The law that governs legal wiretapping in South Africa — the Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA) — was declared unconstitutional last week.
Anyone with a cellphone in South Africa has interacted with RICA, to the extent that it has become a verb that most of us understand.
Tell someone that you had to “RICA your SIM card” or mention a “pre-RICAed SIM” and chances are they will know exactly what you mean.
For those who might not be up-to-speed on the lingo, “RICAing” a SIM means to provide documents verifying your personally identifying information — a copy of your ID book or card, and a proof of address — which are registered against the SIM.
What is perhaps lost in this use of “RICA” as a verb is that the ultimate goal of the law is to establish the framework for legal interception.
RICA states that authorities must first apply for an “interception direction” from a judge, who was designated by the Minister of Justice to grant such requests, before they can execute a surveillance operation.
Surveillance operations include getting call records, listening in on calls, obtaining emails, and the interception of other electronic communications.
Post-surveillance notification
While RICA imposes some strict requirements for legal wiretapping in South Africa, the Constitutional Court has identified several problems with the Act and has given Parliament three years to fix it.
Among the problems, the court ruled on was the issue that your private communications could be intercepted and that you might not ever be told about it.
Vodacom CEO Shameel Joosub explained in 2018 that in the case of mobile networks, the government can intercept cellular communications without the operators even knowing about it.
This is thanks to interception and monitoring centres built in the early 2000s specifically to comply with RICA.
Rather than allow this to continue for the next three years while RICA is amended by Parliament, the Constitutional Court has injected two additional sections into the law as a stop-gap.
The provision dealing with what has been termed “post-surveillance notification” was written as follows:
Section 25A Post-surveillance notification
(1) Within 90 days of the date of expiry of a direction or extension thereof issued in terms of sections 16, 17, 18, 20, 21 or 23, whichever is applicable, the applicant that obtained the direction or, if not available, any other law enforcement officer within the law enforcement agency concerned must notify in writing the person who was the subject of the direction and, within 15 days of doing so, certify in writing to the designated Judge, Judge of a High Court, Regional Court Magistrate or Magistrate that the person has been so notified.
(2) If the notification referred to in subsection (1) cannot be given without jeopardising the purpose of the surveillance, the designated Judge, Judge of a High Court, Regional Court Magistrate or Magistrate may, upon application by a law enforcement officer, direct that the giving of notification in that subsection be withheld for a period which shall not exceed 90 days at a time or two years in aggregate.
It essentially states that the law enforcement agency that applied for an interception direction must inform the target 90 days after the surveillance operation ends.
To protect their investigation, officers can apply for extensions – 90 days at a time, to a maximum of two years.
Can your cellular or Internet provider send the post-surveillance notice?
MyBroadband asked Vodacom, MTN, Cell C, Telkom, and the Internet Service Providers’ Association (ISPA) whether they could send the post-surveillance notification as now mandated by the Constitutional Court.
The answers from Vodacom, MTN and Cell C were nearly identical:
“Mobile operators are prohibited in terms of Section 42(3) from divulging the fact that an interception direction has been received,” the networks explained.
“By implication, mobile operators cannot provide a subscriber with a notification of the existence of an interception direction.”
ISPA regulatory advisor Dominic Cull agreed with the mobile networks.
However, could the officer responsible for notifying the target of a surveillance order not ask their mobile network or Internet provider to inform them about the wiretap?
Cull said that Internet service providers are extremely careful to act in accordance with the applicable framework under RICA and that there is nothing in the Constitutional Court judgement which authorises an electronic communications service provider to disclose the fact of interception to anyone.
Rather, the new section 25A puts this obligation on the person who applied for the interception direction to make the disclosure in writing.
It remains to be seen how the Constitutional Court’s directives will be implemented.
