In a recent judgment on the Regulation of Interception of Communication and Provision of Communication Related Information Act (Rica), the Gauteng High Court found sections of Rica to be unconstitutional. In doing so, it upheld the amaBhungane Centre for Investigative Journalism’s arguments that Rica failed to provide sufficient protections for privacy and freedom of expression.
Clearly, legislators and the executive dropped the ball on keeping Rica fit for purpose. While the spies’ powers are being reined in domestically, though, spies continue to run amok abroad.
There is publicly available evidence suggesting that South Africa imports, manufactures and exports surveillance tools. Unless these activities are regulated properly for human rights, then the government could contribute to globalising the very abuses that were called out at home.
The safeguards that were established in the amaBhungane case need to become the gold standard for South Africa’s export market in surveillance tools. If the companies they licence, and the countries they export to, do not meet these standards, the government must ban these exports.
Typically, the surveillance tools bought by government spy agencies are weapons-grade and dual-use: that is, they are used for civilian and military purposes. Manufacturers around the world are doing a roaring trade at the moment, selling their wares to law enforcement and intelligence agencies ostensibly for legitimate purposes. Yet, these very surveillance tools can be (and have been) abused to target dissidents and others who are considered politically inconvenient.
So serious is the problem that earlier in 2019, the UN Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, David Kaye, called for “… an immediate moratorium on the global sale and transfer of the tools of the private surveillance industry until rigorous human rights safeguards are put in place to regulate such practices and guarantee that governments and non-state actors use the tools in legitimate ways”.
Yet, too many countries are still focusing on controlling the sales of conventional arms, South Africa included. This focus is understandable, as conventional arms have a visible cost in the form of injuries and deaths, and are politically sensitive. However, if used inappropriately, governments can use surveillance tools to engage in invisible, or less visible, forms of violence that are very difficult to challenge.
Unless there are international standards to control the global trade in surveillance tools, it will continue to proliferate, and the tools will continue to be abused.
Global efforts to develop such international standards have intensified since the Edward Snowden revelations about the major surveillance powers’ mass surveillance abuses. But the reality is that the global trade in surveillance tools has run far ahead of regulatory efforts to control it, and surveillance companies are making a killing, figuratively and possibly even literally.
According to Privacy International, the global trade in surveillance comes in five forms: the direct equipping of foreign intelligence and security forces; the training of foreign intelligence and security forces; the financing of their operations and procurement; the facilitation of exports of surveillance equipment by industry, and the promotion of legislation which enables surveillance.
Given the complexity of these activities, the organisation has adopted a two-fold strategy: stop the transfer of unlawful surveillance, and promote the transfer of adequate privacy protections. South Africa needs to be adopting a similar strategy.
To its credit, though, South Africa is the only African country to be a signatory to the Wassenaar Arrangement On Export Controls for Conventional Arms and Dual-Use Goods and Technologies. The arrangement is a voluntary reporting mechanism for tracking the export of conventional arms and dual-use technologies, to prevent destabilising accumulations. Most major arms-exporting countries are signatories.
Participating states are expected to apply export controls to arms that are listed on all items listed on control lists, which are updated regularly. South Africa became a participating state in 2006. These control lists are meant to be implemented through national legislation and are to ensure that arms are not sold to governments that will use them for repressive purposes.
In the wake of the Snowden revelations, participating states updated the control lists to include internet-based mass surveillance equipment and intrusion software (or hacking tools), which means that they have to report on their export.
A full 86% of Western surveillance companies are located in countries that subscribe to the Wassenaar arrangement, which makes this agreement important to the fight to control the spread of surveillance technologies. However, according to Amnesty International, the surveillance industry has continued to grow.
So why is the surveillance industry booming if it is subject to unprecedented export controls? One of the problems is that the Wassenaar Arrangement is voluntary. It does not have the status of a legally binding treaty, which means that countries can choose whether to, and how to, codify the agreement into domestic law. There are no sanctions for violations of the arrangement.
As Kaye has pointed out, while the arrangement is useful, as it brings more transparency to the global arms trade, it does not require countries to consider the human rights implications of their exports. These realities led Kaye to conclude that “…[It] is insufficient to say that a comprehensive for control and use of targeted surveillance technologies is broken. It hardly exists”.
Apart from the traditional arms manufacturers, some countries have carved out niches as surveillance actors. South Africa does not appear to be as prominent as Israel in developing its surveillance industry, though. However, reportedly South African company Vastech has been attempting to expand its role in “developing country” contexts whose markets for social control technologies are not as saturated by the established players.
Controversially, Vastech’s Zebra monitoring centre, which boasts the ability to “reach back in time and discover new targets and networks of collaborators”, was sold to Libya while Muammar Gaddafi was president, and was reportedly used to increase the ability of the government to crackdown on pro-democracy protests.
The commercial temptation to export surveillance tools into less well-regulated countries is huge, and South Africa has a particular responsibility to prevent abuses. However, the available evidence suggests that the government has not been up to this task.
South Africa does have national legislation that codifies the Wassenaar Arrangement into law, the National Conventional Arms Control Act of 2002. This Act established the National Conventional Arms Control Committee (NCACC), which must regulate the trade in conventional arms (which in the definition includes dual-use goods). The Act requires all arms traders to register with the NCACC and obtain a permit.
The permit system is used for very sound public interest purposes, including to ensure that arms traders do not threaten the security of South Africa, contribute to crime or terrorism or internal repression in the countries they are exporting to or escalate a military conflict.
However, the problem is that the Act has not kept up with the most recent revisions to the Wassenaar Arrangement’s control lists to incorporate internet-based surveillance tools. The last time the list of controlled items to which the Act applies was updated was in 2012 and related to the 2010 control list.
In a submission to the United Nations Special Rapporteur on the Promotion and Protection of the Right to Freedom of Opinion and Expression, ALT Advisory and the Right2Know Campaign argued that the outdatedness of the NCACC Act and regulations means that the Act “does not provide an effective control in respect of the trade in surveillance equipment”.
The organisations also argued that the government, state actors and private companies should be required to ensure that they are not facilitating human rights infringements either domestically or abroad, and should be held accountable for any infractions.
It is not enough for South Africa to be guided by whether there are UN Security Council sanctions against particular countries in deciding whether to grant or revoke export permits. That bar is far too low to prevent abuses of surveillance tools. It is also not enough not to export to repressive countries only, as even the so-called “major democracies” have used surveillance tools to violate human rights.
Rather, South Africa should have an export control regime that requires minimum safeguards to be in place before it will sell surveillance tools to other countries, and Kaye goes into some detail on these safeguards in his report. The amaBhungane judgment should also be used as a touchstone.
These safeguards include ensuring that there is an adequate legal framework in the importing country, and practices that promote safeguards. The laws governing surveillance in those countries should be clear and accessible, and restrict surveillance to serious crimes.
Surveillance should be approved by independently appointed judges, with limits on the duration and scope of the surveillance. Hacking should involve a much more stringent level of authorisation and oversight. Surveillance targets should be notified of the surveillance once investigations reach a non-sensitive stage. Reporting on surveillance should be transparent and regular.
Surveillance should be targeted; in other words, South Africa should not be exporting bulk surveillance monitoring centres to any country, period. Countries should demonstrate that they have a particularly high burden of proof before journalists or lawyers are put under surveillance.
Surveillance manufacturers should also develop minimum standards of behaviour, failing which their licences should be revoked. These standards include customer policies affirming a commitment to human rights, due diligence processes for privacy and freedom of expression, and regular public disclosures of audits of the uses of its products.
The NCACC should not grant export licences to any companies that export to countries that do not meet these standards. The South African government will need to do some urgent work on the existing export control regime to make it fit for purpose.
In the meantime, the government should impose a moratorium on any exports of surveillance tools until these safeguards are in place. With its sophisticated arms industry, South Africa has a responsibility to stop the worldwide abuse of surveillance tools. DM
Jane Duncan is a professor in the Department of Journalism, Film and Television, School of Communication, Faculty of Humanities, University of Johannesburg. She is author of Stopping the Spies: Constructing and Resisting the Surveillance State in South Africa, published by Wits University Press in 2018. She tweets at @duncanjane.
The movie Cloudy with a Chance of Meatballs is titled It’s Raining Falafel in Israel.