Snowden, Sam Sole, Sutherland and Surveillance

This week, the Pretoria High Court handed down a momentous decision on South Africa’s surveillance laws that made international headlines.  You can read the judgment here:

Indeed, in response to a tweet by Privacy International about the judgment, the best known modern whistleblower in the world, Edward Snowden, tweeted, ‘Wow’.

The decision has – at least for now – outlawed bulk surveillance in South Africa, and also declared a number of provisions in South Africa’s legislation permitting surveillance – known as RICA – unconstitutional.  Next step is the Constitutional Court.

I was lead attorney in the case for the applicants, the investigative journalists at amaBhungane, and Sam Sole, its co-managing director, who was placed under surveillance in 2008 simply for doing his job.  Sam’s take on the case, an excellent read, is available here:

Here’s my summary of the case below, which was published in Business Day this week here:

“Wow,” read a tweet posted on Monday by Edward Snowden, the American whistle-blower, now exiled in Russia, who five years ago leaked classified information from the National Security Agency.

Snowden was reacting to reports of a judgment by Roland Sutherland in the Pretoria high court the same day, declaring unconstitutional bulk surveillance as well as various aspects of SA’s surveillance legislation, the Regulation of Interception of Communications and Provision of Communication‑Related Information Act (Rica) of 2002.

Most South Africans are familiar with the acronym Rica, though the full name is a mouthful. And while the public’s experience of Rica is limited to registering SIM cards for their mobile devices, this is not what the case was about. Rica is also the authority under which the state is lawfully entitled to engage in targeted surveillance after making an application to the designated judge. One of the subjects of such surveillance was the investigative journalist and co-MD of amaBhungane, Sam Sole.

Sole discovered quite fortuitously that he had been placed under surveillance. In 2015, when the Zuma spy tapes saga hit the headlines, former president Jacob Zuma’s attorney attached to court papers extracts from intercepted conversations involving Sole from 2008. This revelation prompted applications by Sole to the state security agency for the records of the interception under the Promotion of Access to Information Act. Sole was given two interception directions authorised by the designated judge under Rica, which extended the original interception direction (which was not available) for a successive period of six months.

 Sole was in a better position than most subjects of surveillance — he happened to find out about it. You can’t request records you don’t know exist. The constitutional challenge by amaBhungane and Sole to Rica was birthed against this background — and against a global context in which there was increasing evidence of widespread abuse of surveillance laws by governments and others to spy on activists and journalists who were doing nothing wrong but speaking truth to power.

The starting point — which Rica itself recognises — is that privacy of communications must be respected  But at the same time, democracies around the world recognise that there is a critical place for legitimate, tailored surveillance, to protect national security and to investigate serious crimes. So a classic constitutional balancing act is required: how do we meet the legitimate objectives of lawful surveillance while respecting a citizen’s constitutional rights? The amaBhungane litigation was an attempt to convince the court that Rica had not struck the optimal constitutional balance in various respects.

In relation to five challenges to Rica, Sutherland declared the relevant provisions of Rica unconstitutional and gave parliament two years to remedy the deficiency. Pending these legislative changes, the ruling provided interim relief in relation to some of the challenges.

First, Rica was deficient because it makes the secrecy of interception permanent. There is no obligation on the part of the state to notify the subject of the surveillance after the surveillance is over that they were under surveillance. This may sound academic, but it is important — for example, Sole could take action to interrogate why he was placed under surveillance, could seek a declaratory order that it was unlawful, and could even seek constitutional damages (a general remedy mentioned by Sutherland).

The fact that notification in due course must take place means the secrecy is generally temporary, so the state will think twice before taking a chance with a speculative interception application. Sutherland’s interim solution is to compel notification to the subject within 90 days of the expiry of the interception order — or longer periods subject to additional safeguards.

The second major challenge to Rica that succeeded is critically important for media freedom. Sutherland held that Rica is deficient because it does not provide adequate safeguards where the subject of the surveillance is a journalist, such as Sole. As the judge commented, “spying on a journalist would be to investigate the people with whom the journalist is in contact. That conduct cannot be appropriate.” So the right to protect sources “must extend to protection from being spied on too”.

The judge’s interim solution is that this material fact must be brought to the attention of the designated judge and the judge should ensure the order is only granted if necessary. The same applies to lawyers, who will frequently be communicating legally privileged information.

 Third, the office of the designated judge in Rica is not sufficiently independent. The judge, being a retired judge or one discharged from active duty, is currently selected by the minister of justice for renewable periods of office. Sutherland ruled that these features were problematic. His interim solution is that the judge should be nominated by the chief justice and appointed for a non-renewable period of two years.

Fourth, when the designated judge is currently approached for an interception order, this is an ex parte application. No-one speaks for the other side (for obvious reasons).  Sutherland was of the view that this was also unconstitutional — some mechanism was needed to “overcome the absence of adversarial process”.  While the judge was not prescriptive, a “public advocate” or amicus is one suggestion parliament can consider.

The final Rica challenge related to the processing of the information once it has been lawfully intercepted: Rica does not prescribe proper procedures for the processing (storage) of such information and this needs to be remedied.

Then came the cherry on the top, possibly the order with the most profound implications: bulk or mass, untargeted government surveillance is not lawful in SA, simply because there is no law (including Rica) that authorises this type of collection. The court stated that absent such a law, the mining of metadata is unlawful: “Our law demands clarity, especially when the claimed power is so demonstrably at odds with … privacy”.

amaBhungane must now apply to the Constitutional Court to confirm the declarations of Rica’s unconstitutionality. Thus the last word has not yet been spoken. But there can be no doubt that this judgment is ground-breaking and of international significance. Just ask Edward Snowden.