South Sudan Enacts Cybercrimes & Computer Misuse Provisional Order 2021

South Sudan has enacted the Cybercrimes and Computer Misuse Provisional Order 2021, which is aimed at combating cybercrimes. The country has a fast-growing technology sector, with three mobile operators and 24 licensed internet service providers.  Accordingly, investments in infrastructure development have propelled internet penetration to 16.8 per cent and mobile phone penetration to 23 per cent of the country’s population of 11.3 million people, which necessitates a law to curb cybercrime.

The Provisional Order is based on Article 86(1) of the Transitional Constitution of South Sudan 2011, which provides that when parliament is not in session, the president can issue a provisional order that has the force of law in urgent matters.

The Cybercrimes and Computer Misuse Order makes strides in addressing cybercrimes by extending the scope of jurisdiction in prosecuting cybercrimes to cover offenses committed in or outside the country against citizens and the South Sudan state. The Order also establishes judicial oversight especially over the use of forensic tools to collect evidence, with section 10 requiring authorisation by a competent court prior to collecting such evidence. Furthermore, the Order attempts to protect children against child pornography (sections 23 and 24) and provides for the prevention of trafficking of persons (section 30) and drugs (section 31).

According to The Collaboration on International ICT Policy for East and Southern Africa (CIPESA), the Order is largely regressive of citizens’ rights including freedom of expression, access to information, and the right to privacy.

CIPESA indicates that the Order gives overly broad definitions including that of computer misuse, indecent content, and pornography, which are so ambiguous and wide in scope that they could be used by the state to target government opponents, dissidents, and critics. The definitions largely limit the use of electronic gadgets and curtail the exercise of freedom of expression and access to information.

Article 22 of the Transitional Constitution of South Sudan 2011 guarantees the right to privacy. The country has ratified the International Convention on Civil and Political Rights (ICCPR) that provides for the right to privacy under article 17 and the African Charter on Human and Peoples Rights, whose article 5 provides for the right to respect one’s dignity, which includes the right to privacy. The Order appears to contravene these instruments by threatening individual privacy.

Despite a commendable provision in section 6 imposing an obligation on service providers to store information relating to communications, including personal data and traffic data of subscribers, for 180 days – a period far shorter compared to other countries – personal data is still potentially at risk. The section requires service providers and their agents to put in place technical capabilities to enable law enforcement agencies to monitor compliance with the Order. With no specific data protection law in South Sudan and without making a commitment to the leading regional instrument, the African Union Convention on Cybersecurity and Personal Data Protection, the privacy of the citizens is at stake.

The section on offenses and penalties lacks specificity on fines that may be levied on errant individuals or companies. On the other hand, some of the offenses provided for under the Order potentially curtail freedom of expression and the right to information. For instance, the offense of spamming under section 21 could be interpreted to include all communications through online platforms including social media platforms like Facebook and WhatsApp. Under the provision, virtually all individuals who forward messages on social media stand the risk of prosecution. This also has a chilling effect on freedom of expression and the right to information.

The offense on offensive communication under section 25 potentially has a chilling effect on freedom of expression, media freedom, and access to information. A similar provision under section 25 of the Computer Misuse Act, 2011 of Uganda has been widely misused to persecute, prosecute and silence political critics and dissidents. Section 25 of the South Sudan Cybercrimes Order could be used in a similar manner to target government critics and dissidents. 

Analysis of the Order call for specific actions that could ensure the prevention of cybercrime while at the same time not hurting online rights and freedoms, including the deletion of problematic definitions or provisions from the Order as well as the enactment of a specific data protection law to guarantee the protection of data of individuals and urgent drafting of rules and regulations to prescribe the procedures for implementing the Order.

South Sudan human rights activists have in the past urged parliament to enact a law against cybercrime.

Reech Malual, the Executive Director of Screen of Rights, said South Sudanese in and outside the country are misusing social media platforms to advance hate and violence. The activist believes using security organs to address cyberbullying or defamation without a proper cyber law will not mitigate the problem. Globally, international nations consider bullying or cyberbullying a criminal act that may be addressed in a single law or with multiple laws. Cyberbullying is categorised under harassment, defamation, and or publishing intimate images without the consent of the source.

According to Reech Malual, some South Sudanese online users have always used their platforms to harass and intimidate others, especially those of the opposite sex. He said new research done by Screen of Rights has noted that bullying is a common practice by most male online users against women. “For example, you cannot call me a prostitute when I am not a prostitute, but a public figure and being just female,” he said.

Malual points out the only way to curb this social vice is to enact a law that will help track and punish those practicing hate speech both online and offline. “The government has a role to be able to have cyber law, to be able to control the content of what is being published on Facebook,” he said. According to Malual, women who have fallen victims to cyberbullying are mostly those who have advanced in their profession. He added that these negative online sentiments discourage female professionals from accepting jobs in public offices for fear of being accused of using sexual favors.