INTRODUCTION TO CYBER THREATS TO NATIONAL SECURITY

COURSE DESCRIPTION

This course will examine the legal and policy issues related to cybersecurity. This interactive course will explore various legal and policy issues related to enabling a safe and secure internet and protecting government and private sector networks. We will examine the key legal and policy issues associated with cybercrime as a global phenomenon.

The course will aim: To help students gain insights and strategies for dealing with the clash between technology and criminal investigation and prosecution, generally; To understand the role of relevant Ghanaian authorities in addressing cybersecurity and internet governance; To understand investigating crime in the Darknet.

The darknet, also known as the dark web, refers to a part of the internet that is intentionally hidden and not indexed by traditional search engines. It requires special software or authorization to access. Characteristics: Anonymity: Users can remain anonymous through encryption and virtual private networks (VPNs). Encryption: Data is encrypted to protect user identities and activities. Hidden services: Websites and servers are hidden from search engines and the general public. Peer-to-peer (P2P) networking: Users connect directly, without intermediaries.

On completion of the course, students will be able to: Understand the national security implications of cybersecurity and the current challenges that policymakers and private sector face in addressing those issues. Understand the relevant cybersecurity roles and responsibilities of government agencies, internet governance and international law to nation state activity in cyberspace. Understand the key legal and policy issues associated with cybercrime as a global phenomenon.

Core statutory definitions from the Cybersecurity Act, 2020 (Act 1038)

Why this matters: the Cybersecurity Act 2020 provides several working definitions that structure how Ghanaian regulators, courts and enforcement agencies treat cyber incidents and actors. Students should learn the Act's precise meanings rather than relying on colloquial uses. Key defined terms needing explicit classroom explanation include: "cybersecurity threat", "cybersecurity incident", "critical information infrastructure", "cybersecurity service provider", and "owner of critical information infrastructure". The Act ties regulatory powers, registration duties and investigatory powers to these definitions — for example, registration, audits and mandatory standards apply specifically to registered critical information infrastructure (CIIs).

Teaching points: state each statutory definition in plain words, then show legal effect. For example, the Act treats a cybersecurity threat as an unauthorised effort to adversely impact the security, confidentiality, integrity or availability of information or information systems — this is the trigger for Authority action (registration, audits, incident reporting) and criminal prohibitions. Contrast the Act's "incident" (the realised event that harms systems or data) with a "threat" (the potential or attempt), and show how that distinction affects duty to report and response timelines under the Act's procedural provisions.

Darknet (dark web): technical meaning, legal significance and investigative limits

Definition and technology: the darknet describes overlay networks that require special software/configuration (e.g., Tor) and are not indexed by conventional search engines. Key technical features: onion-routing or equivalent anonymity layers; hidden services (addresses only reachable inside the overlay); and strong or end-to-end encryption. Peer-to-peer darknet services may decentralise hosting and identification.

Legal significance in Ghana: presence on the darknet does not make an activity lawful or unlawful by itself. Investigations that reach into darknet services must still respect Ghanaian statutory limits (search, seizure, surveillance and data-protection rules) and, when evidence crosses borders, rely on mutual legal assistance or international cooperation channels designated by the Cyber Security Authority. The Act empowers the Authority to assist law enforcement and to designate 24/7 contact points for cross-border cybercrime cooperation; practical darknet investigations commonly require technical warrants, international cooperation and adherence to evidence-handling rules to be admissible in court.

Illustration: a Ghanaian suspect uses a Tor hidden service to sell stolen payment data originating in several jurisdictions. Investigators must (1) identify jurisdictional nexus to Ghana; (2) obtain legal authority for data collection from local servers or service providers (search warrant, production order); (3) request evidence from foreign hosts via MLA or use the CSA contact point if data is abroad; and (4) ensure chain of custody and admissibility under domestic criminal procedure and the Data Protection Act.

Critical information infrastructure (CII): definition, registration, duties and enforcement

Definition and scope: under the Cybersecurity Act, CII covers information systems, services and assets whose disruption would materially affect national security, economic stability, or public safety. The Act requires the Authority to publish registration procedures and to maintain a register of CIIs. The owner of a registered CII has statutory duties including periodic audits, incident reporting and implementing Authority standards.

Operation together with other rules: CII status activates enhanced regulatory obligations (registration, inspections, mandatory standards) and enables the Authority to prioritise protective measures, audits and rapid responses. The Cybersecurity Risk Register contains personal data of owners of CIIs and is protected under the Act but may be disclosed if required by law (illustrating the tension with data-protection rules).

Illustration: the national payment switch is declared a CII. The operator must register with the Authority, submit to periodic security audits, and implement the Authority's incident-reporting timeline. Failure to comply attracts administrative penalties and possible criminal consequences for offences specified in the Act.

Offences, defences and procedural safeguards under the Cybersecurity Act

Offences: the Act creates a range of offences (unauthorised interference, unlawful access, failure by CII owners to comply with duties, obstructing the Authority, and offences connected to orders or notices). The text includes mens rea and strict-liability elements in different provisions; students must identify the exact mens rea for each offence before concluding whether defences apply.

Defences and exceptions: the Act contains explicit statutory defences (for example where conduct was without consent or where reasonable diligence was exercised in some contexts). It also preserves constitutional protections: the Authority’s powers are subject to Article 135 (on privilege) and other constitutional limits. Where the Act authorises property orders or production, the Act requires court action or specified procedures; note the Act's provision that some powers (e.g., opening safe deposit boxes under order) must be exercised in the presence of authorised persons.

Procedural safeguards: emphasise which powers can only be exercised by court order, which are administrative (issued by the Authority), timelines for service and publication requirements for certain orders, and how evidence seized under the Act can be used or challenged in criminal proceedings. Note the Act’s immunity provision for Authority members acting in good faith.

Interplay with the Data Protection Act, 2012 (Act 843): personal data, lawful processing and investigative exceptions

Scope: the Data Protection Act protects personal data processing rights (consent, purpose limitation, data subject rights) and sets conditions for lawfulness. Investigations and incident-response activities can involve processing of personal data — the Cybersecurity Act and the Data Protection Act must be read together.

Exceptions for law enforcement and national security: both regimes recognise that certain disclosures or processing may be authorised or required by law for prevention, detection and prosecution of offences or for national security. In practice this means: (a) CSA and law enforcement may share limited personal data when authorised; (b) CIIs’ registration data held in the Cybersecurity Risk Register are protected but may be disclosed when required by law; and (c) investigators must still observe data minimisation, proportionality and retention limits as required by the Data Protection Act.

Illustration: when responding to a large breach at a hospital (a CII), the Authority may access patient records for forensic analysis under its statutory powers and share incident details with law enforcement. Investigators remain accountable under the Data Protection Act to limit access to the minimum necessary and to protect sensitive health data.

Constitutional limits, human rights and national security doctrine

Constitutional framework: Ghana’s 1992 Constitution remains supreme. Powers exercised for national security or in cyber investigations must comply with constitutional rights (privacy, fair trial, freedom of expression) and due process. Students must learn how security-driven statutes (like the Cybersecurity Act) are interpreted in light of the Constitution and judicial decisions.

Key tension: national-security exceptionalism versus rule of law. Courts may permit some restrictions where they are prescribed by law, necessary and proportionate. In classroom analysis, always test statutory powers against constitutional requirements (is there clear legal authorisation; is the measure necessary; is there adequate oversight or remedy?).

International cooperation and treaties: the Budapest Convention and mutual legal assistance

Ghana’s international posture: Ghana has engaged with the Council of Europe’s cybercrime cooperation instruments and has taken steps to accede to the Budapest Convention; the Cybersecurity Act requires the Authority to implement measures for effective enforcement of international treaties to which Ghana is a signatory and to maintain 24/7 contact points for cross-border cooperation.