Part V - Interception of Communications — The Cyber Security Act, 2025

21. Central Monitoring and Co-ordination Centre

The Central Monitoring and Coordination Centre established under the repealed Act is continued as if established under this Act.
Subject to the provisions of this Act, the Centre shall be the sole facility through which —
1. lawful interceptions shall be effected; and
2. intercepted communication and call related information of an interception target shall be forwarded.
The Centre shall be managed, controlled and operated by the division responsible for Government communications.

22. Prohibition of interception of communication

A person shall not knowingly and without lawful authority—
1. intercept, attempt to intercept or procure another person to intercept or attempt to intercept any communication; or
2. use, attempt to use or procure another person to use or attempt to use any electronic, software, mechanical or other device to intercept a communication.
A person who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding one million penalty units or to imprisonment for a term not exceeding ten years, or to both.

23. Prohibition of use, manufacture or possession of interception device

A person shall not use, manufacture or possess an interception device without authorisation.
A person who contravenes subsection (1), commits an offence and is liable, on conviction, to a fine not exceeding one million penalty units or to imprisonment for a term not exceeding ten years, or to both.
Subsection (1) does not apply to the use or possession of an interception device by an electronic communications service provider, the Agency, Authority or any other person authorised by the division responsible for Government communications, where that interception device is used—
1. for the operation, maintenance and testing of an electronic communications service;
2. to protect the rights or property of the electronic communications service provider or the users of the electronic communications service from abuse of that service or any other unlawful use of the service;
3. to record that a communication was initiated or completed in order to protect —
  1. an electronic communications service provider in the completion of a communication; or
  2. a user of an electronic communications service from fraudulent, unlawful or abusive use of that electronic communications service;
4. pursuant to an interception of communication order; or
5. for research purposes where consent of a user of the electronic communications service has been obtained.
Despite subsection (3), an institution or person referred to under that subsection shall keep a record of the interception conducted by that institution or person using an interception device registered under section 24 and submit a copy of the record to the Centre.
A person who contravenes subsection (4) commits an offence and is liable, on conviction, to a fine not exceeding two hundred thousand penalty units or to imprisonment for a term not exceeding two years, or to both.
In this section, unless the context otherwise requires, “interception device” means a device designed or modified to intercept cellular communications, manipulate cellular network protocols, intercept satellite communications, intercept radio communications or capture mobile device identifiers.

24. Registration of interception device

A person authorised to use or possess an interception device under section 23 shall apply to the Centre for the registration of the interception device in a prescribed manner and form on payment of a prescribed fee.
The Centre shall, within fourteen days of receipt of the application under subsection (1), grant or reject the application.
The Centre shall, where the Centre —
1. grants the application under subsection (2), issue the applicant with a certificate of registration in a prescribed manner and form on terms and conditions that the Centre may determine; or
2. rejects the application under subsection (2), inform the applicant in writing, stating the reasons for the rejection.
A certificate of registration granted under subsection (3) shall be valid for a period as prescribed.
A person who intends to renew a certificate of registration may, not less than three months before the expiry of the certificate of registration, apply to the Centre for renewal of the certificate of registration in the prescribed manner and form on payment of the prescribed fee.

25. Variation of certificate of registration

A holder of a certificate of registration may, at any time during the validity of the certificate of registration, apply to the Centre for a variation of the certificate of registration, in a prescribed manner and form, on payment of a prescribed fee.

26. Surrender of certificate of registration

The holder of a certificate of registration shall, where the holder of a certificate of registration does not intend to continue using or possessing an interception device for the purpose to which the certificate of registration relates, surrender the certificate of registration to the Centre.
Where a certificate of registration has been surrendered under subsection (1), the holder of a certificate of registration shall surrender the interception device to the Centre.
The Centre shall determine the manner in which an interception device surrendered under subsection (2) shall be disposed of.

27. Transfer of certificate of registration

A certificate of registration issued under this Part shall not be transferred to a third party.

28. Cancellation or suspension of certificate of registration

The Centre shall suspend or cancel a certificate of registration if a holder of the certificate of registration —
1. obtained the certificate of registration through fraud, misrepresentation or concealment of a material fact; or
2. contravenes any provision of this Act or terms and conditions of the certificate of registration.
The Centre shall, before suspending or cancelling the certificate of registration in accordance with subsection (1), notify the holder of the certificate of registration of the Centre’s intention to suspend or cancel the certificate of registration and shall —
1. give reasons for the intended suspension or cancellation; and
2. require the holder of a certificate of registration to show cause, within a period of not more than thirty days, why the certificate of registration should not be suspended or cancelled.
The Centre shall, in making the Centre’s final determination on the suspension or cancellation of a certifcate of registration, consider the submissions made by the holder of a certificate of registration under subsection (2) (b).
The Centre shall not suspend or cancel a certificate of registration under this section if the holder of a certificate of registration takes remedial measures to the satisfaction of the Centre within the preiond specified unders subsection (2) (b).
The Centre may suspend or cancel a certificate of registration if the holder of a certificate of registration after being notified under subsection (2) fails to show cause or does not take any remedial measures, to the satisfaction of the Centre, within the time specified in that subsection.
The holder of a certificate of registration shall, where a certificate of registration is cancelled in accordance with subsection (5), surrender the certificate of registration to the Centre.

29. Lawful interception

Subject to subsection (2), a law enforcement officer shall, where the law enforcement officer has reasonable grounds to believe that an offence has been committed, is likely to be committed, or is being committed, apply ex-parte to a judge for an interception of communication order.
A judge to whom an application is made under subsection (1) may issue an interception of communication order—
1. requiring an electronic communications service provider to intercept and retain specified communication or communications of a specified description received or transmitted, or about to be received or transmitted by that electronic communications service provider;
2. authorising the law enforcement officer, through the Centre, to enter specified premises and to install on such premises any device for the interception and retention of communication or communications of a specified description and to remove and retain such device;
3. requiring any person to furnish the law enforcement officer with information, facilities and assistance as the judge considers necessary for the purpose of the installation of the interception device; or
4. imposing terms and conditions for the protection of interests of persons specified in the interception of communication order or any third parties or to facilitate investigations.
A judge may grant an order under subsection (2), where the judge is satisfied that there are reasonable grounds to believe that the communication relates to the —
1. commission of an offence under this Act or any other written law; or
2. whereabouts of a person suspected by a law enforcement officer to have committed an offence is contained in that communication.
An order referred to under subsection (2), shall be valid for a period of three months and may, on application by a law enforcement officer, be renewed for a further period not exceeding three months.
A law enforcement officer shall on receipt of an order under subsection (2), serve the order on an electronic communications service provider.
An electronic communications service provider shall, within twenty four hours of receipt of an order issued under subsection (2), route duplicate signals of an indirect communication to the Centre.
The Centre shall make available to a law enforcement officer the duplicate signals of an indirect communication routed to the Centre under subsection (6).
Information shall be admissible in proceedings for an offence under this Act, as evidence of the truth where that information is contained in a communication that is intercepted and retained —
1. pursuant to an interception of communication order under subsection (2); or
2. in a foreign State in accordance with the law of that foreign State and certified by a judge of that foreign State to have been so intercepted and retained.
An action shall not lie in any court against an electronic communications service provider, any officer, employee or agent of the electronic communications service provider, for providing information, facilities or assistance in accordance with the terms of an interception of communication order under subsection (2).

30. Interception of communication to prevent bodily harm, loss of life or damage to property

A law enforcement officer may orally request an electronic communications service provider to intercept any communication and to route the duplicate signals of the indirect communication specified in that request to the Centre where the law enforcement officer has reasonable grounds to believe that—
1. a person who is party to any communication —
  1. has caused, or may cause, the infliction of bodily harm to another person;
  2. threatens, or has threatened, to cause the infliction of bodily harm to another person;
  3. threatens, or has threatened, to kill oneself or another person, or to perform an act which may endanger that person’s own life or that of another person;
  4. has caused or may cause damage to property; or
  5. has caused or may cause financial loss to banks, financial institutions, account holders or beneficiaries of funds being remitted or received by such account holders or beneficiaries;
2. it is not reasonably practical to make an application under section 29 for an interception of communication order as the delay to intercept a specified communication would result in the infliction of bodily harm, the death of another person or damage to property; or
3. the sole purpose of the interception is to prevent bodily harm to, or loss of life of, any person or damage to property.
An electronic communications service provider shall, on receipt of a request made under subsection (1) by a law enforcement officer, route the duplicate signals of the indirect communication to the Centre.
A law enforcement officer who makes a request to an electronic communications service provider under subsection (1) shall, within twenty-four hours after making that request, furnish the electronic communications service provider with a written confirmation of the request setting out the information given by that law enforcement officer.
A law enforcement officer who makes a request for interception under subsection (1), shall within two days, after the interception of the communication, submit to a judge —
1. a copy of the written confirmation referred to in subsection (3);
2. an affidavit setting out the results and information obtained from that interception;
3. a recording of the communication that has been obtained through that interception; and
4. a full or partial transcript of the recording of the communication and any notes made by the law enforcement officer.
An electronic communications service provider who, in accordance with subsection (2), routes duplicate signals of indirect communications to the Centre shall, as soon as practicable, submit an affidavit to a judge setting out the steps taken by that electronic communications service provider in giving effect to the request and the results obtained from such steps.
A judge may make an order as the judge considers appropriate in relation to the electronic communications service provider, the person whose communication has been intercepted or the law enforcement officer, where a judge, on receipt of a written confirmation and affidavit under this section, determines that the interception was effected or used for purposes contrary to, or in contravention of, the provisions of this Act or any other law.

31. Prohibition of use, acquisition, etc of geolocation and interception information

Subject to the provisions of this Part, a person shall not, intentionally and without consent of the owner of the geolocation information, use an electronic, mechanical or other device to —
1. acquire or attempt to acquire, geolocation information relating to another person; or
2. disclose, or attempt to disclose or intercept communication or geolocation information relating to another person.
A person who contravenes subsection (1), commits an offence and is liable, on conviction, to a fine not exceeding five hundred thousand penalty units or to imprisonment for a term not exceeding five years, or to both.
In this section, unless the context otherwise requires, “consent” has the meaning assigned to the word in the Data Protection Act, 2021.

32. Interception of communication for purposes of determining location

Where a person is a party to a communication and that person, as a result of information received from the other party to the communication, has reasonable grounds to believe that an emergency exists and the location of that other party is unknown, that person shall, if that person is —
1. a law enforcement officer, and has reasonable grounds to believe that determination of the location of the other party is likely to be of assistance in dealing with the emergency, request an electronic communications service provider to —
  1. intercept that communication for purposes of determining that other party’s location; or
  2. determine the location of the sender; or
2. not a law enforcement officer, inform any law enforcement officer of the emergency.
Subject to this Part, the provisions relating to interception of communication under section 29 shall apply to the interception of communication for purposes of determining geolocation with necessary modifications.
An emergency for purposes of this section exists if—
1. there is potential or actual threat to national security;
2. there is potential or actual threat to public safety;
3. the life of another person is likely to be endangered or is endangered; or
4. property is likely to be damaged, is being damaged or has been damaged.

33. Technical assistance for purposes of determining location or illegal use of spectrum

The Centre may, on request by a law enforcement officer, with a warrant, assist the law enforcement officer for purposes of determining a location or the location of a prohibited device as prescribed.
The Authority may intercept communication for purposes of determining the location of illegal use of the spectrum or numbering resources.

34. Prohibition of access and use of intercepted communication

An electronic communications service provider who intercepts a communication pursuant to an interception of communication order shall not use the communication in any manner other than in accordance with the provisions of this Act.
A person commits an offence if that person without authorisation —
1. accesses the contents of any intercepted communication; or
2. uses, or attempts to use, the contents of any intercepted communication.
A person who contravenes subsection (2), commits an offence and is liable, on conviction, to a fine not exceeding one million penalty units or to imprisonment for a term not exceeding ten years, or to both.

35. Disclosure of intercepted communication by law enforcement officer

A law enforcement officer who obtains information pursuant to an interception of communication order may disclose the communication to another law enforcement officer where the disclosure is necessary for the determination of the commission of an offence or the whereabouts of a person suspected to have committed an offence.
Where a law enforcement officer, in the performance of any functions under this Act, obtains information pursuant to an interception of communications order relating to the commission of an offence under any other law, the law enforcement officer shall disclose or use the communication in accordance with the provisions of this Act or that other law.

36. Privileged communication to retain privileged character

A privileged communication intercepted in accordance with the provisions of this Act shall not lose its privileged character.

37. Prohibition of random monitoring

A person shall not use an electronic communications service, critical information or critical information infrastructure to randomly monitor a communication, except for mechanical or service quality control checks.
A person who contravenes subsection (1), commits an offence and is liable, on conviction, to a fine not exceeding one million penalty units, or to imprisonment for a term not exceeding ten years, or to both.
In this section, unless the context otherwise requires — “monitor” includes listening to, viewing, reading or recording communication by means of a monitoring device; and “monitoring device” means any electronic, software, mechanical or other instrument, device, equipment or apparatus which is used or can be used, whether by itself or in combination with any other instrument, device, equipment or apparatus, to listen to, view, read or record any communication.

38. Interception of satellite transmission

An interception of satellite transmission that is not encrypted or scrambled and that is transmitted to a broadcasting station for purposes of transmission to the public, or as an audio subcarrier intended for redistribution to facilities open to the public, is not an offence under this part unless the interception is for the purpose of a direct or indirect commercial advantage or private financial gain.
Subsection (1) does not apply to a two-way data transmission or a telephone call.

39. Assistance by electronic communications service provider

An electronic communications service provider shall —
1. use an electronic communication system that is technically capable of supporting interception in accordance with this Act;
2. install hardware and software facilities and devices to enable interception of communications when required by a law enforcement officer or under a court order;
3. provide services that are capable of rendering real time and full time monitoring facilities for interception of communications;
4. provide all call-related information in real time or as soon as possible on call termination;
5. provide one or more interfaces from which an intercepted communication shall be transmitted to the Centre;
6. transmit intercepted communication to the Centre through fixed or switched connections; and
7. provide access to all intercepted subjects operating temporarily or permanently within the service provider’s communications systems, and where the interception subject is using features to divert calls to other service providers or terminal equipment, access to such other service providers or equipment.
An electronic communications service provider who contravenes subsection (1) commits an offence and is liable, on conviction, to a fine not exceeding ten million penalty units.

40. Interception capability of electronic communications service provider

Despite any other written law, an electronic communications service provider shall —
1. provide a service which has the capability to be intercepted; and
2. store call-related information or internet connection records in accordance with the provisions of this Act.
The President may, in consultation with the Centre, by statutory instrument, make Regulations to provide for the —
1. manner in which interception capability is to be provided by an electronic communications service provider;
2. security, technical and functional features of facilities and devices to be acquired by an electronic communications service provider to enable the —
  1. interception of communication under this Act; and
  2. storing of call-related information and internet connection records; and
3. period within which requirements under paragraphs (a) and (b) shall be complied with.
The Regulations made under subsection (2) shall specify—
1. the capacity and technical features of the devices or systems to be used for interception purposes;
2. the connectivity of devices or systems to be used for interception purposes with the Centre;
3. the manner of routing an indirect communication to the Centre; and
4. any other matter which is necessary for the better carrying out of the provisions of this Part.
An electronic communications service provider shall acquire facilities and devices specified in the Regulations made under subsection (2) at the electronic communications service provider’s own expense.
Subject to this Act, a cost incurred by an electronic communications service provider shall be borne by the electronic communications service provider for the purpose of —
1. enabling —
  1. an electronic communication to be intercepted; and
  2. call-related information to be stored; or
2. complying with this Part.