Cybersecurity and Cybercrime Laws in the SADC Region https://zimbabwe.misa.org inducing, inciting, instigating, instructing, commanding or procuring to commit offence. In terms of penalties, any person who contravenes the provisions of the Act is liable on conviction to a fine or to imprisonment for a period not exceeding five years or to both a fine and such imprisonment. by the South African Constitution include: propaganda for war, incitement of imminent violence and advocacy of hatred based on race, ethnicity, gender or religion, which constitutes an incitement to cause harm. Section 3 of the Act defines “unlawful acquiring of data” as “any person who unlawfully and intentionally overcomes any protection measure which is intended to prevent access to data; and acquires data, within or which is transmitted to or from a computer system, is guilty of an offence. Section 16 of the Act stipulates that “any person who unlawfully makes available, broadcasts or distributes, by means of a computer system, a data message to a specific person, group of persons or the 5 general public with the intention to incite— (a) the causing of any damage to any property belonging to; or (b) violence against, a person or a group of persons, is guilty of an offence”. The burden of proving the “intent to incite” is very complicated. Similarly, section 18 of the Act, which deals with revenge pornography is too broad. Negligence should be sufficient to be convicted of unlawfully distributing revenge porn as many people argue they did not intend to distribute revenge porn. It is difficult to establish the legal requirement of intention. Besides the issue intention, both sections have key concepts such as “broadcasts” and “distributes”, which are not clearly defined. For instance, the definition of “data message” in the proposed Bill is different from the Hate Crimes Bill. This confusion over key definitions opens room for the misuse of the provision. It violates the freedom of expression as outlined in section 16 of the South African Constitution, which only excludes expression that leads to “incitement of imminent violence”. Some of the expressions explicitly outlawed 28 Unlike similar laws in the region, the proposed Bill requires more stringent conditions to be met before a warrant is issued. However, sections 29 and 30 allow for the warrantless search and seizure of computer devices under certain circumstances. This means that the courts are left with the onerous role of demarcating the reasonable grounds within which warrantless searches and seizures may be carried out without unnecessarily and illegally violating a citizen’s privacy. In many ways, the Bill can be viewed as an adopted and improved version of SADC Model Law. This does not mean the Bill is without its own challenges. The Bill has been criticized for attempt to limit the free flow of communications through its opaque and broad definitions of ‘data message’. Section 17(2) (d) refers to messages which are “inherently false in nature”. There are no objective criteria to determine what this means. The causing of “mental, psychological or physical harm” is taken from the Harassment Act. The Bill thus alters the definition of what is harmful in data messages. This is an overbroad limitation of freedom of expression. Section 38 of the Bill expands on the provisions of the Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA), which has been singled out as granting state security agencies with excessive power to conduct surveillance on citizens, investigative journalists and political opponents. For instance, RICA does not provide for notification of interception orders to affected parties. This means the legality of such an order cannot be reviewed because no notification of