Cybercrimes (Prohibition, Prevention, Etc) Act, 2015

EXPLANATORY MEMORANDUM

The Act provides an effective, unified and comprehensive legal, regulatory and institutional framework for the prohibition, prevention, detection, prosecution and punishment of cybercrimes in Nigeria. This act also ensures the protection of critical national information infrastructure, and promotes cyber security and the protection of computer systems and networks, electronic communications, data and computer programs, intellectual property and privacy rights.

Arrangement of Sections

PART I-OBJECT AND APPLICATION

1. Objectives.

2. Application.

PART II- PROTECTION OF CRITICAL NATIONAL INFORMATION INFRASTRUCTURE

3. Designation of certain computer systems or networks as critical national information infrastructure.

4. Audit and Inspection of critical national information infrastructure.

PART III - OFFENCES AND PENALTIES

5. Offences against critical national information infrastructure.

6. Unlawful access to a computer.

7. Registration Of cybercafé.

8. System interference.

9. Interception of electronic messages, email, electronic money transfers.

10 Tampering with critical infrastructure.

11 Wilful misdirection of electronic messages.

12 Unlawful interceptions.

13. Computer related forgery.

14. Computer related fraud.

15. Theft of Electronic Devices.

16. Unauthorised modification of computer systems, network data and system interference.

17. Electronic Signature.

18. Cyber terrorism.

19. Exceptions to financial institutions posting and authorised options.

20. Fraudulent issuance of e-instructions.

21. Reporting of cyber threats.

22. Identity theft and impersonation.

23. Child pornography and related offences.

24. Cyberstalking.

25. Cybersquatting.

26. Racist and xenophobic offences.

27. Attempt, conspiracy, aiding and abetting.

28. Importation and fabrication of e-tools.

29. Breach of confidence by service providers.

30. Manipulation of ATM/POS Terminals.

31. Employees Responsibility.

32. Phishing, spamming, spreading of computer virus,

33. Electronic cards related fraud.

34. Dealing in card of another.

35. Purchase or sale of card of another.

36. Use of fraudulent device or attached e-‐mails and websites.

PART IV-DUTIES OF FINANCIAL INSTITUTIONS

37. Duties of financial institutions.

38. Records retention and protection of data.

39. Interception of electronic communications.

40. Failure of service provider to perform certain duties.

PART V-ADMINISTRATION AND ENFORCEMENT

41. Co-ordination and enforcement.

42. Establishment of Cybercrime Advisory Council.

43. Functions and powers of the Council.

44. Establishment of National Cyber Security Fund.

PART VI-ARREST, SEARCH, SEIZURE AND PROSECUTION

45. Power of arrest, search and seizure

46. Obstruction and refusal to release information.

47. Prosecution of offences.

48. Order of forfeiture of assets.

49. Order for payment of compensation or restitution.

PART VII-JURISDICTION AND INTERNATIONAL CO- ‐ OPERATION

50. Jurisdiction.

51. Extradition.

52. Request for mutual assistance

53. Evidence pursuant to a request.

54. Form of request from a foreign state.

55. Expedited Preservation of computer data.

56. Designation of contact point.

PART VIII-MISCELLANEOUS

57. Regulations

58. Interpretations

59. Citation.

SCHEDULES

CYBERCRIMES (PROHIBITION, PREVENTION, ETC) ACT, 2015

A Bill For An act to provide for the prohibition, prevention, detection, response, investigation and prosecution of cybercrimes; and for other related matters, 2015.

PART I-OBJECT AND APPLICATION - Objectives

1. The objectives of this Act are to-

Application

2. The provisions of this Act shall apply throughout the Federal Republic of Nigeria.

PART II-PROTECTION OF CRITICAL NATIONAL INFORMATION INFRASTRUCTURE

Designation of certain computer systems or networks as critical national information infrastructure

3. (1) The President may on the recommendation of the National Security Adviser, by Order published in the Federal Gazette, designate certain computer systems, and/or networks, whether physical or virtual, and/or the computer programs, computer data and/or Traffic data vital to this country that the incapacity or Destruction of or interference with such system and assets would have a debilitating impact on security, national or economic security, national public health and safety, or any combination of those matters as constituting Critical National Information Infrastructure.

Audit and Inspection of critical national information infrastructure

4. The Presidential Order made under section 3 of this Act may require the Office of the National Security Adviser to audit and inspect any Critical National Information Infrastructure at any time to ensure compliance with the provisions of this Act.

PART III-OFFENCES AND PENALTIES

Offences against critical national information infrastructure

5. (1) Any person who with intent, commits any offence punishable under this Act against any critical national information infrastructure, designated pursuant to section 3 of this Act, shall be liable on conviction to imprisonment for a term of not more than 10 years without an option of fine.

Unlawful access to a computer

6. (1) Any person, who without authorization, intentionally accesses in whole or in part, a computer system or network for fraudulent purposes and obtain data that are vital to national security, commits an offence and shall be liable on conviction to imprisonment for a term of not more than 5 years or to a fine of not more than N5,000,000.00 or to both fine and imprisonment.

Registration of Cybercafé

7. (1) From the commencement of this Act all operators of a cybercafé shall register as a business concern with Computer Professionals' Registration Council in addition to a business name registration with the Corporate Affairs Commission. Cybercafés shall maintain a register of users through a sign-in register. This register shall be available to law enforcement personnel whenever needed.

System Interference

8. Any person who without lawful authority, intentionally or for fraudulent purposes does an act which causes directly or indirectly the serious hindering of the functioning of a computer system by inputting, transmitting, damaging, deleting, deteriorating, altering or suppressing computer data or any other form of interference with the computer system, which prevents the computer system or any part thereof, from functioning in accordance with its intended purpose, commits an offence and shall be liable on conviction to imprisonment for a term of not more than 2 years or to a fine of not more than N5,000,000.00 or to both fine and imprisonment.

Intercepting Electronic Messages, Emails Electronic Money Transfers.

9. Any person who unlawfully destroys or aborts any Electronic mails or processes through which money and or valuable information is being conveyed is guilty of an offence and is liable to imprisonment for 7 years in the first instance and upon second conviction shall be liable to 14 years imprisonment.

Tampering with Critical Infrastructure.

10. From the commencement of this Act, any person being employed by or under a Local Government of Nigeria, private organization or financial institution with respect to working with any critical infrastructure, electronic mails commits any act which he is not authorized to do by virtue of his contract of service or intentionally permits, tampering with such computer, is guilty of an offence and is liable to a fine of N2,000,000.00 or imprisonment for 3 years.

Willful misdirection of Electronic Messages

11. Any person who misdirects electronic messages with either the intention to fraudulently obtain financial gain as a result of such act or with the intention of obstructing the process in order to cause delay or speeding the messages with a view to cause an omission or commission that may defeat the essence of such messages is guilty of an offence and is liable to imprisonment for Three Years or a fine of N1, 000,000.00 or both.

12. (1) Any person, who intentionally and without authorization, intercepts by technical means, non-public transmissions of computer data, content, or traffic data, including electromagnetic emissions or signals from a computer, computer system or network carrying or emitting signals, to or from a computer, computer system or connected system or network; commits an offence and shall be liable on conviction to imprisonment for a term of not more than 2 years or to a fine of not more than N5,000,000.00 or to both such fine and imprisonment.

Computer Related Forgery.

13. A person who knowingly accesses any computer or network and inputs, alters, deletes or suppresses any data resulting in inauthentic data with the intention that such inauthentic data will be considered or acted upon as if it were authentic or genuine, regardless of whether or not such data is directly readable or intelligible, commits an offence and is liable on conviction to imprisonment for a term of not less than 3 years or to a fine of not less than 7,000,000.00 or both.

Computer related fraud.

14. (1) Any person who knowingly and without authority or in excess of authority causes any loss of property to another by altering, erasing, inputting or suppressing any data held in any computer, whether or not for the purpose of conferring any economic benefits on himself or another person, commits an offence and is liable on conviction to imprisonment for a term of not less than 3 years or to a fine of not less than 7,000,000.00 or both fine and imprisonment.

Theft of Electronic Devices

15 (a) Any person who steals a financial institutions or Public Infrastructure Terminal commits an offence and shall be liable on conviction to imprisonment for a term of 3 years or a fine of N1,000,000.00 or to both fine and imprisonment.

Unauthorized modification of computer systems, network data and System interference

16. (1) Any person who with intent and without lawful authority directly or indirectly modifies or causes modification of any data held in any computer system or network, commits an offence and shall be liable on conviction to imprisonment for a term of not more than 3 years or to a fine of not more than N7, 000,000.00 or to both such fine and imprisonment.

Electronic Signatures

17. (1)(a) Electronic signature in respect of purchases of goods, and any other transactions shall be binding.

Cyber Terrorism

18(1) Any person that accesses or causes to be accessed any computer or computer system or network for purposes of terrorism, commits an offence and is liable on conviction to life imprisonment.

Exceptions to Financial Institutions, Posting and authorizations

19. (1) From the commencement of this Act, no financial institution shall give posting and authorizing access to any single employee.

Fraudulent issuance of E-Instructions

20. Any person being authorized by any financial institution and charged with the responsibility of using computer or other electronic devices for financial transactions such as posting of debit and credit, issuance of electronic instructions as they relate to sending of electronic debit and credit messages or charged with the duty of confirmation of electronic fund transfer, unlawfully with the intent to defraud issues false electronic or verbal messages is guilty of an offence and is liable to imprisonment for 7 years.

Reporting of Cyber Threats

21. (1) Any person or institution, who operates a computer system or a network, whether public or private, must immediately inform the National Computer Emergency Response Team (CERT) Coordination Center of any attacks, intrusions and other disruptions liable to hinder the functioning of another computer system or network, so that the National CERT can take the necessary measures to tackle the issues.

Identity theft and impersonation

22. (1) Any person who is engaged in the services of any financial institution, and as a result of his special knowledge commits identity theft of its employer, staff, service providers and consultants with the intent to defraud is guilty of an offence and upon conviction shall be sentenced to 7 years imprisonment or N5,000,000.00 fine or both.

Child pornography and related offences.

23. (1) Any person who intentionally uses any computer system or network in or for-‐

commits an offence under this Act and shall be liable on conviction-

Cyberstalking

24. (1) Any person who knowingly or intentionally sends a message or other matter by means of computer systems or network that-

commits an offence under this Act and shall be liable on conviction-‐

Cybersquatting

25. (1) Any person who, intentionally takes or makes use of a name, business name, trademark, domain name or other word or phrase registered, owned or in use by any individual, body corporate or belonging to either the Federal, State or Local Governments in Nigeria, on the internet or any other computer network, without authority or right, and for the purpose of interfering with their use by the owner, registrant or legitimate prior user, commits an offence under this Act and shall be liable on conviction to imprisonment for a term of not more than 2 years or a fine of not more than N5,000,000.00 or to both fine and imprisonment.

Racist and xenophobic offences

26. (1) Any person who with intent-

"Crime against humanity" includes any of the following acts committed as part of a widespread or systematic attack directed against any civilian population, with knowledge of the attack: murders, extermination, enslavement, deportation or forcible transfer of population, imprisonment, torture, rape, sexual slavery, enforced prostitution, forced pregnancy, enforced sterilization or any other form of sexual violence of comparable gravity, persecution against an identifiable group on political, racial, national, ethnic, cultural, religious or gender grounds, enforced disappearance of persons, the crime of apartheid, other inhumane acts of similar character intentionally causing great suffering or serious bodily or mental injury.

"Genocide" means any of the following acts committed with intent to destroy in whole or in part, a national, ethnic, racial or religious group as such: Killing members of the group, deliberately inflicting on the group conditions of life calculated to bring about its physical destruction in whole or in part; Imposing measures intended to prevent births within the group; Forcibly transferring children of the group to another group.

"racist or xenophobic material" means any written or printed material, any image or any other representation of ideas or theories, which advocates, promotes or incites hatred, discrimination or violence, against any individual group of individuals, based on race, color, descent or national or ethnic origin, as well as religion if used as a pretext for any of these factors.

Attempt, conspiracy, aiding and abetting

27. (1) Any person who-

Commits an offence and shall be liable on conviction to the punishment provided for the principal offence under this Act.

Importation and fabrication of E-Tools

28. (1) Any person who unlawfully produces, supplies, adapts, manipulates or procures for use, imports, exports, distributes, offers for sale or otherwise makes available-

Commits an offence and shall be liable on conviction to imprisonment for a term of not more than 3 years or a fine of not more than N7,000,000.00 or to both.

Breach of Confidence by Service Providers

29. (1) Any person or organization who being a computer based service provider and or vendor does any act with intent to defraud and by virtue of his position as a service provider, forges, illegally used security codes of the consumer with the intent to gain any financial and or material advantage or with intent to provide less value for money in his or its services to the consumer shall if corporate organization be guilty of an offence and is liable to a fine of N5,000,000.00and forfeiture of further equivalent of the monetary value of the loss sustained by the consumer.

Manipulation of ATM/POS Terminals

30. (1) Any person who manipulates an ATM machine or Point of Sales terminals with the intention to defraud shall be guilty of an offence and upon conviction sentenced to Five Years imprisonment or N5,000,000.00 fine or both.

Employees Responsibility

31. (1) Without prejudice to any contractual agreement between the employer and the employee all employees in both the public and private sectors must relinquish or surrender all codes and access rights to their employers immediately upon disengagement from their employment, and if such code or access right constitutes a threat or risk to the employer, it shall, unless there is any lawful reason to the contrary, be presumed that the refusal to relinquish or surrender such code or access right is intended to be used to hold such employer to ransom.

Phishing Spamming, Spreading of Computer Virus

32. (1) Any person who knowingly or intentionally engages in computer phishing shall be liable upon conviction to 3 years imprisonment or a fine of N1,000,000.00 or both.

Electronic Cards related fraud.

33. (1) Any person who with intent to defraud, uses any access device including credit, debit, charge, loyalty and other types of financial cards, to obtain cash, credit, goods or service commits an offence and shall be liable on conviction to imprisonment for a term of not more than 7 Years or a fine of not more than N5,000,000.00 or to both such fine and imprisonment and shall further be liable to payment in monetary terms the value of loss sustained by the owner of the credit card.

resulting in a loss or gain commits an offence and shall be liable on conviction to imprisonment for a term of not more than7 years or a fine of not more than N5,000,000.00 and forfeiture of the advantage or value derived from his act.

Dealing in Card of Another

34. Any person, other than the issuer, who receives and retains possession of two or more cards issued in the name or names of different cardholders, which cards he knows were taken or retained under circumstances which constitute a card theft commits an offence and is liable on summary conviction to 3 years imprisonment or to a fine of one N1,000,000.00and shall further be liable to repayment in monetary terms the value of loss sustained by the cardholder or forfeiture of the assets or goods acquired with the funds from the account of the cardholder.

Purchase or sale of Cad of Another

35. Any person other than an issuer or their authorized agent who sells a card or a person who buys a card from a person other than an issuer or their authorized agent commits an offence and is liable on summary conviction to a fine of N500,000.00 and shall further be liable to payment in monetary terms the value of loss sustained by the card holder or forfeiture of the assets or goods acquired with the funds from the account of the cardholder.

Use of Fraudulent Device or Attached E-mails and Websites

36. (1)Any person who with intent to defraud uses any device or attachment, e-mails or fraudulent website to obtain information or details of a cardholder commits an offence and upon conviction is liable to imprisonment for a period of 3 years or to a fine of N1,000,000.00 or both.

PART IV- ‐ DUTIES OF FINANCIAL INSTITUTIONS

Duties of Financial Institutions.

37. (1) A financial institution shall-

Records retention and protection of data

38. DUTIES OF SERVICE PROVIDERS

Interception of electronic communications

39. Where there are reasonable grounds to suspect that the content of any electronic communication is reasonably required for the purposes of a criminal investigation or proceedings, a Judge may on the basis of information on oath;

Failure of service provider to perform certain duties

40. (1) It shall be the duty of every service provider in Nigeria to comply with all the provisions of this Act and disclose information requested by any law enforcement agency or otherwise render assistance howsoever in any inquiry or proceeding under this Act.

PART V-ADMINISTRATION AND ENFORCEMENT

Co-ordination and enforcement.

41. (1) The office of the National Security Adviser shall be the coordinating body for all security and enforcement agencies under this Act and shall;

Establishment of the Cybercrime Advisory Council

42. (1) There is established, a Cybercrime Advisory Council (in this Act referred to as "the Council") which shall comprise of a representative each, of the Ministries and Agencies listed under the First Schedule to this Act.

Functions and powers of the Council

43. (1) The Council shall-

Establishment of National Cyber Security Fund

44. (1) There is established a Fund, which shall be known as the National Cyber security Fund (in this Act referred to as "The Fund").

Provided that the terms and conditions attached to such gifts, endowments, bequest or contributions will not jeopardize the functions of the Agency;

PART VI - ARREST, SEARCH, SEIZURE AND PROSECUTION

Power of arrest search and seizure

45. (1) A law enforcement officer may apply ex-parte to a Judge in chambers for the issuance of a warrant for the purpose of obtaining electronic evidence in related crime investigation.

Obstruction and refusal to release information

46. Subject to the provisions of the Constitution of the Federal Republic of Nigeria, any person who-

commits an offence and shall be liable on conviction to imprisonment for a term of 2 years or to a fine of not more than N500,000.00 or to both such fine and imprisonment.

Prosecution of offences

47. Subject to the powers of the Attorney General, relevant law enforcement agencies shall have power to prosecute offences under this Act. In the case of offences committed under sections 19 and 21 of this Act, the approval of the Attorney General must be obtained before prosecution.

Order of forfeiture of assets

48. (1) The Court in imposing sentence on any person convicted of an offence under this Act, may order that the convicted person forfeits to the Government of the Federal Republic of Nigeria-

Order for payment of compensation or restitution

49. In addition to any other penalty prescribed under this Act, the Court shall order a person convicted of an offence under this Act to make restitution to the victim of the false pretense or fraud by directing that the person that-

PART VII-JURISDICTION AND INTERNATIONAL CO-OPERATION

50. (1) The Federal High Court located in any part of Nigeria regardless of the location where the offence is committed shall have jurisdiction to try offences under this Act, if committed-

may, if proved, be taken into consideration by the Court as corroborating the testimony of witness in the trial.

Extradition

51. Offences under this Act shall be extraditable under the Extradition Act, CAP E25, Laws of the Federation of Nigeria, 2004.

Request for mutual assistance

52. (1) The Attorney-General of the Federation may request or receive assistance from any agency or authority of a foreign State in the investigation or prosecution of offences under this Act; and may authorize or participate in any joint investigation or cooperation carried out for the purpose of detecting, preventing, responding and prosecuting any offence under this Act.

Evidence pursuant to a request

53. (1) Any evidence gathered, pursuant to a request under this Act, in any investigation or proceedings in the court of any foreign State, if authenticated, shall be prima facie admissible in any proceedings to which this Act applies.

Form of request from a foreign state.

54. (1) A request under this Act shall be in writing, dated and signed by or on behalf of the person making the request.

Expedited Preservation of computer data

55. (1) Nigeria may be requested to expedite the preservation of electronic device or data stored in a computer system, or network, referring to crimes described under this Act or any other enactment, pursuant to the submission of a request for assistance for search, seizure and disclosure of those data.

Designation of contact point

56. (1) In order to provide immediate assistance for the purpose of international cooperation under this Act, the Office of the National Security Adviser shall designate and maintain a contact point that shall be available twenty-four hours a day and seven days a week.

PART VIII-MISCELLANEOUS

Regulations

57. (1) The Attorney General of the Federation may make orders, rules, guidelines or regulations as are necessary for the efficient implementation of the provisions of this Act.

Interpretation.

58. In this Act -

"access" means gaining entry into, instructing or communicating with the logical, arithmetical, or memory function resources of a computer system or network;

"Access Device" means and includes: Electronic cards such as:

"ATM" means Automated Teller Machine.

"authorized access"-

A person has authorized access to any program or data held in a computer if-

"Authorised Manufacturer" means a financial institution which or any other person who is authorised under any written law to produce a card;

"authorized officer or authorized persons" means a member of any law enforcement Agency or a person mandated by it, involved in the prohibition, prevention, elimination or combating of computer crimes and cyber security threats;

"Bank Card" means any instrument, token, device, or card whether known as a bank service card, banking card, cheque guarantee card, or debit card or by any other similar name, issued with or without a fee by an issuer for the use of the cardholder in obtaining goods, services, or anything else of value or for the use in automated banking device to obtain money or any of the services offered through the device;

"Card" means a bank card, credit card, or payment card;

"Cardholder" means the person named on the face of a bank card, credit card or payment card to whom or for whose benefit such a card is issued by an issuer;

"Card-Making Equipment" means any equipment, machine, plate, mechanism, impression, or any other device designed, used, or capable of being used to produce a card, a counterfeit card, or any aspect or component of a card;

"Computer" means an electronic, magnetic, optical, electrochemical or other high speed data processing device performing logical, arithmetic, or storage functions and includes any data storage facility. All communication devices that can directly interface with a computer through communication protocols shall form part of this definition. This definition excludes the following; portable hand-held calculator typewriters and typesetters or other similar devices;

"computer data" include every information including information required by the computer to be able to operate, run programs, store programs and store information that the computer user needs such as text files or other files that are associated with the program the computer user is running.

"computer program" or "program" means a set of instructions written to perform or execute a specified task with a computer;

"computer system" refers to any device or group of interconnected or related devices, one or more of which, pursuant to a program, Performs automated or interactive processing of data. It covers any type of device with data processing capabilities including, but not limited to, computers and mobile phones. The device consisting of hardware and software may include input, output and storage components which may stand alone or be connected in a network or other similar devices. It also includes computer data storage devices or media;

"Consumer" means every person or organization who enters into computer based purchase, lease transfer, maintenance and consultancy service agreements with a computer service provider and the customer and agent of the consumer. Consumers will also include bank account holders who carry financial cards;

"content data" means the actual information or message sent across during a communication session;

"Counterfeit Card" means a bank card, credit card or a payment card which is fictitious, altered, or forged and includes any facsimile or false representation, deception, or component of such a card, or any such card which is stolen, obtained as part of a scheme to defraud, or otherwise unlawfully obtained, and which may or may not be embossed with account information or an issuer's information;

"Countering Violent Extremism (CVE) Program includes any intervention designed to counter the persistence of violent radicalization to reduce the incidence of violent activities, change the behaviour of violent extremists, and counter the negative extreme groups while promoting core national values;

also any program that seeks to identify the underlying causes of radicalization (social, cultural, religious and economic) and develop strategies that provide solutions and also introduce measures to change the attitudes and perceptions of potential recruits, including providing vocational training of prisoners and means of sustainable livelihood and reintegration of reformed extremists to their families and communities'';

"Credit" includes a cash loan, or any other financial information;

"Credit Card" means any instrument, token, device, or card, whether known as a charge card or by any other similar name, issued with or without a fee by an issuer for the use of the cardholder in obtaining goods, services, or anything else of value on credit from a creditor or for use in an automated banking device to obtain money or any of the services offered through the device;

"Creditor" means a person or company that agrees or is authorised by an Issuer to supply goods, services, or anything else of value and to accept payment by use of a bank card, credit card, payment card for the supply of such goods, services or anything else of value to the cardholder;

"Critical infrastructure" means, systems and assets which are so vital to the country that the destruction of such systems and assets would have an Impact on the security, national economic security, national public health and safety of the country;

"Counterfeit access device" means counterfeit, fictitious, altered, or forged, or an identifiable component of an access device or a counterfeit access device;

"cyberstalking" a course of conduct directed at a specific person that would cause a reasonable person to feel fear;

"cybersquatting" The acquisition of a domain name over the internet in bad faith to profit, mislead, destroy reputation, and deprive others from registering the same, if such a domain name is:

"damage" means any impairment to a computer or the integrity or availability of data, program, system or information that-

"data" means representations of information or of concepts that are being prepared or have been prepared in a form Suitable for use in a computer;

"database" means digitally organized collection of data for one or more purposes which allows easy access, management and update of data;

"device" means any object or equipment that has been designed to do a particular job or whose mechanical or electrical workings are controlled or monitored by a microprocessor;

"electronic communication" includes communications in electronic format, instant messages, short message service (SMS), e-mail, video, voice mails, multimedia message service (MMS), Fax, and pager;

"electronic device" means a device which accomplishes its purpose electronically. This includes, computer systems, telecommunication devices, smart phones, access cards, credit cards, debit cards, loyalty cards etc;

"electronic record" means a record generated, communicated, received or stored by electronic, magnetic, optical or other means in an information system or for transmission from one information system to another;

"Electronic transfer of fund" means any transfer of funds which is initiated by a person by way of instruction, authorisation or order to a bank to debit or credit an account maintained with that bank through electronic means and includes point of sales transfers, automated teller machine transactions, direct deposits or withdrawal of funds, transfer initiated by telephone, internet and card payment;

"Expired Card" means a card which is no longer valid because the term shown of it has expired;

"Financial Institution" includes any individual, body, association or group of persons, whether corporate or unincorporated which carries on the business of investment and securities, a discount house, finance company and money brokerage whose principal object includes factoring project financing equipment leasing, debt administration, fund management, private ledger services, investment management, local purchase order financing, export finance, project consultancy, financial consultancy, pension fund management, insurance institutions, debt factorization and conversion firms, dealer, clearing and settlement companies, legal practitioners, hotels, casinos, bureau de change, supermarkets and such other businesses as the Central Bank or appropriate regulatory authorities may, from time to time, designate";

"Financial Transaction" means,

"function" includes logic, control, arithmetic, deletion, storage, retrieval and communication or telecommunication to, from or within a computer;

"Identity Theft" means, the stealing of somebody else personal information to obtain goods and services through electronic based transactions;

"Infrastructure Terminal" includes terminals shall include GSM Phones that can be used to access bank or any other sensitive information, Point of sales terminals (POS) and all other Card Acceptor Devices that are in use now or may be introduced in the future;

"Interception" in relation to a function of a computer system or communications network, includes listening to or recording of communication data of a computer or acquiring the substance, meaning or purport of such and any acts capable of blocking or preventing any of these functions;

"Issuer" includes a financial institution which or any other entity who is authorised by the Central Bank to issue a payment card;

"law enforcement agencies"- includes any agency for the time being responsible for implementation and enforcement of the provisions of this Act;

"Minister" means the Attorney-General of the Federation;

"Modification" means deletion, deterioration, alteration, restriction or suppression of data within computer systems or networks, including data transfer from a computer system by any means.

"network" means a collection of hardware components and computers interconnected by communications channels that allow sharing of resources and information;

"payment Card" means any instrument, token, device, or card, or known by any other similar name, and encoded with a stated money value and issued with or without a fee by an issuer for use of the cardholder in obtaining goods, services, or anything else of value, except money;

"person" includes an individual, body corporate, organisation or group of persons;

"President" means the President, Commander-in-Chief of the Armed Forces of the Federal Republic of Nigeria;

"Phishing" means the criminal and fraudulent process of attempting to acquire sensitive information such as usernames, passwords and credit card details, by masquerading as a trustworthy entity in an electronic communication through e-mails or instant messaging either in form of an email from what appears from your bank asking a user to change his or her password or reveal his or her identity so that such information can later be used to defraud the user;

"Purchasing Forged Electronic" Means of Credit/Debit Transfer Instruments Such as Credit Card, Debit Card, Smart Card, ATM or Other Related Electronic Payment System Devices;

"Receives" or "Receiving" means acquiring possession, title or control or accepting a card as security for credit;

"Revoked Card" means a card which is no longer valid because permission to use it has been suspended or terminated by the issuer, whether on its own or on the request of the cardholder;

"Service provider" means -‐

"Sexually explicit conduct" includes at least the following real or simulated acts-

It is not relevant whether the conduct depicted is real or simulated;

"Spamming" is an abuse of electronic messaging systems to indiscriminately send unsolicited bulk messages to individuals and corporate organizations;

"Traffic" means to sell, transfer, distribute, dispense, or otherwise dispose of property or to buy, receive, possess, obtain control of, or use property with the intent to sell, transfer, distribute, dispense, or otherwise dispose of such property; and

"traffic data"- means any computer data relating to a communication by means of a computer system or network, generated by a computer system that formed a part in the chain of communication, indicating the communication's origin, destination, route, time, date, size, duration, or type of underlying service.

Citation.

59. This Bill may be cited as the Cybercrime (Prohibition, Prevention, Etc.) Act, 2015.

FIRST SCHEDULE

[Section 42]

MEMBERS OF THE CYBERCRIME ADVISORY COUNCIL

SECOND SCHEDULE

Businesses which section 44 (2) (a) refers to are: