SA’s Spy Bill edges closer


The so-called Spy Bill has been signed off by the National Council of Provinces and is now only awaiting president Jacob Zuma’s signature before being passed into law, allowing state security agencies carte blanche to intercept foreign electronic communication signals.

The General Intelligence Laws Amendment Bill deals with state security agencies’ ability to monitor and intercept signals, but the final version has omitted the previous reference to foreign signals, creating concern that there are no rules in place as to how the government can monitor and intercept communications passing through foreign servers.

Interception of local electronic communication is governed by the Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA). However, this law has no bearing on foreign communication signals, allowing state agencies to monitor communications that go through a foreign server, without judicial oversight.

In addition, because the regulations around the pending law have yet to be finalised, and other regulations over foreign communications are secret, there is no oversight relating to how, when and why government monitors communication with servers such as those hosted by Google, Facebook and Skype.

The Bill has been adopted by both the National Assembly and the National Council of Provinces and was submitted on 3 June for Zuma’s signature.

Kathleen Rice, director of Cliffe Dekker Hofmeyr’s technology, media and telecommunications practice, says that, in the absence of a definition as to what a foreign signal is, it appears there is no scope to make provision for the interception and monitoring of foreign communications to be subject to the provisions of RICA.

Rice says leaving out the definition of “foreign signals intelligence” effectively avoided lengthy debate on whether such signals should be subject to RICA.

According to the meeting minutes, State Security minister Siyabonga Cwele was happy to leave out the definition, as “classified regulations” apparently exist governing the interception and monitoring of foreign communications, says Rice.

Rice adds that the fact that the regulations are not available to the public “beggars belief”. Although it is understandable that the mechanisms of interception and monitoring, as well as the content being monitored, can be kept secret, the operational processes contained in regulations should be open, she adds.
“As things stand, the security services may intercept and monitor foreign communications without a warrant or any form of judicial oversight, as the security services regard RICA as only having domestic application. This should be of concern to every person who uses the Internet, which inevitably results in the receipt of signals from outside of SA’s borders,” says Rice.

None the wiser

Rice adds that monitoring is happening, but there is no indication as to the current extent, or under which circumstances it takes place. “They can do anything.”

The 2006 Matthews Commission on Intelligence found that “bulk interception” and “environmental monitoring” was being undertaken by the National Communications Centre (NCC) – functions that the Right2Know (R2K) campaign says would presumably fall under the State Security Agency (SSA) under the Bill.

Right2Know says the practice appears to be that voice prints and written and spoken keywords are “listened to” by the system, which automatically records these signals when there is a “hit”, after which the recordings can be analysed.
“It is claimed that the recordings are discarded after a while, and that any follow-up targeted-bugging is done through the RICA warrant procedure. However, even if the recordings are discarded, there is nothing to prohibit the SSA from retaining and using intelligence such as who contacted whom, as well as personal data culled such as e-mail addresses and phone numbers,” R2K has said.

Major hole

Although R2K has welcomed some changes in the Bill that was finally signed off, such as a tighter monitoring mandate, Parliament’s failure to introduce regulations is a major missed opportunity to clamp down on unlawful monitoring of communications, it says.

This debate has been delayed for a future policy review and the current lack of regulation will prevail, potentially leaving this opportunity for abuse untouched, says the campaign.

In addition, Parliament stopped short of addressing concerns around “foreign signals intelligence”, where a lack of regulation has led to fears of unfettered surveillance and monitoring of surveillance, says R2K.

Rice says interception and monitoring of foreign signals should have been made subject to RICA, as judicial oversight is the best means of ensuring that rights are not being infringed. “If the security services are enforcing their own internal procedures, this is yet another case of the fox guarding the henhouse.”

Brian Dube, head of communication at State Security, says the department was happy to provide certainty to Parliament over what is meant by foreign signals, but the legislative body felt this was best left up to the Joint Standing Committee on Intelligence, as it may infringe on the department’s tools of the trade.

Dube adds that citizens will have the opportunity to raise concerns over the legislative process around intelligence and state security, as a discussion on a white paper is in the pipeline.