4

BRIEFING NOTES ON regulation of interception of communications and provision of communication-RELATED INFORMATION AMENDMENT BILL, 2006, TO THE SELECT COMMITTEE ON SECURITY AND CONSTITUTIONAL AFFAIRS ON 14 SEPTEMBER 2007

1. Introduction

1.1 The Regulation of Interception of Communications and Provision of Communication-related Information Act, 2002 (Act 70 of 2002) (which I will refer to as the principal Act), prohibits the interception of certain communications relating to serious crimes, except in terms of the provisions of the Act. In other words, it ensures that the interception and monitoring of communications only take place in accordance with very strict criteria after a specially designated judge has considered an application by any of our law enforcement agencies for “permission” or interception order to intercept and monitor the communications of a specific person in a particular case. Members are also reminded that the interception of communications is only allowed where a serious crime has been or is likely to be committed. The interception of communications is directed at criminals. The principal Act is also aimed at protecting law-abiding citizens because any interception and monitoring of private communications by anyone is illegal and subject to severe criminal sanctions. The principal Act provides for a number of other ancillary issues which I do not intend dealing with in this briefing, except to say that it requires the service providers to obtain and keep certain information pertaining to their clients in case it is required for detecting or investigating serious crimes. I mention this ancillary issue specifically because this is what our Bill revolves around. It revolves chiefly around sections 40 and 62(6) of the Act.

1.2 These sections, that is 40 and 62(6) deal with the information that needs to be obtained and kept by persons who sell cellular phones and SIM-cards: Section 40 deals with transactions after the commencement of that section and section 62(6) deals with persons who are already customers when the Act is implemented, that is existing owners of cellular phones and SIM-cards. Sections 40 and 62(6) have not yet been put into effect.

1.3 The Bill is intended mainly to amend the principal Act so by moving away from a “paper-based” registration process to an “electronic solution”. These were requested by the service providers, which are VODACOM, MTN and Cell C (which I shall refer to collectively as the MCO’s). When the provisions of the principal Act were in the process of being implemented during 2005, the MCO’s urged Government not to implement sections 40 and 62(6) of the Act, dealing with the registration of cell phones due to numerous practical issues they had identified. The implementation of these provisions was consequently delayed pending the promotion of the amendments contained in the Bill. The Bill also provides for offences, penalties and other sanctions where its provisions are not complied with.

1.4 The MCO’s, during their discussions with the Department on the proposed electronic solution, indicated that the proposed electronic solution would be applied in practice in the following manner:

(a) There is an existing process through which the required information in

respect of post-paid customers is obtained. That is customers who have cellphone contracts. This category of customers already comply with the registration requirements.

(b) In respect of pre-paid customers, that is those customers who buy air time, they, the MCO’s will have to set up registration points which will be located in –

* the formal distribution channels of the operators; and

* the informal distribution channels.

Registration agents will be designated by the MCO’s for purposes of the registration points located in the informal distribution channels. The registration agents will collect the information, conduct face-to-face validations and then the information will be sent from there to the central databases of the MCO’s.

1.5 The briefing will cover the following areas:

(a) First a brief overview of sections 40 and 62(6) of the principal Act as they are now.

(b) I shall then refer to the practical difficulties pointed out to us by the MCO’s with the implementation of these sections.

(d) Finally, I shall deal with the advantages and benefits of the Bill.

2. Existing sections 40 and 62(6) of the principal Act

2.1 Section 40 at the moment places the following obligations on a person who sells or in any other manner provides a cell phone or SIM-card to another person:

(a) If the recipient is a natural person-

(i) the following must be obtained by the seller from the recipient, namely -

* the full names;

* ID number;

* residential and business or postal address; and

* a certified copy of ID document;

(ii) the seller must retain a certified copy of the ID document and must verify -

* the photo;

* the full names; and

* ID number.

(b) If the recipient is a juristic person-

(i) the seller must obtain from the person representing the juristic person, the following:

(aa) In respect of the representative:

* his or her full names, ID number, residential and postal address; and

* a certified copy of the representative’s ID document.

(bb) In respect of the business:

* the name and address and registration number (if applicable) of the business; and

* a certified copy of the business letterhead.

(ii) The seller must retain certified copies of the ID document and the letterhead.

(iii) The seller must verify -

(aa) in respect of the representative:

* his or her photo, full names and ID number.

(bb) in respect of the business:

* the name and registration number thereof.

(i) the information and copies obtained and any change in information;

(ii) the cellular telephone number or any other number allocated to the recipient;

(iii) the number of the cellular phone concerned; and

(iv) any other information required to identify the recipient.

2.2 Section 62(6) places an obligation on a person, who at the date of commencement of the Act, is the owner of a cellular phone or SIM-card (the so-called “historical owners”) to provide the information mentioned in section 40. The information must be provided in the manner and within the period determined by the Minister by notice in the Gazette. This information must be provided to the person who sold or provided the phone or card or to the MCO.

In respect of the notice, the following requirements are set out:

(a) Different periods may be determined by the Minister;

(b) the Minister must consult the MCO’s before determining the periods; and

3. Practical difficulties identified by the MCO’s regarding the implementation of sections 40 and 62(6)

The following practical difficulties in the implementation of the said sections were highlighted by the MCO’s:

(a) The MCO’s make extensive use of informal distribution channels in respect of pre-paid communication services in traditionally under-served markets, mainly rural areas. A paper-based registration process will not be viable for these sellers who will not have the infrastructure to comply with the Act. This will have a negative impact on job creation and employment in the informal distribution chain, with a resulting negative impact on services and access.

(b) Law enforcement agencies will experience difficulties in tracing documents through a cascading decentralised paper-based system. In other words, law enforcement agencies will have to approach different persons and organisations, which form part of the distribution channels, in order to gather information and trace the documents and cellular phones as the distribution channels are not structured.

(c) Difficulties will be experienced in enforcing and monitoring the registration of cellular phones and SIM-cards already in circulation since there is no central control mechanism to establish whether a customer has failed to register or not.

(d) Difficulties will be experienced in enforcing the registration of cellular phones.

4. Overview of individual clauses of the Bill

4.1 Clause 1

Clause 1 of the Bill inserts a number of new definitions in the principal Act and also amends a number of existing definitions. The Bill is aimed mainly at the registration and verification of certain particulars of owners of cellular phones and SIM-cards, for instance addresses and identity. If persons cannot provide an address or identity document, they will not get access to cellular phone services. Some of the definitions in clause 1 are therefore intended to ensure that as many persons as possible will be in a position to comply with the registration requirements, particularly persons who live in outlying areas who rely heavily on cellular phone services, for instance persons needing information about pension pay-outs and cellular phone banking. I think the Memorandum of the Objects of the Bill explains these definitions and the reasons for them well:

A: The definitions to facilitate compliance with the registration requirements:

(a) The new definition of “address”, besides referring to conventional forms of addresses, such as where the persons usually resides, also includes as addresses, places for persons living in “informal settlements”, for instance an address of a school, church or retail store where a person living in an informal settlement usually receives his or her post. That is in the case of natural persons. If the person is a juristic person, eg a company, address is defined as the registered of the juristic person or the address where business is situated (This definition has a bearing on section 40(2) of the Act which will be discussed later )

(b) In order to clarify the expression “informal settlement” in the definition of “address”, the new definition of “informal settlement” is defined as “a place in an urban or rural setting used for residential purposes and in respect of which no physical addresses or street particulars are officially assigned”.

(c) The definition of “identification document”, already in the principal Act, is being amended in order to assist persons who may, for some or other reason, not be in possession of an identity document as currently defined in the principal Act, for instance persons who are not yet 16 years old and refugees. The current definition is being expanded to include documentation which children younger than 16 years can obtain, for instance a passport. This definition recognises the fact that there are many child-headed households who do not qualify for identity documents as contemplated in the Identification Act, 1986. An “identification document” now includes the following:

(i) in the case of a person who is a South African citizen or is lawfully and permanently resident in the Republic –

* a green, bar-coded identity document issued in terms of the Identification Act, 1986, until such identity document is replaced by an identity card as contemplated in the Identification Act, 1997;

* an identity card issued in terms of section 14 of the Identification Act;

* a temporary identity certificate issued in terms of section 16 of the Identification Act; or

* a South African passport issued in terms of the South African Passports and Travel Documents Act, 1994; or

(ii) in the case of a person who is who is not a South African citizen or not permanently resident in the Republic, excluding a refugee, a valid passport or travel document as contemplated in the Immigration Act, 2002; or

(iii) in the case of a person who is a refugee, a valid identity document issued in terms of section 30 of the Refugees Act, 1998.

(d) The proposed new definition of “identity number” broadens the scope of what an identity number is, to include not only the number referred to as the identity number in a South African identity document, but also a passport number or a number which is issued on a document to a refugee in terms of section 30 of the Refugees Act, 1998.

(The definitions of “identification document” and “identity number” has a bearing on section 40(3) which will later on be discussed in detail.)

B: Other definitions:

(a) A new definition of “activate” has been inserted, which means “to allow access to the network of the electronic communication service provider who provides a mobile cellular electronic communications service”. This is intended to provide clarity on when a cellular phone or SIM card will be regarded as activated for purposes of section 40(1) and section 62(6)(a).

(b) The definition of “customer” in the principal Act is extended to include former customers of MCO’s, where applicable. At present it only refers to existing customers of MCO’s. The amended definition of customer has a bearing sections 40(7) and 62(6)(c) which will be later be discussed as well as Chapter 3 of the of the principal Act that relates to the application to and granting of interception directions by the designated judge.

(c) A definition of “family member” has been inserted. It finds application in the proposed new section 40(5) of the principal Act, dealing with the disposal of a cellular phone or SIM card by a person to another person, other than a family member, and will be discussed shortly. A family member means a person who is related to another person biologically, by statutory, customary or religious law, including affinity by marriage, adoption or foster care, a person’s permanent life partner, or, in the case of an orphan, a care-giver as defined in the Children’s Act, 2005 (Act No. 38 of 2005).

4.2 Clause 2

Clause 2 of the Bill replaces section 40 of the principal Act and can be summarised as follows:

4.2.1 The proposed section 40(1) prohibits an MCO from –

(a) activating a SIM-card; or

(b) allowing the use of any cellular phone,

on its electronic communications system unless subsection (2) has been complied with.

4.2.2 In terms of the proposed section 40(2), an obligation is placed on an MCO, at own cost, to implement a process to record and store the following information:

(a) The Mobile Subscriber Integrated Service Digital Network number (MSISDN- number) of the SIM-card that is to be activated by the MCO concerned;

(b) the International Mobile Equipment Identity Number (IMEI-number) of the cellular phone that is to be used;

(d) the following personal particulars of the person who requests that a SIM-card be activated or that a cellular phone be allowed to be used on the system of an MCO, namely –

(i) in the case of a person who is a South African citizen or is lawfully and permanently resident in the Republic, the full names and surname, identity number and at least one address of such person;

(ii) in the case of a person who is not a South African citizen or who is not permanently resident in the Republic, the full names and surname, identity number and at least one address of such person and the country where the passport was issued; or

(iii) in the case of a juristic person−

* the full names, surname, identity number and an address of the authorised representative of the juristic person; and

* the name and address of the juristic person and, where applicable, the registration number of the juristic person.

4.2.3 The proposed section 40(3) spells out how the information that is recorded and stored must be verified. An MCO must verify−

(a) the full names, surname, identity number and identity of the person and, where applicable, the country where the passport was issued, by means of an identification document;

(b) the name and, where applicable, the registration number of the juristic person by means of documentation, including a registration document, founding statement, document issued by the South African Revenue Service or any other similar document;

(c) in the case of a person South African citizen and a juristic person, the address, by means of documentation, including a bank statement, a municipal rates and taxes invoice, telephone or cellular phone account of not older than three months, or any other utility bill or an account of a retailer of not older than three months, or an existing lease, rental or credit sale agreement, insurance policy, a current television licence or a new motor vehicle licence document (this is not require in the case of visitors to the country); and

(d) the authority of the representative of a juristic person by means of a letter of authority or an affidavit.

4.2.4 The proposed section 40(4) places an obligation on an MCO’s to ensure that the process to obtain and register the required information, the information itself and the facility on which the information is kept are secure and only accessible to persons specifically designated by the MCO in question. The Minister for Justice and Constitutional Development may furthermore determine security standards for compliance with these requirements.

4.2.5 The proposed section 40(5) and (6) makes provision for the instances where an activated cellular phone or SIM-card is transferred by one person to another and the recipient is not a family member. The transfer of cellular phones and SIM-cards between family members is excluded from the ambit of these provisions. In terms of the proposed section 40(5), if a person sells or, in any manner, provides an activated cellular phone or SIM-card to another person, who is not a family member, the person receiving the cellular phone or the SIM-card and the person giving the cellular phone or SIM-card must, immediately provide the relevant MCO with the following information:

(a) The full names, surname and identity number of the person giving the cellular phone or SIM-card; and

(b) all the particulars of the person receiving the cellular phone or SIM-card as required by section 40(2).

The MCO must, upon receipt of this information -

(a) verify the full names, surname and identity number and identity of both persons (the giver and the recipient) with reference to their identification documents;

(b) verify the address, contemplated in section 40(3), of the person who is to receive the SIM-card or the cellular phone by means of the documents contemplated in that section; and

The MCO must, upon receipt of this information, immediately record and store the information as contemplated in section 40(2).

4.2.6 The proposed section 40(7) obliges the MCO’s to respond to queries of the law enforcement agencies whether a particular person is a customer of the MCO in question and also to provide certain information relating to that customer, prior to the issuing of an interception direction in terms of the principal Act.

4.2.7 The proposed section 40(8) requires an employee or agent of an MCO to report any false information that has been submitted for verification purposes, to a police official at a police station.

4.2.8 The proposed section 40(9) grants to the Minister the power, by notice in the Gazette, for a period not exceeding three months, to exempt MCO’s from verifying, recording and storing the particulars of visitors to the country ( called “roamers”) contemplated in subsection 40(2). This exemption can only take place after the Minister has weighed up security and crime considerations against the following factors, namely—

(a) the extent to which an international event hosted by the Republic may be affected;

(b) the international obligations of the Republic;

(d) the objective of universal access to electronic communications service; and

(e) the number of persons entering the Republic within a particular period.

The provision has in mind big events such as the 2010 World Cup Soccer, for example.

4.3 Clause 3

Clause 3 of the Bill seeks to amend section 51 of the principal Act. Section 51 deals with offences and penalties for contravention of any provision of the Act. New obligations and duties are created in the Bill. Failure to comply with these obligations and duties also needs to be made subject to criminal sanction. That, in essence, what clause 3 is about. Clause 3 adds to the list of offences and penalties already contained in section 51 of the principal Act. It, for instance, criminalises non-compliance with the proposed new sections 40, 62(6) and 62C of the Act. Furthermore, a conviction under this section does not relieve an MCO from compliance with the relevant section.

4.4 Clause 4

Clause 4 of the Bill amends section 62(6) of the principal Act. In terms of the amendment an MCO must, within 12 months from the commencement of the Bill, record, store and verify the information required by the proposed section 40 in respect of all customers whose cellular phones and SIM-cards are already activated on its electronic communications system at the time the Bill is implemented. The provisions of section 40 apply mutatis mutandis in respect of the information to be recorded, stored and verified. A person who is a customer of an MCO at the time the Bill comes into operation, has 12 months within which to provide the prescribed information to his or her MCO. If this is not done, the MCO is obliged, under threat of a severe criminal sanction, to terminate that person’s access to the cellular services.

4.5 Clause 5

Clause 5 inserts sections 62A, 62B and 62C in the principal Act.

The proposed section 62A provides that the Minister may determine uniform tariffs of compensation payable by the MCO’s/electronic communication service providers to persons employed in order to record and store the information contemplated in sections 40 and 62(6) of the Act. This was inserted at the request of some MCO’s in order to eliminate any unnecessary competition in this crucial initiative.

The proposed section 62B places an obligation on MCO’s to inform their customers of their obligations in terms of proposed sections 40, 41 and 62(6) of the Act and the manner in which such obligations must be complied with, as well as the consequences of non-compliance with these obligations.

The proposed section 62C requires from juristic persons which provide cellular phones or SIM cards to their employees, to keep record of the particulars of these employees. It also requires persons who, for reward, hire out cellular phones or SIM-cards to record and store the particulars required in section 40(2) and verify the personal particulars of their clients. This information must be stored for a period of 5 years. Failure to comply is criminalised.

4.6 Clause 6 and 7

These clauses are very technical and deal with the commencement. Clause 6 amends section 63 of the principal Act. At the moment section 63 provides that the principal Act comes into operation on a date fixed by the President by proclamation in the Gazette. Clause 6 adds a new provision to state that sections 40 and 62(6) (which, as already mentioned, have not yet been put into operation, and which are being amended by the Bill) come into operation on the same date as the Bill comes into operation. This, in effect, does away with the necessity for the President to implement these provisions by way of a Proclamation. Clause 7 of the Bill provides that the Bill shall comes into operation on 1 January 2008 or on such earlier date as the President may determine by proclamation in the Gazette.

5. Advantages and benefits of Bill

The proposed amendments have the following advantages or benefits:

(a) They will improve the effectiveness of the principal Act, especially from the perspective of law enforcement agencies. As the necessary customer information will be available centrally at each MCO, the time and resources of law enforcement agencies will be saved. They can approach a central source to obtain the information they require, rather than having to follow a paper trail.

(b) The solution is not reliant on Government sources. This will eliminate the need to place a huge administrative burden on already under-resourced offices and officials.

(c) The infringement and disruption that the registration process will cause on the citizens of the country will be reduced.

(d) The MCO’s will be able to control access to their systems by way of “blocking” or limiting services to their customers in the case of non-compliance.

(e) When the Bill is assented to by the President, mobile service operators and historical customers will be well aware of their obligations and the time period within which registration must be completed so as to prevent de-activation of services.

(f) The burden on the informal distribution points, particularly in the rural areas, will be reduced.

(g) A uniform application of the system is more likely.

(h) Because the obligation to register is now placed on the MCO’s and not historical owners, appropriate steps will be taken by such operators to ensure compliance so as to prevent economic losses.

6. Conclusion

It is important to end off by emphasising that the Bill requires the capturing of essential information, not only for investigation purposes, but also information that may be required as evidence in our courts. Without the requirements as set out in the Bill, there will be gaps or loopholes, making the entire principal Act almost meaningless.

1. Differences between the Bill as introduced and the Bill now

1.1 The Electronic Communications Act, 2006, inter alia, brought certain terminology used in the communications environment into line with international accepted terminology, and substituted –

(a) “telecommunication service provider” with the term “electronic communication service provider”; and

(b) “telecommunication service” with the term “electronic communications service”.

The principal Act has therefore been amended accordingly, but the amendments in the Bill need to capture the new terms where they occur. The necessary changes have been made to the Bill in this regard.

1.2 Clause 1 of the Bill, as introduced in Parliament, only contained one definition, that of “family member”. The Bill adopted by the Committee contains various new definitions as was already discussed. The newly inserted definitions of “address”, “informal settlement”, “identification document” and “identity number” are aimed to ensure that as many persons as possible comply with the registration requirements of the Act. In addition to the afore-mentioned the definitions of “activate”, “cutomer” and “family member”, have also been inserted in the Bill.

1.3 The following noteworthy changes have been effected to Clause 2 of the introduced Bill:

(a) The additional requirement of the recording and storing of the IMSI-number has been inserted (see section 40(2)(c).

(b) The Bill requires that only one address be recorded and stored. The Bill as introduced required the recording and storing of a residential, business and postal addresses (see section 40(2)(d).

(c) Whereas the introduced Bill did not state specifically how the verification of the personal particulars of the person should be done, the Bill spell out in detail how this must be done (see section 40(3)).

(d) In addition to the requirements of the introduced Bill that an MCO must ensure that the registration process, the information recorded and stored and the storage facilities should be secure, the Bill gives the Minister a discretion to determine minimum security standards in this regard (see section 40(4)).

(e) The introduced Bill placed the obligation on the person who sells or otherwise provided a SIM-card or cellular phone to another person to collect and verify the particulars of the recipient thereof to retain that information and to inform the relevant MCO of change of ownership. In terms of the Bill the both parties is now under an obligation to provide the required information to the MCO. Furthermore, in terms of the Bill the MCO must now verify the personal particulars of both the persons and the cellular phone and SIM-card and record

and store such information (see section 40(5) and (6)).

(f) The Bill makes provision for the reporting of any suspected fraudulent documentation in the verification process. The introduced Bill did not contain such a provision.

(g) The Bill makes provision that the Minister may, under certain circumstances and for a specific period of time, exempt the MCO’s from compliance with section 40. The introduced Bill did not contain such a provision.

1.4 Clause 3, which amends section 51 of the Act, remained largely unchanged, with the exception of the following amendments:

(a) The Bill also criminalises non-compliance by an MCO with the directives issued under section 30(2) of the Act.

(b) Non-compliance with the minimum security standards that the Minister may issue in terms of section 40(4) is criminalised.

(d) Non-compliance by a juristic person with section 62C is criminalised.

1.5 Clause 5 which inserts section 62A, 62B and 62C in the Act is something the introduced Bill did not provided for. Sections 62A, 62B and 62C were already discussed.

1.6 Clause 6, unlike the introduced Bill, specifically makes provision for the coming into operation of sections 40 and 62(6).