/ 10 March 2010

Rica: ‘Let common sense prevail’

The Regulation of Interception of Communications Act (Rica) is not just for those with cellphones — it affects all internet users too.

Whether you get your internet through your phone line from a service provider (iBurst, MWeb, Neotel) or through a data card on your cellphone, section 40 of Rica says that you must be registered in terms of the Act.

Rica makes it compulsory for everybody with cellphones, everybody buying a new SIM card, and all broadband internet users to register at their service provider with proof of residence and their identity document or passport. It was introduced to help fight illegal activities, particularly organised crime, where the criminals buy cheap pay-as-you-go SIM cards that cannot be traced.

But while Rica-ing your cellphone number may be a matter of simply visiting the local branch of your mobile service provider, customers of internet service providers (ISPs) may find the process somewhat more challenging.

Rica stipulates that the ISPs must personally verify the documents that their customers are required to submit before a service can be activated. But many ISPs are online businesses, which means they sign up customers and maintain relationships with them over the internet.

“An ISP may be based in Cape Town but provide internet access to the whole of South Africa. It is not clear — how such an ISP will be able to verify Rica documentation in person where its customers are hundreds or thousands of kilometres away,” said Dominic Cull, regulatory adviser to the Internet Service Providers’ Association of South Africa (ISPA), in a press release.

Rica a long and costly process
Cull claimed that the registration of cellphone users is costing the mobile service providers a “massive” amount of money, and that it appears the process will not be completed by the end of December 2010.

“If the mobile providers are struggling to comply with personal verification then it follows that personal verification will be close to impossible for ISPs to comply with. Most of our members have a purely online relationship with their customers since they do not provide a physical component for their services, such as a SIM card,” said Cull.

Tlali Tlali, spokesperson for the Department of Justice, told the Mail & Guardian it was aware there will be challenges with the implementation of Rica.

“It is the responsibility of the service providers to ensure compliance with Rica. We are not naïve to the fact that there will be challenges, but this is not an excuse for failure to comply. But we will deal with each situation as it arises, on its own merits.”

Help for ISPs
The ISPA has noted that the Department of Justice has taken “a number of steps” to address its concerns about the logistics of customer registration and verification; “In particular, the amendments to section 39 of Rica that will allow ISPs to use agents to verify customer documents.”

But the ISPA questioned why Rica did not allow the verification of documents in electronic format when the Electronic Communications and Transactions Act of 2002 created a framework to do this. “South African law clearly provides for verification of documents in electronic format, and the ISPA is not sure why this framework is not being used for customer registration under Rica.”

Tlali explained that some things are still under consideration, and details were still being worked out. He added that meetings will be held with all stakeholders on a six-monthly basis to discuss the situation with regards to implementation of Rica across the sector.

“We do not want to cause inconvenience to anyone; we want to be flexible, but without compromising on the terms of the Act. We want to get as much compliance as possible.”

Cull told the M&G that the ISPA has not been involved in any sort of stakeholders’ consultation meeting. “But we would absolutely welcome it,” he said.

Practically speaking
Cull noted that relooking at the definition of an ISP would help to lessen the doubt over who exactly Rica applies to. “If you cut down on the broad definition of ISPs — at the moment it could extend to varsities, offices, and even families — and just make it apply to those companies with licences who provide access to the internet.

“We have no problem with the concept of verification, but we would like common sense to prevail. All ISPs are in a state of uncertainty, a grey area. We’re doing our best but it’s difficult for us to personally verify our customers,” he added.