UG’s authoritarian cyber laws are facilitating the continuous blockage of Social Media & the Internet; UW Report

The Cover page of the New Cyber Laws analysis report by UW & CRD

Kampala, 16th/05/2016; Close to a dozen of cyber laws in Uganda have a direct impact on people’s right to privacy, use of the Internet and do not meet the 1995 Constitution and International Human Rights Standards according to the Unwanted Witness audit. The audit exercise which lasted for over six months used the 1995 Constitution of the Republic of Uganda, the Universal Declaration of Human Rights, the International Convention Civil and Political Rights, the Necessary and Proportionate International Principles and Africa declaration on Internet Rights & freedoms as bench-marks.

The laws being used include the Uganda Communications Commissions Act, 2013, which has since lacked regulations for it’s implementation. It has been used twice to block social media totally disregarding the citizens’ right to free speech and targeting the entire Internet, making free speech and privacy hard to be enjoyed in Uganda. The first blockage occurred on the elections eve on 17th of February 2016 lasting for a period of three days and the same blackout was experienced from 11th to 14th May 2016 ahead of President Museveni’s inauguration on 12th May 2016. The security apparatus, the regulator and Internet Service Providers hid under the UCC Act sec.7 (4) to curtail freedoms where orders to switch block or switch off the internet are not written.

According to the analysis report, the legislative process in Uganda is hurried without wide consultations and debate both within and outside parliament which would have reduced the plentiful noticed need to control rather than promoting and protecting citizens’ civil liberties, including the right to freedom of expression, access to information and privacy online. The said laws will continue to affect enjoyment of online freedoms and legitimized otherwise would be illegal practices by the state. That notwithstanding, the enactment of the said laws needed to conform to the international and national standards especially the 1995 Constitution of the republic of Uganda.

Article 29 (1), Uganda’s Constitution provides for the right to freedom of expression including the media. The Constitution also provides for the right of Access to Information in the possession of the state or any other organ or agency of the state under Article 41.

The right to freedom of expression goes hand in hand with the right to privacy, and this was recognised by the framers of the Uganda Constitution when they provided under Article 27 that; “no personal shall be subjected to unlawful search of the person, home or other property of that person or unlawful entry by others of the premises of that person”.

The article also provides that no person shall be subjected to interference with the privacy of that person’s home, correspondence, communication or other property.

Besides these domestic guarantors of the right to freedom of expression, there are a number of to key international instruments providing for the rights to freedom of expression including online freedoms. These including, the Universal Declaration of Human Rights (Article 19), the International Convention on Civil and Political Rights (Article 19(2)) as well as the African Declaration on Human and Peoples’ Rights (Article 9), the Joint Declaration on Freedom of Expression and the Internet , the African Declaration on Internet Freedom , among others.

It is noteworthy that the right to privacy as a fundamental human right central to the maintenance of democratic societies is also provided for under International human rights law to which Uganda is a signatory. It is an essential to human dignity and it reinforces other rights, such as freedom of expression and information, and freedom of association.

In his submission to the UN General Assembly, Frank La Rue notes that by explicitly providing that everyone has the right to express him or herself through any media, Articles 19 of the UDHR and the ICCPR were drafted with foresight to include and to accommodate future technological developments through which individuals can exercise their right to freedom of expression. Hence, the framework of international human rights law remains relevant today and equally applicable to new communication technologies such as the Internet .

And although the right to freedom of expression and the right to privacy is not absolute, International human rights law provides that these restrictions shall only be such as are provided by law and are necessary: (a) for respect of the rights or reputations of others; (b) for the protection of national security or of public order, or (c) of public health or morals (ICCPR 19(3).

Experts also observed that the fight against terror worldwide and Uganda in particular has become the main reason for the state to enact laws considered retrogressive and only aimed at stifling civil liberties and freedom of expression online.

“Encryption and anonymity, today’s leading vehicles for online security, provide individuals with means to protect their privacy, empowering them to browse, read, develop and share opinions and information without interference and enabling journalists, civil society, organisations, members of ethnic or religious groups those persecuted because of their sexual orientation or gender identity, activists, scholars, artists and others to exercise the rights to freedom of expression and opinion” said David Kaye, the current UN Special Rapporteur for Opinion and Expression

Laws that were subjected to the analysis exercise include the Anti Pornography Act 2014, Anti Terrorism Act 2002, Regulations of Interception of Communications Act 2010, the National Information and Technology Act 2013, the Uganda Communications Commissions Act, the Computer Misuse Act 2011, Electronic Signatures Act 2011, and Electronic Transactions Act 2011 among others.

The above laws have in them retrogressive provisions that inhibit peoples’ enjoyment of the right Privacy, access to information and freedom of expression online. Below are brief findings

The Anti-Terrorism Act, 2002 
The Anti-Terrorism Act includes provisions that provide for obtaining information in respect of acts of terrorism, which include the authorising of the interception of the correspondence of and the surveillance of persons suspected to be planning or to be involved in acts of terrorism. These provisions constitute a violation of right to privacy on the Internet, when digital communications are intercepted. The Act also includes provisions that threaten the freedom of expression online. Also, the law lacks the judicial oversight role before carrying out surveillance act on someone.

Under Section 9(2), the Act provides that any person, who, without establishing or running an institution for the purpose, trains any person for carrying out terrorism, publishes or disseminates materials that promote terrorism, commits an offence and shall be liable on conviction, to suffer death.

The National Information Technology Authority, Uganda Act, 2009 
The Act establishes the National Information Technology Authority – Uganda (NITA-U) as an autonomous statutory body to coordinate and regulate information technology services in Uganda. Amongst its functions (Section 5) is the co-ordination and monitoring of the utilisation of information technology in the public and private sectors; set and regulate standards for information technology planning, acquisition, implementation, disposal, risk management, data protection, and security; and regulation of the electronic signature infrastructure and other related matters as used in electronic transactions in Uganda.

The Regulation of Interception of Communications Act, 2010 
This Act provides for lawful interception and monitoring of communications in the course of their transmission through telecommunications, postal or any other related services or systems in Uganda. Under Section 3, it gives the ICT minister the powers “to set up a monitoring centre, equip, operate and maintain the centre, acquire, install and maintain connections between telecommunication systems and the Monitoring Centre; and administer the Monitoring Center at the expense of the state.” The law requires the ICT minister to appoint officers to run the center. The persons allowed to apply for lawful interception are the Chief of Defense Forces, the Director General of the External and Internal security agencies, and the Inspector General of Police.

Under Section 5 subsection (1) (c) (d) &(e), lawful interception is granted after issuance of a warrant by a judge if “there is an actual threat to national security or to any national economic interest, a potential threat to public safety, national security or any national economic interest, or if there is a threat to the national interest involving the State’s international relations or obligations.” Whereas the Act defines ‘national security of Uganda’ to include matters relating to the existence, independence or safety of the State, it does not define what ‘national economic interests’ are which can be used against opponent of the state.

Section 8 of this Act requires service providers to provide assistance in intercepting communication by ensuring that their telecommunication systems are technically capable of supporting lawful interception at all times. Non-compliance by service providers is punishable by a fine not exceeding UGX2.24 million (US$896) or imprisonment for a period not exceeding five years or both. Non-compliance could also lead to cancellation of an operator’s license.

The Electronic Signatures Act, 2011 
The Electronic Signatures Act 2011 regulates the use of electronic signatures in Uganda. There are some aspects of the Act that can be seen as creating risks as regards individuals’ right to privacy and freedom of expression. The Act includes provisions on advanced electronic signature that are uniquely linked to signatory, reliably capable of identifying the signatory and linked to the data to which it relates in such a manner that any subsequent change of the data or the connections between the data and signature are detectable (Section 2). In case the security of these types of signatory systems is not adequate, the anonymity of a person’s online behaviour is threatened due to the possibility to identify the individual through his or her signature.

The Computer Misuse Act, 2011 
The Computer Misuse Act 2011 prescribes liability for offences related to computers. For example child pornography, cyber harassment, offensive communications, and cyber stalking are penalized under the Act. The maximum penalties for these offences range from one to five years of prison, with the exception of child pornography, which can generate the maximum prison sentence of 15 years.

The Act also penalizes unauthorized access to computer programs and data, unauthorized modification of computer material, unauthorized use of interception of computer service. The maximum penalties for these offences are between 10-15 years in prison. Section 18 further penalizes unauthorized disclosure of information with a maximum prison sentence of 15 years.
Such heavy penalties can have a chilling effect on individual’s use of computers in order to access to information and in order to exercise the right to freedom of expression and opinion online.

The Electronic Transactions Act, 2011 
The Act provides for the use, security, facilitation and regulation of electronic communications and transactions. As regards possible threats to Internet freedom, the Act contains key provisions concerning the liability of Internet service providers. Under Section 29, a service provider is not be subject to civil or criminal liability in respect of third-party material which is in the form of electronic records to which he or she merely provides access if the liability is founded on the making, publication, dissemination or distribution of the material or a statement made in the material or the infringement of any rights subsisting in or in relation to the material.

Under Section 31, persons with complaints about a data message or related activity are required to notify the service provider or their designated agent in writing, giving details of the right allegedly infringed and remedial action required to be taken by the service provider in respect of the complaint. If a service provider fails to act on a complaint, the complainant can appeal to NITA-U, under regulations issued in 2013. However, the Act and its regulations are silent on the appeal mechanisms the party accused of infringement may take. Also, the regulations do not state the steps that NITA–U will take to investigate the complaint raised

The Uganda Communications Act, 2013 
This Act, sought to among other things; “… consolidate and harmonize the Uganda Communications Act and the Electronic Media Act33; to dissolve the Uganda Communications Commission and the Broadcasting Council and reconstitute them as one body known as the Uganda Communications Commission (Section 4). Among its functions, the UCC is supposed to monitor, inspect, licence, supervise, control and regulate communications services; and (b), receive, investigate and arbitrate complaints relating to communications services and take necessary action (j) and establish an intelligent network monitoring system to monitor traffic, revenue and quality of service of operators (u) and to set standards, monitor and enforce compliance relating to content (x) (Section 5).

While there had been some optimism with the enactment of this in terms of protecting peoples’ right to privacy with sections 79 and 80, criminalising the infringement and punishment for unlawful interception and disclosure of private communication by a service provider – respectively, the same Act under section 5(u) has been used to establish the Social Media Monitoring Unit as well as the Interception of the Communications unit to conduct communication surveillance of individuals communication. The effect of these types of actions on the Internet freedom of citizens with regard to both freedom of expression and privacy is obviously extremely hampering.

The act gives powers to the Minister to give policy guidelines to the commission, regarding its functions, which the commission must comply with; section 7(2) states thus; “The Commission shall comply with the policy guidelines given by the Minister under this section.”

The Anti-Pornography Act, 2014 
The Act prohibits the production, traffic in, publishing, broadcasting, procuring, importing, exporting and selling or abetting any form of pornography, and makes service providers liable for content hosted on their networks.

Under, Section 17 (1), internet service providers (ISPs) whose systems are used to upload or download pornography can be imprisoned for five years and fined UGX 10 million (US$4,000). Subsequent conviction of the ISP may lead to the suspension of their operating license. Under Section 7 (f), the Act provides for establishment of a Pornography Control Committee whose functions include to “expediting the development or acquisition and installation of effective protective software in electronic equipment such as computers, mobile phones and televisions for the detection and suppression of pornography.” Service providers are obliged to take measures recommended by the Pornography Control Committee, including installing software to detect and censor pornography.

The definition of pornography is not exact enough to enable media and individuals to know for certain which presentations fall within the scope of the law

“Uganda doesn’t have a specific law that addresses issues of Digital Rights and Internet Freedoms, but a myriad of laws and policies that have provisions that affect peoples’ right to Internet Freedoms. Unfortunately, most of these laws are counter-productive to the extent that they infringe on civil liberties, including right to privacy, freedom of expression, right of access to information including online” said Jeff Wokulira Ssebaggala, the Chief Executive Officer, the Unwanted Witness

He added that for a country whose Constitution guarantees peoples’ rights and fundamental freedoms including the right to privacy, freedom of expression online and offline, and is also a signatory to various international conventions providing for the same, it is unfortunate that laws with retrogressive provisions continue to be enacted despite numerous protests from human rights activities