The first report overlooked by many South Africans in the closing days of 2016 was the annual report of the Joint Standing Committee on Intelligence (JSCI), the multiparty committee responsible for the oversight of the country’s intelligence services.

The second was by Yvonne Mokgoro, until recently the judge responsible for deciding whether to grant or refuse applications for communications interceptions from state spy agencies. The judge reports annually to the JSCI, and is appointed in terms of the Regulation of Interception of Communications and Provision of Communications-related Information Act (Rica).

(See both reports here.)

What makes these reports so significant? They point to us needing to be even more worried than we were about unaccountable state spying on citizens. Last year delivered some pretty damning evidence suggesting that state spying went far beyond protecting the country against genuine threats to national security, and strayed into spying to protect Jacob Zuma’s faltering presidency.

The position of the Inspector General of Intelligence, the executive oversight body of intelligence services, was vacant for close to two years, but was filled towards the end of 2016. Evidence emerged in parliamentary hearings for the position that the spies enjoyed practically a free pass over this period.

Mokgoro has raised the bar in reporting on her work as the Rica judge, providing an unprecedented amount of information about her activities and the challenges she’s faced during her term of office. It remains to be seen if her successor will follow suit. In 2013, for instance, she expressed concern about the intelligence agencies’ lax approach towards Rica applications, as they cut too many corners and made her work more difficult.

On the other hand, the JSCI has typically been as transparent as mud, with most of its work taking place in secret. Mokgoro has also been emphatic about the need for capacity building in state institutions about Rica and its requirements, which undoubtedly has improved compliance.

Mokgoro’s report reveals a sharp rise in the number of interception directions for the year it covers (2013/14). There was a spike in applications in 2010/11, including a huge increase in the number of directions granted to the Crime Intelligence Division (CID) of the South African Police Service (Saps), and a less dramatic but still significant increase in applications by the State Security Agency (SSA).

After this, there were decreases in the application and approval rates for 2012/13, accompanied by an increase in the number of emergency directions, about which Mokgoro also expressed concern at the time. The numbers rose again in 2013/14, although the increases were unremarkable.

For 2014/ 15, though, the number of applications by SSA and CID rose massively, with the SSA registering a particularly large increase. Two new state agencies were also added as applicants: the Financial Intelligence Centre (FIC) and South African National Defence Force (SANDF).

It is difficult to know what to make of these increases. On the surface of things, they could be seen as good news, as more agencies could be choosing to abide by Rica in making their applications rather than going rogue and spying outside the law. However, Mokgoro argues that it is not possible to assess the effectiveness of Rica in bringing down crime as such an assessment is of necessity “highly subjective”. Other factors impact on the success of an investigation, she claims, such as information obtained by other means.

Presumably, she made these arguments in response to an attempt by the South African History Archives to obtain records about the number of directions that resulted in arrests and convictions. If made available, this information could be used to assess whether surveillance is actually bringing down crime levels, or whether the authorities are merely on fishing expeditions. Aggregate information on the nature of the crimes for which directions were granted would also be important to provide.

In the US, the publicly available annual reports on what they call wiretaps include information on the number of arrests and convictions resulting from intercepts. If the US can provide such information, then there is no reason why South Africa can’t, too. In the absence of such information, increases in an intrusive investigative method such as communications surveillance, when its effectiveness is not being assessed, is not good news at all.

Mokgoro’s report confirms a long-standing tendency for the designated judge to refuse only a fraction of the applications, with her being more likely to decline SSA applications than CID applications. This is of concern. In spite of Mokgoro’s criticisms about the quality of applications, she is clearly willing to give the applicants the benefit of the doubt.

This bias towards the applicants is almost inevitable, as Rica ensures that the application process is not adversarial, and is therefore inherently one-sided. The judge pretty much has to take applications on face value. In the past, the judge has been duped into issuing a direction against two Sunday Times journalists: a case that is before the Pretoria Commercial Crimes Court at the moment.

However, if Rica required the presence of a public representative, arguing the case on behalf of users, then the number of refused directions may well increase as the applications would be interrogated.

This bias towards the applicants is made worse by the fact that Rica does not make provision for user notification. In other words, people whose communications are intercepted are never informed that this has happened, even if the investigation has reached a non-sensitive stage. This is in spite of the fact that countries such as the United States, Japan, Austria and Chile do have user notification.

Then there is the fact that the grounds for seeking interception directions in Rica are vague and speculative. This problem led to the police obtaining a directive against Sunday Times journalist Mzilikazi wa Afrika on the grounds that he was gun running in Mozambique, when in fact he travelled to the country to interview a source.

In March last year, the United Nations Human Rights Committee criticised South Africa for inadequate privacy safeguards in Rica. They expressed concern about “…the relatively low threshold for conducting surveillance in the State party and the relatively weak safeguards, oversight and remedies against unlawful interference with the right to privacy [in Rica]”.

Mokgoro does recognise the need for reforms to Rica, though, but the reforms she lists are biased towards the spy agencies. These include the need to ensure that state surveillance keeps pace with technological developments and addresses deficiencies, such as the ease with which criminals can bypass Subscriber Identity Module (SIM) card registration requirements.

She also notes that the growing use of encryption is placing more communications beyond the reach of intelligence agencies. To assess the full extent of the problem, the judge’s report should provide details about the number of interceptions where encryption was encountered.

When combined with information about arrests and convictions, this information will allow basic questions about effectiveness to be answered. So, for argument’s sake, if interceptions are ineffective in bringing down crime, why expand the spies’ powers? In the US, intelligence agencies have vastly overstated the threat of encryption to their investigations, to justify more expansive powers.

Hopefully, in South Africa, and in the absence of hard empirical evidence about the extent of the problem, encryption is not going to be used as an excuse to legalise more intrusive forms of surveillance.

Last year, Britain legalised bulk hacking through its controversial Investigatory Powers Act, to address the encryption challenge. Yet an investigation into the operational case for mass surveillance – which was largely deferential to the arguments of the British spy agencies – found that when they made their case for the surveillance powers they sought, the case for bulk hacking was the weakest of all.

However, Mokgoro’s report remains silent on the legislative reforms needed to address the privacy-violating weaknesses identified by the UN Human Rights Committee. In fact, the judge marks her own homework by deciding on applications and then writing an annual report about them. Rightfully, these two functions should be separated.

Her assumption seems to be that SIM card registration requirements need to be tightened to prevent criminals from obtaining pre-registered SIM. But there are strong arguments that SIM card registration per se is pretty useless for crime-fighting, and in fact creates other categories of crime (such as identity theft).

Also, according to Mokgoro, under Rica the devices utilised by the agencies do not require judicial authorisation. In fact, once they have obtained an interception direction, they can exercise their discretion as to the interception devices they use.

This argument is problematic, as it ignores the international push for judges to regulate particularly intrusive surveillance devices like International Mobile Subscriber Identity (IMSI) catchers (or “grabbers”, as they have become known in South Africa). This is because grabbers inevitably collect more information needed to target specific individuals. In fact, the judge’s report should provide aggregate information about the methods of interception.

Most problematically, Mokgoro’s report remains silent on the state’s involvement in mass surveillance, which, according to a 2008 Ministerial Review Committee on Intelligence, should fall under Rica and therefore be subject to scrutiny by the designated judge.

Rica-related interceptions (or what are often known as “lawful intercepts”) are undertaken by the Office for Interception Centres (OIC) on behalf of the applicants, while mass surveillance is undertaken within the SSA by the National Communications Centre (NCC). In her report, Mokgoro makes it clear that the head of the OIC must report on its activities each quarter, but both hers and the JSCI’s reports are silent about the reporting obligations of the NCC.

The JSCI’s report is particularly interesting on this issue, though, as it puts much more detail into the public domain about the activities of these two entities. This suggests that Parliament is becoming much more responsive to calls for greater transparency around intelligence work. According to the report, the JSCI conducted an oversight visit to National Communications (NC), a division of the State Security Agency (SSA) that houses the OIC and the NCC.

While the establishment and functions of the OIC are set out in Rica, the NCC has no statutory backdrop, which means that the most powerful surveillance state entity is also the one that is the least well-regulated by law. In 2008, a Bill setting out the mandate and function of the NCC was introduced to Parliament, but was subsequently withdrawn.

In its report, the JSCI notes that the OIC is established in terms of Rica and facilitates the interception of communications on behalf of the Law Enforcement Agencies. The NC, on the other hand, has the following responsibilities:

• To analyse the electromagnetic spectrum and programme the acquired signals to extract usable information;
• To install and maintain Signal Intelligence (SIGINT) collection platforms; and to
• Conduct feasibility studies to identify new geographic signal collection sites.

This description means that not only is the NCC continuing to undertake mass surveillance for intelligence purposes, but that it is actively expanding its capacity to do so. The problem with mass surveillance is that it subjects vast numbers of people to privacy violations even if they are not suspected of crimes.

Both the European Court of Human Rights and the European Court of Justice have expressed concern in recent cases about the disproportionate nature of mass surveillance and the negative implications for privacy. In 2016, the UN Special Rapporteur on Privacy referred to these cases as “the beginning of the judicial end for mass surveillance”.

The fact that there are no meaningful controls over South Africa’s mass surveillance activities should be of particular concern, given the JSCI’s call in its report for the spy agencies to prioritise economic intelligence and cybercrime.

A recent Privacy International investigation has exposed a revolving door between the intelligence agencies, the mining industry, and private security companies in the communications surveillance sector.

In other words, spies leave the employ of the intelligence agencies and set up private security companies that ply their trade in the private sector, especially in the mining industry where some of these players also have business interests. This collusion appears to have intensified in the wake of the Marikana massacre.

A court application in the dying days of 2016 alleges that after Marikana, President Zuma encouraged the establishment of a government-friendly union in the platinum belt to spy on rival trade unions and destabilise them. These allegations come in the wake of evidence seen by Rapport newspaper that the foremost representative of Lonmin PLC (the company where the strike took place that led to the massacre) during the strike was, in fact, an SSA agent.

These reports suggest that the SSA’s economic intelligence focus is being used to legitimise government spying on perceived political critics, and protect the exploitative business practices of mining companies. They also suggests that there is growing public-private collusion in cracking down on such dissent, made possible by insufficient controls on conflicts of interest.

To her credit, Mokgoro tacitly acknowledges these dangers. She states: “There is a continued general public perception that some law enforcement and other institutions and/or officers use these intrusive interception methods to advance their own interests with no regard to the rights and values the Rica aims to protect in the context of the Constitution.”

She goes on to note media reports containing “…allegations and comments of manipulation and abuse of the interception system by officials and even individuals”, such as cases where intelligence agencies bypass the judge to intercept communications, or where they do not provide strong enough justifications for their applications.

Mokgoro argues that these problems cannot be fixed by legislative reforms only. Instead, they require a shift in the culture and practices of intelligence agencies that are tempted to rush to communications surveillance as an investigative method of first resort. While undoubtedly there is merit to her argument, it fails to take into account the fact that the problem is not just one of institutional culture, but of law, too. While it does have many good points, Rica is a fundamentally flawed law.

This year, the Department of Justice intends to launch a Rica reform process. South Africans need to ensure that this process it is not captured by the spy agencies and used to drive through an expansion of their already-considerable but underregulated surveillance powers. Communications users who are concerned about their privacy must get involved. DM

Jane Duncan is a professor in the Department of Journalism, Film and Television at the University of Johannesburg. She is the author of Protest Nation: the Right to Protest in South Africa and a member of the Right 2 Know Campaign’s Secrecy and Securitisation Focus Group.