A single post on X has reignited a debate over whether lending your internet connection could land you in legal trouble in Nigeria. "It's TODAY, I found out that sharing hotspot can implicate you in a crime," a user known as Talk2veee wrote in a post on X on 25 August, adding that if you share your hotspot with a random person, "it's your IP address and everything that will pop up if they are being tracked."

The claim drew a divided response. Replying to the post, Sam Ivere agreed that users of a shared hotspot can be traced back to the host's IP address, warning that "police/the network may come to your number first," even though the host is not automatically guilty. John Obiefuna pushed back on part of the framing, noting that Carrier-Grade Network Address Translation (NAT), used by most Nigerian telcos, already means several subscribers can share the same IP address simultaneously — hotspot sharing or not — and that it is the shared public IP at stake, not a personal one.

The stakes are practical rather than abstract for many Nigerians: fixed-line broadband penetration remains low, most people reach the internet over mobile data, and lending a hotspot to a friend, colleague or stranger is routine — even as EFCC prosecutions of internet fraud keep cybercrime in the headlines.

With opinions split, Technext put the question to two telecom engineers and a digital rights lawyer to separate the myth from the mechanics.

How hotspot sharing actually works

Every device connected to the internet needs an IP address — a kind of digital house address that tells data where to go and where to return. According to telecommunications engineer Chukwuka Chijioke Jerry, a device that connects to your hotspot is normally assigned its own private IP address by your phone, for instance an address like 192.168.x.x. Your phone then acts as a router, using a process called Network Address Translation (NAT) to forward that device's traffic through its own cellular connection.

From the perspective of any website the connected device visits, the traffic appears to come from your phone's public-facing IP address, not the guest's private one.

Arinzechukwu Miracle Okoli, an electrical/electronic engineering graduate specialising in wireless, RF/microwave and telecom engineering, explains the concept with a building analogy. Your public IP address is like a building's street address — the one visible to the outside world. Each device inside your home or hotspot, whether your phone, laptop, or a friend's phone connected to your hotspot, gets its own private IP address, like an internal flat number that only makes sense inside the building.

Your phone acts as the building's doorman: when a connected device sends a request to a website, the doorman relabels it with the public address before sending it out, then delivers the reply to the correct "flat" when it comes back. From the outside, every device sharing your hotspot looks identical — they all appear to be browsing from you.

It gets more complicated from there. Both engineers confirmed that Nigerian mobile networks, including MTN and Airtel, use Carrier-Grade NAT (CGNAT) to conserve a limited pool of public IP addresses. CGNAT works the same doorman trick, but at the telco's level: instead of one router sharing an address among your own devices, the network operator shares a single public IP address among many unrelated subscribers at once.

Chukwuka noted that exact sharing ratios are not publicly disclosed and vary by operator, network load and configuration, but the underlying point is consistent: a public IP address linked to your phone at any given moment may already be shared with other subscribers before anyone even connects to your hotspot.

Why a public IP address alone proves little

Both engineers agreed on the key point: a public IP address alone cannot pin down one subscriber, let alone one person. Investigators typically need extra details, such as the exact timestamp and the "port number" — a technical marker attached to each connection that helps distinguish one session from another on a shared address — to narrow a public IP down to a single account. Such narrowing depends on telco record-keeping: under Section 38 of the Cybercrimes (Prohibition, Prevention, etc.) Act 2015, Nigerian service providers are required to retain traffic data and subscriber information for two years — the trail investigators follow when matching an address, timestamp and port back to an account. Even then, that identifies the account, not necessarily the person who was using a device at the time.

Chukwuka and Okoli both noted that telcos generally cannot see which specific device is connected to a customer's personal hotspot; that information, if it exists at all, is stored on the host's phone, not in the network operator's systems.

What the law says

The technical picture is only half the story. Muhammed Bello Buhari, founder of Internet for Rights and NAFASI Project Officer at Magamba Network, said Nigerian law enforcement agencies, including the Economic and Financial Crimes Commission (EFCC) and the police cybercrime unit, can and do question account holders once an investigation traces back to their SIM or internet subscription — even if they had nothing to do with the offence. That identifiability is itself underpinned by Nigeria's SIM registration regime: under Nigerian Communications Commission (NCC) rules, SIM cards must be registered before activation and have since been linked to subscribers' National Identity Numbers (NIN), tying each mobile subscription to a verified identity.

However, the law does not automatically transfer guilt to the account holder. "Nigerian criminal jurisprudence does not recognise vicarious or automatic criminal liability for simply owning an internet subscription," Buhari said, pointing to the constitutional presumption of innocence under Section 36(5). To secure a conviction, prosecutors must prove both the physical act and criminal intent, typically by matching device forensics, login records and other digital footprints to a specific individual, in line with the certification requirements for computer-generated evidence under Section 84 of the Evidence Act.

Buhari also pointed to a related, everyday risk: buying second-hand phones, laptops or routers from unverified vendors. Devices carry hardware identifiers, such as an IMEI number — a unique serial number for each phone, used to identify it on mobile networks — which can remain flagged in security databases if the device was previously stolen or used in fraud. Buhari said unsuspecting buyers who insert their own SIM card or connect such a device to their home network can find themselves questioned by investigators until they can prove, often through receipts or a bill of sale, that they acquired the device legitimately and after the fact.

In practice, Buhari said, being the registered account holder may make you one of the first people investigators contact, even though that does not by itself establish responsibility for the offence.

The bottom line

Sharing your hotspot does not automatically make you legally responsible for what someone else does with it. But it can make you the first person law enforcement questions — and clearing your name can take time. The episode is also a reminder that digital identifiers — IP addresses, port logs, IMEIs — are investigative starting points rather than proof of guilt, and connecting them to a specific person is what prosecutors must still prove. Both engineers and the lawyer advised limiting hotspot access to people you trust, using strong passwords, and disconnecting devices once they are no longer needed.

Source: TechNext24