In this era of spyware, Parliament must codify safeguards in surveillance law

Daily Maverick

2 days ago

Considering the proliferation of sophisticated surveillance technologies such as spyware, South Africa has a unique opportunity to implement a meaningful surveillance safeguard that can serve as a model regionally and globally by fixing the flaws in the Rica Bill.
It has been more than four years since the South African Parliament began the reform of the Regulation of Interception of Communications Act (Rica). In 2021, the Constitutional Court declared the law unconstitutional and directed additional constitutional safeguards for surveillance.
The 36-month timeline set by the court has long past, and warrant applications are delayed or unprocessed, leaving South Africa vulnerable to internal and external threats.
A major factor behind this delay is Parliament and the Justice Department's minimalist approach, which conflicts with the court's mandate to address fundamental constitutional problems in the Rica Bill.
The original bill passed by Parliament failed to remedy all constitutional flaws, so President Cyril Ramaphosa refused to assent and referred it back to Parliament. As the DA's Werner Horn predicted in 2023, 'the idea of a future wholesale review was a way of delaying the process which was likely to take years'.
Considering the proliferation of sophisticated surveillance technologies such as spyware, South Africa has a unique opportunity to implement a meaningful surveillance safeguard that can serve as a model regionally and globally by fixing the flaws in the Rica Bill. This article explains how South Africa can achieve it.
Indefinite suspension of notification keeps surveillance secret and grants permanent impunity
The first flaw in the Rica Bill is the weak notification system. The introduction of a mandatory notification to surveillance subjects within 90 days of warrant expiration is a positive step; however, the implementation will probably fail.
It allows suspension under vague conditions, i.e. whenever a court finds notification 'has the potential to negatively impact national security' for any period the court deems appropriate.
Without clear limitations, suspension will be granted in many more cases for much longer than necessary (as found by the European Court of Human Rights in Bulgaria's notification system).
Such a broad notification suspension makes accountability and remedy virtually impossible. Consider the case of journalist Sam Sole, a director of the amaBhungane Centre for Investigative Journalism, who was the plaintiff of the 2021 Constitutional Court case.
Like many other targets Sole suspected he was being monitored, but lacked proof. That evidence emerged by good fortune when official intercept extracts were included in documents in another case.
Sole's case is far from rare. Right2Know reports case studies where journalists only found out about the surveillance on them 'through accident, coincidence, or via a confidential source — without which it would be impossible to get any recourse'.
If surveillance evidence is used in a criminal case, the subject may challenge its legality, but such cases are rare in practice. The Rica Bill does little to change the status quo, leaving the situation where, in Jacques Pauw's words, journalists 'can't do anything' with '(their) phone and emails (being) monitored'.
The prospect becomes even more concerning when we consider the persistent instability the intelligence community has faced since 1994. This organisational weakness has been a root cause of surveillance abuse, notably identified by the 2018 Presidential High-Level Review Panel and the 2009 Commission of Inquiry.
Yet, while the president-led reforms have led to some positive changes, they remain incomplete.
International human rights law requires that people be notified of surveillance without jeopardising government interest
The access to remedy is a human right. International and regional bodies consistently stress that states must provide victims of illegal surveillance access to an effective remedy (e.g. UN General Assembly, Human Rights Council, Special Rapporteur on Freedom of Expression, Human Rights Committee [see, recommendations to South Africa ], and African Commission on Human and Peoples' Rights).
The knowledge of secret surveillance is the first step in achieving a remedy. Suspension thus should be strictly limited when it is necessary and proportionate to a specific legitimate aim, and should be subject to oversight.
Notably, the European Court of Human Rights (e.g. in 2024 and 2022), and the European Court of Justice repeatedly clarified that notification must be provided to the surveillance subjects as soon as it can be made without jeopardising the purpose of surveillance.
However, the current Rica Bill stands in contrast. It is doubtful that, without a clear condition and upper limit on suspension, notification would be issued immediately after the threat abates.
Another problem with the notification system under the Rica Bill is its silence on what should be notified. To ensure access to remedy, the notification must include sufficient information so the surveillance subject could substantiate a claim to have the legality of the surveillance reviewed by a competent body.
This, at a minimum, includes details such as who sought and conducted the surveillance, why and when it was done, and what information was obtained.
In the case of Sole, while he (because of unique circumstances) learned of the interception, it was not enough for accountability. The government continues to insist that the application document justifying Sole's interception 'cannot be found', leaving Sole still 'left in the dark' as to whether the intrusion was legally valid.
A concern that a robust notification system may deter agencies from using interception reflects a lack of understanding among agencies. The system does allow for notification to be suspended when necessary. Training is needed to ensure agencies understand that the notification framework is designed to strike a careful balance between government interests and transparency, and it should be implemented accordingly.
Advanced surveillance technologies like spyware make the importance of notification even greater for accountability
New tools like spyware make surveillance more intrusive and sophisticated. Spyware enables secret access to any data on a targeted device and even the alteration of data. International human rights experts are concerned that spyware may only be justified by necessity and proportionality principles in extremely limited situations.
Spyware, like Pegasus by NSO Group, has been widely abused by governments worldwide to target journalists, human rights defenders, lawyers, and politicians. In South Africa, Ramaphosa's mobile phone was targeted in 2019 by Rwanda using spyware.
One of the unique challenges posed by spyware is that of documenting its actual use. Some spyware can self-delete traces of itself on the target device. Moreover, many spyware operations are conducted by private vendors, adding another layer of opacity around who is conducting the surveillance. In fact, many accountability efforts related to Pegasus stem from leaked documents.
This unique level of secrecy undermines the effectiveness of accountability mechanisms across the globe. For instance, in Ireland, individuals who believe they are subject to surveillance can appeal to a complaints referee to examine the legality of interception. However, individuals are less likely to realise they are being targeted by spyware.
'One-sided' warrant application process requires safeguards to prevent authorisations based on false claims
The other major defect in the Rica Bill is the lack of solutions to ex parte — or one-sided — hearings. Under Rica's existing procedures, the government applies for a warrant in an ex parte hearing with only the judge and government representative present.
While the exclusion of the surveillance subject from the process is necessary to achieve the goal of interception, this is a departure from traditional adversarial hearings where the judge can hear from advocates on either side of the issue.
As a result, in the Constitutional Court's words, 'blatant mendacity may be the basis of an approach to (the judges)', like the journalists of The Sunday Times, who were subject to real-time interception based on 'unadulterated lies' that they were suspected ATM bombers; and the illegal surveillance over Saki Macozoma.
Such misconduct is not unique to South Africa. In the United States, the FBI fabricated an email to carry out surveillance on Trump campaign advisor Carter Page, whom the FBI suspected of having ties to the Russian government.
There are probably more cases that have not surfaced due to the 'complete secrecy' surrounding surveillance practices, which the Constitutional Court identifies as a root cause of abuse in surveillance.
A public advocate system would help protect South African privacy rights
One solution referenced by the court and supported by researchers and civil society is the introduction of a public advocate system, which is designed to bring an adversarial element to the hearing.
A security-cleared lawyer would act in the interest of the excluded party (in this case, the individual subject to surveillance). While communication with the excluded parties is prohibited, public advocates typically have access to all information held by the government, including national security information, and they can submit claims, cross-examine evidence or witnesses, and challenge legal arguments.
Such a system aligns with the principle confirmed by the European Court of Human Rights that 'measures affecting fundamental human rights must be subject to some form of adversarial proceedings', 'even when national security is at stake'.
At least Canada, the UK, Australia, Sweden, the US, New Zealand, Denmark, Norway and Hong Kong have introduced public advocate systems since the 1980s and improved the systems, including in the context of surveillance authorisation.
Notably, these countries have either maintained their public advocate programme or expanded their application. The European Court of Human Rights recognised the public advocate system as a method to address ex parte concerns, and human rights bodies have recommended that states consider including a public advocate system in the warrant application process. Governments explicitly confirmed its effectiveness.
Public advocates have demonstrated impact on outcomes. Public advocates' arguments have led courts to negate warrant applications. Existing studies based on interviews with public advocates and government agencies confirm a positive trend, with public advocates increasingly successful in raising the standard for government evidence and warrant applications. The system can improve the quality of warrant applications and help reduce the burden on judges.
Parliament should consider public advocate system now
The Department of Justice disfavours the public advocate system without fully understanding its effectiveness because it is a new concept in South Africa. Its reluctance is evident in its lacklustre conclusion from preliminary research on the global landscape of the system. It only scratched the surface of some literature, failing to consider the latest rules, ignoring positive trends, and saying 'each country has a very different model of a public advocate, and that this role is not necessarily enabled by state surveillance legislation'.
Given the emergence of spyware, the department should conduct more in-depth research into implementation models in other countries and carry out a detailed feasibility assessment of introducing the public advocate system within South African law, particularly in sensitive cases involving press freedom or source confidentiality.
The department has failed to show an alternative solution. It argues that an automatic review mechanism would remedy the one-sided warrant hearing. Under this mechanism, all warrant decisions would be reviewed by another judge immediately after the original decision was made.
However, such a system is simply less effective and incurs greater costs in both time and money compared with the public advocate system. As Professor Jane Duncan, who has written and worked extensively on public oversight of security agencies, has noted the review judge is likely to 'mirror the decisions', as review judges 'will still be making decisions based on the same one-sided secret evidence'.
South Africa has the opportunity to implement a meaningful safeguard to be a model regionally and globally
Parliament and the State Security Agency have justified concerns about the legislative gap and the resulting damage to state security. But South Africa is uniquely situated as a state that understands the damage a 'skewed notion of national security' can cause when it is 'weaponised and calculated to subvert the dignity of the majority of South Africans'. South Africa should not miss the present opportunity.
The world is watching. Many countries, in Africa and beyond, are updating their surveillance laws. As the Constitutional Court stated, 'the right to privacy is singularly important in South Africa's constitutional democracy.'
The world is waiting for South Africa to demonstrate its commitment to constitutional democracy — something that is urgently needed in the current global context. DM
Hinako Sugiyama is a public interest lawyer licensed in both Japan and New York, USA, specialising in issues related to surveillance, human rights, and democracy. She currently supervises the work of the International Justice Clinic at the University of California, Irvine School of Law.