/ 21 June 2013

Spy wars: South Africa is not innocent

Spy Wars: South Africa Is Not Innocent

South Africa spies on visiting foreign officials and diplomats to gain the advantage in negotiations, just as Britain spied on South African delegations to multi­lateral events, and as does every other country with the ability to do so.

The Guardian revealed earlier this week that South African politicians and senior officials were spied on and bugged by Britain during the G20 summit in London in 2009.

And, much like the United States, South Africa spies on its own citizens illegally, and continues to do so despite knowing the spying cannot be justified under the Constitution. That includes listening in on the conversations had by specific people, supposedly individuals who require watching, but also extends to the bulk harvesting of information about  law-abiding citizens – with little to nothing in the way of oversight or assurances that the data will not be misused, and a history of exactly such misuse.

Read more

SA knew UK was spying on it in 2009
Law cannot keep up with spying tech
Ten things about surveillance
Spying: SA's outcry over spying rings hollow

At the heart of the system of surveillance in South Africa is the secretive National Communication Centre (NCC), which remains largely unregulated and free of oversight, while Parliament continues to fret about what its legal status should be.

Unlike the cases in Britain and the US, however, such spying in South Africa was not exposed by a whistle-blower or on the basis of leaked documents, but through official, public government documents that arose from the last major crisis of confidence in the methods and actions of intelligence agencies.

Virtually everything that governs the workings of the South African spy agencies is secret: their finances, audits relating to those finances, the rules under which they operate, oversight reports on whether they comply with such rules, and details on what it is they actually do. That makes it impossible to be sure exactly how much surveillance is conducted of foreign diplomats and ordinary citizens, or how much of that surveillance is unjustifiable.

Yet especially egregious cases of abuse, particularly what is still referred to as "the intelligence crisis of 2005-2006", have, over the years, provided rare glimpses into the world of telephone interception and counter-intelligence – glimpses that show South Africa is not in a position to object too vociferously to British attempts to spy on government ­ministers, or to claim the moral high ground on America's dragnet surveillance techniques.

Turbulent years
Ronnie Kasrils is better placed than most to know that: He was intelligence minister for four of the more turbulent years of South Africa's spy apparatus, from 2004 to 2008, and is now a prominent critic of laws around secrecy and spying.

His insider knowledge also makes it illegal for him to respond directly to, say, questions on the type of ­telephone interception conducted in South Africa. However, he can speak generally.

"Let me say this to you," Kasrils said this week, "should anybody be surprised, anywhere in the world … that with the enormous technological ability that any developed country has today, would you be surprised about revelations relating to prying into foreign countries, into one's own citizens, never mind foreign citizens? The ability is there."

It is a sentiment often repeated by a wide array of former intelligence officers, policymakers and those who have access to briefings produced on the basis of telephone intercepts: Of course South Africa uses the abilities at its disposal.

"We used to do it. We still do it. It would be a scandal if we didn't do it," said a former intelligence operative.

A former reviewer of intelligence protocols said: "Are we spying on neighbouring states? Of course we are spying on neighbouring states."

Constitutional provisions
What fewer people are willing to speak about is the techniques used, including dragnet-style monitoring of wide swathes of the communication between citizens in South Africa.

At the centre of that monitoring is the NCC, a central facility originally intended to intercept foreign traffic (such as satellite communication), but which also engages in ill-defined "environmental scanning", and apparently routinely analyses communications to establish the ­personal networks of individuals.

The NCC operates outside the law and has, in the past, done so with the assumption that it need not comply with constitutional provisions to protect privacy and dignity, which can be infringed only when reasonable and justifiable.

Environment scanning has benign application, as shown by a report into the recent furore around the landing of a private plane at the Waterkloof Air Force Base, for the convenience of guests to a wedding in the well-connected Gupta family.

In that case, the government said, the State Security Agency conducted analysis of freely available information, such as comments on phone-in radio shows and on social media, to determine how the public felt about the controversy.

But it also entails "random monitoring of signals", as defined in one review of the lack of rules around the NCC, "through its bulk monitoring capability".

Within the intelligence community, legend has it that the NCC is capable of monitoring every phone call made within South Africa, and of automatically flagging those in which pre-selected keywords occur.

Outside experts concur that monitoring would not only be possible, but easy. By law, communication providers must put in place infrastructure to allow monitoring of traffic on their networks, at their own cost. But those involved in the complex field of language recognition say South Africa's bewildering array of languages and accents, combined with the inevitable interference on telephone lines, would make it very hard to monitor all telephone ­conversations simultaneously for specific words or phrases.

Non-targeted information
Extracting other data is considerably easier.

In a 2008 report on intelligence agencies, a ministerial review committee established by Kasrils disclosed that he, as then minister of intelligence, had decreed that "non-targeted information generated by environmental scanning" can only be retained for up to three days "for evaluation and data-mining". In other words, information relating to innocent citizens caught in the dragnet had to be discarded.

But it is not clear that the policy survived Kasrils's departure from the post, or that it was ever implemented, or how it was interpreted.

Thanks to various leaks about similar surveillance in the US, it is now known that the South African government used similar techniques to monitor who phones whom in order to create network diagrams showing the links between individuals. Such links have, in the past, uncovered the sources of leaks from within government structures. South Africa has considerable expertise in that field, and has exported software necessary for the analysis to other countries. That means information on who phones whom can be discarded – but not before data-mining uncovers connections in the data.

"Give me enough metadata [information about communication, but not the actual content of the communication] and I can tell you who is having an affair or is looking for another job," said an expert in network analysis.

Project Avani, the operation uncovered in 2006 in the hoax e-mail saga, started off as environmental scanning before being subverted by what was later found to have been faked e-mails and chat room logs. It did not end before surveillance, both physical and through telephone intercepts, had been conducted of businessmen, journalists and politicians, none of whom was ever found to have engaged in nefarious activities.

Such spying was illegal then and would be illegal today, but is almost certainly still taking place.

In dealing with intelligence agencies in 2008, the ministerial review group was confronted by spymasters who argued, in Orwellian fashion, that not all interception counts as interception, and that laws meant to restrict the reach of interception cannot be applied to intelligence work.

An earlier task team warned that intelligence agencies still held vestiges of a pre-1994 "culture of non-accountability" and used "a no-holds-barred approach" – but in the same breath argued that operatives should know that it is acceptable to bend the rules to achieve results.

That much was made clear five years ago, in the report commissioned by Kasrils, and controversially made public just as the Mbeki administration was replaced by the Zuma administration. With a dearth of information ever since, it is conceivable that the culture and methods within security agencies have changed. Conceivable, but unlikely.

"We don't know," said Laurie Nathan, an academic with a focus on conflict resolution who was one of the people who drafted the 2008 report. "And we have no way of knowing in the absence of adequate transparency."

But considering the marked shift towards more of a security focus since 2008, Nathan said, the message to spooks is more likely to lean towards getting the job done than to worry about legal niceties.

"The debate [around intelligence] is, to put it crudely, between effectiveness and accountability. The previous minister [of intelligence, Kasrils] emphasised accountability and transparency. The current minister emphasises effectivity."