International Telecommunication Union Support for Harmonization of the ICT Policies in Sub-Sahara Africa Name of presenter HIPSSA Project

2Summary Context Background Overview of Existing Legislation Comparative Law Analysis - Substantive Criminal Law - Criminal Procedural Law Conclusion and recommendations

31.Background Context – Development of model law on cybercrime Globalization has given rise to activities and transactions increasingly conducted via ICT and internet ICT applications - e-Government, e-Commerce, e-Education, e-Health and e-Environment, seen as enablers for development, as they provide efficient channel to deliver a wide range of basic services Challenges - attacks against information infrastructure and internet, and cyber threats (legal, technical, institutional) Risks - financial, economic, health, security, technical etc Need to protect information infrastructure and internet against cybercrime

4 1. Background 1.0 Legal measures – cybercrime legislation (as part of cybersecurity strategy) Internet borderless, challenges global, global solution needed Harmonization of legislation needed 2.0 SADC countries situation analysis as at February 2011: -countries with cybercrime laws, -countries with cybercrime laws under development - countries with cybercrime related laws 2.1 Countries with cybercrime laws: Botswana, Mauritius, South Africa, Zambia 2.2 Countries with cybercrime legislation under development/cybercrime related legislation: Angola, Democratic Republic of Congo, Lesotho, Madagascar, Malawi, Mozambique, Namibia, Swaziland, Seychelles, Tanzania, Zimbabwe

5

6

7 3.1 Comparative Law Analysis – Substantive Criminal Law Comparisons: 1.Substantive criminal law provisions – offence and acts constituting offence 2.Criminal procedural law - procedural instruments that enable law enforcement agencies to take necessary measures to identify offender and collect the evidence required for criminal proceedings 3.1.Substantive Criminal Law provisions - Comparative Law Analysis table Countries with specific cybercrime legislation or cybercrime legislation draft laws and cybercrime related legislation available as at February Similarities – 1.unauthorized access - Angola, Botswana, Mauritius, Namibia, Seychelles, Tanzania, Zambia 2.llegal interception – Angola, Botswana, Lesotho, Malawi, Mauritius, Mozambique, Namibia, South Africa, Swaziland, Tanzania, Zambia. Zimbabwe Interception of Communications Act no.6 of 2007 provides for telecom. Interception but does not provide for offence of illegal interception

8 3.1Comparative Law Analysis – Substantive Criminal Law Similarities –contd 3.Interfering with computer data – Angola, Act, Lesotho, Mauritius, Namibia, South Africa, Zambia 4.Interfering with computer systems – Angola, Botswana, Mauritius, Namibia, Zambia; no exceptions to liability Similarities – 5.Illegal devices – Angola, Botswana, Mauritius, Namibia S. Africa, Zambia 6.Disclosure of details of an investigation Botswana, S. Africa, Zambia 7.Failure to permit assistance – Botswana, S. Africa, Zambia 8.Computer related forgery - Angola, Madagascar, S. Africa, Zambia 9. Computer related fraud - Angola, Botswana, Mauritius, Madagascar, Namibia, S. Africa 10.Child pornography – Angola, Botswana, Madagascar 11.Lack of provisions on illegal remaining, data espionage, identity theft/crime

9

10 3.1Comparative Law Analysis – Substantive Criminal Law Differences -Offences 1a.Unauthorized access Terminology - - computer or computer systems –Botswana, Mauritius, Zambia; information system – S. Africa, Namibia 1.b. Best practice - Harmonization in line with global standards to improve international cooperation in the framework of cybercrime investigations and prosecution; 2a. Illegal interception - acts covered, intent, exceptions 2b. Best practice - Harmonization as in 1b.

11 3.1Comparative Law Analysis – Substantive Criminal Law Differences contd 3a. Interfering with computer data Acts covered – destruction, suppression, alteration, modification, rendering data meaningless, useless or ineffective, obstruction, interruption, interfering with lawful use, with intent – Botswana, Mauritius (knowingly, where as a result of the commission of an offence … the reliability of data is … otherwise impaired),Angola, Namibia – deterioration and degradation of data included, denying access to data to person entitled with intent – Botswana; South Africa, Zambia (interferes with data in a way which causes such data to be modified, destroyed or otherwise rendered ineffective ), Lesotho – restricted to interference with contents of telecom message; 3b. Best practice - Harmonization as in 1b.

3.1Comparative Law Analysis – Substantive Criminal Law Differences contd 4a. Interfering with computer systems - Acts covered, intent 4b. Best practice - Harmonization as in 1b. 5a.Illegal devices - Acts covered, intent 5b. Best practice - Harmonization as in 1b. 6a. Computer-related fraud - Acts covered, intent; Madagascar – details of acts covered in offence not provided. 6. Computer-related fraud 6b. Best practice - Harmonization as in 1b. 7a.Computer-related forgery - Acts covered, intent 7b. Best practice - Harmonization as in 1b. 12

3.1Comparative Law Analysis – Substantive Criminal Law Differences Contd 8a.Disclosure of details of an investigation - acts covered/permitted disclosure – 8b. Best practice - Harmonization as in 1b. 9a. Failure to permit assistance - Acts covered – non compliance with investigative order or notice under procedural provisions – Botswana; search and seizure - S. Africa, Zambia. 9b. Best practice - Harmonization as in 1b. 10a. Child pornography - Mauritius, S. Africa, Namibia not criminalized, Madagascar criminalized in Penal Code, Zambia criminalized in S.177A (1) Penal Code; 13

3.1Comparative Law Analysis – Substantive Criminal Law Differences Contd 10a. Child pornography Acts covered - production, publication, possession, access,, Botswana, Angola; Zambia provision applicable to generally; Botswana includes communication with under 18 year old to commit offence or prostitution /other sexual offence on child under Penal Code, or 16years for purpose of abduction, kidnapping, defilement under Penal Code; Madagascar – transmission or broadcast of pornographic material by any means -S.346 Definition of child – Botswana below 14 years, Zambia below 16 years (S.131 A Penal Code); Angola 18 years; Madagascar no definition, but minor below 15years imprisonment for offence 3-10years from 2-5years) 10b. Best practice - Harmonization as in 1b. 14

3.1Comparative Law Analysis – Substantive Criminal Law Differences contd 11a. Harassment using means of electronic communications Only criminalized by Angola – acts covered - to commission of fraud, sexual harassment, threats and coercion (Art.13 and Art.1). 11b Best practice – inclusion of provision harmonized as in 1b. 12a. Spam - Only criminalized by Zambia- acts covered - sending of unsolicited message over the internet for purposes of illegal trade or commerce or other illegal activity (S105 ECT Act). 12b. Best practice - inclusion of provision harmonized as in 1b. 13. Other differences Penalties (maximum) – Botswana P5000 and P , imprisonment of up to 5 years, Zambia penalty units to twenty-five years imprisonment, Mauritius and rupees to twenty years imprisonment, or to both penalties 15

3.1Comparative Law Analysis – Substantive Criminal Law 13. Other differences Penalties (maximum) – South Africa no minimum or maximum monetary and no minimum, custodial penalties, maximum imprisonment 5years, Namibia N$500,000 to5 years imprisonment, Angola – penalties to be applied as provided in the Criminal Code Eg - unauthorized access Botswana 1year, 6months if with intent to commit offence under another law, Mauritius 5years, 20yrs if with intent to commit offence, Zambia 2years, Angola 2yrs, 8yrs if through violation of safety measures, Seychelles 2years, Namibia 24 months; -Illegal interception – Angola 2years, Botswana 2years, Lesotho 6 months, Malawi 10years(fixed) Mauritius 10years, S. Africa 1year, Zambia 25years, -Child pornography – Angola 3yrs, 8years if minor under 14years, Botswana 3years, Madagascar 5years,10years if minor under fifteen years, Zambia life imprisonment (minimum 15years) 16

3.2 Comparative Law Analysis – Criminal Procedural Law 3.2.Criminal Procedural Law provisions - Comparative Law Analysis table Countries with specific cybercrime legislation, cybercrime legislation draft laws and cybercrime related laws available as at February, Similarities - Search and seizure order - Angola, Botswana, Mauritius, S. Africa, Swaziland, Zambia - Production order - Angola, Botswana, Mauritius, Zambia - Expedited Preservation of Computer data - Angola, Botswana, Mauritius - Real-time collection of traffic data – Angola, Botswana, Mauritius, - Lack of provisions on forensic software 17

18

3.2 Comparative Law Analysis – Criminal Procedural Law Differences Procedures for issuance/competent authorities – 1a. search and seizure - Swaziland provided for in S.46 Criminal Evidence and Procedure Act No. 67 of 1938; - procedure 1b. Best practice - Harmonization in line with global standards to improve international cooperation in the framework of cybercrime investigations and prosecution 2a. Production orders - procedure 2b. Best practice - Harmonization as in 1b. 3.a Expedited Preservation of Computer Data - procedure 3b Best practice - Harmonization as in 1b 4a. Real-time collection of traffic data - procedure 4b Best practice - Harmonization as in 1b. 19

4. Conclusion and Recommendations Of the fifteen benefitiary States, Botswana, Mauritius, South Africa and Zambia cybercrime legislation contain similar provisions to large extent, with some differences. Angola and Namibia laws still in draft form. Differences mainly centred on terminology, acts covered in offences, non-criminalisation of certain offences and or lack of provision for certain procedural instruments, and penalties; Differences including significant differences in penalties for offences of concern vis-avis effectiveness of deterrence provided for cybercrime and the need for removal of safe havens to would-be offenders; Harmonization in line with global standards to improve international cooperation in the framework of cybercrime investigations and prosecution recommended. 20

21 Thank you for your attention!

22

23