GPU Issues Position Paper on CyberCrime Bill
GPU Board © GPU
GAMBIA PRESS UNION POSITION PAPER ON THE CYBERCRIME BILL, 2023
INTRODUCTION
1. The Cybercrime Bill, 2023 is aimed at improving the Gambia’s capacity to respond to cybercrime incidents adequately, according to the Minister of Communication and Digital Economy, on whose behalf the Bill was presented to the National Assembly on March 4, 2023.
2. From our own assessment, there are a few clauses in the Bill that raises some concerns with regards press freedom and freedom of expression that are likely to affect specifically the media, human rights activists, opposition activists, and generally, members of the public and social media users.
3. These provisions include:
I. Section 4, Subsection 7
II. Section 5
III. Section 6(1)(a); and paragraphs (b) and (c).
IV. Section 7
V. Section 8(1)
VI. Section 12(1)
VII. Section 13
VIII. Section 15
IX. Section 16, and subsection (6)
X. Section 17(6)
XI. Section 18(2)
4. This Gambia Press Union position paper on the Cybercrime Bill, 2023 seeks to examine the legal framework to present a case on how it meets (or fail to meet) the standards necessary for the promotion and protection of press freedom and freedom of expression in The Gambia.
POSITION ON THE CYBERCRIME BILL, 2023
5. Article 5 of the draft Bill covers “child pornography” as defined in section 2. The Bill does not list the offence under “computer related offences” despite the measure being titled a “cybercrime” law. For these reasons, a cybercrime treaty is not the right forum to discuss them. We urge the State to uphold their obligations under international human rights law and adopt comprehensive approaches to addressing child sexual abuse material.
6. As drafted, section 5 risks criminalizing content that may have scientific, educational, artistic, or literary value, notwithstanding the defence provided in section 5(2) (a-c). It may also restrict the legitimate experience and expression of gender and sexuality of children and adolescents, as the definition in section 2 only uses the phrase “sexually explicit conduct” with no further definition. We are particularly concerned about how criminalizing vaguely defined online content and activity will impact children seeking information about sexual and reproductive health and rights, sexual and gender diversity, discrimination and gender-based violence, and other topics that fall under the rubric of comprehensive sexuality education. Without further elaboration, the phrase “sexually explicit conduct” left undefined may be misused to criminalize the very vulnerable groups that the provision is intended to protect. We recall that the Committee on the Rights of the Child has advised that “States should avoid criminalizing adolescents of similar ages for factually consensual and non-exploitative sexual activity.”[1] Further, such conduct may include “written material” and “writing.” It is not clear the limits of what written material include, and whether this could give rise to the banning or sale of prominent, historically relevant books that are taught in universities.
18. We note that the Bill contains some provisions providing ‘defences’ on account of “public good” or “reasonable grounds,” and expressly includes the interest of “science, literature, or learning.” However, an accused must “prove” this, and as such these merely shift the burden on individuals to defend the legitimacy of what may be permitted, when instead it is the burden of the government to justify restrictions on expression as necessary and proportionate to achieve a legitimate aim. As a result, providing a ‘defence’ provides insufficient protection and still threatens to have a severe chilling effect as it does not prevent underlying charges, forcing individuals to invest legal resources in defending themselves (which may be prohibitive for children or their families). This is of particular concern given that section 5(3) includes in the definition of exploitation materials in written, visual, or audio formats that merely give the “impression” of being a child, and the only protection for children expressing themselves is to legally prove that they had “reasonable grounds” to do so. (See Article 19 analysis on the Cybercrime Bill, 2023[2])
7. Section 6(1)(a) creates the offence of ‘false news or information against a person’. The offence of 'false news or information' is overly broad and lacks clarity, posing a significant threat to human rights. In 2018, the ECOWAS Community Court ruled against the inclusion of 'false news' in the Gambia's Criminal Code, citing its adverse impact on journalists' and freedom of expression. This decision stemmed from a lawsuit filed by the Media Legal Defence Initiative and the Federation of African Journalists (which the Gambia Press Union is a member of) challenging the constitutionality of several Criminal Code offences, including 'false news.' Including this offence in the current Bill would perpetuate the risks faced by journalists, whistleblowers, anti-corruption bodies, and human rights defenders, undermining freedom of expression and impeding efforts to combat corruption and human rights abuses, and to promote good governance, transparency and accountability.
8. Similarly, paragraphs (b) and (c), which establish the offences of 'inciting violence against a person' and 'bullying, abusing, or making derogatory statements against a person,' respectively, present similar challenges to human rights defenders, journalists, and ordinary citizens due to their ambiguous language. The lack of clarity regarding what constitutes 'incitement,' 'bullying,' 'abuse,' and 'derogatory remarks' leaves these provisions open to misinterpretation and potential abuse, particularly in targeting journalists. These provisions also infringe on the constitutionally guaranteed rights of the media to hold the government and public officials to account (Section 207, 1997 Constitution).
9. We note that there is already a provision in the Criminal Code, which was replicated in the Criminal Offences Bill, 2022 on “False Publication and Broadcasting”, which places severe restrictions on media freedom and freedom of expression despite recommendations by the Gambia Press Union and the ECOWAS Court of Justice for its removal from the penal code and as per the Recommendation of the TRRC which the government accepted.
10. Similarly, in 2018, The Gambia’s Supreme Court in a landmark judgement gave a major boost to the enjoyment of digital rights by declaring as unconstitutional the law on “False Publication on the Internet” – which was a 2013 amendment to the Information and Communication Act, 2009 – following a suit by the Gambia Press Union filed in April 2017.
11. The above provisions in the Cybercrime Bill, 2023 contradict the core Constitutional rights which directly affect the freedom of the media, freedom of speech and expression as found in Sections 25(1) (a) and 207 (1) and (3) and 208 of the 1997 Constitution.
12. Therefore, the provisions in Section 6 1(a) and subsections (b) and (c) of the Cybercrime Bill, 2023 should either be removed entirely or revised to ensure they do not infringe upon fundamental rights and freedoms.
13. Section 25 (1) (a) of the 1997 Constitution provides that every person shall have the right to “freedom of speech and expression, which shall include freedom of the press and other media”.
14. Section 207 (1) and (3) provide as follows:
“207. Freedom and responsibility of media
(1). The freedom and independence of the press and other information media are hereby guaranteed.
(2). The press and other information media shall at all times, be free to uphold the principles, provisions and objectives of this Constitution, and the responsibility and accountability of Government to the people of the Gambia”
13. Section 208 provides,
“208 Responsibility of state-owned media
All state-owned newspapers, journals, radio and television shall afford fair opportunities and facilities for the presentation of divergent views and dissenting opinions”.
GAMBIA’S OBLIGATIONS UNDER INTERNATIONAL LAW
14. The Gambia is a party to the United Nations General Assembly Resolution 217A (III)
referred to as the Universal Declaration of Human Rights. Article 19 of the Resolution
states,
“Everyone has the right to freedom of opinion and expression: this right includes the right to hold opinions without interference and to seek, receive and impart information and ideas through any media regardless of frontiers”.
15. In 1979, The Gambia ratified the International Covenant on Civil and Political Rights
(ICCPR) Article19 of the Covenant states:
“19 (1) Everyone shall have the right to hold opinions without interference."
(2) Everyone shall have the right to freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of choice.
(3) The exercise of the rights provided in paragraph 2 of this article carries special duties and responsibilities. It may therefore be subject to certain restrictions, but these shall only be such as are provided by law and are necessary:
(a) for the respect of the right and reputations of others;
(b) for the protection of national security or of public order or morals”.
The Three-Part Test or the Oakes Test contained in Article 19 is incorporated in the limitations to freedom of expression and the media in Sections 25(4) and 209 of the Constitution of 1997.
16. The Gambia is also a party to the African Charter on Human and People’s Rights of 1986
commonly referred to as the Banjul Charter. Article 9 of the said Charter provides that:
“1. Every individual shall have the right to receive information”.
“2. Every individual shall have the right to express and disseminate his opinions within the law”.
Article 27(2) of the Charter provides the limitation to the enjoyment of the rights conferred by
Article 9 and provides that “the rights and freedoms of each individual shall be exercised
with due regard to the rights of others, collective security, morality and the common interest”.
17. In Article 66(2)(c) of the Treaty of ECOWAS to which the Gambia is also a party, it is provided that states parties should ensure “respect for the right of journalists. It is obvious that amongst those rights is the right to freedom of expression.
19. Section 7 of the Draft Bill makes it an offence to use a computer system to “repeatedly cause fear, intimidation, humiliation or other damage or harm” to a person’s “health, emotional well-being, self-esteem or reputation.” We note that the notions of harm to “emotional well-being, self-esteem or reputation” are highly vague, subjective, and nowhere defined in the Bill or in international law.
20. A similar provision appears in section 6(1)(c), which prohibits using a computer to “bully, abuse or make derogatory statements against a person” (without a requirement of actually causing harm).
21. Sections 6 and 7 appear to contain redundant provisions which may be therefore subjected to separate and duplicate criminal penalties. It is worth emphasizing that there are absolutely no safeguards for public interest investigations or news reporting. While ‘cyberbullying’ appears in the definitions section of section 2, this ‘definition’ merely repeats the language of section 7 in a circular manner, adding that anyone “assisting” or “encouraging” such conduct is also guilty of cyberbullying. It is unclear what it means to ‘encourage’ one to cause fear or harm to someone’s reputation, and this captures a potentially limitless amount of conduct. Under this framing, a member of the public who is simply commenting or reposting a critical news article exposing the misdeeds of a government official could be deemed to be providing ‘assistance’ or ‘encouragement’ for bullying that official.
22. It is notes that most investigative journalism that exposes misconduct of an official for the public benefit can be said to make “derogatory” statements or “harm” the reputation or “self-esteem” of the individual exposed. The problem with overcriminalization of these concepts is that they are inherently difficult to define, highly subjective, and extremely vulnerable to misuse. In the context of the Gambia’s recent crackdowns on expression, critics and dissidents themselves may rightfully fear being accused of ‘harassment’. (See Article 19 analysis on the Bill)
23. Section 8(1) punishes using a computer to acquire “sexually explicit” photos, videos, or representations of another person without their consent or knowledge. The following provision further punishes using a computer to intimidate, coerce, or harass an individual by using that content. Provisions 8(4) and 8(5) provide for additional procedural protections for the confidentiality of victims, including preventing the publication of identifying information.
24. While this provision would appear intended to protect victims of non-consensual sharing of images (often referred to as ‘revenge porn’), it is framed so broadly to actually potentially punish victims of abuse by perpetrators who are authority figures. For example, if a survivor of abuse has documented abuse of a sexual nature, transmitting evidence of such abuse in an effort to gain access to justice could be criminalized under the Bill. Criminalizing acts cannot be justified if their purpose or effect is to prevent legitimate criticism of public figures, the exposure of corruption, official wrongdoing, or to protect the reputation of heads of state or other public officials or public figures. Worse, the ‘privacy’ and anonymity protections could be abused by officials or public figures to anonymously bring criminal claims against those who report on evidence of abuse. Section 8 provides no safeguards to protect against this scenario.
25. Section 8(1) is also overly broad in its definition of “sexually explicit content,” which includes a “digital representation.” This could include artistic expression and satire as forms of “representation,” and provide a criminal cause of action for authority figures to respond to satire against them.
26. Section 12(1) of the draft Bill punishes any person who “does an unauthorized act” in relation to a computer system or data, where they “know” that it is unauthorized. Section 12(5) provides convoluted definitions including that a “reference to doing an act includes causing an act to be done,” and that an “act” includes a “series of acts.” Nowhere is it defined what an “act” entails, neither is the fact that an “act” must merely be in “relation” to a computer system clarified. There is no clarity at all on what conduct 12(1) criminalizes, and as such, it fails the test of legality.
27. Taking a broad reading, the breadth of such provisions as written might be abused to punish a journalist who publishes leaked text messages or incriminating photos of a government official, who then claims that it is an “unauthorized” use of their data.
28. Section 13 of the draft Bill provides strict liability for the manufacture, sale, receipt, or distribution of systems or data “without authorization” which are “designed primarily for the purpose of committing an offence.” Sections 13(2)-(3) go further to indicate that the mere possession of such data, including a “document” recording the computer data, is itself an offence. These are punishable by up to three years imprisonment.
29. This provision is extremely dangerous; it completely re-writes “computer misuse” in Article 6 of the Budapest Convention into a strict liability offence criminalizing digital security technology. The key difference is that the Budapest Convention requires that production or sale be conducted with the intent to commit an offence, rather than simply that the device, program, or code is “designed” for an offence. We emphasize that section 13 has no intent requirement.
30. Computer programs and data, by their nature, are typically use-agnostic[3] (i.e., not necessarily designed with static end-uses in mind). Technologies are more often than not ‘dual use’, meaning that they may often be used for positive or negative purposes, just as a hammer might be used as either a tool or a weapon. This is the reason that the Budapest Convention includes not only an intentionality requirement, but also an explicit carve-out stating that criminal liability does not apply to instances where technologies are not acquired for committing of offences, such as for “authorized testing or protection of a computer system.”
31. Indeed, section 13 would threaten to criminalize not only legitimate security research, but also digital security tools that individuals may use to protect themselves from malicious cyber activities. Further, it would criminalize the use of privacy and anonymity tools; the dual-use nature of these tools may result in their users being accused of employing them for illicit activities. Journalists and human rights defenders routinely utilize encryption and anonymity tools in order to protect sources as well as their work and safety. (See Article 19 analysis of the Bill)
32. Section 15 of the draft Bill, relating to the liability of media and civil society organisations, contains an extremely problematic provision that attaches automatic criminal liability for actions taken by a corporation to its directors, managers, or those acting on the corporation’s behalf. Specifically, section 15(1) holds that any offence by a corporate body is “treated as committed” by any person listed in sub-parts (a) or (b) which include senior leadership or individuals acting as such. We are particularly concerned that this provision can be used to target the editors or leadership of media or civil society organizations for their statements, publications, or investigations online. The liability is effectively automatic because for key officers of an organization to escape they have the burden to prove, under section 15(2), that they did not “consent” or have “knowledge” and also conducted “due diligence” to prevent a violation “as ought to have been exercised having regard to the nature of the person’s functions and all the circumstances.” This goes well beyond any permissible mens rea[4] requirement for criminal liability, instead imposing a strict liability obligation for individuals to be actively investigating and preventing the conduct of others, whether or not it is known to them. In the context of media organizations, this can easily be used to criminally prosecute an editor-in-chief of a journalistic organization that is accused of publishing ‘false news’, as well as other key staff of the media outlet, if they do not conduct “due diligence” to prevent the story’s publication. Most of the time, under section 15’s language, mere knowledge of a story would be enough to hold an editor criminally liable. The same might occur against the leadership of a human rights organization providing an investigation on government misconduct that has significant public interest value but is deemed objectionable under the draft Bill. As a result, the provision on corporate liability effectively requires corporate entities to police themselves in order to escape liability.
33. Section 15 of the Bill further creates room for violation of the principle of presumption of innocence as guaranteed under section 24(3) (a) of the 1997 constitution of The Gambia which provides thus:
(3) Every person who is charged with a criminal offence_
(a) shall be presumed innocent until he or she is proved, or has pleaded guilty.
Accordingly, the legal burden of proof in any criminal case lies on the prosecution throughout the case. The legal burden in criminal cases never shift. Thus, any law that reverse the presumption of innocence and imposes the burden of proof on the accused is unconstitutional. (See: decision of the Privy Council in the Attorney General of the Gambia v. Momodou Jobe. The reversion of the burden of proof as envision under section 15 of the Bill is therefore in clear violation of the 1997 constitution of the Gambia).
34. Section 16 of the Cybercrime Bill, 2023 grants broad authority to authorized persons to search and seize computer systems, programs, data, or storage mediums if there are reasonable grounds to believe they contain evidence of an offence or has been acquired through the commission of an offence. While the need for a court warrant is essential as it provides for judicial oversight over the exercise of this power, the requirement for ex-parte[5] application for this warrant means that the target of the search and seizure would not be notified in advance. This could lead to situations where individuals are unaware of actions being taken against them, potentially violating their rights to due process and fair trial. We also see a repeat of the ex-parte warrant provisions in section 17 (6) on “real-time collection of traffic data”, and section 18 (2) on “interception of content data”.
35. Section 16, Subsection 6 also mandates the use of reasonable force during seizures, the interpretation of what constitutes "reasonable force" could vary and may lead to excessive use of force in some cases, potentially infringing on the rights of individuals.
36. Section 4, Subsection 7 also includes penalties for obstructing the exercise of powers granted under the section, with fines and imprisonment as potential consequences. While it's essential to deter obstruction of justice, the severity of the penalties could potentially discourage legitimate forms of protest or resistance against unjust searches or seizures.
RECOMMENDATIONS
37. In due regard to the 1997 Constitution, conventions and treaties to which The Gambia is a party, we hereby recommend the following:
I. The provisions in Section 6 1(a) and subsections (b) and (c) of the Cybercrime Bill, 2023 should either be removed entirely or revised to ensure they do not infringe upon fundamental rights and freedoms.
II. Sections 5, 6 and 7 must be stricken entirely. They consistently fail the tripartite test of permissible restrictions of expression, particularly the test of legality in that they contain vague and overbroad prohibitions that have been routinely rejected under international standards. Many restrictions do not pursue a legitimate aim as explicitly enumerated in Article 19 paragraph 3 of the ICCPR. Further, they constitute cyber-enabled, rather than cyberdependent offences, and as such are inappropriate to include in a cybercrime law.
III. Strike[6] section 12 entirely, which fails the test of legality and is so broadly worded that it would criminalize public interest journalism or reporting.
IV. Strike section 13 as written, which does not track any existing internationally or regionally accepted cybercrime, and would criminalize not only academic and security research but also the widespread use of digital security and anonymity tools by journalists and human rights defenders.
V. Section 15 must be stricken as written; individual criminal liability for corporate actions should never automatically attach in a “guilty unless proven innocent” manner, but instead must require specific intent to cause an identifiable harm that is justified under international standards.
VI. That the Cybercrime Bill, 2023 be subjected to a thorough review in line with principles of freedom of expression[7] and international human rights standards and principles[8]
VII. That the Education Committee’s public consultations on Cybercrime Bill, 2023 be widened to involve all relevant stakeholders including the National Human Rights Commission, Gambia Bar Association, Female Lawyers Association, consumer groups like the Consumer Protection Alliance, and political parties etc.
CONCLUSION
The Gambia Press Union expresses its fervent hope that the National Assembly would give due consideration to its position on the way forward as articulated in this document.
[1] Committee on the Rights of the Child, General comment No. 20 (2016) on the implementation of the rights of the child during adolescence, (CRC/C/GC/20), https://undocs.org/en/CRC/C/GC/20 , para 40.
[2] https://www.article19.org/wp-content/uploads/2024/03/Analysis-the-Gambia-Cybercrime-Bill-2023-26-March-2024.pdf
[3] https://www.techtarget.com/whatis/definition/agnostic
[4] https://ojen.ca/wp-content/uploads/OJEN-Mens-Rea-and-Actus-Reus-Resource_0.pdf
[5] https://dictionary.law.com/default.aspx?selected=696
[6] https://dictionary.findlaw.com/definition/strike.html
[7] https://www.cidh.oas.org/basicos/english/basic21.principles%20freedom%20of%20expression.htm
[8] https://www.humanrightscommission.ky/human-rights-principles
