State Police Bill Passes at Senate: Governors Get Officers, But Cybercrime Stays in Abuja’s Hands

When the Nigerian Senate passed the Constitution Alteration Bill decentralising policing on Wednesday, most of the country’s attention landed on the political drama, the manual voting process, the governors watching from the gallery, the decades-long debate finally reaching a legislative resolution.

The technology and digital economy sector largely watched from the margins.

It should not have.

Buried inside the State Police bill’s delineation of responsibilities between federal and state police formations is a provision with direct implications for how Nigeria investigates, prosecutes, and ultimately deters digital crime: cybercrime, alongside counter-terrorism, organised crime, border security, and arms trafficking, has been explicitly designated as a federal police responsibility.

That single jurisdictional assignment, easy to miss in the broader political spectacle, defines the architecture within which Nigeria’s digital economy will be policed for the foreseeable future. And it raises questions that the bill’s passage has not yet answered.

What the bill actually creates

The legislation establishes a dual policing structure in which state-controlled police services would operate concurrently with the existing Nigeria Police Force.

Under Clause 17 of the proposed constitutional amendment, each State Police Service shall be headed by a Commissioner of Police appointed by the governor and confirmed by the state legislature, while the Federal Police Service continues to be headed by the Inspector-General of Police.

State police would handle the enforcement of state laws, maintenance of public order, prevention and detection of local crimes, and the protection of lives and property within their jurisdictions.

Federal police retain responsibility for protecting federal institutions, counter-terrorism, organised crime, cybercrime, border security, arms trafficking, and interstate criminal activities.

The logic is defensible: cybercrime by its nature crosses state and national boundaries, making it a poor fit for jurisdiction-specific enforcement.

A Lagos-based fraudster targeting victims in Kano, Abuja, and Port Harcourt simultaneously, a pattern documented repeatedly in Nigeria’s digital fraud landscape, is precisely the category of crime that requires coordination above the state level.

But the existing federal architecture for handling that crime has not distinguished itself.

The enforcement gap the bill does not fix

Nigeria loses an estimated $500 million annually to cybercrime, according to figures cited by the Nigeria Cybercrime Working Group.

The DAWN Commission’s Director-General estimated that the new structure would add approximately 180,000 officers to Nigeria’s total policing capacity if each of the 36 states recruited an average of 5,000 officers, a significant expansion of overall law enforcement presence.

But cybercrime prosecution will not benefit from that headcount. It stays within a federal system that has historically been under-resourced for the specific demands of digital crime investigation.

The Nigeria Police Force’s cybercrime unit, the Cybercrime Section of the Force Criminal Investigation Department, operates with investigative tools and technical capacity that security researchers and industry insiders have described as significantly behind the sophistication of the crimes it is asked to prosecute.

EFCC and NITDA carry parallel mandates in adjacent areas, but jurisdictional overlaps between agencies have historically produced coordination gaps rather than coordinated enforcement.

The bill creates no new federal cybercrime enforcement body. It simply confirms that whatever currently exists at the federal level retains exclusive authority over digital crime, in a country where fintech transactions now exceed ₦600 trillion annually and where, by the CBN’s own PSV 2028 targets, digital payment volumes are set to grow substantially over the next three years.

The fraud and trust architecture question

For Nigeria’s fintech sector and the broader payments ecosystem, the cybercrime jurisdiction question is not abstract. It is operational.

The CBN’s Payments System Vision 2028, launched just weeks ago, sets a target of reducing electronic fraud losses to below 0.001 per cent of total transactions by 2028, a target that depends on a combination of AI-driven detection, NIN and BVN identity integration, and, critically, credible law enforcement deterrence.

A fraudster who calculates that prosecution is unlikely will not be deterred by NIN verification alone.

The bill does provide that federal police intervention in any state requires written authorisation from the President and remains subject to Senate oversight and judicial review.

Those accountability mechanisms are significant for the political abuse concerns that have dominated discussion of the bill. But they also mean that cybercrime enforcement, already operating within a complex multi-agency landscape, now sits inside a federal structure whose relationship with newly empowered state formations will need to be negotiated in real time.

The scenarios are not hypothetical. When a payment platform based in Lagos is defrauded through a scheme coordinated from Kano using infrastructure hosted in a third state, which formation investigates?

When a state police commissioner receives a complaint about a local digital fraud that connects to an interstate criminal network, what is the handoff protocol to federal cybercrime units?

The bill assigns jurisdiction clearly at the top level. The operational mechanics one layer below that assignment remain unwritten.

The safeguard that matters most for digital businesses

Among the anti-abuse provisions inserted by senators, one carries particular relevance for the technology and business community: a state Commissioner of Police shall not arrest, detain, investigate, or deploy force against any person, political party, or group merely for criticising the government, except in accordance with the law.

For Nigeria’s technology media, startup ecosystem, and digital civil society, this provision is consequential. Online criticism, investigative journalism published through digital channels, and social media commentary have historically been among the activities most vulnerable to politically motivated law enforcement action.

A constitutional prohibition, however dependent on enforcement for its actual value, establishes a baseline that did not previously exist in the state policing context.

The National Assembly would also retain powers to prescribe minimum national standards relating to recruitment, training, vetting, promotion, discipline, use of force, complaints procedures, accountability mechanisms, and data management for state police services.

The data management standard, in particular, is worth watching: how state police formations collect, store, and share personal data collected in the course of investigations has direct implications for the privacy rights of digital economy participants, individuals and businesses alike.

What comes next, and why it matters

The bill now moves to the 36 state Houses of Assembly, where at least 24 must endorse it before it can proceed to President Bola Tinubu for assent. That threshold is achievable but not guaranteed, and the consultation process that follows in state capitals will determine both the speed and the final shape of implementation.

For the digital economy sector, the more pressing question is what happens in the implementation design phase after those approvals are secured.

The bill establishes the constitutional framework. Everything operationally significant, inter-agency coordination protocols, data sharing standards between federal and state formations, the precise scope of federal cybercrime authority, and the resourcing model for federal digital crime enforcement, will be determined in subsidiary legislation, executive directives, and institutional design decisions that follow passage.

Nigeria’s digital economy is processing transactions at a scale and pace that its law enforcement architecture has not kept up with. The state police bill does not change that gap. What it does is restructure the institutional landscape within which that gap must eventually be closed, and lock in, at the constitutional level, that closing it remains a federal responsibility.

Whether the federal apparatus rises to that responsibility is the question the bill cannot answer. That answer will be written in the years ahead, in the fraud statistics, the prosecution rates, and ultimately in the confidence, or lack of it, that Nigeria’s digital economy participants place in the system designed to protect them.