On 1 July 2020, the National Council of Provinces (NCOP) passed the Cybercrimes Bill, which now awaits president Cyril Ramaphosa’s assent.
While a number of electronic crimes are already covered by existing legislation, law firm Cliffe Dekker Hofmeyr noted that should the bill be passed by the president it will effectively criminalise the following types of cybercrimes:
- Malicious communications – being the distribution of data messages with the intention to incite the causing of damage to any property belonging to, or to incite violence against, or to threaten a person or group of persons, including the distribution of “revenge porn”.
- Unlawful access – which includes the unlawful and intentional access to data, a computer program, a computer data storage medium or a computer system (commonly referred to as “hacking”);
- Unlawful interception of data – which includes the acquisition, viewing, capturing or copying of data of a non-public nature through the use of hardware or software tools;
- Unlawful acts in respect of software and hardware tools – being the unlawful and intentional use or possession of software and hardware tools that are used in the commission of cybercrimes (such as hacking and unlawful interception);
- Unlawful interference with data, computer programs, storage mediums and computer systems – being the unlawful and intentional interference with data, a computer program, a computer data storage medium or computer system;
- Cyber fraud – being fraud committed by means of data or a computer program or through any interference with data, a computer program, a computer data storage medium or a computer system;
- Cyber forgery – being the creation of false data or a false computer program with the intention to defraud;
- Cyber uttering – being the passing-off of false data or a false computer program with the intention to defraud.
Cliffe Dekker Hofmeyr said that the bill also prescribes the sentences that offenders will be liable to on conviction of the cybercrimes created by the bill.
These include fines and/or imprisonment ranging from five to 10 years, with aggravated offences attracting imprisonment of up to 15 years.
“In the case of the offences of cyber fraud, cyber forgery and uttering, the Bill provides for broad penalties that could be imposed for anyone found guilty of any of these cybercrimes where a court will have a discretion to impose a penalty that it deems appropriate under section 276 of the Criminal Procedure Act 51 of 1977,” it said
“Such penalties may include a fine (unspecified), imprisonment, a declaration as a habitual criminal and correctional supervision.”
Obligations for businesses
Cliffe Dekker Hofmeyr said that the Cybercrimes Bill does not simply prescribe offences and penalties to regulate criminal conduct but also imposes obligations on businesses in general and on electronic communications service providers (ECSPs) and financial institutions in relation to the commission of cybercrime.
“ECSPs and financial institutions will have obligations in relation to (i) the reporting of cybercrimes and (ii) the preservation of evidence in relation to the commission of cybercrime,” it said.
“Any ECSPs or financial institutions that fail to comply with such obligations could be found guilty of an offence and be liable on conviction to a fine not exceeding R50,000.”
Businesses who may fall victim to a cybercrime or who, for example, have an employee who commits a cybercrime, are required to offer cooperation and assist law enforcement officials in any investigations they may conduct, the firm said.
“Such businesses may be required to comply with search warrants and/or maybe called to comply with directions issued by the court to furnish particulars to the court relating to the computer systems involved in a cybercrime and/or may be requested to comply with court directions to preserve data or evidence relevant in a cybercrime investigation.”
Commentary by Preeta Bhagattjee (director), Aphindile Govuza (senior associate) and Liam Sebanz (associate designate) of law firm Cliffe Dekker Hofmeyr.