Introduction
A person sends you threatening messages on WhatsApp. Someone repeatedly creates new social media accounts after you have blocked them. Another person publishes messages about you online that they know to be false. Someone threatens to expose private information about you unless you pay money.
At what point does this conduct become a crime?
In Nigeria, the answer may be found principally in section 24 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, as amended by the Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024.
The law is important because not every unpleasant online interaction is cyberstalking. At the same time, genuine threats, harassment and intimidation conducted through electronic communications can attract serious criminal consequences.
The 2024 amendment also changed an important part of section 24. Therefore, anyone relying on an old article or social media post about cyberstalking should be careful: the law applicable today is not identical to the original 2015 provision. The official Nigerian Computer Emergency Response Team (ngCERT) publishes the amended legislation as part of its current legal resources. (Certification Portal)
What is cyberstalking?
Cyberstalking generally describes persistent or serious unwanted conduct carried out through electronic communications, computers, social media, messaging applications or other computer networks, particularly where the conduct involves threats, harassment, intimidation or other prohibited communications.
Under Nigerian law, however, the important question is not simply whether someone describes conduct as “cyberstalking.”
The question is whether the particular conduct satisfies the requirements of section 24 of the Cybercrimes Act.
Section 24 contains several different forms of prohibited conduct. Some involve false or pornographic messages under subsection (1), while subsection (2) deals specifically with communications used to bully, threaten or harass another person, including certain threats involving death, violence, bodily harm, kidnapping, extortion, property or reputation.
What changed in 2024?
This is one of the most important things to understand about cyberstalking in Nigeria.
Under the original 2015 version of section 24(1), the law criminalised, among other things, communications described as “grossly offensive”, “indecent”, “obscene” or “menacing”, as well as certain false communications sent for purposes including annoyance, inconvenience, insult, hatred, ill will and needless anxiety.
The Cybercrimes (Prohibition, Prevention, etc.) (Amendment) Act 2024 substituted paragraphs (a) and (b) of section 24(1). The amended provision now addresses a message or other matter sent through a computer system or network which:
- is pornographic; or
- is known by the sender to be false and is sent for the purpose of causing a breakdown of law and order, posing a threat to life, or causing such message to be sent.
The amendment therefore removed several of the broader expressions contained in the original subsection 24(1).
This distinction matters when considering older cyberstalking cases.
What does section 24(1) now prohibit?
Section 24(1) provides for an offence where a person knowingly or intentionally sends a message or other matter through a computer system or network that:
1. Is pornographic
The amended section 24(1)(a) covers a message or other matter that is pornographic.
2. Is knowingly false and sent for a specified purpose
Section 24(1)(b) applies where the sender knows the message or other matter to be false and sends it for the purpose of:
- causing a breakdown of law and order;
- posing a threat to life; or
- causing such message to be sent.
The significance of the amendment is that merely establishing that a statement is false is not enough.
The statutory requirements must be satisfied.
For example, where the prosecution relies on section 24(1)(b), questions may arise as to whether the accused knew that the communication was false and whether it was sent for one of the purposes specified by the law.
What did the Court say in JULIUS v. FRN?
An important Nigerian case on the former section 24(1)(b) is JULIUS v. FRN (2021) LPELR-54201(CA).
The case was decided before the 2024 amendment and therefore concerned the wording of the former provision. The Court of Appeal identified the ingredients that had to be established for the offence under the then applicable section 24(1)(b).
The Court stated:
……..Section 24(b) of the Cybercrimes (Prohibition, Prevention etc.) Act, 2015, which Section is hereby reproduced: 24. (1) A person who knowingly or intentionally sends a message or other matter by means of computer systems or network that- (b) he knows to be false, for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred, ill will or needless anxiety to another or causes such a message to be sent, commits an offence under this Act and is liable on conviction to a fine of not more than N7,000,000.00 or imprisonment for a term of not more than 3 years or both. The ingredients of this offence include that: i. the defendant knowingly or intentionally sent messages by means of computer which he knows to be false; ii. the defendant sent the false messages for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred, ill will or needless anxiety to another person. ……..
JULIUS v. FRN (2021) LPELR-54201(CA), pp. 27–28, paras. E–D, per Cordelia Ifeoma Jombo-Ofo, JCA.
The quotation above must be understood in its historical context. The Court was applying the 2015 wording of section 24(1)(b). The 2024 amendment subsequently removed the listed purposes such as annoyance, inconvenience, insult, hatred and needless anxiety and replaced them with the narrower purposes contained in the amended provision.
The case nevertheless illustrates an important general point: the prosecution must establish the ingredients of the particular statutory offence with evidence.
What about bullying, threatening or harassing someone online?
This is where section 24(2) becomes particularly important.
The 2024 amendment to section 24(1) should not be confused with section 24(2). The amendment specifically substituted the paragraphs in subsection (1). The provisions of subsection (2), dealing with certain threatening and harassing communications, remain part of the law.
Section 24(2) addresses a person who knowingly or intentionally transmits or causes the transmission of a communication through a computer system or network:
Bullying, threatening or harassing communications
Under section 24(2)(a), the communication must be one that is used to bully, threaten or harass another person, and it must place that person in fear of:
- death;
- violence; or
- bodily harm.
This is significant.
A person may send an insulting or unpleasant message without committing the offence contemplated by section 24(2)(a). The statutory requirement concerning fear of death, violence or bodily harm must still be considered.
For instance, repeatedly sending a person messages threatening to kill or physically harm them is materially different from simply posting an unflattering opinion about them.
What about threats to kidnap someone?
Section 24(2)(b) deals with communications containing:
- a threat to kidnap a person;
- a threat to harm another person;
- a demand or request for ransom for the release of a kidnapped person; or
- a demand made to extort money or another thing of value from a person, firm, association or corporation.
This means that a threat made electronically can have serious criminal consequences even where the victim and perpetrator never meet physically.
The fact that the communication was made through WhatsApp, Facebook, Instagram, email, SMS or another computer network does not make a serious threat legally insignificant.
What about threats to someone’s reputation?
Section 24(2)(c) addresses certain communications containing threats to harm:
- the property of the addressee or another person;
- the reputation of the addressee or another person;
- the reputation of a deceased person; or
- threats to accuse the addressee or another person of a crime.
However, the provision is concerned with such threats where they are used to extort money or another thing of value.
That qualification is important.
For example, a message threatening to publish damaging information about someone unless the person pays money may raise issues under section 24(2)(c).
It would therefore be incorrect to read the provision as making every online statement that damages someone’s reputation a cyberstalking offence.
What are the penalties for cyberstalking?
The penalties depend on the particular subsection involved.
For an offence under section 24(1), the penalty is a fine of not more than ₦7,000,000, imprisonment for a term of not more than three years, or both.
For communications falling under section 24(2)(a) and (b), the Act provides for imprisonment for a term of 10 years or a minimum fine of ₦25,000,000.
For an offence under section 24(2)(c), the Act provides for imprisonment for a term of five years or a minimum fine of ₦15,000,000.
The seriousness of these penalties demonstrates that the law does not treat certain forms of online threats and harassment as merely private disputes.
Can a court order the person to stay away from the victim online?
Yes.
Section 24(3) gives the court additional protective powers where a person has been convicted of an offence under subsections (1) or (2).
The court may make an order intended to protect the victim or another person from further conduct amounting to harassment or conduct likely to cause fear of violence, death or bodily harm.
The order may prohibit the defendant from doing specified things.
The Act also provides that breaching such an order is itself an offence. A person who does something prohibited by the order may be liable to a fine of not more than ₦10,000,000, imprisonment for a term of not more than three years, or both.
Importantly, section 24(6) also permits the court to make an interim order for the protection of victims from further exposure to the alleged offences.
Does creating multiple social media accounts amount to cyberstalking?
Not necessarily.
Suppose someone blocks another person on Instagram, Facebook or WhatsApp and the other person creates another account.
The creation of the account, standing alone, does not automatically establish the offence under section 24.
The conduct that follows is what matters.
If the new account is used to send communications that satisfy the requirements of section 24, particularly threats, harassment or communications placing the victim in fear of death, violence or bodily harm, the legal position may be very different.
The lesson is simple: do not focus only on the existence of multiple accounts. Examine what was communicated through those accounts and whether the statutory ingredients have been established.
Is every online insult cyberstalking?
No.
This is perhaps the most important point for social media users.
Calling someone an unpleasant name, criticising them, disagreeing with their views or making a statement that they dislike does not automatically make the person a cyberstalker.
The 2024 amendment is particularly important in this regard because several of the expressions that appeared in the former section 24(1), including “annoyance”, “inconvenience”, “insult”, “hatred”, “ill will” and “needless anxiety”, were removed from the amended subsection.
The amendment followed longstanding concerns about the breadth of the former provision and its implications for freedom of expression.
This does not mean that everything said online is protected.
Threats of violence, kidnapping, extortion and other conduct expressly prohibited by law remain potentially criminal.
The important point is that there must be a proper legal basis for the criminal allegation.
What should you do if someone is cyberstalking or threatening you?
If you believe that someone is using electronic communications to threaten or seriously harass you, preserve the evidence.
Do not immediately delete the messages.
Keep:
- screenshots;
- the original messages where possible;
- usernames and account details;
- telephone numbers;
- email addresses;
- dates and times;
- links to posts or profiles;
- voice notes;
- photographs and videos;
- evidence of repeated contact; and
- any communication demanding money or another thing of value.
Where possible, preserve the original electronic material rather than relying solely on screenshots.
If the communication involves a genuine threat to your life or physical safety, treat the situation seriously and seek appropriate assistance from law enforcement and legal counsel.
What if you have been accused of cyberstalking?
An allegation is not a conviction.
If someone reports you for cyberstalking, the actual communication and the circumstances surrounding it should be examined against the specific statutory provision relied upon.
Do not assume that every complaint under section 24 automatically establishes an offence.
The 2024 amendment is particularly important because the wording of section 24(1) has changed. An allegation based on conduct that may have been captured by the old wording must be carefully distinguished from conduct that satisfies the current law.
You should also preserve the complete conversation where relevant. A single screenshot may not tell the whole story.
If the matter has progressed to an invitation, arrest, investigation or prosecution, obtaining independent legal advice is advisable.
What is the difference between cyberstalking and ordinary online disagreement?
A useful way of thinking about it is this:
Online disagreement concerns what people say to one another. Cyberstalking concerns conduct that falls within a specific criminal prohibition.
Someone can be rude without committing cyberstalking.
Someone can be offensive without satisfying section 24.
Someone can make a controversial political statement without automatically committing a cybercrime.
But a person who uses electronic communications to make qualifying threats, place another person in fear of death or violence, threaten kidnapping, or make certain threats for purposes of extortion may cross the line into criminal conduct.
The precise facts therefore matter.
The burden of proving the offence matters
Cyberstalking allegations can have serious consequences for the accused person. This makes it important that the statutory ingredients are properly established.
The prosecution cannot simply point to an unpleasant message and assume that the offence has been proved.
In JULIUS v. FRN (2021) LPELR-54201(CA), pp. 27–28, paras. E–D, the Court of Appeal expressly identified the ingredients that applied to the version of section 24(1)(b) before the 2024 amendment.
Although the wording considered in that case has since been amended, the decision remains useful in demonstrating the importance of identifying and proving the ingredients of the particular offence charged.
Conclusion
Cyberstalking is not simply another word for being rude to someone online.
Under Nigerian law, section 24 of the Cybercrimes Act deals with specific forms of electronic communication, and the applicable requirements depend on the subsection being relied upon.
The 2024 amendment significantly changed section 24(1) by replacing the former broad language with provisions concerning pornographic communications and knowingly false communications sent for specified purposes.
At the same time, section 24(2) continues to address serious online bullying, threats and harassment, including communications that place a person in fear of death, violence or bodily harm, threats to kidnap, and certain threats made for extortion.
For victims, the practical lesson is to preserve evidence and take genuine threats seriously.
For persons accused of cyberstalking, the lesson is equally important: an accusation is not proof of an offence. The precise communication must be tested against the requirements of the law.
Disclaimer
This article is provided for general informational and educational purposes only. It does not constitute legal advice and does not create a solicitor-client relationship between the author and any reader.
Cybercrime legislation and its interpretation may change, and the application of section 24 depends on the particular facts and circumstances of each case. The discussion of judicial authorities in this article is also subject to the distinction between the law considered in those cases and subsequent legislative amendments.
Anyone who is facing arrest, investigation, prosecution, threats or other legal consequences arising from alleged cyberstalking or online communications should obtain advice from a qualified legal practitioner based on the specific facts of the matter.
If you found this helpful, please share it on social media — it only takes a click.