S.Africa’s new cybercrimes laws that can land you in jail for a LONG TIME!
President Cyril Ramaphosa recently proclaimed that several sections of the Cybercrimes Act came into force on 1 December, introducing a new set of offences for crimes committed online.
Some of these new crimes introduced by the new law carry stiff penalties of up to 15 years in jail.
Other crimes now have an explicit “cyber” definition—like theft, fraud, forgery, and extortion—while retaining the sentences of their non-cyber counterparts of up to 25 years in jail.
Technology law specialists have broadly welcomed the new law, though they have raised questions about law enforcement’s capacity to make arrests and prosecute these crimes.
Certain sections of the Act could not yet be put into operation as they require regulations that are still to be finalised, the department of justice has stated.
These sections include, amongst others, those relating to protection orders against the harmful disclosure of pornography and the establishment of a functional point of contact within the SAPS to coordinate cybercrime investigations, and to facilitate international cooperation.
The remaining sections will be put into operation once the regulations have been finalised.
“Cybercrime is a reality of the world we live in,” said justice minister Ronald Lamola.
“More and more criminals are exploiting the internet and online means to commit a diverse range of crimes. We therefore need to make cyberspace safer and more secure.”
The crimes contained in the Act and the maximum sentences applicable for each are summarised below.
Unlawful access — 5 years
Any person who unlawfully and intentionally accesses a computer system or a computer data storage medium is guilty of an offence.
Enabling an attacker — 5 years
Enabling someone to gain unlawful access to a system, intercept data, exploit or hack a computer program, or interfere with a storage medium is also guilty of an offence
Unlawful interception of data — 5 to 15 years
5 years — If you are found in possession of data where there is a reasonable suspicion that it was intercepted unlawfully, and you can’t give a satisfactory explanation of how you came by the data, you are guilty of an offence.
10 years — If you knowingly possess unlawfully intercepted data, you are guilty of an offence.
10 to 15 years — If you unlawfully intercept data, you are guilty of an offence. If you knowingly intercepted data from a restricted computer system, you are liable for an aggravated sentence of up to 15 years.
A restricted system is defined as one belonging to a financial institution, an organ of state, and any system protected by security measures to prevent unauthorised use.
Possession or use of software or hardware tool for cybercrime — 10 years
It is an offence to intentionally use or possess any software or hardware tool for:
Enabling another attacker
Unlawfully accessing a system
Intercepting data
Interfering with a data storage medium
Acquiring a password to use in any of the above activities
Unlawful interference with data or computer program — 10 to 15 years
Any person who unlawfully and intentionally interferes with data or a computer program is guilty of an offence.
Interference with data or a computer program is defined as follows:
Deleting
Altering
Rendering vulnerable
Damaging or deteriorating
Rendering meaningless, useless or ineffective
Obstructing, interrupting or interfering with the lawful use
Denying access
If you knowingly interfered with a restricted computer system, you are liable for an aggravated sentence of up to 15 years.
A restricted system is defined as one belonging to a financial institution, an organ of state, and any system protected by security measures to prevent unauthorised use.
If you could have reasonably known that your actions endangered someone’s life, might have caused serious risk to health or safety, or caused a public emergency, you are also liable for an aggravated sentence of up to 15 years.
Unlawful interference with a computer data storage medium or computer system — 10 to 15 years
You are guilty of an offence if you alter any resource or interrupt or impair a data storage medium or computer system’s functioning, confidentiality, integrity, or availability.
If you knowingly interfered with a restricted computer system, you are liable for an aggravated sentence of up to 15 years.
A restricted system is defined as one belonging to a financial institution, an organ of state, and any system protected by security measures to prevent unauthorised use.
If you could have reasonably known that your actions endangered someone’s life, might have caused serious risk to health or safety, or caused a public emergency, you are also liable for an aggravated sentence of up to 15 years.
Passwords — 5 to 15 years
10 to 15 years — Unlawful acquisition, possession, provision, receipt or use of a password, access code or similar data or device is an offence.
The passwords in question must be for use in:
Unlawful access
Interception of data
Interfering with a program, system, or storage medium
Fraud, forgery, or uttering
If you knowingly interfered with a restricted computer system, you are liable for an aggravated sentence of up to 15 years.
A restricted system is defined as one belonging to a financial institution, an organ of state, and any system protected by security measures to prevent unauthorised use.
5 years — If you are found in possession of a password where there is a reasonable suspicion that it was used or will be used in a crime and you can’t give a satisfactory explanation of how you got the password, you are guilty of an offence.
Theft of incorporeal property — up to 25 years
Incorporeal property must now be considered under the interpretation of the common law offence of theft.
Some legal professionals have said that this provision might apply to copyright infringement, but others have argued that piracy does not constitute theft.
Instead, they said this provision applies to digital goods that you might be totally deprived of if someone breaks into your accounts and takes them — such as video game items, cryptocurrencies, and non-fungible tokens.
According to legal insurance provider Law for All, sentences for offences related to extortion, fraud, forgery, uttering, and theft depend on the severity and record of the perpetrator.
If the crime involves:
Amounts over R500,000;
Amounts over R100,000 and was committed by people, a syndicate, or enterprise furthering a common purpose or conspiracy; or
Amounts over R10,000 and the offender is a law enforcement officer
The minimum sentence is 15 years for a first-time offence.
Second-time offenders get 20 years in prison, and a third-time offender would get 25 years.
Cyber fraud — up to 25 years
You can be found guilty of cyber fraud if you unlawfully and with the intention to defraud make a misrepresentation that causes actual or potential prejudice to another person.
It is considered cyber fraud if a computer system or data was used in perpetrating the crime, or if the crime was committed through any interference with data or a computer program.
Depending on the court hearing the case, fraud can result in a sentence of ten, twenty, or even 25 years.
Cyber forgery and uttering — up to 25 years
Any person who unlawfully and with the intention to defraud makes false data, or a false computer program to the actual or potential prejudice of another person, is guilty of the offence of cyber forgery.
Similarly, any person who unlawfully and with the intention to defraud passes off false data or a false computer program to the actual or potential prejudice of another person, is guilty of the offence of cyber uttering.
According to legal insurance provider Law for All, sentences for offences related to extortion, fraud, forgery, uttering, and theft depend on the severity and record of the perpetrator.
If the crime involves:
Amounts over R500,000;
Amounts over R100,000 and was committed by people, a syndicate, or enterprise furthering a common purpose or conspiracy; or
Amounts over R10,000 and the offender is a law enforcement officer
The minimum sentence is 15 years for a first-time offence.
Second-time offenders get 20 years in prison, and a third-time offender would get 25 years.
Cyber extortion — up to 25 years
Cyber extortion is defined as someone committing or threatening to commit a cybercrime to gain advantage or compel you to perform or abstain from any act.
The specific cybercrimes a blackmailer might threaten for it to be considered extortion are: unlawful access and unlawful interference with a computer system, program, data, or storage medium.
If you could have reasonably known that your actions endangered someone’s life, might have caused serious risk to health or safety, or caused a public emergency, you are also liable for an aggravated sentence.
According to legal insurance provider Law for All, sentences for offences related to extortion, fraud, forgery, uttering, and theft depend on the severity and record of the perpetrator.
If the crime involves:
Amounts over R500,000;
Amounts over R100,000 and was committed by people, a syndicate, or enterprise furthering a common purpose or conspiracy; or
Amounts over R10,000 and the offender is a law enforcement officer
The minimum sentence is 15 years for a first-time offence.
Second-time offenders get 20 years in prison, and a third-time offender would get 25 years.
Malicious communications — 3 years
The Act also criminalises what it terms “malicious communications”. It defines three types of messages as malicious:
Data message which incites damage to property or violence
Data message which threatens persons with damage to property or violence
Disclosure of a data message containing an intimate image
The Cybercrimes Act defines “violence” as bodily harm, and “damage to property” as damage to corporeal or incorporeal property.
Data messages include communications sent over private platforms like WhatsApp, and public social media services like Facebook and Twitter.
Contravening these provisions could result in a fine and up to three years imprisonment.