By Ransford O. McCarthy
Anyone who has sat in Friday evening traffic at Nsawam, or crawled behind a broken-down truck somewhere around Bunso, knows the Accra-Kumasi trip is less a journey and more an endurance test. Five hours if you’re lucky. Six if you’re not. So when government says it can be done in two, people pay attention.
The numbers behind that promise are big. The new expressway is planned at 198.7km, six lanes, on a completely separate alignment from the existing 270km highway. That alone cuts close to 70km off the trip. At 100km an hour, the President says, you’re looking at roughly two hours. A morning meeting in Kumasi, dinner at home in Accra. That’s the pitch.
And this time the money appears to be sitting somewhere. By July, 22, US$1.7 billion had been lodged in a dedicated account at the Bank of Ghana , and the President has since put the figure at US$2 billion, with a target of US$4 billion by December. The Ghana Armed Forces 48 Engineer Regiment finished clearing 175.6km of right of way and handed it over at Kwaso on 14 September. Pre-qualification for contractors opened on 11 September, and the plan is to award the main contract before the year runs out.
I work in cybersecurity, so one line in the Finance Minister’s mid-year review caught my eye more than the dollar figures. The expressway will come with intelligent transport systems and electronic tolling. Cameras, sensors, gantries, control rooms, payment integrations. Put simply, we are about to build a 200km computer network and pour asphalt over it.
That’s exciting. It’s also a risk worth talking about now, while the whole thing is still on paper.
Why People In Tech Should Care
Kumasi has talent. Kwame Nkrumah University of Science and Technology, Kumasi alone, turns out a steady stream of engineers every year, and office space there is noticeably cheaper than in Airport City. What the city has lacked is quick, predictable access to the Accra market.
Bring the trip down to two hours and an Accra company can hire in Kumasi without asking anyone to relocate. A delivery startup can realistically promise next-day delivery between the two cities. An IT support or security firm can cover both regions with one team instead of two. Even the towns along the route, places like Asamankese and Akyem Oda, get pulled closer to the digital economy.
None of that holds up, though, if the systems running the road can’t be trusted.
Transport Is Already Classified As Critical
To be fair, Ghana saw some of this coming. Back in September 2021, under the Cybersecurity Act, 2020 (Act 1038), the Minister Hon. Samuel Nartey George gazetted 13 sectors as Critical Information Infrastructure. Transport is on that list, right beside energy, banking, and emergency services. Whoever runs this expressway’s systems will be a CII owner, with every obligation that comes with it.
In practice, the cameras, message boards, lighting controls, and toll equipment are operational technology. When OT fails, it doesn’t stay on a screen. It shows up on the road.
London found this out recently. In 2024, the hacking group Scattered Spider got into Transport for London’s network. Traffic cameras were suspended. Dial a Ride, the booking service for elderly and disabled passengers, went down. 148 systems were affected, and all 27,000 staff had to reset their passwords in person. TfL puts its recovery costs at £29 million, and the two young men behind the attack were each jailed for five and a half years in July this year.
They didn’t need anything exotic to pull it off. They got in through people. Keep that in mind for what follows.
Tolls Plus Mobile Money Equals A Target
Electronic tolling here will almost certainly lean on mobile money, and the size of that ecosystem is hard to overstate. Bank of Ghana figures show mobile money transactions reached GH¢4.54 trillion in 2025, up 50.8% on the year before.
Every wallet integration, every payment API, and every merchant account linked to the toll system becomes something worth attacking. The operator will need solid API security, real fraud analytics, tokenized payments, and tight reconciliation between what the gantry reads and what the wallet actually gets charged.
The Scam Is Already Written
If I had to bet on where ordinary drivers get hurt first, it wouldn’t be some sophisticated hack. It would be a text message.
In the US, fake “unpaid toll” texts have become an epidemic. The Federal Bureau of Investigation (FBI) says it received more than 60,000 complaints about them in 2024 alone. The message names the local toll service, links to a lookalike website, and asks for a small payment to avoid a late fee. Simple, and it works.
Now bring that home. Fraud is already our biggest cyber problem. CERT-GH logged 3,876 incidents between January and July 2026, and 1,818 of them, about 47%, were online fraud. Launch a brand new toll system with millions of first-time users and no clear official channel, and the scammers will be ready before the ribbon is cut. The fix isn’t complicated: one official payment channel, verified sender IDs, and a public education push well before the first car pays a toll.
Access, Data And Someone On Watch
Identity and access. Toll operators, contractors, maintenance crews and emergency services will all need some access to the corridor’s systems. That’s a lot of accounts. Multi-factor authentication, least privilege, and proper privileged access management shouldn’t be treated as extras. TfL shows what a single compromised identity can do.
Data protection. Plate recognition cameras and toll accounts will build a detailed record of who drives where, and when. That’s personal data under the Data Protection Commission – Ghana Act, 2012 (Act 843). Retention limits, encryption, and access logs aren’t paperwork. They’re how you keep the public’s trust.
Monitoring and response. A corridor this size needs someone watching it around the clock, whether that’s an in-house SOC or a managed provider, with a tested plan that plugs straight into CERT-GH. Ransomware hitting the toll system at 5 pm on a Friday is not the time to be drafting your first incident playbook.
Supply chain. Dozens of contractors and vendors will touch this project, and each one is a possible way in. Security requirements belong in the procurement documents, and independent penetration testing should happen before anything goes live, not after.
Why This Conversation Can’t Wait
The trend lines aren’t friendly. Reported cyber incidents rose from 1,317 in the first half of 2024 to 2,008 in the first half of 2025. Losses between January and September 2025 came to GH¢19.3 million, and that’s only what people bothered to report.
Government has called the expressway the single largest capital investment in Ghana’s history. If security is designed in from the start, it becomes proof that we can run smart infrastructure properly, and a real opportunity for local cybersecurity and OT talent. If it’s bolted on later, the road meant to bring the country closer together could become our most visible target.
Two hours to Kumasi sounds great. Let’s just make sure the hackers don’t get there first.
