Computer Misuse Act

Defines terms used in the Act (for example: access, application, child, computer, data message, electronic record, Minister, traffic data, and others).

Defines when a person 'secures access' to any program or data held in a computer: by viewing, altering, erasing, copying or moving to other storage or locations, using or destroying, or causing output (including display).

Defines when a person "uses a program": when the function they cause the computer to perform causes the program to be executed, or when that function is itself a function of the program.

A person may access any program or data held in a computer if they are entitled to control access or have consent from the person charged with giving consent.

References to a program or data in a computer include those on removable storage; a computer can be regarded as containing programs or data held on such removable media; and a "program" includes parts of a program.

Defines when a modification of a computer's contents occurs: alteration or erasure of a program, data or data message held in the computer, or addition of a program, data or data message.

A person whose act causes a modification must not make that modification if they are not entitled to decide the modification and do not have consent from someone who is entitled.

Investigative officers may apply to court for an order to compel persons or service providers to produce data or subscriber information for criminal investigations or prosecutions; material stored electronically must be produced or given access in a removable, visible and legible form.

An investigative officer may apply to court for an order to preserve data when there are reasonable grounds to believe the data is vulnerable to loss or modification; the provision also states that "data" includes traffic data and subscriber information and that an order shall remain in force until the time reasonably required for investigation or until final determination or as the court deems fit.

An investigative officer may apply to court for an order to disclose preserved data, data sufficient to identify service providers and transmission path, or an electronic key for accessing/interpreting data, for a criminal investigation or prosecution of an offence.

Unauthorised access, interference with data, producing or using devices to overcome security, and denial-of-service are offences punishable by up to seven hundred fifty currency points or up to ten years imprisonment.

Making or performing acts under section 11 with intent to commit or facilitate another offence is prohibited and is an offence.

It is an offence for a person to cause an unauthorised modification of the contents of any computer when the person has the requisite intent and knowledge.

A person who knowingly secures unauthorised access to a computer to obtain computer services, intercepts computer functions without authority, or uses a computer/device to commit those offences is guilty; if damage results, convicted persons face a fine up to one hundred sixty-eight currency points or up to seven years' imprisonment, or both.

Anyone who, knowingly and without authority or lawful excuse, interferes with, interrupts or obstructs the lawful use of a computer, or impedes access to or impairs programs or data stored in a computer, is prohibited.

Anyone who knowingly and without authority discloses a password, access code or other means of accessing a computer, and who knows or ought to know it is likely to cause loss, damage or injury, commits an offence.

People with authorized access must not disclose or reuse electronic or other material except for purposes of the Act, prosecutions, or court orders; breach is an offence with specified penalties.

Any person who carries out electronic fraud commits an offence and, on conviction, is liable to a fine not exceeding three hundred sixty currency points or imprisonment for a term not exceeding fifteen years, or both.

If, during the commission of an offence listed in sections 11, 13, 14 or 15, a person obtains access to a "protected computer", the convicted person is liable on conviction to imprisonment for life instead of the punishments otherwise prescribed.

Abetment and attempts: a person who abets or attempts an offence under this Act is treated as committing that offence and is liable on conviction to the prescribed punishment.

Defines attempt: a person who, intending to commit an offence, begins executing that intention by an overt act adapted to its fulfilment but does not complete the offence is deemed to have attempted it.

It is an offence for any person to produce, offer, distribute, procure, or unlawfully possess child pornography through a computer, or to make pornographic material available to a child; penalties include a fine up to three hundred sixty currency points and/or up to fifteen years imprisonment.

Persons must not send, share or transmit information about a child through a computer unless they have parental/guardian consent, are authorised by law, or the disclosure is in the child's best interest.

Defines “cyber harassment” as using a computer for specified improper purposes and makes any person who commits it liable on conviction to a fine not exceeding seventy-two currency points or to imprisonment for a term not exceeding three years, or both.

Using electronic communication to harass someone and to threaten them or their immediate family constitutes the crime of cyber stalking, punishable on conviction by a fine not exceeding one hundred twenty currency points or imprisonment for up to five years, or both.

A person must not write, send or share information through a computer that is likely to ridicule, degrade, demean, create divisions or promote hostility against protected groups.

A person must not send or share unsolicited information through a computer except where it is in the public interest.

A person shall not send, share or transmit malicious information about or that relates to another person through a computer.

Using social media under a false or disguised identity to publish information prohibited by law is an offence; managers of organisational social media accounts can be held personally liable; on conviction the offender faces a fine up to five hundred currency points or imprisonment up to five years, or both.

When a person is convicted under this Act, the court must order that person to pay compensation to the aggrieved party in addition to any punishment.

Authorised officers may seize computer systems and take copies of data by search warrant; seized systems must be returned within 72 hours unless extended; obstructing officers is an offence with fines or imprisonment.

Courts must consider specific reliability and authenticity factors when weighing electronic records, and a person seeking to introduce such a record must prove its authenticity.

The Act applies to any person regardless of nationality or whether they are inside or outside Uganda; offences committed outside Uganda may be treated as if committed within Uganda.

A court presided over by a chief magistrate or magistrate grade I has jurisdiction to hear and determine offences under this Act and has power to impose the full penalty for such offences.

The Minister may, by statutory instrument and with the approval of Cabinet, amend the Schedule to this Act.