INTRODUCTION
In February 2024, the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act, 2024, (“the Cybercrimes (Amendment) Act”) was signed into law by President Bola Ahmed Tinubu. The Cybercrimes (Amendment) Act consists of thirteen (13) sections, amending 11 sections of the Cybercrimes (Prohibition, Prevention, etc.) Act, 2015. According to the Explanatory Memorandum of the Cybercrimes (Amendment) Act, it aims to insert some consequential words that were inadvertently omitted in the Cybercrimes Act. However, a critical look at the Cybercrimes (Amendment) Act reveals that it does more than inserting omitted words; it introduces some new provisions that are significant to Nigeria’s cyber security ecosystem. This article, therefore, reviews key amendments made by the Cybercrimes (Amendment) Act.
Introduction of Certified True Copies of Valid Electronic Signature
Section 2(b) of the Cybercrimes (Amendment) Act amends Section 17(2) of the Cybercrimes Act to provide an exception to transactions that would be excluded from the categories of contractual transactions or declarations that are valid by virtue of electronic signature, with the exception being “where they are legally verified in Certified True Copies”. Similarly, Section 2(a) of the Cybercrimes (Amendment) Act amends Section 17(1)(b) of the Cybercrimes Act by substituting the word “geniuses” with the word “genuineness”. With this amendment, Section 17(1)(b) of the Principal Act now reads as follows “where the genuineness or otherwise of such signatures is in question, the burden of proof, that the signature does not belong to the purported originator of such electronic signatures, shall be on the contender”.
Establishment of Sectoral National Computer Emergency Response Team (CERTs) or Sectoral Security Operations Centres (SOC)
Section 3 of the Cybercrimes (Amendment) Act amends Section 21(1) of the Cybercrimes Act by establishing the Sectoral National Computer Emergency Response Team (CERTs) and Sectoral Security Operations Centers (SOC) which shall be under the administration and control of CERT Coordination Center. CERT Coordination Center is a centre where any person or institution, who operates a computer system or a network, whether public or private can report any attacks, intrusions and other disruptions liable to hinder the functioning of another computer system or network, so that necessary measures may be taken by the Centre to tackle the issue. By this amendment, there is hopefully going to be more efficiency in managing reports of cyber threats by the Centre.
Resolving the issues of Section 24 of the Cybercrimes Act
Section 24(1) of the Cybercrimes Act criminalizes sending a message via a computer system which is ‘grossly offensive, pornographic, or of an indecent, obscene, or menacing character’, or to send a message knowing it to be false for the purpose of “causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred, ill will, or needless anxiety to another”, or to cause such a message to be sent. The words used in this provision are quite vague, nebulous and ambiguous. In fact, the civil society organizations are of the opinion that this provision was used by state authorities to prosecute journalists, bloggers and media practitioners.
Thankfully, Section 5 of the Cybercrimes (Amendment) Act has deleted the vague, nebulous and ambiguous words used in Section 24(1) of the Principal Act and amended the provision with clarity and certainty. Now, Section 24 of the Cybercrimes Act simply criminalizes messages that are ‘pornographic’ or sent by a person knowing them to be false, for the breakdown of law and order, posing a threat to life, or causing such a message to be sent.
National Identification Number (NIN) as requirement for Electronic Financial Transactions
Section 8 of the Cybercrimes (Amendment) Act amends Section 37 (1) of the Cybercrimes Act. By this amendment, financial institutions shall verify the identity of their customers by requiring them to present their ‘National Identification Number issued by the National Identity Management Commission and other valid’ documents bearing their names, addresses, and other relevant information before issuance of ATM cards, credit cards, debit cards, and other related electronic devices.
Recognition of Nigeria Data Protection Act
Section 9 of the Cybercrimes (Amendment) Act amends Section 38(1) of the Cybercrimes Act by providing that a service provider must keep and protect specific traffic data and subscriber information in accordance with the provisions of the Nigeria Data Protection Act, which the principal act had only prescribed as “relevant authority”.
Cybersecurity Levy and Punishment for Defaulting
Section 11(a) of the Cybercrimes (Amendment) Act amends Section 44(2)(a) of the Cybercrimes Act to provide a levy of 0.5% (0.005), equivalent to half a percent of all electronic transaction values by the businesses specified in the second schedule of the Act, which include GSM service providers and all telecommunication companies; Internet service providers; banks and other financial institutions; insurance companies; and the Nigerian Stock Exchange. Under the old provision, it required “a levy of 0.005 of all electronic transaction by the businesses specified in the second schedule of this Act”
Section 11(b) of the Cybercrimes (Amendment) Act further provides for the punishment for defaulting to pay the levy which is “on conviction, to a fine of not less than 2% of the annual turnover of the defaulting business” and failure to comply with payment of fine shall lead to closure or withdrawal of the business operational license.
Removal of Section 48(4) of the Cybercrimes Act
Section 12 of the Cybercrimes (Amendment) Act deletes Section 48(4) of the Cybercrimes Act, which provides that any person convicted of an offence under this Act shall have their international passport cancelled, and in the case of a foreigner, their passport shall be withheld and only returned to them after they have served the sentence or paid the fines imposed on them.
Conclusion
The amendments made by the Cybercrimes (Amendment) Act lengthens the arm of the law against various forms of cybercrimes, ensuring that no financial institution or any public or private person takes advantage of the inadequacies in the principal act to endanger Nigeria’s cyber ecosystem. With the evolving cyber threat landscape, this amendment holds potential of safeguarding Nigeria from cyber threats and propel the authorities’ yearning for a safer and secured cyberspace in Nigeria.