What you should know about Cybercrimes Act
Nigeria is already in the digital age, and using computers and the internet in different facets of life by its citizens is no longer a big deal, especially to those across the country’s cities and towns. But amidst this technological advancement, the landscape has now become a fertile ground for traditional and emergent forms of […]
Nigeria is already in the digital age, and using computers and the internet in different facets of life by its citizens is no longer a big deal, especially to those across the country’s cities and towns.
But amidst this technological advancement, the landscape has now become a fertile ground for traditional and emergent forms of crime, thereby calling for urgent solutions.
This is why the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015 (“The 2015 Act”), was enacted to combat the growing danger of cyber insecurity. The Act sought to establish the regulatory and institutional framework to best achieve its aim. The Act also safeguards the Critical National Information Infrastructure (CNII), enhances cybersecurity measures, and protects various digital assets.
A comprehensive review of the Cybercrimes Act to enhance its effectiveness and address emerging threats was recently done. This review birthed the Cybercrime (Prohibition, Prevention, etc) (Amendment) Act, 2024 (“The Amendment Act”).
Key Provisions of the Cybercrimes (Prohibition, Prevention, Etc) (Amendment) Act, 2024
The Amendment Act introduces several significant changes to strengthen Nigeria’s cybersecurity framework and address gaps in the previous legislation. Key provisions include:
Revised timeline for reporting of cyber threats
Under the Amendment Act, individuals or institutions facing cyber threats must notify the National Computer Emergency Response Team (CERT) within seventy-two hours of detection. This is a departure from the old provision of the Act, which mandated that a report must be made within seven days of such incidence of cyber threat or cybercrime. This rapid escalation to the National CERT is intended to address cyber threats and swiftly avert the resulting cybercrimes. Failure to comply will lead to denying internet access and an obligatory fine of 2,000,000 (Two Million Naira) payable to the National Cybersecurity Fund (NCF).
Widening the applicability of the Act
The 2015 Act stipulated that any individual employed by a financial institution who, leveraging their specialised knowledge, engages in identity theft of their employer, staff, service providers, or consultants intending to defraud is deemed to have committed an offence. However, the Amendment Act has broadened the scope of this provision to encompass all individuals employed by any public or private organisation. The Amendment Act also amended Section 27(2) of the 2015 Act to widen the net of those who are culpable for attempting, conspiring, aiding and abetting cybercrime.
Manipulation of ATM/POS Terminals
The 2015 Act limited payment systems to Automated Teller Machines (ATMs) and Point of Sales (POS) terminals, neglecting other payment technologies in Nigeria. The Amendment Act rectifies this omission by holding individuals accountable for manipulating ATMs, POS terminals, and other payment technology systems. This extension encompasses the diverse array of payment systems in Nigeria, ensuring comprehensive coverage and mitigating fraud risks associated with unconventional payment methods.
Requirement of National Identification Number (NIN)
By Section 8 of the Amendment Act, customers engaging in electronic financial transactions at financial institutions are now required to furnish their National Identification Number (NIN) issued by the National Identity Management Commission (NIMC) for identity verification. There was no such requirement in the corresponding section of the 2015 Act. This mandate seeks to streamline the identification and tracking of defaulters or perpetrators, leveraging NIN, which encompasses individual data.
Protection of specific traffic data and subscriber information
The Amendment Act revised Section 38(1) of the 2015 Act in line with the Nigeria Data Protection Act (NDPA). Consequently, service providers are now obligated to retain specified traffic data and subscriber information and guarantee their protection.
Establishment of Sectoral Computer Emergency Response Teams (CERT) and Sectoral Security Operation Centres (SOC)
The Amendment Act establishes Sectoral CERTs and SOCs, to collaborate with the National Computer Emergency Response Teams (CERT) as stipulated in the 2015 Act. These Sectoral CERTs and SOCs are designated to receive information from individuals or institutions operating computer systems or networks, whether public or private, during cyberattacks or disruptions. Their core duty is to respond to such incidents swiftly. They will also supervise the integration and routing of internet and data traffic from all public and private organisations, aiming to safeguard the national cyberspace.
Implementation of the cybersecurity levy
The Amendment Act rectifies the ambiguity surrounding the cybersecurity levy imposed in Section 44(1)(a) of the 2015 Act by clarifying the levy percentage of 0.005 to include 0.5%. Additionally, the Amendment Act establishes that the office of the National Security Adviser administers the records of accounts of the Cybersecurity remittances and ensure that the account is audited per the Directives of the Auditor-General.
The Amendment Act further provides that the penalty for failure to comply with the Act is a conviction for a fine of not less than 2% of the annual turnover of the defaulting business and/or the closure or withdrawal of the business’ operational license.
A lawyer, Chimezie Ugwuoke, said the Amendment Act heralds a significant stride in Nigeria’s battle against cybercrimes and the fortification of its digital domain through the key provisions under the Act. He However, said that a pressing need still exists for effective collaboration between government agencies, private enterprises, and individual Nigerians to ensure the successful implementation of the Act and to further safeguard Nigeria’s digital future.
An activist, Festus Ogun the cybercrimes Act signed into law as “an effective, unified, and comprehensive legal, regulatory, and institutional framework for the prohibition, prevention, detection, prosecution, and punishment of cybercrimes in Nigeria”. According to the Act’s explanatory Memorandum, the instrument was also enacted to ensure the protection of critical national information infrastructure and promote cybersecurity, the protection of computer systems and networks, electronic communications, data, computer programs, intellectual property, and privacy rights.
He said Section 24(1) of the Act, prior to its recent amendment made it an offense to send a message via a computer system that was “grossly offensive, pornographic or of an indecent, obscene or menacing character” or to send a message or cause any such message or matter to be so sent; or to send a message, knowing it to be false for the purpose of “causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred, ill will or needless anxiety to another” or to cause such a message to be sent. The sentence on conviction for such an offense is a fine of up to N7,000,000 (Seven Million Naira Only) or imprisonment for up to three years or both.
“Over the years, several provisions of the Act, particularly Section 24(1) reproduced above, have been used by the authorities to suppress and harass critics, activists, opposition members, media organizations, and journalists for publications that are critical of powerful interests, as well as politically exposed and influential individuals. Despite the fact that the provision of Section 24(1) of the Act violated the constitutional right to freedom of expression and of the press, the Courts in Nigeria, have refused invitations by media rights lawyers and activists aimed at amending or repealing the draconian provision.
“The nebulous section 24 and other sections of the Cybercrimes Act 2015 has been contested at the Federal High Court, the Court of Appeal, the Supreme Court and the ECOWAS court for violating freedom of speech. The suit was struck out at the Federal High Court and the Court of Appeal. It was then appealed to the Supreme Court in 2019, and since when the brief was filed a day has not been fixed for it. The suit was filed at the ECOWAS Court in 2018, and in a 2020 judgement by the court it ordered the Nigerian Government to repeal or amend section 24 of the 2015 Act. This judgement was not obeyed by the Federal Government until 2024 when the Federal Government gave effect to the judgement of the ECOWAS Court”, Ogun said.
He said the attitude of the Nigerian courts in not nullifying the draconian provision of Section 24(1) of the Act gave a boost to the authorities to attack journalists and individuals who hold dissenting views and an opportunity to violate their rights to freedom of expression further.
He said it is conventional wisdom that when news stories, publications, reports, or comments critical of government policies are published on the internet, these reports are typically tagged as “annoying,” “grossly offensive,” “insulting,” “inflammatory,” or “needless anxiety” “negative,” thus resulting in arrests and detentions under Section 24 of the Act.
“Thankfully, by the Cybercrime (Prohibition, Prevention, Etc) (Amendment) Act, 2024, the controversial Section 24 was amended to remove the nebulous words and phrases with which the authorities suppress free speech. The newly amended Section 24(1) provides as follows:
“Any person who knowingly or intentionally sends a message or other matter by means of computer systems or network that –
(a) Pornographic: or (b) He knows to be false, for the purpose of causing a breakdown of law and order, posting a threat to life or causing such a message to be sent commits an offence under this Act and shall be liable on conviction to a fine of not more than N7,000,000.00 or imprisonment for a term of not more than 3 years or to both such fine and imprisonment.”