56 CYBER CRIME & CYBER SECURITY TRENDS IN AFRICA Observations • As only about 20% of States have the basic legal framework in place, the situation in Africa regarding legislation on cyber crime and electronic evidence is not satisfactory. On the positive side, it is encouraging that reforms are under underway in many States, even though in some cases, draft laws have been under discussion for several years with little progress. • A number of (draft) laws contain provisions that create risks to the freedom of expression and other fundamental rights, in particular where offences are vaguely defined and conditions and safeguards are weak or missing. Examples are the criminalisation of the “creation of sites with a view to disseminating ideas and programmes contrary to public order or morality”, “broadcasting information to mislead security forces”, “publication of false information” and similar. This not only affects the rights of individuals and restricts media freedoms but also undermines trust and hinders international and public/private cooperation.13 • Procedural law powers are not always precisely defined and safeguards may be lacking. For example, a law allows for orders to compel the production of content data without court order, or a police officer can carry out searches or seizures of computers without court order. This may be contrary to rule of law requirements, namely, that investigative powers that interfere with the rights of individuals must be prescribed precisely, be subject to guarantees against abuse, be necessary and proportionate and must allow for effective remedies. • On the other hand, data protection regulations are increasingly being adopted in African States, often in conjunction with laws on cyber crime. This creates additional safeguards to the rights of individuals. Mauritius, Morocco and Senegal are not only Parties or have been invited to accede to the Budapest Convention on Cyber Crime, but have also requested accession to the Data Protection Convention 108 of the Council of Europe.14 The African Union Convention on Cyber Security and Personal Data Protection of 2014 also contains an important chapter on the protection of personal data. • Joining an international treaty such as the Budapest Convention on Cyber Crime not only provides a legal framework for international cooperation but instills confidence and trust that such cooperation has a solid foundation in domestic law. This also applies to cooperation between criminal justice authorities and private sector service providers. Mauritius was one of the first countries of Africa to adopt comprehensive legislation on cyber crime in 2003, and in 2014 was the first African State to become a Party to the Budapest Convention on Cyber Crime. South Africa signed this treaty in 2001 and the additional Protocol on Xenophobia and Racism in 2008 but has not yet ratified these instruments. Morocco and Senegal have been invited to accede and it is expected that both will become Parties in the course of 2016. These countries participate in the Cyber Crime Convention Committee15 and are priority countries for capacity building. Several other African countries have expressed their political commitment to join and implement this Convention. • Limited capacities of law enforcement, prosecutors and the judiciary is the main impediment to an effective criminal justice response to cyber crime and other offences involving electronic evidence not only in Africa but in most countries around the world.16 The adoption of legislation by African States needs to be accompanied by capacity building programmes. The Council of Europe – often jointly with the European Union – is providing support to those African countries that have requested accession to the Budapest Convention, including in the training of criminal justice authorities.17 13 14 15 16 17 For analysis of the state of the protection of freedom of expression on the Internet in European countries see page 47 ff of http:// rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=0900001680646af8 http://www.coe.int/en/web/conventions/full-list/-/conventions/treaty/108 http://www.coe.int/en/web/cybercrime/tcy http://rm.coe.int/CoERMPublicCommonSearchServices/DisplayDCTMContent?documentId=09000016802fa3e6 See the GLACY and GLACY+ projects on Global Action on Cyber Crime. http://www.coe.int/en/web/cybercrime/capacity-buildingprogrammes