Provision of Real-time Lawful Interception Assistance

Constitution of the Republic of Cameroon

The Preamble to the Constitution states that “the privacy of all correspondence is inviolable and may not be interfered with or intercepted unless this is authorised by the judiciary.” It also states that “the home is inviolate. No search may be conduct except by virtue of the law.” The constitution affirms the country’s “attachment to the fundamental freedoms enshrined in the Declaration of Human Rights, the Charter of United Nations and the African Charter, on Human and Peoples’ Rights,” including in relation to the aforementioned principles.

Law 2005/007 of 27 July 2005 – Criminal Procedure Code (“CPC”)

Section 92(3) CPC states that for investigations of crimes punishable with at least two years imprisonment, judicial police officers may, on the written authorisation of the Examining Magistrate and under the control of the State Counsel, intercept, record or transcribe telecommunications in the course of an investigation.

Under section 245(4), the Examining Magistrate or State Counsel may order the interception, recording and transcription of correspondence sent by means of telecommunication only when necessary for the purposes of the investigation. These operations are then performed under his authority and control. The order for interception must be in writing and identify:

• the means of communication to be intercepted;
• the offence being investigated; and
• the duration of the authorised interception.

The duration of the interception operation may be up to four months but can be renewed under the same formalities, for the same duration, and for an unlimited number of times for as long as it remains necessary for the purposes of the investigation.

These orders are not subject to any form of appeal process or judicial review.

The Examining Magistrate, or the judicial police officer commissioned by him, may order the installation of an interception device by any qualified agent of a service or institution placed under the authority or supervision of the Minister in charge of Telecommunications or any qualified agent of the operator of a telecommunication network or a provider of authorized telecommunication services (in each case, whether public or private).

Such interception devices may be installed on communication service providers’ (“CSPs”) networks, with or without their knowledge or oversight. Such interception devices may only be installed upon the issuance of an intercept order and must be removed after the expiration of the order.

The Examining Magistrate, or the judicial police officer commissioned by him, must transcribe the correspondence relevant to the case, and make a report of each interception operation and recording. The report must state the date and hour that the operation started and ended. The recordings are kept under seal and the transcription is then put in the case file.

Unless the President of the Bar Council is informed by the Examining Magistrate in advance, no interception can be effected on the telephone lines of a barrister’s office or residence and no interception can be effected on the telephone lines of members of a public institution which benefits from immunity from prosecution under the Constitution.

Law 2010/012 OF 21 December 2010 Relating To Cybersecurity and Cybercriminality in Cameroon

Article 1 of Law 2010/12 states an objective to “protect basic human rights, in particular the right to human dignity, honour and respect of privacy, as well as the legitimate interests of corporate bodies.” Article 41 states that “every  individual  shall  have  the  right  to  the  protection  of  their  privacy.” Articles 42 through 48 provide further clarifications on expectations for providers to protect users’ privacy in the storage and transmission of data, including requirements for user consent in Article 44. Exceptions for technical storage prior to transmission and for purposes of providing digital evidence are outlined (see more in “disclosure of communications data” below).

Under Article 49, criminal investigation officers may intercept record or transcribe any electronic communication in the investigation of crimes or offences provided for under Law 2010/012. Such interceptions must be carried out in accordance with the formalities under section 245 CPC set out below.

Decree 2012/1638/PM of the 14th of June 2012 and Law 2010/013 OF 21 December 2010 Regulating Electronic Communications in Cameroon

Section 16 of Decree 2012/1638/PM states that all network operators (including operators of public networks) must comply with requests from judicial, administrative, military, and police authorities as well as from the Minister in charge of Telecommunications and the TRB, in accordance with applicable laws.

If CSPs do not comply with such orders, the Telecommunications Regulatory Board (“TRB”) may suspend, withdraw or curtail their licence to operate (Article 68, Law 2010/013).

Disclosure of Communications Data

Law 2010/012 OF 21 December 2010 Relating To Cybersecurity and Cybercriminality in Cameroon

Article 25 of Law 2010/012 requires that network operators and electronic communication service providers preserve traffic and connection data (data relating to an electronic communication indicating the access process, origin, destination, route, time, date, size and duration or type of underlying service) for a period of 10 years and ensure that such data shall be accessible during judicial investigations. Such CSPs must also set up mechanisms for monitoring the traffic data of their networks so that it is accessible as required in the course of judicial inquiries. There is no specific oversight for this process and CSPs must simply respond to any requisition received under section 16 of Decree 2012/1638/PM within the timeframe set out in the requisition or order.

Article 29 includes similar retention requirements for “operators of information systems.” Article 35 includes similar retention requirements for “persons whose activity consists in providing access to electronic communications” and “persons in charge, even gratuitously, of the storage of signals, written material, images, sound or messages of any nature.”

Article 55 of the cybersecurity law also requires encrypted, encoded, and compressed data to be handed over to authorities upon request. According to Article 58, private keys must also be delivered on request of regulated agents and, if they are not available, the judicial authorities may appoint an expert to perform technical operations to obtain the clear version of said data.”

National Security and Emergency Powers

Constitution of Cameroon

Under Article 9 of the Constitution, the President may, where circumstances so warrant, declare by decree a state of emergency which shall confer upon him special powers “as may be provided for by law” and in the event of a serious threat to the nation’s territorial integrity or to its existence, its independence or institutions, the President may declare a state of siege by decree and take any measures as he may deem necessary.

The nature of such powers are not defined by the law and are often used in cases of threat to national security, public order or national sovereignty. For example, there have been instances in the past where the TRB has shut down internet connection services in certain regions of the country on national security grounds.

Law 2010/013 of 21 December 2010 Regulating Electronic Communications in Cameroon

Under Articles 9(3) and 10(3), government agencies may invoke special powers to prescribe measures to be taken in the event of threats to national security, defence, public security, health and the environment. These measures are set out in network operators’ licences and may include powers to temporarily suspend or restrict access to certain services. These powers may be exercised by any government agency upon notice to the licence holder.

Article 72 specifies that “In the event of a serious event affecting the security of the State, the President of the Republic may prescribe to operators and service providers, any measure ranging from the restriction of access to certain services to the temporary suspension of electronic communications, in all or part of the national territory.”

Censorship-related Powers

Decree 2012/1638/PM of the 14th of June 2012

As referred to above in “Disclosure of Communications Data”, section 16 states that all network operators (including operators of public networks) must comply with requests from judicial, administrative, military and police authorities as well as from the Minister in charge of Telecommunications and the TRB, in accordance with applicable laws. This power may be used by the aforementioned authorities to require CSPs to block IP addresses of websites with illegal content (such as child pornography).

Law N°2014/028 of 23 December 2014 on Suppression of Acts of Terrorism in Cameroon

Section 8 clarifies that whoever publicly acclaims acts of terrorism shall be punished with imprisonment of, from fifteen to twenty years or a fine of, from twenty-five million francs (25,000,000) FCFA to fifty million (50,000,000) or both such imprisonment and fine. The offense is characterized by any act of terrorism made by way of media, leaflet, or by any other means intended to reach the public.

Law 2010/012 OF 21 December 2010 Relating To Cybersecurity and Cybercriminality in Cameroon

Section 28 of Law 2010/012 states that operators of information shall “inform users of prohibitions to use electronic communications networks for publishing of illicit content or other act that is likely to affect security of networks or information systems.”

Section 34 states that “the persons in charge,  even gratuitously,  of the storage of signals, written material, images, sound or messages of any nature supplied by the users of [electronic communication] services may be liable” for such acts.  However, the law clarifies the liability does not apply where the persons were not aware of the illicit nature of the content or data at issue or facts characterizing them as such, and where they acted promptly to withdraw it or render it inaccessible upon obtaining such knowledge.

Section 40 clarifies that anyone whose activity is intended to make transmission more efficient by “the automatic, intermediary and temporary storage of content transmitted by a provider” can only be held liable to the extent they modify such content, fail to comply with required conditions of access, or “impede the licit and normal use of the technology used to obtain data.

Publication of Laws and Aggregate Data

Publication of laws

There are no restrictions on the publication of laws in Cameroon.

Publication of aggregate data

Section 51 of Law 2010/012 of 21 December 2010 Relating To Cybersecurity and Cybercriminality in Cameroon states that the personnel of electronic communication network operators or electronic communication service providers are be bound to secrecy for any requests they receive in relation to the interception of electronic communications.

Therefore, CSPs are not able to publish reports containing aggregate data on the numbers of interception requests they receive from government agencies.