Zambia’s new cyber laws conundrum:
Balancing security needs with human rights concerns
Prof. Cephas Lumina
CYBERCRIME is a global issue, and its prevalence is increasing. The rapid growth of information and communication technologies has changed how people interact and do business. Recent data from DataReportal shows that in January of this year, there were 7.13 million internet users in Zambia, accounting for 33 percent of the estimated population of 21.6 million. Additionally, there were approximately 3.7 million active social media users, representing 17.1 percent of the population, with platforms like Facebook and WhatsApp being popular choices. Social media is also a key news source for many Zambians, with nearly a quarter of the population using it daily for news consumption. The youth in Zambia are increasingly using social media for activism, while businesses are leveraging the internet for branding and marketing. The government has also introduced various online services to streamline administrative processes.
The digital transformation of society has also created new opportunities for criminal activities and other harm. As critical services move online, there is a greater risk of technology being exploited for malicious purposes. Cybercrime, which includes activities like hacking, data breaches, and online fraud, poses a significant threat to individuals, businesses, and national security. In 2022, the Zambia Computer Incidence Response Team, established under the Cyber Security and Cyber Crimes Act of 2021, reported a total of 10,718,00 cyber-attacks from January to December 2021, with activities such as mobile money scams, social media account hijacking, and fraudulent online schemes leading to financial losses and data breaches.
Few would disagree that there is a noticeable increase in social media abuse in Zambia, including online harassment (involving unwanted and repetitive messages, threats, or abusive behaviour), cyberbullying (bullying a person using digital devices like phones, computers, or tablets, typically by sending intimidating or threatening messages), and sexting (involving sending or receiving sexually explicit images or videos online). Cyberbullying, in particular, has become a major concern globally, with cases in Zambia, South Africa, and other countries resulting in mental health issues, and even suicides among young people.
Therefore, cybercrime and cybersecurity legislation are essential to protect individuals, businesses, and the government from the growing threats in the digital environment. The primary goal of such laws is to protect personal data, critical infrastructure, and combat cyber threats that pose risks to national security, economic stability, and individual well-being. Additionally, cybersecurity and cybercrime laws play a crucial role in safeguarding personal data, maintaining the integrity of financial systems, and securing governmental and corporate networks.
However, it is important to recognize that cyber laws and cybercrime investigations can impact human rights, such as privacy, a fair trial, freedom of expression, and protection of property. Other rights that may be affected include non-discrimination, freedom of religion or belief, freedom of association, right to liberty, and the rights of the child. The vast amount of personal data collected by digital devices and online services can reveal sensitive information about individuals’ health, finances, relationships, and political views.
The Office of the United Nations High Commissioner for Human Rights (OHCHR) has raised concerns that some cybercrime laws have been used to restrict free expression by criminalizing online content related to extremism, terrorism, public morals, or hate speech. This can impede the work of civil society organizations that promote transparency, accountability, and human rights in democratic societies. The OHCHR emphasizes the importance of ensuring that cybercrime laws do not violate human rights, particularly freedom of expression and privacy, and cautions against using such laws to suppress legitimate human rights advocacy and dissent. Therefore, it is vital to incorporate adequate safeguards for human rights in cyber laws.
In Zambia, the recently enacted Cyber Security Act and Cyber Crimes Act have faced widespread criticism for their potential infringement on fundamental rights, concentration of power, and undermining of democratic processes. Concerns have been raised about the broad nature of the laws, lack of independent oversight, and potential for abuse, leading to calls for revisions and a stronger legal framework that upholds human rights. Critics argue that the laws, especially the Cyber Crimes Act, could be used to suppress dissent and restrict freedom of expression, as well as to prevent the dissemination of information critical of the government.
I will not delve into the various criticisms aimed at the Cyber Crimes Act and Cyber Security Act. Rather, my focus is on the insufficient safeguards for human rights in the new cyber laws. To begin with, I want to emphasize that most human rights, such as privacy and freedom of expression, are not absolute and can be restricted in specified circumstances. It is a fundamental principle of international human rights law that any restrictions must be clearly defined by law, necessary, and proportionate.
The legality principle mandates that any restriction on a right must be based on national legislation that is accessible and clear to individuals. The legislation must also include safeguards against arbitrary enforcement and limit the discretion of officials. The necessity principle requires that any restriction on a right must have a valid purpose and be limited to what is necessary to achieve that purpose. The proportionality principle dictates that any interference with a right must be proportionate to the legitimate aim, ensuring that no less restrictive measures are available and that the essence of the right is preserved. Procedural safeguards play a crucial role in determining the proportionality of a limitation on a right.
A major criticism of the new legislation is the vague and poorly drafted provisions, including those concerning “unauthorized disclosure” of information, which critics argue could potentially criminalize legitimate criticism of the government or investigative journalism. The provisions on “cyber terrorism,” which include “inciting or attempting to incite ethnic divisions among the people of the Republic,” have also been criticized for their ambiguity. These vague formulations leave room for broad interpretation and do not meet the standards of legality, necessity, and proportionality. The lack of clear definitions not only makes it difficult to determine criminal liability but also complicates the protection of individual rights by blurring the line between criminal behaviour and the lawful exercise of digital freedoms.
Ambiguous cybercrime laws can restrict freedom of expression by allowing authorities to target dissent and legitimate public discourse. Vague language in legislation may be misused to suppress political activists, journalists, and public figures under the guise of maintaining order or national security. When enforced without proper oversight, these laws can lead to self-censorship and reduced public discourse, ultimately eroding democratic values. Furthermore, unclear norms can give law enforcement excessive discretion and lead to inconsistent judicial interpretations.
An imprecise statutory framework also violates the principle of legal certainty, which underscores the need for clear and understandable legal rules. Legal certainty ensures that laws are clear and predictable, allowing individuals to understand what behaviour is allowed or prohibited and to adjust their actions accordingly. It also prevents arbitrary or discriminatory enforcement of the law. This principle is essential for upholding the rule of law, ensuring that citizens are not left uncertain about acceptable behaviour and that state power is exercised predictably.
Therefore, within the context of human rights, it is important to clearly define cybercrimes to ensure that the legislative framework does not criminalize everyday behaviours or restrict freedoms unnecessarily.
Another issue raised by the new legislation is the absence of independent bodies to oversee compliance, implementation, and enforcement practices. The Cyber Security Act creates the Zambia Cyber Security Agency under the Office of the President, tasked with implementing the Act “under the overall guidance of the President.” The Agency is granted extensive powers, including coordinating cybersecurity and cyber resilience efforts, identifying and safeguarding critical information and infrastructure, regulating cyber security service providers, and providing advice to the President on cyber security issues. This differs from the approach in countries like Kenya and Malawi, where oversight is entrusted to an independent statutory body.
The Act also maintains the Central Monitoring and Co-ordination Centre (CMCC) that was established under the now-repealed Cyber Security and Cyber Crime Act of 2021. The CMCC is to “be managed, controlled, and operated by the division responsible for Government communications,” but without the requirement to liaise with the Zambia Information and Communications Authority as previously mandated.
The centralized control of the Cyber Security Agency and CMCC raises concerns about accountability and the risk of political interference, deviating from international best practices that call for oversight by an independent body. Independent oversight is crucial for scrutinizing government actions, promoting transparency, and providing checks and balances to prevent potential abuses related to surveillance and data interception. To safeguard human rights, oversight must involve a variety of stakeholders, including government agencies with defined legal responsibilities, independent oversight bodies comprised of cybersecurity experts, human rights advocates, and representatives from the private sector and civil society. This comprehensive approach is essential for ensuring that cybersecurity measures align with international human rights standards and best practices.
In contrast to similar laws in other countries in the region, the new laws lack robust human rights and due process safeguards in their enforcement measures, leading to concerns about potential overreach in investigative and surveillance activities that could violate fundamental rights and freedoms. In Malawi, the Electronic Transactions and Cyber Security Act of 2016 establishes guiding principles for its implementation, including the promotion of freedom of communication over electronic networks with specific exceptions outlined in the Act, and the protection of consumer rights. Similarly, the Cyber Crime Act of 2020 in South Africa mandates the Minister of Police, in consultation with various authorities, to issue Standard Operating Procedures for investigating offences under the Act, after public consultation. These procedures emphasise principles such as upholding individuals’ right to privacy and other fundamental rights, ensuring that any infringement is justified in line with South African legislation, and guaranteeing that investigations and seizures of cyber items are proportionate to the scope of the criminal investigation. Zambia’s new cyber legislation could benefit from adopting similar guidelines to safeguard individuals’ rights during enforcement actions.
Human rights impact assessments are increasingly seen as important tools for identifying and mitigating potential adverse effects on fundamental rights and freedoms when formulating cybersecurity legislation. These assessments involve analysing proposed legal measures to determine their potential implications for privacy, expression, and due process before implementation. By conducting these assessments, policymakers can adjust legislation to protect individual freedoms and avoid excessive government intrusion. It is unclear if the government conducted a human rights impact assessment before proposing changes to cyber security laws. Given that human rights impact assessments can also be conducted after the enactment of legislation, the government needs to consider conducting such an assessment to ensure that the new cyber and other laws align with constitutional rights and international human rights standards.
Finally, the effectiveness of the new cyber laws hinges on finding a careful balance between security needs and safeguarding human rights. While it is essential to utilize advanced technology and legal mechanisms to combat cyber threats effectively, these measures must be implemented in a way that respects individual rights and freedoms. This involves incorporating procedural safeguards, independent oversight, and clear legal limits to prevent excessive government intrusion. The interplay between cyber laws and human rights necessitates thoughtful deliberation and adaptations to avoid disproportionate state measures. By striking a careful balance between security needs and human rights concerns, the Cyber Crime Act and Cyber Security Act could potentially pass constitutional muster.
