FC: South Africa moves to increase Net-surveillance, limit encryption

[Declan McCullagh <declan () well com>]

A quick summary of South Africa's "Interception and Monitoring" bill, which 
has cleared the Cabinet and is heading for a vote in the Parliament:

* Internet providers and telephone companies must provide a pipe to a 
National Monitoring Center for Carnivoresque surveillance. "The Police 
Service, the Defence Force, the Agency, the Service and the Directorate 
must, at State expense, establish, equip, operate and maintain central 
monitoring centres... Duplicate signals of communications authorized to be 
monitored in terms of this Act, must be routed by the service provider 
concerned to the designated central monitoring centre concerned."

* Internet providers may not "provide any telecommunication service which 
does not have the capacity to be monitored." A provider is responsible for 
"decrypting any communication encrypted by a customer if the facility for 
encryption was provided by the service provider concerned." This represents 
an attack on liberty, privacy, and autonomy, and is akin to anti-encryption 
rules in Russia a few years ago. Though as a practical matter, a lot would 
seem to turn on the definition of "provide." Does that mean giving someone 
an SSL-enabled web browser? IPv6 software?

* The legislation bans the provision of anonymous Internet access. It says: 
"A service provider must... require from such person his or her full names, 
residential, business or postal address and identity number."

* Internet providers and telcos must pay for their own surveillance. "A 
service provider must at own cost and within the period, if any, specified 
by the Minister of Communications in a directive referred to in subsection 
(4)(a), acquire the necessary facilities and devices to enable the 
monitoring of communications in terms of this Act. The investment, 
technical, maintenance and operating costs in enabling a telecommunication 
service to be monitored, must be carried by the service provider providing 
such a service."

* Internet providers cannot reveal wiretaps. "No person who is or was 
concerned in the performance of any function in terms of this Act, may 
disclose any information which he or she obtained in the performance of 
such a function" (except to officials or courts).

The text of the legislation is here:
http://www.pmg.org.za/bills/Interception0107.htm

-Declan

*******

http://news.bbc.co.uk/low/english/world/africa/newsid_1484000/1484698.stm
Protests over SA 'snooping' bill
2001-08-13 06:10:06

   By Philippa Garson in Johannesburg

   Protests are growing in South Africa against the country's plan to
   give the security services new powers to monitor terrorists and
   serious criminals.

   Opponents say the Interception and Monitoring Bill is draconian,
   describing it as a charter for government snooping.

   Given only three weeks to make submissions on the Bill, non-government
   organisations have been making last-ditch attempts to garner more time
   to respond before the 13 August deadline.

   The bill was quietly passed by South Africa's Cabinet last month,
   largely catching the public unawares.

   It provides for state monitoring of all telecommunications systems,
   including mobile phones, internet and e-mail, once permission has been
   granted by relevant authorities.

   In most cases a judge must grant the order, but in some instances a
   police or army officer of a particular rank may do so.

   [...]




-------------------------------------------------------------------------
POLITECH -- Declan McCullagh's politics and technology mailing list
You may redistribute this message freely if you include this notice.
Declan McCullagh's photographs are at http://www.mccullagh.org/
To subscribe to Politech: http://www.politechbot.com/info/subscribe.html
This message is archived at http://www.politechbot.com/
-------------------------------------------------------------------------