Law N° 60/2018 of 22/08/2018 on Prevention and Punishment of Cyber Crimes

Law N° 60/2018 of 22/08/2018 on Prevention and Punishment of Cyber Crimes is Rwanda's principal cybercrime statute. It was published in the Official Gazette of 25 September 2018 and entered into force on that date. The law provides a comprehensive framework of cyber-offences together with procedural powers for investigation and obligations on service providers, and it sits alongside Rwanda's broader cybersecurity institutional framework led by the National Cyber Security Authority (NCSA). The law criminalises a wide range of conduct, including unlawful access to a computer or computer system, unlawful interception of data, illegal data and system interference, and the production, sale or use of devices or computer programs designed to commit offences. It establishes computer-related offences such as electronic fraud and forgery, and a substantial body of content offences, including the publication of pornographic images (including child pornography), the publication of rumours or information that may incite fear or disorder, and the dissemination of information through a computer system that is contrary to public order or good morals. Several content and intermediary provisions (for example on website take-downs and prohibited content) carry significant digital-rights and free-expression implications. The law also addresses unlawful interception of communications, identity-related offences and the misuse of personal data, giving it a data-protection overlap. On procedure, the law imposes duties on service providers to inform users of cybercrime risks, to establish incident-reporting procedures, to preserve relevant data (with preservation generally up to 30 days, extendable on order), and to disclose electronic traffic or log data when directed by the prosecution authority. It empowers competent authorities to order hosting and hyperlink providers to remove or disable access to illegal information, and provides for search, seizure and preservation of electronic evidence and for cooperation in investigations. Institutionally, enforcement is carried out by the prosecution authority and investigative bodies (including the Rwanda Investigation Bureau), while the National Cyber Security Authority leads on cybersecurity policy, coordination and critical-infrastructure protection. The content-takedown, data-preservation and disclosure provisions make the law a focal point for debates on surveillance and online expression in Rwanda, and it operates alongside Law N° 058/2021 relating to the protection of personal data and privacy.

1. 1Criminalises unlawful access to computers/computer systems, unlawful interception, and illegal data and system interference.
2. 2Prohibits production, sale or use of devices and computer programs designed to commit cyber-offences, and creates electronic fraud and forgery offences.
3. 3Establishes content offences including child pornography, publication of rumours/information inciting fear or disorder, and content contrary to public order or good morals (with notable free-expression implications).
4. 4Imposes service-provider duties to report incidents, preserve data (generally up to 30 days, extendable) and disclose traffic/log data on the prosecution's direction.
5. 5Empowers authorities to order hosting/hyperlink providers to remove or disable access to illegal content.
6. 6Provides for search, seizure and preservation of electronic evidence and for investigative cooperation.