Preamble, 2 The Cyber Security qnd Crine Act 2021

ACT Supplement to the Sierra Leone Gqzetre l/ol. CXLXII, No. 71 dated 25th November 2021 THE CYBERSECURIryANDCRIME ACT, 2O2I Being an Act to provide for the effective, unificd aad comprehensive legal, regulatory aod institutiooal fraDework for the prohibition, prevertion, detection, prosecution ard puDishment of cybercriBcs; preveolioo of tbe .busivc ute of computer system!; to provide for the estsblkhmetrt of structure! to promote cybersccurity ard c8p8.ity buildirg; to provide for the timely .nd .ffectiye collection ofelectronir evidence for the purpose of irvcstigalioD arld prosecution of cybercrime; to provide for th. protection of Critical National hformation Infrastructure arrd the protectioo of compute. systemg ard networks, electronic communicatiotrs, drta rnd computer programs, intellectusl property atrd priyacy rights to provide for fscilitstioo of internrtioml cooperaliol in dealing with cybe.crime Drtters and to provid€ for other relsted m8tters. tl Ex,lcrm by the President and Members ofParliament in this prese[t Parliament assembled. Date of commencement. @ 2 The Cyber Security qnd Crine Act 2021 PART I - PRELIMINARY lfiterpretation l. tn this Act, unless the contrary intention appea$ - "Attom€y General" means The Attorn€y-General and Minister of Justice established under the Constitution; "authorised person" means a member ofthe National Cyber Security Coordination Center or a person mandated by iL inyolv in the prohibition. prevention. elemination or combating ofComputer crimes and Cyier Securiry threats. "computer data" means any representation of facts, information or concepts in a form suitable for processing in a computer system, including a prcgtam suilabl€ to cause a computer system to perform a function; "computer data storage medium" means any device, physical or virtual, conlaining or designed to contain, or enabling or designed to enable storage ofdat4 whetber available in a single or distribuled forrn for use by a computer; "computer system" means any physical or virtual device, or any set of associated physical or virtual devices; or a group of interconnected or related devices, one or more ofwhich, pursuant to a prcgrrm, performs automatic processing of data at least one ofwhich use electronic, magnetic, optical or other technologr, to perform logical arithmetic storage and data or which perform control functions on physical or virf,ral devices including mobile devices and reference to a computer system includes a reference to part of a computer system; No.7 No. 7 The Cyber Security and Ctime -4ct 202r 3 "crime against humanity" includes any ofthe following acts committed as part of a widespread or systemal.ic attack directed against any civilian population, r ,ith knowledge of the attack: murders. extermination, enslavement, deportation or forcible transfer of population, imprisonment, torture rape, sexual slavery,, enforced prostitution, forced pregnancy, enforced sterilisation or any other form of sexual violence of comparable gravity, persecution agaiost an identifiable goup on political, racial, national, ethnic, cultural, religious or gender grounds, enforced disappearance of persons, the crime of apanhcid, other inhumane acts ofsimilar character intentionally causing great suffering or serious bodily or mental itliury; "Critical National Iniormation Infiastructure" means computer systems that are necessary for the continuous delivery ofessential services that Sierra Leone relies on. lhe loss or compromiie of rvhich will lead to a debilitating impact on- (a) the security, defence or intemational relations of Siena kone; O) the existence or identity of a confidential source of information relating to the enforcement ofthe criminal law; (c) the provision of services directly related to communications- infrastructure, banling and financial services, public utilities, public trarxportation or publickey infrastructure; or (d) the protection of public safety including system related to essential emergency services; 4 No. 7 The Cyber Security and Ctime Act 2021 "Cybemtalking" is when a person intentionally initiate communications or a cou.rse ofcoDduct directed at a specific person or persons with the intent to coerce, intimidate, harass, or cause emotional distress.; "Cybersquatting" means the acquisition ofa domain nafle over the intemet in bad faith to profit, mislead, destroy reputation, and deprive olhers f.om registering the same, if such a domatn is; O Similar, identical, or confirsingly similar to an existing hademark registered with the appropriate govemment agency at the time of the domain name registration; (r) Identical or in any way simitar with the name of a person other than the registrant, in case of a personal name; and (if Acquired without right or with intellectual property inter€sts in it; "data" means representations of information or of concepts that are being prepared or have been pfepared in a form suitable for use in a computer; "database" means digitally organized coliection ofdata for one or more purposes which allows easy access, management and update of data; "device" means any object orequipmentlhat has b€en des igned to do a padicularjob or whose mechanical or electrical workings are controlled or monitored by a microprocessor; "eleckonic communication'' means communicalions in electronic format, instant messages, short message No. 7 The Cyber Security ahd Crine Act 2021 5 service (SMS), e-mail, videq voicemails, multimedia message service (MMS), Fax" and pager; "enforcement officer" means an officer in a law enforcement agency trained in cyber security work designated or authorised to carryout functions including for the pu$roses of Part lV of this Act; "exfiadite" means the legal obligation ofstates under public intemational law to handover persons who commit intemational crimes to a foreign state for indictrnent, prosecution or imprisonment. "encrypted data" means data which has been transformed from its plain text version to an unintelligible format, regardless of the technique utilised for such transformation and irrespective of the medium in which such data occurs or can be found, for the purposes ofprotecting the content of such data; "false news" means incorrect deceptive information or propagand4 misinformation or hoaxes deliberately spread undcr the guise ofbeing authentic ne.xs via haditional print and broadcast news media or online social media witten and published with the intentto mislead for gains; "Financial Institution" means any individual, body, association or group of persons, whether corporate or unincolporated which carries on the business of inveshnent and securities, a discounthouse, finance company and money brokerage whose principal object includes factoring project financing equipment leasing, debt administration, fund management, private ledger services, investment management, local purchase order financin& export 6 No. 7 The Cyber Seeurity and Crime Act 2021 finance, project consultancy, financial consultancy, pension fund management, insurance institutions, debt factorization and conversion firms, dealer, clearirg and settlement companies, legal practitioners, hotels, casinos, bureau de change, supermarkets and such other businesses as the Central Bank or appropriate regulatory authorities may, from time to time, designate; "Financial Transaction" means a ransaction which in any way involves movement of funds by wire or other electronic means; involving one or more monetary instruments; or the transfer oftille to any real or personal property; "function" means logic, control, arithmetic, deletion, storage, retrieval and communication or telecommunication to or fiom, or within a computer; "genocide" means any ofthe following acts committed with intent to destroy in whole or in part, a national, ethnic, racial or religious group as such: killing members ofthe group, deliberately inflicting on the group conditions oflife calculated to bring about its physical destruction in u'hole or in part, imposing measures intendcd to prevent births within th€ group; forcibly transfening children ofthe group to another group; "identity theft" means the stealing of somebociy else personal identiling information and preteflds to be that person in order to commit fraud orto gain other financial benefits such as making unauthorised transactions or purchases. "interference" means any impairment to the confidentiality, integrity or availabiliq ofa computer system, or any program or data on a compuler slstem, No. 7 The Cyber Secrrity and Crime Act 2021 1 or any act in relation to a computer system which impairs the opcration of the computer system. program, or data; "law enforcement agencies" means any agency for the tirne being responsible for implementation and enforcement ofthe provisions of this Act; "Minister'' means the Minister responsible for lnformation and Communications; "modification" means in relation to a computer syst€r\ program or data, the alteration or modification with resp€ct to the contents of a computer system by the operation of a function of the computer system or any other computer if; (a) a program or data held in the computer system is altered or erased; (b) a program or data is added to its contents; or and any act which contributes towards causing such aheration or modification shall be deemed to have caused it; "password" means any data by which a computer service or a computer system is capable of being obtained or used; "person" includes a natual person, a corporation, company, parhership, hrm, association or societies; "Phishing" means the criminal and &audulent process (c) an act occurs which impairs the normal operation of a computer system, 8 No.7 l'he Cyber Secu|ity ahd Critne Act 2021 of acquiring or attempting to acquire sensitive information such as usemames, pilsswotds and credit card details, by masquerading as an authentic entity in an elechonic comnunication through emails, telephone or text message asking a user to change his or her password or reveal his or her identity so that such information can later be used to de&aud the user; "plain text" means original data before it has been transformed into an unintelligible format. "plain text version" means original data before it has been transformed into an unintelligible format. "pornography" means the representation in books, magirzines, photographs, films, and other media, telecommunication apparatus of scenes of sexual behavior that are erotic or lewd and are designed to arouse sexual interest; "premises" means land, buildings, movable structures, a physical or virtual space in which data is maintained, managed, backed up remotely and made available to usets over a network, vehicles, vessels or aircraft; "President" means the President of the Republic of Sierra Leone as established by the Constitution. "progmm or computer program" means computer data representing instructions or statements that, when executed in a computer system, catses the computer system to perform a f,rnction; "prosecute" means the legal obligation ofstates under public intemational law to prosecute persons who corunit intemational crimes where no other state has requested extradition; No.7 The Cyber Security and Ctirne Acl 2021 o "racist or xenophobic material" meirns any writt€n or printed material, any image or any other representation ofideas or theories, which advocates, promotes or incites hated, discrimination or violence against any individual or group of individuals, based on race, colour, descent or national or ethnic origin, as well as religion if used as a pretext for any of these factors. "Requested State" meaos a state being requested to provide legal assistance under the terms ofthis Act; "Requesting State" means a state requesting for legal assistance and may for the purposes of this Act include an intemational entity to which Sierra Leone is obligated: "service provider" means a public or private entity that provides to users of its services the means to communicate by use ofacomputer system including any other entity that processes or stotes computer data on behalfofthal entity or its users; "seize" with respect to a program or data be defined to include: (a) secure a computer system or part of it or a device; O) make and retain a digital image or secure a copy ofany program or data, including using an on-site equipment; (c) render the computer system inaccessible; (d) remove data in the accessed computer system; or (e) obtain output ofdata from a computer systeml l0 No. 7 The Cyber Secuity and Crime Act 2021 "Sexually explicit conduct" includes at leasl the following real or simulaled acts done with iotent to exploit a child- (a) sexual intercourse, including genital-genital, oral-genita[, anal-genital or oral-anal, involving a child, or behreen an adult and a child, ofthe same or opposite sex; (b) (c) (d) bestialityi masturbationi sadistic or masochistic abuse in a sexual contexq or (e) lascivious exhibition ofdre genitals ol the pubic area ofa child. It is not relevant wtiether the conduct depicted is real or simulated; "Spamming" means deliberate abuse of electronic messaging systems to ind iscrim in ate ly send unsolicited bulk messages to individuals and corporate organizations; "subscriber information" means any information contained in the form ofdata or any form lhat is held by a service provider, relating to subscribers of its services, other tlan traffic data or content data, by . which can be estabiished- (a) the O?e ofconmunication service used, the technical provisions taken thereto and the period ofservice; (b) the subscriber's identity, postal, geogmphic, electronic mail address, telephone and other No. 7 The Cyber Security dnd Crime Act 1l access number, billing and payment information available on the basis ofa service agreement or anangement: or (c) any other information on the site of an installation of communication equipment available on the basis ofa service agreement or anangement; "ftaffic data" means computer data relating to a communication by means of a computer system, generated by a computer system that formed a part in the chain of communication, indicating the communjcation's origin, destination, route, time, date, size, duration or the aype ofunderlying service; "unauthorised" means access of any kind, 1o a computer system, program or data, by a person who- (a) is not entitled to access that computer system, program or data; and (b) does not have or exceeds the level of authorisation consented to by the person entitled to grant such consent, for the particular kind or typre ofaccess with respect to that computer system, program or data: Provided that any act or access in exercise ofpowers under this Act shall not be deemed to be unauthorised. 202t l2 No.7 The Cyber Secuity dnd Crime Act 202, Establishment of the National Computer Sectllity lncidencc Rcsponse Coordination Centre PART IIADMINISTRATION AND COORDINAIION