Government accesses the call records of more than 70 000 phone numbers in South Africa per year, according to the Right2Know Campaign, citing statistics from Vodacom, MTN, Cell C and Telkom.
“These numbers show that, at a minimum, law enforcement agencies are spying on the communications of at least 70 000 phone numbers each year,” Right2Know said in a statement on Wednesday.
The organisation asked the four big telecommunications operators in May how many warrants they receive in terms of section 205 of the Criminal Procedures Act. “These requests aimed to understand how a legal loophole has allowed surveillance operations to take place using the Criminal Procedures Act, rather than the Rica law.”
Right2Know said section 205 allows law enforcement officials to bypass Rica, which requires a special judge to agree, to get access to get phone records showing who users have communicated with, when, and where.
“According to this law, any magistrate can issue a warrant that forces telecoms companies to give over a customer’s call records and metadata,” the organisation said.
“Policymakers are wrong to assume this information is less sensitive or private than the contents of the communication: metadata can reveal as much, if not more, about a person’s contacts, interests and habits than what they say over the phone or in a text message.”
When a person’s communications information is handed over using section 205, they are never notified, even if the investigation is dropped or if they are found to be innocent, it said.
Rica
“Rica is meant to be South Africa’s primary surveillance law. It requires law enforcement and intelligence agencies to get the permission of a special judge, appointed by the president, to intercept a person’s communications.
“To apply for this warrant, they need to provide strong reasons because such interceptions threaten people’s right to privacy so much. But policymakers have wrongly assumed that the information about the communication (such as the identity of who you have communicated with, when, and your location) is less sensitive than the content of the communication.”
Due to “incomplete records” (only Vodacom and Telkom could say how many phone numbers were contained in the warrants it received), the actual number is estimated to be much higher than 70 000, Right2Know said.
In 2016, MTN received 23 762 warrants for customers’ call records, while Vodacom got 18 594 warrants, Cell C 6 455 and Telkom 1 271.
The most recent statistics from the Rica judge’s office show that in 2014/2015, the judge issued 760 warrants for interception. At a minimum, in the same year magistrates issued 25 808 warrants in terms of the Criminal Procedures Act.
“These statistics confirm for the first time that the vast majority of ‘authorised’ surveillance operations are happening outside of the Rica judge’s oversight, with no transparency or accountability,” Right2Know said. “Urgent reforms are needed for South Africa’s surveillance policies.”
The organisation wants:
- Call records to be given better protection. Metadata about communication (information about who was contacted, when and where) must be given the same level of protection as the content of communication. Interception of this information should only be authorised by a specially appointed judge with special insight on privacy protections and digital rights. The Rica judge is a specialist judge who must be specially positioned to weigh the interests of justice against the right to privacy. Magistrates and ordinary judges, on the other hand, may not be as sensitised to the privacy issues involved in deciding whether to release metadata records. This should not be authorised at the lower levels of our court system. The section 205 loophole should be closed immediately.
- An end to mass storage of customers’ data. Rica requires telecoms companies and Internet service providers to store all users’ metadata, including websites visited, for three to five years. This means even people who are not suspected of any crime are already being treated with suspicion.
- An end to Sim card registration. This violates privacy in that it limits the ability of citizens to communicate anonymously. It also facilitates the tracking and monitoring of all users by law enforcement and intelligence agencies.
- Greater transparency. Private companies should be publishing regular, detailed transparency reports about their role in interceptions, and the Rica judge must publish a much more detailed report, and it must be tabled in open parliament.
- Users to be notified when their data has been intercepted. This is a legal requirement of many surveillance laws across the world. The current situation is ripe for abuse, as people who are targeted for surveillance have no way of knowing that their rights have been violated. Only under exceptional circumstances should the judge have the power to delay notifying a user that their data has been intercepted.
“The Right2Know Campaign will not relent on challenging surveillance abuses. The people of South Africa can and will take back control of their privacy,” it said. — © 2017 NewsCentral Media
