At the twilight of his administration, former President Goodluck Jonathan assented to the Cybercrime Bill which had earlier been passed into law by the Sixth National Assembly to become the Cybercrime Act 2015. Last week in Lagos, during Technology Times Outlook, stakeholders, largely telecom lawyers, gathered to review the law. The consensus was that there is still a long way to go as several lacunae were decidedly created by the authors of the law.
The hall of Rodizzo Event Centre, GRA, Ikeja, venue of Technology Times Outlook on Nigeria Cybercrime Act 2015 Review was filled to capacity. After the formal introduction of guests, largely telecoms legal practitioners, some from the telcos and others from Federal Government agency such as the National Information Technology Development Agency (NITDA) and from the human rights community, the lead presenter, Managing Partner, Technology Advisors, ICT Lawyers & Consultants, Basil Udotai mounted the rostrum and took a sweeping look at the provisions of the Act.
The Act, among others, prescribes punishment for vandalism of critical infrastructure, other offences.
Henceforth, any crime or injury on critical national information infrastructure, sale of pre-registered Subscriber Identity Module (SIM) cards, unlawful access to computer systems, cyber-terrorism, among others will be punishable by this Act.
The Act Lists offences and penalties including unlawful access to computers, unlawful operation of cybercafes, system interference, intercepting electronic messages, emails, e-money transfer, tampering with critical infrastructure, computer-related forgery are punishable under the Act.
Theft of electronic devices, electronic signature, child pornography and related offences, racism and xenophobic offences are punishable under the Act.
The objectives of this Act are to–provide an effective and unified legal, regulatory and institutional framework for the prohibition, prevention, detection prosecution and punishment of cybercrimes in Nigeria: ensure the protection of critical national information infrastructure and promote cyber security and the protection of computer systems and networks electronic communications, data and computer programs intellectual property and privacy rights.
Highlight of the Act are: Part 11: Protection of Critical National Infrastructure which states that (1) The President may, on the recommendation of the National Security Adviser, by Order published in the Federal Gazette, designate certain computer systems or networks, whether physical or virtual, the computer programs, computer data or traffic data vital to this country that incapacity or destruction of or interference with such systems and assets would have a debilitating impact on security, national or economic security, national public health and safety or any combination of those matters as constituting Critical National Information Infrastructure;
The Presidential Order made under subsection (1) of this section may prescribe minimum standards, guidelines, rules or procedure in respect of- the protection or preservation of critical information infrastructure: the general management of critical information infrastructure: access to transfer and control of data in any critical information infrastructure: infrastructural or procedural rules and requirements for securing the integrity and authenticity of data or information contained in any designated critical national information infrastructure: the storage or archiving of data or information designated as critical national information infrastructure: recovery plans in the event of disaster, breach or loss of critical national information infrastructure or any part of it: any other matter required for the adequate protection, management and control of data and other resources in any critical national information infrastructure.
It further stated that the Presidential Order made under Section 3 of this Act may require the Office of the National Security Adviser to audit and inspect any critical National Information infrastructure at any time to ensure compliance with this Act.
Part III which deals with offences and penalties stated that a person who, with intent commits any offence punishable under this Act against any critical national information infrastructure designated under section 3 of this Act, is liable on conviction to imprisonment for a term of not more than 10 years without option of fine.
Where the offence committed under subsection (1) of this section results in grievous bodily harm to any person, the offender is liable on conviction to imprisonment for a term of not more than 15 years without option of fine.
Where the offence committed under subsection (1) of this section results in the death of a person, the offender is liable on conviction to life imprisonment.
It added that a person who, without authorisation, intentionally access in whole or in part a computer system or network for fraudulent purposes and obtains data that are vital to national security, commits an offence and is liable on conviction to imprisonment for a term of not more than five years or a fine of not more than N5,000,000.00 or both.
Where the offence provided in subsection (1) of this section is committed with the intent of obtaining computer data, securing access to any program, commercial or industrial secrets or classified information, the punishment shall be imprisonment for a term of not more than 7 years or a fine of not more than N7,000,000.00 or both.
A person who with the intent to commit an offence under this section, uses any device to avoid detection or otherwise prevent identification or attribution with the act or omission, commits an offence and is liable on conviction to imprisonment for a term of not more than seven years or to a fine not more than N7,000,000.00 or both such.
A person or organisation who knowingly and intentionally traffics in any password or similar information through which a computer may be accessed without lawful authority if such trafficking affects public, private or individual interest within or outside the Federation of Nigeria, commits an offence and is liable on Conviction to a fine of not more than N7,000,000.00 or imprisonment for a term of not more than three years or both.
It stated that from the commencement of this Act, all operators of cybercafé shall- register as a business concern with Computer Professionals Registration Council in addition to a business name registration with the Corporate Affairs Commission and; maintain a register of users through a sign-in register and the register shall be available to law enforcement personnel whenever needed
A person who perpetrates electronic or online fraud using a cyber café, commits an offence and is liable on conviction to imprisonment for a term of three years or fine of N1,000,000.00 or both.
In the event of proven connivance by the owner of the cybercafé, such owners are guilty of an offence and are liable to a fine N2,000,000.00 or imprisonment for a term of three years or both. The burden of proving connivance in subsection 3 of this section shall be on the prosecutor.
A person who without lawful authority intentionally or for fraudulent purposes does an act which causes directly or indirectly the serious hindering of the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data or any other form of interference with the computer system, which prevents the computer system or any part thereof, from functioning in accordance with its intended purpose, commits an offence and is liable on conviction to imprisonment for a term of not more than two years or to a fine of not more than N5,000,000.00 or both.
A person who unlawfully destroys or aborts any electronic mail or process through which money or valuable information is being conveyed, commits an offence and is liable on conviction to a term of imprisonment for seven years in the first instance and upon second conviction, is liable to 14 years imprisonment.
From the commencement of this Act, any person being employed by or under a Local Government of Nigeria, private organization or financial institution with respect to working with any critical infrastructure or electronic mail commits any act which he is not authorised to do by virtue of his contract of service or intentionally permits tampering with such computer, commits an offence and is liable on conviction to imprisonment for three years.
A person who misdirects electronic messages with either the intention to fraudulently obtain financial gain as a result of such act or with the intention of obstructing the process in order to cause delay or speeding the messages with a view to cause an omission or commission that may defeat the essence of such messages, commits an offence and is liable on conviction to a term of imprisonment for 3 years or a fine of N1,000,000.00 or both.
A person who intentionally and without authorization, intercepts by technical means, non-public transmission of computer data, content, or traffic data, including electromagnetic emissions or signals from a computer, computer system, or network carrying or emitting signa,s, to or from a computer, computer system or connected system or network commits an offence and is liable on conviction to a term of imprisonment of not more than two years or a fine of not more than N5,000,000.00 or both.
A person or organization who, by means of false pretense, induces any person employed by or under the federal state or local government of Nigeria or any person in charge of electronic devices to deliver to h9im any electronic message which including e-mail, credit and debit cards information, facsimile messages which is not specifically meant for him or his organization (in the latter case except he is authorized to receive such messages for and on behalf of his organization), commits an offence and is liable on conviction to a term of imprisonment for two years or a fine of not more than N1,000,000.00 or both.
A person who, being employed by or under the authorities of the Local, State or Federal Government of Nigeria or private organization who intentionally hides or detains any electronic mail, message, electronic payment, credit and debit cards which was found by him or delivered to him in error and which to his knowledge ought to be delivered to another person, commits an offence and is liable on conviction to imprisonment for a term of one year or a fine of N250,000 or both.
A person who knowingly accesses any computer or network and inputs, alters, deletes or suppresses any data resulting in inauthentic data with the intention that such inauthentic data will be considered or acted upon as if it were authentic or genuine, regardless of whether or not such data is directly readable or intelligible, commits an offence and is liable on conviction to imprisonment for a term of not less than three years or a fine of not less than N7,000,000.00 or both.
A person who knowingly and without authority or in excess of authority causes any loss of property to another by altering, erasing, inputting or suppressing any data held in any computer, whether or not for the purpose of conferring any economic benefits on himself or another person, commits an offence and is liable on conviction to imprisonment for a term of not less than three years or to a fine of not less than N7,000,000.00 or both
A person who with intent to defraud, sends electronic message materially misrepresents any fact or set of facts upon which reliance the recipient or another person is caused to suffer any damage or loss, commits an offence and is liable on conviction to imprisonment for a term of not less than five years and to a fine of not less than N10,000,000.00 or both.
A person who with intent to defraud, franks electronic messages, instructions superscribes any electronic message or instruction, commits an offence and is liable on conviction to imprisonment for a term of not more than 3 years or to a fine of not more than N5,000,000.00 or both.
Udotai identified weaknesses in the Act to include decentralised and distributed enforcement framework; issues with compliance; possible constitutional challenge (the NSA Act); impact of the Cybersecurity Fund doubtful; technology-specificity; special provisions on the Financial Sector worrisome (needless really); and tendency for focus shifting dangerous; and unnecessarily transactional in certain areas.
Looking at the enforcement framework of the Act, he wondered if there is a conspiracy to ensure Nigeria doesn’t enforce cybercrime. “You may feel that way if you look at the enforcement framework designed for this law. But I think it was an error, which should be corrected,” he said.
On cybercrime investigation, prosecution and enforcement, he also wondered if they are separated, adding that it prescribed the traditional approach the nation’s Criminal Justice System which is usually based on ‘Conferred Authority’; which he argued is an unprecedented departure from the norm, and very unlikely to work. He also foresees threat of chaotic compliance
Head, Legal Services and Board Matters Unit, NITDA, Emmanuel Edet, said he has read the Act, adding that it was “asking for the impossible.” He said the Act created funds to be generated yet failed to give direction on how the fund would be spent, lamenting that the criminal law which the Act appeared to have copied has become too old and anachronistic. “It is a good law with fundamental flaws that could be amended,” he submiited.
President, Oniline Publishers Association of Nigeria and CEO, Proshare Nigeria, Femi Awoyemi, like Edet, said Nigeria’s criminal law has become too old. He said the police which is charged with the responsibility of investigating criminal activities live in a world completely different from reality. He also agreed that the law was not perfect but argued that there is no need trying to re-invent the wheel.
Chief Corporate Services Officer, Smile Communications, Tobe Okigbo lamented that the operators were always on the firing line, adding that the Cybercrime Act 2015 as currently passed, is a major risk to the telcos. Over the years, the telcos have clamoured for critical national communication infrastructure. The Nigeria Communications Commission (NCC) should have been empowered to advise the NSA before such advice gets to the President because of the technicalities involved in the issues. He urged stakeholders’ engagement to fine tune the implementation of the Act.
For the former Chairman, Nigeria Bar Association, Lagso Branch, Alex Muoka, described the Act as the most unintelligent law he had ever reviewed, creating lacuna, setting up a cybercrime council which the NSA is not a member yet calls its meeting and advice.
He described the provision for funding as “alternative taxation” which will not be administered by anybody.
‘The operators are always on the firing line. The Cybercrime Act 2015 as currently passed, is a major risk to the telcos. Over the years, the telcos have clamoured for critical national communication infrastructure. The Nigeria Communications Commission (NCC) should have been empowered to advise the NSA before such advice gets to the President because of the technicalities involved in the issues. He urged stakeholders’ engagement to fine tune the implementation of the Act’
While agreeing that the law will change the way businesses are carried out, he identified dearth of expertise in the areas of prosecution and adjudication as threats to the law.
Like Okigbo, Edet stressed the need for multi-stakeholders’ forum, arguing that previously under international law, attention was focused on the state adding that now, things have changed as groups are taking up arms and annexing parts of countries.
