New Mali Cybercrime Law Potentially Problematic to Digital Rights

By Simone Toussi |

On December 5, 2019, the president of Mali promulgated Law n° 2019-056 on the Suppression of Cybercrime. Although timely and relevant, a number of provisions pose potential threats to privacy and freedom of expression online, especially in view of Mali’s democracy deficits and low press freedom ranking.

The new law, applies to “any offence committed by means of Information and Communication Technologies (ICT) in whole or part on the territory of Mali, to any offence committed in cyberspace and whose effects occur on the national territory” (article 2).  It is part of a legislative framework deemed necessary to support reforms in the technology sector, pursuant to the 2000  Mali Telecommunications Sector Policy Declaration.

From Privacy Breaches to Digital Authoritarianism

Mali’s Constitution provides for privacy of communications under Article 6 while the Personal Data Protection Act of 2013 under article 5 and the Telecommunications Act, 1999 in article 1 buttress the constitutional provision. Unfortunately, the cybercrime law conflicts with these existing right to privacy guarantees.

The Cybercrime Law in articles 74 to 78 authorises search of computers and seizure of data as part of criminal investigations. Moreover, under article 75, data may be copied and stored where “seizure of the medium seems inappropriate”. The law does not provide for how the copied data should be stored, processed or disposed of upon conclusion of investigations. This undermines the data protection principle laid down in article 7 of the  Personal Data Protection Act – that personal data must only be kept for a specified period and purpose.

Further, articles 83 to 86 suggest real-time surveillance through interception of communications. Service providers are required to cooperate with authorities, including through ensuring that they have in place the necessary technical means to facilitate interception of communications. These wide powers double as an addition to those given to authorities under article 4 of the Telecommunications Act. This article which states: “When public security or the defense of the territory of Mali so requires, the Government may, for a limited period, requisition all the telecommunications networks established in the territory of Mali, as well as the equipment connected to it and / or prohibit the provision of telecommunications service.” This article has in the past been evoked when the government ordered  social media disruptions in 2016 during public protests and more recently during the 2018 elections when it ordered an internet shutdown.

Furthermore, communications service providers are required to put in place mechanisms to monitor systems for potential illegal activity, with failure to inform authorities of illegal activities being punishable by a prison sentence of between six months and two years, a fine of Central African Francs (CFA) 500,000 to 2,000,000  (USD 830 to 3,318 ) or both (article 25).

Warnings for Freedom of Expression

Although Mali’s constitution guarantees freedom of expression and opinion (article 4), the Law on the Press Regime and Press Offences (2000) is vague as it does not explicitly guarantee freedom of the press or media pluralism, nor does it define press offences. It also does not contain any provisions on online media. This constitutes a vacuum preceding the law on the Suppression of Cybercrime which, for its part, contains provisions which directly affect freedom of expression and opinion.

Articles 20 and 21 of the new law punish threats and insults made through an information system, with penalties ranging from six months to 10 years imprisonment, a fine of CFA 1,000,000 to 10,000,000 CFA (USD 1,680 to 16,800), or both. Without a clear definition and detail of the constituent elements of ‘threat’ or ‘insult’, these provisions are open to interpretation that can hinder freedom of expression. This is all the more critical since these terms are also not defined by the law on the press regime and press offences, in its article 33 on incitement and article 38 on defamation.

Moreover, articles 55 and 56 condemn the “public dissemination” of “all printed matter, all writings, drawings, posters, engravings, paintings, photographs, films or stereotypes, matrices or photographic reproductions, emblems, all objects or images that do not tie with good morality.” The corresponding penalties range from six months to seven years imprisonment, a fine of CFA 500,000 to 10,000,000 (USD 840 to 16,800), or both.

Article 54 of the cybercrime law states that “press offenses, committed through information and communication technologies, with the exception of those committed by the press on the internet, are punishable by ordinary law”. Given that the Press Law does not include provisions for online press, it is unclear what the distinction is between press offences via ICT and press offences via the internet. Furthermore, there is a lack of precision on the determination as to whether an offense falls under the cybercrime law, ordinary law, or press law.

Article 23 provides for a fine of CFA 200,000 to 2,000,000 (USD 332 to 3,318), imprisonment of between six months and one year, or both, for fake reports of illegal activity or content online, “with the aim of obtaining its withdrawal or having it stopped by a public eCommunications service provider”. However, activities and contents considered as illegal are not defined by the law, and therefore subject to denunciation.

Way forward

The law is well intentioned in seeking to ensure safe and secure use of ICT in Mali. However, it comes into effect in a fragile context. Provisions relating to data processing as part of criminal investigations pose significant risk to personal data integrity, security and privacy. Further, the law places a huge burden on telecommunications intermediaries to track and monitor network activity, and holds these intermediaries liable for the actions of their clients. Provisions relating to online press offences are inconsistent with legislating the media in the age of digitalisation. The new law and existing related laws therefore require revisions to safeguard and uphold constitutional guarantees of freedom of expression and privacy, online and offline.

The International Conference on Cyberlaw, Cybercrime & Cybersecurity 2019

The event aims to examine and analyze the emerging Cyberlaw, Cybercrime and Cybersecurity trends of today’s times. The International Conference will be attended by various international delegates and speakers as also representatives from the national Diaspora representing the stakeholders in the digital ecosystem and alive web. These would include representatives from the Central Government & State Governments, various Ministries, Law Enforcement Agencies, Police, Business, Information Technology, Corporate Sector, Academicians, Scholars, Service Providers, International Organizations and distinguished thought leaders.
For more details on this event, please click here.

Cyber Security Symposium Africa (CSSA)

The Cyber Security Symposium Africa (CSSA) is aimed at bringing together those in the security sector to share knowledge and ideas, and identify possible collaborations.
For more details on the event, please click here.

Zambia Introduces Daily Tax on Internet Voice Calls

By Daniel Mwesigwa |
The government of Zambia is set to introduce a daily levy of 30 Ngwee (USD 0.03) on internet voice calls. In a press statement issued after a cabinet meeting on August 12, 2018, the government spokesperson said internet calls through platforms such as Viber, WhatsApp and Skype “threaten the telecommunications industry and jobs” in licenced telecom companies such as Zamtel, Airtel and MTN”.
Accordingly, the cabinet approved the issuance of a Statutory Instrument to “facilitate the  introduction of the tariff to be charged through mobile phone operators and internet providers.” In justifying the introduction of the levy, the government spokesperson cited research which showed that “80 percent of the citizens are using WhatsApp, skype, and Viber to make phone calls.”
The statement did not indicate when the statutory instrument would be introduced, or when the levy is anticipated to take effect. The new tax, according to reports quoting the communications minister, was expected to fetch USD 22 million annually.
The proposed levy adds to Zambia’s mixed record on ICT access and freedom of expression online. The Zambia Information & Communications Technology Authority (ZICTA) reports a mobile phone penetration rate of 81.9% and mobile internet penetration rate of 47.1%. However, mobile and internet proliferation is threatened by high costs of access, a digital divide between men and women and between rural and urban areas. Quality of service also remains poor as evidenced by the recent fines slapped by ZICTA on the three leading telecommunications service providers.  
The Media Institute of Southern Africa (MISA) Zambia Chapter and a collective of bloggers have expressed deep concern about the tariffs on internet calls. They asked government to shelve the plans to introduce the tariff and to instead undertake efforts to promote affordable internet access. They argued that the “underlying objective” of the tariff is to “stifle free expression of millions of Zambians who increasingly depend on online tools to communicate.” They added that it is a “threat to entrepreneurship and innovation as many youths and citizens are using internet platforms to advance their socio-economic activities.”
Meanwhile, the Zambian cabinet has also approved the introduction of the Cyber Security and Cyber Crimes Bill that will repeal and amend provisions of the Electronic Communications and Transactions Act No. 21 of 2009. The bill will purportedly “promote an increased cybersecurity posture, facilitate intelligence gathering, investigation, prosecution and judicial processes in respect of preventing and addressing cybercrimes, cyber terrorism and cyber warfare.”
In addition to facilitating the establishment of Zambia National Cyber Security Agency (ZNCSA), which is expected to serve as the “coordination centre for all matters related to cyber security at national and international levels”, the proposed law will also criminalise “computer-based offences and network-related crime in line with the Penal Code”. Furthermore, it will “provide for investigation and collection of evidence for computer and network related crime and also provide for the admission of electronic evidence for such offences” as well as “adequately deal with various crimes committed using social media platforms.”
Zambia’s move  becomes the latest in a string of steps taken by African governments to undermine internet access and affordability, and weaken the potential of the internet and related technologies to promote free expression, access to information and civic participation. In March 2018, Uganda’s communications regulator issued a directive requiring online content providers to register and pay an annual fee of USD 20. Shortly thereafter, in July 2018, social media taxes were introduced with users required to pay a daily levy of Uganda Shillings (UGX) 200 (USD 0.05) before regaining access to social media platforms which were blocked.
In neighbouring Tanzania, online content service providers and producers have to pay over USD 900 to register with the state for permission to maintain their platforms, according to new 2018 regulations. Meanwhile, in the Democratic Republic of Congo, in mid June, the ministry of communications issued a decree giving online media outlets a month to comply with new regulations or face harsh penalties.