THE LANGUAGE BILL, 2000

SUBMISSION BY TELKOM ON THE INTERCEPTION AND MONITORING BILL, 2001

1 GENERAL OBSERVATIONS AND COMMENTS

Telkom SA Limited would like to express its appreciation for the opportunity to comment and make representations with respect to the Interception and Monitoring Bill, 2001

Introduction

The Bill seeks firstly to place on telecommunication service providers the obligation of ensuring the monitorability of all communications.
Secondly it seeks to prohibit the provision of telecommunication services by telecommunication service providers that lack the capacity to be monitored.
In the third instance it places the obligation and cost of providing the equipment and facilities required to monitor communications on service providers as opposed to placing it on the respective government departments concerned.

1.1.4 In the forth instance the Bill infringes a number of constitutional rights such as the right to privacy, fair trial, property, equality and proportionality and the enactment thereof may be subject to a constitutional challenge.

What concerns Telkom is that, although the proposed approach of the Bill may seem to be a pragmatic and cost-effective solution to the problem faced by government of ensuring that it can effectively monitor communications in an environment of rapid and sometimes bewildering technological change, it gives rise to a plethora of problems as more fully canvassed below.
Some of the consequential issues arising from the Bill may be considered intractable, or at the very least would require a reconsideration of the premise on which the new approach to interception and monitoring is based.
The requirement that the Telecommunication service provider must ensure the monitorability of telecommunication services also raises a number of concerns as more fully canvassed below.

1.2 Inability to make all telecommunication services capable of being monitored

1.2.1 South Africa has a considerable amount of established infrastructure and existing network telecommunications capacity that cannot -except at prohibitive cost- be rendered capable of intercepting and monitoring communications at will.

1.2.2 Private telecommunications networks ("PTN") may for instance encompass both national and international telecommunication networks and carry the traffic of a single party, usually that of a corporate person. Where the network provider is tasked with the end to end responsibility for interception and monitoring of such networks, whose scale, complexity and international reach might require the co-operation not only of other international network providers but also the administrative authorities of third countries, interception and monitoring can only be undertaken at prohibitive cost and with the co-operation of international network providers.

1.2.3 The capacity of a network provider to intercept and monitor communications may also be limited by how effectively it can deal with the problems posed by the various network architectures and encryption on these networks.

1.3 Monitorability versus network expansion and affordability of services

1.3.1 The financial implications of ensuring the monitorability of all communications, particularly in a context where there are no stipulations as to the cost, affordability, grade of service and the reasonableness of requirements, would undermine the telecommunications policy framework which the government has so assiduously crafted.

1.3.3 There will clearly have to be a trade-off between the mandate of operators to extend penetration and renew and extend the existing telecommunications network with limited resources and under considerable time restraints -particularly to undeserved and previously disadvantaged communities- and meeting new and rather onerous obligations of monitoring communications to the detriment of the former.

1.4 Any judge competent to issue or extend a direction

1.4.1 If a judge (section 4(2)) may direct and any judge (section 4(4)) may extend the operative period of a direction it could be near impossible for a service provider to verify and check the source and identity of a judge when a verbal direction is issued.

1.4.2 Telkom submits that a judge should be designated for purposes of issuing directions in terms of the Act, as is presently the case. The reference should therefore be to a judge designate and not merely to a judge or any judge. That coincides with the definition of a judge in the definitions clause of the Bill.

1.5 Assistance at execution of directions by service providers

1.5.1 In terms of section 6(1)(b) a service provider served with a direction addressed to it must enable the person authorized to execute a direction to intercept or monitor communications or assist with the execution of the direction.

1.5.2 In order not to expose employees of service providers to risk, the obligation to enable execution or to assist with the execution of a direction should exclude:

the rendition of assistance by employees of service providers to gain entry into customer premises, or to provide cover for authorized entry,
the installation or placement of technical monitoring or bugging devices into customer premises, handsets or other devices and connecting it to the service provider's network, and
the installation of additional lines or connections on or to customer premises.

1.6 Recovering the cost of assistance rendered at executing directions

1.6.1 The remuneration payable to a service provider for enabling execution or for assisting with the execution of a direction is only in respect of direct costs incurred in respect of personnel and administration and the lease of telecommunications systems, where applicable, and may not include the costs of acquiring the facilities and devices in accordance with sections 7(2), 7(4) and 7(5). (Section 6(4))

1.6.2 Since the monitoring of communications is quintessentially a function of law enforcement the attendant investment, technical, maintenance and operating costs of acquiring, providing and monitoring facilities and devices should be recoverable from the cost of rendering assistance to monitor communications.

Prohibition on certain telecommunication services

1.7.1 Section 7 confers on the Minister of Communications extensive discretionary powers to issue very prescriptive directives from time to time after consultation with the service provider concerned, regarding either the acquisition or upgrading of facilities and devices for purposes of monitoring communications.

1.7.2 The fact that the minister may prescribe the security, technical and functional requirements of the facilities and devices to be acquired; the systems to be used, and the manner of routing duplicate signals of communications and call-related information still leaves the service provider concerned with no choice of provider or mode of routing.

1.7.3 The provision takes no account of the fact that the facilities of the service provider's choice may be cheaper, better, more reliable, more stable and more compatible to its infrastructure than the facilities prescribed. It also implies that the service provider must adapt its system with that of the yet to be established central monitoring centres and not vice versa. As such the provision is unreasonable.

1.8 Requests for the provision of call-related information

1.8.1 The Bill should take account of the fact that there are limitations in that the provision of call-related information in real time is not possible. Since there is no immediate transfer or dumping of call-related information into a central data bank the provision of up to date data has to be done by means of manual intervention. The Bill also does not specify the form in which call-related information is to be provided.

1.9 Information to be obtained and kept by service providers

1.9.1 The fact that service providers conduct business by phone means that the identity and personal information of applicants can not always be verified and vouched for.

1.9.2 The Bill also does not specify for how long records are to be kept and if records need to be kept for past clients.

1.10 Offences and penalties

1.10.1 The maximum sentence prescribed for illegal monitoring is less than that for improper disclosure of information by a functionary of a service provider and disproportionate to the gravity of infringing a fundamental right. It will therefore not be much of a crime-prevention deterrent.

1.11 Magistrate's courts attenuated jurisdiction

1.11.1 Despite Magistrate's courts otherwise confined jurisdiction it may in terms of the Act impose any penalty provided for in the Act. (Section 15(3))

1.11.2 It is arguable whether justification exists for the imposition of fines (implicitly the adjudication of offences) associated with offences relating to the statutory limitation of fundamental rights by Magistrate's courts

2 SPECIFIC COMMENTS
2.1 Section 1 Definitions

2.1.1 "call-related information" includes switching, dialling or signalling information that identifies the origin, destination, termination, duration and equipment identification of each communication generated or received by a customer or user of any equipment, facility or service provided by a service provider and, where applicable, the location of the user within the telecommunications system;

Comment:

2.1.2 It is not known what is meant by "equipment identification" and in the absence of clarity of the matter, the words should preferably be deleted.

2.1.3 With respect to certain types of equipment, it should be noted that not all the call information can be provided.

2.1.4 We would therefore propose that the section be amended to read as follows:

"call related information" means, to the extent that is possible to provide such information switching, dialling or signalling information, that identifies the origin, destination, termination, duration and equipment identification of each communication generated or received by a customer or user of any equipment, facility or service provided by a service provider, and where applicable, the location of the user within such telecommunications system."

2.2 Section 6

2.2.1 In view of the fact that the Draft Bill will pose a much wider responsibility on Telkom than in the past, the Bill should state that directives be served on the service provider concerned at its registered head office or chosen domicilium citandi et executandi. Directions by a designated judge should be given directly to a service provider's designated official, be it oral or written.

2.3 Section 6(4):

Comment:

2.3.1 The remuneration referred to in subsections (2) and (3) should include all incidental costs such as installation costs, the cost of providing data, call related information and routing as well as witness fees.

2.3.2 Telkom should as a minimum be permitted to amortize the cost of any equipment purchased for the purpose of this Act, over the technical life of the equipment and include such cost into the cost of the leased circuits or the cost of providing the specific service.

2.4 Section 7(1)
7. (1) Notwithstanding any other law, no service provider may provide any telecommunication service which does not have the capacity to be monitored: Provided that a service provider providing such a service is only responsible for decrypting any communication encrypted by a customer if the facility for encryption was provided by the service provider concerned.

2.4.1 Telkom suggests the following amendment:

Notwithstanding any other law, no service provider may to the extent that it is both technically and economically feasible provide any telecommunication service which does not have the capacity to be monitored: Provided that a service provider providing such a service is only responsible for decrypting any communication encrypted by a customer if the facility for encryption was provided by the service provider concerned.

The provision apparently infringes the following constitutional rights:

the right to free economic activity since it impacts upon the costs and revenue of a service provider, and
the right to privacy which in terms of the Constitution includes the right not to have your communications infringed. (Section 14(d))

2.5 Section 7(2)
(2) A service provider must at own cost and within the period, if any, specified by the Minister of Communications in a directive referred to in subsection (4)(a), acquire the necessary facilities and devices to enable the monitoring of communications in terms of this Act.
Comment:

2.5.1 The obligation to acquire the facilities and devices within a stipulated time, as formulated in this section, is problematic, since:

the facilities and devices may not exist and will have to be developed for the purpose,
such persons as may be capable of providing or developing said facilities and devices may be persons subject to foreign jurisdictions where the provision or supply of such facilities may be restricted or prohibited,
it deprives a service provider of its constitutional right to free economic activity, and
furthermore to require a service provider to acquire specific equipment at its own cost -which is for a public purpose or benefit- without compensation is unconstitutional and a violation of section 25(2) Of the Constitution of South Africa, Act 108 of 1996.

2.5.2 The minister should not, and does not need to, have the power to prescribe the service providers what systems they need to acquire for purposes of monitoring communications.

2.5.3 The clause in its current formulation limits Telkom’s commercial and contractual freedom.

2.6 Section 7(3):

(3) The investment, technical, maintenance and operating costs in enabling a telecommunication service to be monitored, must be carried by the service provider providing such a service.

Comment:

2.6.1 Telkom is of the view that this provision is both unreasonable and unfair:

It is unreasonable because while capability and capacity required are determined by the security entities, the cost is born by the service provider. As the security entities do not bear the costs, they have no incentive to confine their requirements to what is necessary and reasonable, nor is there any provision in the Act to compel them to do so. The service provider, on the other hand has no way to resist unreasonable requests;

2.6.2 It is unfair because:

it puts the burden of financing an activity of the state, security and crime prevention, on a predetermined section of the population, the providers of telecommunication services and through them their customers.

with respect to Telkom it is also unfair because it creates what could be extremely onerous financial obligations, which were not taken into account when Telkom committed itself to the roll-out obligations in its PSTS licence. The problem is further exacerbated by the fact that Telkom, unlike other telecommunication service providers, is subject to a Price Cap regime in its licence which restricts its ability to recover these costs from its other customers.

2.6.3 If the cost quoted with regard to the provisions of such services in the USA of between $500 million and $1.8 billion can be of any assistance, it should be evident that the provision is not justified.

2.6.4 Maintenance costs and costs pertaining to the upgrading of the software with regard to this equipment, should also be considered.

2.7 Section 8(3):
(3) Duplicate signals of communications authorized to be monitored in terms of this Act, must be routed by the service provider concerned to the designated central monitoring centre concerned.

Comment:

2.7.1 Save for what said above in respect of costs, forecasting of capacity, and possible complexity in accessing the signal to be duplicated, this provision seems acceptable

2.8 Section 8(1)

8. (1) The Police Service, the Defence Force, the Agency, the Service and the Directorate must, at State expense, establish, equip, operate and maintain central monitoring centres for the authorised monitoring of communications in terms of this Act: Provided that an agreement on the sharing of any such central monitoring centre, including the cost thereof, is not excluded.

2.8.1 Since the location and amount of monitoring centers will have an effect on the cost and may require an expansion on our network the cost should be recoverable.

2.9 Section 7(5)
(5) A directive referred to in subsection (4)(a) may include specifications relating to-

(a) the security, technical and functional requirements of the facilities and devices to be acquired in terms of subsection (2);

(b) the capacity needed for interception purposes;

(c) the systems to be used;

(d) the connectivity with central monitoring centres referred to in section 8;

(e) the manner of routing duplicate signals of communications to designated central monitoring centres in terms of section 8(3); or

(f) the manner of routing call-related information to designated central monitoring centres in terms of sections 9(4) and 10(1) or (2).
Comment:

2.9.1 It is doubtful whether the Minister will in fact have the capability to specify some of the listed elements, as often only the affected service provider, or the equipment supplier, will have the required technical information.

2.10 Section 11(1),(2) and (3):
11. (1) A service provider must-

(a) before he, she or it enters into a contract with any person, body or organization for the provision of a telecommunication service to such person, body or organization-

(i) in the case of a person, require from such person his or her full names, residential, business or postal address and identity number; or

(ii) in the case of a body or organization, require from such body or organization its business name and address and, if registered as such in terms of any law, its registration number; and

(iii) any such other information as the service provider deems necessary; and

(b) ensure that proper records of-

(i) the information referred to in paragraph (a) and, where applicable, any change in such information which is brought to the attention of the service provider; and

(ii) the number allocated to the customer,

are kept.

(2) A service provider must provide the Police Service, the Defence Force, the Agency, the Service or the Directorate with such information regarding a customer, as may be required by an officer or member referred to in section 3(1)(a), (b), (c) or (d) to perform the functions and exercise the powers authorized by law.

(3) The obligation in terms of subsection (2) includes the provision of the information referred to in subsection (1)(a) in respect of a customer

(a) with whom or which the service provider concerned has entered into a contract for the provision of a telecommunication service; or

(b) to whom or which a pre-paid telecommunication service is provided, if such information of such customer is available.
Comment:

2.10.1 The practicality of these requirements are questionable, particularly with respect to where services are contracted telephonically. It is also not clear for what period these records are required to be kept.

2.11 Section 15(2)
(2) Any service provider who or which-

(a) fails or refuses to comply with, or to assist with the execution of, a direction issued in terms of section 4 or 10(2) or a supplementary direction issued in terms of section 10(1);

(b) fails or refuses to comply with a directive issued in terms of section 7(4);

(c) contravenes section 7(1), 8(3) or 11(2); or

(d) contravenes section 11(1),

is guilty of an offence and liable on conviction

(i) in the case of a conviction of an offence referred to in paragraph (a), (b) or (c), to a fine not exceeding R1, 000 000 and to a further fine not exceeding R50 000 for every day during which such failure, refusal or contravention continues; or

(ii) in the case of a conviction of an offence referred to in paragraph (d), to a fine not exceeding R200 000.

Comment:

2.11.1 In its current formulation, the obligations are absolute and could be extremely onerous. There is, therefore, a high risk that telecommunication service/network providers will be unable to comply.

2.12 Section 16
16. The Minister of Communications may, in the case of a second or subsequent conviction of an offence referred to in section 15(2)(b) and notwithstanding the imposition of any penalty prescribed by section 15(2), revoke the licence issued to the service provider concerned in terms of Chapter V of the Telecommunications Act, 1996, to provide a telecommunication service.
Comment:

2.12.1 As discussed earlier, in light of the lack of consultation in formulating the obligation, this seems rather draconian.

2.13 Safeguarding witnesses

Telkom would like to suggest, with respect to the provision of viva voce evidence in a court of law by an employees of service providers that, consideration should be given as to whether such evidence presented in terms of the Act could not be given "in camera" to safe-guard the employee (of the Network/Service Provider) and to keep the employee’s involvement in matters relating to this Act, from becoming public knowledge. Alternatively, consideration should be given as to whether such evidence could not be given in the form of an affidavit or certificate, as provided for in the Criminal Procedure Act (Sections 212 and/or 213).