Cybercrime and Digital Investigations: Legal Frameworks and Best Practices

Contributor: Oby E. Umeh

INTRODUCTION:

The Internet and the rapid deployment of information and communication technologies in recent years have changed the trends and practices in criminal investigation. Digitalization and internet-based activities have grown tremendously in recent times, and this has led to the growth and utilization of Information and Communication Technologies (ICTs). This growth has been supplemented by an increase in criminal actions^[1] due to the accessibility of computers and the decrease in cost,^[2] which has led to cybercrimes.

Cybercrimes consist of criminal acts committed online by using electronic communication and information systems. These criminal activities either target or use a computer, a computer network or a networked device.^[3] It is important to note that cybercrime continues to grow at an accelerated rate due to global connectivity and the advancements in networks, information exchange and mobile technologies.^[4]  As the internet continues to saturate every aspect of society, the growth of cybercrimes has also increased.

This paper discusses cybercrime and digital investigation, its legal frameworks and best practices, and further posits that unless and until serious actions are taken to tackle this menace, criminals involved in cybercrime will continue to thrive in Nigeria.

TYPES OF CYBERCRIME

The types of cybercrimes are generally divided into 4 which are Financial cybercrimes, Cyber Espionage/ Information Theft, Cyber Attacks on State Infrastructure, and Cyber Blackmail/Cyber Harassment or Online Abuse. Some examples of cybercrimes include:

1. Online Fraud: This involves deceptive practices to obtain financial and personal information from individuals or organizations. It normally takes the form of Card fraud, investment scams, and identity theft.
2. Corporate Espionage: involves the theft of proprietary information, trade secrets, or intellectual property from businesses or organizations. Cyber spies are often sponsored by Countries or international business conglomerates to target competitors so as to gain a competitive advantage or political leverage.
3. Cyber Attacks on State Infrastructure: This involves targeting critical infrastructure such as power grids, water systems, and transportation networks to disrupt services or cause widespread outages. This attack poses serious threats to public safety and national security.
4. Cyber Extortion/Blackmail: This Involves actions like sextortion, Child pornography, cyberbullying, and revenge porn. They are actions specifically carried out to cause harassment, intimidation, and humiliation to individuals through digital channels.

CYBERCRIMES AND DIGITAL INVESTIGATIONS

Over the past decade, the internet has experienced an explosive growth with the number of hosts connected to the internet increasing daily at an exponential rate. As the internet grows to become more accessible and many more services become reliant on it for their daily operation, so does the threat increase.^[5] Investigating cybercrimes is usually a hectic task, and just like the crime it involves making use of digital tools and imprints to uncover.^[6]

Digital Investigation is a branch of forensic science encompassing the recovery, investigation, examination, and analysis of materials found in digital devices, often in relation to mobile devices and computer crime.^[7] It is aimed at gathering, analyzing, and presenting digital evidence in order to prosecute crimes perpetrated using electronic infrastructure in Court.

By utilizing advanced digital tools and techniques, security agencies involved in the prevention and prosecution of cybercrimes are able to detect fraud, data breaches, financial scams, and other forms of high-tech crimes.^[8]

GOVERNMENT BODIES AND AGENCIES RESPONSIBLE FOR THE INVESTIGATION OF CYBERCRIMES

In Nigeria, various law enforcement agencies have been established majorly to investigate and prosecute cybercrimes, some of the Government bodies/agencies responsible for the Investigation of Cybercrimes include:

1. Economic and Financial Crimes Commission (EFCC).
2. Cybercrime Unit of NPF (Nigeria Police Force).
3. Department of State Services (DSS); and
4. Interpol National Central Bureau (NCB).

THE LEGAL FRAMEWORK FOR CYBERCRIME CONTROL IN NIGERIA:

1. Nigerian Cybercrimes (Prohibition, Prevention, Etc) Act, 2015

The Nigerian Cybercrimes (Prohibition, Prevention, etc) Act 2015 is the first legal and regulatory framework enacted to regulate people’s activities in cyberspace.^[9] Presently, it is the principal legislation for combating acts of cybercrime in Nigeria, before the enactment of this Act, the Nigerian digital economy had carried on with the absence of a specific legal framework for cyber security and was a problem to law enforcement agencies.

Therefore, with the enactment of the Cybercrime Act in 2015, Nigeria became more legally equipped in the fight against cybercrime activities. The Act was made to cope with the advancement of technological growth and the complexities involved in the investigation and prosecution of cybercrime and internet-based offences.^[10]

The objectives of the Act are to:

1. Provide an effective and unified legal framework for the prohibition of cybercrimes in Nigeria;
2. Ensure the protection of critical national information; and
3. Promote cyber security.^[11]

Some of the laws regulating cyberspace activities in Nigeria prior to the enactment of this Act include,

1. Advance Fee Fraud and Other Related Offences Act, (AFF Act) 2006.

The AFF Act was enacted to prohibit and punish certain offences relating to advanced fee fraud.^[12] The Act generally provides for ways of fighting fraud.^[13] One key provision in the Act is that every internet user must now have an identity.

An instance where the provisions of the AFF Act was used in prosecuting a case is the case of;

Harrison Odiawa (alias Abu Belgore) v. Federal Republic of Nigeria,^[14] where a syndicate used the internet to defraud an American citizen of 2 million USD. The offenders were tried under the Advance Fee Fraud and Other Related Offences Act, 2006 and sentenced to twelve years and ten years imprisonment respectively, without an option of fine.

1. The Economic and Financial Crimes Commission (Establishment) EFCC Act 2004.

This Act established The Economic and Financial Crimes Commission (EFCC)^[15] and bestowed upon them the responsibility of enforcement and due administration of the provisions of the Act,^[16] then investigation of all financial crimes. ^[17] The EFCC Act have made very elaborate provisions towards cyber security by creating a wide scope of cyber and internet crimes to which the Act applies. This provision and powers to prosecute those crimes and many more have helped the Commission in making some laudable achievements in the fight against various types of cybercrime.

1. Money Laundering (Prohibition) Act, 2022,

The Act inter alia makes comprehensive provisions to prohibit the financing of terrorism, and the laundering of the proceeds of a crime or illegal act and provides appropriate penalties, it also expands the scope of regulatory authorities to address the challenges faced in the implementation of the anti-money laundering regime in Nigeria. Although primarily aimed at combating money laundering, this law also covers offences related to electronic financial transactions and can be invoked in cases of cyber-financial crimes.^[18]

Other laws interconnected with the prosecution of cybercrimes include the Nigerian Communication Act, 2003, Terrorism (Prevention) Act, 2011. Nigeria Data Protection Act 2023 etc. These laws collectively aim to address various aspects of cybercrimes and provide legal mechanisms to prosecute offenders and protect individuals and organizations from cyber threats.

COMPLEXITIES SURROUNDING THE PROSECUTION OF CYBERCRIMES IN NIGERIA

Like it has been noted above, there is no draught as regards laws seeking to prohibit, prevent, and aid the prosecution of cybercrimes in Nigeria. However, the problem among other things lies in the successful application of these laws, some other challenges include:

1. Evidence Gathering/Admissibility in Court: The end–to–end encryption used in messaging platforms and secure communication channels presents formidable barriers to Evidence collection. Cybercriminals in a bid to clear their tracks delete incriminating evidence and destroy the hard disk of devices used in committing the offence. Also, establishing the authenticity, integrity, and chain of custody of digital evidence is crucial for its admissibility in court. All these, constitute a problem for prosecutors who will need evidence to prove their case beyond reasonable doubt in court.
2. Cyber Anonymity: Although the AFF Act provides against cyberspace users concealing their identity,^[19] cybercriminals still employ various tactics such as masking their IP addresses, using Virtual Private Networks (VPNs), and employing sophisticated encryption techniques to evade identification. Which makes it difficult for law enforcement agencies to track down the perpetrators.
3. Resource Constraint: The constant technological advancement in the digital space is one that must be matched by the prosecuting agencies. Limited technological infrastructure, forensic capabilities, and trained personnel hinder effective investigation and prosecution of cybercrimes.
4. Plea Bargaining: The introduction of plea bargains in our criminal justice system has also diminished the deterrence effect of cybercrime Laws, plea bargain agreement often results in reduced sentences which may continue to embolden offenders in the crime culture.^[20]

PRACTICAL MEASURES TO ENHANCE THE EFFECTIVENESS OF CYBERCRIME PROSECUTION

Due to some defects in the current cybercrime mechanisms, there is a need to explore comprehensive reforms aimed at bolstering the legal framework and enforcement strategies to combat cybercrimes effectively. Therefore, it is crucial to outline key reform options essential for enhancing the effectiveness of cybercrime prosecution in Nigeria.

1. Establishment of Specialized Cybercrime Units: The Cybercrime Act grants the office of the National Security Adviser the duty of establishing the National Computer Emergency Response Team (CERT) to see to the effective execution of the provisions of the Act.^[21] Other law enforcement bodies should have dedicated cybercrime units.
2. Stiffer Punishment for Cybercriminals: The penalties as contained in the Cybercrime (Prohibition, Prevention Etc) Act, 2015^[22] should be increased to effectively deter people from engaging in Cybercrime.
3. Continuous Training of Personnel: Periodic training programs should be held for Personnel involved in cybercrime prevention and prosecution, on cybercrime investigation techniques, digital evidence gathering and handling, and legal procedures specific to cyber offences.
4. Investment in Technological Infrastructure: Technological infrastructures pertaining to cyber forensic technology and tools to enhance the capacity of law enforcement agencies in collecting, preserving, and analysing digital evidence must be invested in.
5. Legislative Update: The existing cybercrime laws need to be constantly updated to address emerging threat areas and provide clearer provisions for cybercrimes.

It is important to note that each reform strategy plays a crucial role in safeguarding the Nigerian digital space and ensuring justice for victims of cybercrimes. Therefore, more should be done to strengthen cooperation with international law enforcement agencies to facilitate the extradition of cybercriminals, cross-border investigations, and mutual legal assistance in prosecuting cybercrimes.

By implementing these reforms, Nigeria can significantly enhance its capacity to prosecute cybercrimes effectively and deter the activities of cybercriminals within its jurisdiction.

CONCLUSION

The increase in cybercrime is a major concern in Nigeria, the internationally celebrated case of Hushpuppy is a pointer to how this very ugly trend is negatively affecting the image of the country. Nigeria is rated as one of the countries with the highest level of cyber crime activities. It is therefore imperative that a combination of advanced technical measures, laws and ethics are used to counter the activities of cybercriminals.

The government and other stakeholders should exercise the duty of care in the use of cyberspace while Prosecuting agencies keep up with technological and security advancements to effectively prosecute.

REFERENCE

1. O.A Onadeko & A.F Afolayan ‘A Critical Appraisal of the Cybercrimes Act, 2015 in Nigeria’. A paper presented at the 29^th International Conference of the International Society for the Reform of Criminal Law (LSRCL) held at Halifax, Nova Scotia, Canada July 24-28, 2016. Available at https://www.isrcl.com/wp-content/uploads/2021/05/Onadeko-Afolaya-A-critical-appraisal-of-the-cybercrimes-act-in-Nigeria.pdf accessed on 21 March 2024 ↑
2. Mohammed, Kabiru H.; Mohammed, Yusuf D, and Solanke, Abiodun A. (2019) “Cybercrime and Digital Forensics: Bridging the gap in Legislation, Investigation and Prosecution of Cybercrime in Nigeria,” International Journal of Cybersecurity Intelligence & Cybercrime: 2(1), 56-63 Available at https://vc.bridgew.edu/ijcic/vol2/iss1/5 accessed on 21 March 2024 ↑
3. E.I Amah & K.M Mbah ‘Domestic Regulation of The Cyberspace: An Appraisal of The Impact of The Nigerian Cybercrime Act on The Rights to Freedom of Expression And Privacy Guaranteed Under The Nigerian Law’. African Journal of Law and Human Rights (AJLHR) 7 (1) 2023. Available at https://journals.ezenwaohaetorc.org/index.php/AJLHR/article/download/2514/2588 accessed on 23 March 2024 ↑
4. M Cano Jeimy et al’, ‘Digital Forensic Analysis of Cybercrimes: Best Practices and Methodologies’ (2017) Vol.11, No. 25, International Journal of Information Security and Privacy (IJISP) DO – 10.4018/IJISP.2017040103 ↑
5. A. Michael, A. Boniface & A. Olumide, ‘Mitigating Cybercrime and Online Social Networks Threats in Nigeria, Proceedings of the World Congress on Engineering and Computer Science Adu Michael Kz’ (2014), Vol I WCECS, 22–24. ↑
6. B. A. Omodunbi, P. O. Odiase, O. M Olaniyan and A. O. Esan, ‘Nigeria: Analysis, Detection and Prevention’ (2016), 1(1) FUOYE Journal of Engineering and Technology, 37 ↑
7. M. Reith, C. Carr & G. Gunsch, ‘An examination of digital forensic models’ (2002) International Journal of Digital Evidence https://en.wikipedia.org/wiki/Digital_forensics#cite_note-ijde-2002-1 accessed 6^th March, 2025. ↑
8. NCS, ‘CYBERCRIME DETECTION AND FORENSIC INVESTIGATION WORKSHOP’ (2023) https://www.ncs.org.ng/cybercrime-detection-and-forensic-investigation-workshop/ accessed 6^th March. 2025. ↑
9. M.F Anyaegbu. Legal Framework for the Enforcement of Cyber Law and Cyber Ethics in Nigeria. International Journal of Computer and Technology, (Volume 15, Number 10) 2277-3061. Available at https://rajpub.com/index.php/ijct/article/view/12 accessed on 21 March 2024 ↑
10. F.E. Eboibi 2017 “A Review of the Legal and Regulatory Frameworks of Nigerian Cybercrimes Act 2015” Computer Law & Security Review. Available at https://www.researchgate.net/publication/316345017_A_review_of_the_legal_and_regulatory_frameworks_of_Nigerian_Cybercrimes_Act_2015 accessed 21 March 2024 ↑
11. See Section 1 of the Cybercrimes (Prohibition, Prevention etc.) Act, 2015. ↑
12. Section 1, Advance Free Fraud and Other Related Offences Act. ↑
13. Section 2, Advanced Fee Fraud and other Related Offences Act. ↑
14. [2008] 57 WRN 83 ↑
15. Section 1, EFCC Act. ↑
16. Section 6, EFCC Act. ↑
17. Section 7, EFCC Act. ↑
18. Section 2, Money Laundering (Prohibition) Act ↑
19. Section 12, Advance Fee Fraud & Other Fraud Related Offences Act ↑
20. K. Mohammed, Y. Mohammed, & A. Solanke (2019) Cybercrime and Digital Forensics: Bridging the gap in Legislation, Investigation and Prosecution of Cybercrime in Nigeria. International Journal of Cybersecurity Intelligence and Cybercrime 2(1), 56-63 ↑
21. Section 41, Cybercrime (Prohibition, Prevention Etc) Act, 2015 ↑
22. Section 5-36 of the Cybercrime (Prohibition, Prevention Etc) Act, 2015 ↑