RICA bill misses the chance for real reform

Parliament has called for comment on its new bill to amend RICA, South Africa’s surveillance law. The Department of Justice introduced the RICA amendment bill more than two years after the Constitutional Court declared key parts of the surveillance law to be unconstitutional, in a case brought by amaBhungane.

At a glance all this may look like a step forward. At just eight pages long, the RICA bill simply follows the court’s instructions on how to fix certain aspects of the law. But that’s just the problem.

In the 20 years since the law was first drafted, it’s drawn a host of criticisms – only some of which could be considered by the Constitutional Court. By limiting itself to the minimum requirements of the court order, the RICA bill misses the chance for other vital reforms, including some the Department of Justice has been promising for years.

What did the court say needs to be fixed?

In short, amaBhungane convinced the justices that while RICA is meant to enable the government to spy on people’s communications in limited circumstances (for investigations of serious crimes, and only with a judge’s permission) it needed better safeguards and oversight to protect privacy and freedom of expression and to prevent spying powers from being abused. (Government agents had used RICA to secretly spy on journalist Sam Sole’s phone communications while he was reporting on corruption.)

The court ordered Parliament to amend RICA in five ways:

• Provide for post-surveillance notification. In other words, if someone’s communications are intercepted as part of an investigation, they should be notified after the fact. This would bring RICA in line with dozens of other surveillance laws, and would help ensure that when someone is spied on unfairly, they can eventually take steps to protect themselves. Until now, most people spied on through RICA never know that it happened.
• Boost the independence of RICA judges who approve surveillance warrants, by changing how they’re appointed.
• Put in new safeguards to address the fact that surveillance warrants are issued ex parte (meaning the targeted person is not there to defend themselves).
• Create procedures for the handling (and deletion) of any data collected through surveillance.
• Ensure additional safeguards when the person being targeted is a practising lawyer or journalist, since people in these jobs have a professional duty to communicate confidentially.

The court gave Parliament three years to fix these problems.

Now, with just five months before that deadline, the Department of Justice has produced an eight-page amendment to RICA, which is narrowly confined to implementing the court order.

On post-surveillance notification, the bill simply adopts language proposed by the court.

On the independence of the RICA judge, where previously the Minister of Justice had sole discretion to appoint any surveillance judge, now the appointment also needs the blessing of the Chief Justice.

On the question of introducing fairness to the ex parte secret surveillance hearings, the RICA bill shies away from the proposal used in many jurisdictions of having a ‘public advocate’, often an independent legal figure with security clearance, to secretly represent the interests of the spied-on person in their absence. Instead, the bill provides for a second judge whose sole function is to review all the decisions of the existing surveillance judge. (More on this later.)

The amendments have the feel of a box-ticking exercise, but the changes are mostly positive. So why are privacy advocates not celebrating? Because there are deep, lingering issues with RICA which were never under consideration in the Constitutional Court case and which the Department of Justice knows about but has chosen not to address here.

The section 205 “loophole”

The biggest problem is that in nearly all situations where the state accesses someone’s sensitive communications data, it’s through a separate legal avenue than RICA: section 205 of the Criminal Procedure Act.

As we’ve documented extensively, this parallel procedure allows police investigators to seize a person’s call records, internet records, or nearly any other kind of communication data, by getting a magistrate’s order. None of the safeguards which apply to RICA, as faulty as they may be, apply to the section 205 requests. And the section 205 procedure seems to be used much more than RICA procedures. This is not a hypothetical risk; section 205 procedures have been used to spy on journalists, police investigators, lawyers and government officials.

This fact was raised in the amaBhungane challenge to RICA, but because Sam Sole was spied on through RICA rather than section 205, the court never ruled on it. But the Department of Justice has been made aware of the 205 loophole many times over the years, and officials had previously declared that they were working on it.

Unless the RICA amendment bill fixes the section 205 loophole, any new safeguards and protections against abuse in RICA procedures will just drive more surveillance abuses to section 205. And if the Court rules that RICA surveillance could only be constitutional if it meets strict safeguards on transparency, oversight, and accountability, it follows that these same safeguards should apply to all forms of surveillance.

There is a simple fix: close the loophole.

Missing details

There are other problems, too. A lot of detail is missing on how the new safeguards will be implemented. For example, how will people be notified that they have been spied on? By SMS or snail mail? What details will be included in case they decide to take legal action? And to whom will they address their grievances?

And some of the details that are there beg scrutiny.

For example, while there is no legal limit on the number of judges assigned to oversee surveillance requests, for some reason the Department of Justice has only ever appointed one at a time. But for oversight to work, judges require time and resources, without risk of backlogs. In other words you need a whole group of judges. Sadly the RICA bill doubles down on the idea of there being only one judge (except the one judge will now have a second judge reviewing each of their decisions, based on the same set of facts).

Why not provide for a whole bench of judges to split the workload of overseeing surveillance requests, and for there to be periodic reviews only of controversial decisions?

To be clear, this is a good-faith attempt at policy reform by the Department of Justice, unlike the State Security Agency’s new intelligence bill, which coincidentally seeks to re-introduce the mass surveillance powers that the Constitutional Court ruled was unlawful in terms of RICA.

But whether it’s because of a lack of institutional memory, or a last-minute scramble to meet the court’s deadline, the RICA bill falls short of delivering the real reforms needed.

Maddeningly, during court proceedings on RICA, the Department of Justice urged the court not to rule on RICA on the basis that it was working on its own far-reaching reforms to the law. Instead, the Department seems to have demonstrated that only a court order will deliver reforms.

The problems in the RICA bill are fixable. But with Parliament racing to meet its deadline, they do need to be fixed. Otherwise, it’s likely that these piecemeal reforms will fail to rein in the surveillance abuses that got us here in the first place.

Murray Hunter is acting head of Intelwatch, and a senior associate with ALT Advisory.