Cybercrime Combating Law 2018 (as amended 2020) / Law Combating Cybercrimes (Sudan)

Sudan's Law Combating Cybercrimes of 2018, substantially amended on 13 July 2020, is the country's principal cybercrime statute. It was approved by the National Council in 2018 and repealed the earlier Computer Crimes (Informatic Offences) Act of 2007. The 2020 amendment increased penalties for numerous offences, for example raising the maximum term under Article 23 from one year to four years, and broadened the law's reach, particularly in relation to online content. (Sudan's Ministry of Justice has been criticised for not publishing the 2018 law in the Official Gazette; the most reliable accessible primary text is the REDRESS English translation of the July 2020 amendments to the Official Gazette.) The law criminalises the core cyber-dependent offences. Unauthorised access to a website or information system with intent to consult or copy is punishable by imprisonment up to two years or a fine, while deletion, destruction or alteration of data carries imprisonment up to four years or a fine. Aggravated treatment applies to public employees who access systems without authorisation (up to five years). The law contains enhanced penalties for offences touching national security or the national economy: deliberately accessing a site or system to obtain data affecting national security or the national economy is punishable by up to seven years' imprisonment, rising to up to ten years where such information is deleted or altered. Alongside these computer-integrity offences, the law criminalises a broad set of content offences. Most controversially, it penalises the publication of rumours, news or reports known to be false that aim to spread fear, threaten public peace, or diminish the prestige of the State, an offence carrying imprisonment (increased under the 2020 amendment) or a fine. These provisions, together with the increased penalties, have drawn sustained criticism from the Committee to Protect Journalists, ARTICLE 19 and Global Voices, who report the law's use against journalists and online critics under the banner of combating “fake news”, giving it a pronounced digital-rights dimension. Enforcement runs through Sudan's ordinary criminal justice institutions, the police, prosecution and courts, supported by specialised cybercrime units. The law provides Sudan's substantive and procedural basis for investigating and prosecuting offences against the confidentiality, integrity and availability of data and systems, as well as ICT-enabled content offences.

1. 1Principal cybercrime statute (2018, amended 13 July 2020); repealed the 2007 Computer Crimes / Informatic Offences Act
2. 2Criminalises unauthorised access to a website or system to consult/copy (up to 2 years or fine) and deletion/destruction/alteration of data (up to 4 years or fine)
3. 3Aggravated penalties for public employees accessing systems without authorisation (up to 5 years)
4. 4Enhanced penalties for national-security/national-economy offences: up to 7 years for accessing such data, up to 10 years for deleting or altering it
5. 5Criminalises publication of false news/rumours intended to spread fear, threaten public peace or diminish the prestige of the State (penalties increased in 2020)
6. 62020 amendment raised maximum terms across offences (e.g. Article 23 raised from 1 to 4 years); criticised by CPJ, ARTICLE 19 and Global Voices for use against journalists and critics