On World Press Freedom Day, May 3, 2026, the Executive Secretary of Nigeria's National Human Rights Commission (NHRC), Tony Ojukwu, told law enforcement to "exercise caution" before reaching for Section 24 of the Cybercrimes Act. He criticised the statute's misuse to silence journalists and dissenting opinion, called press freedom the "lifeblood" of democracy, and confirmed that the Commission has begun systematically tracking and publishing press-freedom violations tied to the Act. It is a notable move: a federal body, not a foreign NGO, is now keeping the receipts.
The intervention is worth taking seriously precisely because it reframes a problem most observers thought had already been fixed.
A law a regional court already condemned
Section 24 of the 2015 Cybercrimes Act criminalised sending messages that were "grossly offensive," "annoying," or "insulting" via a computer network. In a judgment in suit ECW/CCJ/APP/09/19, brought by the Socio-Economic Rights and Accountability Project (SERAP), the ECOWAS Court of Justice ruled the provision "arbitrary, vague and repressive" and incompatible with Article 9 of the African Charter on Human and Peoples' Rights and Article 19 of the International Covenant on Civil and Political Rights. The court ordered Nigeria to repeal or amend it. That ruling — the legal foundation Ojukwu invoked — is not contested doctrine; it is binding regional law.
The 2024 reform was real — and the case for it is genuine
It is easy to caricature Section 24's defenders, so start with their strongest argument. Online harms are not imaginary. Coordinated harassment, doxxing, fraudulent messaging, and incitement that spills into real-world violence are live problems in a country of more than 100 million internet users, and a state has a legitimate interest in deterring them. Nigeria's government did not ignore the ECOWAS judgment, either. President Bola Tinubu signed the Cybercrime (Prohibition, Prevention, etc.) (Amendment) Act on February 28, 2024, revising twelve sections of the 2015 law. Section 24 was narrowed materially: the "grossly offensive" and "annoyance" language was stripped out, and the false-information offence was retethered to messages sent "for the purpose of causing a breakdown of law and order or posing a threat to life." On paper, that is a defensible, harm-focused standard.
The trouble is that the paper standard is not what people are being arrested under.
Narrower text, unchanged practice
The Committee to Protect Journalists documents that at least five journalists have been prosecuted for cybercrime since the 2024 reforms — evidence that statutory narrowing did not change enforcement behaviour. In a single stretch of 2025, CPJ recorded journalists detained over Facebook posts criticising state officials and over reporting tied to harassment allegations, with bail in one case set at ₦15 million. The pattern is arrest first, charge later, and the chilling effect lands long before any court tests whether a "threat to life" was ever plausible.
That is the real lesson of the NHRC's pivot. When the binding constraint was the text of the law, amendment was the right tool, and Nigeria used it. But the binding constraint has migrated. It now sits in prosecutorial discretion, in the decision to treat a corruption exposé as "cyberstalking," and in the absence of any judicial filter before a reporter spends a week in a cell. No further edit to Section 24's wording reaches that. Documentation — counting the cases, naming the pattern, publishing it — is a direct response to an enforcement problem rather than a drafting one, which is why the NHRC's tracking matters more than another round of amendments would.
The contrast inside Nigeria's own government
The sharpest argument for a lighter touch is sitting elsewhere in Abuja. In April 2026, the Minister of Communications, Innovation and Digital Economy, Bosun Tijani, began standing up a National Cybersecurity Coordination Council — explicitly a non-statutory, multi-stakeholder platform, with a technical secretariat housed at NITDA and support from the NCC, the Nigeria Data Protection Commission, and Galaxy Backbone. Its premise is that security online is achieved through coordination among regulators, industry, civil society and researchers, not through a single coercive instrument.
That is the correct model — and it exposes the contradiction. The same state that convenes industry and civil society to build cyber resilience also presides over an arm that jails the journalists and social-media users who populate the digital public sphere its digital-economy strategy depends on. A serious online-harms regime cannot be a criminal cudgel pointed at speech and a collaborative council pointed at infrastructure; the speech rules deserve the same proportionate, multi-stakeholder logic.
What proportionate looks like
The reform agenda is not abolition. Genuine harms — credible threats, fraud, targeted harassment — warrant clear, narrowly drawn offences. But three changes would align Nigeria with both the ECOWAS ruling and its own innovation ambitions: decriminalise mere offensive or false speech and route reputational disputes to civil defamation; require judicial authorisation before arrest under Section 24, ending the arrest-first norm; and treat the NHRC's documentation as an accountability mechanism with teeth, feeding it into prosecutorial guidelines and police training. Civil-society partners — Access Now, SERAP, Avocats Sans Frontières and the Human Rights Journalists Network, who convened an April 21, 2026 workshop on rights-centred reporting of the Act — have already mapped much of this ground.
Nigeria has shown it will amend a law when a court demands it. The harder test, now visibly its own government's to pass, is restraining how that law is used.