'The New SA Electronics Bill'

LoneGunman

Expert Member
Joined
Sep 23, 2003
Messages
4,552
Reaction score
3
Location
In The Shadow of Bush-lite: Obama
This article was picked up and spread around indymedia and watchdog sites worldwide. Locally, there was a crashing silence. You probably remember some bullsh*t coverage that referred to a 'new Bill' to 'protect the rights of consumers online' - but little else.

The reality is very different - as the writer below, took the time to read through the Bill. If you're worried about any current legislation, read what I think, is ALREADY in law, with - apart from this article below, from 2003 - NO uproar or mention by local media at all. The writer below, takes the time to demonstrate, quoting exact sections of the Bill, to prove his point - a good example of real journalism in action.

Funny that you never heard about this Bill, isn't it? Your worst nightmare already happened, and you know nothing about it.

(It appears within Frasers column: http://www.chico.mweb.co.za/pc/razor/2003/030514-raz.htm
and can be found at http://www.fortunecity.com/victorian/orwell/93/howlfour.html

----------------------------------------------------------->
THE NEW SOUTH AFRICAN ELECTRONICS BILL

by Ian Fraser

(Permission is granted for reproduction of this article, in any medium, provided that Ian Fraser is credited.)

Under the diversionary tactic of helping make online transactions more secure, your rights online are in the process of being 'legally' removed.

In Chapter 5 of the Bill, there appears the following statement. "The Internet presents security challenges which, without an effective regulatory framework, would pose a threat to the security of consumers and the State." I think, based on some of the examples listed below, you can safely remove the word "consumers" - because this Bill appears to be all about the security of the State, while paying mere lip service to 'regulating electronic commerce' and 'protecting consumers'.

(Something like passing a Law to help Supermarkets, which requires that everyone in the area as well as those people using the Supermarket, can be watched and snooped on - just in case.. And of course the Media is focusing on the various sections dealing with 'regulating electronic commerce' and leaving the more sinister elements alone, or mentioning them in passing, buried deep within articles that - for the most part - read like quickly regurgitated press releases direct from the Government itself.

Did you know that once the new Bill is in law, so-called 'Cyber-Inspectors' can enter your home, search it, search your PC, and even search you, if they feel justified? Of course, this is only during daylight hours - although the Bill says a court can waive this nicety, if its deemed necessary. (87 (d) subsection 5).

They can also make copies of any documents or books they find on your premises which may "have a bearing on the investigation". The Bill also makes sure to say that you have to 'render technical and other assistance' if necessary, to the Cyber Inspector (86 (h) - presumably to help them find information proving that you're a criminal - and failure to help is illegal.

But wait there's more! According to my layman view, in section 90 of the Bill - if you happen to be using an encryption program which in the Governments view hinders, or prevents them getting the information they want, you can be jailed for up to 5 years. Of course they've tucked this away in a section dealing with unauthorised interception or interference with data. And naturally, this only refers to criminals.

Who are the criminals? Well, that's up to the South African Police and the Cyber Inspector to determine. And I'm sure we law abiding citizens therefore have absolutely nothing to worry about. Mistakes just dont get made, especially not by the South African Police - who can request the Cyber-Inspector to help them with ANY investigation.

And in Section 86 (1) - there's the innocent seeming phrase that - subject to getting a warrant, "the Cyber-Inspector may enter any premises or access an information system that has a bearing on an investigation". Lets look at this phrase more closely.Given my recent discovery of local Intelligence agents emails online (<http://cryptome.org/dirt-safrica.htm>) where local spies (with the full approval of our Government) were hunting for a good trojan-program to sneak into local users computers to intercept and access their data From a distance - the wording in that subsection covers a multitude of surveillance opportunities.

Now look again at the phrase "enter any premise or access an information system". They're not just saying 'enter your premises and snoop,'- they're discreetly talking about remotely accessing your PC - and wording it in such a circumspect way that it slips in under the radar.

Personally, I'd be very wary about downloading any programs from local sites from here on, given that they may be hiding the Governments new and improved snooping device(s), which they can turn on or off at their desire.

Then in Section 90 (3) - anyone who has any kind of software or device that is "designed primarily to overcome security measures for the protection of data" is guilty of an offence. So if you have any little program for those times when you've forgotten your zip or Word or PC password - you're about to be made a criminal.

There's also the fairly far reaching ramifications of 85 (1) - which states that a Cyber Inspector may "monitor and inspect any web site or activity on an information system in the public domain and report any unlawful activity to the appropriate authority".

What this means - to my reading of it - is that all the thousands of local users chatting away on MIRC, and/or sharing files on this and many other 'networking' applications, can now be monitored full time, if it's desired. After all, its "activity on an information system in the public domain".

Then there's the frankly Orwellian doublespeak of what the Bill calls "Protection of Critical Data" in Chapter 10. I quote - "Critical data is information which, if compromised, may pose a risk to the national security of the Republic or to the economic or social well being of its citizens". 'Social well-being'? What does this mean? So what happens when web-pages critical of the government are being run or hosted? Does this constitute 'misuse of critical data'?

I'm also curious about the role of local Internet Service Providers in all this. What happens when the police or the Cyber-Inspector comes knocking? Are the ISP's going to be allowed to notify users that they're being monitored and/or investigated? Are they going to be storing users emails for the police? Or having to quietly install software similar to the FBI's 'Carnivore' program, to browse data traffic of suspected criminals?

It's no good using the traditional statement by budding dictatorships that "If you're doing nothing wrong then there's nothing to worry about" - that's so insultingly simplistic and self-serving, that it cant be accepted as a valid argument by any intelligent citizen in this modern age.

Who trusts Government and intelligence agencies to do the right thing, or believes the State is responsible enough for citizens to abdicate their personal freedom and rights so easily? I dont. After all, that's my RIGHT. Democracy doesnt end where your keyboard begins. If you wouldnt allow a camera in your home to watch you when "a co
 
Last edited:
Where were you? There was stacks of coverage at the time about the new act, and still continues to be unhapiness because some parts of it have not been enacted (such as electronic signatures). The cyber cops are one part that seems not to be up and running and I would guess they would rather it all fell under SAPS now anyhow.

There is a full copy of the act here:
http://www.internet.org.za/ect_act.html

To see what coverage there has been do a google search for ECT ACT selecting "pages from South Africa"
 
I think the key thing here is that they are not going to use these measures against just any citizen BUT (and this is a BIG BUT), should you be under suspicion for any particular reason, or should you exercise your freedom of speech and critisise a person "in power", these laws suddenly become a very dangerous weapon against you.

An individual could merrily carry on doing whatever they wish with their computers, but should they cross the path of someone with more power than themselves - say a government minister, or a high powered Telkom executive - well, it doesn't take a great deal of imagination to figure out where it could lead.

That would also extend to websites critical of large corporations or government organisations.

It's a sobering thought, so the fact is, if your going to get vocal and be an activist, make sure you keep yourself safe from this type of practice - a good laywer always on hand and of course meticulous data organisation.
 
In the electronic media, at the time - the biggest indepth mention was how nicely this new bill would make transactions more secure for consumers..

I remember listening to radio coverage at the time, and thats the extent of analysis that was done.

Newspaper coverage doesn't 'mean' anything - given that more people listen to the radio locally, than read newspapers.

So saying that there was 'stacks of coverage' - doesn't mean 'the majority of people got to hear or read a deeper point of view'.

Television as well didn't go into it in any depth either.

Therefore, in terms of 'stacks of coverage' - you practically mean 'those who have the resources to buy daily newspapers' learned about it.
No one else did.
We have 40 000 000 citizens (roughly). As far as 'getting news' goes:
What percentage read newspapers? What percentage watch TV? What percentage listen to radio?

Just because you and I may buy newspapers, or use online resources to find out data - doesn't mean 'everyone heard about it'.
 
Last edited:
Well, for the majority of the citizens of this country, it's not of interest.
Fact is, a vast amount of them can't even get a credit card, let alone a computer.

For those that can, I'd say the majority wouldn't care, because the majority don't find computers or the internet interesting at all.

Take my sister-in-law (I'm staying at my brothers until tommorrow) - we were watching TV last night (it was baaaaad) and I indicated that once internet access becomes more affordable, she should get online.

She said she's really not interested in the internet or computers in general.

I know for a fact that 90% of the people I know, feel exactly the same way.

So it's not really newsworthy, even though it is infringing on their rights.

I'd say that this is how rights get slowly eroded away - the numbers of people concerned about any given privacy or rights issue always seems to be vastly outnumbered by those that don't care, because it doesn't immediately affect them.

Of course, the "powers that be" are all too aware of this and it's really only the people who would think for themselves that they are concerned about anyway.
 
I believe this has been taken out of context. I'm not going to say much, but without reading the whole ACT, you can't just extract sections to utilise. One thing, encrypted data can NEVER BE ILLEGAL. NEVER.

There is a need for Encryption, and whatever that need or purpose there may be for it, there are far more legitimate uses for it that otherwise. You're saying to me that a company whose business is purely data, or even a company whose business is not data, but still utilises encrypted data is breaking the LAW?!? Are you MAD?!?

If you have data that the government wants access to for an investigation, then you'd be obliged to give them that data. What if you were uncapable of providing that data? Who says you still have the key? Who says you encrypted that data? Who says WHO SAYS?! Nobody, that's who. The nature of such a thing is far beyond proof. Perhaps you create commands to erase said data. What about deleted data? What happens if someone sends you child porn? Sure, you delete it... but guess what, it's still on your HDD. So a technical expert examines your PC, finds your deleted data and undeletes it, WHAM! ARRESTED! LOL.

All these porn banners, with browsers that have cache and stuff... the moment you see it, it's on your HDD. Guess what? Just because you visited a site, you are BREAKING THE LAW. EVEN THOUGH YOU HAD NO CONTROL OVER IT. WHAM, ARRESTED!

Love you all.

All I can tell you is that this is bull ****. Goodbye.
 
Last edited:
It a bill, its open for discusstion.... If you dont object to to - then it becomes legislation...

Richard
 
RichardP said:
It a bill, its open for discusstion.... If you dont object to to - then it becomes legislation...

Richard
I object to the context. I also object anything that suppresses the rights of the people.
 
TigerTael said:
I object to the context. I also object anything that suppresses the rights of the people.

Parlament can pass any bill... ***BUT*** if it infringes on the Constitution which is the Highest Law - the Bill becomes NULL and Void!
 
LoneGunman said:
This article was picked up and spread around indymedia and watchdog sites worldwide. Locally, there was a crashing silence. You probably remember some bullsh*t coverage that referred to a 'new Bill' to 'protect the rights of consumers online' - but little else.

The reality is very different - as the writer below, took the time to read through the Bill. If you're worried about any current legislation, read what I think, is ALREADY in law, with - apart from this article below, from 2003 - NO uproar or mention by local media at all. The writer below, takes the time to demonstrate, quoting exact sections of the Bill, to prove his point - a good example of real journalism in action.

Funny that you never heard about this Bill, isn't it? Your worst nightmare already happened, and you know nothing about it.

(It appears within Frasers column: http://www.chico.mweb.co.za/pc/razor/2003/030514-raz.htm
and can be found at http://www.fortunecity.com/victorian/orwell/93/howlfour.html

----------------------------------------------------------->
THE NEW SOUTH AFRICAN ELECTRONICS BILL
you threw me into one serious fscking panic there.....

this is nothing other than the Electronic Communications and Transactions Act No 25 of 2002 signed into law around 30 June 2002...it has been in force for more than three years

this kind of act regularly bypasses the mainstream and non_IT media simply because it has limited relevance to the great majority; there was however a great deal of debate and a massive industry participation beforehand and many of the provisions - especially with regard to encryption & accreditation of "advanced electronic signatures"

i think the article is way overdone - yes there is potential in the way that provisions could be interpreted to allow abuse but this is true for just about everything - fact of the matter is that (a) the most important pieces of the Act are harmless, necessary and positive & (b) the DoC is yet to finalise one single set of regulations or otherwise achieve much remotely constructive...imho they are wholly incapable of administering the legislation - witness domain name authority cock-up etc etc & c) a number of provisions are unworkable or unenforceable (seems often to be the case with "IT" legislation) & d) the capacity of IT to outpace the law should not be forgotten

as regards a) the single most important function of the act is to equate data with traditional writing for legal purposes (the doctrine of functional equivalence if you like fancy titles) - setting out how data must be managed to make it admissible in courts; allowing for electronic and advanced electronic signatures and facilitating e-commerce

i could write you a thesis on your post because i have - looking at the big squeeze on ISPs under legislation such as the ECT Act & the recently passed Interception Act (RICA)...the most crucial point for me is that while we have happily copied and enacted this post 9/11 legislation from the EU (for the most part) we do not have the countervailling privacy/data protection legislation that creates the "balance" in the EU...in SA we do not even have the beginnings of a culture of respect for data privacy and we are likely to be extremely vulnerable until the South African Law Reform commission & govt gets their acts together and finalise the "privacy" working paper that has been floating around for the last two years (copy on the SALRC web site)

ISPs, while they are becoming an extension of the law enforcement agencies under RICA, are of the largest aggregators of personal information - they are the new intermediaries of commerce and information - understandable then that govt might want to allow itself access to the most comprehensive records of their citizen's personal information
 
dominic - the problem for me is that the Act contains - if the reading of it is correct - a variety of possibilities for abuse, 'if' the State feels like enforcing it.

Take the issue of 'cyber inspectors' - no warrants needed, total freedom to enter your premises and search through any books or documents which they think are or might be 'related', right down to - if there's any part of your PC that they/experts can't access, they can legally demand that you unencrypt the data (or you face charges)

If this is already in Law - and technically 'legal' - then surely its just a matter of time before it's used. And I'm unsure as to whether any publicity would even be allowed surrounding its use.
(Currently in the US, its illegal, for instance, should the FBI be investigating someone's reading habits at a library - for the local librarian to inform the customer that there have been inquiries from the authorities. I wonder if there's similar spins in effect in local law?

Then, I'm also curious as to the ISP's general role currently. Has anyone officially ever asked local ISP's what their reaction would be to law enforcement authorities asking them for access to put individuals under surveillance? And more importantly, would the ISP's themselves
a) inform their customer and/or
b) request a legal court order from the Authorities before allowing surveillance?

(I know things are heating up somewhat - I know of a couple of programmers working on creating appz which allow for data to be 'disappeared' into, overlaid with a harmless and genuine working exe file, and topologically rendered invisible in terms of sniffing algorithms hunting for hidden data or encryption signatures..)

The State can't demand that you unencrypt data - if they can't find it or even see that it exists. So technically you're doing nothing illegal. (This is also the problem with almost all the commercially available encryption tools - they themselves contain highly visible and known algorithm signatures, which means its very easy for the State to assemble a list of supposedly 'secure' files on your PC - even if they don't know what they are - and then demand you show them what's on them.
 
Last edited:
LoneGunman said:
dominic - the problem for me is that the Act contains - if the reading of it is correct - a variety of possibilities for abuse, 'if' the State feels like enforcing it.

Take the issue of 'cyber inspectors' - no warrants needed, total freedom to enter your premises and search through any books or documents which they think are or might be 'related', right down to - if there's any part of your PC that they/experts can't access, they can legally demand that you unencrypt the data (or you face charges)
LG - absolutely take the point that as it reads the ECT Act is open to governmental abuse, but i see no evidence at this stage of this happening....rather there is ineptitude in even the most basic implementation of the Act

to the best of my knowledge, for example, there is not yet a single cyber-inspector

ECT Act said:
Obtaining warrant

83.
(1) Any magistrate or judge may, upon a request from a cyber inspector but subject to the provisions of section 25 of the Criminal Procedure Act, 1977 (Act No. 51 of 1977), issue a warrant required by a cyber inspector in terms of this Chapter.
(2) For the purposes of subsection (1), a magistrate or judge may issue a warrant where*—
(a) an offence has been committed within the Republic;
(b) the subject of an investigation is*—
(i) a South African citizen or ordinarily resident in the Republic; or
(ii) present in the Republic at the time when the warrant is applied for; or
(c) information pertinent to the investigation is accessible from within the area of jurisdiction of the court.
(3) A warrant to enter, search and seize may be issued at any time and must*—
(a) identify the premises or information system that may be entered and searched; and
(b) specify which acts may be performed thereunder by the cyber inspector to whom it is issued.
(4) A warrant to enter and search is valid until*—
(a) the warrant has been executed;
(b) the warrant is cancelled by the person who issued it or in that person's absence, by a person with similar authority;
(c) the purpose for issuing it has lapsed; or
(d) the expiry of one month from the date on which it was issued.
(5) A warrant to enter and search premises may be executed only during the day, unless the judge or magistrate who issued it, authorises that it may be executed at any other time.
warrants definitely required (altho i would be happier if could only be authporised by a Judge and not a magistrate)...this is very similar to the position under the Telecomms Act which allows for search and seizure warrants to be executed by ICASA together with the SAPS...[/quote]

LoneGunman said:
If this is already in Law - and technically 'legal' - then surely its just a matter of time before it's used. And I'm unsure as to whether any publicity would even be allowed surrounding its use.
(Currently in the US, its illegal, for instance, should the FBI be investigating someone's reading habits at a library - for the local librarian to inform the customer that there have been inquiries from the authorities. I wonder if there's similar spins in effect in local law?
fortunately we are no where near as rabid as the US under the Patriot Act...this would be i guess the idea under the critical databases provision.

LoneGunman said:
Then, I'm also curious as to the ISP's general role currently. Has anyone officially ever asked local ISP's what their reaction would be to law enforcement authorities asking them for access to put individuals under surveillance? And more importantly, would the ISP's themselves
a) inform their customer and/or
b) request a legal court order from the Authorities before allowing surveillance?
this is more the new Interception Act - ISPs will not have a choice...if they can afford to they must set up a "interception and monitoring facility", bind their staff to secrecy and obey any "interception direction" issued by a judge to intercept and monitor the comms of a specified target...they have to interface with a provincial interception centre; they have to ensure that they have the capacity to deal with archived and real-time communications; etc etc etc

there is little choice in this (altho hopefully some ISPs will take a constitutional point to preserve client confidentiality...) - if the ISP does not play ball huge criminal penalties are laid out....

bear in mind this is "state security" at work and must be distinguished from civil requests to ISPs to reveal information about subscribers for use in civil proceedings (all the RIAA and online defamation stuff)

LoneGunman said:
(I know things are heating up somewhat - I know of a couple of programmers working on creating appz which allow for data to be 'disappeared' into, overlaid with a harmless and genuine working exe file, and topologically rendered invisible in terms of sniffing algorithms hunting for hidden data or encryption signatures..)
- yip...serious moving target and will have the effect that those who know what they are doing and wish to avoid detection will be able to do so.
 
Prometheus said:
Anybody ever heard of plausible deniability?
Good for digging this out (8/10/05)

dominic
i could write you a thesis on your post because i have - looking at the big squeeze on ISPs under legislation such as the ECT Act & the recently passed Interception Act (RICA)...the most crucial point for me is that while we have happily copied and enacted this post 9/11 legislation from the EU (for the most part) we do not have the countervailling privacy/data protection legislation that creates the "balance" in the EU...in SA we do not even have the beginnings of a culture of respect for data privacy and we are likely to be extremely vulnerable until the South African Law Reform commission & govt gets their acts together and finalise the "privacy" working paper that has been floating around for the last two years (copy on the SALRC web site)

Some bits out of the ECT Act - the ISPA ADVISORY:

No TSP can offer a telecommunication service that is not capable of being monitored. That is, all telecommunication services must be surveillance enabled or capable. (Section 30(1)(a)).
6. All the costs of ensuring surveillance capacity must be borne by the TSP.
7. TSP’s including ISPs are required to store communication-related (traffic) data.
8. The agencies or persons that may make applications for the surveillance of
communications include, law enforcement agents, the SA Police Service (SAPS), the National Defence Force (SANDF), the Secret Service and the National Intelligence Agency (NIA) or a member of the Independent Complaints Directorate.

Communications and Directions
The Act distinguishes between ‘direct communications’ (audible, oral communications between two or more people) and ‘indirect communications’ (the transfer of information including messages in the form of speech; music; data; text; visual images; signals and radio frequency spectrum).
Except where interception is authorised without a Direction, the Act provides for a variety of “interception directions” that can be obtained by law enforcement, who must apply to a designated (retired) judge to obtain an interception direction, before requiring assistance from ISPs. These are:
(a) The broad interception direction;
(b) A real-time communication related direction (for traffic related data on an
ongoing basis for no longer than three-months at a time)
(c) an archived communications direction (any communication related information in the possession of and being stored by a TSP)

http://www.tenet.ac.za/ISPA_Advisory_RIC%20Act.PDF

And mention of the EU above - would seem much of this new world order was formulated in SA - the proposal
 
I was thinking that this law only applies to when you are in the country and not off the shore so maybe we should all move out of the country. ;)

Uhhhhh, hope this is still available. Websites look so old and unmanaged.

Anybody here know how far SA's territorial waters extend and what the international limit is?
 
Last edited:
dominic said:
- understandable then that govt might want to allow itself access to the most comprehensive records of their citizen's personal information
This is wrong, this is unconstitutional unless this GVT overwrote that too. Where is the right to privacy. This implies everyone is a criminal unless proven differently. They should only be allowed to this information if there is good cause to believe you are actively an criminal and with a court order. Who in their right mind can trust this GVT agency's with this information. They will sell it for self gain, ID theft by the GVT extended!
 
dominic said:
to the best of my knowledge, for example, there is not yet a single cyber-inspector
Every policeman or legal clerc will be deemmed to be one with the toltal integration of law enforcement in this country!
 
Top
Sign up to the MyBroadband newsletter
X