Nepal’s Cybercrime and Social Media Laws: Tested Against Real Cases

A post may disappear from your feed in hours. The screenshot and the legal consequences can last much longer.

Somewhere in Nepal, someone is about to publish something they may later regret.

It could be a joke about a minister, an accusation posted without evidence, a private WhatsApp screenshot dropped into a group chat, or a video uploaded before the person in it realizes they were being recorded.

Most posts disappear into the scroll. But sometimes they do not. A screenshot becomes evidence. A private image reaches the police. A fake investment offer spreads to thousands of users. What began with one tap becomes part of a criminal investigation.

That does not mean most online speech is illegal. Nepalis are free to express opinions, criticize public officials, report wrongdoing, create satire, and participate in political debate.

The harder question is where criticism ends, and crimes such as defamation, fraud, intimidation, unauthorized access, or invasion of privacy begin.

That question became impossible to ignore in September 2025, when Nepal blocked 26 social media platforms after major companies failed to meet government registration requirements. The ban did not create the public anger on its own. It became a flashpoint for deeper frustration over corruption, political privilege, and growing distrust of the government. Protests soon spread, followed by a deadly crackdown, the lifting of the ban, and the resignation of former Prime Minister KP Sharma Oli. 

But platform bans and political speech are only one part of the story. Nepal’s cyber laws are used every year in cases involving hacked accounts, financial scams, threats, fake identities, intimate images, privacy violations, and online accusations.

The Law Behind Many Online Cases

The Electronic Transactions Act, 2063, or ETA, was originally introduced to recognize electronic records, digital signatures, and online transactions.

Today, its most debated provision is Section 47.

Section 47 prohibits publishing electronic material that is illegal under another law, contrary to public morality or decent behavior, likely to spread hatred, or capable of damaging harmony between communities. A violation can carry up to five years in prison, a fine of up to Rs. 1,00,000, or both.

The problem is its broad wording. Expressions such as “public morality” and “decent behavior” do not give social media users a clear test for what is illegal. The provision has therefore been used not only against obscene or harmful content but also in cases involving criticism, journalism, satire, and online allegations.

An analysis of more than 700 ETA cases decided by Kathmandu District Court over a decade identified 70 involving journalism or freedom of expression. In 64 percent of those cases, defendants were initially arrested.

A 2024 review by the Office of the Attorney General also described Section 47 as unclear, ambiguous, and contradictory and recommended reform.

Still, the provision remains valid. In a ruling released in February 2025, Nepal’s Supreme Court rejected a challenge seeking to strike it down. The Court said freedom of expression is a fundamental right, but it is not absolute. The state may impose reasonable restrictions involving defamation, public morality, communal harmony, and incitement.

The debate, therefore, is not simply about whether Nepal may regulate online activity. It is about whether the current law defines prohibited conduct clearly enough.

Hacking, Unauthorized Access, and Digital Fraud

Not every cybercrime case involves speech.

Section 45 of the ETA deals with unauthorized access to computers, programs, information, or data. It can apply when someone breaks into an account, accesses protected files, or exceeds the permission they were given.

The maximum punishment is three years in prison, a fine of up to Rs. 2,00,000, or both.

Section 52 addresses computer fraud. It covers obtaining financial benefits through fraudulent use of computers, electronic records, digital signatures, bank accounts, ATM cards, and similar systems.

The offense carries up to two years in prison, a fine of up to Rs. 1,00,000, or both. The law also allows authorities to recover the financial benefit obtained through the crime.

These provisions cover what many people traditionally imagine as cybercrime: account hacking, digital forgery, unauthorized access, and computer-enabled financial theft.

When a Post Becomes Defamation

Nepal’s National Penal Code, 2074, separately deals with damage to reputation.

Section 305 concerns slander, while Section 306 defines libel. Libel generally involves making or publishing an allegation, through words, signs, images, or other forms, with the intention of harming or knowing that it may harm another person’s reputation.

For social media users, libel is usually more relevant because posts, comments, videos, and captions leave a record that can be copied and shared.

Under Section 307, libel can carry up to two years in prison or a fine of up to Rs. 20,000, or both. If it is committed through electronic or mass media, an additional sentence of up to one year may apply. A court may also order compensation and legal costs.

But not every damaging statement is defamation.

The Penal Code protects truthful statements made for the public good, good-faith criticism of a public official’s conduct, fair opinions on public issues, reviews of work presented to the public, and substantially accurate reporting of court proceedings.

Those protections are essential for journalists, activists, reviewers, and ordinary citizens. Public accountability would be impossible if every uncomfortable statement about a powerful person automatically became a crime.

However, truth, public interest, evidence, and good faith matter. A person publishing a serious allegation should be able to explain how it was verified and why releasing it served the public.

Privacy Does Not Disappear Online

The Privacy Act, 2075, protects personal documents, communications, health information, family matters, correspondence, residence, property, and personal data.

This means a privacy violation does not always require hacking.

Someone may receive a photograph, conversation, medical document, or voice recording legally and still create a legal problem by sharing it without consent.

A private screenshot does not automatically become public property simply because someone has a copy.

The legal risk depends on what was shared, how it was obtained, whether the person consented, why it was published, and whether there was a genuine public-interest reason.

This matters especially for journalists. “Someone sent us the screenshot” is not enough. Newsrooms must still verify the material, assess the harm, and decide whether identifying details are necessary.

The Social Media Bill That Never Became Law

In February 2025, the Oli government introduced a Social Media Bill intended to create more specific rules for online platforms and users.

The bill proposed up to five years in prison for spreading misleading information through a fake identity. Online harassment, threats, humiliation, or imitation of another person’s voice could have carried up to two years.

Hacking a social media account could have resulted in up to three years in prison. Creating or spreading an AI-generated deepfake could have carried up to two years. Platforms that failed to meet government conditions faced fines of up to Rs. 1 crore.

Critics argued that the bill contained vague definitions, excessive punishments, and provisions that could restrict journalism and political criticism.

It never became law. In February 2026, the interim government led by Sushila Karki moved to withdraw it.

Nepal therefore continues to rely on several existing laws rather than one comprehensive social media statute. Conduct involving deepfakes, impersonation, or fake profiles may still fall under fraud, privacy, forgery, defamation, harassment, or ETA provisions, depending on the facts.

How to File a Cybercrime Complaint

Nepal Police’s Cyber Bureau accepts complaints involving hacked or fake accounts, online financial fraud, unauthorized access, intimate material, and other cyber-related offenses.

A complaint can be submitted at a nearby police office or directly at the Cyber Bureau in Bhotahiti, Kathmandu. People unable to appear personally may submit the required information and documents by email.

The Bureau asks complainants to provide identification, relevant links, and clear screenshots.

Useful evidence may include:

• Original account, profile, or post links

• Screenshots showing usernames and timestamps

• Bank or digital-wallet transaction records

• Phone numbers, email addresses, and account handles

• Payment receipts

• A clear timeline of what happened

Screenshots should remain unedited whenever possible. Cropping out usernames, timestamps, or links may make the material harder to verify.

There is no fixed period for every investigation. The process may take longer when police must trace transactions, obtain platform information, examine devices, locate suspects, or conduct digital forensic analysis.

The Rights of an Accused Person

Being accused of cybercrime does not remove constitutional protections.

A person who is arrested has the right to know the reason for the arrest and to consult a lawyer from the moment of arrest. They must generally be presented before a judicial authority within 24 hours, excluding necessary travel time.

The accused also has the right against forced self-incrimination, the presumption of innocence, access to legal representation, and the right to seek review or appeal according to law.

These rights do not prove innocence or guilt. They determine how the government must conduct an investigation and prosecution.

Case One: The 2025 Platform Ban

On September 4, 2025, Nepal blocked 26 platforms, including Facebook, Instagram, WhatsApp, YouTube, X, and LinkedIn, after they failed to complete government registration requirements.

The government presented the decision as an enforcement measure intended to improve platform accountability. Critics described it as a sweeping restriction affecting communication, journalism, businesses, and political expression.

The ban arrived when public anger over corruption and political privilege was already growing online. A campaign highlighting the lifestyles of politicians’ children had been spreading across the same platforms the government switched off.

On September 8, young protesters gathered in Kathmandu and other cities. Nineteen demonstrators were killed during the first day of the crackdown. More violence and deaths followed. The government lifted the platform restriction, and Prime Minister Oli resigned on September 9.

The episode revealed the difficult balance between platform accountability and freedom of expression. Governments have a legitimate interest in addressing fraud, abuse, incitement, and misinformation. But blocking platforms used by millions can also affect constitutional rights, emergency communication, commerce, and public debate.

Case Two: A Scam That Reached Thousands

In January 2026, police announced the arrest of 11 people, including a Chinese national, in connection with an alleged online investment scheme operated through the SMC mobile application.

Investigators said the operation attracted users with promises of earnings and investment returns. The Cyber Bureau received 255 complaints and identified reported losses of approximately Rs. 12.08 crore. More than 70,000 people were reportedly affected.

The case shows that cybercrime enforcement is not mainly about political posts. Much of it involves ordinary people trying to recover money lost through fake platforms, deceptive advertisements, and digital payment schemes.

Because the suspects had not necessarily been convicted at the time of the reports, they should be described as accused or arrested, and not guilty.

Case Three: Fraudsters Posing as Police

In another case, police arrested four people in Dharan for allegedly impersonating Cyber Bureau officials.

The suspects reportedly contacted people who had already lost money through Telegram scams and promised to recover the stolen funds in exchange for another payment.

The scheme was effective because it borrowed the credibility of the agency responsible for investigating online fraud.

The warning is simple: anyone claiming to represent the Cyber Bureau should be verified through official police contacts. Victims should never provide passwords, one-time codes, banking details, or additional payments simply because a caller claims to be a government official.

Where Does Criticism End and Crime Begin?

Nepalis are legally allowed to criticize the prime minister, ministers, police, political parties, and government policies.

A statement such as “This policy is harmful and dishonest” is clearly a political opinion.

A statement such as “This minister stole Rs. 10 crore” is a factual allegation. Publishing it responsibly requires evidence.

Satire and memes are not automatically illegal. The legal risk increases when they contain fabricated factual claims, threats, private material, hate speech, impersonation, or manipulated content presented as genuine.

Journalists may publish leaked information when there is a legitimate public interest. But they must still consider authenticity, privacy, possible harm, source protection, and whether every private detail needs to be published.

The difficulty is that protection from eventual conviction does not always prevent a complaint, arrest, legal expense, or time in custody. That is one reason Section 47 remains deeply controversial.

Before You Post

Most social media activity is lawful. People can criticize, debate, joke, review public work, and share their experiences.

But before publishing something that could seriously affect another person, ask:

Is it true, and can I support it with evidence?

Am I exposing private information without consent?

Could the message reasonably be understood as a threat?

Am I sharing manipulated content without checking it?

Am I using someone else’s identity to deceive people?

Am I making a serious allegation look like an established fact?

Deleting a post does not guarantee it has disappeared. Someone may already have taken a screenshot, recorded the screen, downloaded the file, or forwarded it.

A Law Built for an Older Internet

Nepal’s Electronic Transactions Act was written to regulate electronic records, digital signatures, and online transactions. Two decades later, one broad section of that law has become central to how the country regulates online speech.

Some cybercrime cases involve obvious harm: fraud, hacking, coercion, exploitation, and financial theft. Others expose a difficult boundary between protecting people and restricting lawful expression.

Nepal does not need to choose between an internet with no accountability and one governed by unclear criminal provisions. It needs modern laws that clearly define illegal conduct, punish serious harm proportionately, protect due process, and leave space for journalism, satire, political criticism, and ordinary disagreement.

Until then, the safest rule is simple: verify serious claims, respect privacy, do not threaten or deceive people, and remember that a post meant to last a few minutes can remain as evidence for years. 

Sources

 Government of Nepal. The Electronic Transactions Act, 2063 (2006). Act No. 27 of 2063. Kathmandu: Nepal Law Commission.

Government of Nepal. The National Penal Code, 2074 (2017). Kathmandu: Nepal Law Commission.

The Himalayan Times. "Cyber Bureau busts major online scam targeting over 70,000 users." January 6, 2026.

Kathmandu Post. "19 dead in Gen Z protests across Nepal." September 8, 2025. 

Human Rights Watch. "Nepal: Police Fire on 'Gen Z' Protest." September 9, 2025. 

Amnesty International. "Nepal: Widespread failings responsible for excessive use of force and unlawful killings in 'Gen-Z' protests." December 2025..

TIME. "What to Know About Nepal's Deadly 'Gen Z' Protests." 

Kathmandu Post. "Government moves to withdraw Social Media Bill." February 7, 2026. 

Kathmandu Post. "Government can enforce law to regulate free speech, top court rules." February 19, 2025. 

Kathmandu Post. "Nepal's electronic transactions law continues to be misused to stifle free speech." April 29, 2026. 

The Himalayan Times. "Cyber Bureau busts major online scam targeting over 70,000 users." January 6, 2026. 

Kathmandu Post. "19 dead in Gen Z protests across Nepal." September 8, 2025. 

Human Rights Watch. "Nepal: Police Fire on 'Gen Z' Protest." September 9, 2025. 

Amnesty International. "Nepal: Widespread failings responsible for excessive use of force and unlawful killings in 'Gen-Z' protests." December 2025..

TIME. "What to Know About Nepal's Deadly 'Gen Z' Protests." 

Kathmandu Post. "Government moves to withdraw Social Media Bill." February 7, 2026. 

Kathmandu Post. "Government can enforce law to regulate free speech, top court rules." February 19, 2025. 

Kathmandu Post. "Nepal's electronic transactions law continues to be misused to stifle free speech." April 29, 2026. 

The Himalayan Times. "Cyber Bureau busts major online scam targeting over 70,000 users." January 6, 2026.