Internet freedom, freedom of expression and privacy in South Africa

Jane DuncanHighway Africa Chair of Media and Information SocietySchool of Journalism and Media StudiesRhodes University29 November 2013

“Everyone has the right to freedom of expression, which includes freedom of the press and other media; freedom to receive or impart information or ideas; freedom of artistic creativity; and academic freedom and freedom of scientific research.”“The right in subsection (1) does not extend to propaganda for war; incitement of imminent violence; or advocacy of hatred that is based on race, ethnicity, gender or religion, and that constitutes incitement to cause harm.”

“Everyone has the right to privacy, which includes the right not to have their person or home searched; their property searched; their possessions seized; or the privacy of their communications infringed.”

1992 – Interception and Monitoring Prohibition Act2003 – Regulation of Interception of Communications Act (RICA)

Purpose of Act – to regulate the interception of certain communicationsTo prevent the unauthorised interception of communications

Main features of RICA

• Prohibits interception of communications;

• Law enforcement officers may intercept communications, providing they have an interception direction authorising them to do so;

• Directions to be issued by a designated judge;

• Allows for interception directions to be issued in retrospect in the case of emergencies;

• Real-time directions to be obtained from designated judge, archive-related information from High Court judge or Magistrate;

• Prohibits the provision of telecommunications service that doesn’t have the capability to be intercepted, or to store communications related information;

• Establishes the Office for Interception Centres, to undertake RICA-related surveillance;

• Establishes the Internet Service Providers Assistance Fund to enable ISP’s to meet the requirements of the Act;

• Requires cellphone users to register their SIM cards, and SIM card vendors to ensure registration.

RICA issues – interception directions

Low level of proof required for interception direction

Judge needs only to be satisfied that there are reasonable grounds to believe that a serious office has been or is being or probably will be committed

Privacy International has argued for probable cause or a similar higher level of finding

RICA issues – interception subjects never informed

RICA forbids disclosure of information about its application.

In the US system on criminal matters, in order to protect the rights of the people under surveillance in criminal matters, within 90 days of the termination of the court order the judge must ensure that the person whose communications were intercepted is informed about the order.

International Principles on the Application of Human Rights to Communications Surveillance

User notification

“Individuals should be notified of a decision authorising communications surveillance with enough time and information to enable them to appeal the decision, and should have access to the materials presented in support of the application for authorisation”

Delays justified if purpose of surveillance will be seriously jeopardised, judge allows this, and user is notified as soon as possible afterwards.

Cops admit Mzilikazi wa Afrika arrest was wrongful18 November, 2012 11:51

RICA issues – foreign signals intelligence not covered by the Act

Foreign signals intelligence surveillance undertaken by the National Communications Centre, which also houses bulk monitoring capacity.

Mail and Guardian: ‘…this means that you can be bugged completely outside of the law, and without a judge’s direction, if your communication involves a party in another country’.

A 2008 Ministerial Review Commission into the intelligence services found the unregulated interception of foreign signals intelligence to be unconstitutional, and recommended that the activities of the National Communications Centre (NCC) should be covered by RICA.

Misuse of signals intelligence capacity – the example of Project Avani

South African definition of nationals security is broad:

“National security must reflect the resolve of South Africans, as individuals and as a nation, to live as equals, to live in peace and harmony, to be free from fear and want and to seek a better life”

Risk over-broad mandate for security services.

Political intelligence gathering – eg. Project Avani. Surveillance capacity mis-used to advantage factions in the presidential succession battle between Jacob Zuma and Thabo Mbeki. The bulk scanning facilities at the NCC were used to keep at least thirteen South African politicians, businessmen and officials in the public service under surveillance under the auspices of Project Avani

RICA issues – lack of information about monitoring and surveillance

No information on the following:• Number of interceptions that resulted in arrests and

convictions• Number of arrests and convictions resulting from sim

card registrations• Average costs per order• The types of surveillance used• No Joint Standing Committee on Intelligence reports for

2010 onwards

RequestingAgency 

ApprovedRequests 

DeclinedRequests 

Total Percentage declined

SAPS CI 84 14 98 14.29%NIA 63 7 70 10%DSO 13 1 14 7.69%SASS 6 1 7 16.67%

RequestingAgency 

ApprovedRequests 

DeclinedRequests 

Total Percentage declined

SAPS CI 300 25 325 7.69%NIA 82 9 91 9.89%NPA 2 0 2 0%SASS 1 0 1 0%

Table 1: Number of interception directions – 1 May 2008 to 31 March 2009 (Source: Joint Standing Committee on Intelligence)

Table 2: Number of interception directions – 1 April 2009 to 31 March 2010 (Source: Joint Standing Committee on Intelligence)

 

Promotion of Access to Information Act request on RICA

TRANSPARENCY:States should be transparent about the use and scope of communications surveillance techniques and powers. They should publish, at a minimum, aggregate information on the number of requests approved and rejected, a disaggregation of the requests by service provider and by investigation type and purpose. States should provide individuals with sufficient information to enable them to fully comprehend the scope, nature and application of the laws permitting communications surveillance. States should enable service providers to publish the procedures they apply when dealing with State communications surveillance, adhere to those procedures, and publish records of State communications surveillance (International Principles on the Application of Human Rights to Communications Surveillance)

RICA issues – requires all communications networks to be capable of surveillance

“INTEGRITY OF COMMUNICATIONS AND SYSTEMS:

In order to ensure the integrity, security and privacy of communications systems, and in recognition of the fact that compromising security for State purposes almost always compromises security more generally, States should not compel service providers or hardware or software vendors to build surveillance or monitoring capability into their systems, or to collect or retain particular information purely for State surveillance purposes.” (International Principles on the Application of Human Rights to Communications Surveillance)

Vulnerabilities in South Africa’s communications networks

South Africa uses Calea (Communication Assistance for Law Enforcement Act) and ETSI (European Telecommunications Standards Institute) handover interface standards.

In the wake of widespread violations of internet freedom in the Middle East and North Africa, ‘…Particularly the standards developed by the European Telecommunications Standards Institute (ETSI) on the Handover interface for the lawful interception of telecommunications traffic (TS 101 671 & ES 201 671) and on Requirements of Law Enforcement Agencies (TS 101 331) would need to be reconsidered’ (Directorate-general for External Policies, European Parliament)

Source: Department of Communications, Directives in terms of different categories of telecommunications service providers made in terms of the Regulation of Interception of Communications and Provision of Communications-Related Information Act, Notice 1325 of 2005.

RICA issues – SIM card registration

“INTEGRITY OF COMMUNICATIONS AND SYSTEMS:

A priori data retention or collection should never be required of service providers. Individuals have the right to express themselves anonymously; States should therefore refrain from compelling the identification of users as a precondition for service provision.” (International Principles on the Application of Human Rights to Communications Surveillance)

South Africa’s role in global surveillance industry

• Wikileaks leaked information about two SA companiesinvolved in development of mass surveillance technology – Vastech and Seartech

• Vastech’s Zebra Strategic Network Monitoring system allows for ‘massive passive solutions for law enforcement’

• Vastech equipment uncovered in listening rooms in Libya and Egypt.

Securitisation of the internet in South Africa

• Cyber-security policy framework still being completed

• Transferred from Dept of Communication to State Security – implications?

• Main cyber-security threats in South Africa are fraud-related, with phishing being the most common form of attack by far. In fact, South Africa is one of the top three countries targeted for phishing attacks, alongside the US and UK

• Information security vs. national security policy?

Other internet freedom issues – the role of the Film and Publications Board

Board set up in 1996 as classification Board1996 - publication was defined as printed or duplicated matter, pictures and sculptures, recordings for reproduction (with the exception of a film soundtrack), and computer software.1999 – internet brought under jurisdiction of Board. Definition of publication broadened to include ‘…any message or communication, including a visual presentation, placed on any distributed network including, but not confined to, the internet’. Right of ISP’s to self-police through notice and takedown procedure also recognised, in return for ‘safe harbour’ from liability for unlawful content1999 – amendments reducing independence of the Board, making it account to Dept of Home Affairs2009 – amendments introducting pre-publication classification. Most struck down as unconstitutional, with the exception of hate speech, which is over-broad

From classification to censorship

2012 – Board banned a painting of President Zuma with his genitals showing, for children under 16, including online versions of the painting.

According to the Board, ‘younger people and sensitive people may find the themes [in the exhibition] complex and troubling’

Board’s appeal structure, the Appeal Tribunal overturned the ban, claiming that the Board had exceeded its authority in classifying the painting and its online reproductions