Tuesday 25 February was a bad day for the ministries of State Security, Police and Justice and Correctional Services. In a Constitutional Court hearing on that day on South Africa’s main communication surveillance law, the Regulation of Interception of Communication and Provision of Communication-related Information Act (Rica), the judges subjected them to withering questioning.

The hearing was a consequence of a case brought by the amaBhungane Centre for Investigative Journalism. They are contesting the constitutionality of sections of Rica after having found that their managing partner, investigative journalist Sam Sole, had his phone tapped by the state. The high court upheld the complaints in 2019, and the Constitutional Court has to decide whether to confirm the lower court’s judgment. 

So weak were the ministries’ submissions that at one point, Chief Justice Mogoeng Mogoeng asked counsel for the South African Police Service (SAPS) whether they shouldn’t go back to the drawing board on Rica as they couldn’t even explain how it functioned. Piling on the criticism, Justice Chris Jafta observed that Rica was one of the worst-drafted laws he had ever seen. 

The Justice Ministry requested another three years to draft a new law, in spite of the fact that it promised a new draft by August 2019, and it accepted the need for a legal review three years ago. 

In questioning, it turned out that the minister had been appointing the Rica judge despite there being no enabling provision empowering him or her to do so. So what does this mean for all the decisions taken by these improperly appointed judges? 

The Ministry of State Security made an argument that clearly perplexed the judges. Its counsel claimed that intelligence methods such as mass communication surveillance are covered by the extremely vague National Strategic Intelligence Act. 

This act empowers the State Security Agency (SSA), SAPS and the South African National Defence Force (SANDF) to gather covert intelligence. According to the act, the SSA has the powers to gather, correlate, evaluate and analyse intelligence in order to identify national security intelligence. 

The SSA argued that this provision empowers it to use methods it deems necessary to collect national security intelligence. As counsel for amaBhungane argued, conceivably this could include torture methods such as waterboarding. Chief Justice Mogoeng Mogoeng asked, if the SSA put a bugging device in his bedroom, would that be alright as it’s about intelligence?

The State Security Ministry’s argument that spies must spy, and how they spy is nobody’s business, was met with scorn, and correctly so. It will be surprising if its argument about mass surveillance being mandated by this act survives.

If it doesn’t, then the SSA will have to do one of two things: shut down its mass surveillance entity, the National Communication Centre (NCC), or introduce legislation to cover its activities while suspending the NCC’s operations. 

As far as we know (as its activities are secret), the NCC collects and analyses foreign signals intelligence; that is, intelligence gathered from communications that have one leg, or both legs, outside the country. 

According to the SSA’s responding affidavit in the Rica case, this intelligence is collected on an untargeted basis. In other words, it is not directed at a specific individual and does not have to be based on reasonable suspicion of criminality. These features make it an extremely powerful spying machine; so, the fact that its powers and functions are not set out in separate law is deeply concerning. 

In the wake of the Edward Snowden revelations about spying abuses after the September 11, 2001, terrorist attacks, activists are forcing more governments to impose constraints on intrusive intelligence methods. These constraints include preventing intelligence agencies from conducting mass surveillance on their own citizens, and calling them to account when they do.

Spy agencies have argued that they need more invasive powers such as mass communication surveillance outside their own borders, as they do not have the same investigatory powers as they do inside. Often (and not unproblematically), this means that the agencies need a warrant for surveillance of domestic communications, but not foreign communications. Rica is premised on this distinction. 

Another restriction that’s become more commonplace requires governments not to surveil protected categories of individuals who have a legally recognised duty of professional secrecy, such as lawyers or journalists, unless there are exceptional circumstances. amaBhungane has asked the Constitutional Court to recognise such a restriction in South Africa. 

However, there is a loophole in Rica that isn’t addressed in the Constitutional Court case, and that is around intelligence co-operation. No one should be surprised if this loophole is exploited in time to come. There is legislative silence in Rica on international intelligence co-operation on communication surveillance, and inadequate regulation in other intelligence laws, which leaves this important area wide open for abuse. 

The Constitution requires international co-operation agreements to be tabled in Parliament. In the case of intelligence agreements, though, they would be dealt with in secret. The National Strategic Intelligence Act empowers the State Security Agency to undertake intelligence liaison and co-operate with organisations inside and outside the country. 

International co-operation could include intelligence-sharing, and the Minister of State Security is empowered to regulate how this gets done. While this provision empowers the SSA to share intelligence, the act does not provide sufficient controls to prevent abuse. As the act was drafted in 1994, it could never have envisaged the problems caused by modern forms of intelligence-sharing. These include the cross-border interception of masses of raw data and the sharing of information about whole populations. 

Rica regulates the interception of communication inside South Africa, and establishes procedures and safeguards for these activities. But, conceivably, domestic spy agencies could follow the examples of the major surveillance powers and collude with foreign spy agencies to target South Africans from outside the country. They could even consider establishing interception stations outside the country. What law would regulate their actions then? 

In contrast, the Canadian signals intelligence agency, the Communications Security Establishment, is prevented by law from asking foreign intelligence partners to do for it what it is unable to do domestically. It cannot target Canadians either on their own soil or anywhere else in the world. 

There should be an explicit provision in Rica preventing the outsourcing of activities that would be illegal in South Africa. The executive should not be allowed to direct the services to act in these ways. These provisions would provide at least some safeguards against the avoidance of controls. 

Spy agencies can co-operate with one another on a cross-border basis in different ways, and for very sound reasons. Co-operation can take more passive forms, such as liaison, to more active forms such as co-operation on covert operations. For instance, they can share intelligence to solve transnational crime, and co-operate to bring those responsible to book. 

In the case of signals intelligence, co-operating partners can share raw data. They can even allow direct access to one another’s electronic networks in bulk or databases, and operate interception stations in other countries. 

Possibly the most well-developed signals intelligence co-operation agreement is the Five Eyes alliance. In terms of what little is known about this standing co-operation agreement (only the original 1946 version is public), the US, the UK, Canada, Australia and New Zealand co-operate with one another to collect and analyse foreign signals intelligence. Co-operation extends to joint management of interception stations and live, direct access to networks. 

So, if intelligence co-operation is necessary in view of the increasingly transnational nature of crime and national security threats, then why does the loophole in Rica even matter? Because it could be exploited to circumvent any reforms to Rica that may be won from the Constitutional Court case. The spy agencies could follow the road of least accountability, even if that road leads outside the country. 

South Africa can learn some hard lessons from other countries about the lengths that spy agencies will go to, to bypass domestic controls on their powers, by “colluding for circumvention”.

The UN Commissioner for Human Rights has observed that there is credible information to suggest that some countries engage in jurisdiction-shopping through intelligence-sharing agreements. 

This strategy is particularly useful when country X wants to surveil someone domestically, but cannot as they cannot meet the threshold to apply for a warrant. So they approach country Y to do their dirty work, leading to the surveillance being classified as foreign signals surveillance, which even in the most stringent of jurisdictions is subject to fewer controls than domestic surveillance. 

Country X then gets country Y to send the intelligence back to them (known in spy-speak as inbound intelligence). In more extreme situations, these countries can set up and operate transnational networks of spy agencies to circumvent domestic controls. 

The Edward Snowden revelations showed how US signals intelligence agency, the National Security Agency (NSA), used its special relationship with its British counterpart, Government Communications Headquarters (GCHQ), to collect on its behalf as it perceived spying controls inside the UK to be weaker than inside the US. 

At the time, GCHQ also claimed that using the NSA to collect intelligence for it on a warrantless basis was not an unlawful practice. The Canadian spy agencies have also used the Five Eyes alliance to circumvent tight controls over spying on Canadians abroad, which led to them being called to court to account.

The entire Five Eyes alliance provides its most powerful partner, the NSA, with a powerful means to jurisdiction-shop. As civil society forces more intelligence reforms domestically, then it simply moves its activities to weaker jurisdictions. Currently, the weakest link in the alliance appears to be Australia, where in 2018 an important struggle for the right to encrypt was lost. 

As domestic controls tighten up, Five Eyes intelligence co-operation can be used against journalists. One of the most important investigative journalists on state spying, Nicky Hager, interviewed sources who revealed that the New Zealand military received assistance from the US to spy on investigative journalist John Stephenson and his contacts. 

The spying occurred while Stephenson was reporting from a conflict zone in Afghanistan: a claim which the military denied. Stephenson had clashed with the military over his critical reporting, and the operation appeared to be an attempt to uncover his sources of information.

The Rica challenge may make it more difficult for agencies to spy on journalists such as Sam Sole in future. But, unless the loophole around intelligence co-operation is closed, then there is little to stop them asking another country to do it on their behalf and getting away with it. 

Intelligence co-operation between South Africa and other countries is shrouded in secrecy: too much secrecy. The law, policy and Parliament need to spell out general parameters for this area of spying, and the justifications for co-operation. 

Intelligence co-operation agreements should be reduced to writing and as a general rule, they should be made public. Secret Memoranda of Understandings with other countries just don’t cut it as adequate controls.

The Inspector-general for Intelligence should have oversight over such agreements, and have access to the intelligence shared by foreign partners. No rule in the agreement preventing access to shared intelligence by third parties should prevent this oversight. 

Limits on interception of privileged communication should extend to inbound intelligence. The spy agencies should only enter in co-operation agreements with countries that have prior independent authorisation to intercept communications and independent subsequent review of the interceptions. They need to practice due diligence by verifying the information. Inbound intelligence that does not meet these standards is tainted and should not be solicited. 

If mass surveillance continues in the medium term, then Rica should state that to avoid circumvention of domestic rules on domestic intelligence gathering, the shared bulk data should only be searched if the national requirements for a search are fulfilled. For instance, where an individual is identified by inbound intelligence, they should be notified when the investigation reaches a non-sensitive stage.

The amaBhungane case is an important first step in challenging unaccountable state spying: but it is only the first step. International intelligence co-operation has provided spy agencies with important workarounds to bypass national reforms. 

Anti-surveillance activists need to up their own international co-operation to ensure that anti-spying co-operation eliminates practices of bulk collection, as unregulated government co-operation is sustaining the market for unregulated mass surveillance. This is likely to be a more protracted struggle, but an important one. 

In other words, in seeking to rein in the spies, it is important to think globally, act locally and co-operate transnationally. DM

Jane Duncan is a professor and Head of Department of Journalism, Film and Television, University of Johannesburg. She is the author of ‘Stopping the Spies: Constructing and Resisting the Surveillance State in South Africa’ (Wits University Press, 2018).