Interception & Monitoring Bill:Hearings

Meeting report

JUSTICE AND CONSTITUTIONAL DEVELOPMENT PORTFOLIO COMMITTEE
31 August 2001
INTERCEPTION AND MONITORING BILL: HEARINGS

Chairperson: Adv J H de Lange

Submissions presented:
UUNET South Africa submission
Cape Telecommunications User’s Forum
Free Market Foundation
Internet Service Providers Association

SUMMARY
The Committee met for another set of public hearings. Most of the public bodies present accepted that the measures in the Bill were necessary and that the present task was thus to best regulate the area. The most contentious issue was where the cost of the provision of equipment would fall, with most of the public bodies arguing that the state was obliged to bear this cost. Only one institution, namely the Cape Telecommunications User’s Forum, found the cost allocation, and in fact most of the Bill, to be to their liking.

MINUTES
National Intelligence Agency
Mr Crosby (NIA) said that the National Intelligence Agency had not experienced any problems in terms of compliance by Telkom. The Chair, confused, asked if that meant that Telkom was presently capable of giving the NIA what they required. Mr Crosby replied that what the NIA sometimes required was content as well as some detail information, such as time, duration and parties involved. Adv de Lange then asked about interception and monitoring equipment, wanting to know how much such information would cost. Mr Crosby said that the equipment required was available and was currently being used in other jurisdictions. He said that the equipment needed would cost much less than one million Rand. Mr Crosby ended his short address by saying that all the NIA required was that all communication and information networks should be interceptible.

Mr W Hanekom, head of Legal Services for the NIA, said that his institution and the South African Secret Service (SASS) strongly supported the principles behind the Bill, because without them these institutions would not be able to carry out their mandate. It was important to understand the nature of intelligence which was to gather, evaluate and process information. This would include the development of intelligence as well as counter-intelligence measures.

Mr Hanekom said that the next important point is to remember that the term ‘National Interest’ has expanded in scope. In the past this term was construed as the physical security of the State which was to be protected from threats from outside. Today however a much wider interpretation is in order and National Security is taken to indicate a much broader band of State interests. Today the definition of National Security recognises that threats to National Security come from within possibly more often that they come from without. This is the reason that today the move is towards intelligence gathering on matters that relate internally.

Mr Hanekom noted that the intelligence agencies were not executive bodies and thus never acted on information that had been gathered by them. The task of this institution is simply to collect such information and pass it on to the relevant law enforcement agency. Mr Hanekom said that all these facts needed to be remembered when formulating the legislation and taking into account the suggestions made by interested bodies.

Mr Hanekom went on to discuss the NIA’s submission on the Bill. Referring to the definition of pre-paid telecommunication services, he pointed out that these were defined as mobile cellular telecommunication services. The NIA suggested that the definition be changed to include all pre-paid telecommunication and not just cellular. Adv de Lange said that there was no such need because there was no such thing as pre-paid internet or pre-paid Telkom phones. Mr Crosby, from the NIA, respectfully told Adv de Lange that there were indeed pre-paid Telkom services. However, Adv de Lange pointed out that the Telkom pre-paid phones were the same as ordinary phones, in that the lines were fixed while the pre-paid element only provided for paying for ones calls beforehand. In these situations the identity of the telephone user or owner was determinable. Mr Crosby said here that what the NIA was concerned about was ‘number mobility’ and its increase in degree and incidence in the future.

Mr Hanekom pointed out that the NIA wanted definition of ‘telegram’ to be reworked. The definition of telegram was currently formulated as "any communication in written form or information in the form of an image transmitted over a communications line". The NIA suggested that the words ‘communications line’ be replaced with ‘communications systems’.

On ‘participant monitoring’ the NIA supports the view of Dr Jacobs of the SAPS. Clause 2(2) of the Bill provides that the SAPS cannot be involved in participant monitoring. Mr Hanekom said that this position was favourable because the Police need co-operation when they testify in court. Furthermore, when agents gather information they make a report to the Police in writing. A more favourable position would be if the Police had an exact report or evidence constituted in the manner and form in which the information was recorded.

Adv de Lange noted that Judge Cameron had made it clear that in South Africa the Police cannot legally be involved in participant monitoring. If the NIA had an answer to this position, he would gladly change the Bill.

Mr Hanekom pointed out that in light of clause 2(3), he had some concerns as it seemed that the clause was open to abuse by private investigators. Clause 2 of the Bill contains provisions relating to when the person monitoring the conversation is party to the communication, in whatever form it might be.

Adv de Lange directed the NIA’s attention to clause 4(2)(b) which provided that a direction to effect a particular interception may be granted if the security or other compelling national interest of the Republic is threatened. Adv de Lange wanted to know what this meant and asked for an example of such ‘a compelling national interest’.

Mr Hanekom said that this formulation was consistent with the broader definition which was now attributed to this term internationally. Adv de Lange still felt that the term was far too nebulous, even if the word ‘compelling’ was added to serve as a further qualifier. This term was far too wide and useable even by the police, Adv de Lange’s concern was that the section would be felt to be too vague to pass the constitutional test. The content of the term needed to be determined so that which so-called national interests would be protected.

Adv G Ali from the South African Secret Services noted that the whole process was subject to judicial oversight. He felt that the integrity of the members of our judicial system should not be underestimated. If a judge felt that there was not any threat to national security or some other compelling national interest, then he would not allow the interception or monitoring.

Adv de Lange said he did not underestimate the integrity of our judges. However, when drafting, the legislator is giving the judge scope within which to perform his duty. The question of whether or not a judge can be trusted does not enter the equation as the judge’s mandate still needs to be defined in terms of the Bill of Rights. He had yet to hear from the NIA what these other compelling national interests were and added that the legislation as it stood gave the NIA and the judiciary a blank cheque to intercept and monitor when they pleased.

After Adv Ali respectfully requested that this matter be left in abeyance until the NIA was able to formulate their argument better, Adv de Lange obliged.

Discussion
Mr Landers (ANC) asked the NIA whether they did not think that the problem here was that in other legislation, including the National Strategic Intelligence Act, there were references to ‘national security’ all with differing definitions. He asked if they did not feel that it was time to bring all these different definitions into line with each other and implement one definition for this term.

Adv Ali said that the suggestion would be well noted and that the intelligence community did in fact strive for a sense of consistency. This was done through a system of constant review.

Dr Delport (DP) said that one should remember that clause 2(a) dealt with private investigators while subsection (b) dealt with the gathering of information. A lot of this work would be preemptive, and would consist of building up profiles and information on specific individuals. This process is obviously open to much abuse because the person does not even have to commit a crime. Getting information is fine, Dr Delport said, but once you move into the area of ‘tapping’ someone’s phone that is undoubtedly a serious breach of the individual’s rights. Therefore at this point, the relevant agency must have evidence so compelling that it justifies the infringement of the individual’s rights. Adv de Lange added that this was true especially in the light of the fact that clause 2(2)(b) required consent while clause 2(2)(a) did not.

Adv Masutha (ANC) suggested that the term ‘national interest’ in clause 4(2)(b) not be used but instead specific offences should be referred to. He expressed a concern that if an ‘interest’, something less than a right, was allowed to form the basis, then when the State or individuals came under threat, the door would be opened to the area of private law.

Mr Hanekom pointed out that this was not so as the word interest was qualified by two other words, namely ‘compelling’ and ‘National’. The presence of these two qualifiers would prevent private law from ever becoming a factor.

Mr J Jeffrey (ANC) asked that better information be obtained on costing. To date, all costing information submitted had been vague.

Adv de Lange said, in reference to clause 4(2)(b), that there had to be parameters in which intelligence agencies can gather information. These agencies perform a necessary function but the process needed parameters if the Bill were to pass the constitutional test. The words "are threatened" provide for an objective test that would offer some form of parameter. Adv de Lange called for a comparative analysis investigating the positions in other countries to establish how and when these other jurisdictions allow interception and monitoring.

UUNet South Africa
UUNet South Africa, an Internet Service Provider, was represented by Mr Batsri of Webber Wentzel and Bowen. Mr Batsri said that he had identified four important principles that would need to be considered when looking at the Bill. UUNet was not opposed to the principle behind the Bill, but the provisions of the Bill would have to be carefully balanced against the provisions of the Constitution. Here the issues would involve the individual’s right to privacy. The provision of the Bill and actions taken in terms of the Bill would also have to be reasonable and proper. This Mr Batsri referred to as the constitutional imperative.

The next issue was consistency. Mr Batsri said that when interception and monitoring as envisaged in the Bill eventually occurred, it would have to be done in a consistent manner. This position would stand against the implementation of differing national mechanisms and standards for surveillance

Mr Batsri’s said that law enforcement in South Africa was a state function and the individual cannot take the law into his own hands. Mr Batsri submitted that if these premises were true then conversely the individual could not be expected to bear the costs of law enforcement. This was referred to as the cost imperative which called for compensation of private organisations where they assisted the State in its function.

Mr Batsri’s final principle related to privacy. Here he spoke of due process and the separation of powers. Mr Batsri submitted that interception and monitoring should take place only in a framework that accommodates for the principle of due process, the separation of powers and the individual’s right to privacy.

Mr Batsri said that there were also important policy issues involved. UUNet South Africa was charged with the promotion of universal access to the internet. UUNet is also responsible for the promotion of the internet as a viable, free and valuable business arena.

Mr Batsri moved on to discuss UUNet SA’s proposed amendments, the first of which called for the deletion of all references to "and any retired Judge". UUNet SA suggested that all references to "compelling national interest" either be deleted or further qualified.

Adv de Lange interjected and said that all these issues had already been discussed, he was however interested in whether UUNet had any comment on clause 2(3) and whether this clause was open to abuse by private investigators.

Mr Batsri said that UUNet had not formulated any comment on the topic. Looking at the clause Mr Batsri said that the clause would not really affect UUNet as it was an institution whose business revolves around the internet, a medium which hardly uses voice. Mr Batsri said that despite this he had no objection to the clause as it stood as it made perfect sense in the context of the internet.

Mr Batsri stated that the costs of the infrastructure for interception and monitoring should be borne by the Government. He mentioned Article 21 of the European Union’s Mutual Legal Assistance (MLA) Convention which specifically states that costs incurred by telecommunications operators or service providers should be borne by the requesting member state.

Adv de Lange interjected and challenged Mr Batsri to give him one example of where the obligation to provide interception and monitoring equipment was not placed on the service provider. Mr Batsri said that he could not think of an example but would endeavor to find one and bring it to the attention of the Committee. Adv de Lange repeated very emphatically that he challenged Mr Batsri to show him just one country where the state was obliged to pay for the equipment necessary for interception and monitoring.

Mr Batsri told the Committee that it was not the money which was the issue, but a matter of principle. He once again noted that it was the state’s duty to enforce the law and private organisations could not be expected to bear the costs of the performance of a state function. Such an expectation would result in smaller service providers going out of business.

At this point Adv de Lange again interjected, this time to encourage Mr Batsri not pursue the issue of cost anymore. If he wanted to discuss the matter further, he should do so in writing.

This brought UUNet’s part of the discussion to an end. Adv de Lange thanked the relevant parties for their time and said that some of their suggestions would be taken to heart. On the matter of costs Adv de Lange said that the position relating to cellular phones was clear, but in relation to specifically internet service providers he would require scientific proof that in other jurisdictions these costs are borne by the government.

Cape Telecommunications User’s Forum
The Cape Telecommunications User’s Forum (CTUF) was represented by Mr A Levine who explained that CTUF was a forum established to look after the public interest. He explained that the core team of CTUF had met to establish a framework within which the consideration of the Bill was to take place. They had a public meeting where issues which were agreed upon were documented. These issues only made their way into the CTUF submission through a general consensus. Through their meetings, they had identified three components to the Bill. These were the procedural, the technical and the economic aspects.

Under Procedural there were two points to be made. The first was that CTUF recognised that the Bill protected users. Secondly, it needed to be noted that the corporate environment can override this Bill. Mr Levine said that in the corporate environment the individual’s right to privacy is violated as bosses and managers often have access to the content of employee’s computers. Through this Bill the number of people who readily have access to the individual’s computer or other information is limited. Mr Levine also stated that there would be a need for accountability. Here he gave the example of the United Kingdom where there is a Commissioner in place to review interceptions and report them to the public.

Under the technical heading, Mr Levine said he wished to commend the government on legislation well drafted. The Bill encourages mandatory privacy policies between the end-user and Internet Service Provider (ISP). He said that a problem arises where the ISP has to provide the government with information as they then become liable for a breach of the privacy agreement. Provision would thus have to be made for the indemnification of ISP’s and other telecommunication service providers where they breach privacy agreements as a result of a statutory obligation to furnish information. Also under the technical heading was the concern that the need to integrate interceptability as a functionality of new technology would slow the advance of technology down because of increased costs and difficulty in research and development.

Mr Levine discussed the cost issues simply saying that there was a potential risk of the end-user bearing the costs of the new system. He said that with this in mind the Bill should be drafted in such a manner that implementation occurs in the most cost effective way and at the lowest cost to the consumer.

Mr Levine went on to explain the complexities of the internet and the difficulties associated with the interception and monitoring of information. In most cases the internet user leaves a trail when going online. This trail is however a complex one to follow. When an internet user logs onto the internet he is assigned an IP number. The IP for one user varies as it is assigned when that user goes online. To track the communication of someone would require you to determine the IP number of that user when he logs on. If this is done the information can be intercepted, and the person being communicated with can be determined. Once the interception of the information is complete the task of decoding the information begins. This is the hard part as determining the content of such communication is very difficult. Especially in light of the fact that serious criminals would encrypt their communication. Mr Levine explained that monitoring is hard but not as hard as interpreting the raw intercepted data. Forms of communication such as "chatting" are even harder to monitor. Chatting refers to IRC or Internet Relay Chat where millions of users communicate in an open forum. In areas such as these surveillance of any form is extremely hard.

Mr Levine said that CTUF was satisfied with the allocation of costs. He said that on a reading of the present Bill, the ISP was obliged to be able to, and on occasion to actually, monitor and intercept information. This task was easily done with software and little bit of skill. Once this information had been harvested by the ISP it would be the relevant intelligence agency that would have to go and translate or interpret the raw data and attempt to establish whether the data contained any information of value. The duty to develop the equipment and skills to perform the second part of the process would fall on the intelligence agency. The cost of this procedure should not, and did not according to Mr Levine, fall on the ISP.

Adv de Lange asked if he was correct in understanding that Mr Levine was in favour of the cost allocation under the Bill as he had not yet seen such an attitude towards the allocation of costs.

Mr Levine said that CTUF found the Bill favorable in that it provided a good structure for interception and monitoring. It also limited the number of interceptors of information to a number of governmentally empowered bodies. The Bill was favourable in its cost allocation in that it obliged the ISP to provide the equipment to intercept and monitor but did not place on them a duty to provide the service. The provision of service, or interpretation of data, would be the duty of the intelligence agency.

Mr Levine told the Committee that in the United States of America there exists a programme called ‘carnivore’. Mr Levine said that this was a horrible program that enabled the US government to access any information they wanted as the program is capable of decrypting anything. The US government gets a court order and sets up their equipment at the service provider. The functionality of this program gets expanded all the time, with the cost of such advancement being placed on the consumer.

Mr Levine commented that he had concerns relating Telkom. He reminded the Committee that Telkom used to be a state-owned organisation. In those days the SAPS and Telkom had a very close relationship with the Police using Telkom for surveillance purposes. He said that today there is a feeling that remnants of this old arrangement still exist. Mr Levine recommended an investigation into Telkom to see whether all their surveillance was above board.

Adv de Lange said that Mr Levine need not worry as such an investigation was already a possibility as when the Committee spoke to them, Telkom had made statements which aroused suspicion.

Free Market Foundation
The FMF took a stance that was opposed to the Bill, as they felt that the Bill as it stood was a serious infringement of the right to liberty. They argued that it is understandable that crime needs to be fought. When the old regime was in power the government was authoritarian and used whatever measures it pleased to root out crime. However, today there is a democratic society. Democracy is a situation that comes with a price as criminals thrive in this type of environment. The FMF argued that if crime is to be fought, existing law enforcement resources should be supplemented and the money that would be used to implement this Bill should be ploughed into existing and less offensive law enforcement methods and agencies. The FMF felt that there was a sense of déjà vu about this legislation that brings to mind the past regime. They also submitted that a few years down the line this Bill could be used to deal with political opponents.

Adv de Lange interjected to tell the FMF representatives that there was an absolute and fundamental difference between the present situation and the one of old. This difference lies in the fact that under the apartheid government there was no Bill such as this that controlled activities of this nature. Adv de Lange pointed out that before 1992 there was no legislation regulating this area but after 1992 there was a court order requirement for such activities.

Mr Louw, a representative of the FMF, pointed out that once the legislation was enacted the process of getting this court order would be controlled by a retired judge. Mr Louw felt that retired judges were no longer part of the executive and thus subject to no disciplinary body. He suggested the use of acting judges for this duty as acting judges, appointed by the executive, are subject to various bodies.

Adv de Lange appreciated the sentiments of the FMF but the Heath judgment expressly stated that acting judges could not perform such a duty. Adv de Lange told Mr Louw that he felt that this issue became a problem because of clause 4(2)(b) and asked him for his views on this clause.

Mr Louw said that the term was wide and that too many things would fall into this area. The example which Mr Louw gave was of the COSATU strike which was happening outside Parliament that very moment. He said that these strikes could very well be a threat to a national interest, but that did not mean that it would be reasonable for the secret service to ‘bug’ the phones of all COSATU leaders. Mr Louw added that the Bill embodied extreme measures which called for extreme checks and balances.

The FMF argued for the allocation of costs to fall on the government. Here Adv de Lange interjected and asked the FMF to give him one example of a country where the cost allocation is as the FMF would wish it to be.

Mr Louw told the Committee that one of the things that South Africa had not come to terms with was the fact that when moving from an authoritarian society to a democratic one, the government has to increase the power of the law enforcers. South Africa spends 7% of its budget on law enforcement, Mr Louw submitted that this was far too little. He added that the cost of intercepting and monitoring was huge while for the criminal it was extremely easy to get around it. All they needed to do was not use an interceptible form of communication. He also enquired as to whether a cost to benefit analysis had been done. In light of the extreme costs, will the fruits of the exercise exceed the cost? Mr Louw argued that when fighting crime in a democratic society, one does not undermine the principles of that society, but does so by spending more money. Better crime fighting can also be achieved by making the police fight against proper crime instead of matters which are not that important.

Adv de Lange thanked the FMF for their time and said that their suggestions would be considered seriously. He told them that he had spoken to acting judges who themselves felt that they should not be doing such work. Adv de Lange however said that he was happy that the FMF had brought this matter to light in the meeting.

Internet Service Providers Association
Mr Thompson from UUNet SA also represented ISPA. He told the Committee that in South Africa there were just under 100 ISPs with ISPA acting as a representative for 50 of these. He explained that network design varied from one ISP to the next, but there was a general design which could be found in most medium to large networks. To intercept and monitor communication via the internet is possible but requires equipment. Tracing would best be done at what Mr Thompson referred to as points of presence. He explained that there were three main areas where interception and monitoring could be done. In choosing the point at which to monitor, cost implications would play the deciding role. Mr Thompson said that the cost of integrating intercepting technology could easily be as much as 50% of the total infrastructure costs in the SMME (Small to Medium Enterprises) environment and 25% of infrastructure costs in medium to large networks. Here again it can be seen that the burden of the legislation is to be borne by the smaller ISP’s.

Mr Thompson said that a number of other questions were also raised, such as whether there will be multiple monitoring centres. This is important because there are increased cost considerations when there is long distance ‘backhaul’ to the monitoring centre. Also, if storage is required, who will bear this cost?

The legislation provide that no telecommunication service can be provided if no monitoring can take place. The problem here is that complex technologies may not be susceptible to ‘practical’ monitoring. Another problem is that monitoring technology often follows many months after new technology has hit the market.

Mr Thompson explained how the obligation to disclose identity and address records may result in free ISPs discontinuing their services. This would in turn go against the principle of furthering the internet as a logical, viable and open method of communicating and doing business. The second problem would be that internet cafés would be obliged to request a form of identification before allowing a user to make use of their services. In this example and others it is obvious that there will be a significant increase in administrative costs to the detriment of SMMEs.

Adv de Lange told those institutions which had technical expertise that they needed to sit down with the NIA and discuss exactly what was needed. He could not understand why such meetings had not already taken place. Adv de Lange specifically mentioned that he would like there to be a meeting between Telkom and the NIA so that the NIA could tell them that they already had the capability to fulfill their obligations in terms of the Bill. Here Adv de Lange was referring to previous meeting where Telkom had stated that the move to an interceptable infrastructure would cost a R1 Billion. He said that Telkom later reduced this amount to only half a billion Rand, an amount that was itself later reduced. He referred to the opening comment by the NIA that Telkom can, and has been, furnishing the NIA with the kind of information required under the Bill. Adv de Lange stated that the issue of cost needed to be properly discussed. The meeting was adjourned.