Sierra Leone

Section 33(1) prohibits intentionally and without authorisation causing a computer system to perform a function with intent to secure access to the whole or a part of a computer system or to enable such access to be secured.

Section 33(3) defines unauthorised, for the purposes of this section, by reference to a person who has been authorised to access specific data and, without lawful excuse, causes the system to perform a function other than what was authorised, and section 33(4) confirms that the absence of authority includes a case where general authority exists but a specific type, nature, or method of access does not.

The Act's general interpretation section separately defines unauthorised access as access by a person who is either not entitled to access the computer system, program, or data at all, or who does not have or exceeds the level of authorisation consented to by the person entitled to grant it. Neither definition requires infringing a technical security measure to gain access, though both turn on there being a scope of consented access to exceed.

On conviction, an individual faces a fine of not less than Le 100,000,000 and not more than Le 250,000,000, or imprisonment of not less than 2 years and not exceeding 5 years, or both, and a corporation, partnership, or association faces a fine of not less than Le 500,000,000 and not exceeding Le 1,000,000,000.

Section 7(1) lets the Minister, in consultation with the National Cybersecurity Advisory Council, recommend that the President designate specific computer systems, computer data, or traffic data, or a combination of them, as Critical National Information Infrastructure by an Order published in the Gazette.

The Act's interpretation section defines Critical National Information Infrastructure as computer systems necessary for the continuous delivery of essential services Sierra Leone relies on, whose loss or compromise would have a debilitating impact including on services directly related to communications infrastructure, banking and financial services, public utilities, public transportation, or public-key infrastructure.

Under section 7(2), a Presidential Order made under section 7(1) must prescribe minimum standards, guidelines, rules, or procedures including requiring critical information systems to be secured by default and to log system and user activity for accurate and efficient audits.

Section 8 lets a Presidential Order made under section 7(1) require the National Computer Security Incidence Response Team to audit and inspect any Critical National Information Infrastructure at any time to ensure compliance with the Act. Section 2 establishes that body as the National Computer Security Incidence Response Coordination Centre, headed by the National Cyber Security Coordinator.

Section 53(1) requires a person or institution that operates a computer system or network, whether public or private, to immediately inform the National Computer Security Incidence Response Team of an attack, intrusion, or other disruption liable to hinder the functioning of another computer system or network. Under section 53(2), the Team may propose isolating an affected computer system or network pending resolution of the issue.

Section 53(3) separately makes it an offence to intentionally or without reasonable excuse fail to report such an incident to the Team within 7 days of its occurrence, distinct from any liability for the underlying disruption itself.

On conviction an individual faces a fine of not less than Le 10,000,000 and not more than Le 30,000,000, or imprisonment of not less than 1 year and not exceeding 3 years, or both, and a corporation, partnership, or association faces a fine of not less than Le 50,000,000 and not exceeding Le 100,000,000.