RICA does not provide for interception at customer premises. Doing so would - in most instances - compromise the need to prevent the target from finding out that they're subject of a LI warrant.
All LI should take place on the ISP or TSP network.
Unfortunately, the complexity comes in with the definition of ISP.
http://www.internet.org.za/amended_ricpci.html
"Internet service provider" means any person who provides access to, or any other service related to, the Internet to another person, whether or not such access or service is provided under and in accordance with a telecommunication service licence issued to the first-mentioned person under Chapter V of the Telecommunications Act;
This definition is so broad that it could apply to any businesses whose staff can access the net or even you or I if we happen to let our neighbor surf the net whilst he/she is visiting.
But this is not a unique case of badly drafted legislation. Usually, people take what they consider to be the most reasonable interpretation, until authorities choose to prosecute someone for non-compliance. At that stage, a judge has to read the bad definition and make a reasoned call on it. In cases like this, precedent dictates that the judge cannot use the broadest interpretation of a definition but rather has to look at the intent of the legislation to define the scope of the definition.
It is very clear from RICA overall and the various directives issued in terms of it, that the *INTENT* is that companies/organisations providing telecomms services have the ability to intercept on their networks.
Should authorities try and prosecute an ordinary company for not intercepting its staff's communications, the company would have a strong argument that they were not providing the telecomms service because their ISP or telco was the provider of the service.
The directives for ISPs also has some wording that basically states that it is not a requirement for every element of the network to be able to perform LI, only that traffic crossing any of the ISP's "network links" can be intercepted (ie. not at CPE or even at the access router). I know this, because I personally sat in a meeting at the DoC and then helped draft minor wording changes which ISPA added into its submission and which the DoC - thankfully - incorporated between the draft and final directives. It's one of the lessor known ISPA successes that I'm rather proud of. I'm not as familiar with the exact wording of the directives for other types of telecomms service providers (eg. mobiles, fixed line operators, etc) but am pretty confident that based on the Act itself, CPE would be excluded.
Sorry to make such a long reply of such a small question. Sadly with RICA nothing is simple or straight-forward. Horribly drafted legislation often raises more questions than it answers.
