ATC231130: Report of the Select Committee on Security and Justice on the Regulation of Interception of Communications and Provision of Communication-related Information Amendment Bill [B 28B-2023] (National Assembly – sec 75), dated 30 November 2023

COMMENTS ON THE REGULATION OF INTERCEPTION OF COMMUNICATIONS AND PROVISION OF COMMUNICATION-RELATED INFORMATION AMENDMENT BILL, 2023 (BILL)

SELECT COMMITTEE ON SECURITY AND JUSTICE

DOJ&CD RESPONSES

SPECIFIC COMMENTS ON BILL

PROVISION

COMMENTS

DOJ PROPOSAL/COMMENTS

Clauses 1,  5, 6, 8, 10 to 12

No specific comments were received.

Clause 2

Insertion of Chapter 2A

15A. Designated judge

15B. Review judge

15C. Powers and functions of review judge

15D. Tenure of designated and review judges

Jane Duncan

15A: Designated judge

The appointment process is adequate only to the extent that it means that the appointment must be made by the Minister with the concurrence of the Chief Justice.

As a result of the public hearings and deliberations held by the Portfolio Committee on Justice and Correctional Services, a decision has been taken to make an option of having more than one judge available. This is a welcome insertion and brings the Bill into line with RICA.

Recommendations:

The Bill could make it clear that the appointments of the designated judges and review judges should be made with the concurrence of the Chief Justice.

15B: Review judge

For better use of resources, build in the automatic review into the process once surveillance subjects have been notified, and then they can be included in the review if they wish to contest the bases for surveillance, supported by the public advocate. The public advocate would be available at two stages: when the initial decision is being made and when surveillance subjects contest the bases for decision-making at review stage. However, automatic review does not depend on their doing so: it would take place whether or not the subject wishes to contest the basis for surveillance.

15C: Powers and functions of review judge

The Bill is also not clear on whether the review judge will have access to remedial powers (including, making orders, cessation of surveillance, destruction of intercepted information or payment for compensation) if it is found that decisions were flawed.

15D: Tenure of designated and review judges

The fact that the designated judge and the review judge will enjoy substantial tenure for a non-renewable period not exceeding seven years is not sufficient to provide them with security of tenure. This is because while it is clear what the maximum period of their tenure is, it is not clear what the minimum period of their tenure is. Amend the section to make clear what the terms of tenure are - avoid the dangers of judges becoming subject to regulatory capture, it may be better to restrict appointments to a non-renewable term of five years.

In the same way that one judge may not be enough at the decision stage, one judge is also not likely to be enough at the review stage and the establishment of a Tribunal could be considered.

Recommendations:

The Bill could state that the tenure of both judges is for a non-renewal period of five years;

The review judge should be retained but consideration should be given to including more review judges and establishing a Review Tribunal with remedial powers.

Re: ex parte process

Possible that the review judge was introduced as a safeguard to respond to the ex parte problem identified by the Constitutional Court. The Court left it to Parliament to decide how best to respond to these matters, but with the proviso that its solutions would need to address the inherently one-sided nature of the process.

The purpose of the ex parte requirement is to ensure that there is an adversarial element introduced into the system. The review judge does not satisfy the ex parte requirement as it is not an adequate or appropriate safeguard and fails to introduce an interrogative element.

In its response to the public submissions to the Portfolio Committee on the Bill, the Department conflates two issues that should not be conflated, namely automatic review and the ex parte issue. Any solution to the problem must address the issue that the judge(s) do not get to hear the other side of the argument, which undermines the audi alteram partem principle and does not elevate the process from being an inquisitorial one to an adversarial one. The Bill fails to grapple sufficiently with this problem and the advances made internationally in how to respond to it.

Recommendation:

Bill could make provision for a special advocate to defend the interests of the surveillance subject.

V L Mashava (Attorney of the High Court in personal and stakeholder capacity)

Paragraph 6 of the order requires that there must be adequate safeguards to address the fact that interception directions are sought and obtained ex parte. The explanatory memorandum does not explain how adequate safeguards have been provided for in the Bill. There is no specific clause dedicated to s16(7)(a) or paragraph 6(c) of the Court’s order.

15A

The Department disagrees. The Bill is clear regarding the appointment of judges and the involvement of the Chief Justice – this is what is meant by the phrase “in consultation”. The Department is of the view that there is no need to be amend the Bill, as this is trite in legislative drafting and well understood and accepted.

15B

Issues of review at the end of the surveillance process and the introduction of a public advocate will receive due attention during the review process for the overhaul of RICA.

The comment seems to suggest that the automatic review process serves the purpose where it is currently located – at the decision-making process – and at the end of the surveillance process (regardless of involvement by the surveillance subject).

It does not seem to follow that review at the end of the surveillance process which is not prompted by an aggrieved subject of surveillance or involves the subject of surveillance would yield any real or meaningful relief. To follow the suggestion to its logical end, the automatic review would be conducted at the end of the surveillance, but it is unclear at whose instance this review would be triggered and what the purpose of this would be. If the automatic review results in the conclusion that the interception application should not have been granted, and the subject of interception is not a part of the review process, what is the meaningfulness of the outcome of the review process for the person affected by it? The person would need to be notified of the outcome, presumably, but would still need to proceed to exercise their rights through ordinary court and civil processes.

Practically, in all review matters, the person seeking a review would be required to act positively when seeking the review of a decision. This includes, for example, instituting an application for review. The other method of automatic review involves one court (usually a lower court) forwarding the decision and all related documents to another court (usually a higher court) for a review of the decision.

15C

The Bill empowers the review judge to consider and either confirm, vary or set aside any decision made by the designated judge and also provides that any decision by the review judge must be executed immediately upon receipt by the applicant. This necessarily will include the power to make orders, cessation of surveillance and destruction of intercepted information, among others. The absence of a clause on issues of compensation does not prevent any person to approach a court for relief and compensation.

15D

The Department disagrees with the suggestion to reduce the term to five years. The continuity and the skills handover in this function are critical and a longer term allows for the judge to build and amass skills pertinent to this role, which in turn allows for greater capacity and improved turnover. Further, the suggestion to have a longer term was reached as a compromise between multiple governmental stakeholders through a series of consultations.

The Department also does not agree with the suggestion to make provision for a minimum period. –It is not standard practice to provide for a minimum period of appointments, as circumstances may require a judge to be released from these functions for various reasons, including their personal requests.

Re: ex parte process

The Bill addresses the ex parte nature of surveillance applications in response to the issues raised in the Amabhungane case in two ways: the introduction of an automatic review conducted by a review judge and the introduction of a mandatory post-surveillance notification to the subject of surveillance. These are both critical safeguards that were discussed and considered in the Amabhungane case.

An automatic review has been introduced to address the dual issues of the pitfalls of ex parte applications in terms of RICA and the suggested automatic review considered by the Constitutional Court.

Clause 2 of the Bill provides for a review judge as a safeguard to deal with the fact that applications for interception directions are made on an ex parte basis.  The Bill empowers the review judge to consider and either confirm, vary or set aside any decision made by the designated judge and also provides that any decision by the review judge must be executed immediately upon receipt by the applicant.

The Amabhungane judgment indicates in paragraphs 49 to 54, and in particular paragraph 52, that an automatic review may be considered as a possible safeguard to deal with the ex parte nature of the applications. The Department has, in fact, taken the suggestion made by the Constitutional Court a step further by establishing a separate review process by a separate judge to ensure greater and more effective safeguarding of rights through the automatic review process.

The Department disagrees that the purpose of the ex parte requirement is to ensure that there is an adversarial element introduced into the system. This is but one option available to address the ex parte requirement. The issue of a public advocate is an issue to be considered in the comprehensive review of RICA.

The Department notes the comment that there is conflation of issues automatic review and the ex parte issue. This comment is premised on the view that the process should include an adversarial element, such as a public advocate. As explained above, the Department is of the view that an automatic review is a solution to the ex parte issue as it affords an added layer of protection against abuse and brings a fresh set of eyes and another objective mind to bear on an application for surveillance.

The Department conducted fairly extensive research into the concept of a public advocate, looking to examples in other jurisdictions. It is clear that there is no uniform approach to this issue, and the scope of powers and the use of a public advocate in surveillance legislation.

The issue of post-surveillance notification has also been introduced in response to the issues raised in the Amabhungane case. Clause 4 of the Bill introduces section 25A in RICA. The default position is that the subject of surveillance should be notified of the surveillance with the time specified and this can only be deviated from in exceptional circumstances. The fact that there is now mandatory post-surveillance notification is another important safeguard against the ex parte nature of surveillance applications because the subject is now required to be notified of the surveillance.

The ex-parte nature of the directions sought has been sufficiently dealt with in the Bill. See response above also.

Clause 3

Insertion of section 23A

23A. Disclosure that person in respect of whom direction, extension of direction or entry warrant is sought is journalist or practising lawyer

Jane Duncan

This provision is the same as in the judgment, however, part of the clause has been omitted. The protection afforded by the Bill is weaker than the protection afforded by the Constitutional Court for the period of suspension. Requiring the judge to satisfy themselves that the direction is necessary is a high test. To fulfil this requirement, the direction needs to be more than merely convenient and cannot lead to the required result of solving serious crimes or protecting national security using less invasive means and protecting vital interests.

Placing journalists and lawyers under surveillance should be an investigative method of last resort.

Recommendations:

Include the following clause in the draft section 23(A):

         “(2) The designated Judge must grant the direction, extension of a direction or entry warrant referred to in subsection (1) only if satisfied that it is necessary to do so, notwithstanding the fact that the subject is a journalist or practising lawyer.”.

The Department disagrees. The Bill does omit (2), as it is unnecessary for inclusion, as the judge already necessarily exercises a discretion when considering an application where a journalist or practising lawyer is a subject of an application. This discretion need not be restated – it is accepted as part and parcel of holding judicial office.  This is clear in the wording of the Bill which states  in proposed 23A(2) “If a designated judge issues the direction, extension of a direction or entry warrant, she or he may do so subject to such conditions as may be necessary,..”

Clause 4

Insertion of section 25A

25A. Post-surveillance notification

Jane Duncan

Largely mirrors the reading by the Court.

Subsection (2) which has been added to the provision in the judgment is too broadly framed and could lead to an indefinite suspension of the notification requirement - the judge merely must satisfy themselves that the notification has the potential to impact negatively on national security. This introduces a speculative element.

The uncertainty could be reduced by specifying the adverse result of the notification, such as death or physical harm to an individual, fleeing prosecution or prevention of evidence tampering or witness intimidation, and the delay should be necessary to prevent these adverse results from occurring, and for no longer than that.

There is no requirement for the judge to provide reasons for their decisions. This leaves the subject unable to assess the basis for issuing the direction and unable to protect their rights.

Recommendations:

The clause on national security should be replaced with a clause that allows for delayed notification in ‘life-and-limb’ situations and should set an upper limit for the delay.

The RICA judges should give reasons for their decisions, which should form part of the post-surveillance notification as a default;

Consideration could be given to adapting the mechanism for post-surveillance notification prescribed by the High Court, where decisions to delay notification should be referred to the Review Tribunal.

In making a decision, the designated judge must consider the   reasons provided for a request not to give notification. The Department is of the view that judges must be entrusted to properly discharge their functions impartially and fairly, taking into account all relevant factors, including the balancing of national security interests and privacy rights. Further, the judge will not be required to speculate on the potential to impact negatively on national security. This will need to be set out by the law enforcement agency making the application for the delay of the post-surveillance notification, who will need to adequately substantiate the reasons therefor. The judge will then be required to apply their minds to the application and exercise judicial discretion in making their decisions, taking into account all relevant factors. It is not merely a speculative exercise by the judge, but a process which follows settled civil law procedures.

The provision empowers the designated judge to allow the withholding of a notification for a period that the designated judge may deem necessary based on the reasons provided. It is not clear why national security is not a sufficient justification for withholding notification. It may be that an upper limit on delayed notification may not be feasible in all instances and cannot be rigidly applied, particularly if that upper limit frustrates the purpose of the surveillance. Further, imposing a “life and limb” restriction in all instances may not be feasible, given the nature of the threat to national security giving rise to the surveillance.

Not prescribing a more precise definition of “national security” allows for law enforcement agencies to motivate for a range of risks falling within the RICA framework. See the responses above on the application process and the judge’s consideration of the application.

On the issue of RICA judges providing reasons for their decisions to the subject of surveillance, this is an issue which the Department will consider in tandem with the content of post-surveillance notifications. The proposed recommendation introduces the idea of a Review Tribunal and delves into issues for a broader review of RICA. It is understood that this request is based on the review or appeal of that decision, which the subject of surveillance can undertake once they are notified. The release of information will have to be managed in order not to pose a threat to the purposes of RICA, while also protecting privacy rights of the subject of surveillance.

Clause 7

Insertion of section 37A – Management of data

Jane Duncan

Including these procedures in regulations without adequate guidance in primary legislation is inadequate in that it moves the legislative process into a subsidiary process that is unlikely to be ventilated to the extent that legislative changes in the Parliamentary process are.

Recommendations

The section around the management of data needs to be reconsidered as it does not provide sufficient detail to meet the requirements of the Constitutional Court judgment;

Where information is retained and examined for purposes other than the destruction of the material, and it is material that contains confidential journalistic material or identifies a source of journalistic material, then the judge must be informed;

Any details not dealt with in primary legislation should be included in regulations that are gazetted and released for public comment.

The Department is of the view that it is permissible for the Act to contain the principles within which the regulations must be made. The regulations will provide for the procedures to implement the required the provisions. The process of making regulations involves public consultation. Therefore, the submissions made by the public are taken into consideration. Regulations can be subjected to the same level of scrutiny in terms of its legality as primary legislation.

Clause 9

Laws amended

Jane Duncan

There is insufficient guidance provided on the reporting requirements and what reports should contain. As a result, reports have varied hugely in terms of the amount and type of information, making comparisons across the tenures of several judges difficult.

The standards contained in an international civil society document (Necessary and Proportionate Principles) for transparency reporting could be considered for reporting.

Reporting should be separated from authorisation, which raises the question of the need for an independent reporting mechanism – this could be given to the Inspector General of Intelligence than creating an entirely separate reporting mechanism.

Recommendations:

The standards for reporting proposed in the Necessary and Proportionate Principles could be considered as the baseline reporting standards for the Rica judges;

Consideration should be given to making the Inspector General of Intelligence responsible for reporting on Rica intercepts to Parliament.

The comments are noted and will be considered during the process to overhaul RICA.

GENERAL COMMENTS ON BILL

COMMENT

DOJ PROPOSAL/COMMENTS

RE: SIM-CARDS

Baker McKenzie on behalf of Premium Ideas South Africa (Pty) Ltd (PISA)]

PISA is South Africa's largest specialised telecommunications SIM-card fulfilment house, performing inter alia, SIM-card packaging and logistics services. A large part of PISA's business comprises the packaging of prepaid SIM-cards for large mobile network operators (MNOs) classified as "electronic communications service providers" under the Regulation of Interception of Communications and Provision of Communication-Related Information Act (RICA).

There is a need for further amendments to RICA which are not included in the Bill to address certain shortcomings or loopholes in RICA.

RICA directly applies to and regulates MNOs regarding their obligation to process, record, store and verify certain information of their customers before activating any SIM-card. The particular obligations are set out in section 40 of RICA.

There are loopholes in RICA in that proliferation of unpackaged, duplicated and/or pre-RICA'd SIM-cards and the consequences of this are that—

1. MNOs are unable to assist law enforcement authorities in intercepting communications.
2. government and law enforcement officials are hamstrung in their duties to prevent the illegal transfer of funds.
3. it does not facilitate the adequate monitoring and containing of AML risks and compliance with global AML/CTF policies.
4. the proliferation of unregistered SIM-cards in such significant numbers as described in this submission could have the contrary, yet equally perverse, effect of inadvertently extending the State's surveillance capabilities, which is contrary to the purport of the AmaBhungane judgment.

Recommendations:

Distribution of SIM-cards must be reviewed.

Premium Ideas South Africa (PISA)

Trends observed regarding declining RICA compliance, with various roleplayers abandoning the effort to provide SIM cards in a secure packaging solution. This trend has implications for crime prevention and global perceptions in being removed from the “greylist”.

Understand the limited purpose of the amendment in light of the Amabhungane case, but believes that non-compliance and related shortcomings should be dealt with by the Committee.

Widespread dissemination of inadequately protected SIM cards creates a substantial risk, which subverts the intent of RICA and places consumers at risk.

MNOs are best placed to play a significant role in stopping the dissemination of improperly packaged SIM cards. Growing public scrutiny of MNOs in relation to the proper enforcement of RICA.

There are currently two skewed incentives that affect SIM card distribution: cost-saving for manufacturers and incentive payments for service uptake (i.e. activating new SIM cards), which motivate shortcuts. There should be a cost for noncompliance with RICA that counteracts these incentives and promotes the security measures necessary for RICA’s purposes. Another trend is that of “pre-RICA’ed” SIM cards, disseminated at the point of sale. This means that a distributor has been through the RICA registration in the name of a person other than the buyer. This circumvents the purposes of RICA as the SIM is untraceable to the user. This can be eliminated through the proper packaging of SIM cards.

Suggests that legislation should specify the minimum standards for packaging, security features and verification protocols of SIM cards.

References FICA and the Cybercrimes Act as being relevant to MNOs and their responsibilities.

The comments are noted. The same comments were made in the Portfolio Committee on Justice and Correctional Services. The submission relates to an issue which has been raised in the government cluster consultations and thus identified for consideration during the comprehensive review of RICA, which has been initiated.

It is important to note that the Department is considering not only the proper packaging of SIM cards in dealing with the proliferation of illegally registered SIM cards, but it is also looking more broadly at the entire value chain and all roleplayers in the SIM registration process.

Also, RICA does provide for offences and penalties for noncompliance with its provisions in section 51. In particular, section 51(3A) (3B), (3C) and (3D) deal with the offences and penalties for noncompliance with the SIM registration process set out in Chapter 7.

RE: REFERRAL OF THE BILL TO THE JOINT STANDING COMMITTEE ON INTELLIGENCE

V L Mashava (Attorney of the High Court in Personal & Stakeholder Capacity)

The commentator is of the view that the Department was obliged to refer the Bill to both the Portfolio Committee and the Joint Standing Committee on Intelligence (JSCI) for dealing with the Bill in succession (i.e. Portfolio Committee then the JSCI), and not in a joint sitting.

The comment is noted. However, the Department is of the view that the referral of Bills to the Parliamentary Committees is not the responsibility the Department, but of the Speaker of the National Assembly and the Chairperson of the NCOP should they deem it necessary. The Department cannot recommend through which Committee in Parliament the Bill is processed, as that is the decision of Parliament.  Further, the JSCI does not process legislation and its proceedings are not open to the public. It is unclear what purpose the deliberation of legislation under these circumstance would have.  The Chair and majority of members of the JSCI are members of the National Assembly and there was no objection from any of them when the Bill was tabled for approval in the National Assembly.  In addition RICA deals with the issuing of interception orders by the designated judge, the review of these orders  and the post subject notification by the judge.  These are administrative decisions and are not “intelligence and intelligence related activities”.Adv Mashava has also referred to Rule 123 of the NA Rules which is incorrect as Rule 123 deals with Motions without notice. In any event the JSCI is a Joint Committee of both Houses and does falls under the Joint Rules not the Rules of either house.

RE: PROCESS

V L Mashava (Attorney of the High Court in Personal & Stakeholder Capacity)

The order requires the Department to “adequately provide safeguards” to address the ex parte nature of the applications and interception directions procedure. This would, logically, require the Department to consult with relevant stakeholders, particularly experts, in order to outline draft stipulations to give effect to this aspect of the order of invalidity.

Jane Duncan

The Bill should have been preceded by a review and a discussion paper setting out a comprehensive policy framework – deal with all amendments beyond the judgment as Rica is an outdated piece of legislation and no longer fit for purpose.

Rica needs to be reviewed in a comprehensive fashion, which the Department has acknowledged, and the Department should commit to a deadline in this regard.

The process of legislative drafting within the Executive requires consultation with key stakeholders, which has been undertaken in respect of key government stakeholders. The Parliamentary process requires public consultation and this process has been followed.

The Department has begun reviewing RICA and has committed timeframes to the Portfolio Committee. The Portfolio Committee, in its report to the National Assembly, urged the Department to introduce the comprehensively reviewed RICA by the end January 2025. The Department proposed this timeframe based on the extensive nature of the work to be undertaken. The Department indicated that it will finalise the initial consultation process by end March 2024 and publish a Bill for consultation during July 2024 with a view to introducing the Bill in Parliament by the beginning of 2025. The consultation and research process is currently underway.

RE: SECTION 205 OF THE CRIMINAL PROCEDURE ACT

Jane Duncan

The Bill is missing an opportunity to address possibly the most serious surveillance control and oversight issue, relating to section 205 of the Criminal Procedures Act. Section 15(1) of RICA allows for the use of other procedures for obtaining real-time or archived communication-related information, and this had led to the preferred option of section 205 being used extensively for law enforcement purposes. In 1999, the South African Law Commission recommended that the main surveillance law (at that stage the 1992 Interception of Communications Act) should be the only law authorising requests for call-related information.

Recommendations:

Rica could be amended in s. 15(1) to make it clear that if procedures are used in any other Act for obtaining real-time or archived communication-related information, then the Rica standards apply, including the need to make usage of metadata an investigative method of last resort and to confine the applications to serious crimes;

Mobile network operators could become responsible for providing statistics about the number of subpoenas granted to the Rica judge, and for the Rica judge could include these in the annual report to Parliament.

The comment is noted and will be dealt with during the process to overhaul RICA.

Furthermore, the provision (section 205) is also under discussion in the South African Law Reform Project relating to the review of the Criminal Procedure Act which is underway.

S Tau

Indicates approval for the Bill, which aims to establish comprehensive regulatory measures to govern the interception of communications and the management of communication-related information while incorporating safeguards to protect the rights and privacy of individuals.

The comments received repeats the intention of the provisions of the Amendment Bill without providing any substantive comments and inputs thereon.

The comment is noted.