/ 20 April 2017

Surveillance: The silent spy on citizens and journalists faces court challenge

Zuma is expected to experience severe backlash to any changes to the cabinet.
Zuma is expected to experience severe backlash to any changes to the cabinet.

“Is your phone tapped?” people often ask me. That’s because they’re aware I am involved, through the amaBhungane Centre for Investigative Journalism, in sensitive investigations of state and corporate malfeasance.

“I don’t know, but I assume it is,” is always my answer.

I’m not certain I am being monitored, but I have a pretty good hunch I am because, unlike most surveillance targets, I know my phone calls were recorded at one time.

How do I know? Jacob Zuma told me, through his lawyer Michael Hulley.

It happened like this.

In 2009, when rumours of the so-called “spy tapes” started to surface in the midst of the campaign to have corruption charges against Zuma dropped, some of his acolytes boasted to me about how I featured on various recordings they had access to.

When acting National Director of Public Prosecutions Mokotedi Mpshe announced his decision to revoke the prosecution of Zuma, he cited only a tiny sub-set of the full recordings, which had been derived from official surveillance carried out by the police and national intelligence organs.

Those intercepts quoted by Mpshe featured Leonard McCarthy, then the head of the Scorpions, and not little me, so the proof that I was tapped remained frustratingly out of reach.

Not even the Democratic Alliance’s years-long efforts to gain access to the spy tapes delivered the goods for me, but their bid to have charges against Zuma reinstated finally shook something loose.

Hulley, demonstrating the Zuma camp’s superior access to the intercepted material, attached a transcript of conversations between advocate Billy Downer and myself to his court papers opposing the DA’s effort to have Mpshe’s decision overruled.

The conversations dated back to 2008, when Downer was the senior advocate leading the National Prosecuting Authority’s team investigating Zuma on charges relating to the arms deal.

Hulley unsuccessfully tried to make something of the rather tame exchanges to bolster Zuma’s argument that the prosecution was tainted.

But he provided me – and amaBhungane – with the proof we needed to start probing the legal architecture and oversight of the state’s surveillance regime.

It was the catalyst for the groundbreaking constitutional challenge we are mounting, beginning this week, to the way in which the state spies on us – and also on you.

The first thing to note is that this is not about me – and has never been (though it is galling think that the state has had this intimate access to your professional and private life).

The core issue is that legislation governing legal interception, the Regulation of Interception of Communications and Provision of Communication-Related Information Act (Rica), was conceived when most people thought of monitoring communications as being a rare right granted by a judge to officer Koekemoer or agent Sithole to tape and listen in on the conversations of criminals and terrorists.

This conception was outdated even when the law was passed in 2002  – and now it is light years away from the reality of modern signals intelligence.

The law’s safeguards, inadequate then, are dangerously weak now.

That’s because the scale and reach of technology has grown dramatically. Increasingly, we live our lives online and that reality has ushered in a global information ecosystem where surveillance and propaganda have been digitally weaponised.

The disclosures of United States whistleblower Edward Snowden revealed what is technically possible.

In the words of Glenn Greenwald, the journalist to whom Snowden leaked his material, Snowden has demonstrated that “the US and its closest allies are trying to build a surveillance system that has as its primary objective the elimination of privacy globally, by which I mean that everyone’s communications electronically will be collected, stored, analysed and monitored”.

The scale of the US collection programme is staggering. So much data is collected that the raw contents can’t be kept very long, though selections of interest are.

But metadata is already stored for five years or more. Metadata – typically from cellphones – is the record of each call. That means the date and time and duration of the call and the number to which it was made, as well as the location of the cellphone at the time.

Cellphones have been correctly dubbed “the spy in your pocket” – they are the most ubiquitous tool for human surveillance ever conceived.

As well as call-logs, cellphones continuously deliver location data to the network, telling someone with access to that information where the phone is to within a few meters.

Combine that information with logs of an individual’s total online activity – the websites visited, electronic payments of whatever kind, email contacts – and you have a detailed picture of someone’s life.

It’s not just someone’s life: the surveillance of whole populations is now within reach.

As we have known since the days of George Orwell’s 1984, even the possibility or suspicion of being monitored can have a chilling effect on free speech and association.

The Americans may be far advanced, but lesser states will follow. When the government of Libya’s Muammar Gaddafi fell, the rebels discovered equipment for capturing, storing and searching all calls going into or out of the country.

The equipment was made by a South African company called Vastech.

Our own legislation requires a warrant issued by a judge to allow legal interception inside the country, but the situation regarding metadata is less clear. Cellphone call records, for instance, can fairly easily be obtained by a police officer on application to a local magistrate in the course of a criminal investigation.

In any case, the evidence suggests that the legal requirements are quite easily sidestepped, not only by state players but also by private entities who use commercially available surveillance tools or bribe communications company employees who have access to the data.

There are a number of cases on record where the police have substituted the telephone numbers of persons of interest – such as journalists – and hidden them among the numbers for genuine targets. The judge or magistrate is none the wiser.

And our own State Security Agency is not subject to any restrictions on communication that has a leg outside the country.

That means all cross-border communication, but it also means Gmail, Facebook, Skype, Whatsapp and the like – because, even though both parties may be inside South Africa, communication is routed through external computer networks and servers.

For journalists, the ease with which surveillance can be used to reveal sources represents a special threat to the flow of confidential information – which is the life-blood of accountability journalism.

Already it is virtually standard practice for both sources and journalists in South Africa to insist on removing their cellphone batteries before a meeting, because of the ease with which phones can be hacked and turned into listening devices.

Propaganda is the other side of the surveillance coin.

Messages, including “fake news”, can be tailored and directed to exploit what surveillance reveals – also on a mass scale.

Recent events, such as the election of Donald Trump as US president, have shown us that this technology can now be used to achieve political outcomes – the technology makes the manipulation of populations possible in ways that undermine our basic understanding of the authenticity and authority of the popular will, of democracy itself.

Against this backdrop amaBhungane has launched a legal challenge to Rica, to try to strengthen safeguards against the abuse of this powerful tool.

Constitutional challenge

The amaBhungane Centre for Investigative Journalism has launched a constitutional challenge to the Regulation of Interception of Communications and Provision of Communication-Related Information Act (Rica).

Rica serves as the basis for the lawful interception of citizens’ communications, but we contend that there are fundamental flaws in the law and that various sections are inconsistent with the Constitution.

We are going to court, starting with the high court in Pretoria, to strengthen the protection of citizens – and journalists – against the potential abuse of this necessary but intrusive legislation.

Our complaints fall into two categories: first, the areas where Rica regulates surveillance, but does so in an inadequate manner; and, second, where it fails to regulate certain monitoring activities.

Weak Regulation
Where Rica does regulate, there are five main constitutional flaws:

  • First – and this is a fundamental problem – the target of the interception order is never informed of the order, even after the period of interception has ended and even after any investigation has been concluded.

It is like a search warrant that is executed at your home while you are away, but you are never informed and everything is put back very carefully so you never know it happened.

Because of this, we argue, the target of an interception order is never granted the opportunity to test whether the intrusion was lawfully approved – and on the basis of a reasonable suspicion.

It would defeat the purpose of interception if the targets knew they were being monitored, but we argue that once the need for secrecy has passed, targets of interception should be informed and given the right to challenge the order in retrospect.

  • The second constitutional flaw concerns the Act’s silence on the correct procedure to be followed when state officials are examining, copying, sharing, sorting through, using, destroying and/or storing the data obtained from the interceptions.

Scooping up someone’s communications is an intimate violation of their privacy, but there are no legal safeguards concerning what happens with the data, who may have access to it and what they can do with it.

Where the interception is found to be irrelevant or of no probative value, there is no certifiable procedure for the data to be destroyed.

  • *The third constitutional flaw concerns mandatory data retention by telecommunications service providers. The Act requires that private companies must keep metadata – the who, when, where of communications, but not the content – for at least three years. But it does not provide for any oversight mechanisms to control access to, and ensure the protection of, that information.
  • The fourth constitutional flaw concerns deficiencies in the regime for oversight by the retired judge nominated to rule on interception applications, including that there is no adversarial process under Rica when applications are considered.
  • The fifth constitutional flaw concerns the failure adequately to protect those targets of interception that have a legal duty to protect the confidentiality of communications and sources, such as lawyers and journalists.

No Regulation
There is a second category of problems with Rica, in that it does not regulate certain kinds of interception.

  •  The law is under-inclusive because it does not cater for the regulation of “bulk interception”. Bulk interception is what is termed “environmental scanning”, which uses computers to scan massive flows of data, rather than targeting identified persons.

The scanning will flag and save communication that contains key-words or numbers or other kinds of electronic signatures that are of interest to the intelligence community. This material is then available for further scrutiny.

  • Second, Rica is under-inclusive because it does not provide any approval mechanism regarding interception or surveillance of “foreign signals”.

According to the practice of the intelligence community, this communication is monitored without any warrant.

Where any part of the communication occurs via a system that is outside the borders of the Republic, that is defined as foreign and treated as “fair game” for surveillance.

Communications infrastructure has globalised to the point where it hardly makes sense to distinguish between local and foreign.

This directly affects citizens not only where one party to a communication is located in South Africa and one outside, but also where both are located in South Africa and using a foreign network, such as Gmail.

Finally, we are not arguing that the interception of communications is, in all circumstances, unconstitutional and impermissible.

It remains a vital intelligence-gathering and policing tool.

But we say that because the interception and surveillance inevitably limit fundamental rights, such as privacy, it is essential that these procedures be subject to a series of stringent checks and balances.

The founding papers were served on the ministers of justice, police, state security and communications, as well as other interested parties, this week.

You can read the full application HERE.

The amaBhungane Centre for Investigative Journalism produced this story. Like it? Be an amaB supporter and help us do more. Know more? Send us
a tip-off.