Computer Crimes and Cyber Security Bill a threat to human rights

Lerato Matheka

The reinstated Computer Crimes and Cyber Security Bill, may be hailed as an answer to many cybercrimes the government is worried about but it directly violates fundamental human rights protected by the constitution, the civil society sector has said.

The “assist” legislation according to the Minister of Communications Information and Technology, Nthati Moorosi, is an answer to information communications technology infrastructures and internet access that have grown rapidly.

“The government has a responsibility to ensure that its citizens are protected against cyber-attacks, and the enactment of the Computer Crime and Cybersecurity Bill is an effort by Lesotho to combat computer crime by putting in place the appropriate punishment for it thus ensuring cybersecurity,” Moorosi said.

She noted that the Bill complies with the Convention on Cybercrime (Budapest Convention) and the African Convention on Cyber Security and Personal Data Protection.

“The two Conventions require that member states enact cybercrime and cybersecurity legislation, therefore, the Bill provides for the designation and protection of critical information infrastructure,” Moorosi told parliament.

She, however, failed to mention violations of human rights enshrined in Lesotho’s Constitution or those embedded in the United Human Rights Charter which Lesotho is a signatory to and has also ratified.

Moorosi continued to tell the parliament that there is no statute which provides for the criminalisation of illegal activities committed through the use of electronic devices except for the Penal Code Act of 2012 and the Communications Act of 2012.

“The Penal Code only criminalises unlawful access to a computer or electronic storage devices owned by another person, while the Communications Act criminalises intentional damage of communications facilities belonging to another,” she said.

“There is a need for comprehensive legislation which adequately prevents computer and internet-related crimes and the Bill provides a list of offences committed through the misuse of electronic devices,” she added.

She further indicated that the Bill has provisions on procedural law which prescribe procedural standards relating to search, seizure, obligations to assist the investigating officers, production of information, preservation of data, collection and disclosure of data and the interception, and the use of forensic tools by law enforcement officers.

Civil society, on the other hand, insists that the Bill is a direct threat to human rights.

Human rights defender, Advocate Lepeli Moeketsi, in an interview with Newsday, said the Bill is a ‘trap’ targeting cyber users especially those with dissenting views and those who work on defending human rights.

“The Bill fails dismally to strike a balance between constitutionally protected civil liberties and the government’s interest in ‘national security’ and law enforcement. It introduces the use of forensic tools without paying attention to procedures that comply with the Constitution and international human rights standards to protecting civil liberties,” he said.

He added: “In its current state, the Bill gives unfettered and or arbitrary powers to the government agencies in policing cyberspace and if passed into law, the Bill will surely close down the already shrinking civic space as well as the media freedom.”

Lepeli added that the work of human rights defenders of holding the government accountable for human rights violations will be negatively impacted thus leading to a government that is not accountable to anyone for its excesses.

He noted that the Bill does not strengthen the right to access information.

“The purported criminalisation of publication of falsehoods opens a leeway for politicians to unnecessarily restrict freedom of expression as well as access to information,” he said.

“Media will be the first casualty. The Bill fails to provide necessary protection for whistle-blowers, instead, it criminalises their whistleblowing. It indirectly deters whistle-blowers and media from disclosing very crucial information which is in the public interest and essential for curbing corruption, amongst others,” Lepeli said.

Advocate Mokitimi TÅ¡osane, Public Interest Litigation and Human Rights Officer with the Transformation Resource Centre (TRC) told this paper earlier that constitutional democracy includes, among its highest purposes, the protection of the right to privacy and freedom of expression.

“It is with great concern that there is lurking in our midst, the Computer Crimes and Cybersecurity Bill. It has elements that justify overreach of enforcement of powers suffocating the very essence of a responsive democracy – freedom of expression and speech and the right to be free from intrusions and interference by the state and others deriving from the right to privacy.”

TÅ¡osane further explained that in the Bill, the government risks excluding the general public from the greater information society in this information era.

“The Bill encompasses sections meant to undermine and erode the right to privacy, freedom from arbitrary search and seizure of property, freedom of expression and access to information, and right to a fair trial,” he said.

“These provisions have the potential to shrink the civic, media, and political spaces,” he added.

Tšosane last month made a presentation before the African Commission on Human and People’s Rights and urged the ACHPR to encourage the Government of Lesotho to review and rework the Bill considering all comments received from all stakeholders including the public and private sector, as well as the legal profession, academia, and information security practitioners in line with section 20(a) of the constitution.

He said the government should also be made to ensure that the sections meant to undermine the right to privacy, freedom from arbitrary search and seizure of property, freedom of expression and access to information, and right to a fair trial are deleted entirely.

“It is also important to ensure that the Cyber Bill complies with the African Union Convention on Cyber Security and Personal Data Protection (Malabo
Convention),” Tšosane told the Commission.

He further urged the Commission to ensure that media is free and secure to ensure that media can play a role in promoting sustainable growth and regional integration.

As a member state of SADC, Lesotho started drafting the Bill in 2020 and first presented it to parliament in 2021 where it met a lot of reservations from the civil society organisations as well as the media among other sectors that petitioned the parliament.

The groups wanted certain sections altered and others removed the Bill as they argued that they violated the protections enshrined in the Constitution.

The Bill, according to Dr Makanatsa Makonese of the Advancing Rights in Southern Africa (ARISA), was adopted in line with the SADC Model on Computer Crime and Cybercrime.

Dr Makonese charged that the SADC Model itself needs an alternative to protect human rights because “there were no public or parliamentary consultations when it was adopted in 2014.”

She explained that the SADC Model on Computer Crime and Cybercrime is a guide for member states on what cybercrime should entail.

“It identifies offences that can be incorporated into national laws for combating of computer and cybercrimes, and offences including illegal access, interception, data interference, espionage, forgery, fraud, pornography, xenophobic material and disclosure of details of an investigation on cybercrimes.

Dr Makonese also pointed out that the law directly violates the right to freedom of expression, right to privacy, right to equal protection of the law and the right to freedom of assembly.

“The SADC Model law doesn’t provide mechanisms for the enjoyment and protection of freedom of expression and countries used this gap when transporting to law to impose provisions that limit this right,” she said.   

She stressed that the Lesotho Bill does not only impose harsh sentences, impacts democracy and governance, media freedom and digital rights, but infringes general free expression pointing at section 22 of the Bill.

She said: “This section is legitimate, but it must also be understood in the context of freedom of expression, and legitimate criticism in the context of politics and governance.”

Dr Makonese noted that while the SADC region is addressing the challenges of cybercrimes, human rights should not be “unnecessarily” infringed upon.

“Where the infringement of human rights happens, necessary or adequate safeguards should be in place to provide the requisite protection.

“It is important to prioritise cybersecurity and human rights because that automatically translates to a safe and secure cyberspace in which socio-economic and political engagement can thrive,” she said.

Bill directly violates the constitution

Tšosane indicated that while the popularity of cybercrimes is taking global centre stage, the Bill in itself threatens an important component of the right of access to the internet “which is the principle of ‘network neutrality’ or ‘net neutrality.”

“This essentially protects the freedom to access internet content, applications, services, and hardware according to individual choice. Additionally, there is a threat to privacy, and the right to a fair trial.”

The lawyer pointed out that the participation of all stakeholders in the law “making process” Section 20 of the Constitution – Lesotho’s democracy is characterized as both representative and
participatory the former includes participation through elected representatives and exercised through regular elections while the latter concept includes participating in, inter
alia, the law-making process.

“This would include, for example, individuals or groups making submissions. Consultation demands an engagement with the public to ascertain what the public wishes and demands so that the policy or law reflect those views.

“The right to political participation is further strengthened by inter-alia sections 14 and 15 of the constitution,” Tšosane explained.

He added that consultation would also ensure consistency with other laws.

“It is of great concern that the Bill will be running parallel with many other existing laws which include, but is not limited to, the Criminal Procedure and Evidence 1981, Police
Service Act 1998, National Security Service Act 1998, the Industrial Property Order 1989, Money Laundering and Proceeds of Crime Act 2008, Data Protection Act, 2011 and secondary legislations.”

He charged that there is no attempt to create synergies or attempt to amend existing laws to include the incoming cyber elements where they were lacking in existing statutes as Minister Moorosi pointed out lack of existing criminal laws.

Tšosane pointed out the “reverse onus” intentional and “without lawful excuse” Compelling witnesses to give evidence.

“Section 12(7) of the constitution states that “no person who is tried for a criminal offence shall be compelled to give evidence at the trial. Under our Criminal law, a person who is charged with a criminal offence is “presumed to be innocent until proven guilty”.

“The “presumption of innocence” is an important part of the foundation of the
judicial system. This is widely known as the fundamental principle or “golden thread” of our criminal law that is related to the burden of proof. Simply defined, the burden of proof describes the requirement that the Crown must provide sufficient evidence in court to convince the legal authority that their side of the case brought forward is conclusively proven to be true and accurate, thus, in terms of section 12(7) of the Bill, reverse onus is constitutionally prohibited in our jurisdiction.”

He noted that through the Bill, provisions that threaten/violate Freedom of Expression, Opinion and Speech leading to criminal defamation are embedded in Section 43 of the Bill.

It indicated that “a person who publishes information or data presented in a picture, text, symbol or any other form in a computer system knowing that such information or data is false, deceptive, misleading, or inaccurate, and with intent to threaten, abuse, insult, mislead or deceive the public, or conceals commission of such an offence, commits an offence and is liable, on conviction, to a fine not exceeding M500,000 or imprisonment for a term not exceeding five years or both.

“Section 43 has the effects of bringing back criminal defamation. In terms of the Constitutional Court ruling in Basildon Peta v. The Minister of Law and Constitutional Affairs and Human Rights and Others, CC/11/2016, criminal defamation is no longer part of our law,” he said.