(Illustration: Daily Maverick) 
In a recent, ringing judgment on the right to privacy, high court judge Roland Sutherland ruled that bulk surveillance activities and foreign signals interception undertaken by the National Communications Centre (NCC) are unlawful and invalid. The NCC is part of the State Security Agency (SSA).
Bulk surveillance involves the collection and analysis of massive amounts of information obtained from electronic signals, including communication and internet traffic, on an untargeted basis, for intelligence-gathering purposes. There does not have to be a reasonable suspicion of criminality to trigger this form of surveillance, which is why it is often called “suspicionless” surveillance.
target="_top" rel="noopener noreferrer">can be so invasive that it is usually reserved for collecting intelligence on foreign threats to national security, as no country that considers itself a democracy wants to be caught spying on its own citizens en masse. Intelligence generated from bulk surveillance is known in spook-speak as foreign signals intelligence. It can be obtained from tapping into over-the-air or cable-borne electronic signals that have one leg in the country and one leg outside, or both legs outside.
Edward Snowden’s revelations were so earth-shattering partly because they revealed how the US had, in fact, used its mass surveillance capabilities to spy on US citizens. Even intimate video-chats in which people exposed their naked body parts were stored and processed by the US’s version of the NCC – the National Security Agency – even though most of this information had no intelligence value.
Why should you care about the Sutherland judgment, you might ask? After all, you may not be a journalist or a lawyer or an activist or any other category of person who might attract intelligence attention. You may say you have nothing to hide and therefore nothing to fear. But that argument assumes a benign government that will not misuse your personal information. If you are concerned about your naughty bits landing up in a state database, and possibly even the databases of other countries, then the Sutherland case should concern you.
Disagreement on whether to fix or nix bulk surveillance
The judge gave the SSA a well-deserved snotklap over the NCC as the government has been aware of its probable illegality for over a decade. In fact, former Minister of Intelligence Ronnie Kasrils even drafted two parliamentary Bills to try and give the NCC a legal status (the Intelligence Services Amendment Bill and the National Strategic Intelligence Amendment Bill). However, these Bills were withdrawn shortly before Jacob Zuma took over as president and were never reintroduced.
Sutherland made it clear he was not ruling on the constitutionality of mass surveillance per se, upon which he felt it was unnecessary to decide, but the fact that it did not have any legal footing. The implication of the judgment is that if the NCC’s existence were to be backed up by an Act, the problem would be solved. There was disagreement between the applicant in this case (the amaBhungane Centre for Investigative Journalism) and the amici (Right2Know and Privacy International) on the important matter of whether to fix or nix bulk surveillance.
On the one hand, the applicants argued that the SSA had no statutory power to undertake mass surveillance of foreign signals. They argued for no bulk surveillance to be allowed until new legislation is enacted which incorporates sufficient safeguards. On the other hand, the amici argued that bulk surveillance is inherently unconstitutional as the state claims the right to capture all internet traffic between South Africa and other countries, or outside South Africa, which is a massive violation of the right to privacy.
According to the amici, even if the NCC was put on a legal footing there would probably be another legal challenge. Rather, they argued, “…this court should make it clear that untargeted, unregulated, bulk surveillance will always be unconstitutional, even if it is conducted with legal authority”. They argued that introducing legislation to regularise the NCC would most likely trigger a challenge to mass surveillance later on.
Why do spy agencies want bulk surveillance powers?
Why do spy agencies want these powers in the first place, or why do they claim to want them? The SSA’s papers give little away in this regard but signals intelligence agencies elsewhere have been more forthcoming publicly, mainly in response to legal challenges to their powers. The problem is, when it comes to national security threats the agencies don’t know what they don’t know. Especially when those threats emanate from outside a country’s borders, as they do not have the same investigatory powers outside their borders as they do inside. To tackle the problem agencies say they need access to huge volumes of information, which only bulk interception offers.
The UK signals intelligence agency GCHQ claims the nature of packet-switched internet communications forces them to collect as much information as possible from a communication bearer on a fibre optic cable. They claim they would not be able to reassemble the packets without a “collect it all” approach, whereby they access the internet at scale. Where they do not have these capabilities, they partner with other powerful surveillance countries through intelligence-sharing agreements, to allow them to piece together fragments of information and obtain a complete picture.
So, spy agencies claim they want these capabilities because they meet intelligence needs that cannot be met easily by other means. Bulk surveillance allows them to be more forward-looking about threats or potential threats, rather than to respond to threats once they’ve emerged (by which time it may be too late). The intelligence obtained can be used (is used) to disrupt transnational terrorist networks through picking up patterns of behaviour indicative of operational planning, and may be particularly valuable in detecting foreign cyber-threats.
Foreign signals intelligence gathering may also be less risky than deploying human intelligence assets in foreign contexts, as spies may be uncovered. In the words of the UK’s spy complaints body, the Investigatory Powers Tribunal, the country has a “‘need for [access to] the haystack in order to find the needle”. After a lengthy review of the need for bulk surveillance powers, Independent Reviewer of Terrorism Legislation David Anderson found that, as unpalatable as it was, the operational case for these powers was compelling.
He cited many examples of threats that could not have been prevented without them. It could be argued that there are other dangers of South Africa nixing bulk surveillance completely. The country will lie exposed, unable to listen in on communication traffic while other countries do.
Stopping bulk surveillance will allow the major surveillance superpowers of the world’s largest intelligence-sharing network alliance (known as the Five Eyes) free reign over the global networks.
Some “best practice” options for fixing bulk surveillance
Fixing bulk surveillance would mean introducing legislation setting out and limiting its powers and functions, which is likely to happen in the short term if the Constitutional Court confirms the Sutherland judgment.
As the matter is urgent and the work has been done, the government could simply dust off the Kasrils Bills.
The first bill provides for the establishment of the NCC. The second Bill provides for its functions, including collection and analysis of foreign signals intelligence, and requires the minister to authorise targets. According to this Bill, the NCC is prohibited from targeting any communications that does not fall into the definition of foreign signals, which should prevent a repeat of the 2005 abuses.
However, reviving the Kasrils Bills will not solve the NCC’s problem as the body is inadequate and out of date in important respects. The Bills make no provision for judicial authorisation of bulk collection, for instance, as this responsibility is assigned to the minister, who is not independent of the very executive arm that undertakes the surveillance.
The government might argue that legal warrants are incompatible with signals intelligence, as warrants are by their very nature designed to be targeted. However, bulk warrants are possible.
According to research conducted by the German think-tank Stiftuing Neue Verantwortung (SNV), in the signals intelligence environment warrants can be tied to classes of individuals or activities rather than specific people. These warrants could include information about which fibre-optic cables are going to be intercepted, expiration dates for particular operations, the private entities that will be involved, search terms or selectors to be used, and geographical zones or organisations or groups of people to be placed under surveillance. They must be narrowly tailored to prevent them from being misused to authorise surveillance of whole cities or even countries.
In the Swedish system, the selectors or search terms used to search communication traffic have to be presented to the foreign signals court for approval. If a search term is used that relates to a person, then they should be informed when the investigation reaches a non-sensitive stage. However, it may not be possible to identify all selectors at the outset of an investigation. Where this is not practical, there should be after-the-fact oversight of the selectors.
Another way of limiting the scope of warrants is to limit surveillance of the number of people who have been in direct communication, or the number of “hops” out, from a suspect. In the wake of the Snowden revelations, the Obama administration reduced the number of hops from three to two. There is also the option of issuing different warrants for different stages of the signals intelligence process, such as collection and filtering, pre-treatment of unevaluated data and selection of content for operational use. Setting quotas for particular data collection methods should also ensure that any unnecessary warrants are retired.
Some countries have special signals intelligence courts, but they are also notoriously secretive and susceptible to capture by the very agencies they are meant to make decisions about. The Swedish court is better in some respects than the