The effects of stakeholder perceptions on the outcomes of the computer crime and cybersecurity bill:  a case of Lesotho

Mohale, Khotso Clement

The effects of stakeholder perceptions on the outcomes of the computer crime and cybersecurity bill: a case of Lesotho

Thesis / Dissertation

2025

Publisher

University of Cape Town

Department

Department of Information Systems

Faculty

Faculty of Commerce

Abstract

Problem Statement: Cybersecurity legislation formulation is an agenda item for many governments due to data privacy, cyberbullying, financial fraud, and other cybercrimes. This initiative must account for the stakeholders' understanding of cybersecurity to be effective. Without the stakeholders' understanding of cybersecurity, cybersecurity control initiatives such as legislation and policies may not be able to effect the required behaviour changes. Very little is known about stakeholders' perception of cybersecurity and their impact on cybersecurity controls. Purpose of the research: This study aims to determine how stakeholders' perceptions about cybersecurity affect the outcomes of the Computer Crime and Cybersecurity Bill. Design/methodology: The study used qualitative methods and was based on the case study; purposive snowballing was used to identify 17 participants for the study. The data was gathered through semi-structured interviews and document analysis of the Bill and the SADC Model Law Documents. The study used an inductive approach, and thematic analysis was used to analyse the data to achieve the research objectives. Findings: The findings indicated that stakeholders' perceptions had minimal effect on the outcomes of the Computer Crime and Cybersecurity Bill. The Bill was drafted from the SADC Model Law on cybersecurity, and the outcome of the Bill seems to have been primarily shaped by the model law. It was also determined that there was minimal contextualisation and customisation done on the Bill. Contributions of the study: The study contributes to the gap in research in terms of investigating the effect of stakeholder perceptions on the development of legislation. In addition, the study contributes new knowledge by providing insights into the source of cybersecurity stakeholders' perceptions. The knowledge may be used to support future studies in humanistic cybersecurity control initiatives. The study may inform stakeholder engagements to assist in accommodating stakeholders' perceptions and inclusion of local expectations in cybersecurity control initiatives. The findings in the study may also guide countries that are in the process of harmonising and transposing cybersecurity legislation to improve their stakeholder expectations in the process.