Who watches the watchers?

The Portfolio Committee on Justice and Constitutional Development says it has received 26 "substantial submissions" on the proposed Interception and Monitoring Bill it is reviewing, after the period for written public submissions closed on Monday.

The committee can at its own discretion decide to skip the public hearings phase for such legislation, but says the level of interest means it will aim to hold such hearings towards the end of the month.

The Bill came to widespread attention when it was described as "Internet censorship", causing a storm of controversy on what many see as nothing but a misinterpretation.

But the submissions by a range of organisations shows a deep concern focused on the possibility of abuse of monitoring capacity and the likelihood that the costs to telecommunications service providers and Internet service providers could put smaller players out of business.

Also of near-universal concern is a clause in the proposed Bill that would prohibit telecommunications services which cannot be monitored.

"We believe that [it] is inconsistent with basic human rights for a government to demand that no conversation should ever be free from being overheard," says Privacy International, a Washington-based umbrella body, in its submission. "While we recognise that many telecommunications networks have the capability for interception, making it a primary function of the system changes the nature of the network and places a chill on free speech and other human rights."

Others are concerned about the technological impact of such a clause. The Cape Telecommunications Users` Forum (CTUF) says that should new systems be designed to ensure compliance with the Bill, it "may not necessarily limit technological innovation in this sector but may impact negatively on the commercial application of new technologies in the market".

The Internet Service Providers Association of SA (ISPA) is also concerned with another part of the same clause, which stipulates that "a service provider providing such a service is only responsible for decrypting any communication encrypted by a customer if the facility for encryption was provided by the service provider concerned".

"This section is worded in an unclear manner and has implications for broader encryption policies awaited by the industry." ISPA has repeated its call for a co-ordination of legislation dealing with encryption, such as the Green Paper on E-commerce which mooted the possibility of general key escrow.

Both ISPA and Privacy International highlighted the definition of "call-related information" in the Bill as a potential problem. Both organisations say the seemingly innocuous definition of information relating to "switching, dialling or signalling information that identifies the origin, destination, termination, duration and equipment identification of each communication generated or received by a customer" takes on a dangerous meaning in the Internet realm.

"Given the nature of Internet technologies and the availability of software that facilitates anonymity, it is impossible in every situation to identify the origin, destination and termination of a communication," says ISPA.

Privacy International is worried that such information, which could be requested by certain government officials without a court order, could reveal more than the Bill`s drafters may realise.

"When surfing the Net, a user can visit dozens of sites in just a few minutes and reveal a great deal about their personal situation and interests," Privacy International says. "The detailed and potentially sensitive nature of the data makes it more similar to content of communications than telephone records and it should be treated as content." It also uses the example of a Google.com search query, where the URL sent to the search engine actually contains information on the search being conducted.

Treating such information as content would mean the information would only be made available to law enforcement on the issue of a court order.

The part of the Bill that service providers object to the most calls for each provider to pay for the equipment needed to intercept calls and information, a not insubstantial cost according to the players.

Bridges.org, a local non-profit that advocates policies to promote technology use, says similar laws elsewhere have proven onerous for smaller Internet service providers.

"In February 2001, up to a third of Dutch [ISPs] faced bankruptcy due to the high costs of mandatory Internet traffic interception," Bridges says.

The CTUF is concerned that such costs could create a barrier of entry for smaller players, reducing competition and negatively impacting users, while ISPA sees the clause as double taxation. "Our members pay taxes, pay licence fees, pay for bandwidth to state-owned entities, contribute to universal service funds and now are required to pay for infrastructure that is potentially very expensive," it says.

Privacy International has other reasons to address the cost issue.

"Requiring that law enforcement pay for their surveillance capabilities provides an important level of accountability through the budget process," it says. "The lack of reimbursement significantly lowers the barriers to law enforcement surveillance by removing budgetary limits that would require that new surveillance capabilities be cost-effective before they are implemented."

Accountability is a theme on which Bridges.org, the CTUF and Privacy International agree.

Privacy International says it is common in other countries to have an annual public report on the number of surveillance operations undertaken and their eventual outcome. While citing examples, Privacy International stops short of calling for a South African commissioner of wiretapping.

The CTUF, however, calls for the appointment of a commissioner to "monitor the process and issue of all warrants" for interception requests, and with the power to randomly inspect communication centres.

Bridges.org wants to see an independent commission with similar powers established.

"The need for such a commission is especially critical in a developing country context where people have concerns about trusting government," it says. "It will also curb the potential for abuse within the communication monitoring centres, and ensure that accidental interceptions of unwarranted communications are reported and minimised."

Related columns:
This is not censorship
Censorship hysteria breaks out in local media
Big brother isn`t so bad