Op-ed | “Grabbers”: State surveillance in SA just got a legal boost, but it’s not an unrestricted licence to intercept

This opinion piece, by Heidi Swart, was published by Daily Maverick.

The authorities have approved the South African Police Service’s (SAPS) request to build their own (or purchase from elsewhere) communications interception equipment. On 19 May, an exemption certificate was published in the Government Gazette, clearly stipulating the red tape police need to work through if they want to purchase, make, and/or use spy gear such as grabbers (legally termed “listed equipment”) and keep it above board.

Local media and opposition parties have been sceptical about the move, citing as a concern the misuse of listed equipment to spy on innocent citizens, journalists and political opponents. To boot, they argue, the police have been purchasing listed equipment without legal permissions for years.

Another worry is that, technically, the police would be able to buy and use mass surveillance equipment – tech that can, for instance, capture the phone numbers and geographic locations of hundreds of people participating in a protest in front of Parliament. That’s a great tool if you are looking to oppress civil society and political opposition.

All of these concerns are valid, but the idea that the exemption certificate gives police carte blanche to intercept our communications is, quite apart from being very dangerous, simply not accurate.

In South Africa, law enforcement and state intelligence agencies may only intercept communications if they do so in terms of the Regulation of Interception of Communications and Provision of Communication-Related Information Act (Rica) of 2002. The exemption certificate doesn’t change that.

The rationale behind the exemption certificate stems from the fact that law enforcement can use several methods to intercept, and some are more clandestine – and thus harder to regulate – than others. Such methods can range from secretly planting bugs under desks to asking a mobile operator for access to private communications.

But, no matter which method police choose, one thing remains constant: if they listen in on conversations between unwitting surveillance targets, they have to get a warrant. With Rica, this warrant is known as an interception direction; it has to be issued by a specially designated judge whose sole job is to see to it that Rica is adhered to. To issue a direction, that judge has to be convinced that you’re not just curious about what your girlfriend is telling your mother about you.

So, if there is already a special judge involved regardless of the type of technology being used, why would the National Assembly have to approve an exemption certificate for certain types of equipment? The short answer? Some types of equipment are more easily bought and used off-the-books than others.

Lawful Interception

Let’s start with one method law enforcement can’t use on the sly. Formally known as Lawful Interception (LI), international standards for this technology are well-established, and South Africa subscribes to the LI standards set by the European Telecommunications Standards Institute.

By definition, LI involves a mobile operator sending a duplicate signal of a person’s cellphone communications to a state interception centre. Here, law enforcement officials can monitor those communications. LI depends on expensive, carefully controlled infrastructure, and interception is impossible unless the mobile operator cooperates. That will only happen if police can produce an interception direction issued by a designated judge.

But there are ways to bypass the mobile operator – and thus the designated judge – entirely. Those ways can include listed equipment.

Take, for instance, the now infamous grabber (formally referred to as an International Mobile Subscriber Identity – IMSI – catcher), which the SAPS is known to have purchased in the past without Parliament’s permission. (The new exemption certificate is tailored specifically for the development, purchase and use of grabbers.)

A grabber acts as a false cellphone tower. Your phone connects to it instead of the network. Depending on the level of sophistication of the grabber model, intelligence services can listen to conversations, intercept messages, manipulate the contents of messages or conversations, or locate you. Importantly, though your phone is connected to the grabber, you remain in contact with the actual network, so you can continue your communications uninterrupted and be none the wiser.

Grabbers are useful when police need to track someone or eavesdrop on them in the field. For instance, police could drive a van or bakkie with tinted windows and a grabber workstation in the back to a surveillance target’s house to listen in on calls. Intelligence agents could also pull up next to a protest to identify innocent participants – to investigate them later.

Acquiring invasive devices

As you may have noticed by now, listed equipment is dangerous, which is why Rica has put so much red tape in place for the issuing of an exemption certificate.

First, the minister of police must apply for a certificate to the justice minister, and justify why acquiring such an invasive device is necessary. If the latter gives the go-ahead, the application is inspected by the parliamentary portfolio committee for justice, which then issues recommendations. Finally, the application needs approval from the National Assembly. If approved, the SAPS can buy, build and use what it needs. Significantly, the exemption certificate must be published in the Government Gazette for the public to see.

The recently issued certificate puts in place a number of controls. For instance, the national commissioner of police must personally authorise the purchasing of grabbers, and each grabber must have a non-alterable identification number. There are several other sets of extensive rules pertaining to access control, record-keeping of use, and secure storage, among others.

Some of these controls would have been part of the SAPS’s internal regulations already, but now they’ve been cemented in law for all to see – at least for the next five years – and a measure of external oversight has also been added.

The exemption certificate states that, at the end of the financial year, the minister of police must report to Parliament about how often grabbers (and other listed equipment) were used, why they were used, and whether there were any unauthorised uses (plus what was done about the wrongdoing).

In addition, the SAPS will now need to get a formal certificate (either from an equipment manufacturer or from an expert) stating the specific interception capabilities of the listed equipment in its possession. If the Inspector-General of Intelligence – the civilian oversight body of SA’s intelligence services – wants to see that certificate, the SAPS has to hand it over.

This is a significant departure from how things were done in the past when it comes to portable spy equipment – at least on paper.

Opposition party concerns

That does not mean that the opposition parties’ concerns are unfounded. It’s true that the police have purchased grabbers in the past without permission from Parliament, and the factors contributing to this won’t disappear because of an exemption certificate.

The grabber is a field device and thus, by design, portable and concealable. It can be smuggled into the country, and this is made easier by the fact that it can be broken into its component parts, which are shipped separately and reassembled once inside the country. This can be done through commercial or diplomatic channels. It doesn’t help that international surveillance merchants aren’t always too worried about who their customers are.

The other reason why listed equipment has been in the shadows of secrecy is South Africa’s state intelligence services’ (both SAPS Crime Intelligence and the State Security Agency) strict secrecy policies. Such secrecy remains despite the fact that it is, by now, common knowledge that intelligence services globally have used various interception methodologies – including grabbers – as a standard practice for decades. (We’ve all seen The Wire, and Edward Snowden got his own movie.) The new exemption certificate, if enforced, could go a long way toward curbing unnecessary measures of secrecy that ultimately make accountability and transparency impossible.

But the opposition’s second qualm – that police will still circumvent the law – is not misplaced. There are lengthy records (including the findings of media investigations, state-sanctioned inquiries, and court cases) illustrating police and intelligence services’ misuse of interception technology and a general disregard for Rica.

Then there is the thorny issue of mass surveillance. Certain grabber models are capable of, for instance, capturing simultaneously thousands of phone numbers within their range. Mass surveillance is very much unregulated in South Africa. Rica was written with targeted interception – monitoring very specific people – in mind.

The one known mass surveillance facility in South Africa, the National Communications Centre, was recently ruled unlawful by the Constitutional Court (confirming an earlier high court ruling). The exemption certificate, however, makes no mention of the mass interception potential of grabbers, or any other listed equipment for that matter. How this will be handled lawfully remains to be seen.

So, the new exemption certificate is unlikely to be a cure-all. Former designated Rica judge Yvonne Mogkgoro cut to the heart of the matter of state abuses of interception capabilities in her 2012 report to Parliament in which she addressed widespread allegations about various abuses of the Rica process by law enforcement, including bypassing her office and intercepting illegally.

Mokgoro was convinced that legislation alone was not enough, stating: “Not all of these challenges may be resolved through legislative amendments. Some may only be resolved through the dedication, commitment, full understanding and appreciation of the role of investigation officers gathering crime intelligence in a democratic society based on the values of human dignity, freedom and equality. The need to sharpen and constantly improve the investigative skills and prowess of our law enforcement agencies comes to mind – no doubt an important aspect of contemporary policing.” DM

Heidi Swart is the research and journalism co-ordinator for Intelwatch, a non-profit organisation based in South Africa and dedicated to strengthening public oversight of state and private intelligence actors in Africa and around the world.