Publications
Partners
The state's first move to use phone tracking to fight Covid-19 lacks key details and safeguards against abuse, writes Murray Hunter.
South Africa has joined the league of countries looking to track people using their phones and other devices in the bid to contain Covid-19.
It's a proposal - contained in vague directions issued last Thursday by the minister of communications and digital technologies - which raises privacy concerns.
Before we go further, let it be said that officials in the department have suggested that these proposals are now being revised, which may yield a better framework for privacy protections.
I should also add that an aggressive digital tracking policy may well be a necessary response to the pandemic - even if that case hasn’t been articulated by the authorities.
But as South Africa joins dozens of governments who have turned to various tracking programmes in their scramble to contain the pandemic, we need to look carefully at what the current proposals would entail.
This is especially important, as I’ll argue below, given that South Africa’s surveillance laws have been abused in the past - and given new research findings that underscore the extent to which our laws have neglected communications privacy.
FIRST TAKE: Reality bites as Ramaphosa and government’s lack of firepower becomes clear
Understanding the telecoms directions
Direction 8, titled "Individual track and trace", would compel mobile operators and internet service providers to hand over users' locational information without a warrant to track the movements of either a person believed to be carrying the coronavirus or anyone they may have come into contact with.
The direction reads: To assist track and trace efforts, [Electronic Communication Network Service] and [Electronic Communication Service] licensees, internet and the digital sector in general are directed to provide location-based services in collaboration with the relevant authorities identified to support designated departments to assist and combat the spread of Covid-19.
Although the drafting is slightly vague, Nthabaleng Mokitimi, spokesperson for the minister, confirmed that this would entail handover of individuals' locational information. (Read her full statement below).
If this provision were enacted today, it would be an unprecedented expansion of the state’s power to access people’s communications data – with no judicial oversight. Under South Africa’s much-maligned surveillance law, Rica, even in the most serious crimes or threats to security, the police or intelligence agencies can’t access this kind of information without the involvement of a judge or magistrate.
Why worry about privacy?
The importance and urgency of contact tracing in a pandemic is undeniable.
But even in the post-1994 era, South Africans have better cause than most to greet an expansion of communications surveillance powers with caution.
Just a month ago, Rica faced the withering scrutiny of the Constitutional Court, after years of evidence that state authorities had abused their spying powers.
Even when officials don’t abuse their powers or break the law, there is now clear evidence that South Africa's laws and its leaders have failed to appreciate the sensitivity of communications data - from records of who you call, to information about your location.
READ | Edward Snowden warns Covid-19 could give governments invasive new data collection powers
Just a few weeks before President Cyril Ramaphosa declared a national state of disaster in response to the outbreak - before Covid-19 became, necessarily, the main crisis we could think about - I completed a research report for the Media Policy and Democracy Project which grappled with the lack of privacy protections for communications metadata in South Africa.
The research looked at how police use "Section 205" subpoenas to access phone records. As it stands, section 205 requests account for the vast majority of documented surveillance requests by state agencies in South Africa.
Yet, a striking feature of the research was the extent to which ordinary police investigators often showed more appreciation of the privacy issues at play than the politicians who speak for them – and more willingness to explore novel legal and policy reforms that could protect privacy.
Keeping our heads in an emergency
We still need clarity from public officials on exactly what the status of these regulations are, and what process they see going forward.
However, whatever policy proposal comes forward should be evaluated for its privacy protections.
Public-health authorities can use data and different approaches to curb the spread of Covid-19 - and some are less invasive than others.
In Austria and Germany, for example, mobile operators appear to have shared high-level statistics of where their networks were in use, to give the authorities an anonymised picture of population movements.
Israel, on the other hand, is reportedly tracking suspected infections using a mass-spying programme designed for anti-terrorism.
And as the Electronic Frontier Foundation has argued, in many cases governments haven't made the case for the efficacy of invasive location surveillance.
Any proposal to use sensitive communications data, including your location, needs to contain basic safeguards to protect against abuse, promote transparency and due process, and ensure that any emergency measures don’t outlast the emergency.
ALSO READ | SA app will reward you for isolating, trace who you saw if you test positive
A concern for privacy is not necessarily in conflict with public health priorities. Dr Michael Ryan, a key figure in the World Health Organisation, recently made this point, saying: "It is important when we talk about surveillance and the surveillance society that in the case of public health, the gathering of information about individuals and their movements, must be done with the consent of the community and in many cases of the individual themselves."
The story of every crisis is that desperate times call for desperate measures. But let's look at what these proposals would actually mean, what they would give us, and at what cost.
In the chaotic weeks since coronavirus came to our shores, South Africa's public health officials have met the challenge with impressive composure and clarity of purpose.
But other parts of the state's response have fallen far short of that standards.
The incidents of outrageous and dehumanising abuses by police and soldiers in the past few days are a reminder that accountability, checks and balances matter as much in a time of crisis as ever before.
* Murray Hunter is amaBhungane's acting advocacy coordinator, writing here on research he did for the Media Policy and Democracy Project, which is jointly hosted by Unisa and the University of Johannesburg. Read “Cops and call record: Policing and metadata privacy in South Africa”, a research report for the Media Policy and Democracy Project.
Full statement by Nthabaleng Mokitimi for the ministry of communications and digital technologies:
“The directions introduced by the Minister place a significant focus on building a social compact with the industry. The implementation of the directions will involve a collaborative effort between government and the industry. To this end the Minister has established a Programme Management Office to be coordinated by Ernest and Young. This will ensure and enhance transparency.
“The track and trace provision should be understood within this context. The direction is limited to assisting the Department of Health to track people who test positive and might have interacted with others unknowingly. This is done to protect those might have unknowingly interacted with persons who tested/test positive. Information in this regard will be used for the stated purpose and nothing else.
“As stated the implementation mechanism will be consultative within and outside government. In government we will involve the Department of Justice to ensure that we are always in line with the requirements of relevant legislative instruments.
“Lastly, please note that our legal teams are engaging on the mechanisms in the interest of the country and using the Disaster Management Act provisions.”
