How Zambia’s Cyber Laws Rebrand Repression

The hope was that President Hakainde Hichilema would bring much-needed reform and openness. Instead, he has ushered in new laws that are silencing dissent and free expression. 

By Wiriranai Brilliant Masara

August 2025

When Zambia’s President Hakainde Hichilema swept into power in 2021, many hailed him as the reformer the country had long awaited. Winning with almost 60 percent of the vote in the general election that year — despite campaign obstruction from the ruling Patriotic Front and a politically charged treason trial — Hichilema was seen as a principled technocrat poised to undo nearly seven years of democratic backsliding under President Edgar Lungu (2015–21). This perception was rooted not only in the hopes people held but also grounded and shaped by the promises Hichilema made during his campaign and the widespread expectation that he would fulfill them once in office.

One of these was to repeal the repressive laws used by his predecessors to stifle dissent and undermine fair electoral competition. Early in his presidency, Hichilema followed through on his promises — most notably, perhaps, by abolishing the Criminal Defamation of the President Law as well as the death penalty, marking a symbolic break with Zambia’s authoritarian past. In this spirit of reform, the Hichilema regime also sought to repeal and replace the controversial and much-criticized 2021 Cyber Security and Cyber Crimes Act (CSCCA), which was seen not as a genuine cybersecurity tool but as a legal façade for digital authoritarianism. And yet four years later, in the process of replacing the old with the new, the vague with the just, what has emerged instead is a rebranded version of repression draped in reformist language.

The apparent U-turn by Hichilema can be understood within the dimming glow of his reformist rhetoric as well as the failure of his administration to meet some of the campaign promises he had made. While his early reforms won him international praise and domestic goodwill, public discontent gradually surged as core campaign promises went unfulfilled, with the cost of living soaring, and youth unemployment remaining high. When his campaign promises began to clash with the realities of incumbency, Hichilema chose to consolidate power, and civil society groups that once celebrated his rise began sounding the alarm over shrinking civic space in Zambia.

As mounting public frustration deepens and his 2026 electoral prospects darken, the regime’s political calculus has shifted, and Hichilema’s intolerance of dissent has shattered his reformist image. What began as a promise of democratic renewal has hardened into a project of control where the regime increasingly relies on legal and institutional power to silence dissent.

The New Cyber Laws

This past April, Zambia’s Parliament quietly enacted the Cyber Security Act of 2025 and the Cyber Crimes Act of 2025. Together, they replaced the earlier CSCCA, which had been controversially passed under Hichilema’s predecessor, President Lungu, ahead of the 2021 general elections. International observers and civil society groups had warned that the law’s broad definitions — for example, the imprecise definition and classification of “critical information” to broadly include all forms of digital communication — grant the regime sweeping powers to criminalize dissent, chill legitimate speech, and enable intrusive data collection. Similarly, this year’s two new laws, which authorities claim are needed to strengthen security and state cyber capabilities, have received substantial criticism from prodemocracy activists, regime opponents, and legal professionals.

Some sections of the Cyber Security Act are regressive, as they far outstrip the CSCCA in allowing for extended warrantless or ex parte surveillance. For instance, Section 39 dramatically expands state surveillance by requiring all internet and communication providers to install equipment with “full time monitoring facilities for interception of communications.” Consequently, after the new law came into force in April, the U.S. embassy in Lusaka issued a surveillance warning to U.S. citizens in Zambia. The country’s authorities, however, dismissed the warning, characterizing it as a misinterpretation. Many Zambians were stunned not only by the content of the legislation but also by the fact that they had learned of its implications from a foreign embassy’s alert rather than from their own government, which had given no prior public notice.

The surveillance powers pose a grave threat to citizens’ privacy. The Cyber Security Act includes no explicit boundaries on how intercepted or collected data may be used. The mandated monitoring facilities essentially build a pipeline from private networks to government agencies, the exact nature of which has not been publicly clarified. As no communication is guaranteed to be private, the provision affects all citizens and residents who use phones, messaging services, or the internet. This loss of privacy is especially alarming for activists, regime critics, journalists, and opposition politicians, as they are likely persons of interest who could be targeted for political spying. With the general election looming in August 2026, the ruling party could abuse state surveillance powers to track opposition activities, intercept strategies, and or intimidate dissenters. Indeed, Zambia has a history of ruling parties using state machinery to suppress their opponents during elections. Now, the digital realm could be similarly weaponized.

Embedded in the Cyber Security Act is a stringent data-localization requirement, which has also drawn criticism: Any information deemed “critical” — broadly defined to include data related to economic stability, public health, and other loosely bounded categories — must be stored domestically. In practice, this could compel any entity, including civil society groups and even social-media platforms, to store data on local servers, thereby giving authorities easier access. The 2021 CSCCA contained no localization mandate. The new law’s shift toward “digital sovereignty” — that is, the ability of states and organizations to shape and enforce policies within their digital environments — reflects a regional trend. Countries such as Kenya and Nigeria, for example, are requiring data residency to assert control over digital infrastructure, ostensibly for national-security purposes but also to facilitate surveillance and regulatory oversight. The broad data-localization mandate in Zambia’s law likewise risks enabling regime monitoring of sensitive private data under the guise of security.

Separately, the Cyber Crimes Act enumerates a broad spectrum of crimes, yet several provisions hinge on indeterminate language that risks ensnaring legitimate online expression. Notably, Section 22 makes it an offense to use a computer to publish anything “obscene, vulgar, [or] lewd” with the intent to humiliate or harass another person. The ambiguity inherent in this context enables law-enforcement entities to target dissenting journalists, opposition members, and civil society activists. In practice, the legislation may serve to suppress online discourse and deter whistleblowing, ultimately discouraging the public from exercising fundamental rights for fear of being accused of engaging in cyber harassment.

Perhaps the most glaring irony of the Cyber Crimes Act is how it reintroduces criminal defamation despite Hichilema’s having earlier championed freedom of expression by repealing Section 69 of the Penal Code, which specifically criminalized defamation of the president and had long been used to stifle dissent. The new law punishes any false statement that damages someone’s reputation, effectively criminalizing defamation in cyberspace — a stipulation that contradicts Zambia’s earlier steps to undo Section 69. The Cyber Crimes Act prescribes prison terms for anyone who disseminates, via electronic communication, “information, statement or image” that “subjects another person to public ridicule, contempt, hatred or embarrassment.” Such content-based offenses could lead journalists to self-censor and make them reluctant to cover high-risk stories, leaving Zambian citizens far less informed about the workings of their government.

For the general public, the existence of such a law creates a climate of fear around social media, ultimately impoverishing the democratic space as citizens lose the freedom to openly discuss and debate issues online. It mirrors the very kind of law that Zambia had begun moving away from. Thus, despite touting democratic reforms to address the misuse and abuse of vague laws, Hichilema’s purported human-rights commitments sharply contrast with what his government is actually doing.

The new cybersecurity laws lack adequate human-rights safeguards and could further shrink civic space. As censorship-ready legislation that also legalizes short-term social-media bans during civil unrest, the two acts collectively threaten to criminalize dissent and restrict online expression. Good cybersecurity laws typically include clauses to ensure that enforcement measures respect privacy, free expression, and other fundamental rights. The minimal procedural safeguards mean that the law does not provide a clear mandate requiring authorities to exercise restraint or for the courts to interpret the law in a manner that respects free speech or privacy rights. The absence of comprehensive safeguards means that citizens have weaker legal protection against potential abuse. Such uncertainty is itself repressive, as it leads citizens to err on the side of caution, often silencing themselves, which is precisely what a repressive law aims to achieve.

Bait and Switch

Democratically, this trajectory is worrisome. Why would a president who was elected on promises of transparency, rule of law, and human rights introduce laws that mirror and, in some cases, exceed the authoritarian tendencies of his predecessor? Is this the mark of a pragmatic modernizer responding to digital threats or the evolution of a digital strongman cloaked in democratic legitimacy? The new laws could tilt the electoral playing field by giving the ruling party powerful tools to monitor and spy on its opponents. As Zambia heads toward the 2026 general election, these concerns are not abstract. The cumulative effect of the new laws threatens to reverse the gains of Zambia’s democratic transition in 2021.

The Cyber Security Act and Cyber Crimes Act of 2025 were enacted under the banner of reform, but their architecture reveals something far more dangerous. With these laws, the regime did not correct the overreach of the country’s earlier cybersecurity law, but rather deepened it. They empower the state to surveil, silence, and suppress individuals under the pretext of maintaining digital order while also rewiring the social contract in favor of executive control. By enshrining vague offenses, enabling warrantless interception, and centralizing authority under the presidency, these laws set in motion a calculated erosion of democratic oversight in an environment where there is already a crackdown on opposition leaders, independent journalists, and activists.

In a country that once stood as a beacon for peaceful transitions in the region, this legal shift is a warning. Zambians now inhabit a digital space where the lines between lawful dissent and criminality are intentionally blurred. The very tools citizens use to speak, organize, and hold power to account are now subject to surveillance and sanction. This is not a lapse of judgment but a strategic recalibration of power under a president who had promised to dismantle repression. Unless it is challenged legally, politically, and publicly, it will not stop here.

Wiriranai Brilliant Masara, Ph.D., is a research fellow with the Human Rights Foundation.

Copyright © 2025 National Endowment for Democracy

Image credit: Peng Lijun/Xinhua via Getty Images