In early 2021, the South African Constitutional Court found that the country’s State Security Agency, through its signals intelligence agency, the National Communication Centre, was conducting bulk interception of electronic signals unlawfully.
Bulk interception involves the surveillance of electronic signals, including communication signals and internet traffic, on a very large scale, and often on an untargeted basis. If intelligence agents misuse this capability, it can have a massive, negative impact on the privacy of innocent people.
The court found that there was no law authorising the practice of bulk surveillance and limiting its potential abuse. It ordered that the agency cease such surveillance until there was.
In November 2023, the South African presidency responded to the ruling by tabling a bill to, among other things, plug the gaps identified by the country’s highest court. The General Intelligence Laws Amendment Bill sets out how the surveillance centre, based in Pretoria, the capital city, should be regulated.
I have researched intelligence and surveillance for over a decade and also served on the 2018 High Level Review Panel on the State Security Agency. In my view, the bill lacks basic controls over how this highly invasive form of surveillance should be used. This compromises citizens’ privacy and increases the potential for the state to repeat previous abuses. I discuss some of these abuses below.
The dangers
Intelligence agencies use bulk interception to put large numbers of people, and even whole populations, under surveillance. This is regardless of whether they are suspected of serious crimes or threats to national security. Their intention is to obtain strategic intelligence about longer term external threats to a country’s security, and that may be difficult to obtain by other means.
Former United States National Security Agency contractor Edward Snowden’s leaks of classified intelligence documents showed how these capabilities had been used to spy on US citizens. The leaks also showed that British intelligence spied on African trade negotiators, politicians and business people to give the UK government and its partners unfair trade advantages.
In the case of South Africa, around 2005, rogue agents in the erstwhile National Intelligence Agency misused bulk interception to spy on senior members of the ruling African National Congress, the opposition, business people and civil servants. This was despite the agency’s mandate being to focus on foreign threats.
These rogue agents were able to abuse bulk interception because there was no law controlling and limiting how these capabilities were to be used. A 2008 commission of inquiry, appointed by then-minister of intelligence Ronnie Kasrils, called for this law to be enacted. The government refused to do so until it was forced to act by the Constitutional Court ruling.
The government justified its refusal to act by claiming that the National Communication Centre was regulated adequately through the National Strategic Intelligence Act. The court rejected this argument because the act failed to address the regulation of bulk interception directly.
What the Constitutional Court said
The 2021 Constitutional Court judgment did not address whether bulk interception should ever be acceptable as a surveillance practice. However, it appeared to accept the agency’s argument that it was an internationally accepted method of monitoring transnational signals. But the legitimacy of this practice is highly contested internationally. That’s because this form of surveillance usually extends far beyond what is needed to protect national security.
The court indicated that it would want to see a law authorising bulk surveillance that sets out “the nuts and bolts of the Centre’s functions”. The law would also need to spell out in
clear, precise terms the manner, circumstances or duration of the collection, gathering, evaluation and analysis of domestic and foreign intelligence.
The court would also be looking for details on
how these various types of intelligence must be captured, copied, stored, or distributed.
What the amendment bill says
The amendment bill provides for the proper establishment of the National Communication Centre and its functions. This includes the collection and analysis of intelligence from electronic signals, and information security or cryptography. A parliamentary ad hoc committee has set a deadline of 15 February 2024 for public comment.
The bill says, in vague terms, that the centre shall gather, correlate, evaluate and analyse relevant intelligence to identify any threat or potential threat to national security. But it doesn’t provide any of the details the court said it would be looking for. This is a major weakness.
The bill has one strength, though. It states that the surveillance centre needs to seek the permission of a retired judge, assisted by two interception experts, before conducting bulk interception. The judge will be appointed by the president, and the experts by the minister in charge of intelligence. The position is located in the presidency.
However, it does not spell out the bases on which the judge will take decisions. The fact that the judge would be an executive appointment also raises doubts about his or her independence.
Inadequate benchmarking
The bill fails to incorporate international benchmarks on the regulation of strategic intelligence and bulk interception in a democracy. These require that a domestic legal framework provide what the European Court of Human Rights has referred to as “end-to-end” safeguards covering all stages of bulk interception.
Read More: From self-driving cars to military surveillance: quantum computing can help secure the future of AI systems
The European Court has stated that a domestic legal framework should define
- the grounds on which bulk interception may be authorised
- the circumstances
- the procedures to be followed for granting authorisation
- procedures for selecting, examining and using material obtained from intercepts
The framework should also set out
- the precautions to be taken when communicating the material to other parties
- limits on the duration of interception
- procedures for the storage of intercepted material
- the circumstances in which such material must be erased and destroyed
- supervision procedures by an independent authority
- compliance procedures for review of surveillance once it has been completed.
The bill does not meet these requirements.
Incorporating these details in regulations would not be adequate on its own, as the bill gives the intelligence minister too much power to set the ground rules for bulk interception. These rules are also unlikely to be subjected to the same level of public scrutiny as the bill.
The fact that the presidency is attempting to get away with the most minimal regulation of bulk interception raises doubt about its stated commitment to intelligence reform to limit the scope for abuse, and Parliament needs to correct the bill’s clear deficiencies.
- is a Professor of Digital Society, University of Glasgow
- This article first appeared in The Conversation
