On 23 January 2019, the Nigerian Communications Commission (“NCC”) issued the Lawful Interception of Communications Regulations (“LICR”), which seek to provide a Regulatory framework for lawful interception of communications, collection and disclosure of intercepted communications in Nigeria. The aim of the LICR is to specify the nature and types of communications that can be intercepted whilst prescribing penalties for non-compliance with its provisions.
Will LICR apply to VOIP services not originating from Telcos, but passes through Telcos?
By virtue of Regulation 4, the LICR will apply to communication services provided by a Licensee to persons within and outside Nigeria. A Licensee is defined under the LICR to mean any person, body or organization, which provides communications services in accordance with the License. VOIP service providers are ordinarily not Licensees, thus, the LICR would ordinarily not apply to VOIP services that do not originate from telcos. However, this position would be different if the VOIP services passes through the traffic of a telco (i.e a Licensee).
Where the VOIP service has to pass through the traffic of a Licensee, then the VOIP service providers will become a shared licensee. In this respect, the Licensee can be mandated to intercept the traffic when requested by an authorized agency.[1] A telco being a licensee is under a binding legal obligation to adhere to the terms of the license granted to it, which term equally includes the provisions of the LICR. A VOIP service that passes through a licensee traffic is therefore subject to lawful interception.
Can an Authorized Agency install an intercept device in a Licensee facility to intercept VOIP traffic?
An authorized agency cannot of its own motion, install an interception device in a licensee facility as the LICR do not mandate or empower it to do so. However, by virtue of Regulation 10(1), a licensee is mandated to install devices that will make interception by the authorized agencies possible. Failure of the licensee to install the device that can make interception possible will be a ground for a civil action against such licensee.
So long as the information and communication provided by and passing through the communication system of a Licensee can be intercepted, a VOIP service delivered through the Communication System of a licensee can equally be intercepted. This is because immediately the licensee installs devices that make interception possible, there will be no restrictions as to the type of information or communication that can be intercepted, as such interception will be on every aspect of the license granted to the licensee, which in this case will include the VOIP service using its traffic.
Can an Authorized Agency force a VOIP service owner to decrypt an encrypted traffic in a licensee facility?
Regulation 9 of the LICR empowers the authorized agency to request for the code of an encrypted communication. An authorized agency can request the code from another person who is not the original licensee. A VOIP service using the traffic of a licensee in this regard can be compelled to decrypt any communication, as the VOIP service providers are bound by the terms, which are attached to the license granted to the original licensee such as a telco.
Will non-licensee be subject to the LICR for VOIP services hosted in Data Centers but delivered through Telcos?
Where VOIP Services that are hosted in a Data Center are delivered to customers through the network or communication system of a licensee, the said VOIP services will automatically be subject to the LICR and by that very fact can be intercepted by an authorized agency.
The primary aim of the LICR is to monitor or track communications or information going through the communication system or network of a telco or other licensee. Since the Data Center provides VOIP Services through the communication system of a telco or other licensees, it goes without saying that such communication or information will be liable to interception by an authorized agency.
Would an Authorised Agency be authorized under the Regulations to install an intercept device in the Data Center?
An authorized agency is not empowered to install an intercept device, so therefore the authorized agency cannot install same in the data center. However, the licensee has an obligation to install devices on all aspect of its network that will make interception possible. Considering the fact that the data center will not operate independently, but have to use the traffic of the telcos and such telcos communications can be intercepted, any information that passes through the licensee network, even third parties’ information will be subject to this regulation.
LICR vis-à-vis the Constitutional Guaranteed Right to Privacy.
The LICR were made pursuant to the provisions of Section 70 of the Nigeria Communications Act, which empowers the NCC to make and publish regulations in relation to, amongst other things, the licenses granted or issued under the Act.
Chapter IV of the Constitution of the Federal Republic of Nigeria 1999 guarantees and protects certain fundamental rights including the right to private and family life, which protects telephone conversations and telegraphic communication. For ease of reference, the provision of Section 37 is set out below:
37. The privacy of citizens, their homes, correspondence, telephone conversations and telegraphic communications is hereby guaranteed and protected.
This notwithstanding, this provision is however moderated by Section 45[2] of the Constitution. Given the foregoing, A law or regulation, which impinges on or curtails the enjoyment of the right to privacy may be made, in so far as it is reasonably justifiable in a democratic society, in the interest of defence and public safety. Where such a law or regulation is made, it would be lawful.
The LICR aims to protect of public safety, security and national defence. The LICR aides the investigative powers of the authorized agencies and helps the security agencies in intelligence gathering. Therefore, the regulation itself and actions validly taken pursuant to it, cannot be said to be in breach of the right guaranteed and protected by Section 37 of the Constitution as the LICR and the actions taken pursuant to it, fall within or come under the exceptions allowed by Section 45 of the Constitution.
