This article is a response to the following discussion prompt: 
To what extent does Germany's new BND draft bill provide a rights-based and modern framework for foreign intelligence?

A number of different contributions have addressed this 
question or will do so soon. See all of them here.

Germany’s BND Act has been much discussed in recent months, meanwhile on the other side of the world a similar case has just been ruled upon. In another win for intelligence oversight, South Africa’s Constitutional Court found untargeted foreign SIGINT surveillance unlawful, as it had no legal basis. This swiftly shut down the state’s foreign SIGINT capabilities, at least temporarily, and like Germany, has set the task for legislation to bring oversight practices in line with the court’s ruling. These coming reforms in Germany and South Africa will hopefully set a high bar for other countries grappling with this aspect of their national security debates.

It is almost eight years since the documents leaked by Edward Snowden revealed how the world’s most powerful countries abused their signals intelligence (SIGINT) capabilities. Ever since then, activists have been struggling to bring these invasive powers under democratic control. However, as terrorist attacks picked up in Europe, it seemed like those who argued for these controls were losing the argument as public panic spread and national security took precedence over privacy. Yet, recently, some legal victories have given hope for more controls, including one in Germany in 2020 on the constitutionality of the Federal Intelligence Service Act (or the BND Act) of 2016.

This blockbuster judgment recognised that the very basis on which foreign SIGINT has been practiced around the world — namely that foreign communications should receive fewer privacy protections than local communications — was flawed, and that fundamental rights such as privacy are not restricted to German territory. The ramifications of this judgment have been discussed widely, including on this blog.

Perhaps less well known is the fact that on the other side of the world, in February 2021, the South African Constitutional Court handed down a judgment that shut down the country’s foreign SIGINT capabilities, at least temporarily. These capabilities are housed in the National Communication Centre (NCC) of the country’s civilian intelligence agency, the State Security Agency (SSA). In doing so, the Court confirmed a 2019 judgment by the Gauteng High Court, which found that these capabilities were operating unlawfully because there was no law governing these activities.

The case was based on evidence that emerged that the amaBhungane Centre for Investigative Journalism’s Sam Sole was spied on by the state while communicating with a source in the country’s National Prosecuting Authority. So why does a legal judgment in a faraway African country even matter to the global fight against unaccountable state spying? Answering this question requires delving into what the judgment said, its immediate implications for South Africa and its broader global implications.


The South African judgment’s main points

The Constitutional Court’s judgment about South Africa’s foreign SIGINT capabilities was included in a broader judgment about the constitutionality of the interception of communications, which is governed by the Regulation of Interception of Communications and Provision of Communication Related Information Act, or RICA.

RICA is a typical lawful interception act that requires communication companies to provide networks that are interception-capable. It also requires intelligence agencies to seek an interception direction (or warrant) from a special judge designated for the purpose before conducting communication surveillance. However, the Act was promulgated in a rush to respond to the global panic in the wake of the September 11, 2001, terrorist attacks on the US. It has not been revised since then, and has not kept up with international developments on democratic oversight.

As such, it was hardly surprising that Sole brought this constitutional challenge to RICA, and won all of his arguments. The Court found RICA to be unconstitutional on five grounds:

  • RICA fails to provide for post-surveillance notification of people who have been subjected to surveillance;
  • The appointment process for the judge designated in terms of RICA lacks safeguards to prevent executive interference;
  • The application process for interception directions (or warrants) is inherently one sided and lacks safeguards to prevent abuse. This was because the judge only heard from the applicants when taking a decision about interception directions;
  • RICA does not provide adequate safeguards for the management of interception data;
  • RICA fails to recognise that lawyers and journalists have a professional duty to retain the confidentiality of their sources and communications. (Following similar thinking to the German Constitutional Court, the South African court found that special requirements should apply to the protection of professional groups or groups of persons whose communications call for increased confidentiality).

In addition to these five areas, the Court also found that untargeted foreign SIGINT surveillance conducted by the NCC was unlawful and invalid as it had no legal basis. As this activity involved an exercise of public power, the Court reasoned, it had to be authorised by a law setting out its powers, functions and limits.

The Minister of State Security contended that a 1994 Act, the National Strategic Intelligence Act (NSIA), governed the activities of the NCC. This was one of a trio of Acts that was promulgated shortly after the transition from apartheid to democracy. However, the Act sets out the powers and functions of the SSA in the most general of terms, which is unsurprising as it predated many of the most significant developments in SIGINT, and failed to provide for its specificities.

Consequently, the Constitutional Court dismissed the SSA’s argument on the basis that the NSIA “does not stipulate in clear, precise terms the manner, circumstances or duration of the collection, gathering, evaluation and analysis of domestic and foreign intelligence”. Given that the NSIA failed to deal with what the Court referred to as the nuts and bolts of the NCC’s functions, it could not accept that it “…provides for a practice that so significantly intrudes on the right to privacy”. However, unlike the German court, the South African court did not problematise the foreign-local distinction. It also didn’t consider whether bulk interception powers per se were unconstitutional, so this may be an issue the Court may have to return to at some stage in the future as an NCC Act is developed.

The Court suspended the finding of unconstitutionality of RICA for three years, to give the legislature an opportunity to cure the problems. As RICA does not cover the activities of the NCC though, the implication was that the SSA was required to shut the NCC down immediately, until an enabling Act was in place. And after the judgment, amaBhungane wrote to the SSA to ask if they had shut down the NCC, and they confirmed that they had.


The SSA’s own goals

The judgment was a spectacular own goal for the SSA, as it had been warned by a Commission of Enquiry as far back as 2008 that the activities of the NCC were most likely unlawful and unconstitutional. This Commission was established after evidence emerged that the NCC was being abused to spy on locals. Yet, the NCC continued operating without a founding law. It is difficult to think of a similar situation anywhere in the world where one day, a SIGINT agency is open, and the next day it is shut down by legal decree. To the extent that the SSA finds itself in a crisis as it is unable to scan transnational signals for national security threats, then it is a crisis of its own making.

Immediately after the 2008 Commission, then-intelligence Minister Ronnie Kasrils introduced two draft laws regulating the NCC. But a national election a year later saw Jacob Zuma become president, and these efforts stalled. The Zuma presidency saw many intelligence abuses, so they have a vested interest in keeping the SSA as unregulated as possible.

In another own goal, in its answering affidavit, the SSA admitted that it had no way of distinguishing between foreign and local communication signals when it conducted bulk interceptions. Their admission may be a basis for a future challenge if a law is introduced that assigns weaker protections to foreign communications than local communications.


Conclusion: two victories for intelligence oversight

The fact that there have been two victories for intelligence oversight on opposite ends of the globe shows just how poorly regulated foreign SIGINT surveillance remains eight years after Snowden’s revelations. Both Germany and South Africa are now facing similar legislative processes to bring their oversight practices into line with their respective court rulings. Germany’s BND Act, which is already in process, is eliciting considerable debate already about how far these powers should stretch, whereas South Africa is still to embark on developing its NCC Act. In grappling with the tasks set for them by their Constitutional Courts, South Africa and Germany may well set the bar for other countries for democratic oversight of these highly invasive powers, and let us hope that they set a high bar indeed. Watch this space.