ACT

Supplement to the Sierra Leone Gqzetre l/ol. CXLXII, No. 71

dated 25th November 2021

THE CYBERSECURIryANDCRIME ACT, 2O2I

ARRANGEMENT OF SECTIONS

PART I-+RELIMINARY
Section

l. Interpretation.

PARI' I I-ADMIN-ISTRATION AND COORDN AIION

2 Establishment ofthe National Computer Security lncidence Response

Coordination Center.
3. Functions and Powers ofthe Center
4. Establishment of the National Cybenecurity Advisory Council.
5. Functions and Powers ofthe Council.
6 Establishment ofNational Cyber Secudty Eund.

PART III{RITICALNATIONAL INFORMATION INTRASTRUCTURE

7. Designation ofcritical National Information Infrastructure.

8. Audit and hspection ofcritical Nationa.l lnformation Infrastructure-

PART IV-POWERSAND PROCEDURES

9. Scope of Powers and Procedufes.
10. Search and Seizure of Stored Computer data
11. Record ofand Access to Seized Data-
12. Production Order.
t3. Expedited Preservation and Panial Disclosure ofTraffic Data
It

t4. Real-Time Collection oftramc Data.

ls. Inlerception of content data.
16. Confi dentiality and Limitation of Liability
t'1. Tenitorial Jurisdiction.
18. Prosecution of Ex$aditable O ffences.
19. Forfeiture to the State.
20. Restitution.

PART V-INTERNAIIONAL COOPERATION.

21. Spontaneous disclosure of Information.

22 Powers offie Attomey-General.
23. Authority to make and act on mutual assistance requests.
24. Extradition.
25. Confidentiality and Limitation ofuse.
26. Expedited preservation ofstored computer data.
27 Expedited disclosure ofpreseryed t'affic data.
28. Mutual assistance regarding accessing of stored computer data
29. Trans-border access to computer data.
30. Mutual assistance in real time collection oftramc data,
31. Mutual assistznce rcgarding interception of content data-
32. Point ofcontact.

PARTVI_OFFENCES
33. Unautborised access.
34_ Unauthorised access to protected system
35. Unauthorised data interception.
ia. Unauthorised data interference.
37. Unauthorised system interference.
38_ Misuse of divice.
39. Unauthorised disclosure of password.
40. Computer related forgery.
E
41. Computer Aaud.
Identiry theft and impersonation.
43. Elecaonic signature.
4. Cyber statking and bullying.
45. Cyber Squatting.
4. Infiingement ofcoplright and related rights.
47. Online child sexuat abuse.
.18. Online adult sexual abuse.
49. Attempting and Aiding or Abetting.
50. Registration of cyber cafes.
51. Cyber Tenorism.
52. Racist Xenophobic Offences.
53. Reporting c).ber tkeats.
g. Breach ofconfidence by service provider.
55. Employees responsibiliry
56. Corporae liability.
57. Acts by children.

PARTvII-MISCEII.ANEOUS PROVISION.
58. Regulations.
SToNED this l5th day of November,202l

DR. JULIUS MAADA BIO,

President.

@
No. 7 2021

The Cyber security and crim€ Act, 2021. short tid€

Being an Act to provide for the effective, unificd aad

comprehensive legal, regulatory aod institutiooal fraDework for the
prohibition, prevertion, detection, prosecution ard puDishment of
cybercriBcs; preveolioo of tbe .busivc ute of computer system!; to
provide for the estsblkhmetrt of structure! to promote cybersccurity
ard c8p8.ity buildirg; to provide for the timely .nd .ffectiye collection
ofelectronir evidence for the purpose of irvcstigalioD arld prosecution
of cybercrime; to provide for th. protection of Critical National
hformation Infrastructure arrd the protectioo of compute. systemg
ard networks, electronic communicatiotrs, drta rnd computer
programs, intellectusl property atrd priyacy rights to provide for
fscilitstioo of internrtioml cooperaliol in dealing with cybe.crime
Drtters and to provid€ for other relsted m8tters.

tl Date of com-
mencement.
Ex,lcrm by the President and Members ofParliament in this
prese[t Parliament assembled.
2 No.7 The Cyber Security qnd Crine Act 2021

PART I - PRELIMINARY
lfiterpretation l. tn this Act, unless the contrary intention appea$ -

"Attom€y General" means The Attorn€y-General and

Minister of Justice established under the
Constitution;

"authorised person" means a member ofthe National

Cyber Security Coordination Center or a person
mandated by iL inyolv in the prohibition. prevention.
elemination or combating ofComputer crimes and
Cyier Securiry threats.

"computer data" means any representation of facts,

information or concepts in a form suitable for
processing ina computer system, including a prcgtam
suilabl€ to cause a computer system to perform a
function;

"computer data storage medium" means any device,

physical or virtual, conlaining or designed to
contain, or enabling or designed to enable storage
ofdat4 whetber available in a single or distribuled
forrn for use by a computer;

"computer system" means any physical or virtual

device, or any set of associated physical or virtual
devices; or a group of interconnected or related
devices, one or more ofwhich, pursuant to a prcgrrm,
performs automatic processing of data at least one
ofwhich use electronic, magnetic, optical or other
technologr, to perform logical arithmetic storage and
data or which perform control functions on physical
or virf,ral devices including mobile devices and
reference to a computer system includes a reference
to part of a computer system;
No. 7 The Cyber Security and Ctime -4ct 202r 3

"crime against humanity" includes any ofthe following

acts committed as part of a widespread or systemal.ic
attack directed against any civilian population, r ,ith
knowledge of the attack: murders. extermination,
enslavement, deportation or forcible transfer of
population, imprisonment, torture rape, sexual
slavery,, enforced prostitution, forced pregnancy,
enforced sterilisation or any other form of sexual
violence of comparable gravity, persecution agaiost
an identifiable goup on political, racial, national,
ethnic, cultural, religious or gender grounds, enforced
disappearance of persons, the crime of apanhcid,
other inhumane acts ofsimilar character intentionally
causing great suffering or serious bodily or mental
itliury;

"Critical National Iniormation Infiastructure" means

computer systems that are necessary for the
continuous delivery ofessential services that Sierra
Leone relies on. lhe loss or compromiie of rvhich
will lead to a debilitating impact on-

(a) the security, defence or intemational relations

of Siena kone;

O) the existence or identity of a confidential

source of information relating to the
enforcement ofthe criminal law;

(c) the provision of services directly related to

communications- infrastructure, banling and
financial services, public utilities, public
trarxportation or publickey infrastructure; or

(d) the protection of public safety including

system related to essential emergency
services;
4 No. 7 The Cyber Security and Ctime Act 2021

"Cybemtalking" is when a person intentionally initiate

communications or a cou.rse ofcoDduct directed at a
specific person or persons with the intent to coerce,
intimidate, harass, or cause emotional distress.;

"Cybersquatting" means the acquisition ofa domain

nafle over the intemet in bad faith to profit, mislead,
destroy reputation, and deprive olhers f.om
registering the same, if such a domatn is;

O Similar, identical, or confirsingly similar

to an existing hademark registered with
the appropriate govemment agency at
the time ofthe domain name
registration;

(r) Identical or in any way simitar with the

name of a person other than the
registrant, in case of a personal name;
and

(if Acquired without right or with

intellectual property inter€sts in it;

"data" means representations of information or of

concepts that are being prepared or have been
pfepared in a form suitable for use in a computer;

"database" means digitally organized coliection ofdata

for one or more purposes which allows easy access,
management and update of data;

"device" means any object orequipmentlhat has b€en

des igned to do a padicularjob or whose mechanical
or electrical workings are controlled or monitored by
a microprocessor;

"eleckonic communication'' means communicalions in

electronic format, instant messages, short message
No. 7 The Cyber Security ahd Crine Act 2021 5

service (SMS), e-mail, videq voicemails, multimedia

message service (MMS), Fax" and pager;

"enforcement officer" means an officer in a law

enforcement agency trained in cyber security work
designated or authorised to carryout functions
including for the pu$roses of Part lV of this Act;

"exfiadite" means the legal obligation ofstates under

public intemational law to handover persons who
commit intemational crimes to a foreign state for
indictrnent, prosecution or imprisonment.

"encrypted data" means data which has been

transformed from its plain text version to an
unintelligible format, regardless of the technique
utilised for such transformation and irrespective of
the medium in which such data occurs or can be
found, for the purposes ofprotecting the content of
such data;

"false news" means incorrect deceptive information

or propagand4 misinformation or hoaxes deliberately
spread undcr the guise ofbeing authentic ne.xs via
haditional print and broadcast news media or online
social media witten and published with the intentto
mislead for gains;

"Financial Institution" means any individual, body,

association or group of persons, whether corporate
or unincolporated which carries on the business of
inveshnent and securities, a discounthouse, finance
company and money brokerage whose principal
object includes factoring project financing
equipment leasing, debt administration, fund
management, private ledger services, investment
management, local purchase order financin& export
6 No. 7 The Cyber Seeurity and Crime Act 2021

finance, project consultancy, financial consultancy,

pension fund management, insurance institutions,
debt factorization and conversion firms, dealer,
clearirg and settlement companies, legal
practitioners, hotels, casinos, bureau de change,
supermarkets and such other businesses as the
Central Bank or appropriate regulatory authorities
may, from time to time, designate;

"Financial Transaction" means a ransaction which in

any way involves movement of funds by wire or
other electronic means; involving one or more
monetary instruments; or the transfer oftille to any
real or personal property;

"function" means logic, control, arithmetic, deletion,

storage, retrieval and communication or
telecommunication to or fiom, or within a computer;

"genocide" means any ofthe following acts committed

with intent to destroy in whole or in part, a national,
ethnic, racial or religious group as such: killing
members ofthe group, deliberately inflicting on the
group conditions oflife calculated to bring about its
physical destruction in u'hole or in part, imposing
measures intendcd to prevent births within th€
group; forcibly transfening children ofthe group to
another group;

"identity theft" means the stealing of somebociy else

personal identiling information and preteflds to be
that person in order to commit fraud orto gain other
financial benefits such as making unauthorised
transactions or purchases.

"interference" means any impairment to the

confidentiality, integrity or availabiliq ofa computer
system, or any program or data on a compuler slstem,
No. 7 The Cyber Secrrity and Crime Act 2021 1

or any act in relation to a computer system which

impairs the opcration of the computer system.
program, or data;

"law enforcement agencies" means any agency for

the tirne being responsible for implementation and
enforcement ofthe provisions of this Act;

"Minister'' means the Minister responsible for

lnformation and Communications;

"modification" means in relation to a computer syst€r\

program or data, the alteration or modification with
resp€ct to the contents of a computer system by
the operation of a function of the computer system
or any other computer if;
(a) a program or data held in the computer system
is altered or erased;

(b) a program or data is added to its contents; or

(c) an act occurs which impairs the normal

operation of a computer system,

and any act which contributes towards causing such

aheration or modification shall be deemed to have
caused it;

"password" means any data by which a computer

service or a computer system is capable of being
obtained or used;

"person" includes a natual person, a corporation,

company, parhership, hrm, association or societies;

"Phishing" means the criminal and &audulent process

8 No.7 l'he Cyber Secu|ity ahd Critne Act 2021

of acquiring or attempting to acquire sensitive

information such as usemames, pilsswotds and credit
card details, by masquerading as an authentic entity
in an elechonic comnunication through emails,
telephone or text message asking a user to change
his or her password or reveal his or her identity so
that such information can later be used to de&aud
the user;

"plain text" means original data before it has been

transformed into an unintelligible format.

"plain text version" means original data before it has

been transformed into an unintelligible format.

"pornography" means the representation in books,

magirzines, photographs, films, and other media,
telecommunication apparatus of scenes of sexual
behavior that are erotic or lewd and are designed to
arouse sexual interest;

"premises" means land, buildings, movable structures,

a physical or virtual space in which data is maintained,

managed, backed up remotely and made available to

usets over a network, vehicles, vessels or aircraft;

"President" means the President of the Republic of

Sierra Leone as established by the Constitution.

"progmm or computer program" means computer data

representing instructions or statements that, when
executed in a computer system, catses the computer
system to perform a f,rnction;

"prosecute" means the legal obligation ofstates under

public intemational law to prosecute persons who
corunit intemational crimes where no other state
has requested extradition;
No.7 The Cyber Security and Ctirne Acl 2021 o

"racist or xenophobic material" meirns any writt€n or

printed material, any image or any other
representation ofideas or theories, which advocates,
promotes or incites hated, discrimination or violence
against any individual or group of individuals, based
on race, colour, descent or national or ethnic origin,
as well as religion if used as a pretext for any of
these factors.

"Requested State" meaos a state being requested to

provide legal assistance under the terms ofthis Act;

"Requesting State" means a state requesting for legal

assistance and may for the purposes of this Act
include an intemational entity to which Sierra Leone
is obligated:

"service provider" means a public or private entity

that provides to users of its services the means to
communicate by use ofacomputer system including
any other entity that processes or stotes computer
data on behalfofthal entity or its users;

"seize" with respect to a program or data be defined to

include:

(a) secure a computer system or part of it or a

device;

O) make and retain a digital image or secure a

copy ofany program or data, including using
an on-site equipment;

(c) render the computer system inaccessible;

(d) remove data in the accessed computer system;

or

(e) obtain output ofdata from a computer systeml

l0 No. 7 The Cyber Secuity and Crime Act 2021

"Sexually explicit conduct" includes at leasl the

following real or simulaled acts done with iotent to
exploit a child-

(a) sexual intercourse, including genital-genital,

oral-genita[, anal-genital or oral-anal,
involving a child, or behreen an adult and a
child, ofthe same or opposite sex;

(b) bestialityi

(c) masturbationi

(d) sadistic or masochistic abuse in a sexual

contexq or

(e) lascivious exhibition ofdre genitals ol the pubic

areaofa child. It is not relevant wtiether the
conduct depicted is real or simulated;

"Spamming" means deliberate abuse of electronic

messaging systems to ind iscrim in ate ly send
unsolicited bulk messages to individuals and
corporate organizations;

"subscriber information" means any information

contained in the form ofdata or any form lhat is held
by a service provider, relating to subscribers of its
services, other tlan traffic data or content data, by
. which
can be estabiished-

(a) the O?e ofconmunication service used, the

technical provisions taken thereto and the
period ofservice;

(b) the subscriber's identity, postal, geogmphic,

electronic mail address, telephone and other
No. 7 The Cyber Security dnd Crime Act 202t 1l

access number, billing and payment

information available on the basis ofa service
agreement or anangement: or

(c) any other information on the site of an

installation of communication equipment
available on the basis ofa service agreement
or anangement;

"ftaffic data" means computer data relating to a

communication by means of a computer system,
generated by a computer system that formed a part
in the chain of communication, indicating the
communjcation's origin, destination, route, time,
date, size, duration or the aype ofunderlying service;

"unauthorised" means access of any kind, 1o a

computer system, program or data, by a person who-

(a) is not entitled to access that computer system,

program or data; and

(b) does not have or exceeds the level of

authorisation consented to by the person
entitled to grant such consent, for the
particular kind or typre ofaccess with respect
to that computer system, program or data:

Provided that any act or access in exercise ofpowers

under this Act shall not be deemed to be
unauthorised.
l2 No.7 The Cyber Secuity dnd Crime Act 202,

PART IIADMINISTRATION AND COORDINAIION

Establishment 2. (l) There is established a National Computer Security

of the
National Incidence Response Coordination Cenue responsible for managilg
Computer cyber security incindences in Sierra Leone, headed by the National
Sectllity Cyber Secwity Coordinator, who subject to the approval ofParliament
lncidencc
Rcsponse
shall be appointed by the President on the recommendation of the
Coordination M inister
Centre
(2) The Narional Cybersecurity Coordinator shall hold
omce for a term of (5) yea$ and is eligible for reappointment for
another term of (5) years only.

(3) A person shall not be appointed National Cyber

Security Coordinator unless that person has relavant knolvledge,
qualification and expertise in either Computer Science, Information
Technology, Cyber Security or lnformation Security and related
matters of at least ( I 0) yearc and is a person of proven integriry

(4) The National Cybersecurity Coordinator shall cease

to hold office on any ofthe following grounds:

(a) for his or her inability to perform the

firnctions ofthe office by reason of infirmity
of mind or body;

(b) fo, proven misconduct;

(c) if he becomes bankrupt or insolvent;

(d) if he is convicted and sentenced for an
offence involving fraud or dishonesty;

(e) if he resigns his oflice by *ritten notice to

the minister; or

(0 at the expiration ofhis term ofofice

Functions and 3. The National Computer Security lncidence Response

Pow€,rs of the Coordination Center shall be responsible for cyber security issues
Center.
under thls Act mcludlng:
No. 7 The Cyber Security and Crime Act 202t l3

(a) provision of support to computer systems

and networks in preventing and combating
cybercrime in Sierra t one;

@) formulation and implementation of national

cyber security policy and cyber security
strategY;
(c) overseeing of the numagement of computer
forensic laboratories;
(d) provision of support lo the Judiciary and
other law enforcemetrt agencies in the
discharge of their finctions in relation to
cybercrime in Sierra Leone;

(e) promotion of Sierra l-eone's involvement iu

international cyber security cooperation; and

(D doing such other acts or things that are

trecessary for fie effective performance of
the firnctions of the relevant security 8nd
enforcement agencies under this Act.

4. (l) There is established, a National Cybersecurity Estrblishmenl

Advisory Council comprising the Vice President as Chairman and of the
N.tional
the following other members- Cyb€rsccurity
AdYisory
(a) the Minister of Finance; Council.

@) the Aaomey-General and Minister of Justice;

(c) the Minister of Intemal Affairs;

(O the Minister of Foreign Affairs and

lntemational Cooperation ;

(e) the National Secwity Coordinator, offce of

National Security;
14 No. 7 The Cyber Sec-urity qnd Crime Act 2021

(0 the Director{eneral, Central lntelligence and

Security Unit;

(g) the ChiefofDefence Stafl Republic ofsiera

Leone Armed Forces;

(h) the lnspector-General, Sierra Leone Police;

(i) the Dkector-General, National Telecomm-

unications Commission;

0) the GoYemor, Bank ofSierra Leone;

ft) the National Cyber Security Coordinator as

Secretar.v

(D the Director General Financial Intelligence

Unit

(m) the Minister of Information and

Communications.

(n) a barister and solicitor ofover l5 years post

enrolinenl at the bar nominated by the Sierra
Leone Bar Association, appointed by the
President.

(2) A membe ofthe Council shall cease to hold ofrice if-

(a) he ceases to hold the office on the basis of

which he became a member ofthe Council; or

(b) the member listed in paragraph (n) ofclause

4 (l ) shall cease to hold offrce only for sAted
misconduct or infirmity ofbody or mind for a
temr of3 years which said term may where
the President deems fit be renewed for a
further tenn of 3 years without any further
renewal.
No.7 The Cyber Secltrity and C rne Act 202t t5

(3) The meeting ofthe Council shall be presided over by

the Vice hesident and the Council shall rneet, at least, 4 times a year.

5, (1) The Council shall- Functions aod

Powars of thc
(a) provide strategic teadership, oversight ard council
guidance on implemcntation and develo-
pment of national cyber security legal
framework in Sierra l-eone is order to ensure
that-
([) Sierra Leone's cybercrime policies and
laws are in conformity widr regional and
intemational standards;
(D there is maintenance of international
coopention requircd for preventing and
combating cybercrimes and promoting
cybersecurity; and
(iif effective prosecution of cybercrimes
and cyber security matters.

O) make rccommendation to Government on

issues relatiDg to the prevention and
combating ofcybercrime and the promotion
of cyber security in Sierra Leone;

(c) provide general policy guidelines for the

implementation of this Acq and

(d) promote the development of educaiional

programs and research in cyber security
defences, techniques and processes.

(2) The Council shall have power to regulate its

proceedings and make standing orders with respect to the holding of
its meetings, notices to be given, the keeping of minutes of its
proceedings and such others matters as Council may &om time to
time determine.
,
l6 No, 7 The Cyber Security and Ctirne Act 2021

Eslabli shrner t 6. (l) There is established a ftmd which shall be known as

of National
the National Cyber Security Fund.
Cyberse.urity
Fund.
(2) There shall be paid and credited into the Fund
established under subsection ( I ) and domiciled in the Cenhal Bank
of Sierra kone -
(a) grants-in-aid and assistance from donor,
bilateral andmultilateral agencies;

O) all other sums accruing to the Fund by way

of gifts, endowments, bequests or other
voluntary contributions by persons and
organisations:

Provided that the terms and conditions attached to such gifts,

endowments, bequests or contributions will not jeopardize tbe
ftrnctions ofthe Council; and

(c) allocarion from the consolidated fund;

(d) all other monies or assets that may, tom time

to time accrue to the Fund.

(3) An amount not exceeding 30 percent ofltre Fund

may be allocated for programs relating to public education and
awareness raising on cyber security issues.

( ) (i) The office of the National Computer Security

Incidence Response Coordination Centre shall keep proper records
ofthe accounts in a form approved by the Auditor General.

(if The books of account kept under sub-section

(4) (i) shall witlrin 3 months after the end ofeach financial year be
audited by the Auditor General or an auditor appointed by him.

(iD The financial yea shall be the same as the

financial year ofthe Government.
No. 7 The Cyber Security dnd Cime Act 2021 l7

(, (D The CounciJ shall, a:i soon as possible but not

later than 6 months after the end ofeach financial year, submit to the
Minist€r a report oflhe activities, operations, underrakings, properties
and financies ofthe National Computer Security Incidence Response
Coordination Center for that year, including the Auditor General's
Report.

Gi) The Minister shall within 30 days ofthe receipt

of the report referred to in sub-section (sxi) lay a copy before
Padiament

PART III€RITICALNATTONAL INFORMATION

INFRASTRUCTTJRE

?. (l) The Minister shall in consultation with the National D.signation

Cybersecurity Council recomrnend to the President who may by Order Of Criri.al
National
published in the Cazette, designate certain computer systems, lnforlnatioo
computer dala or traffic data vital !o Sierra Leone or any combination lnfrastructurc
of those matters, a:r constituting Critical National lnformation
In&astructure.

(2) A Presidential Ordermade rmder subsection (l), shall

prescribe minimum standards, guidelines, rules or procedures
reasonably required in respect of-

(a) the protection or preservation of Critical

National ltrformation Infiastructure;

(b) the general managemed ofcritical National

Information lnfi astructure;

(c) the implementation of critical information

systems to ensure all systems are secured
by default and system and user activities are
logged to facilitate accurate and efiicient
information systems operations audits.

(d) access to, transfer and control of data in

Critical National Information Infiastructurei
I8 No.7 The Cyber &curity and Crime Act 2021

(e) infrastructural or procedural rules and

requirements for securing the integrity and
authenticity ofdata or information contained
in any designated Critical National
Infomntion Infrastructur€;

O the storage or archiving of data ot

informatibn designated as Critical National
Information Infrastructure;

(g) recovery plans in the event ofdisaster. bre3ch

or loss of the Critical National Information
IntasEucture or any part of it; and

(h) any other matter required for the adequate

protection, management and control ofdata
and other resources in any Critical National
lnformation ln&astructure.

(i) raspect for and protection ofthe fundamental

Aeedoms, including the right to privacy.

Audil and
Inspcction of
E. A Presidential Order made under subsection ( I ) ofsection
Critical 7 may require the National Computer Security lncidence Response
National Team established under section (2) to audit and inspect any Critical
lnformation National Information Infrastructure at atly time to ensure compliance
Irfrastructure.
with the provisions ofthis Act.

PARI' IV - POWERS AND PROCEDLTRES

Scope of 9. (l) Powers and procedures under this Act shall be

Procedures.
applicable to and may be exercised with respect to-

(a) criminal offences under this Act;

(b) criminal offences committed by means ofa

comput€r system, including mobile phones
atrd other electronic equipment under any
other law; and
No.7 The Cyber Security and Crime Acl 2021 I9

(c) the collection ofevidence in elechonic form

of a criminal offence under this Act or arty
other law.

(2) In a trial of an offerce under any [aw, the fac.t that

evidence has been generated, transmitted or seized from or identified
in a search of a computer system, shall not of itself prevent thal
evidence from being presented, relied upon or admitted provided
that the cvidence has been properly obtained and preserved.

(3) The powers and procedures provided under this Part

are without prejudice to the operation of, or powers granted under
the Criminal ProcedureAct, when exercised lawflrlly by any other law
enforcement agency or service or any regulatory authorilv that by
itself does not investigate or prosecute an offence.

I0. (l) Upon an application by an enforcement omcer or other S€.ich rnd

authoris€d person to a Judge ofthe High Court that there is reasonable Seiarre of
Stored
grounds to believe that ther€ may be in a specified computer system,
Computer
program, data, computer data storage medium material specirying the data.
basis ofthe beliefand the scope ofthe warrant requled \yhich-

(a) may be reasonably required as evidence in

proving a specifically identified offence in a
criminal investigation or criminal
proceedings;

@) has been acquired by a person as a result of

the commission ofan offence,

the Judge may issue a warrant which shall authorise the enforcement
officer or other authorised person, with such assistance as may be
necessary, to access, seize or secure a specified computer system,
program, dala or computer data storage medium.

@) A warrant issued under subsection (l) shall authorize

an enforcement omcer or other authorised person tG.
z) No. 7 T'he Cyber Searity and Cime Act 2021

(a) enter and search any premises or place if

within those premises or place-

(| an offence under this Act is being

committed; or

(! there is evidence ofthe commission of

an offence rmder this Act; or

(rii) there is an urgent need to prevent the

commission ofan o$ence under this Act

(b) search any person found on any premises or

place which such authorised officers who are
empowered to enter and search under
paragraph (a) of subsection l;
(c) stop, board and search where there is
evidence of the commission of an offence
under this Act;

(d) seize or secure a computer system or part of

it or a computer{ata storage medium;
I
i
(e) make and rehin a copy ofcomputer data;

(0 maintain the integrity of stored computer

data;

(g) render inaccessible or rernove computer data

in the accessed computer system;

(h) have access to, inspect and check the

operation ofa computer E6tem to \yhich the
warrant applies;

(, haye access io any information, obtained from

the encrypted data contained or available to
No. 7 The Cyber Security and Crime Act 2021 21

a computersystem into an intelligible formal

for the purposes of the warranq

O require a person possessing knowledge

about the finctioning of a computer system
or measures applied to protect a computer
data therein, to provide the necessary
computer data or information, to enable an
enforcement officer or other authorised
person in conducting an activity authorised
under this section;

(k) have access to such reasonable technical

and other assistance as he may require for
the purposes of the warrant.

O require any person having charge of or

otherwise concemed with the operation of
any computer or electronic device in
connectioo with an offence under this Actto
produce such eomputer or electonic deyice.

(3) An application under subsection (l) shall provide

reasons explaining why it is believed that-

(a) the material sought will be found on the

premises to be searched; or

(b) the purpose of an investigation search may

be frustrated or seriously prejudiced unless
an investigating officer arriving at the
premises can secure immediale enfy to them,

(4) The court may issue a warant under subsection (2)

of this section where it is satisfied that-

(a) th€ warrant is sought to preveDt the

commission of an offence under this Act or
D, No. 7 The Cyber Security and Crime .4ct 2021

to prevent the interference with inyestigadye

process under this Actl or

(b) the warrant is for the purpose ofinvestigating

cybercrime, cyber security breach, computer
related offences or obtaining eiectronic
evidence; or

(c) there are reasons for believing that the

person or material on the premises may be
relevant to the cyber crime or computer
related offences under investigation; or

(d) there are reasons to believe that the person

named in the warant is preparing to commit
an offence under this Act.

Provided that any such wanart is issued access shall be witlrout

prejudice to $e rights to privacy of persons and may be rescinded
upon an application by a person affected to a Judge of the High
Court.

(5) Where an enforcement officer or other authorised

person (s) authorised to search or access a specific computer system
or part of it has reasonable grounds to believe that the data sought
is stored in another cloud computer system and there is reasonable
grounds to believe that such data is accessible from or available to
the initialsystern, the enforcement o{ficer or other authorised person
may extend the search or accessing to such other system or systems.

(O Computer data seized under subsectio, (2) shall only

be lawfully used for the purpose for which itwas orig,nally obtained-

(7) An enforcement officer or other authorised person

shall-

(a) only seize a computer system under sub-

section (2) when it is-
No. 7 The Cyber Securit, and Crtde Act 2021 ?3

(D not practical to secure the computer

data: or

(ii) necessary to ens[e that data will not

be dcstroyed, altered or otherwise
interfered with;

O) exercise ressonable care while the computer

system or computer data storage medium is
retained.

(8)An enforcement olficer or other authorised person

who intentionally, recklessly or neglige tly misuses the powers
granted under this section commits an offence and is liable on
conviction toa fine not less than Le 1 0,000,000 and not more than Le
50,000,000 or to a term of imprisonment not less than I year and not
more than 5 years or to both such fine and imprisonment.

(9) .A person rvho willfully obslructs an enforcement

officer or other authorised person inthe lawful exercise ofthe powers
under this section commits an offence and is liable on bonviction to
a finenotless than Le5,000,000 andnot more than Le30,000,000 orto
a term of impriso.ment not less than 6 months and not more than 3
years or to both such fine ard imprisonment and in the case of a
corporation, partnership or association to a fine not less than Le
50,000,000 and not more than Le t 00,000,000.

11, (l) Where a computer system or data has been removed Record oland
or rendered inaccessible, following a search or seizure, the person 1"f... to
s"i^o o"'
who made the search or seiztre shall. at the time of the .""."h o,
seizure or as soon as practicable after the search -

(a) make a list of what has been seized or

rendered inaccessible, with the date and tirne
of seizure; and

(b) give a copy ofthat list to -

24 No. 7 The Cyber Securily and Crirne Acl 2tizl

Q the occupier ofthe premises; or

(if the person in control of the conputer

system.

(2) Subject to subsection (3), an enforcement officer or

other aulhorised person shall, on request, permit a person-

(a) who has custody or control of a computer

system,

(b) who has right to data or information seized

under subsection (2) ofsection l0l or

(c) acting on behalf of a person under

subparagraph (a) or (b),

to access and copy computer data on the system orgive strch person
a copy of the computer data.

(3) An enforcement omcer or other authorised person

may refuse to give access or provide copies seized under subsection
(2) if he has reasonable grounds to believe that giving access or
providing copies would-

(a) constitute a criminal offence; or

(t) prejudice-

O an inYestigation; or

(i, any prosecution:-

(4) Notwithstanding sutrsection (3), a Judge ofthe High

Court may, upon sufficient and reasonable grormds, allow a person
under sub paragraph (a), (b) or (c) to access or copy computer data-
No. 7 The Cyber Secrtity and C me Act 2021 25

(5) The National Computer Security lncidence Response

Team shall develop staudards, policies, procedures and guidelines
to be used in the implementation ofthis Act subject to the approval
ofthe National Cyber Secudty Advisory Council in respect o[:

(a) the warant request processl

O) the Focess of collecting and handling

evidence;

(c) chain of custody ofevidence collected;

(o processes related to device collection;

G) processes related to email collectioni

(0 the storage and inventory of data or evidence

collected;

(g) the process of examining evidencb;

(h) the analysis ofdata and evidence collected; and

(i) evidencereporting.

12. (l) Where it is necessary or desirable for the purposes producrion

ofan investigation under this Act, a Judge ofthe High Court may Order.
upon an application by an enforcement officer or other authorised
person, order-

(a) a person in possession or control of

specified data stored in a computer system
oI a computer data storage medium; or

(b) a service provider in possession or control

of specihed subscriber information relating
to services offered -
No. 7 The Cyber Secllrily ahd Crime Act 2021

O in Sierra [€one; or

(D based outside Sien-d Leone but, offering

is services in Sierra [rone;

to submit information in his possession or control.

(2) A Judge of the High Cout may, by order, requirc a

person-

(a) to whom an order is made under subsection

(l),or

O) in control ofa computer system, to whom a

warant is issued under subsection (l) of
section l0;

to keep such order or \yarrant confidential

(3) A person who fails to comply with an order under

subsection (l) commits an offence and is liable on conviction to a
fine not less than Le 5,000,000 and not more than Le 30,000.000 orto
a term of imprisonment not less than 6 months and not more than 3
years or to both such fine and imprisonment and for a corporation
partnership or associationnot less than Le 100,000,000 and not more
$an Le250,000,000.

(4) An enforcement officer or other authorised person

who uses the powers granted under subsection (1) for a purpose
other than that stated in section 10 commits an offence and is liable
on conviction to a fine not less than Le 10,000,000 and not more than
Le 50,000,000 or to a term of imprisonment not less than I year and
not more than 5 years or to both such fine and imprisonment.

(5) An application under subsection (l) shall state the

reasons explaining why it is believed that-
No.7 The Cyber Secwity dhd Clime ict 2021 n
(a) likely to
a specified computer data sought is
be available with a person mentioned in
subparagraph (a) or (b) ofsubsection ( 1);

(b) an investigation may be frustrated or

seriously prejudiced unless the specified
computer data or the subscriber information,
as the ca-se may be, is produced;

(c) the type of evidence suspected is likely to

be produced by a person mentioned in
subparagraph (a) or (b) ofsubsection (l);
(d) subscribers, users or unique identifiers who
ar€ the subject of an investigation or
prosecution, may be disclosed as a result of
the production of the specified computer
data;

(e) an identified offence is an offence in respect

ofwhich the order is sought;

(0 measures taken shall prepare and ensure that

the spec ified computer data ivi ll be ptoduced-

(i) whilst maintaining the privacy ofother

users, customers and third parties; and

(ii) without the disclosure of dats of any

party who is not part of the
investigation; and

G) measures taken shall prepare and ensure that

the produaion ofthe specified computer data
is carried out tkough technical means such
as mirroring or copying ofrelevant data and
not through physical custody of computer
systems or deYices.
a No. ? The Cyber Secwity and Cti e lcl 2021

(O Notwithstanding the provision of sub-section (1)

above, a service provider or a person in possession or conffol of
relevant specified data shall have the right to apply to the Judge of
the High Cout to challenge the issuance ofaproduction order issued
under this section on the ground ofrelevance, privilege, capacity to
implement provisions of the order or otherwise protected from
disclosure by law, or non-satisfaction of the requirements in sub-
section (5) of this Section.

Expedited 13, (l) An enforcement omcer or otler authorised person

Prctervation may, \vhere he is satisfied that-
end Partial
Disclosure of
Traftlc Data. (a) a specified computer data stored in a
computer system or computer data storage
medium is reasonably required for the
purposes ofa criminal investigation: and

(b) there is a risk or vulnerability that the

computer data may be modified, lost,
destroyed or rendered inaccessible,

by u,ritten notice given to a person in possession or control of the

computer system or computer data storage medium, require that
person to undertake expeditious preservation ofthe conputer data.

Q) A notice under subsection (l) may require a person

in possession or conEol of the computer system or conlputer data
storage medium to disclose sufficient traffic data about the
communication to identify-

(a) the service providers; and

(b) the path though which the communication

was transmitted.

(3) The period of preservation of data required under

subsection (l ) shall be for a period not exceeding 30 days.
No.7 The Cyber Securiry and Crime Act 2021 D
(4) The period ofpreservation of data under subsection
may be extended by a Judge ofthe High Court for a fifther specified
(3 )

period oftime, on an application by an enforcement officer or other

authorised person, where such extension is reasonably required for
the purposes of-

(a) an investigation or prosecution:

(b) avoiding a risk or vulnerability that the

computer data may be modified, Iost,
deskoyed or rendered inaccessible; or

(c) averting overly burdensome cost of such

preservation on the person in control of the
computer system.

(5) A person to whom a notice under subsection (l) is

given shall-

(a) be respcnsible to preserve the data for -

@ a period not exceeding 30 days as

specified in subsection (3); or

(ii) any extended period permitted by a

Judge of the High Court und€r
subsection (4).

(b) respond expeditiously to requests for

assistance, whether to fucilitate requests for
police assistance or mutual assistance
requests, and

(c) disclose {u soon as practicable, a sufficienl

amount ofthe nonrontent data to enable an
enforcement officer or other authorised
person to identiry any other telecomm-
unications providers involved in the
Eansmission of the communication.
30 No. ? The Cyber Secuity and Crihe Act ).021

Real-Ti e
Collection of
14. (l) Where there are reasonable grounds to believe that
rraffic Data. taffic data associated with specified communications is reasonably
required for the purposes ofa specific criminal investigation, a Judge
ofthe High Court may, on an application by an enforcement officer
or other authorised person, order a service provider rvith the capacitv
to monitor, coliect and record to-

(a) collecr or record traffic data in real-time;and

(b) provide specified taffic data to an

enforcement officer or other authorised
person.

(2) An Order for the real-time collection or recording of

tramc data under sub-section (l) shall not be for a period beyond
what is absolutely necessary and in any event for not more than 30
days.

(3) A period ofreal-time collection orrecording ofrailic

data under subsectioo (2) may be extended by a Judge of the High
Court for a further reasonable specihed period oftime the same to be
for an additional period of 30 days, on an application by an
enforcement officer or other authorised pcrson, where the extension
is reasonably required for the purposes of-

(a) an investigation ol prosecution;

(b) further real-tlme collection or recording of

tramc data necessary to achieve the purpose
for which the Order under sub-section (l)
was made;

(c) ensuring that the real-time collection or

recording oftramc data is caried out whilst
maintaining the privacy of other users,
customers and third parties and lvithout the
disclosure of information and data of any
party not part of the investigation;
No, 7 The Cyber Security and Cride Act 2021 lr
(d) preventing the investigation of being
frustrated or seriously prejudiced; and

(e) averting overly burdensome cost of such

extension on the person in tontrol of the
computer system.

(4) An application under subsection (l) shall state

reasons explaining why it is believed that-

(a) a traffic data sought will be available with

the person in contol ofthe computer system;

(b) atype oftrafiic data suspected will be found

on that computer system;

(c) the subject ofan investigation or prosecution

may be found on that computer system;

(d) an identified offence is an offence in respect

of which the order is sought;

(e) measures shall be taken to maintain the

privacy of other users, customers and third
parties; and

(f) there will be no disclosure of data of any

party not part ofthe invcstigation.

(5) A Judge ofthe High Court may also require a seruice

provider to keep confidential, an Order under subsection (l) and a
\ ?rrant issued under subsection ( I ) of section I 0.

(6) A service provider who without reasonable excuse

fails to comply with an Order under subsection (l) commits an offence
and is liable on conviction to a fine not less than Le 100,000,000 and
not mor€ han L€ 5,000,000,000.
9 No. 7 The Cyber Secutity arld Crime Act 2A2t

lnterccption 15. (l) Where there are reasonable grounds to believe that
of content
the content ofa specifically identified electronic communications is
data.
reasonably required for the purposes of a specific investigation in
respect ofa felonious offence, a Judge ofthe High Cout may, on an
application by an enforcement ofiicer or other authoris€d person,
order a service provider to-

(a) collect or record; or

(b) co-operate and assist a competent aulhority

in the collection or recording of,

content data of specified communication within the jurisdiction

transmitted by means ofa computer system, in real time.

(2) Aa Order for the real-time collection or recording of

content data under sub-section (l) shall not be for a period beyond
what is absolutely necessary and in any event not more than 30 days

(3) An application under subsection (1) shall state

reasons explaining why it is believed that -

(a) L\e content data sought will be available with

the person in controI ofthe computer system;

(b) the R?e of content data suspected will be

found on a computer system;

(c) an identitied offence is lhe offence for which

the warranl is sought;

(d) funher disclosures are4eeded to achieve the

purpose for which the \ is to be issued,
where authority to seek"rrant
real-time collection
or recording on more than one occasion is
needed;
No. 7 The Cybet Securjty ahd Crime Act 2021 33

(e) measures taken shall be guided by

regulations made pursuant to this Act which
shall eusure that the real-time collection or
recording is carried out whilst maintaining
the p yacy of other users, customers and
third parties without the disclosure of
information and data of any party not part of
the investigation;

(0 the investigation may be frusftated or

seriously prejudiced unless the real time
collection or recording is permitted;

(g) to achieve the purpose for which the warrant

is being applied, real.time collection or
recording by a person in control of a
computer system is necessary; and

(h) adequate provision is made to ensure the

safe storage and protection of the content
data obtained and be used solely for matters
relating to iovestigations.

(4) A period ofreal-time collection or recording ofcontent

data under subsection (3) may be extended by a Judge ofthe High
Court for a further reasonable specified period oftime the same to be
for an additional period not more than 30 days, on an application by
an enforcement ofTicer or other authorised person, where the
extension is reasonably required for the purposes of-

(a) an investigation or prosecution;

(b) achieving the objective for which the warrant

is to be issued;

(c) ensuring that the real-time collection or

recording ofcontent data is carri€d out l,hilst
i4 No. 7 The Cyber Security and Crine Act 2021

maintaining the privacy of other users,

customers and third parties and withoul the
disclosure of information and data of any
parr)* not pan of the investigation;

(d) preventing an investigation from being

frustrated or seriously prejudiced; and

(e) averting overly burdensome cost ofsuch real-

time recording and collection on the person
in control ofthe computer system.
(5) A Judge ofthe High Court may also require a service
provider to keep confidential, an order made under subsection (l)
and a warrant issued under subsection ( t ) of section 10.

(6) The service provider shall have express right to

challenge an order regarding the collection ofreal time content data
where there is non-compliance with the provisions of,the Act by
filling an application to a Judge ofthe High Court.
(7) A sewice provider who fails to comply rvith an order
under subsection (1) commits an offence and is liable on conviction
to a fine not less than Le I00,000,000 and not more than Le
5,000,000,000.

Confidentiality 16. (l) A service provider shall not be subject to civil or

and criminal liabilitl arising in connection with its compliance with its
Limitation of
Liability. obligation, unless it is established that the service provider-
(a) had actual notice, actual knowledge or willful
aad malicious intent and not merely through
omission or Ailure to act; or

O) had facilitated, aided-€r abened the use by

any person of a computer system controlled
or managed by the service provider in
contavention ofthis Act or any other law.

@) A service provider shall not be liable underthis Act or

any other law for-
No. 7 The Cyber Security and Crime Act 2021 JJ

(a) maintaining and making his services

avaiiable; or
(b) the disclosure of any data or other
information to the extent required or in
complianc€ with the exercise ofpowen under
this Act.
f7. (l) The High Court shali have jurisdiction ov€r any Territorill
violation of this Act, including any violation committed by a Sierra jurisdiction
Leone national regardless ofthe place of commission.

(2) The Juridiction ofthe High Court urder subsection

( l), shall lie if an offence under this Act was committed -

(a) wirhin Siena L,eone;

(b) with the use ofa computer system wholly or
partly situated in Siena Leone; or
(c) when by such commission, damage is caused
to a natural or juridical person who, at the
time the offence was committed" was in Sierra
Leone.

18. Subj ect to the powers of the Attomey-General and Minister Paoseculion of
of Justicg law enforcement agencies shall haye power to prosecute Exrraditable
offences under this Act. ln lhe case of offences cornmitted under offcnces.
section 24 and 26 of this Acq the approval of the Attomey-General
must be obtained before prosecution.

19. (l)
The Court in imposing sentence on any person Fodeilure to
convicted ofan offence under thisAct, may order that the convicted the State.
person forfeits to the Republic ofSien-a Leone-

(a) any asset, money or property, whether

tangible or intangible, traceable to proceeds
of such offence; and
(b) any computer, equipment, software,
electronic device or any other device used or
intended to be used to commit or to facilitate
the commission ofsuch offence;
s No. 7 The Cyber Secu ty aad Ctirne -4ct 202t

(2) Where it is established that a convicted person has

assets or properties in a foreign country, acquired as a result ofsuch
criminal activities listed in this Act, such assets or properties, shall
subject to any Treaty or arangement with such foreign country, be
forfeited to the Republic of Sierra Leone.

(3) The Attomey-General and Minister of Justice shall

ensure that lhe forfeited assets or properti6 are effectively transferred
and yested in the Republic ofSierra L€one.

(4) Any person convicted of an offence under this Act

shall have his passport withheld and only retumed to him after he
has served the sentence or paid the fines imposed on him.

Rcstitution 20, In addition to any other penalty prescribed under this Act,
the Court may order a person convicted ofan offence under this Act
to make restitution to the victim of the false presence or fraud by
directing that the person -
(a) where the property involved is money, pay
to the victim an anoulrt equivalent to the loss
sustained; in any other case to-

(i) retum the properry to the victim or to a

person designated by him; or

(ii) pay an amount equal to the value ofthe

property, where the return of the
property is impossible or impracticable.

ft) an order of restitution may be enforced by

the victim or by the prosecutor on behalfof
the victim in the same manner as ajudgment
in acivil action.

PART V. NTERNATIONAL COOPERATION

Spontsncous 21. (l)The Attomey-General may, subject to this Act and
disclosore of without pdor request, forwad to a forcign state, information obtained
information.
under this Act, where he considers that the disclosure of such
infonffdion may-
No, 7 The Cyber Securily a d Crime Ac, 2021 37

(a) initiating or carying

assist the foreign stebe in
out an investigation or prosecution; or

O) lead to a request for cooperation by a foreign

state.

provided that such foreign state shall have or undertake to effect

mutual exchange ofinformation with Sierra Leone in such manner as
shall be agreed upon between the authorised personnel of sucb
foreign state and the Attorney-General subject to the approval of
Parliament

@) Infonnation provided under subsection (l), may be

subject to such conditions including confidentiality, as the Attorney-
General may require.

(3) Where a foreign state cannot comply with conditions

required under subsection (2), it shall notiry the Attorney-General,
who shall determine whether the information should nevertheless be
provided and where the foreign state accepts the information subject
to the conditions, it shall be bound by them.

22. (l) TheAttomey4eneral may cooperate with any foreigr Powers of

state or international agency for the purpose of- f,io.r"r-
Ceneral.
(a) investiga(ng or prosecuting offences under
this Act; or

O) collecting electlonic evidence related to an

offence punishable under the laws ofSierra
Leone.

(2) TheAttom€yceneral shall communicate dircctly wittr

the appropriate authority ofa foreign state responsible for sending,
answering, executing or transmining requests for mutual assistance
or extradition.

(3) Notwithstanding subsection (2), in case of urgency,

requests may be seot directly fiom judicial authority to judicial
authority, provided that the appropriate authority of the requested
state is notified by the appropriate authority ofthe requesting state-
38 No, 7 The Cyber Security qnd Crime Act 2021

(4) For urgent request or communication, the

lntemational Police Organisation networt may be used.

Authority to 23, (l) The Attorney{eneral may make requests on behalf

make and act
on mutual of Sierra Leone to a foreign state for mutual assistance in an
assistance investigation comrnenced or prosecution instituted in Sierra Leone,
r€qu€sts. relatbg to a computer relaled offence or collection of electronic
evidence.

(2) The Attomey-General may, in respect ofa request

from a foreign state for mutual assistance il an investigation
conrmenced or prosecution instituted in that state -

(a) grant the request, in \yhole or in part, on such

terms and conditions as may be deemed
necessary;

(b) refuse tie request on such conditions as he

deems necessary; or

(c) postpone a request, in whole or in part, after

consulting with the appropriate authority of
the foreign state, on the ground that grEnting
the request would be likely to prejudice the
conduct of an investigation or prosecution
in Sierra Leone.

(3) Mutual assistance requests under this section shall

b€ effectuated-

(a) in accordancewift the procedues specified

by a foreign state, except where it is
incompatible with the laws of Sierra kone;
or

(b) where the conduct alleged does not

constitute a $ime in both the foreign state
and h Sierra Leone.
No. 7 Tlu Cyber Security and Crime Act 2021 39

(4) TbeAttomey4eneral shatl, where appropriate, b€fore

refusing or postponing assistance, after having consulted with the
foreign state, consider whether the request may b€ granted pafiially
or subject to such conditions, as he deems necessary.

(, The Attomey-General shall promptly inform a foreign

state of-

(a) the outcome ofthe execution ofa request for

mutual assistance;
(b) any reason that renders impossible, the
execution of a request for mutual assistance
or is likely to delay it significantly; or

(c) any reason for reflrsal or postponement ofa

request for mutual assistatrce.

(Q A foreign state may request that Sierra Leone keeps

conndential the frct of any request for mutual assistance, except to
the extent necessary for its execution and if Siena lrone carmol
comply with the request for confidentiality, it shall promptly inform
the foreign state, which shall then determine whether the request
sbould nevertheless be executed.

24. (l) This Act complements the Exhadition Ac! 1974 (Act Extradirion
No- I I of 1974) which makes provision for the exlradition ofpersons
accused or convicted ofan offence in another country.

(2) Extradition shall Dot be requested for an offence unless

it is an offence in both the foreign state and in Siera Leone.

(3) An offence under this Act shall be extraditable if tle

penalty imposed is imprisonment for a term ofnot less than one year
or a fme equivalent to the peoalty of one year imprisonment.

(4) Extradition will be subject to the conditions provided

for by the law of the foreign state or applicable extradition treaties,
including the grounds on which tbe foreign state may reiuse
exradition.
40 No,7 The Cyber SecLrity and Ctime Act 2021

(5) In line with the extradition or prosecution principle,

where extradition is refused on the sole basis of-

(a) the nationality of the person sought to be

extradiled; or

O) Sierra Leone having jurisdiction over tbe

offence,

the investigation or prosecution shall be conducted and the matter

reported to the foreign state.

confidenxalrty 25. Where there is no muhral assistance teaty or arangement

:lo"l:tnn"" in force between a forcign state and Sierra Leone, Sierra Leone shall
make the supply ofinformation in response to a request on condition
that it is-

(a) kept confidential; or

(b) used only for investigations or prosec[tions

stated in the request.

Expedited 26. (l) A foreign state may request or obtain the expeditious
preservation preservation ofdata stored by means ofa computer system, located
of stored
computer within Sierra kone, in respect ofwhich it intends to submit a request
date. for mutual assistance, for the search, access. seizure, security or
disclosure of the data.

(2) A request for preservation of data submitted under

subsection (l) shall speci$ the-

(a) authority seeking the preservation of data;

(b) offence that is the subject ofan investigation

or prosecution, including a brief summary of
the related facts;
No. 7 The Cyber Security and Crtme Act 202r 4t

(c) stored computer data to be pr€served and

its relationship to the offenc€;

(d) available information identifying the

custodian ofthe stored computer data or the
location of the computer system;

(e) necessity ofthe preservation of data; and

(0 intention to submit a request for mutual

assistance for the search, access, seizure,
secudty, or disclosue ofthe stored computer
data.

(3) Upon receiving a request under subsection (l), the

Anorney-General shall take all appropriate measures to expeditiously
preserve t e specified data in accordance with the procedures and
powers under this Act.

(4) A request under subsection effected where

( I ) shall be I
the conduct alleged does not constitute a crime in both the foreign
state and in Sierra L€one.

(5) A preservation of data effected in response to a

request under subsection (l) shall be for a period not l6ss than 90
days, in order to enable the foreign state, to submit a request for the
search, access, seizure, securtiy or disclosure of the data and
following the receipt ofsuch a request, the data shall continue to be
preserved until a final decision is taken on that pending request.

27. (l) Where during the coune ofexecuting a request under Expedited
wift respect to a specified communication, it is discovered disclosure
section 26, of
preserved
that a service provider in another state was involved in the traffic data.
transmission of the communication, the Attorney-General shall
expeditiously disclose to th€ foreign state, sufficient amount oftraffic
data to identiry that sarvice provider and the path through which the
comrmmication was transmitled.
(2) Exiedited disclosure ofpreserved tramc data under
subsection ( I ) may only be withheld where the -
 No.7 The Cyber Security and Ciae Act 2021

(a) request concems a political offence or an

offence related to a political offence; or
(b) AttorDey-General considers that the
execution ofthe request is likelyto prejudibe
the sovereignty of Sierra Leone, securjty or
public interest.

Mutual 28. (l) A foreign state may request the search, access, secure
assistmce or disclosure ofdata stored by means ofa cornputer system located
regarding
accessing of within Sierra Leone, including data that has been preserved under
stored section 26.
computar
data.
(2) When making a request undel subsection (l), the
foreign state shall provide adequate information on the following-

(a) the name of the authority conducting the

investigatioo or prosecution to which the
request relates;

(b) a description of the natue of the criminal

offence and a statement setting out a
summary ofthe relevant facts and laws;

(c) a description of the purpose of the request

aDd of the nature of the assistance being
sought;

(d) in the case of a request to restrain or

confiscate assets believed on reasonable
grounds to be located in Siera Leone, details
ofthe offence in question, particulars ofany
investigation or prosecutioa commenced in
respect of tbe offence, including a copy of
any relevant restraining or confiscation order;

(e) details ofary procedure that the foreign state

wishes to be followed by Sierra Leone in
giving effect to the requesl pafticularly in
the case ofa request to take evidence;
No.7 The Cyber Secutity dnd Crime Act 2021 43

(0 a statement setting out any wishes of the

foreign state concerning confidentiality
relating to the request and the reasons for
those wishes;

G) details oftbe period within which the foreign

state wishes the request to be complied with;

O) where applicable, details of the property,

computer, computer system or device to be
traced, restrained, seized or confiscated and
ofthe gomds forbelieving that the poperty
is believed to be in Sierra Leone;

(i) details ofthe stored computer dat4 data or

program to be seized and its relationship to
the offence;

(j) information identiSing the custodian ofthe

stored computer data or the location ofthe
computer, computer syslem or device;

(k) an agre€ment on the question ofthe payment

of the damages or costs of fulfilling the
request;

0) details to the effect that wanant in regard

the matter under investigation has already
been obtained to extend the investigations
overseas; and

(m) any other information that may assist in

giving effect to the request.

(3)Upon receiving a request under subsection (l), the

Attorney- General shall take all appropriate measures to obtain
necessary authorisation including a warrant to execute in accordance
with the procedures and powers under this Act or any other law.
41 No. 7 Tle Cyber Security and Crime Act 2021

(4) Upon obtaining oecessary authorisation und€r

subsection (3), including a warant to execute, the Attomey-General
may seek the support and cooperation of the foreign state during
such search and seizure.

(5) Upon conducting the search and seizure under

subsection (4), the Attorney-General shall provide the results ofsuch
search aad seizue, as well as the evidence seLed, to the foreign
state.

Trens-border
&ceess to
29, Subject to this Act, an enforcement omcer or other
stored atthorized person may, without authorisation-
computer
data (a) access pubticly available (open source)
stored computer data, regardless of where
the data is located geographically; or

(b) access or receive through a computer system

in Sierra kone, stored computer data located
in a foreign state, if such an enforcement
officer or other authorised person obtains the
lawful and voluntary cons€nt of the person
who has the lawful authority to disclose the
data through that computer system.

Provided that any such access shall be without prejudice to fte rights
to privacy of persons and may be rescinded upon an application try
a person affected to a Judge ofthe High Court.

Muiual 30. (l) A foreign state may request the Attomey-General to

assistarce in provide assistance in real time collection of traffic data associated
r€a.l tine
collection of with specified communications in Sierra Leone aansmitted by means
traffic dat.. of a computer system.

(2) A request for assistance under subsection (l) shall

speci&-

(a) the authority making the request;

No. ? The Cyber Securir^ and Crime Act 2021 45

(b) the ollence that is the subject ofa criminal

investigation or prosecution and a brief
sunmary of the related facts;

(c) the name ofthe authority with access to the

relevant taffic data;

(d) the Iocation at which the ftamc data may be

held;

(e) the intended purpose for the required traffic

dalai

(0 sufncient information to identiry the trafnc

dzta;
(e) firther details ofrelevant t'affic data;

o) the necessity for use of powers under this

section; and
(') the terms for the use ald disclosure of the
traffic data to third parties.

(3) Upon receiving a requsst under subsection (1), the

Attorney- General shall take all appropriate measures to obtain
necessary authorisation including a warrant to execute upon the
request in accordance with the procedures and powers under this
Act or any other law.

(4) Upon obtaining necessary authorisation including a

warant to execute a request under subsecdon (l), the Attomey-
General may seek the support and cooperation of the foreign state
during the search and sei.zue.

(5) Upon conducting the measures under this section,

the Aiomey-General shall provide the resuhs of such measurEs as
well as real-time collection of trafTic data associated with specified
communication to the foreign state.
4 No. 7 The Cyber Security ahd Crime Act 2021

Mutual 31. (l) A foreign state may, in relation to a serious offence in

assisunce
that state, request or provide assistance in the real time collection or
r.ga.dinB
intcrception recording ofcontent data ofspecified communicatioo tmnsmitted by
of cont.nt means ofa computer system in Sierra L€one.
data.

(2) A reques for assistance under subsection (l) shall

specig-

(a) the authority making the request;

(b) the offence that is the subject ofa criminal

investigation or prosecution and a brief
summary ofthe facts;

(c) the name ofthe authority with access to the

relevant communication;

(d) the location at which or nature of tbe

communication;

(e) the intended purpose for tbe required

communication;

(0 sufficient information to identify the

communication;

G) details ofthe data ofthe relevant interceptioni

(h) the recipient of the cornmunication;

o the intended duration for the use of the

communication;

0) the necessity for use of powers under this

section; and

(k) the terms for the use and disclosure of the

communication to thfd parties.
No. 7 The Cyber SecuriE ahd Crime Act 2021 47

(3) Upon receiving a request under subsection (l). the

Afiomey- General shall take appropriate action to execute the request
in accordance with t}le procedures and powerc uoder this Act.

(4) The Attorney-General shall, on executing the request

under subsection (3), provide the results of such action as well as
real time collection or reeording of content data of specified
communication to the foreign state.

32. (l) The National Cybersecurity Coordinator or his point of

authorized representative shall designate a point ofcontact available contact
on a24-hour,7{ays-a-week basis, in order to ensure the provision of
irnmediate assistance for the purpose of investigation or prosecution
ofoffences relat€d to computer systems and data, or for the collection
ofevidence in elecronic form.

(2) Immediate assistance to be provided under

subsection ( l) shall include -

(a) the provision oftechnical advice;

(b) the preservation of data pursuant to

expedited preservation of stored computer
data and expedited disclosure of preserved
taffic data; and

(c) the collection ofevidence, the provision of

legal information, and locating ofsuspects.

(3) A point ofcontact under subsection (l ), shall -

(a) be resourced with and possess the requisite

capacity to securely and efficiently carry out
communication with other points of contact
in other states, on an expedited basis;

@) have the authority and be empowered to

coordinate and enable access to international
 No.7 The Cyber Sealrity and Crirne Act 2021

mutual assistance under this Act or if

applicable extadition procedures, upon an
expedited basis.

PARTVI OFFENCES

Unauthorised 33. (l) A person, including a corporation, partnership, or

access. association, who intentionally and without authorisation causes a
computer system !o perform a function with inlent to secue access
to the whole or a part ofa computer system or to enable such access
to be secured other than to secure and protect the integrity oldigital
communications or for unlawful purposes, commits an offence and
is liableupon conviction to fine not less than Le 100,000,000 and not
more than k 250,000,000 orto a term ofimprisonment not less than
2 years and [ot exceeding 5 years or to both such fine and
imprisonment and in the case of a corporation, partnership, or
association, to a fine nol less than Le500,000,000 and not exceeding
t€ 1,000,000,m0.

(2) For the purposes of this section, a pe6on secures

access to computer data stored in a computer system ifby causing a
computer system to perform a function he-

(a) alters or erases computer data; or

(b) copies, transferc or moves computer data to

(i) a computer system or computer data

storage medium other than that in which
it is stored; or

(0 a different location in the same computer

system or computer data storage
medium in u,hich it is stored;

(c) has the computer data output from the

computer system in which it is held, whether
by having it disptayed or in any other manner;
No. 7 The Cyber Security and Ctime Act 2 021 49

(d) uses the computer data.

(3) For the purposes of this section, "unauthorised'i

means access of any kind, to a computer system, program or data, by
a person who has been authorised to access a specific data in a
computer syslem and without lawful excuse, whether t€mporary or
not, cause a computer system to perform a function other than those
authorised, with intent to secure access to the whole or a part of a
computer system or to enable such access to be secured,

(4) The absence ofauthority to secure access to the whole

or any part of a computer system under subsection (l) includes
instances where there may exist general authority to access a
computer system but a specific type, nature or method ofaccess may
not be authorised.

(5) For the purposes of this section intention or

recklessness needs not relate to-

(a) a particular computer system;

O) a particular program or data; or '

(c) a progam or data ofany panicular kind.

.(O A person shall be deemed to have contravened

subsection (l>

(a) in the absence of proof that the accused has

the requisite knowledge to access the
computet program or data;

(b) notwithsta-nding rhe tact that committing the

offence is impossible;

(c) in the absence of a program or data of any

panicular kind.

34. (l) A person, including a corporation, partnership, or Unauthorised

association, who inte tionaliy or without reasonable authorisation access to
causes a computer system to perform a function with intent to secure protectcd
system.
access to computer or program or data used directly in connection
50 lr-o. 7 The Cyber Secutiry and Crine Act 2021

with or necessary for a Critical National Information Inftasmrcture

cornmits an offence and is liable upon conviction to a fine not less
than t* I 00,000,000 and not more than [.e 250,000,000 or to a term of
imprisonment not less than 2 y€ars and not exceeding 5 years or to
both such Frne and imprisonment and in the case of a corporation,
partnership, or association, to a fine not less than Le500,000,000 and
not exceeding I.e 1,000,000,000.

(2) A person, including a corporation, partnership, or

association, who has been authorised to access a specific data in a
computer system and without lawfirl excuse, whether temporary or
not, cause a computer system to perform a function other than that
authorised, or intentionally permits tampering of such computer
systems ,l fith intent to secure access to the whole or a part of a
computer system or to enable such access to be secured, commits an
offence and is liable on conviction to a fine not less than Le
100,000,000 and not more than Le 250,000,000 or lo a term of
imprisonment not less than 2 years and not exceeding 5 years or to
both such fine and imprisonment and in the case of a cbrporation,
partnership, or association, to a fine not less than Le500,000,000 and
not exceeding [€ I ,000,000,000.

(3)
The absence of authority to secure access to the
whole or any part of any computer system under subsection (l)
includes instances where there may exist general authority to access
a computer system but a specilic t)?e, nature or method of access
may not be authorised-

Unauthorised 35. 0) A person, including a corporation, parmership, or

dsta
association, who intentionally and without authorisation intercepts
interc€ption.
or causes to be intercepted non-public transmissions of data to or
from a c-omputer system whether directly or indirectly the Eaosmission
ofwhich -

(a) results in a significant financial loss;

(b) tfueatens national secudty;

No. 7 The Cyber Securiry ahd C rne Acl 2021 5l

(b) causes physical injury or death to any

person; or

(c) threatens public health or public safety,

corunits an offence and is liable upon conyiction to a fine not less

than Le 100.000,000 and not more than k
250,000,000 or to a term of
imprisonment not less than 2 years and not exceeding 5 years or to
both such fine and imprisonment and in the case of a corporation,
partn€rship, or association, to afine not less than Le 500,000,000 and
not exceeding l-e I ,000,000,000.

(2) Where a person, including a corporation, partnership,

or associatiorL intentionally and without authorisalion, intercepts or
causes to bo intercepted, the transmission of data to or fiom a
computer system over a telecommunication under subsection (l),
commits an offence and is liable upon conyiction to a frne not less
than Le 100,000,000 and not more than [,e 250,000,000 orto a term of
imprisonment not less than 2 years and not exceeding 5 years or to
both such fine and imprisonment and in the case of a corporatio[,
partneBhip, or associatior! to a fine not less than Le 500,000,000 and
not exceeding [,e 1,000,000,000.

Itis fnmatedal whether -

(a) the unauthorised interception is not dir€cted

at-

(i) a telecomrnunications system;

(D a particular computer system;

(iif a program or data ofaly kind; or

(iv) a program or data held in any particular

computer systemi

(b) an unauthorised interception or an intended

eflect ofit is permanent or temporary.
I No. ? The Cyber Securitl and Cri e Act 20)t

Unauthorised
data
36. A person, including a corporation, partnership. or
interfer€nce. association, who intentionally or without authorisation does an act
in relation to a computer system which-

(a) causes destruction, damage, deletion,

erasure, deterioratioq generation, modifica-
tion or alteration ofa program or data or any
aspect or attribute related to the program or
data;

ft) renders a program or data meaningless,

useless or ineffective;

(c) obstructs, interrupts or interferes with the

use of any program or data or any aspect or
attribute related to the program or data;

(d) causes denial, prevention, suppression or

hin&ance of access to a progam or data or
any aspect or attribute related to the program
or data or to any person entitled to it;

(e) causes impafum€nt to the operation of a

Progam;

(0 causes impairment to the reliability of any

dat4 aspect or attuibute related to a progam
or data;

(g) causes impairment to the security of a

program or data or any aspect, attribute
related to a program or data; or

(h) enables any of the acts mentioned in

pamgraphs (a) to (g) to be done,

commits an offence and is liable upon conviction to a fine not less

than t e I 00,000,000 and not more than l,e 250,000,000 or to a term of
No. 7 The Cyber Sectity and Cime Act z02t 53

imprisonment not less than 2 years and not exceeding 5 years or to

both such fine and imprisonment and in the case of a corporation;'
partnership, or association, to afine not less than h 500,000,000 and
not exceeding Le I ,000,000,000

37. A person, including a corporation, partnership, or unauihorised

association, who intentionally or without authorisation does an svstem
interfercncc
unauthorised act in relation to a computer system which -

(a) interferes with, hinders, damages, prevents,

suppresses, deleriorates, impa irs or
obstructs the functioning of a computer
system;

(b) interferes with, hinders, damages, prevents,

suppresses, deteriorates, impairs or
obstructs the communicatioo between or
]vitha computer system;

(c) interferes with or hinders access to

. acomputer systcml

(d) impairs the operation ofa computer system;

(e) impairs the reliability ofa computer system;

(0 impairs the security of a computer system;

or

(g) enables any of the acts mentioned in

paragraphs (a) to (f) to be done,

commits an offence and is liable upon conviction to a fine not less

than Le 100,000,000 and not more than Le250,000,000 ortoa term of
imprisonment not less than 2 years and not exceeding 5 years or to
both such fine and imprisonment and in the case of a corporation,
partne$hip, or association, to a fine not less than Le 500,000,000 and
not exceeding [r I,000,000,000
g No. 7 The Cyber Secutity and Crine Act 2027

Provided that it shall not be an offence ifinterference with a computer

system is undertak€n in compliance and in accordance with the terms
ofa warrant issued under this Act or any law.
Misuse of 38. (D A person, including a corporation, partnership, or
device.
association, who intentionally or without authorisation manufactures,
adapts, sells, procures for use, receives, possesses, impo(s, offers
to supply, distributes or otherwise makes available-
(a) a device designed or adapted primarily for
the purpose ofcommitting an offence under
this Act; or

(b) a computer password, access code or similar

data by *'hich the whole or any part of a
computer system is capable of being
accessed, designed or adapted primarily for
the purposes ofa computer system.
(c) uses electronic communication eqqipment to
bypass standard inter-connection path by
illegal redirection of traffi c.

commits an offence and is liable upon conviction to a file not less

than tr
500.000,000 and not more than Le 1,500,000,000 or to a term of
imprisorunent not less than 5 years and not exceeding l0 years or to
both such fme and imprisonment and in the case of a comoration,
parmership, or association, to a fine not less than Le 3,000,000,000
and not exceeding Le 6,000,000,000.

(2) Notwithsanding subsection (1) a person shall not be

deemed to have committed an offence if he does an act under
subsection (l ),-

(a) for the purpose of training, testing or

protection ofa computer system; or

(b) .in compliance ofand in accordance with the

tenns ofajudicial order issued orin exercise
of a power under this Act or any law.
n*o.7 The Cyber SecuriO' ahd Crine Act 2021 55

(3) For the purpose of subsection (l), possession of a

program or a clmputer password, access codg or similar data includes
having-

(a) possession of a computer system which

contains the program or a computer
password, access code, or similar data;

(b) possession of a data storage device in which

the program or a computer password, access
code, or similar data is recorded; or

(c) control ofa program or a computer password

access code, or similar data that is in the
possession of another person.

39. A person, including a corporation, partnership, or Un.uriorised

associatioq who intentionally or without authorisation discloses to discloaure of,
p6s*ntd'
another persoD a password, access code or other means of gaining
access to any progmm or data held in a computer system-

(a) for any wrongfut gain;

(b) for any unla*firl purpose; or

(c) to occasion any loss,

commits an offence and is liable upon conviction to a fine not less

than Le 10,000,000 and not more than Le 30,000,000 or to a term of
imprisonment not less than 1 year and not exc€eding 3 yea$ or to
both such fine and imprisonment and in the case of a corporation,
partnership, or association, to a fine not less than [r 50,000,000 and
not exceeding Le 100,000,000.

40. (l) A persog including a corporation, partnership, or Computer

association, who intentionally or without authorisation inputs, alters, telated
lorg€rv'
deletes or suppresses computer data, resutting in inauthentic data
with the intent that it be considered or acted upon for legal purposes
as if it rvere authentic, regardless ofwhether or not the data is directly
s No.7 The Cyber Secwi, and Cime Act 2021

readable or intelligible, commits an offence ard is liable upon

conviction to a fine not tess than Le I 0,000,000 and not more than Le
30,000,000 orto a term ofimprisonment not less than I year and not
exceeding 3 years or to both such frne ard imprisonment and in the
case ofa corporation, parhership, or association, to a fine not less
than k 50,000,000 and not exceeding l,e 100,000,000

(2) A person, including a corpo.ation, partnership, or

association, who dishonestly or witi similar intenl -

(a) for wrongful gain;

(b) for wlongful loss to another person: or

(c) for any economic benefit for oneself or for

another person,

intentionally or without authorisation inputs, alters, deletes or

suppresses computer data, resulting in inauthentic data witb the
intent that it be considered or acted upoD for legal puposes as if it
were autientic, regardless of whether or not the data is directly
readable or intelligible commits an offence and is liable on conviction
to a frne not less flan Le 30,000,000 and not more than l€ 50,000,000
or to a term of imprisoffnent not less than 2 year a.nd not exceeding
5 years or to bolh such fine and imprisooment and in the case ofa
corporation, partnership, or association, to a fine not less than
t€ I 00,000,000 and not exceeding Ir 250,000,000

Computer 41. A person, including a corporation, partnership, or

fraud.
association, who intentionalty causes loss of property, valuable
security or consideration to another person by -

(a) inputting, alteration, modification, deletion,

suppression or generation of a program or
dvtai
(b) interference, hindrance, impairment or
obstruction with the functioning of that
computer systeml or
No. 7 The Cyber Secutity ahd Crime Act 2021 17

(c) copying, transferring or moving data or

program to another computer system, device
or storage medium other than that in which it
is held or to a different location in any other
computer system, device or storage medium
in which it is held;

(d) using any data or program; or

(e) having any data or program output from

thecomputer system in which it is held,
whetherby having it displayed or in any other
manner.

with fraudulent or dishonest intent of procuring, without righq an

ecooomic benefit for himselfor for another person commits an offence
and is liable upon conviction to a fme not less than Le 30,000,000 and
not more tian Le 50,000,000 or to a term ofimprisonment not less
than 2 years and not exceeding 5 years or to both such fine and
imprisonment and in the case of a corporation, partnership, or
association, to a fine not less than Le100,000,000 and not exceeding
l€ 250,000,000"

42. (l) A, person, including a corporation, parmership, or ldentily theft

association, who is engaged in the services ofany financial institution, a,ld
impersonstioI!.
and as a result of his special knowledge commits identity theft,
phishing of its employer, staff, seFr'ice providers and consultants
with the intent to de&aud commits an offence and is liable upon
convictio. to a fine not less than Le 50,000,000 and not more than Le
100,000,000 or to a term of imprisonment not less than 3 years and
not exceeding 7 years or to both such fine and imprisonment and in
the case of a corporation, partnership, or association, to a fine not
less than k100,000,000 and not exceeding Le 250,000,000.

(2) A person, including a corporation, partnership, or

association, who fraudulently-
58 No. 7 The Cyber Secwity ahd Crirne Act 2021

(a) or dishonestly makes use ofthe electonic

signature, password or any other unique
identification featue ofany other person; or

(b) impersonates another entity or person, livhg

or dead, tYith intent to-

(D gain advantage for himself or another

Person;

Qi) obtain any property or an interest in any

property;

(iii) cause disadvantage to the person or

entity being impersonated or another
person; or

(iv) avoid arrest ol prosecution or to

obstmct, pervert or defeat the course
ofjustice, commits an offence and is
liable upon convictionto afine not less
than Le 50,000,000 and not more than
Le 100,000,000 or to a term of
imprisonment not less than 3 years and
not exceeding 7 years or to both such
fine and imprisonment and in the case
of a corporation, partnership. or
association, to a fine not less than
Le100,000,000 and not exceeding l*
250,000,000.

(3) A person, including a corporation, partnership, or

association, who makes or causes to be made, either dtectly or
indirectly, any ialse news as a material fact in w ting, knowing it to
be false and with the intent that it be relied upon respecting his
identity or that ofany other person or his financial condition or that
of any other person for the purpose of procuring the issuance of a
card or other instrument to himself or another person commits an
No.7 The Cyber Securib/ and Crime Act 7o2t 59

offence aod shall be liable on conviction to a fine not less thari Le

50,000,000 and not more than Le 100,000,000 or to a term of
imprisonment not less than 3 years and not exceeding 7 years or to
both such fine and imprisonment and in the case of a corporation,
partnership, or association, to a ftne not less than Le 100,000,000 and
not exceeding Le 250,000,000

43. A person, including a corporation, partnership, or Elccrronic

association, who with the intent to detaud and or misrepresent" forges siS,rature.
through electronic devices another person's signatue or company
mandate co[units an offence and shall be liable on conviction to a
6ne not less than Le 50,000,000 and not more than Le 1 ,000,000,000 or
toa term of imprisonment not less than 3 years and not exceeding 5
years or to both such fine and imprisonment and in the case of a
corporation, partnership, or association, to a fine not less than
k500,000,000 and not exceeding l,e 5,000,000,000.

44. (1) A person, including a corporation, pannership, or cybe,

association, who individually or with another person. willfully and stalking and

repeatedly communicates, either directly or indirectly, with another

person, if he knows or ought to have known thal. his conduct -
ffinr.

(a) is likely to cause that person apprehension

or fear ofviolence to him or damage or loss
on tris propeny-l or

(b) detrimentally affects thal person;

commits an offence and strall be liable on conviction to a fine not less

than Le 30,000,000 and not more than Le 50,000,000 or to a term of
imprisotrment not less than 2 years and not exceeding 5 years or to
both such fine and imprisonment and in the case of a corporation,
partnership, or associatioq to a fine not less than Le 100,000,000 and
not exceeding Le 250,000,000

(2) A person, including a corporation, partnership, or

association, who recklessly or intentionally sends a message or other
matter by means ofa computer system or network that-
@ No. 7 The Cyber Security ahd Cri e Ae, 2021

(a) is grossly offensive, pomographic or of an

indecent, obscene or menacing character or
causes any such message or matter to be so
disseminated without consent; or

ft) he knows to be false, for the purpose of

causing danger, obstructioo, insult, injury.
criminal intimidation enmity, habe4 ill will or
needless anxi€ty to another or causes such a
message to be sent,

commits an offence anC shall be liable on conviction to a fine not less

than Le 30,000,000 and not more than l-e 50,000,000 or to a term of
imprisonment not less than 2 years and not exceeding 5 years or to
both such fine and imprisonment and in the case of a corporation,
partnership, or association, to a fine not less than Le 100,000,000 and
not exceeding t,e 250,000,000.

(3) Notwithstanding subsection (l) a person shall not be

deemed to have acted in contmvention of this Act ifhe does an act -

(a) for the purpose of preventing or detecting

crime;

(b) in compliance of and in accordance with the

terms ofajudicial order issued or in exercise
ofany power under this Act or any law; or
(c) which is in the interest ofthe public.

Cyber 45. 0) A person, including a corporation, partnership, or

Squatting. association, who intentionally takes or makes use ofa name, business
name, ffidemarl( domain name or other word olphrase registered,
owned or in use by an individual, body corporate or belonging to a
govemment institution in Sierra Leone, on the intemet or any other
computer network, without authority, dght or reasonable excuse and
for the purpose of interfering with the use by the owner, registrant or
legitimate prior usec shall be liable to damages in a civil action as
determined by a Judge ofthe High Court.
No.7 The Cyber Searity and Crirne Act 2021 6!

(2) ln awarding penalty against an offender under this

section, a court shall have regard to the following-

(a) refusal by the person to relinquish, upon

formal request by the rightful owner without
reasonable excuse ofa name, business name,
trademark, domain name, or other word or
phrase registere{ owned or in use by any
individual, body corporate or belonging to
the Government of Sierra Leone; or

O) any attempt by the offender to obtain

compensation in any form for the release to
the rightful owner for use of the name,
business name, trademark domain name or
other rrord or phrase registered, owned or in
use by the individual, body corporate or
b€looging to the Governrnent ofSiena Leone.

(3) In addition to the penalt-v specified in this section,

the court may make an order dfuecting an offender to relinquish such
registered name, mark, trad€mark, domain name or other word or phrase
to the rightful owner.

46. A person, including a corporation, partnership, or lnfringemert

associatio& who, through input, alteralion, modification, deletion, of copyight
and rclated
suppression or generation ofa program or data or through use ofa rights
computer, computer system or eleckonic device willfully infringes
any right protected underthe CoplrightAct,201 l(Act No. 8 of20l I )
or any law in force for protection of copyrights and related rights,
corunits an offence and is liable on conviction to a frne not less than
Le 100,000,000 and not more than Le 250,000,000 or to a term of
imprisonment not l€ss than 2 years and not exceeding 5 years or to
both such fure and imprisonment and in the case of a corporation,
partnership, or association, to a fine not less than Le500,000,000 and
not exceeding Le 1,000,000,000 without prejudice to civil remedies
that may be available.
a No.7 Thz Cyber Securily and Cfime Act 2421

Online child 47. (l) A person, including a corporation, parhership, or

saxual abuse.
association, who, intentionally-

(a) disributes, produces, fansmits, dissemin-

ates, circulates, delivers, exhibits, Iends for
gain, exchanges, barters, sells or offers for
sale, lets on hirc or ofieIS to l€t on hire, prints,
photo$aphs, copies, provides location,
requests for, offers in any other way, or
makes available in any way child
pomography through a computer system or
storage data medium; or

(b) acquiesces a child's participation in

pomogaphy,

commits an offence and shall be liable on conviction to a fine oot

less than Le 100,000.000 and not more than Le 250,000,000 or to a
term of imprisonment not less than 5 years and not exceeding l0
years or to both such fine and imprisonment and in the case of a
corporation, partnership, or association, to a fine not less than Le
500,000,000 and not exceeding Le I ,000,000,000

(2) A person, including a corporation, parfiIership, or

association, who intentiona.lly poses, grooms or solicits, through
any computer system or network, to meet a child for the purpose of

(a) engagiDg in sexual activity with the child;

(b) engaging in sexual activity with the child

where-

(f coercion, inducement, force or thrcat is

used;

(if a recognised position oftrust, authority

or influence over the child, including
within t}e family is abused; or
No. 7 The Cyber Sccurity and Crirne Act 2021 63

(iif a child's mental or physical disabiliry or

situation of dependence is a b u s e d;

commits an offence and shall be liable on conviction to a fine not less

than IrI 00,000,000 and not morc than Ir 250,000,000 or to a term of
imprisonment not less than 5 years and not exceeding l0 years or to
both such fine and imprisonment and in the case of a corporation,
parhiership, or association" to a fine not less than Le 500,000,000 and
not exceeding lr I,00O,0O0P00

(3) Notwitlbtanding subsection (l ) a person shall not be

deemed to have committed an offence ifhe does an act intended for
a bona fide scientific ormedical research or law enforcement.

(4) For purposes of this section-

"child" means a person under the age of l8 years;

"child pornography" includes data which, whether visual or audio,

depicts-

(a) a child engaged in sexually explicit conduct;

O) a person who appears to be a child engaged

in sexually explicit conduct; or

(c) realistic images representing a child engaged

in sexually explicit conduct.

48. 0) A person, including a corporation, partnership, or online adulr

association who: sex$al lbuse.

(a) take or share an intimate image or voice

material ofadepicted person without his/her
consent;
& No. 7 The Cyber Security and Crime Act 2021

O) take or share an intimate image or voice

material ofa depicted person without his/her
consen! with the intention to humiliate, alam
or dishess the victim;

(c) take or share an intimate image or voice

material ofa depicted person without his^rer
consent, for the purpose of either sexual
gratification by the perpetrator or that of
another;

(d) theaten to share any intimat€ image oi voice

material of a depicted person Ivith intent to
cause the depicted person to fear that the
image or audio material will be sha:ed, or
being reckless as to whether the depicted
person will have such fear that the threat will
be executedl

(e) disseminate or post sexually explicit image,

media or voice material without the consent
of the depicted person, whether or not the
intent is to shame, humiliaG, Aighten or cause
the depicted person hann.

conrmits an offence and shall be liable on conviction to a fine not less

than k I 00,000,000 and not more than [.e 250,000,000 or to a term of
imprisonment not less than 5 years and not exceeding l0 years or to
both such fine and imprisonment and in the case of a corporation,
No.7 The Cyber Seeutity ahd Crifie Act 2021 65

partnership, or association, to a fine not less than Le 500,000,000 and

not exc€eding t€ 1,000,000,000.

(2) In this section, the expressions "intimate image or

voice material" shall include video, images or voice media created by
the depicted person which hs'she has not willingly put into the public
domain; video, images or voice media taken by another; video, images
or voice media in the possession of the perpetrator by any means
whatsoever including been stolen &om a hacked computer or other
digital device ofthe depicted person; video, image or voice material
that may have been doctored by superimposing the face or voicc of
a depicted person unto an existing intimate or sexually explicit image
or some other voice media.

49. (l) A person, including a corporation, partnership, or Attempting

association, who intentionally abe$ the commission of, aids ," f**oft "',
commiE attempts to commit or does any act preparatory to or in
furtherance ofthe commission ofan offence under this Act conunits
an offence and is liable upon convictio to the same penalty as that
prescribed in respect of the substantive offence under this Act.

@) An offence may be deemed to have been committed

under subsection ( I ), notwithstanding where the act in question took
place.

50. (l) No person shall engage in the operation ofa business Regisrarion
of providing computers for accessing the intemet, playing e""t*, ll;]l"t
chatting or doing other computer-related task unless the business.
6 No. 7 The Cyber Secutity ahd Crime Act 2021

(a) has a registered business name with the

Corporate Affaits Commission established
under the Companies Act, 2009 (Act No. 5 of
2@9);or

(b) is registered with a local corurcil; or

(c) is registered with tbe office of the

Administrator and Registrar General; and

(d) registered with National Telecommunications

Commission established under lhe
Telecommunications Act, 2006 (Act No. 9 of
2006) as a business concemed with providing
computer access to the internet.

(2) A person, including a corporation, partnership, or

association, who perpetrates elecEonic Faud or online Aaud under
this Act using a cybercafd, commits an offence and is liable on
conviction to a fine not less than k 50,000,000 and not more than Le
500,000,000 or to a term of imprisonment not less thatr 3 years and
not excseding 5 years or to both such fine and imprisonment and in
the case of a corporatioq parhership, or association, to a fine not
less than 1,e500,000,000 and not exceeding l-e 5,000,000,000.

provided that the cybercafC owner ot manager shall not be liable for
such an offence unless there is evidence to the effect that he or she
or it were complicit in the commission ofthe oflence.
No. 7 The Cybet Security and Crirne Act 202t 67

51, 0) A p€rson who accesses or cause to be accessed a cyber

'tetrorism.
computer or computer system or network lor purposes ofa terorist
act, commits an offence and is liable on conviction to a term of
imprisonment not less than 10 years aad not exceeding 20 years.

(2) For purposes ofthis sectioq "tenorist act" shall have

the same meaning as provided under the Anti-Money kundering
and Combating of Financing of Terrorism Act. 2012 (Act No. 2 of
2012\.

52, 0) A person, including a corporation, partsrership, or R.cisr

association, who witb intent- 6;x""'J:0"

(a) distibutes or otherwise makes available,

racist or xenophobic material to the public
tkough a computer system or network;

O) theatens through a computer system or

network any other person or group of
of belonging to a
persons for th€ reason
group distinguished by race, colour,
descent, national or ethnic origin, gender
religion, as well as disability

(c) insults publicly through a computer system

or network any other person or group of
persons distinguished by race, colour,
descent or national or ethnic origin, as well
as religion; or
68 No.7 Thz Cyber Security and Crime Act 202t

(d) disributes or otherwise makes available, to

the public, material wtrich denies or approves
or justifies acts constituting genocide or
crimes against humanity,

commits an offence and is liable upon conviction tg a flrne not less

than l* 50,000,000 and not more than l€ 100,000,000 or to a term of
imprisonment not less than I year and not exceeding 3 years or to
both such fine aad imprisoment and in the case of a corporation,
partnership, or associatio[, to a fine not less than Le250, 000,000 and
not exceeding Le 5 00,000,000

Reporting 53. (l) A person or institution that operates a computer

cybcr threats.
system or netwodq whaher public or pivate, shall immediately inform
the National Computer Security Incidence Response Team of an
attach intmsion and othet disruption liable to hinder the functioning
of another computer system or network, and the National Computer
Security lncidence Response Team shall take necessary and
appropriate measues to protecl computer systems and networks.

(2) ln order to protect a computer system or network

under subsection (1), the National Computer Security Incidence
Response Team may propose the isolation ofan affected computer
system or network pending the resoiution ofthe issues.

(3) A person or institution who intentionally or without

reasonable excBe fails to report an incident ofan attacks, intrusions
and other disruptions liable to hinder the functioning of another
computer system or network to the National Computer Security
lncidence Response Team within 7 days of is occurrence, commits
an offence and is liable on conviction to a fine not less than k
No. 7 The Cyber Security and Crime Act 2021 @

10,000,000 and not more than Le 30,000,000 or to a term of

imprisonment not less than I year and not exceeding 3 years or to
both such fine and imprisonment and in the case of a corporation,
partnership, or association, to a fine not less than Le50,000,000 and
rot exceeding L€ 100.000,000.

54. (l) A person or institution which, lieing a computer based Breach of

confidence by
service provider and or vendor does an act with intent to defraud and
by virtue ofhis position as a service provider, forges, illegally uses providers.
securitl' codes ofthe consumer with the intent to gain a hnancial and
or material advantage or with intent to provide less value for money
in his or its services to a consumer commits an offence and upon
conviction is liableto a fine not less than Le30,000,000 and not more
than Le 50,000,000 or to a term ofimprisonment not less than I year
and not exceeding 3 years orto both such fine and imprisonment and
in the case ofa corporation, pa:lnership, or association, to a fine not
less than Le100,000,000 and not exceeding t e 250.000,000.

(2) Where an offence under thisAct commined by a body

corporate is proved to have been committed on the instigation or
with the connivance of or atkibutable to willful neglect on the pan of
a directoq manager, secretaDi or other like officer ofthe body corporate
or any officer purporting to act in any such capacity, he, as r,vell as

the body corporate, where practicable, shall be deemed to have

corrun;tted the offence.

(3) Notwithstanding subsection (l), where a body

corporate is convicted ofan offence under this Act, which threatens
national security the Court may in the case of multiple or repeated
n No. 7 The Cyber Securily and Crine Act 2021

offenders, order that the body corporate shall be wound up and all its
assets and properties forfeit€d to the state, without prejudice to any
Iiability owing from the said body corporate being first satisfied.

(4) Nothing contained in this section shall render a person

liable to punishment, where he proves that the offence was committed
without his knowledge or thathe exercised all due diligeoce to prcvent
the commission ofthe offence.

Employces 55. (l) Without prejudice to any contractual agreement

responsibility
between an employer and employee, an employee shall relinquish or
surrenderall codes and access rights to his employer within a
reasonable time in his possession, power or coDtrol upon
disengagement fr om employment.

@) An employee who, without any lawful reason,

continues to hold unto the code or access right ofhis employer after
disengagement without any lawful reason commits an offence and
shallbe liable on conviction to a fine not iess than Le 10,000,000 and
not more than l-e 30,000,000 or to a term of imprisonment noi less
than I year and not exceeding 3 years or to both such fine and
imprisonment and in the case of a corporation, partnership, or
association, to a fine nol less than Le50,000,000 andnot exceeding k
1m,000,000

Corporale 56. 0) A natural person, who exercises management or

liability.
supervisory authority, based on-

(a) power of representation ofa lcgal person;

(b) authoriry to take decisions on behalfofa legal

person;
No. 7 The Cyber Security and Ctime Act 202r 1t

(c) authority to exercise control within a legal

person, acting either individually or as part
ofan organ ofthe legal person,

and fails to exercise reasonable and proper conrol over such legal
person comrnits an offence underthisAct, and is liable on conviction
to a fine ltot less than L€ 10,000,000 and not more than Le 30,000,000
or to a term of imprisonment not less than I year and not exceeding 3
yea6 or to both such fine and imprisonment and in the case of a
corporation, parheBhip, or association, to a fine nol less than Le
I 00,000,000 and not exceeding f€ 250,000,000.

(2) Where a natural person commits a criminal offence

under this Act, for the benefrt of a legal person, due to the lack of
supervision or control by a natural person, the legal person shall be
liable for the offence under this Act.

57. Without prejudice to the offences prescribed under this ,qg15 gy

Act and subject to the provisions ofthe Children and Young P"oon. "hild*n
Act Cap.44 and the Child Rights Act 2007, where an act done by a
child would be deemed to be an offence under this Act such child
shall be treated as ajuvenile and dealt with accordingly

PARTVII-J\1ISCELI.A^\EOUSPROVISIONS

58. The Minister may by Statutory lnstrument make Rcsularions

Regulations as it considers necessary or exp€dient for giving effects
to any of the provisions of this Act.
n No. 7 The Cyber Security and C ,ne Act 2021

Passed in Parliament this 23rd day o/Juue, in the year ofour Lord two thousand
and twenty one.

PARAN UMAR TARAWALLY

Clerk ol Parliament.

Tlus PRTNTED IMpREssroN has been carefu[y compared by me with the Bill
which has passed Parliament and found by me to be a true and correct printed copy
ofthe said Bill.

PARAN UMAR TARAWALLY

Clerk of Parliament.

Pnorreo eNo Pusl-tsgEo av rrE GovERNtr$r PRTNrNG DEp rrMEar, SrERr LEoNE,
G,EnF, No.7l or 25r, Novt,BEi, 2021.