Computer Crime Proclamation No. 958/2016

The Computer Crime Proclamation No. 958/2016 is Ethiopia's principal cybercrime statute. It was adopted by the House of Peoples' Representatives and entered into force on 7 July 2016 on publication in the Federal Negarit Gazette, replacing the narrower computer-crime provisions previously contained in the 2004 Criminal Code. The Proclamation groups offences into several categories. Crimes against computer systems and computer data cover illegal access, illegal interception, and interference with computer data or systems (including causing damage, deletion, alteration or denial of service). Computer-related crimes cover computer-related fraud and forgery and the dissemination or use of access codes and devices designed to commit offences. Content-related crimes cover the production, dissemination and possession of child pornography, the dissemination through a computer system of material inciting or threatening public security or that is defamatory, and the sending of spam. The Proclamation also provides for aggravated penalties (for example where critical infrastructure is targeted) and for the criminal liability of service providers who fail to act against illegal content of which they are aware. On the procedural side, Part Three (preventive and investigative measures) empowers the public prosecutor and police to investigate, requires service providers to retain traffic data and subscriber information for up to one year and to cooperate with investigations, and allows interception and real-time collection of data and warrant-based sudden searches and digital forensic investigation; the Information Network Security Agency (INSA) provides technical support, conducts digital forensics, and may take protective measures over computer systems and critical infrastructure. Part Four governs evidentiary and procedural matters, including the admissibility of digital evidence, and Part Five designates the institutions responsible for following up computer-crime cases - principally the public prosecutor, the police and INSA. The Proclamation has been criticised by civil-society organisations for the breadth of its content-related offences and surveillance powers and their implications for privacy and freedom of expression.

1. 1Crimes against computer systems and data: illegal access, illegal interception and data/system interference (incl. damage and denial of service)
2. 2Computer-related fraud and forgery and misuse of access codes/devices
3. 3Content offences: child pornography, dissemination of inciting or defamatory content via a computer system, and spam
4. 4Aggravated penalties (e.g. attacks on critical infrastructure) and criminal liability of service providers
5. 5Service-provider duties to retain traffic data and subscriber information (up to one year) and to cooperate with investigations
6. 6Investigative powers: interception, real-time data collection and warrant-based sudden searches and digital forensics
7. 7INSA provides technical support and digital forensics; public prosecutor and police investigate and prosecute (Parts Three to Five)