ROSANA: Why laws alone cannot shape the cyberspace

In 2001, the European Union enacted the Budapest Convention on Cybercrime. In 2018, Kenyan legislators took the Budapest Convention, baptised it and gave it a new name, the Computer Misuse and Cybercrimes Act 2018.

It is certainly not the first time legislators have imported a law from other countries and transfixed it here expecting the same results as its origin. Lord Denning had it in Nyali Ltd v Attorney-General (1956) that you cannot transplant the English oak to the African continent and expect it to flourish in the same manner as in England.

Laws regulating behaviour in other countries may be effective, but one should resist the temptation to import those laws in order to regulate the same behaviour in their own jurisdiction.

The effectiveness of a law does not depend solely on how well it is drafted. The law is effective when it incorporates the values shared by those to whom it is addressed. It is not enough to adopt a law from somewhere else because it is working, we must first ask why it is working.

What are the peculiar conditions in the law whose society we have admired? What are the values of those people? What factors were taken into consideration when drafting the law we want to adopt?

Laws, by themselves, will not shape cyberspace. When we create laws regarding cyberspace they only regulate the behaviour of the users rather than the underlying medium.

Cyberspace only takes the shape we give it – if I may borrow from Prof Lessig’s ‘The Law of the Horse: What Cyberlaw Might Teach’. The underlying medium is majorly the product of code. This is why the phrase ‘cyberspace belonging to Kenya’ in the Cybercrime Act 2018 is wrong in an interesting way.

First, there is no such thing as cyberspace that belongs to Kenya. Cyberspace is an “environment formed by physical and non-physical components characterised by the use of computers and the electromagnetic spectrum, to store, modify, and exchange data using computer networks.”

It would be more correct to state ‘cyber infrastructure that belongs to Kenya’ as that is the only plausible meaning to which the legal provisions would apply. The sovereignty of a state only applies to the physical components that are within its boundaries. It cannot claim jurisdiction over non-physical components that it cannot physically appropriate. If what belongs to everyone belongs to no one then no state can claim ownership over cyberspace per se.

Second, it is not enough to write laws that appropriate cyberspace to your country. In the Island of Palmas Case the tribunal defined sovereignty as the ability of a state to control a portion of the globe to the exclusion of all other states. However, the state has to take tangible steps to secure its cyber infrastructure.
All the world’s laws cannot stop the force of a well written malicious code that seeks to bring down the electric grid of your country. The state has to invest in good cyber security practices that promote the safety of its citizens as they use the medium.

The sovereignty of a country is only as good as the steps it takes to strengthen its cyber power. We must not remain in an ivory tower and play hope chess with cyber threats. There is a certain complacency for states to assume that because the law has said we are sovereign, then we can say whatever we want. Sovereignty gives rights but code enables the state to exercise them. It is not either law or code, it is both law and code.