From the Cybercrime Act to NCC takedown orders, Nigeria has been quietly building a digital control architecture for years.
By Epiphanus Obia
On Monday, 25th May, Kenya’s government walked into parliament asking for $21 million to build an AI-powered social media monitoring system, and the reaction across African tech circles was one of shock, outrage,and the usual X tweets and quotes. While this looks like Kenya’s issue, anyone who has been paying attention to Nigeria’s regulatory moves over the past decade would agree to the fact that Nigeria got there first, but just without the press conference.
Kenya’s officials named the project: AI-driven sentiment analysis, a National Communication Center, real-time tracking of trending narratives, a budget line for flagging content the government considers false or harmful. While everyone can argue with it, the whole process has a paper trail. But Nigeria’s version has no single document, no announced budget, no one moment you can point to and say: this is where it all started. Instead it arrived in pieces, spread across years, dressed in the language of public order and platform accountability. And those pieces, laid side by side, tell a story the country hasn’t quite reckoned with.
The Cybercrime Act: The Original Foundation
The Cybercrimes (Prohibition, Prevention, Etc.) Act was signed in 2015. On paper it was about protecting critical infrastructure and prosecuting online fraud, legitimate goals in a country bleeding billions to internet scams annually. But buried inside it were provisions that created criminal liability for online speech.
Section 24 made it an offence to send messages that were “grossly offensive,” “indecent,” or intended to cause “annoyance.” Annoyance. The penalty was up to three years in prison or a fine of ₦7 million. Critics flagged the vagueness immediately. Courts eventually heard challenges to the provision, and in 2024 a Federal High Court ruled that part of Section 24 was unconstitutional. But the provision had already been used (against journalists, activists, and critics of sitting governments) for nine years before that ruling came.
The amendment that followed in 2024 was supposed to fix the problem. It removed the annoyance clause. It also, almost simultaneously, expanded law enforcement access to communications data. The bill that was supposed to protect free expression handed investigators a broader reach into what Nigerians say and to whom.
The NCC and the Takedown Architecture
The Nigerian Communications Commission has spent years building regulatory muscle over what flows through the country’s internet infrastructure. Some of it is defensible, such as spectrum management, interconnection standards, and consumer protection. But a meaningful portion of it reaches into content.
In 2021, when the federal government ordered Twitter suspended after the platform deleted a tweet by President Muhammadu Buhari, it was the NCC that transmitted the directive to internet service providers. The mechanism worked cleanly. ISPs complied within hours, no court order and no legislative debate. A phone call, essentially, and one of the world’s largest social platforms went dark for 43 million Nigerians for 222 days.
The Twitter ban was eventually lifted, but what it revealed — that Nigeria had a functional infrastructure for platform-level suppression — was never seriously examined after the fact. The story moved on. The infrastructure stayed
NITDA and the Legitimacy Layer
The National Information Technology Development Agency (NITDA) sits slightly removed from the more overtly coercive instruments. Its mandate is development: building Nigeria’s tech sector, promoting adoption, and setting standards. But NITDA has also become the regulatory layer through which content governance gets dressed in procedural clothing.
Its 2019 Social Media Guidelines proposed a registration regime for social media platforms operating in Nigeria, mandatory local data storage, and requirements that platforms respond to government takedown requests within 24 hours. The guidelines were eventually walked back after pushback from civil society and platform operators, but the template was laid. A 2022 NITDA Code of Practice for Interactive Computer Service Platforms revisited much of the same ground, this time with less public noise and more regulatory staying power.
The effect of these instruments, individually, looks like platform governance. Collectively, they create an environment in which foreign platforms face consistent pressure to appoint local representatives, store Nigerian user data on local servers, and maintain compliance teams accessible to Nigerian regulators. Once those structures exist, the distance between a regulator and a user’s data gets considerably shorter.
The Broadcast Code and the Older Media
The National Broadcasting Commission’s regulatory approach to traditional media has long included content monitoring, recording airtime, tracking compliance with local content rules, issuing sanctions for broadcasting material deemed contrary to public order. Stations have been shut down, and fines have been issued. The commission has statutory powers to revoke licences.
As broadcast and digital media increasingly blur, (radio stations with YouTube channels, newspapers with podcast arms, TV networks with Twitter presences) the question of where NBC jurisdiction ends and NCC jurisdiction begins has never been cleanly resolved. That ambiguity is not accidental. Regulatory grey zones are useful when you want flexibility.
The 2024 Cybercrime Amendment: Expansion During Reform
The 2024 amendments to the Cybercrime Act came in response to sustained pressure from civil society over Section 24. Activists, journalists, and international rights groups had spent years documenting its abuse. The amendment was framed as a win.
But the same amendment introduced or strengthened provisions around interception of communications and law enforcement access to user data from service providers. Sections critics had less public appetite to debate (because they didn’t involve jailing people for tweets — expanded) the state’s reach into private digital communications. The public argument about free expression seems to have created cover, or at minimum distraction, for the surveillance infrastructure being reinforced around it.
What Kenya Is Proposing and What Nigeria Has
Kenya is asking their parliament to approve a system, but Critics argue Nigeria already possesses many of the functional elements of such a system . Kenya’s proposal is an AI monitoring tool, a centralized communications hub, and real-time narrative tracking.
Nigeria has a Cybercrime Act that criminalises speech, an NCC with proven platform-suppression capability, a NITDA with data governance ambitions, a broadcast regulator with broad content powers, and a history of using all of them against critics during moments of political pressure.
What Nigeria does not have is a line item in a budget document that reads: social media surveillance. What it has instead is a collection of instruments that can be assembled into something functionally similar, operated through existing agencies, justified under existing law, and activated at political discretion.
The Kenyan debate will happen in public, which means it can be contested in public. The Nigerian architecture was assembled quietly, across multiple administrations, and the pieces are already in place.