Where section 24(1) deals with extortion by software, section 24(2) of the Cybercrime Code Act 2016 deals with extortion by content.
Section 24(2)
(a) accusing or threatening to accuse or cause the accusation of, another person of committing an indictable offence or any other offence under this Act, the Criminal Code Act (Chapter 262) or any other law; or
(b) otherwise exposing sensitive data or compromising of confidential information, with intent to procure monetary or other gain for himself or another person,
is guilty of a crime.
Penalty: natural person — a fine up to K100,000 or imprisonment up to 25 years, or both; body corporate — a fine up to K1,000,000.
The custodial maximum is the same — 25 years. The fines are double: K100,000 for a natural person against K50,000, and K1,000,000 for a body corporate against K500,000.
Section 24(3) — truth is immaterial
It is immaterial whether the person accused or threatened to be accused has committed the offence or act of which he is being accused or threatened to be accused.
A person who threatens to publish material about someone in order to extract money cannot answer the charge by saying the material was true and the accusation well founded.
That reflects the nature of blackmail. The wrong is not the accusation; it is the use of the accusation as leverage for gain. A person who genuinely wishes to report an offence reports it — they do not offer silence for a price.
Compare section 21(3), the defamation-for-extortion provision, and section 21(6), which likewise removes truth as an answer where the publication was for an extortionate purpose.
Sextortion
The pattern is familiar: intimate images are obtained — shared willingly in a relationship, taken from a compromised account, or produced during a recorded video call — and the holder demands money under threat of distribution.
The elements are met by:
- Threatening to upload images or recordings into an electronic system or device;
- For the purpose of exposing sensitive data or compromising confidential information;
- With intent to procure monetary or other gain.
Note that “other gain” is not confined to money. A demand for further images, for sexual activity, or for any other advantage is within the words.
Where the victim is a child, section 19 and section 18 will usually also be engaged — and section 19(2) carries life imprisonment where the child is under 16.
“Sensitive data”
Section 2 defines sensitive data, and the same expression appears in section 10, section 25 and section 7(2).
Section 24(2)(b) is wider still, because it adds “or compromising of confidential information” — which is not limited to the statutory definition.
Where section 24(2) sits
| Provision | Core wrong | Maximum (natural person) |
|---|---|---|
| s 24(1) | Disruptive software for gain | 25 years or K50,000, or both |
| s 24(2) | Content used as leverage for gain | 25 years or K100,000, or both |
| s 21(3) | Defamatory publication to extort | See s 21(3) |
| s 25(1) | Disclosure of confidential or sensitive material — no gain required | 15 years or K20,000, or both |
Sections 24(1) and (2) both require a purpose of procuring monetary or other benefit or gain. Remove that purpose and the conduct falls to be dealt with elsewhere — under section 25 if it is a disclosure, under section 21 if it is defamatory, under section 23 if it is harassment.
If you are the victim
- Do not pay. Payment funds the demand and does not end it.
- Preserve everything. Keep the messages, account names and timestamps. Police can obtain preservation notices under section 36 and production orders under section 35 for subscriber information.
- Report it. The offence is complete on the threat — nothing needs to have been published.
- Ask about a restraining order. Section 38 allows a court to restrain dealings with data.
- Truth does not assist the offender. Section 24(3) is express. Embarrassment about the underlying material is not a reason to stay silent.
Section 24 is not listed in Schedule 2 and cannot be dealt with summarily. See also what to do if you are a victim of cybercrime.
Sources
- Cybercrime Code Act 2016 — ss 2, 8, 11, 18, 19, 21, 23, 24, 25, 35, 36, 38, 48; Schedule 2
- Criminal Code Act (Chapter 262)
Before relying on anything here, read the current text of the Cybercrime Code Act 2016 and check for later amendments. If a decision matters to you, get advice — start with the Office of the Public Solicitor, or find a firm in the law firms directory.