Internet Service Providers' Association

Advisory 2: The surveillance of electronic communications: Monitoring and interception laws in South Africa

Release date: 24 February 2000
Author: Tracy Cohen

Relevance

In 1998, the South African Law Commission (SALC) began a project to review the existing law on the monitoring and interception of communication and make a number of recommendations for its reform. (Discussion Paper 78, Project 105, November 1998) What follows is an outline of the existing 1992 Act and a summary of the SALC's proposals for a Bill to reform the existing law. The implications for ISPs are highlighted.

Introduction

The surveillance of electronic communications (including correspondence) colloquially referred to as 'wiretapping', is conducted in nearly every country in the world by governments and private groups, for a range of reasons. The most renowned target of the wiretap is the standard fixed-line telephone system but surveillance extends to newer technologies and applications. ¹

The law governing legal surveillance in South Africa is called the Interception and Monitoring Prohibition Act No. 127 of 1992. ("The Act") This Act focuses primarily on telephonic communications, but also provides for the interception and monitoring of postal communications. A telecommunication line is defined as "any apparatus, instrument, pole, mast, wire, pipe, pneumatic or other tube, thing or means which is or may be used for or in connection with the sending, conveying, transmitting or receiving of signs, signals, sounds, communications or other information.

Privacy Rights

It should be noted that the right to privacy of communications is a fundamental right, protected in section 14 of the Constitution.² This includes the right to be free from intrusions and interference by the state and individuals. The Constitution explicitly states that the right includes not having " the privacy of communications infringed." (See Below under implications for ISPs)

It is universally accepted however, that that no right is absolute in operation and as long as reasonable grounds exist to limit that right, and that the law is of general application to all citizens, this limitation may be constitutionally acceptable. The Interception and Monitoring Prohibition Act, is of general application, which provides for the limitation of the above right in certain circumstances. There is an existing body of South African case law on the issue of privacy rights and surveillance. How the courts have sought to deal with the issue has depended on the facts of the case, whether it was an intrusion of the right between private parties or whether the intrusion was as between state and an individual. Despite factual differences, two recurring, broad issues generally tend to be raised for consideration, namely, whether the alleged monitoring of communications constitutes a breach of the right to privacy? And whether or not how that evidence was obtained affects its admissibility? The fact that surveillance laws may have a pressing state interest as their primary motivation, and the fact that no right is absolute in operation, does not however mean that surveillance laws can be passed without having regard to the Constitution.

The Interception and Monitoring Prohibition Act, No. 127 of 1992

The Act came into effect in February 1993, prior to the enactment of the Interim Constitution (1993). The stated purpose of the Act is both to prohibit the interception and monitoring of certain communications, and to provide for authorisation to do so in certain circumstances.

The Act prohibits any person from:

1. intentionally intercepting a communication which has, or is being transmitted by telephone or in any other manner over a telephone line; and
2. intentionally monitoring a conversation by means of a monitoring device so as to gather confidential information concerning any person, body or organisation . ³

Only a High Court Judge can issue a direction authorising the monitoring of communications on two grounds:

1. If evidence presented convinces a Judge that the offence committed or about to be committed is a serious offence that cannot be properly investigated in any other manner or ⁴,
2. that the security of the Republic is threatened and the application convinces him that gathering information concerning a threat to security of the Republic is necessary.

A direction (or order) for interception and monitoring may be approved by the Judge for a maximum of three months and thereafter for a further period not exceeding three months at a time.

The law contains a number of substantive and procedural safeguards for applications for surveillance and the subsequent sections of the Act regulate the manner and procedure of such applications. The Act also contains a 'secrecy' provision preventing any person authorised to perform functions under this Act from improperly disclosing any information obtained.

The only agencies or persons that may make applications for the surveillance of communications are the SA Police Service (SAPS), the National Defence Force (SANDF), the Secret Service and the National Intelligence Agency (NIA).

Offences and penalties

Offences and penalties are provided for violation of the Act's general provisions (section 2) or the secrecy provisions. A fine or imprisonment for a period not exceeding two-years is contemplated for violating section 2, and in the case of the `secrecy clause' contravention, a fine or imprisonment not exceeding five-years can be imposed.

The importance of obtaining the proper authority to monitor or intercept with strict adherence to procedure has been stressed in our courts and the validity of the directive can be automatically vitiated if not lawfully issued. This would not only constitute a criminal offence in terms of the Act, but also constitute an infringement of the right to privacy, which includes the right not to be subject to "the violation of private communications", as set out above. ⁵

The White Paper on Telecommunications Policy - 1996

The White Paper which preceded the Telecommunications Act ⁶ also commented on the principles in regard to the interception of call traffic namely, that the very right of government to intercept telecommunications traffic should be stringently controlled; that the Interception and Monitoring Prohibition Act should be reviewed in order to ensure sufficient safeguards are in place and that such a review should of necessity involve public debate and the participation of other Ministries, such as that of Safety and Security. It also proposed that the question of traffic interception should be dealt with in specific legislation, as is currently the case and by logical extrapolation, that such provisions should not be incorporated into the Telecommunications Act which followed. Proposals by the SALC in this regard have been in accordance with this sentiment. (See below).

Telecommunication Service Providers

The Act does not define a telecommunications service provider but merely refers to "persons rendering a telecommunication service". In terms of the Act (section 5) any person (or company) rendering a telecommunications service is obliged to intercept any telegram or postal article in accordance with a direction and hand it over to the law enforcers concerned. The necessary facilities and devices to enable the enforcement officer to execute a direction must be made available to monitor conversations to which the direction applies. Remuneration agreed upon by the law enforcement agency concerned and the person (or company) shall be paid to that person (or company) for assisting to execute a direction. If no agreement can be reached, the Minister of Communications must determine a reasonable remuneration.

It should be noted that the current law provides that the communications/conversations between an attorney and his client are privileged, and may not be intercepted/monitored. Proposals for amendment are contemplated in the draft Bill. (See Below)

The South African Law Commission, Project 105, November 1998

In 1998, the SALC issued a discussion paper setting out the local monitoring and interception laws and comparing them with those of France, the Netherlands, Belgium, Germany, Britain, Canada, Hong Kong and the United States of America. South African law was found to compare favourably with the legislation of these countries. The document was designed to elicit responses and to serve as a basis for the SALC's proposals for reform to SA domestic law. The origin of the investigation lay in a request from the Minister for Safety and Security to review and rationalisation South Africa's security legislation in view of the history of security legislation and changed circumstances in South Africa. All existing legislation such as the Internal Security Act, 1982, should be enacted in accordance with international norms, the Constitution and the country's present circumstances and requirements. The SALC decided to prioritize the investigation into interception and monitoring of communications for crime investigation and intelligence gathering purposes.

The process

Persons wishing to comment on the discussion document had until January1999 to make a submission. ISPA submitted its views by that date. The working committee approved the publication of discussion paper 78 for general information and comment on 27 November 1998. The overall aim of the exercise was to develop a draft Bill on surveillance in South Africa. Twenty-seven respondents commented in writing on the discussion paper. The project Committee met on 29 May 1999 with parties representing telecommunication service providers, law enforcement, intelligence and security agencies. (ISPA was not at this meeting, nor did it receive an invitation to attend). Their views and those reflected in the written comments were taken into account. The project committee's recommendations were considered by the SALC on 13 August 1999 and 22 October 1999. The following recommendations represent the SALC's final views on the draft Bill for Interception and Monitoring Prohibition. The draft Bill is attached and falls under the portfolio of the Minister of Justice.

Summary of Recommendations

The SALC made the following recommendations and reasons to amend the existing Act:

1. To define "call-related information" namely switching, dialling or signalling that identifies the origin, destination, termination, duration and equipment identification of each communication generated or received by a customer or user of any equipment, facility or service rendered by a person, body or organisation rendering a telecommunication service, and where applicable the location of such user at the time of the initiation or first reception of a call".
2. To define "communication" to include all types of communications, namely fax, e-mail, etc. that may be intercepted and to create the obligation for telecommunication service providers to assist in executing directions in respect of not only "conversations" but also "communications". The SALC believes that such a definition clarifies that any "conversation and message, and any part of a conversation or message, whether in the form of speech, music or other sounds, data, text, visual images, whether or not animated or signals, or in any other form or in any combination of forms, will be included.
3. To clarify the definition of "judge" to mean a judge of the High Court in any division.
4. To amend the definition of "serious offence" to include other compelling national interests of the Republic (in addition to offences which may allegedly harm the economy and which are presently included as serious offences); certain offences referred to in the Drugs and Drug Trafficking Act, 1992; any offence relating to the trafficking in firearms, ammunition and explosives; any offence relating to the death or serious bodily harm of any person; any offence referred to in the Prevention of Organized Crime Act of 1998; and any offence threatening the security of the Republic.

It is worth noting that the SALC initially considered making provision in the Bill for the offences contemplated in sections 100 and 101 of the Telecommunications Act 1996 to be serious offences for purposes of the Interception Act. This would mean that SATRA would be able to lay a charge with and request the SAPS to apply for a directive to authorise the interception and monitoring of telecommunications once SATRA inspectors have reasonable grounds to believe that telecommunication service providers are in breach of the provisions of the Telecommunications Act. It was also suggested that the Office of President ought to be vested with a right to make an application for the interception and monitoring of all State Departments within the confines of the Act and that registered, qualified or listed private investigators likewise be vested with such a right to make applications. The SALC however decided against this and the categories of bodies that are presently empowered to apply for directives under the Interception Act remain unchanged.

5. To delete the existing proviso that the offence concerned has to be committed over a lengthy period of time.
6. To substitute the definition of "telecommunications line" with that of "telecommunications system" as defined in the Telecommunications Act. ⁷
7. That the "interests" of the Republic be inserted to expand on the criteria of the security of the Republic.
8. That no communication between a legal representative and his or her client may be intercepted or monitored, except if the judge is satisfied on reasonable grounds that the legal representative is involved in, or aiding or abetting a serious offence or an offence threatening the security of the Republic.
9. To allow a judge to make additions or amendments to an existing directive if he or she is satisfied that it is necessary to do so, without the applicant having to bring a fresh application.
10. To clarify that the remuneration referred to for service providers in the monitoring and interception of communications shall only be in respect of direct costs incurred in respect of personnel and administration and the lease of telecommunications systems, where applicable, and shall not include the costs of acquiring the facilities and devices.
11. To provide that no person may provide a telecommunication service which does not have the capacity to be monitored.
12. To provide that any telecommunication service provider shall at own cost and within the period specified in a directive by the Minister of Communications acquire the necessary facilities and devices to enable the monitoring of conversations and communications.
13. To provide that the investment, technical, maintenance and operating costs in enabling a telecommunication service to be monitored, shall be carried by the person, body or organization rendering such a service.
14. To provide that duplicate signals of conversations and communications authorized to be monitored in terms of the Act, shall be routed by the relevant person, body or organization rendering a telecommunication service to the relevant central monitoring centre, to be designated by, respectively, the National Commissioner of SAPS, the Chief of the SANDF, and the Directors-General of the Agency and Service.
15. To provide that SAPS; SANDF; the NIA and the Secret Service shall, at State expense, equip, operate and maintain central monitoring centres for the authorized monitoring of conversations or communications: Provided that an agreement on the sharing of any such central monitoring centre shall not be excluded.
16. To provide that the Minister for Communication after consultation with any person, body or organisation rendering a telecommunication service, may issue a directive to comply with the provision on the rendering of services which are capable of being monitored and that he or she may specify the security, technical and functional requirements of the facilities and devices to be acquired.
17. To provide for the particular specifications set out in the directive issued by the Minister which she may require telecommunication service providers to comply with and that the Minister may, after consultation with the person, body or organisation rendering the telecommunication service, determine a period, not less than three months from the date on which a direction is issued, for compliance with such a directive.
18. To allow an application for call-related information (see above definition) on an ongoing basis and to ensure that telecommunications service providers route the call-related information to the relevant designated central monitoring centre, whether the call related information is all that is required or if it is to accompany a monitored communication as well.
19. To provide for procedures that the provisioning of call-related information excludes the use of any power in any other Act, to obtain such evidence or information via another piece of legislation.
20. To provide that telecommunication service provider shall ensure that proper records regarding identities and addresses are kept in respect of clients to whom a telecommunication service is provided, whether on a prepaid or contract basis and to require positive identification from a client to whom such a service is provided.
21. To allow for the dispensing of procedures in the Act, if a judge considers any case to be sufficiently urgent, allowing the matter to be dealt with in such manner and subject to such conditions as the judge may deem fit. This may include the granting of an oral directive followed up by written application incorporating the terms of the directive within one week, and that where an oral directive was issued, the judge must reduce it to writing within two days.
22. To provide that the use of any information obtained through the application of the Act, or any similar Act in another country, as evidence in any prosecution, is subject to the decision of a Director of Public Prosecutions or an Investigating Director.
23. To provide that information regarding the commission of any criminal offence, obtained by means of any interception or monitoring in terms of the Act, or any similar Act in another country may be admissible as evidence in criminal proceedings.
24. To provide that any telecommunications service provider who fails to comply with the provisions of this Act, they will be guilty of an offence, and liable on conviction, to a maximum fine of R 200 000. If they continue to fail to comply after conviction and fining, the Minister may revoke their licence issued in terms of Chapter V of the Telecommunications Act.
25. To amend the Act to authorize any other person than those agencies listed, to execute or assist in the execution of a direction under certain circumstances, e.g. in the transcription of tapes.
26. To provide that any person who intercepts or monitors a conversation or communication in accordance with a directive issued under the Act or who in good faith assists a person who he or she believes on reasonable grounds is acting in accordance with a directive, is not guilty of an offence. (It was suggested that MTN and any licenced telecommunications operator be indemnified from any claims where MTN acted in accordance with a prima facie written directive.)

The following is proposed for exclusion from the Bill:

1. Provisions seeking to regulate the manufacture, distribution, possession and advertising of wire or oral communication intercepting devices. The Commission noted in particular the comments by the office of the Deputy Minister of Intelligence which stated that this issue should be part of new legislation and not part of Act, arguing that it is not the appropriate legislation to deal with these issues, that the matter has policy implications, which require further discussion with the Security Ministers and the Joint Standing Committee on Intelligence and that any new ideas on the matter will be addressed before legislation is taken to Parliament.
2. Detailed provisions regulating how interceptions of communications should be recorded, sealed and stored in order to overcome all potential evidential concerns.
3. Hacking and the broader issue of the desirability of legislation governing the Internet such as an Internet Communications Act be dealt with in the SALC's investigation into computer related crimes (project 108) and not in this investigation.
4. No provision is made in the Bill for telecommunication service providers being permitted to answer directives by way of affidavit. It was suggested that due to the sensitive nature of the information, MTN be allowed to answer the directives by way of affidavit, and that to protect its employees a structure should be created in the event of any judicial proceeding whereby the affidavit will be used in such proceedings and MTN employees will not be required to testify in Court. The Commission is of the view that there is no need to confer the proposed power to officials employed by telecommunication service providers.
5. Directives being served upon telecommunication service providers at certain central points.

Implications for ISPs

Application

1. The question may well be asked whether this law applies to Internet service providers at all. The Telecommunications Act sets out that no service shall be provided without a licence. Notwithstanding the fact that ISPs are not currently licenced in a specific category under the Telecommunications Act, a process is underway to ensure that they are licenced in one or other category of VANS or ISP. Many of which are VANS licence holders already. In addition, the new definitions in the Act regarding telecommunications service seem to include ISPs. Finally, the fact that the definitions have been amended to include all communications and messages, including e-mails, would confirm that this Act is intended to apply to ISPs and the communications that travel over the networks they operate. Even if a case were to be made out that ISPs are not technically included by the absence of a definition, it is safe to assume that the proposed Bill, in its final stages will be remedied to target communications on the Internet and those that provide access to it and services on it. ⁸

Network accessibility and costs

2. Assuming that ISPs are affected, the SALC recommendation and proposed amendments place an obligation on service/network providers to ensure that all communications on their networks are capable 9 of being monitored and intercepted; that is, no communication services can be supplied by the Network Providers which cannot be intercepted/monitored and that the costs for enabling monitoring, that is, providing the equipment and facilities shall lie with the Network/Service Provider and the personnel/administrative costs and recording of communications lie with the Government Departments involved.

Time to install and suppliers

3. It is not just the costs of providing the facilities for monitoring and interception, that is being proposed. The recommendations propose that Network operators are to bear the investment, technical, maintenance and operating costs in enabling a telecommunication service to be monitored. It also suggests that the facilities to be utilized must be obtained within a period to be specified in a directive by the Minister of Communications. Operators that made submissions also expressed concerns that the Bill contained in the discussion paper proposed that the telecommunication service providers should acquire the devices and facilities from a supplier approved by the Minister for Communication. The SALC proposes that it does not matter what equipment the service providers acquire, provided it has the capacity to intercept and monitor.

It is assumed that if the State assumes responsibility for these costs, the State will keep on paying tremendous amounts only to keep track with technology, which is renewed every few months. Already the reality of the costs of cellular interception is evident in many countries. In terms of the present wording of the Act there is an obligation on the Network Providers to provide the necessary facilities and devices for the monitoring of conversations (an amendment in this regard to include all communications has already been approved by Parliament). The Government Departments, however, are responsible to pay for services in this regard, or at least the costs involved in providing those services. The SALC has been advised that there are negotiations being conducted involving, the law enforcement and intelligence agencies and the cellular telecommunication operators. The SALC notes that the issue of costs is a legitimate debate. Telkom and the cellular operators have argued that the revenue derived from their ordinary taxes should be appropriately directed. They further argued that law enforcement, including surveillance is a function of the State. The counter argument from law enforcement is that telecommunications operators are in possession of a very productive and lucrative resource, and it is appropriate that they should bear particular obligations. Whilst the matter is not settled, the SALC, having regard to modern technology and criminal methods, including the use of their products, favours the latter argument and feels that the telecommunication operators should bear the costs as is proposed in the Amendment Bill. The Commission is of the view that this is an indeterminable debate, which will not be resolved by it.

Surveillance of clients

4. In addition to monitoring/intercepting communications of crime suspects, on reasonable grounds of suspicion, that ISPs may be asked to assist with, the proposed amendments seem to indicate that there is a need to regulate attorney/client privilege in the Act. This may affect ISPs that provide network support to law firms and other legal practitioners. The continued constitutionality of this provision is open to question.

It is worth noting that the proposed Bill suggests that telecommunications service providers who fail to comply with the provisions of this Act, after conviction and a fine, may have their telecommunication service licence revoked by the Minister for repeated failure to comply.

Encryption

5. Although not dealt with in any great detail, the recommendations indicate that the Commission is of the view that a provision should make it clear that a service provider will not be responsible to decrypt any encrypted communication unless the facility for encryption forms part of the service rendered by the service provider. This may have implications for various security products advertised and offered by ISPs.

Routing

6. The recommendations provide that duplicate signals of conversations and communications authorized to be monitored in terms of the Act, shall be routed by the telecommunication service provider to the relevant central monitoring centre, to be designated by, respectively, the National Commissioner of SAPS, the Chief of the SANDF, and the Directors-General of the NIA and Secret Service. This may have cost implications for ISPs

Privacy

7. Notwithstanding the glaring constitutional privacy concerns inherent in surveillance, monitoring and interception of communications, it is likely that given the current crime rates in the country and the criminal uses to which certain telecommunications equipment is being put to, a law of this nature will likely withstand constitutional scrutiny. The issue however remains to dilute the privacy invasions as much as possible and to protect the privacy rights of the users, customers and subscribers on the networks. For example, a clause is proposed to ensure that proper records regarding identities and addresses are kept in respect of clients to whom a telecommunication service is provided, whether on a prepaid or contract basis and to require positive identification from a client to whom such a service is provided. Further, that provision is made that any telecommunications service provider shall provide such information regarding the customer who has contracted for the use of such telecommunication service to the SAPS; the SANDF, the NIA or the Secret Service, if required to. In addition, operators and service providers will have to make the name, identity number and address of the person contracted for the use of the telecommunication service available. Finally, criminal sanctions apply for failing to comply with the Act or a directive issued by a judge, a directive issued by the Minister for Communication or the obligation to provide information regarding a customer contracted for the use of a telecommunication service, the obligation to keep records, or the obligation to require positive identification when contracting a telecommunication service. Whilst ISPs have to indemnify themselves against this type of liability for failure to comply, it is imperative that these provisions be scrutinized for what is and is not considered constitutionally acceptable. No ISP should make information of this nature available without having all the proper documentation and applications presented by law enforcement officials. Complete adherence to procedure is absolutely imperative in order to avoid a claim of privacy infringement. For those who have not, it may be useful for ISPs to develop "privacy policies" that make it clear to customers when their informational privacy rights will be violated in the case of criminal investigation or matters of a like nature, providing the necessary documentation and procedures are complied with.

Indemnity

8. The recommendations provide that any person who intercepts or monitors a conversation or communication in accordance with a directive issued under the Act or who in good faith assists a person who he or she believes on reasonable grounds is acting in accordance with a directive, is not guilty of an offence. This recommendation assists in clarifying the position and concerns set out above with respect to customer privacy.

---

¹ Some examples of which include: parabolic microphones with ranges extending to more than 250 metres; miniature tape-recorders which can be concealed inside cigarette packets; binoculars having built-in cartridges; listening devices laminated onto business cards; brief-case cameras, activated by pressing a button on the briefcase; residual light image intensifiers with ranges of up to 10 kilometres for long range observation at night; day-and-night cameras connected to monitors and operated by remote control; long-range photographic flash devices enabling photographs to be taken at night without detection and from a range of 100 metres or more; microphones concealed in watches, buttonholes, pens and ties; sub-miniature transmitters, smaller than sugar cubes, which can record conversations from a distance of 10 metres and transmit them at high quality up to 150 metres; listening devices which through the use of laser beams can monitor and record conversations from positions outside the room in which they are occurring; electronic stethoscopes which, by picking up mechanical vibrations and amplifying them up to 10,000-fold, enable conversations to be monitored through windows, doors and walls; optical devices which permit continuous monitoring in complete darkness, and listening devices placed in telephones, which enable surveillance of conversations within a room even when the telephone is not in use.

² Constitution of the Republic of South Africa Act No. 108 of 1996

³ "Monitoring" is defined as including the recording of conversations by means of a monitoring device. A "monitoring device" is defined in the Act as "any instrument, device or equipment which is used or can be used, whether by itself or in combination with any other instrument, device or equipment, to listen to or record any conversation".

⁴ A "serious offence" is defined in the Act as "(a) any offence mentioned in Schedule 1 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977), including any conspiracy, incitement or attempt to commit any offence referred to in that Schedule, provided that -(i) that offence is allegedly being or has allegedly been committed over a lengthy period of time; (ii) that offence is allegedly being or has allegedly been committed on an organized basis, by the person or persons involved therein; (iii) that offence is allegedly being or has been committed on a regular basis by the person or persons involved therein; or (iv) that offence may allegedly harm the economy of the Republic; or (b) any offence referred to in sections 13(f) and 14(b) of the Drugs and Drug Trafficking Act, 1992."

⁵ See S v Naidoo 1998 (1) BCLR 46 (D) at 72 E-F and Protea Technology Ltd and Another v Wainer and Others 1997 (9) BCLR 1225 (W).

⁶ No. 103 of 1996

⁷ (a) a public switched telecommunication service; (b) a mobile or a fixed cellular telecommunication service; (c) a national long distance telecommunication service; (d) an international telecommunication service; or (e) any other telecommunication service licensed as such in terms of the Telecommunications Act, 1996

⁸ The project committee invited particular comment on the technical correctness of the definition of telecommunication service in the Telecommunication Act, since the question arises whether, for example, e-mail communication and video communications are included in its proposed definition. It is submitted that the target communications intended by the Act, place the intent to include ISPs beyond doubt.

⁹ The SALC proposes that the term "capacity" and not "capability" should be used. It is further proposed that the Minister may issue a directive to comply with the provision on the rendering of services which are capable of being monitored and that he or she may specify the security, technical and functional requirements of the facilities and devices to be acquired.