike a lost passport or a stolen credit card, the biometric data at the heart of the new Omang—fingerprints and facial templates—is permanent and cannot be reset if compromised. This “irreversible nature” of biometrics means that once a template is stolen, the individual’s foundational security is permanently weakened.
In the current era of industrialised fraud, where AI-generated deepfakes and autonomous fraud agents are surging across the region, a single breach could de-provision a citizen’s entire digital existence, locking them out of healthcare, banking, and social benefits simultaneously. Furthermore, according to a December 2025 report from the Institute of Development Studies and the African Digital Rights Network, such biometric mandates often lead to “systemic exclusion.” This is particularly true for rural communities and manual laborers whose worn fingerprints may fail authentication, effectively “erasing” them from the digital economy.
While the government touts the Data Protection Act of 2024 and its P50 million fines as a safeguard, according to legal analysts at Michalsons, the legislation’s broad exemptions for state-led processing and national security could leave citizens with limited recourse in the event of a government-level data leak.
For instance, in the “Shadow Citizen” heist a scenario that mirrors high-profile AI-driven breaches documented in recent 2024-2025 vishing reports by GovTech and McAfee—cybercriminals use AI to trick a government worker into giving up their login details. They send a realistic deepfake voice message that appears to come from a supervisor, prompting the worker to open a file that secretly steals their credentials. With these credentials, the attackers access the central Biometric Database and insert fake biometric data, like deepfake facial scans or fingerprints, alongside real records of citizens.
Using the fake biometrics, the attackers can impersonate victims to move large sums of money through the national payment system. They also corrupt the original records, leaving the real citizens “digitally erased,” unable to access their accounts or services. This scenario shows how AI and centralized digital ID systems can be exploited to commit complex fraud.
For the Digital Omang to truly reshape the relationship between the state and its citizens without becoming a liability,
According to NIST Special Publication 800-207, a Zero-Trust approach ensures that Botswana’s digital future is anchored in security rather than just high-speed adoption by enforcing “never trust, always verify” at every layer. Ultimately, as cautioned in the 2025 ISMG Cybersecurity Pulse Report, a critical analysis of the current cybersecurity landscape suggests the government may be building a singular point of failure that could compromise the very citizens it seeks to protect.
