Cybercrimes Act: Friend or Foe?

The Cybercrimes (Prohibition, Prevention, etc) Act, 2015, was enacted with the aim of providing “an effective, unified and comprehensive legal, regulatory and institutional framework for the prohibition, prevention, detection, prosecution and punishment of cybercrimes in Nigeria.”

It was also created “to ensure the protection of critical national information infrastructure and promotion of cyber security and the protection of computer systems and networks, electronic communications, data and computer programmes, intellectual property and privacy rights in Nigeria.”

The Act provides for “the prohibition, prevention, detection, response, investigation and prosecution of cybercrimes and for other related matters.”

It contains 59 sections.

The Act may have been enacted with noble intentions, but within its few years of existence, it has attracted a lot of negative feelings. Some sections of the Act have not gone down well with certain categories of Nigerians and the clamour is on either to amend such sections or have the entire act repelled.

Recently, the constitutionality of the Cybercrimes Act came under review at a media interactive Roundtable organised by the Socio-Economic Rights & Accountability Project, SERAP.

The topic of the day was; “The Constitutionality of the Cybercrimes (Prohibition, Prevention, etc) Act 2015, and it was x-rayed by Mr. Mofesomo Tayo-Oyetibo, a legal practitioner with Twelve Legal, a firm of Legal Practitioners and Arbitrators, who came in place of Mr. Tayo Oyetibo, SAN.

Acknowledging that crime has existed for as long as human beings and that as human life increased in complexity, crimes and criminals also grew in complexity and relative ease, he owned up from the get go that Nigeria needed a cybercrimes law.

According to him, the advent and widespread use of the internet has brought about a new specie of crime previously unknown to and not contemplated by criminal statutes. That crime, he identified as ‘cybercrime.’

Oyetibo, therefore, held that Nigeria “could not ignore cybercrimes and had to enact specific legislation to deal with such crimes not necessarily captured by the general criminal statutes.”

However, notwithstanding the worthy intentions behind the enactment of the Cybercrimes Act, he noted that it had not been immune to criticism and challenge on the ground that it was unconstitutional under the Nigerian constitution.

Oyetibo, recognising the importance of the internet to the 21st century individual, in his presentation, said: “The internet has been one of the most revolutionary inventions of all time. In so many different ways, it has increased the quality of life of each and every person who has access to it by things such as bringing an unlimited amount of information to their doorstep and also giving them the opportunity to connect with people all over the world instantly and conveniently. Without the internet, life, as we know it today, would have been greatly hampered because certain functions would just be incapable of performance.”

He equally recognised that every coin has two sides, saying; “Notwithstanding all of its immeasurable benefits to well-intentioned users, the internet also presents an opportunity for those who have access to it and are criminally-intentioned to misuse it. It is within this realm of opportunity that the specie of crime known as cybercrime thrives.”

What exactly is cybercrime and how much harm can it cause?

Quoting the Nigerian Communications Commission, NCC, Oyetibo, said “cybercrime is generally defined as a criminal offence involving a computer as the object of the crime (hacking, phishing, spamming), or as the tool used to commit a material component of the offence (child pornography, hate crimes, computer fraud).”

He noted that by the nature of cybercrimes, “although they can be perpetrated at relative ease and minimal expense, they can have devastating consequences that transcend national borders.”

Oyetibo, quoted the United Nations Office on Drugs and Crime, UNODC, as saying: “cybercrimes are an evolving form of transnational crime that takes place in the border-less realm of cyberspace, the complex nature of which is compounded by the increasing involvement of organized crime groups.”

Dwelling on the harm that cybercrimes have brought on Nigeria and Nigerian, he said: “From a social standpoint, cybercrimes have had an impact on the manner in which Nigerians are received abroad and even contributed significantly to the erosion of trust amongst and for Nigerians domestically and abroad. Economically, cybercrimes have resulted in significant pecuniary losses to Nigerians and Nigeria as a country in terms of lost revenue and economic opportunities.”

Oyetibo buttressed his point with a quote from the NCC’s Department on New Media and Information Security on the ‘Effects of Cyber Crime on Foreign Direct Investment and National Development,’ which said: “Cybercrime has also had an implication in the Foreign Direct Investment advancement into the country, as information flowing from the country is being characterized as questionable because of the criminal elements which make it unreliable, inaccurate and untrustworthy. Indeed, one cannot overemphasize the investment sabotage resulting from cybercrime in Nigeria.”

In 2014, a report by the South African based Institute of Digital Communication indicated that Nigeria losses about $80 million dollars yearly to software piracy alone. Similarly, in 2015, an estimated customer loss of N2, 146,666,345,014.75 ($13,547,910,034.80) was incurred to cybercrime in Nigeria.”

With the foregoing in mind, was the National Assembly within their right in making the Cybercrimes law? Oyetibo, in answering that question, leaned on the provisions of the 1999 Constitution for guidance.

According to him, the constitution, which is the supreme law of the land, gives the National Assembly the exclusive powers to make certain laws and the concurrent powers to co-legislate with the States’ Houses of Assembly on certain issues and any issue that does not fall within any of the two, would fall within the ‘residual’ list which the States Assemblies handle.

With regards to cybercrime, he noted that it was not expressly mentioned in either the Exclusive or Concurrent Legislative list “which may lead one to generally reach the conclusion that it is a residual matter in respect of which, to the exclusion of the National Assembly, only the States Houses of Assembly have the powers to make laws. However, for certain reasons, a more critical look at the provisions of the constitution and relevant judicial authorities appear to point to a different conclusion altogether.”

READ ALSO: Second Term: SERAP Urges Buhari to Respect Rule of Law

He said there was ample legal justification to conclude that the National Assembly has the legislative competence to enact a law on cybercrimes, citing some decisions of various courts in Nigeria, which support that position.

With the constitutionality of the Act established to the extent that the National Assembly has the competence to make the law, the next kernel for Oyetibo to crack was whether the Act is consistent with the 1999 constitution, which states: “If any other law is inconsistent with the provisions of this constitution, this constitution shall prevail, and that other law shall to the extent of the inconsistency be void.”

In this respect, he focused on two specific provisions of the Cybercrimes Act; sections 24 and 38. Section 24 of the Act provides for the criminalisation of the sending of certain types of offensive messages, whilst section 38 provides for the retention of traffic data and subscriber information by service providers.

According to him, the two sections have been challenged in court on the ground that they are unconstitutional and consequently void by virtue of the provisions of section 1(3) of the constitution, but the courts held otherwise, finding that they did not violate the constitution.

With respect to section 38 of the Cybercrimes Act, Oyetibo said given certain provisions of the Act and the 1999 constitution, the Court of Appeal’s decision that it does not go contrary to the constitution “would appear correct on its face.”

He noted further, “By reason of section 38(5) of the Cybercrimes Act, it would most certainly be difficult for any court to reach the general conclusion that section 38 of the Act is unconstitutional, particularly in the absence of compelling specific factual evidence to the contrary. The said section 38(5) provides that: “Anyone exercising any function under this section shall have due regard to the individual’s right to privacy under the Constitution of the Federal Republic of Nigeria, 1999 and shall take appropriate measures to safeguard the confidentiality of the data retained, processed or retrieved for the purpose of law enforcement.

“Going by the above provision, it certainly does appear that the National Assembly had spotted that section 38(1), (2) and (3) have the potential to be construed as being in violation of the constitutional right to privacy and sought to include subsection (5) as a safeguard.

“However, notwithstanding the inclusion of subsection (5) in section 38, the section still has some inherent issues relating to the privacy of persons. In this regard, section 38(2) of the Act, which makes it compulsory for service providers to release any information kept under subsection (1) to the “relevant authority,” comes to mind. The phrase “relevant authority” is not defined in the Cybercrimes Act, which raises the question as to whether service providers, for fear of criminal sanctions, may be coerced into releasing ordinarily confidential information to any government authority claiming to be a “relevant authority” under the Act.”

He argued that a better provision would have been “for the service providers to be bound to release such information to specific law enforcement agencies that require the information in the course of carrying out their legitimate law enforcement functions, but subject only to the fulfilment of some stipulated procedural conditions or supervision of the court.”

With regards to section 24 of the Act, Oyetibo insisted that the court decisions notwithstanding, “there is significant scope to posit, specifically concerning section 24 of the Cybercrimes Act, that the courts’ decisions possibly ought to have been different from what they are.”

He explained his position; “Section 24(1) criminalises the intentional sending, by means of computers: Messages that are grossly offensive, pornographic, indecent, obscene or menacing in character; and false messages for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred, ill will or needless anxiety to another person. In Nigerian criminal law, two elements must generally be present for a conduct to constitute a criminal offence and they are actus reus and mens rea, which mean ‘guilty act’ and ‘guilty mind’ respectively.

“Essentially, for a person to be found to have committed a criminal offence, he must know what constitutes the offence and have committed the offence with the requisite mens rea. words,” so, mens rea is a criminal intention or knowledge that an act is wrong.

Based on the above, he said any statute that criminalises a certain conduct ought to indicate both the guilty act and the guilty mind element. of the offence adding; “It is against the backdrop of this fundamental principle of law that section 36(12) of the Constitution provides that: “Subject as otherwise provided by this Constitution, a person shall not be convicted of a criminal offence unless that offence is defined and the penalty therefore is prescribed in a written law, and in this subsection, a written law refers to an Act of the National Assembly or a Law of a State, any subsidiary legislation or instrument under the provisions of a law.”

From the foregoing, Oyetibo maintained that section 24(1) of the Cybercrimes Act does not meet the constitutional requirement. According to him, the contentious section in creating criminal offences uses words that are entirely subjective in meaning to describe the ‘guilty act’ elements of the offences, despite the fact that such ought to be capable of objective and not subjective definition.

Worse still, he said, the Cybercrimes Act makes no effort to give certainty to the meanings of any of the words used in its section 24(1) by defining them anywhere in the Act, which means that only judicial definitions can be given to those words in any case where a person is charged with an offence under that section of the Act.

“From a practical standpoint, it means that a person charged with an offence under section 24(1) of the Cybercrimes Act will involuntarily be playing the lottery of judicial interpretation of the words and phrases used in that section. This is because virtually all of the words used in section 24(1) of the Act are of such personal character that, any attempt to define them is entirely subject to the whims and caprices of two different sets of people; complainants and judges. The reality of this scenario is laid bare when one considers the fact that a message that is “grossly offensive, pornographic, indecent, obscene or menacing in character” to one set of people may not at all be to a different set of people.

“Similarly, a message that causes “annoyance, inconvenience, danger, obstruction, insult, enmity, hatred, ill will or needless anxiety” to one set of people may not in any way do so to a different set of people.”

Oyetibo pointed out that the manner in which a person will receive or define a message of the kind described in section 24(1) of the Cybercrimes Act would depend entirely on the person’s age, gender, ethnicity, cultural background, temperament, mentality, sense of bias, etc, which are not factors contemplated by section 36(12) of the constitution in the definition of a criminal offence by a statute.

He further held that it is impossible for a person to be convicted of an offence under section 24(1) of the Cybercrimes Act without conjecture or inference by the court as to the meanings of the words used in that section adding, “Worse still, such conjecture or inference can only be imputed by the court at the point of delivering judgment in the matter, at which point the accused person will not have had the opportunity to be heard by the court as to the court’s interpretation of the meanings of those words and phrases. In this respect, there will no doubt be the question of whether such proceedings do not violate the accused person’s right to fair hearing under section 36(1) and (6)(a) of the constitution.”

Pointing out that every person is constitutionally guaranteed the right to freedom of expression, including freedom to hold opinions and to receive and impart ideas and information without interference under section 39(1) of the constitution, Oyetibo said a situation in which a person is bound by section 24(1) of the Cybercrimes Act to second-guess the exercise of his right to freedom of expression under section 39(1) of the constitution is certainly not one contemplated by the constitution in any way.

He submitted therefore, that the good intentions behind the enactment of the Cybercrimes Act notwithstanding, “section 24(1) of the Act portends great danger for every person in Nigeria. This is by reason of the fact that at the time of issuing any communication in exercise of the right to freedom of expression, it is impossible for a person to determine whether or not an offence is being committed under the Cybercrimes Act.”

Oyetibo, therefore, concluded that given the constitutional guarantee to freedom of speech the Cybercrimes Act particularly in view of the provisions of its section 24(1) is inconsistent with the Constitution.

He consequently recommended that “section 24(1) be entirely deleted from the Cybercrimes Act, due to its apparent irreconcilability with the provisions of section 36(12) and 39(1) of the constitution. This is because notwithstanding that the courts may hold firm on the view that section 24(1) does not violate the constitution, as long as that provision remains in the statute books, it is a tool that readily lends itself to abuse and misuse by those in authority against freedom of expression in Nigeria. This is particularly because the Cybercrimes Act contains no safeguards whatsoever to the enforcement of section 24, which carries with it severe criminal sanctions.

“Also, by the opening phrases of section 24(1) and (2) of the Cybercrimes Act the conducts covered by that section are only of a criminal nature where carried out “by means of computer systems or network” and not any other means. This means that two different people can carry out the exact same conduct but where only one of them uses a computer system or network that person alone would be found to have acted criminally. This is certainly an absurdity that ought not to be. There is no logical or legal reason why a singular conduct should be legally dichotomized on the basis of the medium through which the conduct is carried out.”

In his comments, Mr. George-Maria Tyendezwa, Head Cybercrime Prosecution Unit, Federal Ministry of Justice, conceded that though the Act was not best piece of legislation, it was not as bad as some people have contended.

He explained that the intention of the Act was to protect victims of cyber stalking and other cybercrimes. He said; “Section 24(1) is aimed at stalking and if you read the entire section, it talks about protection of the victim. On the whether the language of the section is subjective or not, bear in mind that a stalker could send out one communication and it would be received by millions of people and indeed the world. In normal everyday life, there has to be a series of actions for one to establish stalking, and but with online, that’s not the case and that’s what the section 24 seeks to guard against. Whether the language has become so subjective to offend section 36 of the constitution, the Supreme Court will tell us ultimately. But it is important that we understand the background from which the legislation was done.”

Tyendezwa, insisted that the Nigerian Cybercrimes Act was a better and cleaner bill than what several other countries have.

“Agreed that other countries probably have stronger institutions, but if we educate ourselves on what the provisions of the Act are, there won’t be much problem. For instance somene told of a person arrested under section 24 of the act and taken to a magistrates Court. I told him straight up that the magistrate’s court had no jurisdiction under the Act. So, it is not about the provisions of the law, but about someone not doing what they ought to do.

“We have had theft in our laws for ages, but are people still not being wrongfully accused and unjustly being locked up for theft,” he queried.

He said further; “two ways to address the issues are either amend the law, if we get to that point and that takes time or educate and enlighten our law enforcement. You do not arrest someone because they have a computer. If someone comes and says another person wrote about him, you must look for the criminal element. The law of defamation is still there to take care of such.

“Bottom line, pending whatever the Supreme Court is going to say about the constitutionality or otherwise of the law, as a nation, we have the responsibility of improving the capability of our law enforcement and they need education and enlightenment around these areas. It is a new law so we need to make allowances.”

Mrs. Nkem Okwuogu of Amnesty International, Nigeria, held that there was a need to amend the cybercrime Act, especially, the contentious sections and challenged journalists to champion the course.

She posited that journalists were facing existential threat, saying it must not be allowed, adding, “Journalists must champion their course, be their brothers’ keepers, lead the fight.”

Earlier in his welcome address, the Executive Director, SERAP, Mr. Mumuni Adetokunbo, noted that while the organisation was not rooting for an unchecked or unregulated media, it would also not accept undue restriction and suppression of the media.

He said people must be free to criticise in any democracy and through any medium of their choice, and further condemned a situation where a publication in the regular media is acceptable, but seen as a crime when carried by the social media or online platforms.

At the end of the Roundtable, participants insisted on a repeal of the cybercrimes Act, failing which, the offensive sections should be amended or deleted.