POLICY PAPER
Executive Summary
South Sudan’s growing reliance on digital communication, mobile services, online media, financial technology and electronic records creates new opportunities for development, but it also creates new risks to human security.
Cybercrime, unauthorized access, identity theft, data breaches, online fraud, harassment and attacks against essential digital systems can affect individuals, businesses, public institutions and national infrastructure. A modern cyber-law framework is therefore not only a technology issue; it is a human-security and governance issue.
This paper examines how cyber law can protect human security and identifies policy priorities for South Sudan. It draws lessons from international approaches to data protection and cybersecurity, while recognizing that legal rules must be adapted to South Sudan’s institutional capacity, constitutional framework and social context. The paper recommends a rights-respecting approach that combines clear legislation, independent oversight, institutional capacity, public awareness, responsible data management and regional and international cooperation.
1. Policy Context
Digital technology is increasingly embedded in everyday life. Citizens use phones and online platforms to communicate, access information, conduct business and interact with institutions. Government agencies and private organisations likewise collect and process increasing amounts of personal and operational information. These developments make cybersecurity and privacy central to public policy.
Human security focuses on protecting people from serious threats to their safety, dignity, livelihoods and ability to participate in society. From this perspective, cyber threats can become human-security threats when they expose personal information, facilitate fraud, disrupt essential services, silence legitimate expression, or undermine trust in institutions.
2. How Cyber Law Protects Human Security
2.1 Data Protection and Privacy
Data protection rules establish standards for collecting, using, storing and sharing personal information. A strong framework should require organisations to collect information for legitimate purposes, limit unnecessary collection, protect information against unauthorized access, and provide individuals with meaningful rights over their data.
The European Union’s General Data Protection Regulation (GDPR) provides an influential international example. It emphasizes transparency, accountability and individual rights, including rights relating to access, correction and, in specified circumstances, deletion of personal data. Its approach demonstrates how privacy can be treated as a governance responsibility rather than merely a technical concern.
For South Sudan, the policy lesson is not that the GDPR should simply be copied. Rather, South Sudan can develop a proportionate national framework that defines personal data, establishes lawful bases for processing, sets security obligations, provides remedies for misuse and creates appropriate oversight.
2.2 Cybersecurity and Critical Infrastructure
Cybersecurity law can establish duties for organisations that operate important digital systems. These may include financial institutions, telecommunications providers, health services, government databases and other essential services. Legal requirements can cover risk management, incident reporting, minimum security controls and cooperation with competent authorities.
The United States Cybersecurity Act of 2015 illustrates the importance of structured information sharing between government and the private sector. Its broader policy lesson is that cybersecurity cannot be managed by government alone. Effective protection requires cooperation among public institutions, businesses, technical specialists and the wider community.
2.3 Criminalising Unauthorised Access and Digital Abuse
Criminal law remains an important component of cybersecurity. The UK Computer Misuse Act 1990, for example, criminalises forms of unauthorized access and interference with computer systems. Such laws provide a basis for investigating and prosecuting conduct that can cause financial, personal or institutional harm.
South Sudan would benefit from clearly defined cyber offences, safeguards against arbitrary enforcement, appropriate investigative powers subject to legal oversight, and penalties that are proportionate to the seriousness of the conduct. Cybercrime legislation should protect people and systems without being used to criminalise legitimate journalism, peaceful criticism or lawful political expression.
3. Key Human-Security Risks in South Sudan
• Personal-data exposure: Weak data-management practices can expose citizens to identity theft, fraud, extortion and discrimination.
• Online fraud and financial crime: Increasing digital transactions create opportunities for scams, account compromise and other forms of financial abuse.
• Attacks on essential services: Disruption of telecommunications, financial services, health systems or government information systems can directly affect public welfare.
• Online harassment and abuse: Cyberbullying, threats and targeted harassment can undermine personal safety and participation in public life.
• Information integrity and trust: Malicious manipulation, impersonation and coordinated online deception can weaken public confidence in institutions and legitimate information.
4. Major Enforcement Challenges
• Jurisdiction: Cyber incidents can cross borders, making investigation, evidence gathering and prosecution dependent on international cooperation.
• Institutional capacity: Effective enforcement requires trained investigators, prosecutors, judges, digital-forensics capacity and secure technical infrastructure.
• Rapid technological change: Legislation can become outdated when new technologies and forms of cybercrime develop faster than legal reform.
• Rights and proportionality: Cybersecurity powers must be subject to clear legal limits, judicial or independent oversight where appropriate, and safeguards for privacy and legitimate expression.
• Public awareness: Laws alone cannot prevent cybercrime. Citizens and organisations need practical knowledge about passwords, fraud, data protection and incident reporting.
5. Policy Recommendations for South Sudan
1. Develop a comprehensive cyber-law framework
Create coherent legislation covering cybercrime, cybersecurity, personal-data protection, electronic evidence and responsible digital governance.
2. Establish clear data-protection standards
Define personal data and establish lawful processing, security, retention, access, correction and complaint mechanisms.
3. Strengthen cybersecurity institutions
Build specialised capacity for incident response, digital forensics, investigation, prosecution and technical risk management.
4. Protect critical digital infrastructure
Identify essential systems and establish proportionate security and incident-reporting requirements for their operators.
5. Guarantee rights and due process
Ensure cyber laws are precise, proportionate and consistent with constitutional rights, including privacy, due process and lawful freedom of expression.
6. Improve public-private cooperation
Create trusted channels for reporting incidents and sharing threat information while protecting confidential and personal information.
7. Expand regional and international cooperation
Use appropriate regional and international mechanisms to support cross-border investigations, evidence sharing, training and capacity building.
Promote public education on online safety, privacy, scams, responsible digital conduct and reporting mechanisms.
6. Implementation Priorities
Priority Short-term action Expected outcome
Legal framework Review existing laws and identify gaps Coherent and rights-respecting cyber-law architecture
Institutions Map responsible agencies and build specialist capacity Better prevention, investigation and response.
Data protection Adopt baseline privacy and security requirements Greater protection of personal information.
Critical infrastructure Identify priority systems and minimum controls Reduced risk of disruptive cyber incidents.
Public awareness Launch practical digital-safety campaigns More informed and resilient users.
7. Conclusion
Cyber law should be understood as part of South Sudan’s broader human-security agenda. Protecting citizens in the digital age requires more than criminalising hacking. It requires rules that protect personal information, secure essential systems, support responsible innovation, strengthen institutions and provide remedies when rights are violated.
South Sudan can draw useful lessons from international models such as the GDPR, the US Cybersecurity Act and the UK Computer Misuse Act, while developing a framework suited to its own constitutional, institutional and social realities. The objective should be a digital environment in which security and rights reinforce rather than undermine each other.
References and Further Reading
• European Union. (2016). Regulation (EU) 2016/679 (General Data Protection Regulation). Official Journal of the European Union.
• United States Congress. (2015). Cybersecurity Act of 2015, enacted as part of the Consolidated Appropriations Act, 2016.
• UK Government. (1990). Computer Misuse Act 1990.
• United Nations Office on Drugs and Crime. (2013). Comprehensive Study on Cybercrime.
• Taddeo, M., & Floridi, L. (2017). The Ethics of Cybersecurity. Springer.
• Solove, D. J., & Schwartz, P. M. (2019). Privacy Law and the Information Economy. Aspen Publishers.
• Additional South Sudan-specific legal sources should be reviewed before formal policy adoption, including the Transitional Constitution of the Republic of South Sudan, applicable telecommunications and electronic-transactions legislation, and any current data-protection, cybercrime or cybersecurity instruments.
Editorial note: This policy paper is intended for public-interest education and policy discussion. It does not constitute legal advice. South Sudan-specific legislation and official government instruments should be checked against their current versions before use in formal legal or policy proceedings.
