South Sudan’s new cybercrime law ramps up threat of jail for journalists

The Committee to Protect Journalists calls on authorities in South Sudan to urgently reform its new cybercrimes law, which punishes defamation with up to five years in prison, criminalizes speech on overbroad grounds, and fails to protect whistleblowers and public interest reporting.

While government officials maintain the law is intended to address online fraud and digital harassment, human rights activists have raised concerns that it could criminalize legitimate online activity and be misused to further restrict press freedom.

South Sudanese human rights activist and researcher James Bidal told CPJ that the Act’s vague definitions of “false or misleading information” (Section 44) and “undesirable content” (Section 42) leave journalists and other citizens in a dangerous position of “legal uncertainty” as these terms can be interpreted subjectively by authorities.

“In its current form, the Act presents a risk of potential misuse and self-censorship,” said Bidal, who is Head of the Secretariat for the South Sudan Human Rights Defenders Network (SSHRDN).

President Salva Kiir signed the Cybercrimes and Computer Misuse Act, 2026 into law on February 18, replacing the Cybercrimes and Computer Misuse Provisional Order, 2021.

A growing number of African nations, including Gambia (2018), Ghana (2001), Kenya (2017), Lesotho (2018), Liberia (2019), Malawi (2025), Seychelles (2021), Sierra Leone (2020), South Africa (2024), Uganda (2026), and Zimbabwe (2014), have abolished criminal defamation laws. Cybercrimes laws continue to be used to jail journalists, including by re-criminalizing defamation and prohibiting speech on broad grounds,  although this legislation is being challenged in countries such as  Kenya, Zambia and Nigeria. 

“South Sudan’s 2026 cybercrimes law is fundamentally flawed. Not only does it increase the jail sentences for defamation and false news, but it also contains myriad poorly crafted provisions that leave it open to abusive interpretation,” said CPJ Africa Program Coordinator Muthoki Mumo. “South Sudanese authorities need to go back to the drawing board to enact a law that tackles legitimate cybercrime concerns without undermining freedom of expression or making it even more difficult for journalists to do their jobs.”

South Sudan’s 2008 penal code already punishes defamation with up to two years in prison and/or a fine.

Imprisoning journalists for causing reputational damage is incompatible with international human rights standards. Both the United Nations and the African Commission on Human and Peoples’ Rights recommend the decriminalization of defamation.

Key cybercrime provisions that could put journalists behind bars

Eight provisions in the South Sudanese law that could pose a threat to journalism include:

Section 6 (3) gives the regulatory National Communication Authority power to order internet service providers to give access to “any” data that it “considers important for protection of users,” without providing for judicial oversight.

Section 33 criminalizes transmitting or receiving data without authorization with a penalty of up to five years in prison. There are no public interest exemptions for activities such as whistleblowing or investigative journalism.

Section 42 says platform administrators who fail to take “reasonable steps to restrict or remove access to unlawful content” could face up to five years in prison. Such “undesirable content” includes “any online content” that is “deceptive or inaccurate, posted with intent to defame, threaten, abuse or mislead the public,” “threatens national security,” or “Promotes Tribalism

Section 44 provides for up to five years in prison for the publication of “false or misleading” information that causes public panic, economic loss, or “damage to the reputation of any person or group of persons.”

Section 47 equates phishing with the knowing transmission or retransmission of “unsolicited messages” and punishes it by up to five years’ imprisonment. This is at odds with the earlier “interpretations” section of the law, which uses a more commonly accepted definition of phishing as the sending of “fraudulent communications that appear to come from a legitimate source” with the intention of stealing or gaining access to sensitive data.

Section 51 provides for up to two years in prison for “offensive communication,” defined as sending messages deemed “abusive, or inappropriate, potentially causing harm or distress to others.”

Section 53 stipulates up to 10 years in prison for “cyberbullying,” defined under the law as “hurtful, targeted behavior” involving “the repeated and intentional use of digital technologies to harass, threaten, embarrass, or target another person.”

Section 67 sets out up to five years in prison for cyber harassment, defined as using electronic communication or a digital platform “to threaten, insult, demean, or otherwise cause psychological distress, fear or emotional harm to another person.”

Journalists risk censorship, detention, and death

South Sudan has had a poor press freedom record since celebrating independence from Sudan in 2011. Conflict and tensions persist, with journalists facing censorship, arbitrary detention, and intimidation. CPJ has documented at least 10 journalists killed since 2012.

In 2025, authorities suspended social media to block news from neighboring Sudan and the online news outlet Hot in Juba over unspecified complaints.

Information Minister Ateny Wek and the regulatory South Sudan Media Authority’s managing director Elijah Alier Kuai did not respond to CPJ’s requests for comment via messaging app.

Editor’s note: This text has been updated in the ninth paragraph to clarify that it is the African Commission on Human and Peoples’ Rights, an African Union organization, that recommends the decriminalization of defamation.