OBSERVATIONS ABOUT THE CASE OF BARRISTER GEOFFREY AMANO vs UNITED BANK FOR AFRICA (UBA) PLC

This article (blog post) is just a part of an insightful, informative and interesting article which will be published in November. As soon as it is published I will put up the link to it on the blog so keep a date with this page.

The case of BARRISTER GEOFFREY AMANO vs UNITED BANK FOR AFRICA (UBA) PLC is reported at page 114 of SLP (Section on Legal Practice) Law Journal Vol. 3, 2013 and a pdf version of the report as scanned from the journal can be found here. The SLP Law Journal is a publication of the Section on Legal Practice (SLP), Nigerian Bar Association (NBA).

Brief Facts

Barrister Geoffrey Amano (the claimant) was a customer of UBA PLC (the defendant). The claimant was issued with an ATM card for the operation of his savings account with the defendant. On 11^th November 2009, he went to the bank to withdraw money and he discovered that the sum of N149,000.00 had been withdrawn from his account without his authorization between 6^th November and 9^th November 2009. The defendant however, contended that the withdrawals were made by the claimant through the correct use of his ATM card and PIN, or that he had authorized unknown persons to do so with his ATM correct PIN.

The claimant contended that the bank failed in its duty of care owed to him, which resulted in the loss to him by the unauthorized withdrawal of the sum of N149,000.00 from his account. The particulars of negligence were that the bank failed to make its ATM fraud-proof; that it is only the bank that knew his ATM card number and PIN because it is used on the bank’s machine; that it is the duty of the bank to protect the use of ATM card from being attacked by thieves, which remains its property; that it is the duty of the bank to carry out a thorough investigation to unearth the fraud perpetrated against the customer through the ATM card, and that the bank made it possible for unauthorized persons to break into the customer’s account to steal his money.

On the other hand, the bank contended that it had at all times exercised reasonable measures to ensure best practice, and that no unauthorized persons have access to and or withdraws money from accounts of its customers including The claimant, and that the alleged withdrawals between 6^th November and 9^th November 2009 were all made by The claimant with his ATM card and PIN and that the PIN was known only to him unless he had disclosed it to any such alleged unknown persons, or had been careless in handling his ATM card and PIN number leading to the alleged transactions. The bank also contended that the ATM card was fraud-proof, with adequate security features to protect its users such as the claimant.

Decision of the court

Although the bank had submitted that the disputed transactions were done using the ATM card and correct PIN of The claimant, it woefully failed to lead credible evidence to show that the said ATM card and PIN were the same ones used for the disputed transactions. The court therefore held that based on the circumstance of the facts and evidence in the case, the withdrawal of the sum of N149, 000.00 from the account of the claimant was unauthorized, and that the bank has the duty of care to ensure that the funds of the customer in its custody are safe, and should only be withdrawn upon due authorization by the customer. The bank had failed in the discharge of its duty of care towards the claimant, and was thus liable in negligence. The court therefore ordered the bank to refund the sum of N149, 000.00 that was withdrawn without the customer’s authorization, and to pay to the claimant the sum of N3, 000,000.00 as general damages for the untold hardship suffered for the unauthorized withdrawal of funds from his account.

The court also ordered that there should be interest on the N149, 000.00 part of the judgement sum at the current interest rate per annum from the 9 November 2009 to the date of the judgement and thereafter, the interest rate of 10 per cent per annum as allowed by the Rivers State High Court Rules 2010 on the entire judgement in the sum of N3, 149,000.00 from the date of the judgement till the entire judgement sum is finally liquidated.

OBSERVATIONS

During the cross examination of the bank’s witness (DW1) he testified that the transactions of 6/11/2009 and 9/11/2009 were done through the use of ATM card and correct PIN of the claimant but failed to lead or give any credible evidence to show that the ATM card and PIN of The claimant was used for the withdrawal. At this juncture it is appropriate to reproduce an excerpt of the DW1’s cross examination below:

Q:    Exhibit A is ATM?

A:     Yes.

Q:    Is the defendant still using this ATM?

A:     No.

Q:    Why did the defendant stop its use?

A:     We migrated to another platform.

Q:    Why?

A:     Because the Exhibit A had no name of the account holder on it.

Q:    So the ATM- Card you use now has more security features?

A:     No, the new ATM has better features.

Q:    The better features are for the security of the customer?

A:     No, it is for fast and better transaction.

Q:    What are the security features of the ATM?

A:     Once a customer inserts his ATM card with a wrong PIN number the ATM machine seizes it.

Q:    How does UBA Plc, determine unauthorised withdrawals over which complaints are made?

A:     Unless the customer compromises his PIN there can be no unauthorized withdrawal by ATM card.

Q:    Look at Exhibit D, the Defendant admitted that fraudster can guess and use PIN illegally?

A:     Yes, but that is - usually through the internet.

 Q:   But the use of the internet is not in Exhibit D?

A:     Yes, it is not there.

Q:    So, since fraudster can get the pin number then unwarranted withdrawal can be made through ATM?

A:     No the customer must have compromised his pin.

Q:    It is common knowledge in banking that a fraudster can hack into the ATM Machines?

A:     I am not aware.

Q:    ATM Machines has the capacity to capture footage of the machine?

A:     Yes.

Q:    Do you have the footage of the withdrawals on 6/11/2009 and 9/11/2009?

A:     No, as the withdrawals were done at other banks which do not have footage but used the journal to know the withdrawals on those dates.

Q:    You did not have the PIN used in those withdrawals?

A:     No, it is known only to the customer.

Q:    You also do have anything to show that it was the same PIN number of the ATM used that date?

A:     No, but it was the same ATM Card that was used.

Q:    Can fraudsters guess and use PIN number of a customer and withdraw money?

A:     No, but a person can guess the pin number of a customer and withdraw money and that is why we usually advice against the use of easy pin numbers such as date of birth.

The defendant in trying to prove that the disputed transactions were done using the claimant’s ATM Card and PIN only tendered Exhibit D1(a comprehensive statement of account of the claimant with the defendant) whose contents were rightly disbelieved or discredited by the court when it stated thus in the judgement:

…for money allegedly withdrawn by the claimant or his authorized person through his ATM Card with correct PIN number on 6/11/2009 and 9/11/2009, in Exhibit D1 not a single fact is stated or shown as to the PIN number used and DW1 did not lead any evidence as to how the court can see and confirm the correct PIN number used as alleged by the defendant.

The ATM card is meant to contain within it what is referred to as an Application Transaction Counter (ATC). The ATC is incremented by one each time a transaction is carried out on the ATM. If the disputed transactions were done using the claimant’s ATM card then the ATC on it would have incremented accordingly.

The ATM card of the customer should therefore have been subjected to a forensic analysis to establish whether the ATC had incremented or increased in accordance with each and every ATM transaction on the customer’s statement of accounts, or whether there are any discrepancies. This piece of evidence coupled with other pieces of evidence such as possible ATM camera footage, transaction and event logs and error reports, ATM receipts (might have confirmed that cash was physically dispensed) and all the Authorization Request Cryptogram (ARCQ) information, would have gone a long way to establish whether the customer’s ATM card and PIN were used by him or by someone else to make the disputed withdrawals. Every time a chip and pin or EMV card is inserted into an ATM, an ARQC is a generated and the Authorization Response Cryptogram is generated by the issuer (bank) in response to the ARQC. This response includes the decision by the bank on the authorization request and is sent back to the card for validation before the transaction is completed. The ARQC would therefore have shown whether the card’s chip had been read by the machine.

It is curious why the bank did not choose to follow the path highlighted above, but rather decided to tender only a printed statement of account which obviously cannot be used to prove that a particular ATM card and PIN was used to make a particular withdrawal. Perhaps if the defendant’s lawyer was tech savvy so as to be aware of all the technical aspects involved in the workings of the ATM card and ATM, he would have probably advised the defendant against the tendering of a mere printed statement of account to show that a particular ATM card and PIN was used for a particular transaction.

Computer Literacy/Technical Training

The case of Barrister Geoffrey Amano therefore demonstrates the need for technical training among lawyers and legal practitioners in Nigeria, especially those involved in litigation. Legal practitioners in Nigeria need to become familiar with or educate themselves about computers and computer-like devices and software so as to be in a better position to handle cases involving or having elements of software. The failure to keep up-to-date with advances in technology and how it affects the law will sooner or later render a lawyer or legal practitioner irrelevant at best, negligent at worst, owing to the ubiquity of electronic communications and documentation; which has in turn elevated electronic evidence to a position of vital importance in modern day litigation.

It is also in this regard that I wish to observe that it is high time that the Council of Legal Education and the National Universities Commission found a way to introduce the teaching of electronic evidence in the universities as a core course, because as a core course any student who fails it would not be able to graduate. This should therefore encourage or compel law students (potential lawyers/legal practitioners) to acquire knowledge of computer usage unlike the present situation where many undergraduate law students are computer illiterates.

The need for lawyers to become proficient in computer usage/ICT or to become familiar with or educate themselves about computers and computer-like devices and software cannot be overemphasized thus in the American case of State v. Crabtree, S.W.3d 2012 WL 3538316, the Kentucky Court of Appeals noted thus:

We note that this case demonstrates a need for technical training among legal professionals. There were several instances during the trial when it appeared that counsel for each party attempted to elicit testimony from the experts but failed because of confusion of technical terms. In this particular case, the evidence of guilt was overwhelming, but we anticipate that this communication gap could be damaging in cases with weaker evidence.

I therefore commend to the Council of Legal Education and the National Universities Commission, the words of Denise H. Wong in her article: “Educatingfor the Future: Teaching Evidence in The Technological Age”:

The advent of the technological age has had significant effect on litigation practice, none more so than in the area of evidence gathering and presentation in court. A significant proportion of evidence that is gathered for both criminal and civil matters is now electronic in nature, and this necessitates a change in the way that lawyers think and advise on evidential issues…rather than simply focusing on principles relating to the admissibility of evidence in court, the traditional course on evidence law should be modified to equip students with an intellectual framework that conceives of electronic evidence in litigation as an entire process. This process begins with the gathering and forensic examination of electronic evidence, and is followed by the admissibility of such evidence in court, ending with the effective presentation of the evidence before a judge or jury…taking such an approach, the law teacher would be playing the role of effective gatekeeper to the legal profession by providing a course that is both intellectually rigorous and adequately prepares would-be litigators for the realities of modern day practice.

Duty to exercise reasonable care and skill

In the case under consideration the bank’s witness was cross-examined thus:

Q:    Do you have the footage of the withdrawals on 6/11/2009 and 9/11/2009?

A:     No, as the withdrawals were done at other banks which do not have footage but used the journal to know the withdrawals on those dates.

At this point it is instructive to note that the Central Bank of NigeriaStandards and Guidelines on Automated Teller Machine (ATM) Operations in Nigeria provides that:

Every ATM shall have cameras which shall view and record all persons using the  machines  and  every  activity  at  the  ATM  including  but  not  limited  to:  card insertion,  PIN  entry,  transaction  selection,  cash  withdrawal,  card  taking,  etc. However,  such  cameras  should  not  be  able  to  record  the  key  strokes  of customers using the ATM.

It is the law that banks owe their customers a duty of care to safeguard customers’ funds in their custody and where they breach that duty of care they may become liable in negligence to their customers. In the case of ECOBANK NIGERIA PLC v. ELDER DOMINIC EKPERIKPE (2013) LPELR-20327(CA) it was held that it is the duty of a bank to exercise reasonable care and skill in regard to its customer's affairs. Now, won’t it be negligence on the part of a bank or a breach of the duty to exercise reasonable care and skill considering the level of ATM fraud in Nigeria; to operate ATMs without a camera to capture photo/video footage of persons making withdrawals on the ATM or put in another way; where a bank fails to install a camera on any of its ATMs, won’t that be considered negligence on its part in safeguarding its customers’ monies?

Conclusion

All hope is not lost for bank customers whose money in the bank gets missing or stolen through ATM fraud. All they need to do is to write to the bank informing it of the stolen or missing funds and also copy the same letter to the Central Bank of Nigeria (CBN). The CBN circular of February 7, 2011 with reference number BPS/DIR/CIR/GEN/02/003 and titled: Penalty for Non Compliance with CBN Circulars and Guidelines on ATM Operations in Nigeria provides in relevant parts thus:

(a)An ATM without a camera installed will attract a fine of N50,000 and deactivation of the ATM until the camera is installed.

(b)An ATM deployer will be made to refund the full amount involved in any fraud perpetrated on its ATM for failure to provide footages on the disputed transactions when required.

(c)Failure to respond to the customer or to CBN on ATM complaints within 72 hours will attract a fine of N50,000 per day for each complaint after the 72 hours until the response is received.

(d)Failure to resolve any ATM dispute with evidence of resolution within 14 days, the deployer will refund the total amount involved in the fraud.

If the above option fails they should contact a lawyer with the requisite knowledge to seek redress in a court of law. A lawyer with the requisite knowledge in this case, according to Stephen Mason in Electronic Banking: Protecting Your Rights; will be a lawyer who has a fair knowledge of computers and the workings of ATMs and internet banking, a lawyer who is knowledgeable about electronic evidence and electronic signatures, a lawyer who knows the law in relation to electronic evidence and banking disputes.

EXAM MALPRACTICE AT HARVARD

Examination malpractice is everywhere. It is really amazing the extent some people can go in order to become what they want.  Mathew Martoma wanted to become a lawyer but was expelled from Harvard Law School because he:

(1) used computer software to generate a forged law school transcript, and then submitted the falsified transcript to Federal judges in support of his application for a clerkship;

(2) was then interviewed by several judges, on the basis of the falsified law school transcript;

(3) during disciplinary proceedings at Harvard Law School, altered the date of an e-mail he submitted as mitigating evidence; and

(4) during the disciplinary proceedings, submitted a computer forensic report concerning the date on which the email had been sent, without disclosing to the disciplinary committee that he had formed the company that had prepared the forensic report.

You can read more about Martoma’s story here and here

Please permit me to exclaim in Nigerian English, “no be small thing o”

Nigeria and Data Protection

According to Omer Tene & Jules Polonetsky:

“We live in an age of “big data.” Data has become the raw material of production, a new source of immense economic and social value. Advances in data mining  and  analytics  and  the  massive  increase  in  computing  power  and  data storage capacity have expanded, by orders of magnitude, the scope of information available to businesses, government, and individuals. In addition, the increasing  number  of  people,  devices,  and  sensors  that  are  now  connected  by digital networks has revolutionized the ability to generate, communicate, share, and access data. Data create enormous value for the global economy, driving innovation, productivity, efficiency, and growth.  At the same time, the “data deluge” presents privacy concerns that could stir a regulatory backlash, dampening the data economy and stifling innovation."

It is therefore clear from the above that data, especially personal data(any data or information in connection with a specific individual, which can be used, separately or in combination with other data, to identify an individual) has acquired an immense value in the age we are living(the digital age) and serious steps ought to be taken to protect the personal data of citizens but Nigeria seems to be lagging behind as the best we have at the moment is the guidelines on personal data issued by National Information Technology Development Agency(NITDA) which is good gut not enough(what we need is a law) and there is also a draft bill on Personal Information and Data Protection which is pending before the federal lawmakers.

This does not augur well for the citizens whose personal data is scattered all over the place (banks, the Federal Road Safety Commission (FRSC), the National Identity Management Commission (NIMC), the Nigeria Communications Commission (NCC), GSM service providers and online retailers like Jumia and Konga who are currently making waves in the Nigeria internet sphere as online shopping is becoming increasingly popular among Nigerians).

In China they have taken serious steps to guard and protect the personal data of their citizens with the passage of such laws as the Peoples’ Republic of China Law on the Protection of Consumer Rights and Interests and persons who flout the law are been arrested and prosecuted. For instance the Police in China, apprehended a 10-member gang in Beijing and Shanghai for illegally obtaining and selling nearly one million...You can find the rest of the story here. 

Barr. Timothy Tion discusses the NCC directive to cybercafe owners and cybercrime Part 1

Recently I was on “ICT WORLD”, a radio Benue program to discuss the Nigeria Communication Commission (NCC) directive to cybercafé operators which came into effect on the 1st of November, 2013 directing all cybercafé licencees and operators in the country to maintain an up to date data base of its subscribers/users detailing information such as; full names, names of corporate body (in the case of a corporate establishment), traceable physical address, full faced passport photograph, telephone numbers, permanent residential address(not P. O. Box), evidence of registration with Corporate Affairs Commission(CAC)(applicable to corporate bodies only) and other forms of identification including international passport, driver’s licence, national identity card, etc.
According to the NCC, this database is to aid law enforcement authorities in fighting the increasing rate of cybercrime committed through cybercafés across the country.

Here is the link to download the discussion. To download; click the "download" icon in green. Listen and let me get your feedback. Thank you.

UPDATE 22 DECEMBER 2020

The above link to the discussion is dead. Here is a new link to the discussion which is divided into parts 1 and 2. Listen to part 1 here and part 2 here

PRIVACY, NIGERIA COMMUNICATIONS COMMISSION AND CYBERCAFES

On the 21^st of October, 2013 Nigeria’s telecommunications regulator; the Nigeria Communications Commission (NCC), issued a public notice via its twitter handle; @NgComCommission, which came into effect on the 1^st of November, 2013 directing all cybercafé licencees and operators in the country to maintain an up to date data base of its subscribers/users detailing information such as; full names, names of corporate body (in the case of a corporate establishment), traceable physical address, full faced passport photograph, telephone numbers, permanent residential address(not P. O. Box), evidence of registration with Corporate Affairs Commission(CAC)(applicable to corporate bodies only) and other forms of identification including international passport, driver’s licence, national identity card, etc.  According to the NCC, this database is to aid law enforcement authorities in fighting the increasing rate of cybercrime committed through cybercafés across the country.

It is not in doubt that cybercrime is rampant in Nigeria. A February 2010 report by the Internet Crime Complaint Centre named Nigeria the top African nation and third in the world (after USA and UK) in its global cybercrime ranking.  It has also been reported that Nigerian consumers lost a total of N1.246 trillion to cybercrime in 2012 and recently the Central Bank of Nigeria (CBN) reported that the Nigerian banking sector lost over 20billion through internet fraud. There is therefore every need to fight this cankerworm called cybercrime in Nigeria.However,the Government (NCC, law enforcement agents, etc.)must ensure that the fight against cybercrime is done within the limits of the law and must avoid infringing;without lawful justification, the constitutional right to privacy of millions of innocent Nigerians who use cyber cafes or do anything that may negatively impact on that right. It is yet to be proven by NCC that most of these crimes are committed using cybercafés. It is even debatable if these internet crimes are perpetrated using cybercafés considering the availability of faster internet on smartphones coupled with cheap internet plans been offered by the GSM service providers(for instance on 31 October 2013, Globacom slashed its blackberry internet subscription (BIS) tariffs by half.The Absolute Month platform which hitherto was N2,800 with 3GB data, now goes for N1, 000 with 3GB data) and the convenience of browsing the internet on smartphones, tablets and personal laptops which are increasingly becoming affordable.

Without conceding that cybercafés are used to commit most of the cybercrimes in Nigeria, let us assume that it is actually the case and NCC rightfully desires to step in to curb this monstrous menace of cybercrime by urging cybercafé lincencees and operators to keep an up to date data base of its subscribers/users (that is assuming the users in the case of non-corporate bodies; submit their actual data and not fictitious data). What then becomes of this huge data base of personal and sensitive information of individuals in the hands of cybercafé operators since there are no data protection laws regulating the use of such data in Nigeria? How long will such data be kept? What remedies are available for any person whose personal information has been misused? The data; for instance, phone numbers could be sold or leaked to companies who could use it to send spam or unsolicited/unwanted text messages(adverts) to people. Someone’s identity could also be stolen and used by criminals for e.g. the name, passport and phone number could be used to fabricate or produce a fake identity card and left at a crime scene. The Police on arrival at the crime scene could pick up the identity card and arrest the person whose name, picture and address appear on the card and interrogate or let’s say torture (because a times that is what their interrogation is all about) the person. In the long run it may be discovered that the identity card was fabricated and the person whose details appear on the card was not actually at the crime scene, however, such person may have suffered bodily injuries (sometimes severe) from the torture by the Police.

These concerns and issues raised above could be addressed to a large extent with a data protection law. In recent times many subscribers of the GSM providers in Nigeria have been flooded with promotional or commercial messages. These messages sometimes are unwanted text messages including commercial messages otherwise known as spam which could be annoying and intrusive. In the United States, two laws– the Telephone Consumer Protection Act (TCPA) and the Controlling the Assault of Non- Solicited Pornography and Marketing (CAN- SPAM) Act – have been enacted to address spam. The TCPA and the Federal Communications Commission’s (FCC) rules ban many text messages sent to a mobile phone using an auto dialer(auto dialer; according to Wikipedia, is an electronic device or software that automatically dials telephone numbers. Once the call has been answered, the auto dialer either plays a recorded message or connects the call to a live person). These texts are banned unless (1) you previously gave consent to receive the message or (2) the message is sent for emergency purposes.In the UK, the Privacy and Electronic Communications Regulations 2003 cover the way organisations send direct marketing by electronic means, including by text message (SMS). Organisations cannot send you marketing text messages you didn’t agree to receive, unless: (a) the sender has obtained your details through a sale or negotiations for a sale; (b) the messages are about similar products or services offered by the sender; and (c) you were given an opportunity to refuse the texts when your details were collected and, if you did not refuse, you were given a simple way to opt out in all the text messages you received.

China too is not left out in the legislative efforts to curb spam and protect personal data thus on October 25, 2013, the Chinese Congress passed an amendment to the Peoples’ Republic of China Law on the Protection of Consumer Rights and Interests (the “Amendment”);to address growing problems related to the misuse of consumers’ personal information in contemporary China.The Amendment establishes strict rules on how business operators should collect and use personal information, and how offenders may be punished. The Amendment emphasizes that the personal information collected by a business operator and its staff must be kept strictly confidential. It also prohibits business operators from leaking, selling or illegally providing such information to others, and requires operators to adopt appropriate technical measures to safeguard the information. At the same time, business operators may not send commercial messages to a consumer unless the consumer has provided consent or requested the information.

Apart from those countries mentioned above, many other countries have a law or laws aimed at protecting personal information or data. In South Africa, the Protection of Personal Information Act has been passed by parliament and is awaiting assent by the President; and in Mauritius the Data Protection Act 2004 (the “MU DPA”) was enacted for the protection of the privacy rights of individuals in response to the developments in the techniques used to capture, transmit, manipulate, record or store data relating to individuals. The MU DPA came into operation in February 2009. Data Protection Regulations were issued in 2009 by the Data Protection Office. It is also responsible for ensuring compliance with the Data Protection Act and bringing enforcement actions.

Furthermore, in the UK they have the Data Protection Act;while in Mexico they have the Federal Data Protection Act. Also, in Japan they have the Personal Data Protection Act while in Canada they have the Personal Information Protection and Electronic Documents Act (PIPEDA).

In the United States they have a host of laws aimed at protecting personal information or data some of which include the Right to Financial Privacy Act of 1978whichrequires a  subpoena  or  search  warrant  for  law  enforcement  officials  to  obtain financial records, the Telephone Consumer Protection Act of 1991whichprovides certain remedies from repeat telephone calls by telemarketers; and the Driver’s Privacy Protection Act of 1994, which restricts the states from disclosing or selling personal information in their motor vehicle records.

It would therefore be of great help if NCC (as a regulator with so much of our data) and other stakeholders could push for data protection laws as is the case in other countries mentioned above.

Moreover, it is even doubtful if this directive by the NCC would be of much assistance in investigating cybercrime cases as by merely maintaining a database of subscribers/users one cannot tell which user browsed the internet for a fraudulent purpose.