A new cybercrime bill significantly strengthens the State's capacity to act in the digital space. At the center of this framework, the Upin has broad investigative powers, including permanent access to user data. The parliamentary vote on Friday will be decisive for regulating Madagascar's digital landscape.

The Digital Protection and Investigation Unit (Upin) represents one of the innovations in the new cybercrime bill, which will be submitted to deputies for a vote tomorrow, barring any schedule changes.

"A Digital Protection and Investigation Unit, abbreviated as Upin, is hereby established with legal personality and financial autonomy. The Upin is a public institution responsible for prevention, detection, technical investigation, operational coordination, and support to judicial authorities in cybercrime matters," states the bill pending before the lower chamber.

This digital police force is granted considerable prerogatives with a broad scope of action. In carrying out its missions, the Upin, under the supervision of a competent judicial authority, may, among other things, "request electronic communications operators and digital service providers to communicate data whose retention is provided for by current legislation."

This point refers to another bill on electronic communications and digital infrastructure, also to be voted on by deputies Friday. It notably introduces the concept of "digital sovereignty," defined as "the State's capacity to exercise its authority in the digital domain, encompassing the sovereign power to regulate, monitor, and protect digital infrastructure, electronic communications networks, technologies, and data within its jurisdiction."

The aim is "to preserve national independence, fundamental rights, and the nation's strategic interests against foreign actors, whether public or private." To this end, the text introduces a related concept: "data sovereignty." On this point, it is provided that "all digital data generated, collected, or processed on the territory falls under Madagascar's jurisdiction and legislation (...)."

Still pursuing data sovereignty, it is emphasized that "the Malagasy State alone holds exclusive authority to regulate the generation, collection, processing, storage, protection, transfer, and exploitation of this data, to ensure its integrity, accessibility, and protection against any foreign interference."

Security Issues and Freedoms

Article 75 of the cybercrime bill provides that "the Upin has direct technical access, permanent and continuously available (24 hours a day, 7 days a week), to the information systems of electronic communications operators, Internet service providers, registration centers, and any other entity holding data necessary for investigations within its competence (...)."

This provision adds that "this access covers identification, subscription, traffic, and where applicable, content data (...)."

The aforementioned entities are required to ensure permanent technical availability of this access, the cybercrime bill emphasizes. In case of unjustified refusal, they face fines ranging from 100 million to 500 million ariary, plus potential criminal or administrative sanctions.

The bill nonetheless provides oversight mechanisms. Each consultation must be recorded in a secure and tamper-proof log. The agent's identity, time, data consulted, and relevant file must be recorded. Any consultation of traffic or content data must be reported within twenty-four hours to the prosecutor or investigating judge, who may order interruption or destruction if legal conditions are not met.

Furthermore, the Upin may also "urgently order (...) the removal or provisional blocking of manifestly illegal content." It may exercise this prerogative "in cases of manifestly illegal content under the infractions provided for by this law [the cybercrime bill]," following a complaint.

The cybercrime bill aims to be a framework better adapted to new forms of digital crime. Child sexual exploitation, sex trafficking, fake profiles, online fraud, identity theft, information manipulation, cryptocurrency use for illicit purposes, and criminal uses of artificial intelligence are notably in its sights.