An Appraisal of the Cybercrimes (Prohibition, Prevention, Etc.) (Amendment) Act, 2024 and Its Implications for the Nigerian Society

CONTRIBUTOR: PRINCE IGHO

INTRODUCTION

In 2015, Nigeria passed the Cybercrimes (Prohibition, Prevention, etc.) Act in response to the changing digital technology landscape and the growing prevalence of cyber risks.^[1] This groundbreaking legislation was enacted to combat cybercrime, protect important information infrastructure, and encourage cybersecurity practices throughout the country.^[2] The Cybercrimes Act of 2015 is a critical step in addressing the issues raised by cybercriminal activities such as fraud, identity theft, data breaches, and online scams. It establishes a legal framework for investigating, prosecuting, and deterring cybercriminals while also protecting the confidentiality, integrity, and availability of electronic communications and information systems.^[3] The Act further demonstrates Nigeria’s commitment to improving cybersecurity and creating confidence in the digital economy.

Despite the laudable provisions of the Act, it is plagued with several ambiguities and inconsistencies, the implementation of which have been variously described as violations of constitutionally guaranteed rights. Thus, an amendment became inevitable. Therefore, the National Assembly’s move to amend the Act and the subsequent passage of the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 was commended in several quarters.

The article will examine the substantive provisions of the Act as well as the implications on several aspects of Nigerian society including the new cybersecurity levy imposed by the CBN.

AN OVERVIEW OF THE KEY AMENDMENTS OF THE ACT AND THE LEGAL IMPLICATIONS.

The Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 aims principally at clearing ambiguities in the Principal Act which had hitherto hampered their effective implementation. Some of the essential amendments will be examined anon.

The Act strengthens Nigeria’s cyber security posture. It expounds the powers and functions of the National Security Adviser to ensure the establishment of Computer Emergency Response Teams (CERT) and Security Operation Centres (SOC) across various sectors. These sectoral CERTs and SOCs will feed data and intelligence to the National CERT, creating a more comprehensive national cybersecurity picture.^[4] Furthermore, the Act mandates that all public and private organisations integrate and route their internet and data traffic to the sectoral SOC thereby protecting the national cyberspace.^[5]

Previously, Section 21 (1) of the Principal Act mandates persons or organisations, operating computer systems or networks whether public or private to inform the National CERT Coordination Centre, of any attack, intrusions or disruptions which are capable of hindering the proper functioning of any other computer system or network to ensure that appropriate measures of redress are taken. The amendment streamlined this process by allowing the report to be made through the sectoral CERTs or Security Operations Centres^[6] and the time frame for making such reports provided under Section 21(3) was abridged from 7 days to 72 hours of its detection.^[7] This is quite commendable as it recognizes the potential impact of cyber-attacks on the business of individuals and institutions, personal and economic data etc. Failure to report such incidents incur criminal liability punishable with denial of internet services and a fine of 2 million Naira payable to the National Cyber Security Fund.^[8]

In amending section 30 of the Principal Act, the amendment Act^[9] recognised the existence of other technology-driven means of payment aside from ATMs and POS terminals. A person or employee of a financial institution who is found either individually or in connivance with others to manipulate, with intent to defraud, a machine, software or other technology means or perpetuate fraud with same will be criminally liable as provided by the section.

Furthermore, Section 4 of the Amendment Act expands the scope of the application of Section 22 (1) of the Principal Act. Thus, criminal liability for identity theft is no longer restricted to employees or persons engaged in the services of a financial institution but extends to any public or private organisation. A similar situation exists under Section 27(2) of the Principal Act, whereby the said provisions are amended by substituting ‘financial institutions’ for ‘any public or private organisation.’^[10] This therefore implies that any employee of an organisation, whether private or public found in connivance with another/others for the perpetuation of fraud will be criminally liable and punishable as provided by the section.

In addition, as part of KYC requirements in line with international best practices, financial institutions are now required to demand together with other relevant information, the National Identification Numbers, issued by NIMC, of their customers who carry out financial transactions through electronic means.^[11]

This aligns with anti-money laundering requirements under the provisions of the Central Bank of Nigeria (Customer Due Diligence) Regulations, 2023.^[12] This has become increasingly important as financial crimes are on the rise as a result of the use of computer systems and other technologies.

Another laudable amendment was made to the provisions of Section 24 of the Principal Act which had hitherto posed a significant challenge to the freedom of speech of citizens. Thus, by the amendment, a message sent via electronic means does not constitute an offence under Section 24 (1) unless such is pornographic, false, or poses a threat to life or breakdown of law and order.^[13] This amendment has been particularly lauded because the former provision has reportedly led to the ‘unlawful’ arrest of journalists and social media personalities.^[14]

Besides, the Act sought to align the Nigerian cybersecurity regime under the current legal data protection framework by mandating service providers to keep and protect traffic data and subscriber information in accordance with the provisions of the NDPA and other provisions for a period of two years. It thus substituted Section 38(1) with a new provision.^[15]

The Act further provides clarity on the exact percentage to be charged as a levy on all electronic transactions specified under the second schedule to the Principal Act. Thus, a sum equivalent to half per cent (0.5%) is to be charged per transaction.^[16] Failure to remit the same by any business is punishable with a fine of not less than 2% of the business’s annual turnover and a subsequent closure of the business or withdrawal of its operational licence, where the failure persists.

Further to the above, on the 6^th of May 2024, the Central Bank of Nigeria released a circular^[17] directing banks, other financial institutions and payment service providers to commence the deduction of the levy within two weeks from the date of the circular. It further specified transactions which are exempted from the deduction and some of these include salary payments, loan disbursements and repayments, savings and deposits, including long-term investments, intra-bank transfers between customers of the same bank, intra-account transfers within the same bank or different banks for the same customer, educational institutions transactions, etc.^[18] This circular, no doubt follows a call by the National Security Adviser for the enforcement of cybercrime law and the strengthening of the regulatory terrain in Nigeria.^[19]

CONTROVERSIES SURROUNDING THE INTRODUCTION OF THE CYBERSECURITY LEVY

The introduction of the cybersecurity levy sparked major debates,^[20] critics argued that the levy will push people back to using cash which will defeat the CBN’s policy of a cashless economy.^[21]

On the 10^th of May 2024, the Chairman of the Senate Committee on National Security and Intelligence, in the defence of the levy stated that same has become pertinent as cybersecurity issues ought not to be funded by international aid and as such the levy imposed was not in any way intended to punish Nigerians.^[22] However, as a result of the unending tension generated by the imposition of the levy, the Federal Government has announced its suspension and review. ^[23] while the arguments in favour of the levy are in no way invalid, it is opined that the timing of the imposition does not augur well for the economic well-being of citizens. It is therefore believed that the government will consider the current economic situation and provide strategies for the implementation which align with the best interest of Nigerian citizens.

Finally, section 48 of the principal act was amended by a deletion of its subsection 4. Thus, conviction under the Act will no longer result in the cancellation of a Nigerian citizen’s passport or the withholding of a foreigner’s passport until he has served the sentence or paid the fines imposed on him.

CONCLUSION

The Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024 in Nigeria introduces significant changes to the existing legislation. It extends criminal liability for identity theft to employees of any public or private organization, aligns with international best practices for financial institutions by requiring National Identification Numbers for electronic transactions, and mandates the protection of traffic data and subscriber information. The Act also imposes a levy on electronic transactions, with penalties for non-compliance, and expands the scope of cybercrime to include manipulation of technology means for fraud. Additionally, it clarifies that electronic messages are not considered offensive unless they are pornographic, false, or pose a threat to life or law and order. With regards to the cybersecurity levy imposed by the Act, clear directions are still awaited and it is believed that the government’s decision will be in the best interest of Nigerian citizens.

1. Ojolo T. L, Singh S. B, ‘The transnational dimension of organised crime: an investigation into the operational structure of cybercrime in Nigeria’ EUREKA: Social and Humanities; 2023, 6 pp. 87-98 at 88 available at https://journal.eu-jr.eu/social/article/view/3263/2401 ↑
2. Onyekonwu I., ‘A Discourse on the Legislation Prohibiting Cyber Stalking in Nigeria’ An Undergraduate Thesis Submitted to the Faculty of Law, University of Nigeria; June 2021; p2. Available at https://papers.ssrn.com/sol3/papers.cfm?abstract_id=4289439 ↑
3. Eboibi, Felix E. “A review of the legal and regulatory frameworks of Nigerian Cybercrimes Act 2015.” Computer law & security review 33.5 (2017): 700-717. ↑
4. Section 10 ↑
5. Ibid. ↑
6. Section 3 of the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024. ↑
7. Ibid. ↑
8. Section 21 (3) of the Principal Act. ↑
9. Section 7. ↑
10. Section 6 of the amendment Act. ↑
11. Section 8 of the Amendment Act. ↑
12. Regulations 6 and 7. ↑
13. See Section 5 of the Amendment Act. ↑
14. Paradigm Initiative, ‘Press Release: Coalition lauds Cybercrimes Act Amendment and urges FG to Further Safeguard Freedom of Expression’ 2024; available at https://paradigmhq.org/press-release-coalition-lauds-cybercrimes-act-amendment-and-urges-fg-to-further-safeguard-freedom-of-expression/ accessed on the 16^th of May 2024. ↑
15. Section 9. ↑
16. Section 11 ↑
17. See Central Bank of Nigeria, ‘Circular to All Commercial, Merchant, Non-Interest and Payment Service Banks; Other Financial Institutions, Mobile Money Operators and Payment Service Providers’ May 6, 2024; available at https://www.cbn.gov.ng/Out/2024/CCD/CIRCULAR%20REF%20PSMDIRPUBLAB017004%2006052024.pdf accessed on the 15^th of May 2024. ↑
18. Ibid. ↑
19. Obewo-Isawode L., ‘NSA Orders Enforcement of Cybercrimes Law’ (CHANNELS, May 3, 2024) available at https://www.channelstv.com/2024/05/03/nsa-orders-enforcement-of-cybercrimes-law/ accessed on the 15^th of May 2023. ↑
20. Ademola C., ‘NLC Rejects CBN’s 0.5% Cybersecurity Levy, Calls for Policy Reversal’ (NAIRAMETRICS, 2024) available at https://nairametrics.com/2024/05/08/nlc-rejects-cbns-0-5-cybersecurity-levy-calls-for-policy-reversal/ See also Abubakar M., ‘Anger in Nigeria Over Levy on Money Transfers’ (BBC NEWS, May 2024) accessed on the 16^th of May, 2024. ↑
21. Tolu-Kolawole D., Abimbola O., ‘Cybersecurity Levy Will Worsen Hardship -Labour’ (PUNCH, May 8^th 2024) available at https://punchng.com/cybersecurity-levy-will-worsen-hardship-labour/ ↑
22. Ogundapo A., ‘Senate Panel Defends 0.5% Cybercrime Levy’ (PREMIUM TIMES, May 10, 2024) available at https://www.premiumtimesng.com/news/more-news/693023-senate-panel-defends-0-5-cybercrime-levy.html accessed on the 15th of May 2023. ↑
23. Adegboyega A., ‘Nigerian Government Announces Suspension of 0.5% Cybersecurity Levy’ (PREMIUM TIMES, May 15, 2024) available at https://www.premiumtimesng.com/news/top-news/694667-nigerian-govt-announces-suspension-of-0-5-cybersecurity-levy.html accessed on the 16th of May 2024. ↑