VPNs with servers in Ghana

Section 76 lets the Cyber Security Authority ask a domestic service provider to install an interception capability, appoint a security-cleared focal person, pay for it and be able to decrypt a telecommunication message. The equipment may not be managed, monitored or remotely accessed from abroad. “Service provider” includes any entity that lets users communicate through a computer system or mobile network, or stores data for one. Whether a VPN operator is covered is not established.

Under section 87 of the Act the Authority may, on the order of a court, authorise a service provider to block, filter or take down illegal content and phone numbers used for a malicious purpose that undermines cybersecurity. The grounds include national security, protection of children, public safety, crime prevention and reputation. Non-compliance draws an administrative penalty and, after a month, a fine and one to five years’ imprisonment.

The Act also creates offences for indecent images of a child, cyberstalking of a child, sexual extortion and the non-consensual sharing of intimate images (sections 62 to 68).

Section 208 of the Criminal Offences Act 1960 (Act 29) punishes publishing a statement, rumour or report likely to cause fear and alarm to the public or disturb the public peace; subsection (2) places on the accused the burden of showing reasonable steps to check it.

Section 76(1) of the Electronic Communications Act 2008 (Act 775) punishes knowingly sending a false or misleading electronic communication likely to endanger safety or prejudice life-saving services.

To identify an account, an investigative officer applies to the High Court for a production order for subscriber information (sections 69–70) or an interception warrant for traffic or content data (sections 71–74). The Court must find the measure commensurate, proportionate and necessary for a specific investigation, and orders the provider to keep it confidential.

Article 125 of the Constitution makes the Judiciary independent and subject only to the Constitution, and article 18(2) allows interference with the privacy of correspondence or communication only in accordance with law and as necessary in a free and democratic society. Under the Cybersecurity Act, interception needs a High Court warrant, and the Authority’s annual report to the Minister, which goes to Parliament, must give the number and outcome of production orders and warrants.

The order of the rows is the security score, and a server’s location is not a recommendation.