OP-ED

Bulk communication surveillance in South Africa – fix it or nix it

By Jane Duncan 30 September 2019
Caption
The chances of the South African Constitutional Court taking a stance to end bulk surveillance are much stronger than they are in Europe or the US, says the writer. (Illustration: Daily Maverick)

A recent high court judgment has opened up important space for South Africans to decide what powers spy agencies should and shouldn’t have. Bulk surveillance is one of the powers it shouldn’t.

In a recent, ringing judgment on the right to privacy, high court judge Roland Sutherland ruled that bulk surveillance activities and foreign signals interception undertaken by the National Communications Centre (NCC) are unlawful and invalid. The NCC is part of the State Security Agency (SSA).

Bulk surveillance involves the collection and analysis of massive amounts of information obtained from electronic signals, including communication and internet traffic, on an untargeted basis, for intelligence-gathering purposes. There does not have to be a reasonable suspicion of criminality to trigger this form of surveillance, which is why it is often called “suspicionless” surveillance.

In fact, bulk surveillance can be so invasive that it is usually reserved for collecting intelligence on foreign threats to national security, as no country that considers itself a democracy wants to be caught spying on its own citizens en masse. Intelligence generated from bulk surveillance is known in spook-speak as foreign signals intelligence. It can be obtained from tapping into over-the-air or cable-borne electronic signals that have one leg in the country and one leg outside, or both legs outside.

Edward Snowden’s revelations were so earth-shattering partly because they revealed how the US had, in fact, used its mass surveillance capabilities to spy on US citizens. Even intimate video-chats in which people exposed their naked body parts were stored and processed by the US’s version of the NCC – the National Security Agency – even though most of this information had no intelligence value.

Why should you care about the Sutherland judgment, you might ask? After all, you may not be a journalist or a lawyer or an activist or any other category of person who might attract intelligence attention. You may say you have nothing to hide and therefore nothing to fear. But that argument assumes a benign government that will not misuse your personal information. If you are concerned about your naughty bits landing up in a state database, and possibly even the databases of other countries, then the Sutherland case should concern you.

Disagreement on whether to fix or nix bulk surveillance

The judge gave the SSA a well-deserved snotklap over the NCC as the government has been aware of its probable illegality for over a decade. In fact, former Minister of Intelligence Ronnie Kasrils even drafted two parliamentary Bills to try and give the NCC a legal status (the Intelligence Services Amendment Bill and the National Strategic Intelligence Amendment Bill). However, these Bills were withdrawn shortly before Jacob Zuma took over as president and were never reintroduced.

Sutherland made it clear he was not ruling on the constitutionality of mass surveillance per se, upon which he felt it was unnecessary to decide, but the fact that it did not have any legal footing. The implication of the judgment is that if the NCC’s existence were to be backed up by an Act, the problem would be solved. There was disagreement between the applicant in this case (the amaBhungane Centre for Investigative Journalism) and the amici (Right2Know and Privacy International) on the important matter of whether to fix or nix bulk surveillance.

On the one hand, the applicants argued that the SSA had no statutory power to undertake mass surveillance of foreign signals. They argued for no bulk surveillance to be allowed until new legislation is enacted which incorporates sufficient safeguards. On the other hand, the amici argued that bulk surveillance is inherently unconstitutional as the state claims the right to capture all internet traffic between South Africa and other countries, or outside South Africa, which is a massive violation of the right to privacy.

According to the amici, even if the NCC was put on a legal footing there would probably be another legal challenge. Rather, they argued, “…this court should make it clear that untargeted, unregulated, bulk surveillance will always be unconstitutional, even if it is conducted with legal authority”. They argued that introducing legislation to regularise the NCC would most likely trigger a challenge to mass surveillance later on.

Why do spy agencies want bulk surveillance powers?

Why do spy agencies want these powers in the first place, or why do they claim to want them? The SSA’s papers give little away in this regard but signals intelligence agencies elsewhere have been more forthcoming publicly, mainly in response to legal challenges to their powers. The problem is, when it comes to national security threats the agencies don’t know what they don’t know. Especially when those threats emanate from outside a country’s borders, as they do not have the same investigatory powers outside their borders as they do inside. To tackle the problem agencies say they need access to huge volumes of information, which only bulk interception offers.

The UK signals intelligence agency GCHQ claims the nature of packet-switched internet communications forces them to collect as much information as possible from a communication bearer on a fibre optic cable. They claim they would not be able to reassemble the packets without a “collect it all” approach, whereby they access the internet at scale. Where they do not have these capabilities, they partner with other powerful surveillance countries through intelligence-sharing agreements, to allow them to piece together fragments of information and obtain a complete picture.

So, spy agencies claim they want these capabilities because they meet intelligence needs that cannot be met easily by other means. Bulk surveillance allows them to be more forward-looking about threats or potential threats, rather than to respond to threats once they’ve emerged (by which time it may be too late). The intelligence obtained can be used (is used) to disrupt transnational terrorist networks through picking up patterns of behaviour indicative of operational planning, and may be particularly valuable in detecting foreign cyber-threats.

Foreign signals intelligence gathering may also be less risky than deploying human intelligence assets in foreign contexts, as spies may be uncovered. In the words of the UK’s spy complaints body, the Investigatory Powers Tribunal, the country has a “‘need for [access to] the haystack in order to find the needle. After a lengthy review of the need for bulk surveillance powers, Independent Reviewer of Terrorism Legislation David Anderson found that, as unpalatable as it was, the operational case for these powers was compelling.

He cited many examples of threats that could not have been prevented without them. It could be argued that there are other dangers of South Africa nixing bulk surveillance completely. The country will lie exposed, unable to listen in on communication traffic while other countries do.

Stopping bulk surveillance will allow the major surveillance superpowers of the world’s largest intelligence-sharing network alliance (known as the Five Eyes) free reign over the global networks.

Some “best practice” options for fixing bulk surveillance

Fixing bulk surveillance would mean introducing legislation setting out and limiting its powers and functions, which is likely to happen in the short term if the Constitutional Court confirms the Sutherland judgment.

As the matter is urgent and the work has been done, the government could simply dust off the Kasrils Bills.

The first bill provides for the establishment of the NCC. The second Bill provides for its functions, including collection and analysis of foreign signals intelligence, and requires the minister to authorise targets. According to this Bill, the NCC is prohibited from targeting any communications that does not fall into the definition of foreign signals, which should prevent a repeat of the 2005 abuses.

However, reviving the Kasrils Bills will not solve the NCC’s problem as the body is inadequate and out of date in important respects. The Bills make no provision for judicial authorisation of bulk collection, for instance, as this responsibility is assigned to the minister, who is not independent of the very executive arm that undertakes the surveillance.

The government might argue that legal warrants are incompatible with signals intelligence, as warrants are by their very nature designed to be targeted. However, bulk warrants are possible.

According to research conducted by the German think-tank Stiftuing Neue Verantwortung (SNV), in the signals intelligence environment warrants can be tied to classes of individuals or activities rather than specific people. These warrants could include information about which fibre-optic cables are going to be intercepted, expiration dates for particular operations, the private entities that will be involved, search terms or selectors to be used, and geographical zones or organisations or groups of people to be placed under surveillance. They must be narrowly tailored to prevent them from being misused to authorise surveillance of whole cities or even countries.

In the Swedish system, the selectors or search terms used to search communication traffic have to be presented to the foreign signals court for approval. If a search term is used that relates to a person, then they should be informed when the investigation reaches a non-sensitive stage. However, it may not be possible to identify all selectors at the outset of an investigation. Where this is not practical, there should be after-the-fact oversight of the selectors.

Another way of limiting the scope of warrants is to limit surveillance of the number of people who have been in direct communication, or the number of “hops” out, from a suspect. In the wake of the Snowden revelations, the Obama administration reduced the number of hops from three to two. There is also the option of issuing different warrants for different stages of the signals intelligence process, such as collection and filtering, pre-treatment of unevaluated data and selection of content for operational use. Setting quotas for particular data collection methods should also ensure that any unnecessary warrants are retired.

Some countries have special signals intelligence courts, but they are also notoriously secretive and susceptible to capture by the very agencies they are meant to make decisions about. The Swedish court is better in some respects than the US court, as it is made more adversarial by the presence of a “privacy protection representative”.

But establishing a special court in South Africa is not a good idea as it reinforces the domestic-foreign split in the treatment of surveillance. If warrants are to be issued, it would be best to convert the office of the RICA judge into a panel of judges to hear applications for all communication-related warrants. Given the often highly technical nature of surveillance, the panel should be able to draw on the expertise of expert witnesses or friends of the court.

All requests for metadata handled in terms of the Criminal Procedures Act should also be handled by this specialist panel of judges, which ideally should be appointed by the Judicial Services Commission. The same standards of protection that apply to communication content should apply to communication metadata. A new bill could make it clear there should be no discrimination based on citizenship or residency, which no doubt the SSA will oppose as this is the very basis upon which bulk surveillance operates.

Apart from the discrimination problem, it has become increasingly impossible to distinguish foreign from local communications as the technology is inherently global. In fact, the distinction between foreign and local signals has become meaningless. The SSA acknowledged this difficulty in its responding papers.

The way to solve this problem is to grant the same privacy protections to national and foreign communications, which is the case in the Dutch system. A new Bill could make it clear that bulk powers should be used only when more targeted means are unlikely to achieve the surveillance objective. Furthermore, bulk surveillance should not be used to obtain an economic advantage or discriminate against particular classes of people.

The US presidential policy directive on signals intelligence, introduced by Barack Obama after the Snowden revelations, provides a useful pointer in this regard. The directive forbids signals intelligence being used to suppress dissent, or disadvantage any person based on ethnicity, race, gender, sexual orientation or religion.

The Bill should, at the very least, incorporate what have become known as the “Weber principles. Principles developed over a decade ago, designed to prevent abuses of power in the strategic intelligence environment. These principles require that warrants should define the nature of the offences which gave rise to the application, the categories of people likely to have their communications intercepted, limits on the duration of interception, procedures to be used for examining, using and storing information, precautions to be taken when communicating intercepted information to third parties, and the circumstances in which information may be erased or records destroyed.

Any law authorising signals intelligence should also be accessible and the scope of the application of signals intelligence should be spelt out. The duration of the operations should be limited, though bulk surveillance is typically of longer duration than targeted surveillance, and there should be prior authorisation by an independent body (preferably but not necessarily a court). Procedures should be spelt out for storing, accessing, examining, using and destroying of intercepted data, as should conditions for transmission of intercepted data to other parties.

The Bill should state that information shared through intelligence-sharing agreements may only be shared and searched by spy agencies elsewhere if the national standards of the country of origin are applied. This safeguard can stop countries “jurisdiction-shopping” and transferring raw data collected by them to another country with weaker rules to circumvent national controls.

Changing the rules of the game on signals intelligence

Even if a bill is drafted that incorporates these safeguards, will it be constitutionally compliant? How likely is the Constitutional Court to declare bulk surveillance unconstitutional? And how desirable are these powers in the first place? While there was significant judicial activism and international standard-setting in the wake of the Snowden revelations, that pointed to mass surveillance not being compatible with international human rights law.

However, more recently, following recent terrorist attacks in Europe, there appears to be a shift in thinking that is more deferential to the executive, and a reluctance to second-guess governments on what it takes to defend national security. Last year, the European Court of Human Rights ruled that there are so many unknown threats to national security in the world today that bulk surveillance, as a general matter, should fall within a national authority’s “margin of appreciation in choosing how best to achieve the legitimate aim of protecting national security”.

The court also did not accept the argument by the applicants, a group of 10 human rights NGOs, that there needs to be individualised, reasonable suspicion for surveillance to occur as they accepted GCHQ’s argument that this is not possible with bulk surveillance. For instance, it may be difficult to obtain a person’s details for an individualised warrant if they are overseas. The NGOs consider this judgment a massive step backwards for the struggle against bulk surveillance and have referred it to the court’s Grand Chamber.

Should South Africa see things the same way? There are no good reasons to become resigned to the reality of spy agencies having these powers. By the SSA’s own admission, South Africa is located in a region that enjoys relative stability. The country does not face any major terrorism threat. So, it is difficult to see a compelling operational case for these powers, other than “we won’t have them while others will”. More importantly, governments cannot adopt whatever measures they see fit to fight national security threats. The SSA may be able to make an operational case for bulk surveillance in time to come, but not everything that is useful to an intelligence service should be permissible in a democratic society.

Spy agencies may be able to make an operational case for torture, for instance, but no democracy worth its salt should allow them to. As a country, we need to ask ourselves: do we really want to live in a society where spy agencies collect everything about everyone, or aspire to? If we allow this to happen in our lifetimes, we will have endorsed living in a tyranny, not a democracy, and no amount of fixing will take the problem away. As Snowden argued in a recent interview:

Mass surveillance is not about public safety, it is not about terrorism, it is about power. It is about economic espionage, it is about diplomatic manipulation, and it is about social influence. It is about understanding the actions of everyone in the world, no matter who they are and no matter how innocent their lives.”

Some country, somewhere, has to change the rules of the intelligence game and exercise global thought leadership on these matters. This country needs to say that no democracy can tolerate blanket indiscriminate surveillance, and commit to rolling back these powers. South Africa has a golden opportunity to do just that.

The military origins of signals intelligence

It should not be forgotten that signals intelligence comes out of a military environment and technologies used by spy agencies are often weapons-grade and dual-use (for use in military and civilian environments). Furthermore, signals intelligence is an offensive capability, unlike cyber-security, and one that is contributing massively to the weaponisation of the internet. Bulk surveillance is leading to a cyber-arms race to nowhere. Claiming your right to have those powers because your adversaries have them, is a dangerous zero-sum game.

South Africa needs to work towards global disarmament, including in cyberspace, and promote minimum privacy standards internationally that outlaw bulk surveillance. However, this will mean reversing the government’s shockingly poor record on the international stage on these issues. In the wake of the Snowden disclosures, South Africa opposed the establishment of the UN Special Rapporteur on Privacy, as well as a UN resolution on human rights on the internet. These foreign policy failures contributed to making the world a more insecure place and the Department of International Relations and Cooperation must bear much of the responsibility.

The war on terror of the Five Eyes countries has had catastrophic consequences for global security and created more terrorism threats than they can ever hope to deal with. Bombing and invading other countries on the pretext of false intelligence will not earn you friends.

The security problem in these countries is fundamentally a creation of militarised and securitised foreign policy. What is needed is changes in foreign policy that de-escalates the major global conflicts, not an expansion of security powers.

The European Court’s judgment, unfortunately, endorsed the security establishment’s arguments. South Africa largely stayed out of the war on terror, to its credit. Who can forget Nelson Mandela’s comment on the eve of the invasion of Iraq, that George Bush was about to “plunge the world into a holocaust”. There is no reason for South Africa to mimic the security capitulations of Europe, and the European Court’s thinking is not automatically relevant or applicable to our situation on this issue.

There are ongoing controversies about the effectiveness of bulk surveillance, with persistent arguments by those in the know, that the operational case is weak to non-existent. In fact, an overreliance on signals intelligence as an intelligence discipline can be a costly distraction from investigations that could benefit from much more targeted methods. It could cause significant intelligence failures, as true criminals “go dark” and plan their activities off the communications grid.

After all, whole industries have grown up around signals intelligence, so there are powerful vested interests at work in ensuring that agencies remain biased towards this discipline.

In short, the arguments of the spy agencies about operational necessity should not be taken at face value. The Sutherland judgment has opened up important space for South Africans to decide what powers the spy agencies should and shouldn’t have. Bulk surveillance is one of those powers it shouldn’t have, because it is an indiscriminate violation of privacy and an invisible form of violence, premised on technical assumptions that are increasingly out of date, and is destroying the internet as a free and open space for generations to come.

The chances of the South African Constitutional Court taking a stance to end bulk surveillance are much stronger than they are in Europe or the US. Compared to the unregulated mess that exists at the moment concerning bulk surveillance, there may be much to be gained from participating in the development of a Bill that puts the NCC on a legal footing. However, putting effort into doing so in the months to come may be unwise and result in misdirected energy. Rather, it would be more foresighted to shut South Africa’s fraught bulk-surveillance activities down once and for all. Then we can put our efforts into ensuring other countries do the same. DM

Jane Duncan is a professor in the department of journalism, film and television, School of Communication, Faculty of Humanities, University of Johannesburg. She is the author of Stopping the Spies: Constructing and Resisting the Surveillance State in South Africa, published by Wits University Press in 2018.

Gallery

PRESIDENT VERSUS PUBLIC PROTECTOR

Ramaphosa’s lawyers on Mkhwebane: ‘Report reveals reckless determination to nail the president’

By Rebecca Davis