2 The Cyber Security qnd Crine Act 2021

ACT Supplement to the Sierra Leone Gqzetre l/ol. CXLXII, No. 71 dated 25th November 2021 THE CYBERSECURIryANDCRIME ACT, 2O2I Being an Act to provide for the effective, unificd aad comprehensive legal, regulatory aod institutiooal fraDework for the prohibition, prevertion, detection, prosecution ard puDishment of cybercriBcs; preveolioo of tbe .busivc ute of computer system!; to provide for the estsblkhmetrt of structure! to promote cybersccurity ard c8p8.ity buildirg; to provide for the timely .nd .ffectiye collection ofelectronir evidence for the purpose of irvcstigalioD arld prosecution of cybercrime; to provide for th. protection of Critical National hformation Infrastructure arrd the protectioo of compute. systemg ard networks, electronic communicatiotrs, drta rnd computer programs, intellectusl property atrd priyacy rights to provide for fscilitstioo of internrtioml cooperaliol in dealing with cybe.crime Drtters and to provid€ for other relsted m8tters. tl Ex,lcrm by the President and Members ofParliament in this prese[t Parliament assembled. Date of commencement. @ 2 The Cyber Security qnd Crine Act 2021 PART I - PRELIMINARY lfiterpretation l. tn this Act, unless the contrary intention appea$ - "Attom€y General" means The Attorn€y-General and Minister of Justice established under the Constitution; "authorised person" means a member ofthe National Cyber Security Coordination Center or a person mandated by iL inyolv in the prohibition. prevention. elemination or combating ofComputer crimes and Cyier Securiry threats. "computer data" means any representation of facts, information or concepts in a form suitable for processing in a computer system, including a prcgtam suilabl€ to cause a computer system to perform a function; "computer data storage medium" means any device, physical or virtual, conlaining or designed to contain, or enabling or designed to enable storage ofdat4 whetber available in a single or distribuled forrn for use by a computer; "computer system" means any physical or virtual device, or any set of associated physical or virtual devices; or a group of interconnected or related devices, one or more ofwhich, pursuant to a prcgrrm, performs automatic processing of data at least one ofwhich use electronic, magnetic, optical or other technologr, to perform logical arithmetic storage and data or which perform control functions on physical or virf,ral devices including mobile devices and reference to a computer system includes a reference to part of a computer system; No.7 No. 7 The Cyber Security and Ctime -4ct 202r 3 "crime against humanity" includes any ofthe following acts committed as part of a widespread or systemal.ic attack directed against any civilian population, r ,ith knowledge of the attack: murders. extermination, enslavement, deportation or forcible transfer of population, imprisonment, torture rape, sexual slavery,, enforced prostitution, forced pregnancy, enforced sterilisation or any other form of sexual violence of comparable gravity, persecution agaiost an identifiable goup on political, racial, national, ethnic, cultural, religious or gender grounds, enforced disappearance of persons, the crime of apanhcid, other inhumane acts ofsimilar character intentionally causing great suffering or serious bodily or mental itliury; "Critical National Iniormation Infiastructure" means computer systems that are necessary for the continuous delivery ofessential services that Sierra Leone relies on. lhe loss or compromiie of rvhich will lead to a debilitating impact on- (a) the security, defence or intemational relations of Siena kone; O) the existence or identity of a confidential source of information relating to the enforcement ofthe criminal law; (c) the provision of services directly related to communications- infrastructure, banling and financial services, public utilities, public trarxportation or publickey infrastructure; or (d) the protection of public safety including system related to essential emergency services; 4 No. 7 The Cyber Security and Ctime Act 2021 "Cybemtalking" is when a person intentionally initiate communications or a cou.rse ofcoDduct directed at a specific person or persons with the intent to coerce, intimidate, harass, or cause emotional distress.; "Cybersquatting" means the acquisition ofa domain nafle over the intemet in bad faith to profit, mislead, destroy reputation, and deprive olhers f.om registering the same, if such a domatn is; O Similar, identical, or confirsingly similar to an existing hademark registered with the appropriate govemment agency at the time of the domain name registration; (r) Identical or in any way simitar with the name of a person other than the registrant, in case of a personal name; and (if Acquired without right or with intellectual property inter€sts in it; "data" means representations of information or of concepts that are being prepared or have been pfepared in a form suitable for use in a computer; "database" means digitally organized coliection ofdata for one or more purposes which allows easy access, management and update of data; "device" means any object orequipmentlhat has b€en des igned to do a padicularjob or whose mechanical or electrical workings are controlled or monitored by a microprocessor; "eleckonic communication'' means communicalions in electronic format, instant messages, short message No. 7 The Cyber Security ahd Crine Act 2021 5 service (SMS), e-mail, videq voicemails, multimedia message service (MMS), Fax" and pager; "enforcement officer" means an officer in a law enforcement agency trained in cyber security work designated or authorised to carryout functions including for the pu$roses of Part lV of this Act; "exfiadite" means the legal obligation ofstates under public intemational law to handover persons who commit intemational crimes to a foreign state for indictrnent, prosecution or imprisonment. "encrypted data" means data which has been transformed from its plain text version to an unintelligible format, regardless of the technique utilised for such transformation and irrespective of the medium in which such data occurs or can be found, for the purposes ofprotecting the content of such data; "false news" means incorrect deceptive information or propagand4 misinformation or hoaxes deliberately spread undcr the guise ofbeing authentic ne.xs via haditional print and broadcast news media or online social media witten and published with the intentto mislead for gains; "Financial Institution" means any individual, body, association or group of persons, whether corporate or unincolporated which carries on the business of inveshnent and securities, a discounthouse, finance company and money brokerage whose principal object includes factoring project financing equipment leasing, debt administration, fund management, private ledger services, investment management, local purchase order financin& export 6 No. 7 The Cyber Seeurity and Crime Act 2021 finance, project consultancy, financial consultancy, pension fund management, insurance institutions, debt factorization and conversion firms, dealer, clearirg and settlement companies, legal practitioners, hotels, casinos, bureau de change, supermarkets and such other businesses as the Central Bank or appropriate regulatory authorities may, from time to time, designate; "Financial Transaction" means a ransaction which in any way involves movement of funds by wire or other electronic means; involving one or more monetary instruments; or the transfer oftille to any real or personal property; "function" means logic, control, arithmetic, deletion, storage, retrieval and communication or telecommunication to or fiom, or within a computer; "genocide" means any ofthe following acts committed with intent to destroy in whole or in part, a national, ethnic, racial or religious group as such: killing members ofthe group, deliberately inflicting on the group conditions oflife calculated to bring about its physical destruction in u'hole or in part, imposing measures intendcd to prevent births within th€ group; forcibly transfening children ofthe group to another group; "identity theft" means the stealing of somebociy else personal identiling information and preteflds to be that person in order to commit fraud orto gain other financial benefits such as making unauthorised transactions or purchases. "interference" means any impairment to the confidentiality, integrity or availabiliq ofa computer system, or any program or data on a compuler slstem, No. 7 The Cyber Secrrity and Crime Act 2021 1 or any act in relation to a computer system which impairs the opcration of the computer system. program, or data; "law enforcement agencies" means any agency for the tirne being responsible for implementation and enforcement ofthe provisions of this Act; "Minister'' means the Minister responsible for lnformation and Communications; "modification" means in relation to a computer syst€r\ program or data, the alteration or modification with resp€ct to the contents of a computer system by the operation of a function of the computer system or any other computer if; (a) a program or data held in the computer system is altered or erased; (b) a program or data is added to its contents; or and any act which contributes towards causing such aheration or modification shall be deemed to have caused it; "password" means any data by which a computer service or a computer system is capable of being obtained or used; "person" includes a natual person, a corporation, company, parhership, hrm, association or societies; "Phishing" means the criminal and &audulent process (c) an act occurs which impairs the normal operation of a computer system, 8 No.7 l'he Cyber Secu|ity ahd Critne Act 2021 of acquiring or attempting to acquire sensitive information such as usemames, pilsswotds and credit card details, by masquerading as an authentic entity in an elechonic comnunication through emails, telephone or text message asking a user to change his or her password or reveal his or her identity so that such information can later be used to de&aud the user; "plain text" means original data before it has been transformed into an unintelligible format. "plain text version" means original data before it has been transformed into an unintelligible format. "pornography" means the representation in books, magirzines, photographs, films, and other media, telecommunication apparatus of scenes of sexual behavior that are erotic or lewd and are designed to arouse sexual interest; "premises" means land, buildings, movable structures, a physical or virtual space in which data is maintained, managed, backed up remotely and made available to usets over a network, vehicles, vessels or aircraft; "President" means the President of the Republic of Sierra Leone as established by the Constitution. "progmm or computer program" means computer data representing instructions or statements that, when executed in a computer system, catses the computer system to perform a f,rnction; "prosecute" means the legal obligation ofstates under public intemational law to prosecute persons who corunit intemational crimes where no other state has requested extradition; No.7 The Cyber Security and Ctirne Acl 2021 o "racist or xenophobic material" meirns any writt€n or printed material, any image or any other representation ofideas or theories, which advocates, promotes or incites hated, discrimination or violence against any individual or group of individuals, based on race, colour, descent or national or ethnic origin, as well as religion if used as a pretext for any of these factors. "Requested State" meaos a state being requested to provide legal assistance under the terms ofthis Act; "Requesting State" means a state requesting for legal assistance and may for the purposes of this Act include an intemational entity to which Sierra Leone is obligated: "service provider" means a public or private entity that provides to users of its services the means to communicate by use ofacomputer system including any other entity that processes or stotes computer data on behalfofthal entity or its users; "seize" with respect to a program or data be defined to include: (a) secure a computer system or part of it or a device; O) make and retain a digital image or secure a copy ofany program or data, including using an on-site equipment; (c) render the computer system inaccessible; (d) remove data in the accessed computer system; or (e) obtain output ofdata from a computer systeml l0 No. 7 The Cyber Secuity and Crime Act 2021 "Sexually explicit conduct" includes at leasl the following real or simulaled acts done with iotent to exploit a child- (a) sexual intercourse, including genital-genital, oral-genita[, anal-genital or oral-anal, involving a child, or behreen an adult and a child, ofthe same or opposite sex; (b) (c) (d) bestialityi masturbationi sadistic or masochistic abuse in a sexual contexq or (e) lascivious exhibition ofdre genitals ol the pubic area ofa child. It is not relevant wtiether the conduct depicted is real or simulated; "Spamming" means deliberate abuse of electronic messaging systems to ind iscrim in ate ly send unsolicited bulk messages to individuals and corporate organizations; "subscriber information" means any information contained in the form ofdata or any form lhat is held by a service provider, relating to subscribers of its services, other tlan traffic data or content data, by . which can be estabiished- (a) the O?e ofconmunication service used, the technical provisions taken thereto and the period ofservice; (b) the subscriber's identity, postal, geogmphic, electronic mail address, telephone and other No. 7 The Cyber Security dnd Crime Act 1l access number, billing and payment information available on the basis ofa service agreement or anangement: or (c) any other information on the site of an installation of communication equipment available on the basis ofa service agreement or anangement; "ftaffic data" means computer data relating to a communication by means of a computer system, generated by a computer system that formed a part in the chain of communication, indicating the communjcation's origin, destination, route, time, date, size, duration or the aype ofunderlying service; "unauthorised" means access of any kind, 1o a computer system, program or data, by a person who- (a) is not entitled to access that computer system, program or data; and (b) does not have or exceeds the level of authorisation consented to by the person entitled to grant such consent, for the particular kind or typre ofaccess with respect to that computer system, program or data: Provided that any act or access in exercise ofpowers under this Act shall not be deemed to be unauthorised. 202t l2 No.7 The Cyber Secuity dnd Crime Act 202, Establishment of the National Computer Sectllity lncidencc Rcsponse Coordination Centre PART IIADMINISTRATION AND COORDINAIION

Incidence Response Coordination Cenue responsible for managilg cyber security incindences in Sierra Leone, headed by the National Cyber Secwity Coordinator, who subject to the approval ofParliament shall be appointed by the President on the recommendation of the M inister (2) The Narional Cybersecurity Coordinator shall hold omce for a term of (5) yea$ and is eligible for reappointment for another term of (5) years only. (3) A person shall not be appointed National Cyber Security Coordinator unless that person has relavant knolvledge, qualification and expertise in either Computer Science, Information Technology, Cyber Security or lnformation Security and related matters of at least ( I 0) yearc and is a person of proven integriry (4) The National Cybersecurity Coordinator shall cease to hold office on any ofthe following grounds: (a) for his or her inability to perform the firnctions ofthe office by reason of infirmity of mind or body; (b) (c) (d) fo, proven misconduct; if he becomes bankrupt or insolvent; if he is convicted and sentenced for an offence involving fraud or dishonesty; (e) if he resigns his oflice by *ritten notice to the minister; or (0 at the expiration ofhis term ofofice Functions and 3. The National Computer Security lncidence Response Pow€,rs of the Coordination Center shall be responsible for cyber security issues Center. under thls Act mcludlng: No. 7 The Cyber Security and Crime Act 202t l3 (a) provision of support to computer systems and networks in preventing and combating cybercrime in Sierra t one; @) formulation and implementation of national cyber security policy and cyber security strategY; (c) overseeing of the numagement of computer forensic laboratories; (d) provision of support lo the Judiciary and other law enforcemetrt agencies in the discharge of their finctions in relation to cybercrime in Sierra Leone; (e) promotion of Sierra l-eone's involvement iu international cyber security cooperation; and (D doing such other acts or things that are trecessary for fie effective performance of the firnctions of the relevant security 8nd enforcement agencies under this Act.

Advisory Council comprising the Vice President as Chairman and the following other members- (a) the Minister of Finance; @) the Aaomey-General and Minister of Justice; (c) the Minister of Intemal Affairs; (O the Minister of Foreign Affairs and lntemational Cooperation ; (e) the National Secwity Coordinator, offce of National Security; Estrblishmenl of the N.tional Cyb€rsccurity AdYisory Council. 14 No. 7 The Cyber Sec-urity qnd Crime Act 2021 (0 the Director{eneral, Central lntelligence and Security Unit; (g) the ChiefofDefence Stafl Republic ofsiera Leone Armed Forces; (h) the lnspector-General, Sierra Leone Police; (i) the Dkector-General, National Telecommunications Commission; 0) the GoYemor, Bank ofSierra Leone; ft) the National Cyber Security Coordinator as Secretar.v (D the Director General Financial Intelligence Unit (m) the Minister of Information and Communications. (n) a barister and solicitor ofover l5 years post enrolinenl at the bar nominated by the Sierra Leone Bar Association, appointed by the President. (2) A membe ofthe Council shall cease to hold ofrice if- (a) he ceases to hold the office on the basis of which he became a member ofthe Council; or (b) the member listed in paragraph (n) ofclause 4 (l ) shall cease to hold offrce only for sAted misconduct or infirmity ofbody or mind for a temr of3 years which said term may where the President deems fit be renewed for a further tenn of 3 years without any further renewal. No.7 The Cyber Secltrity and C rne Act 202t t5 (3) The meeting ofthe Council shall be presided over by the Vice hesident and the Council shall rneet, at least, 4 times a year. 5, (1) The Council shall- Functions aod Powars of thc (a) provide strategic teadership, oversight ard council guidance on implemcntation and development of national cyber security legal framework in Sierra l-eone is order to ensure that- ([) Sierra Leone's cybercrime policies and laws are in conformity widr regional and intemational standards; (D there is maintenance of international coopention requircd for preventing and combating cybercrimes and promoting cybersecurity; and (iif effective prosecution of cybercrimes and cyber security matters. O) make rccommendation to Government on issues relatiDg to the prevention and combating ofcybercrime and the promotion of cyber security in Sierra Leone; (c) provide general policy guidelines for the implementation of this Acq and (d) promote the development of educaiional programs and research in cyber security defences, techniques and processes. (2) The Council shall have power to regulate its proceedings and make standing orders with respect to the holding of its meetings, notices to be given, the keeping of minutes of its proceedings and such others matters as Council may &om time to time determine. , l6 No, 7 The Cyber Security and Ctirne Act 2021 Eslabli shrner t of National Cyberse.urity Fund.

(l) There is established a ftmd which shall be known asthe National Cyber Security Fund. (2) There shall be paid and credited into the Fund established under subsection ( I ) and domiciled in the Cenhal Bank of Sierra kone - (a) grants-in-aid and assistance from donor, bilateral andmultilateral agencies; O) all other sums accruing to the Fund by way of gifts, endowments, bequests or other voluntary contributions by persons and organisations: Provided that the terms and conditions attached to such gifts, endowments, bequests or contributions will not jeopardize tbe ftrnctions ofthe Council; and (c) allocarion from the consolidated fund; (d) all other monies or assets that may, tom time to time accrue to the Fund. (3) An amount not exceeding 30 percent ofltre Fund may be allocated for programs relating to public education and awareness raising on cyber security issues. ( ) (i) The office of the National Computer Security Incidence Response Coordination Centre shall keep proper records ofthe accounts in a form approved by the Auditor General. (if The books of account kept under sub-section (4) (i) shall witlrin 3 months after the end ofeach financial year be audited by the Auditor General or an auditor appointed by him. (iD The financial yea shall be the same as the financial year ofthe Government. No. 7 The Cyber Security dnd Cime Act 2021 l7 (, (D The CounciJ shall, a:i soon as possible but not later than 6 months after the end ofeach financial year, submit to the Minist€r a report oflhe activities, operations, underrakings, properties and financies ofthe National Computer Security Incidence Response Coordination Center for that year, including the Auditor General's Report. Gi) The Minister shall within 30 days ofthe receipt of the report referred to in sub-section (sxi) lay a copy before Padiament PART III€RITICALNATTONAL INFORMATION INFRASTRUCTTJRE ?. (l) The Minister shall in consultation with the National Cybersecurity Council recomrnend to the President who may by Order published in the Cazette, designate certain computer systems, computer dala or traffic data vital !o Sierra Leone or any combination of those matters, a:r constituting Critical National lnformation In&astructure. (2) A Presidential Ordermade rmder subsection (l), shall prescribe minimum standards, guidelines, rules or procedures reasonably required in respect of- (a) the protection or preservation of Critical National ltrformation Infiastructure; (b) the general managemed ofcritical National Information lnfi astructure; (c) the implementation of critical information systems to ensure all systems are secured by default and system and user activities are logged to facilitate accurate and efiicient information systems operations audits. D.signation Of Criri.al National lnforlnatioo lnfrastructurc (d) access to, transfer and control of data in Critical National Information Infiastructurei I8 No.7 The Cyber &curity and Crime Act 2021 (e) infrastructural or procedural rules and requirements for securing the integrity and authenticity ofdata or information contained in any designated Critical National Infomntion Infrastructur€; O the storage or archiving of data ot informatibn designated as Critical National Information Infrastructure; (g) recovery plans in the event ofdisaster. bre3ch or loss of the Critical National Information IntasEucture or any part of it; and (h) any other matter required for the adequate protection, management and control ofdata and other resources in any Critical National lnformation ln&astructure. (i) raspect for and protection ofthe fundamental Aeedoms, including the right to privacy. E. A Presidential Order made under subsection ( I ) ofsection 7 may require the National Computer Security lncidence Response Team established under section (2) to audit and inspect any Critical National Information Infrastructure at atly time to ensure compliance with the provisions ofthis Act. PARI' IV - POWERS AND PROCEDLTRES

(l) Powers and procedures under this Act shall beapplicable to and may be exercised with respect to- (a) criminal offences under this Act; (b) criminal offences committed by means ofa comput€r system, including mobile phones atrd other electronic equipment under any other law; and Scope of Procedures. Audil and Inspcction of Critical National lnformation Irfrastructure. No.7 The Cyber Security and Crime Acl 2021 (c) the collection ofevidence in elechonic form of a criminal offence under this Act or arty other law. (2) In a trial of an offerce under any [aw, the fac.t that evidence has been generated, transmitted or seized from or identified in a search of a computer system, shall not of itself prevent thal evidence from being presented, relied upon or admitted provided that the cvidence has been properly obtained and preserved. (3) The powers and procedures provided under this Part are without prejudice to the operation of, or powers granted under the Criminal ProcedureAct, when exercised lawflrlly by any other law enforcement agency or service or any regulatory authorilv that by itself does not investigate or prosecute an offence. I 0. (l) Upon an application by an enforcement omcer or other authoris€d person to a Judge ofthe High Court that there is reasonable grounds to believe that ther€ may be in a specified computer system, program, data, computer data storage medium material specirying the basis ofthe beliefand the scope ofthe warrant requled \yhich- (a) may be reasonably required as evidence in proving a specifically identified offence in a criminal investigation or criminal proceedings; @) has been acquired by a person as a result of the commission ofan offence, the Judge may issue a warrant which shall authorise the enforcement officer or other authorised person, with such assistance as may be necessary, to access, seize or secure a specified computer system, program, dala or computer data storage medium. @) A warrant issued under subsection (l) shall authorize an enforcement omcer or other authorised person tG. S€.ich rnd Seiarre of Stored Computer I9 z) No. 7 T'he Cyber Searity and Cime Act 2021 (a) enter and search any premises or place if within those premises or place- (| an offence under this Act is being committed; or (! there is evidence ofthe commission of an offence rmder this Act; or (rii) there is an urgent need to prevent the commission ofan o$ence under this Act (b) search any person found on any premises or place which such authorised officers who are empowered to enter and search under paragraph (a) of subsection l; (c) stop, board and search where there is evidence of the commission of an offence under this Act; (d) seize or secure a computer system or part of it or a computer{ata storage medium; (e) make and rehin a copy ofcomputer data; (0 maintain the integrity of stored computer data; (g) render inaccessible or rernove computer data in the accessed computer system; (h) have access to, inspect and check the operation ofa computer E6tem to \yhich the warrant applies; (, haye access io any information, obtained from the encrypted data contained or available to I i No. 7 The Cyber Security and Crime Act 2021 21 a computersystem into an intelligible formal for the purposes of the warranq O require a person possessing knowledge about the finctioning of a computer system or measures applied to protect a computer data therein, to provide the necessary computer data or information, to enable an enforcement officer or other authorised person in conducting an activity authorised under this section; (k) have access to such reasonable technical and other assistance as he may require for the purposes of the warrant. O require any person having charge of or otherwise concemed with the operation of any computer or electronic device in connectioo with an offence under this Actto produce such eomputer or electonic deyice. (3) An application under subsection (l) shall provide reasons explaining why it is believed that- (a) the material sought will be found on the premises to be searched; or (b) the purpose of an investigation search may be frustrated or seriously prejudiced unless an investigating officer arriving at the premises can secure immediale enfy to them, (4) The court may issue a warant under subsection (2) of this section where it is satisfied that- (a) th€ warrant is sought to preveDt the commission of an offence under this Act or D, No. 7 The Cyber Security and Crime .4ct 2021 to prevent the interference with inyestigadye process under this Actl or (b) the warrant is for the purpose ofinvestigating cybercrime, cyber security breach, computer related offences or obtaining eiectronic evidence; or (c) there are reasons for believing that the person or material on the premises may be relevant to the cyber crime or computer related offences under investigation; or (d) there are reasons to believe that the person named in the warant is preparing to commit an offence under this Act. Provided that any such wanart is issued access shall be witlrout prejudice to $e rights to privacy of persons and may be rescinded upon an application by a person affected to a Judge of the High Court. (5) Where an enforcement officer or other authorised person (s) authorised to search or access a specific computer system or part of it has reasonable grounds to believe that the data sought is stored in another cloud computer system and there is reasonable grounds to believe that such data is accessible from or available to the initialsystern, the enforcement o{ficer or other authorised person may extend the search or accessing to such other system or systems. (O Computer data seized under subsectio, (2) shall only be lawfully used for the purpose for which itwas orig,nally obtained- (7) An enforcement officer or other authorised person (a) only seize a computer system under subsection (2) when it isshall- No. 7 The Cyber Securit, and Crtde Act 2021 ?3 (D not practical to secure the computer data: or (ii) necessary to ens[e that data will not be dcstroyed, altered or otherwise interfered with; O) exercise ressonable care while the computer system or computer data storage medium is retained. (8) An enforcement olficer or other authorised person who intentionally, recklessly or neglige tly misuses the powers granted under this section commits an offence and is liable on conviction to a fine not less than Le 1 0,000,000 and not more than Le 50,000,000 or to a term of imprisonment not less than I year and not more than 5 years or to both such fine and imprisonment. (9) .A person rvho willfully obslructs an enforcement officer or other authorised person inthe lawful exercise ofthe powers under this section commits an offence and is liable on bonviction to a finenotless than Le5,000,000 andnot more than Le30,000,000 orto a term of impriso.ment not less than 6 months and not more than 3 years or to both such fine ard imprisonment and in the case of a corporation, partnership or association to a fine not less than Le 50,000,000 and not more than Le t 00,000,000. (a) make a list of what has been seized or rendered inaccessible, with the date and tirne of seizure; and 11, (l) Where a computer system or data has been removed Record oland or rendered inaccessible, following a search or seizure, the person 1"f... to who made the search or seiztre shall. at the time of the .""."h o, s"i^o o"' seizure or as soon as practicable after the search - (b) give a copy ofthat list to - 24 No. 7 The Cyber Securily and Crirne Acl 2tizl Q the occupier ofthe premises; or (if the person in control of the conputer system. (2) Subject to subsection (3), an enforcement officer or other aulhorised person shall, on request, permit a person- (a) who has custody or control of a computer system, (b) who has right to data or information seized under subsection (2) ofsection l0l or (c) acting on behalf of a person under subparagraph (a) or (b), to access and copy computer data on the system orgive strch person a copy of the computer data. (3) An enforcement omcer or other authorised person may refuse to give access or provide copies seized under subsection (2) if he has reasonable grounds to believe that giving access or providing copies would- (a) constitute a criminal offence; or (t) prejudice- O an inYestigation; or (i, any prosecution:- (4) Notwithstanding sutrsection (3), a Judge ofthe High Court may, upon sufficient and reasonable grormds, allow a person under sub paragraph (a), (b) or (c) to access or copy computer data- No. 7 The Cyber Secrtity and C me Act 2021 25 (5) The National Computer Security lncidence Response Team shall develop staudards, policies, procedures and guidelines to be used in the implementation ofthis Act subject to the approval ofthe National Cyber Secudty Advisory Council in respect o[: (a) the warant request processl O) the Focess of collecting and handling evidence; (c) (o G) (0 chain of custody ofevidence collected; processes related to device collection; processes related to email collectioni the storage and inventory of data or evidence collected; (g) the process of examining evidencb; (h) the analysis ofdata and evidence collected; and (i) evidencereporting.

(l) Where it is necessary or desirable for the purposes producrionofan investigation under this Act, a Judge ofthe High Court may Order. upon an application by an enforcement officer or other authorised person, order- (a) a person in possession or control of specified data stored in a computer system oI a computer data storage medium; or (b) a service provider in possession or control of specihed subscriber information relating to services offered - No. 7 The Cyber Secllrily ahd Crime Act 2021 O in Sierra [€one; or (D based outside Sien-d Leone but, offering is services in Sierra [rone; to submit information in his possession or control. (2) A Judge of the High Cout may, by order, requirc a person- (a) to whom an order is made under subsection (l),or O) in control ofa computer system, to whom a warant is issued under subsection (l) of section l0; to keep such order or \yarrant confidential (3) A person who fails to comply with an order under subsection (l) commits an offence and is liable on conviction to a fine not less than Le 5,000,000 and not more than Le 30,000.000 orto a term of imprisonment not less than 6 months and not more than 3 years or to both such fine and imprisonment and for a corporation partnership or associationnot less than Le 100,000,000 and not more $an Le250,000,000. (4) An enforcement officer or other authorised person who uses the powers granted under subsection (1) for a purpose other than that stated in section 10 commits an offence and is liable on conviction to a fine not less than Le 10,000,000 and not more than Le 50,000,000 or to a term of imprisonment not less than I year and not more than 5 years or to both such fine and imprisonment. (5) An application under subsection (l) shall state the reasons explaining why it is believed that- No.7 The Cyber Secwity dhd Clime ict 2021 n (a) a specified computer data sought is likely to be available with a person mentioned in subparagraph (a) or (b) ofsubsection ( 1); (b) an investigation may be frustrated or seriously prejudiced unless the specified computer data or the subscriber information, as the ca-se may be, is produced; (c) the type of evidence suspected is likely to be produced by a person mentioned in subparagraph (a) or (b) ofsubsection (l); (d) subscribers, users or unique identifiers who ar€ the subject of an investigation or prosecution, may be disclosed as a result of the production of the specified computer data; (e) an identified offence is an offence in respect ofwhich the order is sought; (0 measures taken shall prepare and ensure that the spec ified computer data ivi ll be ptoduced- (i) whilst maintaining the privacy ofother users, customers and third parties; and (ii) without the disclosure of dats of any party who is not part of the investigation; and G) measures taken shall prepare and ensure that the produaion ofthe specified computer data is carried out tkough technical means such as mirroring or copying ofrelevant data and not through physical custody of computer systems or deYices. a No. ? The Cyber Secwity and Cti e lcl 2021 Expedited Prctervation end Partial Disclosure of Traftlc Data. (O Notwithstanding the provision of sub-section (1) above, a service provider or a person in possession or conffol of relevant specified data shall have the right to apply to the Judge of the High Cout to challenge the issuance ofaproduction order issued under this section on the ground ofrelevance, privilege, capacity to implement provisions of the order or otherwise protected from disclosure by law, or non-satisfaction of the requirements in subsection (5) of this Section. 13, (l) An enforcement omcer or otler authorised person may, \vhere he is satisfied that- (a) a specified computer data stored in a computer system or computer data storage medium is reasonably required for the purposes ofa criminal investigation: and (b) there is a risk or vulnerability that the computer data may be modified, lost, destroyed or rendered inaccessible, by u,ritten notice given to a person in possession or control of the computer system or computer data storage medium, require that person to undertake expeditious preservation ofthe conputer data. Q) A notice under subsection (l) may require a person in possession or conEol of the computer system or conlputer data storage medium to disclose sufficient traffic data about the communication to identify- (a) the service providers; and (b) the path though which the communication was transmitted. (3) The period of preservation of data required under subsection (l ) shall be for a period not exceeding 30 days. No.7 The Cyber Securiry and Crime Act 2021 D (4) The period ofpreservation of data under subsection (3 ) may be extended by a Judge ofthe High Court for a fifther specified period oftime, on an application by an enforcement officer or other authorised person, where such extension is reasonably required for the purposes of- (a) an investigation or prosecution: (b) avoiding a risk or vulnerability that the computer data may be modified, Iost, deskoyed or rendered inaccessible; or (c) averting overly burdensome cost of such preservation on the person in control of the computer system. (5) given shall- A person to whom a notice under subsection (l) is (a) be respcnsible to preserve the data for - @ a period not exceeding 30 days as specified in subsection (3); or (ii) any extended period permitted by a Judge of the High Court und€r subsection (4). (b) respond expeditiously to requests for assistance, whether to fucilitate requests for police assistance or mutual assistance requests, and (c) disclose {u soon as practicable, a sufficienl amount ofthe nonrontent data to enable an enforcement officer or other authorised person to identiry any other telecommunications providers involved in the Eansmission of the communication. 30 No. ? The Cyber Secuity and Crihe Act ).021 Real-Ti e Collection of rraffic Data.

(l) Where there are reasonable grounds to believe thattaffic data associated with specified communications is reasonably required for the purposes ofa specific criminal investigation, a Judge ofthe High Court may, on an application by an enforcement officer or other authorised person, order a service provider rvith the capacitv to monitor, coliect and record to- (a) collecr or record traffic data in real-time;and (b) provide specified taffic data to an enforcement officer or other authorised person. (2) An Order for the real-time collection or recording of tramc data under sub-section (l) shall not be for a period beyond what is absolutely necessary and in any event for not more than 30 days. (3) A period ofreal-time collection orrecording ofrailic data under subsectioo (2) may be extended by a Judge of the High Court for a further reasonable specihed period oftime the same to be for an additional period of 30 days, on an application by an enforcement officer or other authorised pcrson, where the extension is reasonably required for the purposes of- (a) an investigation ol prosecution; (b) further real-tlme collection or recording of tramc data necessary to achieve the purpose for which the Order under sub-section (l) was made; (c) ensuring that the real-time collection or recording oftramc data is caried out whilst maintaining the privacy of other users, customers and third parties and lvithout the disclosure of information and data of any party not part of the investigation; No, 7 The Cyber Security and Cride Act 2021 lr (d) preventing the investigation of being frustrated or seriously prejudiced; and (e) averting overly burdensome cost of such extension on the person in tontrol of the computer system. (4) An application under subsection (l) shall state reasons explaining why it is believed that- (a) a traffic data sought will be available with the person in contol ofthe computer system; (b) atype oftrafiic data suspected will be found on that computer system; (c) the subject ofan investigation or prosecution may be found on that computer system; (d) an identified offence is an offence in respect of which the order is sought; (e) measures shall be taken to maintain the privacy of other users, customers and third parties; and (f) there will be no disclosure of data of any party not part ofthe invcstigation. (5) A Judge ofthe High Court may also require a seruice provider to keep confidential, an Order under subsection (l) and a \ ?rrant issued under subsection ( I ) of section I 0 . (6) A service provider who without reasonable excuse fails to comply with an Order under subsection (l) commits an offence and is liable on conviction to a fine not less than Le 100,000,000 and not mor€ han L€ 5,000,000,000. 9 No. 7 The Cyber Secutity arld Crime Act 2A2t lnterccption of content

(l) Where there are reasonable grounds to believe thatthe content ofa specifically identified electronic communications is reasonably required for the purposes of a specific investigation in respect ofa felonious offence, a Judge ofthe High Cout may, on an application by an enforcement ofiicer or other authoris€d person, order a service provider to- (a) collect or record; or (b) co-operate and assist a competent aulhority in the collection or recording of, content data of specified communication within the jurisdiction transmitted by means ofa computer system, in real time. (2) Aa Order for the real-time collection or recording of content data under sub-section (l) shall not be for a period beyond what is absolutely necessary and in any event not more than 30 days (3) An application under subsection (1) shall state reasons explaining why it is believed that - (a) L\e content data sought will be available with the person in controI ofthe computer system; (b) the R?e of content data suspected will be found on a computer system; (c) an identitied offence is lhe offence for which the warranl is sought; (d) funher disclosures are4eeded to achieve the purpose for which the \ "rrant is to be issued, where authority to seek real-time collection or recording on more than one occasion is needed; No. 7 The Cybet Securjty ahd Crime Act 2021 33 (e) measures taken shall be guided by regulations made pursuant to this Act which shall eusure that the real-time collection or recording is carried out whilst maintaining the p yacy of other users, customers and third parties without the disclosure of information and data of any party not part of the investigation; (0 the investigation may be frusftated or seriously prejudiced unless the real time collection or recording is permitted; (g) to achieve the purpose for which the warrant is being applied, real.time collection or recording by a person in control of a computer system is necessary; and (h) adequate provision is made to ensure the safe storage and protection of the content data obtained and be used solely for matters relating to iovestigations. (4) A period ofreal-time collection or recording ofcontent data under subsection (3) may be extended by a Judge ofthe High Court for a further reasonable specified period oftime the same to be for an additional period not more than 30 days, on an application by an enforcement ofTicer or other authorised person, where the extension is reasonably required for the purposes of- (a) an investigation or prosecution; (b) achieving the objective for which the warrant is to be issued; (c) ensuring that the real-time collection or recording ofcontent data is carri€d out l,hilst i4 No. 7 The Cyber Security and Crine Act 2021 Confidentiality and Limitation of Liability. maintaining the privacy of other users, customers and third parties and withoul the disclosure of information and data of any parr)* not pan of the investigation; (d) preventing an investigation from being frustrated or seriously prejudiced; and (e) averting overly burdensome cost ofsuch realtime recording and collection on the person in control ofthe computer system. (5) A Judge ofthe High Court may also require a service provider to keep confidential, an order made under subsection (l) and a warrant issued under subsection ( t ) of section 10. (6) The service provider shall have express right to challenge an order regarding the collection ofreal time content data where there is non-compliance with the provisions of,the Act by filling an application to a Judge ofthe High Court. (7) A sewice provider who fails to comply rvith an order under subsection (1) commits an offence and is liable on conviction to a fine not less than Le I00,000,000 and not more than Le 5,000,000,000.

(l) A service provider shall not be subject to civil orcriminal liabilitl arising in connection with its compliance with its obligation, unless it is established that the service provider- (a) had actual notice, actual knowledge or willful aad malicious intent and not merely through omission or Ailure to act; or O) had facilitated, aided-€r abened the use by any person of a computer system controlled or managed by the service provider in contavention ofthis Act or any other law. @) A service provider shall not be liable underthis Act or any other law for- No. 7 The Cyber Security and Crime Act 2021 JJ (a) maintaining and making his services avaiiable; or (b) the disclosure of any data or other information to the extent required or in complianc€ with the exercise ofpowen under this Act. f7. (l) The High Court shali have jurisdiction ov€r any Territorill violation of this Act, including any violation committed by a Sierra jurisdiction Leone national regardless ofthe place of commission. (2) The Juridiction ofthe High Court urder subsection ( l), shall lie if an offence under this Act was committed - (a) wirhin Siena L,eone; (b) with the use ofa computer system wholly or partly situated in Siena Leone; or (c) when by such commission, damage is caused to a natural or juridical person who, at the time the offence was committed" was in Sierra Leone.

Subj ect to the powers of the Attomey-General and Ministerof Justicg law enforcement agencies shall haye power to prosecute offences under this Act. ln lhe case of offences cornmitted under section 24 and 26 of this Acq the approval of the Attomey-General must be obtained before prosecution.

(l) The Court in imposing sentence on any personconvicted ofan offence under thisAct, may order that the convicted person forfeits to the Republic ofSien-a Leone- (a) any asset, money or property, whether tangible or intangible, traceable to proceeds of such offence; and (b) any computer, equipment, software, electronic device or any other device used or intended to be used to commit or to facilitate the commission ofsuch offence; Paoseculion of Exrraditable offcnces. Fodeilure to the State. s No. 7 The Cyber Secu ty aad Ctirne -4ct 202t Rcstitution Spontsncous disclosore of information. (2) Where it is established that a convicted person has assets or properties in a foreign country, acquired as a result ofsuch criminal activities listed in this Act, such assets or properties, shall subject to any Treaty or arangement with such foreign country, be forfeited to the Republic of Sierra Leone. (3) The Attomey-General and Minister of Justice shall ensure that lhe forfeited assets or properti6 are effectively transferred and yested in the Republic ofSierra L€one. (4) Any person convicted of an offence under this Act shall have his passport withheld and only retumed to him after he has served the sentence or paid the fines imposed on him. 20, In addition to any other penalty prescribed under this Act, the Court may order a person convicted ofan offence under this Act to make restitution to the victim of the false presence or fraud by directing that the person - (a) where the property involved is money, pay to the victim an anoulrt equivalent to the loss sustained; in any other case to- (i) retum the properry to the victim or to a person designated by him; or (ii) pay an amount equal to the value ofthe property, where the return of the property is impossible or impracticable. ft) an order of restitution may be enforced by the victim or by the prosecutor on behalfof the victim in the same manner as ajudgment in acivil action. PART V. NTERNATIONAL COOPERATION

(l) The Attomey-General may, subject to this Act andwithout pdor request, forwad to a forcign state, information obtained under this Act, where he considers that the disclosure of such infonffdion may- No, 7 The Cyber Securily a d Crime Ac, 2021 37 (a) assist the foreign stebe in initiating or carying out an investigation or prosecution; or O) lead to a request for cooperation by a foreign state. provided that such foreign state shall have or undertake to effect mutual exchange ofinformation with Sierra Leone in such manner as shall be agreed upon between the authorised personnel of sucb foreign state and the Attorney-General subject to the approval of Parliament @) Infonnation provided under subsection (l), may be subject to such conditions including confidentiality, as the Attorney- General may require. (3) Where a foreign state cannot comply with conditions required under subsection (2), it shall notiry the Attorney-General, who shall determine whether the information should nevertheless be provided and where the foreign state accepts the information subject to the conditions, it shall be bound by them. O) collecting electlonic evidence related to an offence punishable under the laws ofSierra Leone. (2) TheAttom€yceneral shall communicate dircctly wittr the appropriate authority ofa foreign state responsible for sending, answering, executing or transmining requests for mutual assistance or extradition. (3) Notwithstanding subsection (2), in case of urgency, requests may be seot directly fiom judicial authority to judicial authority, provided that the appropriate authority of the requested state is notified by the appropriate authority ofthe requesting state-

(l) TheAttomey4eneral may cooperate with any foreigr Powers ofstate or international agency for the purpose of- f,io.r"r- Ceneral. (a) investiga(ng or prosecuting offences under this Act; or 38 No, 7 The Cyber Security qnd Crime Act 2021 Authority to make and act on mutual assistance r€qu€sts. (4) For urgent request or communication, the lntemational Police Organisation networt may be used. 23, (l) The Attorney{eneral may make requests on behalf of Sierra Leone to a foreign state for mutual assistance in an investigation comrnenced or prosecution instituted in Sierra Leone, relatbg to a computer relaled offence or collection of electronic evidence. (2) The Attomey-General may, in respect ofa request from a foreign state for mutual assistance il an investigation conrmenced or prosecution instituted in that state - (a) grant the request, in \yhole or in part, on such terms and conditions as may be deemed necessary; (b) refuse tie request on such conditions as he deems necessary; or (c) postpone a request, in whole or in part, after consulting with the appropriate authority of the foreign state, on the ground that grEnting the request would be likely to prejudice the conduct of an investigation or prosecution in Sierra Leone. (3) Mutual assistance requests under this section shall b€ effectuated- (a) in accordance wift the procedues specified by a foreign state, except where it is incompatible with the laws of Sierra kone; or (b) where the conduct alleged does not constitute a $ime in both the foreign state and h Sierra Leone. No. 7 Tlu Cyber Security and Crime Act 2021 39 (4) TbeAttomey4eneral shatl, where appropriate, b€fore refusing or postponing assistance, after having consulted with the foreign state, consider whether the request may b€ granted pafiially or subject to such conditions, as he deems necessary. (, The Attomey-General shall promptly inform a foreign state of- (a) the outcome ofthe execution ofa request for mutual assistance; (b) any reason that renders impossible, the execution of a request for mutual assistance or is likely to delay it significantly; or (c) any reason for reflrsal or postponement ofa request for mutual assistatrce. (Q A foreign state may request that Sierra Leone keeps conndential the frct of any request for mutual assistance, except to the extent necessary for its execution and if Siena lrone carmol comply with the request for confidentiality, it shall promptly inform the foreign state, which shall then determine whether the request sbould nevertheless be executed.

No- I I of 1974) which makes provision for the exlradition ofpersons accused or convicted ofan offence in another country. (2) Extradition shall Dot be requested for an offence unless it is an offence in both the foreign state and in Siera Leone. (3) An offence under this Act shall be extraditable if tle penalty imposed is imprisonment for a term ofnot less than one year or a fme equivalent to the peoalty of one year imprisonment. (4) Extradition will be subject to the conditions provided for by the law of the foreign state or applicable extradition treaties, including the grounds on which tbe foreign state may reiuse exradition. 40 No,7 The Cyber SecLrity and Ctime Act 2021 confidenxalrty 25. Where there is no muhral assistance teaty or arangement :lo"l:tnn"" in force between a forcign state and Sierra Leone, Sierra Leone shall make the supply ofinformation in response to a request on condition that it is- (5) In line with the extradition or prosecution principle, where extradition is refused on the sole basis of- (a) the nationality of the person sought to be extradiled; or O) Sierra Leone having jurisdiction over tbe offence, the investigation or prosecution shall be conducted and the matter reported to the foreign state. (a) kept confidential; or (b) used only for investigations or prosec[tions stated in the request.

(l) A foreign state may request or obtain the expeditiouspreservation ofdata stored by means ofa computer system, located within Sierra kone, in respect ofwhich it intends to submit a request for mutual assistance, for the search, access. seizure, security or disclosure of the data. (2) A request for preservation of data submitted under subsection (l) shall speci$ the- (a) authority seeking the preservation of data; (b) offence that is the subject ofan investigation or prosecution, including a brief summary of the related facts; Expedited preservation of stored computer date. No. 7 The Cyber Security and Crtme Act 202r 4t (c) stored computer data to be pr€served and its relationship to the offenc€; (d) available information identifying the custodian ofthe stored computer data or the location of the computer system; (e) necessity ofthe preservation of data; and (0 intention to submit a request for mutual assistance for the search, access, seizure, secudty, or disclosue ofthe stored computer (3) Upon receiving a request under subsection (l), the Anorney-General shall take all appropriate measures to expeditiously preserve t e specified data in accordance with the procedures and powers under this Act. (4) A request under subsection ( I ) shall be effected where the conduct alleged does not constitute a crime in both the foreign state and in Sierra L€one. (5) A preservation of data effected in response to a request under subsection (l) shall be for a period not l6ss than 90 days, in order to enable the foreign state, to submit a request for the search, access, seizure, securtiy or disclosure of the data and following the receipt ofsuch a request, the data shall continue to be preserved until a final decision is taken on that pending request.

(l) Where during the coune ofexecuting a request undersection 26, wift respect to a specified communication, it is discovered that a service provider in another state was involved in the transmission of the communication, the Attorney-General shall expeditiously disclose to th€ foreign state, sufficient amount oftraffic data to identiry that sarvice provider and the path through which the comrmmication was transmitled. (2) Exiedited disclosure ofpreserved tramc data under subsection ( I ) may only be withheld where the - Expedited disclosure of preserved traffic data. I No.7 The Cyber Security and Ciae Act 2021 Mutual assistmce regarding accessing of stored computar (a) request concems a political offence or an offence related to a political offence; or (b) AttorDey-General considers that the execution ofthe request is likelyto prejudibe the sovereignty of Sierra Leone, securjty or public interest.

(l) A foreign state may request the search, access, secureor disclosure ofdata stored by means ofa cornputer system located within Sierra Leone, including data that has been preserved under section 26. (2) When making a request undel subsection (l), the foreign state shall provide adequate information on the following- (a) the name of the authority conducting the investigatioo or prosecution to which the request relates; (b) a description of the natue of the criminal offence and a statement setting out a summary ofthe relevant facts and laws; (c) a description of the purpose of the request aDd of the nature of the assistance being sought; (d) in the case of a request to restrain or confiscate assets believed on reasonable grounds to be located in Siera Leone, details ofthe offence in question, particulars ofany investigation or prosecutioa commenced in respect of tbe offence, including a copy of any relevant restraining or confiscation order; (e) details ofary procedure that the foreign state wishes to be followed by Sierra Leone in giving effect to the requesl pafticularly in the case ofa request to take evidence; No.7 The Cyber Secutity dnd Crime Act 2021 43 (0 a statement setting out any wishes of the foreign state concerning confidentiality relating to the request and the reasons for those wishes; G) details oftbe period within which the foreign state wishes the request to be complied with; O) where applicable, details of the property, computer, computer system or device to be traced, restrained, seized or confiscated and ofthe gomds forbelieving that the poperty is believed to be in Sierra Leone; (i) details ofthe stored computer dat4 data or program to be seized and its relationship to the offence; (j) information identiSing the custodian ofthe stored computer data or the location ofthe computer, computer syslem or device; (k) an agre€ment on the question ofthe payment of the damages or costs of fulfilling the request; 0) details to the effect that wanant in regard the matter under investigation has already been obtained to extend the investigations overseas; and (m) any other information that may assist in giving effect to the request. (3) Upon receiving a request under subsection (l), the Attorney- General shall take all appropriate measures to obtain necessary authorisation including a warrant to execute in accordance with the procedures and powers under this Act or any other law. 41 No. 7 Tle Cyber Security and Crime Act 2021 Trens-border &ceess to stored computer data Muiual assistarce in r€a.l tine collection of traffic dat.. (4) Upon obtaining oecessary authorisation und€r subsection (3), including a warant to execute, the Attomey-General may seek the support and cooperation of the foreign state during such search and seizure. (5) Upon conducting the search and seizure under subsection (4), the Attorney-General shall provide the results ofsuch search aad seizue, as well as the evidence seLed, to the foreign state. 29, Subject to this Act, an enforcement omcer or other atthorized person may, without authorisation- (a) access pubticly available (open source) stored computer data, regardless of where the data is located geographically; or (b) access or receive through a computer system in Sierra kone, stored computer data located in a foreign state, if such an enforcement officer or other authorised person obtains the lawful and voluntary cons€nt of the person who has the lawful authority to disclose the data through that computer system.

(l) A foreign state may request the Attomey-General toprovide assistance in real time collection of traffic data associated with specified communications in Sierra Leone aansmitted by means of a computer system. (2) A request for assistance under subsection (l) shall speci&- (a) the authority making the request; Provided that any such access shall be without prejudice to fte rights to privacy of persons and may be rescinded upon an application try a person affected to a Judge ofthe High Court. No. ? The Cyber Securir^ and Crime Act 2021 45 (c) the name ofthe authority with access to the relevant taffic data; (d) the Iocation at which the ftamc data may be held; (e) the intended purpose for the required traffic dalai (0 sufncient information to identiry the trafnc dzta; firther details ofrelevant t'affic data; the necessity for use of powers under this section; and the terms for the use ald disclosure of the traffic data to third parties. (e) o) (') (3) Upon receiving a requsst under subsection (1), the Attorney- General shall take all appropriate measures to obtain necessary authorisation including a warrant to execute upon the request in accordance with the procedures and powers under this Act or any other law. (4) Upon obtaining necessary authorisation including a warant to execute a request under subsecdon (l), the Attomey- General may seek the support and cooperation of the foreign state during the search and sei.zue. (5) Upon conducting the measures under this section, the Aiomey-General shall provide the resuhs of such measurEs as well as real-time collection of trafTic data associated with specified communication to the foreign state. (b) the ollence that is the subject ofa criminal investigation or prosecution and a brief sunmary of the related facts; 4 No. 7 The Cyber Security ahd Crime Act 2021 Mutual assisunce r.ga.dinB intcrception of cont.nt

(l) A foreign state may, in relation to a serious offence inthat state, request or provide assistance in the real time collection or recording ofcontent data ofspecified communicatioo tmnsmitted by means ofa computer system in Sierra L€one. (2) A reques for assistance under subsection (l) shall specig- (a) the authority making the request; (b) the offence that is the subject ofa criminal investigation or prosecution and a brief summary ofthe facts; (c) the name ofthe authority with access to the relevant communication; (d) the location at which or nature of tbe (e) the intended purpose for tbe required (0 sufficient information to identify the G) (h) o details ofthe data ofthe relevant interceptioni the recipient of the cornmunication; the intended duration for the use of the 0) the necessity for use of powers under this section; and the terms for the use and disclosure of the communication to thfd parties. (k) No. 7 The Cyber SecuriE ahd Crime Act 2021 47 (3) Upon receiving a request under subsection (l). the Afiomey- General shall take appropriate action to execute the request in accordance with t}le procedures and powerc uoder this Act. (4) The Attorney-General shall, on executing the request under subsection (3), provide the results of such action as well as real time collection or reeording of content data of specified communication to the foreign state.

(l) The National Cybersecurity Coordinator or his point ofauthorized representative shall designate a point ofcontact available contact on a24-hour,7{ays-a-week basis, in order to ensure the provision of irnmediate assistance for the purpose of investigation or prosecution ofoffences relat€d to computer systems and data, or for the collection ofevidence in elecronic form. (2) Immediate assistance to be provided under subsection ( l) shall include - (a) the provision oftechnical advice; (b) the preservation of data pursuant to expedited preservation of stored computer data and expedited disclosure of preserved taffic data; and (c) the collection ofevidence, the provision of legal information, and locating ofsuspects. (3) A point ofcontact under subsection (l ), shall - (a) be resourced with and possess the requisite capacity to securely and efficiently carry out communication with other points of contact in other states, on an expedited basis; @) have the authority and be empowered to coordinate and enable access to international No.7 The Cyber Sealrity and Crirne Act 2021 access. mutual assistance under this Act or if applicable extadition procedures, upon an expedited basis. PARTVI OFFENCES

(l) A person, including a corporation, partnership, orassociation, who intentionally and without authorisation causes a computer system !o perform a function with inlent to secue access to the whole or a part ofa computer system or to enable such access to be secured other than to secure and protect the integrity oldigital communications or for unlawful purposes, commits an offence and is liableupon conviction to fine not less than Le 100,000,000 and not more than k 250,000,000 orto a term ofimprisonment not less than 2 years and [ot exceeding 5 years or to both such fine and imprisonment and in the case of a corporation, partnership, or association, to a fine nol less than Le500,000,000 and not exceeding t€ 1,000,000,m0. (2) For the purposes of this section, a pe6on secures access to computer data stored in a computer system ifby causing a computer system to perform a function he- (a) alters or erases computer data; or (b) copies, transferc or moves computer data to (i) a computer system or computer data storage medium other than that in which it is stored; or (0 a different location in the same computer system or computer data storage medium in u,hich it is stored; (c) has the computer data output from the computer system in which it is held, whether by having it disptayed or in any other manner; No. 7 The Cyber Security and Ctime Act 2 021 49 (d) uses the computer data. (3) For the purposes of this section, "unauthorised'i means access of any kind, to a computer system, program or data, by a person who has been authorised to access a specific data in a computer syslem and without lawful excuse, whether t€mporary or not, cause a computer system to perform a function other than those authorised, with intent to secure access to the whole or a part of a computer system or to enable such access to be secured, (4) The absence ofauthority to secure access to the whole or any part of a computer system under subsection (l) includes instances where there may exist general authority to access a computer system but a specific type, nature or method ofaccess may not be authorised. (5) For the purposes of this section intention or recklessness needs not relate to- (a) a particular computer system; O) a particular program or data; or ' (c) a progam or data ofany panicular kind. .(O A person shall be deemed to have contravened subsection (l> (a) in the absence of proof that the accused has the requisite knowledge to access the computet program or data; (b) notwithsta-nding rhe tact that committing the offence is impossible; (c) in the absence of a program or data of any panicular kind.

(l) A person, including a corporation, partnership, orassociation, who inte tionaliy or without reasonable authorisation causes a computer system to perform a function with intent to secure access to computer or program or data used directly in connection access to protectcd system. 50 lr-o. 7 The Cyber Secutiry and Crine Act 2021 dsta interc€ption. with or necessary for a Critical National Information Inftasmrcture cornmits an offence and is liable upon conviction to a fine not less than t* I 00,000,000 and not more than [.e 250,000,000 or to a term of imprisonment not less than 2 y€ars and not exceeding 5 years or to both such Frne and imprisonment and in the case of a corporation, partnership, or association, to a fine not less than Le500,000,000 and not exceeding I.e 1,000,000,000. association, who has been authorised to access a specific data in a computer system and without lawfirl excuse, whether temporary or not, cause a computer system to perform a function other than that authorised, or intentionally permits tampering of such computer systems ,l fith intent to secure access to the whole or a part of a computer system or to enable such access to be secured, commits an offence and is liable on conviction to a fine not less than Le 100,000,000 and not more than Le 250,000,000 or lo a term of both such fine and imprisonment and in the case of a cbrporation, partnership, or association, to a fine not less than Le500,000,000 and not exceeding [€ I ,000,000,000. (3) The absence of authority to secure access to the whole or any part of any computer system under subsection (l) includes instances where there may exist general authority to access a computer system but a specilic t)?e, nature or method of access may not be authorised- 35. 0) A person, including a corporation, parmership, or association, who intentionally and without authorisation intercepts or causes to be intercepted non-public transmissions of data to or from a c-omputer system whether directly or indirectly the Eaosmission ofwhich - (a) results in a significant financial loss; (b) tfueatens national secudty; No. 7 The Cyber Securiry ahd C rne Acl 2021 5l (b) causes physical injury or death to any person; or (c) threatens public health or public safety, corunits an offence and is liable upon conyiction to a fine not less than Le 100.000,000 and not more than k 250,000,000 or to a term of partn€rship, or association, to afine not less than Le 500,000,000 and not exceeding l-e I ,000,000,000. (2) Where a person, including a corporation, partnership, or associatiorL intentionally and without authorisalion, intercepts or causes to bo intercepted, the transmission of data to or fiom a computer system over a telecommunication under subsection (l), commits an offence and is liable upon conyiction to a frne not less than Le 100,000,000 and not more than [,e 250,000,000 orto a term of both such fine and imprisonment and in the case of a corporatio[, partneBhip, or associatior! to a fine not less than Le 500,000,000 and not exceeding [,e 1,000,000,000. Itis fnmatedal whether - (a) the unauthorised interception is not dir€cted at- (i) a telecomrnunications system; (D a particular computer system; (iif a program or data ofaly kind; or (iv) a program or data held in any particular computer systemi (b) an unauthorised interception or an intended eflect ofit is permanent or temporary. I No. ? The Cyber Securitl and Cri e Act 20)t data interfer€nce.

A person, including a corporation, partnership. orassociation, who intentionally or without authorisation does an act in relation to a computer system which- (a) causes destruction, damage, deletion, erasure, deterioratioq generation, modification or alteration ofa program or data or any aspect or attribute related to the program or data; ft) renders a program or data meaningless, useless or ineffective; (c) obstructs, interrupts or interferes with the use of any program or data or any aspect or attribute related to the program or data; (d) causes denial, prevention, suppression or hin&ance of access to a progam or data or any aspect or attribute related to the program or data or to any person entitled to it; (e) causes impafum€nt to the operation of a Progam; (0 causes impairment to the reliability of any dat4 aspect or attuibute related to a progam or data; (g) causes impairment to the security of a program or data or any aspect, attribute related to a program or data; or (h) enables any of the acts mentioned in pamgraphs (a) to (g) to be done, commits an offence and is liable upon conviction to a fine not less than t e I 00,000,000 and not more than l,e 250,000,000 or to a term of No. 7 The Cyber Sectity and Cime Act z02t 53

A person, including a corporation, partnership, or unauihorisedassociation, who intentionally or without authorisation does an svstem unauthorised act in relation to a computer system which - interfercncc both such fine and imprisonment and in the case of a corporation;' partnership, or association, to afine not less than h 500,000,000 and not exceeding Le I ,000,000,000 (a) interferes with, hinders, damages, prevents, suppresses, deleriorates, impa irs or obstructs the functioning of a computer system; (b) interferes with, hinders, damages, prevents, suppresses, deteriorates, impairs or obstructs the communicatioo between or ]vith a computer system; (c) interferes with or hinders access to . acomputer systcml (d) (e) (0 impairs the operation ofa computer system; impairs the reliability ofa computer system; impairs the security of a computer system; or (g) enables any of the acts mentioned in paragraphs (a) to (f) to be done, commits an offence and is liable upon conviction to a fine not less than Le 100,000,000 and not more than Le250,000,000 ortoa term of partne$hip, or association, to a fine not less than Le 500,000,000 and not exceeding [r I,000,000,000 g No. 7 The Cyber Secutity and Crine Act 2027 Misuse of device. Provided that it shall not be an offence ifinterference with a computer system is undertak€n in compliance and in accordance with the terms ofa warrant issued under this Act or any law.

(D A person, including a corporation, partnership, orassociation, who intentionally or without authorisation manufactures, adapts, sells, procures for use, receives, possesses, impo(s, offers to supply, distributes or otherwise makes available- (a) a device designed or adapted primarily for the purpose ofcommitting an offence under this Act; or (b) a computer password, access code or similar data by *'hich the whole or any part of a computer system is capable of being accessed, designed or adapted primarily for the purposes ofa computer system. (c) uses electronic communication eqqipment to bypass standard inter-connection path by illegal redirection of traffi c. commits an offence and is liable upon conviction to a file not less than tr 500.000,000 and not more than Le 1,500,000,000 or to a term of imprisorunent not less than 5 years and not exceeding l0 years or to both such fme and imprisonment and in the case of a comoration, parmership, or association, to a fine not less than Le 3,000,000,000 and not exceeding Le 6,000,000,000. (2) Notwithsanding subsection (1) a person shall not be deemed to have committed an offence if he does an act under subsection (l ),- (a) for the purpose of training, testing or protection ofa computer system; or (b) .in compliance ofand in accordance with the tenns ofajudicial order issued orin exercise of a power under this Act or any law. n*o.7 The Cyber SecuriO' ahd Crine Act 2021 55 (3) For the purpose of subsection (l), possession of a program or a clmputer password, access codg or similar data includes having- (a) possession of a computer system which contains the program or a computer password, access code, or similar data; (b) possession of a data storage device in which the program or a computer password, access code, or similar data is recorded; or (c) control ofa program or a computer password access code, or similar data that is in the possession of another person.

A person, including a corporation, partnership, or Un.uriorisedassociatioq who intentionally or without authorisation discloses to discloaure of, another persoD a password, access code or other means of gaining p6s*ntd' access to any progmm or data held in a computer system- (a) for any wrongfut gain; (b) for any unla*firl purpose; or (c) to occasion any loss, commits an offence and is liable upon conviction to a fine not less than Le 10,000,000 and not more than Le 30,000,000 or to a term of imprisonment not less than 1 year and not exc€eding 3 yea$ or to partnership, or association, to a fine not less than [r 50,000,000 and not exceeding Le 100,000,000.

(l) A persog including a corporation, partnership, or Computerassociation, who intentionally or without authorisation inputs, alters, telated deletes or suppresses computer data, resutting in inauthentic data lorg€rv' with the intent that it be considered or acted upon for legal purposes as if it rvere authentic, regardless ofwhether or not the data is directly s No.7 The Cyber Secwi, and Cime Act 2021 readable or intelligible, commits an offence ard is liable upon conviction to a fine not tess than Le I 0,000,000 and not more than Le 30,000,000 orto a term ofimprisonment not less than I year and not exceeding 3 years or to both such frne ard imprisonment and in the case ofa corporation, parhership, or association, to a fine not less than k 50,000,000 and not exceeding l,e 100,000,000 (2) A person, including a corpo.ation, partnership, or association, who dishonestly or witi similar intenl - (a) for wrongful gain; (b) for wlongful loss to another person: or (c) for any economic benefit for oneself or for another person, intentionally or without authorisation inputs, alters, deletes or suppresses computer data, resulting in inauthentic data witb the intent that it be considered or acted upoD for legal puposes as if it were autientic, regardless of whether or not the data is directly readable or intelligible commits an offence and is liable on conviction to a frne not less flan Le 30,000,000 and not more than l€ 50,000,000 or to a term of imprisoffnent not less than 2 year a.nd not exceeding 5 years or to bolh such fine and imprisooment and in the case ofa corporation, partnership, or association, to a fine not less than t€ I 00,000,000 and not exceeding Ir 250,000,000

A person, including a corporation, partnership, orassociation, who intentionalty causes loss of property, valuable security or consideration to another person by - (a) inputting, alteration, modification, deletion, suppression or generation of a program or dvtai (b) interference, hindrance, impairment or obstruction with the functioning of that computer systeml or Computer fraud. No. 7 The Cyber Secutity ahd Crime Act 2021 (c) copying, transferring or moving data or program to another computer system, device or storage medium other than that in which it is held or to a different location in any other computer system, device or storage medium in which it is held; (d) using any data or program; or (e) having any data or program output from thecomputer system in which it is held, whetherby having it displayed or in any other manner. with fraudulent or dishonest intent of procuring, without righq an ecooomic benefit for himselfor for another person commits an offence and is liable upon conviction to a fme not less than Le 30,000,000 and not more tian Le 50,000,000 or to a term ofimprisonment not less than 2 years and not exceeding 5 years or to both such fine and imprisonment and in the case of a corporation, partnership, or association, to a fine not less than Le100,000,000 and not exceeding l€ 250,000,000"

(l) A, person, including a corporation, parmership, orassociation, who is engaged in the services ofany financial institution, and as a result of his special knowledge commits identity theft, phishing of its employer, staff, seFr'ice providers and consultants with the intent to de&aud commits an offence and is liable upon convictio. to a fine not less than Le 50,000,000 and not more than Le 100,000,000 or to a term of imprisonment not less than 3 years and not exceeding 7 years or to both such fine and imprisonment and in the case of a corporation, partnership, or association, to a fine not less than k100,000,000 and not exceeding Le 250,000,000. association, who fraudulentlyldentily theft a,ld impersonstioI!. 58 No. 7 The Cyber Secwity ahd Crirne Act 2021 (a) or dishonestly makes use ofthe electonic signature, password or any other unique identification featue ofany other person; or (b) impersonates another entity or person, livhg or dead, tYith intent to- (D gain advantage for himself or another Person; (iii) cause disadvantage to the person or entity being impersonated or another person; or (iv) avoid arrest ol prosecution or to obstmct, pervert or defeat the course ofjustice, commits an offence and is liable upon convictionto afine not less than Le 50,000,000 and not more than Le 100,000,000 or to a term of imprisonment not less than 3 years and not exceeding 7 years or to both such fine and imprisonment and in the case of a corporation, partnership. or association, to a fine not less than Le100,000,000 and not exceeding l* 250,000,000. (3) A person, including a corporation, partnership, or association, who makes or causes to be made, either dtectly or indirectly, any ialse news as a material fact in w ting, knowing it to be false and with the intent that it be relied upon respecting his identity or that ofany other person or his financial condition or that of any other person for the purpose of procuring the issuance of a card or other instrument to himself or another person commits an Qi) obtain any property or an interest in any property; No.7 The Cyber Securib/ and Crime Act 7o2t 59

(1) A person, including a corporation, pannership, or cybe,association, who individually or with another person. willfully and stalking and repeatedly communicates, either directly or indirectly, with another ffinr.person, if he knows or ought to have known thal. his conduct - offence aod shall be liable on conviction to a fine not less thari Le 50,000,000 and not more than Le 100,000,000 or to a term of imprisonment not less than 3 years and not exceeding 7 years or to partnership, or association, to a ftne not less than Le 100,000,000 and not exceeding Le 250,000,000 43. A person, including a corporation, partnership, or Elccrronic association, who with the intent to detaud and or misrepresent" forges siS,rature. through electronic devices another person's signatue or company mandate co[units an offence and shall be liable on conviction to a 6ne not less than Le 50,000,000 and not more than Le 1 ,000,000,000 or to a term of imprisonment not less than 3 years and not exceeding 5 years or to both such fine and imprisonment and in the case of a corporation, partnership, or association, to a fine not less than k500,000,000 and not exceeding l,e 5,000,000,000. (a) is likely to cause that person apprehension or fear ofviolence to him or damage or loss on tris propeny-l or (b) detrimentally affects thal person; commits an offence and strall be liable on conviction to a fine not less than Le 30,000,000 and not more than Le 50,000,000 or to a term of imprisotrment not less than 2 years and not exceeding 5 years or to partnership, or associatioq to a fine not less than Le 100,000,000 and not exceeding Le 250,000,000 association, who recklessly or intentionally sends a message or other matter by means ofa computer system or network that- @ No. 7 The Cyber Security ahd Cri e Ae, 2021 Cyber Squatting. (a) is grossly offensive, pomographic or of an indecent, obscene or menacing character or causes any such message or matter to be so disseminated without consent; or ft) he knows to be false, for the purpose of causing danger, obstructioo, insult, injury. criminal intimidation enmity, habe4 ill will or needless anxi€ty to another or causes such a message to be sent, commits an offence anC shall be liable on conviction to a fine not less than Le 30,000,000 and not more than l-e 50,000,000 or to a term of partnership, or association, to a fine not less than Le 100,000,000 and not exceeding t,e 250,000,000. (3) Notwithstanding subsection (l) a person shall not be deemed to have acted in contmvention of this Act ifhe does an act - (a) for the purpose of preventing or detecting crime; (b) in compliance of and in accordance with the terms ofajudicial order issued or in exercise ofany power under this Act or any law; or (c) which is in the interest ofthe public. 45. 0) A person, including a corporation, partnership, or association, who intentionally takes or makes use ofa name, business name, ffidemarl( domain name or other word olphrase registered, owned or in use by an individual, body corporate or belonging to a govemment institution in Sierra Leone, on the intemet or any other computer network, without authority, dght or reasonable excuse and for the purpose of interfering with the use by the owner, registrant or legitimate prior usec shall be liable to damages in a civil action as determined by a Judge ofthe High Court. No.7 The Cyber Searity and Crirne Act 2021 6! (2) ln awarding penalty against an offender under this section, a court shall have regard to the following- (a) refusal by the person to relinquish, upon formal request by the rightful owner without reasonable excuse ofa name, business name, trademark, domain name, or other word or phrase registere{ owned or in use by any individual, body corporate or belonging to the Government of Sierra Leone; or O) any attempt by the offender to obtain compensation in any form for the release to the rightful owner for use of the name, business name, trademark domain name or other rrord or phrase registered, owned or in use by the individual, body corporate or b€looging to the Governrnent ofSiena Leone. (3) In addition to the penalt-v specified in this section, the court may make an order dfuecting an offender to relinquish such registered name, mark, trad€mark, domain name or other word or phrase to the rightful owner.

A person, including a corporation, partnership, orassociatio& who, through input, alteralion, modification, deletion, suppression or generation ofa program or data or through use ofa computer, computer system or eleckonic device willfully infringes any right protected underthe CoplrightAct,201 l(Act No. 8 of20l I ) or any law in force for protection of copyrights and related rights, corunits an offence and is liable on conviction to a frne not less than Le 100,000,000 and not more than Le 250,000,000 or to a term of imprisonment not l€ss than 2 years and not exceeding 5 years or to both such fure and imprisonment and in the case of a corporation, partnership, or association, to a fine not less than Le500,000,000 and not exceeding Le 1,000,000,000 without prejudice to civil remedies that may be available. lnfringemert of copyight and rclated rights a No.7 Thz Cyber Securily and Cfime Act 2421 Online child saxual abuse.

(l) A person, including a corporation, parhership, orassociation, who, intentionally- (a) disributes, produces, fansmits, disseminates, circulates, delivers, exhibits, Iends for gain, exchanges, barters, sells or offers for sale, lets on hirc or ofieIS to l€t on hire, prints, photo$aphs, copies, provides location, requests for, offers in any other way, or makes available in any way child pomography through a computer system or storage data medium; or (b) acquiesces a child's participation in pomogaphy, commits an offence and shall be liable on conviction to a fine oot less than Le 100,000.000 and not more than Le 250,000,000 or to a term of imprisonment not less than 5 years and not exceeding l0 years or to both such fine and imprisonment and in the case of a corporation, partnership, or association, to a fine not less than Le 500,000,000 and not exceeding Le I ,000,000,000 (2) A person, including a corporation, parfiIership, or association, who intentiona.lly poses, grooms or solicits, through any computer system or network, to meet a child for the purpose of (a) engagiDg in sexual activity with the child; (b) engaging in sexual activity with the child where- (f coercion, inducement, force or thrcat is used; (if a recognised position oftrust, authority or influence over the child, including within t}e family is abused; or No. 7 The Cyber Sccurity and Crirne Act 2021 63 (iif a child's mental or physical disabiliry or situation of dependence is a b u s e d; commits an offence and shall be liable on conviction to a fine not less than Ir I 00,000,000 and not morc than Ir 250,000,000 or to a term of imprisonment not less than 5 years and not exceeding l0 years or to parhiership, or association" to a fine not less than Le 500,000,000 and not exceeding lr I,00O,0O0P00 (3) Notwitlbtanding subsection (l ) a person shall not be deemed to have committed an offence ifhe does an act intended for a bona fide scientific ormedical research or law enforcement. (4) For purposes of this section- "child" means a person under the age of l8 years; "child pornography" includes data which, whether visual or audio, depicts- (a) a child engaged in sexually explicit conduct; O) a person who appears to be a child engaged in sexually explicit conduct; or (c) realistic images representing a child engaged in sexually explicit conduct. 48. 0) A person, including a corporation, partnership, or online adulr association who: sex$al lbuse. (a) take or share an intimate image or voice material ofadepicted person without his/her consent; & The Cyber Security and Crime Act 2021 O) take or share an intimate image or voice material ofa depicted person without his/her consen! with the intention to humiliate, alam or dishess the victim; (c) take or share an intimate image or voice material ofa depicted person without his^rer consent, for the purpose of either sexual gratification by the perpetrator or that of another; (d) theaten to share any intimat€ image oi voice material of a depicted person Ivith intent to cause the depicted person to fear that the image or audio material will be sha:ed, or being reckless as to whether the depicted person will have such fear that the threat will be executedl (e) disseminate or post sexually explicit image, media or voice material without the consent of the depicted person, whether or not the intent is to shame, humiliaG, Aighten or cause the depicted person hann. conrmits an offence and shall be liable on conviction to a fine not less than k I 00,000,000 and not more than [.e 250,000,000 or to a term of imprisonment not less than 5 years and not exceeding l0 years or to No. 7 No.7 The Cyber Seeutity ahd Crifie Act 2021 65 partnership, or association, to a fine not less than Le 500,000,000 and not exc€eding t€ 1,000,000,000. (2) In this section, the expressions "intimate image or voice material" shall include video, images or voice media created by the depicted person which hs'she has not willingly put into the public domain; video, images or voice media taken by another; video, images or voice media in the possession of the perpetrator by any means whatsoever including been stolen &om a hacked computer or other digital device ofthe depicted person; video, image or voice material that may have been doctored by superimposing the face or voicc of a depicted person unto an existing intimate or sexually explicit image or some other voice media.

(l) A person, including a corporation, partnership, or Attemptingassociation, who intentionally abe$ the commission of, aids ," f**oft "', commiE attempts to commit or does any act preparatory to or in furtherance ofthe commission ofan offence under this Act conunits an offence and is liable upon convictio to the same penalty as that prescribed in respect of the substantive offence under this Act. @) An offence may be deemed to have been committed under subsection ( I ), notwithstanding where the act in question took place.

(l) No person shall engage in the operation ofa business Regisrarionof providing computers for accessing the intemet, playing e""t*, ll;]l"t chatting or doing other computer-related task unless the business. 6 No. 7 The Cyber Secutity ahd Crime Act 2021 (a) has a registered business name with the Corporate Affaits Commission established under the Companies Act, 2009 (Act No. 5 of 2@9);or (b) is registered with a local corurcil; or (c) is registered with tbe office of the Administrator and Registrar General; and (d) registered with National Telecommunications Commission established under lhe Telecommunications Act, 2006 (Act No. 9 of 2006) as a business concemed with providing computer access to the internet. association, who perpetrates elecEonic Faud or online Aaud under this Act using a cybercafd, commits an offence and is liable on conviction to a fine not less than k 50,000,000 and not more than Le 500,000,000 or to a term of imprisonment not less thatr 3 years and not excseding 5 years or to both such fine and imprisonment and in the case of a corporatioq parhership, or association, to a fine not less than 1,e500,000,000 and not exceeding l-e 5,000,000,000. provided that the cybercafC owner ot manager shall not be liable for such an offence unless there is evidence to the effect that he or she or it were complicit in the commission ofthe oflence. No. 7 The Cybet Security and Crirne Act 202t 51, 0) A p€rson who accesses or cause to be accessed a cyber computer or computer system or network lor purposes ofa terorist 'tetrorism. act, commits an offence and is liable on conviction to a term of imprisonment not less than 10 years aad not exceeding 20 years. (2) For purposes ofthis sectioq "tenorist act" shall have the same meaning as provided under the Anti-Money kundering and Combating of Financing of Terrorism Act. 2012 (Act No. 2 of 2012\. 52, 0) A person, including a corporation, partsrership, or R.cisr association, who witb intent- 6;x""'J:0" (a) distibutes or otherwise makes available, racist or xenophobic material to the public tkough a computer system or network; O) theatens through a computer system or network any other person or group of persons for th€ reason of belonging to a group distinguished by race, colour, descent, national or ethnic origin, gender religion, as well as disability (c) insults publicly through a computer system or network any other person or group of persons distinguished by race, colour, descent or national or ethnic origin, as well as religion; or 68 No.7 Thz Cyber Security and Crime Act 202t (d) disributes or otherwise makes available, to the public, material wtrich denies or approves or justifies acts constituting genocide or crimes against humanity, commits an offence and is liable upon conviction tg a flrne not less than l* 50,000,000 and not more than l€ 100,000,000 or to a term of imprisonment not less than I year and not exceeding 3 years or to both such fine aad imprisoment and in the case of a corporation, partnership, or associatio[, to a fine not less than Le250, 000,000 and not exceeding Le 5 00,000,000

(l) A person or institution that operates a computersystem or netwodq whaher public or pivate, shall immediately inform the National Computer Security Incidence Response Team of an attach intmsion and othet disruption liable to hinder the functioning of another computer system or network, and the National Computer Security lncidence Response Team shall take necessary and appropriate measues to protecl computer systems and networks. (2) ln order to protect a computer system or network under subsection (1), the National Computer Security Incidence Response Team may propose the isolation ofan affected computer system or network pending the resoiution ofthe issues. (3) A person or institution who intentionally or without reasonable excBe fails to report an incident ofan attacks, intrusions and other disruptions liable to hinder the functioning of another computer system or network to the National Computer Security lncidence Response Team within 7 days of is occurrence, commits an offence and is liable on conviction to a fine not less than k Reporting cybcr threats. No. 7 The Cyber Security and Crime Act 2021 @ 10,000,000 and not more than Le 30,000,000 or to a term of imprisonment not less than I year and not exceeding 3 years or to partnership, or association, to a fine not less than Le50,000,000 and rot exceeding L€ 100.000,000.

(l) A person or institution which, lieing a computer basedservice provider and or vendor does an act with intent to defraud and by virtue ofhis position as a service provider, forges, illegally uses securitl' codes ofthe consumer with the intent to gain a hnancial and or material advantage or with intent to provide less value for money in his or its services to a consumer commits an offence and upon conviction is liableto a fine not less than Le30,000,000 and not more than Le 50,000,000 or to a term ofimprisonment not less than I year and not exceeding 3 years orto both such fine and imprisonment and in the case ofa corporation, pa:lnership, or association, to a fine not less than Le100,000,000 and not exceeding t e 250.000,000. (2) Where an offence under thisAct commined by a body corporate is proved to have been committed on the instigation or with the connivance of or atkibutable to willful neglect on the pan of a directoq manager, secretaDi or other like officer ofthe body corporate or any officer purporting to act in any such capacity, he, as r,vell as the body corporate, where practicable, shall be deemed to have corrun;tted the offence. (3) Notwithstanding subsection (l), where a body corporate is convicted ofan offence under this Act, which threatens national security the Court may in the case of multiple or repeated Breach of confidence by providers. n No. 7 The Cyber Securily and Crine Act 2021 Employces responsibility offenders, order that the body corporate shall be wound up and all its assets and properties forfeit€d to the state, without prejudice to any Iiability owing from the said body corporate being first satisfied. (4) Nothing contained in this section shall render a person liable to punishment, where he proves that the offence was committed without his knowledge or thathe exercised all due diligeoce to prcvent the commission ofthe offence.

(l) Without prejudice to any contractual agreementbetween an employer and employee, an employee shall relinquish or surrender all codes and access rights to his employer within a reasonable time in his possession, power or coDtrol upon disengagement fr om employment. @) An employee who, without any lawful reason, continues to hold unto the code or access right ofhis employer after disengagement without any lawful reason commits an offence and shallbe liable on conviction to a fine not iess than Le 10,000,000 and not more than l-e 30,000,000 or to a term of imprisonment noi less than I year and not exceeding 3 years or to both such fine and imprisonment and in the case of a corporation, partnership, or association, to a fine nol less than Le50,000,000 andnot exceeding k 1m,000,000 56. 0) A natural person, who exercises management or supervisory authority, based on- (a) power of representation ofa lcgal person; (b) authoriry to take decisions on behalfofa legal person; Corporale liability. No. 7 The Cyber Security and Ctime Act 202r 1t (c) authority to exercise control within a legal person, acting either individually or as part ofan organ ofthe legal person, and fails to exercise reasonable and proper conrol over such legal person comrnits an offence underthisAct, and is liable on conviction to a fine ltot less than L€ 10,000,000 and not more than Le 30,000,000 or to a term of imprisonment not less than I year and not exceeding 3 yea6 or to both such fine and imprisonment and in the case of a corporation, parheBhip, or association, to a fine nol less than Le I 00,000,000 and not exceeding f€ 250,000,000. (2) Where a natural person commits a criminal offence under this Act, for the benefrt of a legal person, due to the lack of supervision or control by a natural person, the legal person shall be liable for the offence under this Act.

Act and subject to the provisions ofthe Children and Young P"oon. "hild*n Act Cap.44 and the Child Rights Act 2007, where an act done by a child would be deemed to be an offence under this Act such child shall be treated as ajuvenile and dealt with accordingly PARTVII-J\1ISCELI.A^\EOUSPROVISIONS

Regulations as it considers necessary or exp€dient for giving effects to any of the provisions of this Act. n No. 7 The Cyber Security and C ,ne Act 2021 Passed in Parliament this 23rd day o/Juue, in the year ofour Lord two thousand and twenty one. PARAN UMAR TARAWALLY Clerk ol Parliament. Tlus PRTNTED IMpREssroN has been carefu[y compared by me with the Bill which has passed Parliament and found by me to be a true and correct printed copy ofthe said Bill. PARAN UMAR TARAWALLY Clerk of Parliament. Pnorreo eNo Pusl-tsgEo av rrE GovERNtr$r PRTNrNG DEp rrMEar, SrERr LEoNE, G,EnF, No.7l or 25r, Novt,BEi, 2021.