Ever since the lockdown began in South Africa, I have been tracking the government’s evolving positions on using cellphone tracking in the fight against Covid-19. It hasn’t been easy obtaining information about exactly what their intentions are.

Initially, it seemed as if the government was intending to use aggregate location data to map trends in the spread of the virus. The Minister of Communications announced this intention at a security cluster briefing on 25 March. In it, she said that the cellphone industry has agreed to provide data analytics to track how many people are affected in a particular area. 

However, her statement didn’t provide much clarity on exactly what they would be providing. Since then, the government has elaborated on their intentions, notably through revised regulations published by the Ministry of Cooperative Governance on 2 April. 

So how has the government’s position on cellphone tracking evolved, what do the regulations say, how do government’s plans measure up to international best and worst practices, and what do these intentions tell us about how democratic or autocratic government’s response is to the pandemic? 

The spectrum of uses for location data in the fight against Covid-19

There is a spectrum of uses for location data in the fight against the virus, ranging from non-intrusive to highly intrusive. 

The least non-intrusive is to use aggregated and anonymised location data to model population density in the spread of the Covid-19 virus. For instance, Belgium is tracking the mobility of peoples’ movements at a broader level to see if confinement measures are working or not. This data can then be fed into government decisions about whether to relax or tighten measures. 

There is always the danger of this data being de-anonymised and people being re-identified. But these dangers recede when densely populated areas are being surveilled, which is most likely where the data will be of most use, and mitigation measures are used. 

On the more intrusive end of the scale, governments can obtain location data to track the movements of people infected with Covid-19, to establish who they have been in proximity to, and to isolate those people. People who violate lockdowns can also be traced and people graded according to the public health risks they pose. South Korea, China, and Israel have been using location data in such ways. 

Location data can speed up the hugely laborious task of contact-tracing by interviewing Covid-19 carriers in countries that are failing to flatten the curve. People who have been in contact with someone diagnosed with the virus can be informed immediately, without having to wait for contact tracers to get to them. 

In these cases, location data can literally save lives. It even be used as an alternative to an economically-damaging lockdown, as economic activities among uninfected individuals could continue.

However, there are unanswered questions about the effectiveness of location data for these more granular uses. According to the digital rights group, the Electronic Frontier Foundation, location data may not be sufficiently precise to allow people who have been in close proximity to a Covid-19 carrier to be identified with accuracy. 

A more democratic option to involuntary contact tracing involves self-monitoring tracking apps that encourage cellphone users to provide to health authorities their location information and information about symptoms voluntarily. They offer an attempt to strike a balance between public health concerns, on the one hand, and privacy on the other. 

This option will be difficult to implement in South Africa, though, where large numbers of South Africans still lack access to data, some don’t even carry cellphones and, of those who do, many carry feature phones. Furthermore, these apps are only effective if large numbers of people use them. Zero-rating the apps could be one solution. 

South Africa’s evolving position on location data

Government’s evolving position on this is clear from the changes between an initial set of directions issued on 26 March and new regulations issued on 2 April.

On 26 March, the Department of Telecommunications and Postal Services released a direction in terms of the Disaster Management Act, covering communications and media-related issues. 

Under the heading “individual track and trace”, the cellphone operators, and in fact “the digital sector in general”, are required to provide location-based services “to support government departments to assist and combat the spread of Covid-19”. 

The regulation provided important clues to the government’s intentions, in that they appeared to extend beyond obtaining aggregate information and into using location data to track those infected with Covid-19 to see who they had been in the vicinity of. 

This intention was confirmed to my colleague, researcher and information rights activist, Murray Hunter, by the Department of Communications. Yet, at that stage, there was no indication of them intending to apply for warrants to obtain this information.

When approached for comment, the largest cellphone operator in South Africa, Vodacom, told me this:

“Current laws in South Africa serve to protect customer information and do not allow us to share any customer information without a court order or without the consent of the customer. In the event that Vodacom is served with a Section 205 subpoena from the court, Vodacom will then be obliged to act accordingly and will abide by applicable South African laws. Having said that, our understanding of the data information request outlined recently by minister Stella Ndabeni-Abrahams is for high-level aggregated data on how people are moving, to help curb the spread of Covid-19. This does not include personal information or information that identifies a specific individual.”

This statement suggested that Vodacom and the government were not of one mind about how location data would be used. I was unable to obtain a comment from the second biggest cellphone operator, MTN. 

Revised Covid-19 regulations and the new route

Then, on 2 April, the government released revised regulations, with much more elaborate procedures for location tracking. In important respects, they even exceed the privacy protections for metadata provided in Rica and the Criminal Procedures Act. 

According to the regulations, the Department of Health will maintain a Covid-19 database of those infected or reasonably suspected of being infected. The department can direct the cellphone companies to provide location data for the database about the Covid-19 carriers or people who have been in close proximity to them. 

Furthermore, the department can only request data between 5 March (when the pandemic really picked up) and when the state of disaster finally lapses, and they can only use the data strictly for the purpose of countering the virus. They and others are not allowed to intercept any other communication content. 

The regulations envisage the appointment of a special Covid-19 judge, appointed by the Minister of Justice. The Department of Health, on a weekly basis, needs to provide the judge with a list of people whose details were obtained through the regulation, and these people need to be informed six weeks after the state of disaster has lapsed that their details were intercepted. 

The Covid-19 judge can also make recommendations to the relevant Cabinet members regarding the amendment or enforcement of the regulations in order to safeguard privacy, while not compromising the fight against the virus. 

There are positives and negatives to these regulations. One huge positive is that these regulations recognise the principle of user notification. 

In its constitutional challenge to Rica, the amaBhungane Centre for Investigative Journalism has argued that Rica is incorrect in not allowing people whose communications have been intercepted to be notified after investigations have reached a non-sensitive stage. This secrecy prevents interception subjects from contesting abusive government interceptions. 

The regulations also incorporate basic data protection principles, such as purpose specification and time limit principles. They require that within six weeks after the lapsing of the state of disaster, all information in the Covid-19 database should be de-identified, and retained and used for research purposes. The designated judge can give directions if s/he isn’t satisfied about these new storage arrangements. 

However, I am less convinced about the role of the special judge, as the regulations do not envisage judicial authorisation. 

If the judge has any reservations about decisions taken, then s/he only has the powers to recommend remedial action, not review the decisions. This part of the regulations should be reconsidered, as it turns the judge into a rubber stamp for the executive. 

Rica does contain similar emergency procedures where the authorities can notify the judge after the fact if they have intercepted communications when life and limb is threatened. While not the subject of the constitutional challenge, that procedure is unsatisfactory, too, as it doesn’t spell out what happens if the judge disagrees with the authorities’ decisions. 

This loophole has seen the intelligence agencies using emergency powers thousands of times, simply because it is easier to use than the conventional procedure involving prior judicial authorisation. 

Now, it could be argued that locating people infected and affected by Covid-19 requires urgency, but courts deal with urgent matters all the time. Nothing stops the judge, or a panel of judges, from dealing with applications and making decisions on an urgent basis. 

The reporting requirements in the regulations mitigate the potential for abuse, but the absolute baseline for individual cellphone tracking is that the authorities must apply for a warrant, which a judge must issue.

Securocratic or democratic? Untangling the government response

When it comes to government’s intentions to use cellphone tracking in the fight against Covid-19, the bottom line is it could be worse. The government has clearly made an effort to come up with a much less autocratic system than countries like China, Israel and South Korea. The fact that the regulations are driven by public health officials and not the police or the spy agencies is a significant strength.

But, it’s impossible not to contrast this (largely) positive development with the conduct of some police and military officers on the streets. Already, violent military and police actions have become a blight on the lockdown, with police officers under investigation for the deaths of three civilians. 

Police Minister Bheki Cele’s threatening tone in announcing lockdown measures is a stark reminder that the militarised conditions that gave rise to the 2012 Marikana massacre remain deeply embedded in the police. 

In other countries, the lockdowns have revealed already-existing problems in policing, and South Africa is no exception to that general rule. However, the government has had a large window of opportunity in the wake of the massacre to deal with these problems, and it hasn’t. Yet, it has moved with much more speed on the Jacob Zuma-era abuses in the State Security Agency, give or take a speed bump here and there. 

Why this contradictory picture? Most likely, because largely policing abuses don’t touch the political elite. They touch the working class: the families crowded into one-roomed houses, shack dwellers, refugees. 

The elites, on the other hand, are touched by unaccountable state spying. As is public knowledge, politicians in the highest levels of the state have been targets. Clearly, the amaBhungane challenge to Rica has been a wake-up call for them, to the point where they are even willing to concede the very accountability measures they opposed in the case, such as user notification. 

State violence erodes trust in the state’s ability to protect people during this crisis, and is likely to inflame an already tough situation at the worst possible moment. The last thing the government needs to deal with is spontaneous protests of angry people raging against state violence and unbearable conditions.

Unless the government is consistent in its commitment to rein in the securocrats during “normal” times – and not just cherry-pick those powers that affect politicians directly – then we are likely to see uneven, classist and selectively violent responses continuing in times of crisis. DM

Jane Duncan is a professor and Head of Department of Journalism, Film and Television. She is author of ‘Stopping the Spies: Constructing and Resisting the Surveillance State in South Africa’ (Wits University Press, 2018).