Introduction
Legal and regulatory framework
Proposed legislation
Comment
Recent developments around the world on the illegal interception of private communications have highlighted the need for Nigeria to establish a regulatory framework on interception.
This update considers:
- the current position on the interception of private communications;
- the extent to which existing Nigerian laws deal with this issue;
- the circumstances in which such communications may be lawfully accessed or intercepted; and
- the checks that have been put in place to ensure that there is strict compliance with the laws in view of the right to privacy.
Legal and regulatory framework
Currently, Nigeria has no specific law governing the interception of private communications in Nigeria. Two draft bills are pending before the National Assembly: the Interception and Monitoring Bill 2009 is before the Senate, while the Telecommunications Facilities (Lawful Interception of Information) Bill 2010 is before the House of Representatives.
The current position on the interception of private communications is governed by:
- the Nigerian Constitution (Chapter C23, Laws of Federation of Nigeria 2004, as amended);
- the Communications Act (Chapter N97, Laws of Federation of Nigeria 2004); and
- the Freedom of Information Act 2011.
Constitution
Section 37 of the Constitution provides for the protection of the privacy of all Nigerian citizens and their homes, correspondence, telephone conversations and telegraphic communications. Other than this general provision, the Constitution makes no provision for the manner in which citizens' privacy is to be protected or guaranteed. However, the protection and guarantee afforded by Section 37 is not absolute, and under Section 45(1) is subject to any law enacted by the National Assembly in respect of national security, defence, public safety or public order.
Communications Act
Section 147 of the Communications Act provides that the Nigerian Communications Commission (NCC) – the Nigerian telecommunications sector regulator – may determine that a licensee or class of licensees "shall implement the capability to allow authorised interception of communications and such determination may specify the technical requirements for authorised interception capability".
This means that the act recognises a situation when the NCC may direct licensees to permit the "authorised interception of communications" through their facilities. On a related note, Section 148 of the act permits the NCC to issue an order stipulating that any communication or class of communications to or from any licensee, person or the general public, relating to any specified subject, either shall not be transmitted or shall be intercepted or detained on grounds of national security or in the public interest.
Section 146(1) of the act also imposes an obligation on a licensee to use its best endeavours to prevent its network facilities or network service from being used in or in relation to the commission of any offence under any law in operation in Nigeria. At the written request of the NCC or any other authority, a licensee is required to assist the NCC or other authority:
"as far as [is] reasonably necessary in preventing the commission or attempted commission of an offence under any written law in operation in Nigeria or otherwise in enforcing the laws of Nigeria, including the protection of the public revenue and preservation of national security." (Section 146(2).)
To protect licensees from potential litigation by an affected subscriber, the act provides that a licensee shall not be liable in any criminal proceedings of any nature for any damage (including punitive damages), loss, cost or expenditure suffered or to be suffered (whether directly or indirectly) for any act or omission done in good faith in the performance of the duty imposed on it under Sections 146(1) and (2). However, it is unclear whether this protection extends to civil proceedings.
The Guidelines for the Provision of Internet Service issued by the NCC pursuant to the Communications Act require:
"all licensees providing internet services or any other related internet protocol based telecommunications service' to cooperate with 'all law enforcement and regulatory agencies investigating cybercrime or other illegal activity... [and to]provide any service related information requested by the [NCC] or other legal authority, including information regarding particular users and the content of their communications."
The NCC has engaged the services of external consultants to develop the regulatory, legal and technical framework for lawful interception in Nigeria. The framework is expected to establish rules in respect of access to private communications.
Freedom of Information Act
On May 31 2011 the president of Nigeria signed into law the Freedom of Information Act, with the aim of making public records and information freely available. Section 1 of the act provides that:
"Notwithstanding anything contained in any other act, law or regulation, the right of any person to access or request information, whether or not contained in any written form, which is in the custody or possession of any public official, agency or institution howsoever described is established."
However, the act prohibits the disclosure of certain information, such as personal information (ie, any official information held about any person), except in the circumstances specified under the act. The act defines 'information' to include any records, documents and information stored in any form, including written, electronic, visual images, sound and audio recordings.
With regard to the disclosure of information, Section 11(2) of the act provides that an application for information shall not be denied where the public interest in disclosing the information outweighs whatever injury that disclosure would cause. Section 14(2) of the act allows public institutions to disclose personal information where the person to whom it relates consents to such disclosure or where it is in the interest of the public to disclose such information. Under the act, 'public institutions' includes private bodies providing public services or performing public functions. This definition covers most limited liability companies providing public services.
The act prohibits the disclosure of certain information, such as personal information (ie, "any official information held about any person[/corporation]"), except in the circumstances specified under the act. Section 14(2) of the act allows public institutions to disclose personal information where the person to whom it relates consents to the disclosure, where the information is publicly available or where it is in the interest of the public to disclose such information.
Two draft bills are pending before the National Assembly: the Interception and Monitoring Bill 2009 is before the Senate, while the Telecommunications Facilities (Lawful Interception of Information) Bill 2010 is before the House of Representatives. If enacted, these laws will empower various security agencies to intercept phone calls, emails and telegraphic communications, as well as prohibiting certain telecommunication services which cannot be monitored.
Interception and Monitoring Bill
The Interception and Monitoring Bill applies to all communications, including written and call-related communications. The purpose of the bill is to:
"provide for the interception and monitoring of certain communications, to provide for the interception of postal articles and communications and for the monitoring of communications in the case of a serious offence or if the security or other compelling national interest is threatened, to prohibit the provision of certain telecommunication services which do not have the capacity to be monitored and to regulate authorised telecommunications monitoring."
Section 2 of the bill provides that no one may intentionally and without the consent or permission of the dispatcher intercept a communication which has been or is intended to be transmitted by telephone or in any other manner over a telecommunications system, or intentionally monitor any communication by means of a monitoring device, in order to collect confidential information on any person, body or organisation. However, Section 4 of the bill provides that an interception may be lawfully carried out by a police officer or a member of the armed forces or the State Security Service where an application has been made to a judge.
Procedure for interception
The bill contemplates that before making an ex parte application to the judge, a person seeking to execute an interception must have been given prior approval by a senior officer who is not below the rank of an assistant commissioner of police or a major general in the armed forces. The senior officer should also have been authorised to grant such approval by, as applicable, the inspector general of police, the chief of the defence staff or an officer in the State Security Service not below the equivalent rank of an assistant commissioner of police.
Conditions for grant of direction
A judge will be permitted to issue a direction only if he or she is satisfied, on the facts alleged in the application, that there are reasonable grounds to believe that:
- a serious offence has been, is being or is likely to be committed which cannot be investigated in another appropriate manner; or
- security or other compelling national interests are threatened or the gathering of information in relation to the threat is necessary.
Where these conditions are satisfied, the judge may direct that a particular communication which has been, is being or is intended to be transmitted by telephone or in any other manner over a telecommunications system be intercepted.
The application to the judge must be in writing and should contain full details of all facts and circumstances alleged by the officer or member concerned.
Duration of direction
Section 4(3) of the bill provides that a written direction may be issued for a period not exceeding three months. In cases of sufficient urgency, a judge may make an oral direction upon hearing an oral application, which must be confirmed in writing within 48 hours. A three-month extension of the period may be granted upon an application to the judge.
Penalty for unlawful interception
If the bill becomes law, it will provide for the imposition of either a monetary fine or imprisonment for a period for up to two years on anyone who unlawfully intercepts a communication. Section 15 also prescribes a penalty for any person executing a direction who unlawfully discloses any information which he or she obtained in the performance of a function under the act.
Other key provisions
Section 9 of the bill provides that if, in a specific case, only call-related information without actual monitoring of a communication is required, an authorised person (ie, an officer of at least the rank of assistant commissioner of police, major-general in the armed forces or a member of the State Security Service holding a post equivalent to an assistant commissioner of police) may, in writing, request the telecommunications service provider to provide such call-related information in respect of the relevant customer. 'Call-related information' includes switching, dialling or signalling information that identifies the origin, destination, termination, duration and equipment of each communication generated or received by a customer or user of any equipment, facility or service provided by a service provider and, where applicable, the location of the user within the telecommunications system.
A request for call-related information may be made only if the person making such request is satisfied that there are reasonable grounds to believe that information is necessary in an investigation relating to:
- the commission or alleged commission of a serious offence; or
- a threat or alleged threat to the security or other compelling national interest of the nation.
This draft provision appears to suggest that call-related information may be obtained by any of the authorised representatives indicated without an application being made to a judge or any further approval being obtained.
Under Section 10, notwithstanding the fact that a direction has been issued, a judge may, upon an application, issue a supplementary direction in which the service provider concerned is directed to provide call-related information on an ongoing basis for a specified duration, as it becomes available.
Telecommunications Facilities (Lawful Interception of Information) Bill 2010
The Telecommunications Facilities (Lawful Interception of Information) Bill 2010 is applicable only to telecommunications; it thus appears to exclude all other modes of communication (eg, letters).
The purpose of the bill is to ensure that telecommunications service providers can enable national security and law enforcement agencies to exercise their authority to intercept communications, and to require service providers to provide subscriber and other information, without unreasonably impairing:
- the privacy of individuals;
- the provision of telecommunications services to Nigerian citizens; or
- the competitiveness of the Nigerian telecommunications industry.
In addition, telecommunications service providers under the bill are obliged to acquire and install equipment or apparatus for the purpose of facilitating communication interception. The only exception is a telecommunications service provider which has fewer than 100,000 subscribers (Section 9 of the bill).
Under Section 2 of the bill, the following activities and service providers are excluded from the scope of application of the bill:
- a telecommunications service intended principally for the use of its provider and the provider's household or employees, and not by the public;
- telecommunications service providers whose principal function is operating:
- a registered charity within the meaning of that expression in the Income Tax Act (other than any service provider in a class listed in Schedule 2 of the bill);
- an educational institution, other than a post-secondary institution; and
- a hospital, a place of worship, a retirement home or a telecommunications services that are provided ancillary to their principal function; and
-
- telecommunications service providers that also provide broadcasting undertakings, as defined in the Broadcasting Act.
Under the bill, telecommunications service providers shall, in accordance with any regulations have the capability to:
- provide an intercepted communication to an authorised person (ie, a person having authority to intercept communications under the Police Act, the National Security Agencies Act, the Criminal Code or the Penal Code);
- if the intercepted communication is encoded, compressed, encrypted or otherwise treated:
- where the service provider has applied the treatment, either remove the treatment or, if the treatment cannot easily be removed using telecommunications facilities controlled by the service provider, provide the authorised person with the means to remove it; or
- where the treatment has been applied by another, either remove the treatment or, if the service provider does not control all means necessary to remove it, provide the authorised person with the means (other than transmission apparatus) to remove the treatment that the service provider controls;
-
- provide the authorised person with prescribed information that is in the possession or control of the service provider in respect of the location of equipment used in the transmission of the communication; and
- comply with any prescribed confidentiality or security measures in respect of interceptions (Section 3).
Procedure for interception
To obtain an interception, a request is made by a police officer or member of the State Security Service to a person:
"designated by the Inspector of General Police or Director-General of the State Security Service with authority to approach the service provider with a written request for any information in the service provider's possession or control regarding the name and address of any subscriber." (Section 13.)
The authority from a designated person may be dispensed with in cases of real urgency or necessity, or where he or she reasonably believes that in the circumstance the request cannot, with reasonable diligence, be made under Section 13.
The information that is provided by the service provider in response to the request shall not, without the consent of the individual to whom it relates, be used by the agency in which the designated person or police officer is employed, except for the purpose for which the information was obtained or for a use consistent with that purpose (Section 15).
Under Section 12 of the bill, the minister of justice may also issue an order to a service provider to provide an intercepted communication to an authorised person.
Conditions for grant of authority to make request
The conditions that must be satisfied before a request can be made are not expressly stated in the bill. However, Section 14 provides that in cases of real urgency or necessity, or where a police officer reasonably believes that in the circumstances, a request cannot with reasonable diligence be made under Section 13, the police officer may request a telecommunications service provider to provide the officer with the name and address of any subscriber, without the need first to obtain the authorisation of the designated person. The bill presumes generally that the relevant security agencies have a routine duty to make a request from a service provider.
The rationale behind the two legislative houses considering separate bills in respect of what appears to be the same subject matter is unclear. However, the bills will need to be combined at some point in the future. When passed into law, the combined bill should be able to perform the dual role of:
- facilitating and permitting interception for lawful purposes, generally in relation to criminal investigations and matters of national security; and
- prohibiting unauthorised interception or hacking of private communications.
This reflects the need to empower law enforcement and government security agencies with the necessary tools to carry out their functions on the one hand, while protecting the rights of individuals and businesses to enjoy privacy in their personal information and communications on the other.
For further information on this topic please contact Jumoke Lambo at Udo-Udoma & Belo-Osagie by telephone (+234 1 462 2307 10), fax (+234 1 462 2311) or email ([email protected]).