The powers of the South African state and private enterprise to track and monitor citizens in the real world and online are growing, and at a pace that far outstrips our ability to exercise oversight and our right to privacy.
A combined effort of “active participation and political/societal pressure”, along the lines of OUTA’s fight against etolls or the campaigns for human rights is needed to prevent us sleepwalking into a surveillance state.
That’s the view of Dr Dale T McKinley, an activist and author of the newly published New Terrains of Privacy in South Africa report, which was launched last night in Johannesburg. The report is part of an ongoing collaborative research project between the Right2Know Campaign and the Media Policy & Democracy Project.
McKinley focusses on five areas of concern where technology and government practice is outpacing legislation such as the Protection of Personal Information Act (POPI), which has yet to come into force. In the report, which can be downloaded here, McKinley draws on publically available information and interviews with journalists and technologists to analyse the lack of privacy protections in biometric databases, the RICA and FICA processes, the new drone regulations and the use of CCTV and automated licence plate recognition (ALPR) by both police and private security firms alike.
In some areas, such as the biometric database used for administering social grants, there has been no challenge to the deployment of a system, which opens up the potential for abuse. Not only are biometric details being stored on central servers – a practice even the Payment Association of South Africa doesn’t recommend – but because the systems are being outsourced, social grant data is now available to private companies to use for marketing financial services such as loans and funeral cover.
While POPI should cover sharing of information in this way, McKinley says that “it’s going to be a mammoth task to try and ensure a significant degree of compliance and enforcement”.
In others areas, such as CCTV monitoring and ALPR tracking, the debate has focussed around security benefits above the right to privacy – even though it’s been shown that CCTV cameras don’t prevent crime.
Speaking at the launch of the report, Professor Jane Duncan of the University of Johannesburg said that one of the saving graces was down to lack of capacity at the state level to implement many existing systems correctly. Police investigations often struggle with inaccurate information stored in both the RICA data, for mobile phone ownership, and the eNatis database of drivers. The Department of Home Affairs runs two currently incompatible biometric databases for citizens and immigration records, Duncan says, and photos from etoll cameras have been inadmissible in court due to incorrect timestamps.
But we can’t rely on incompetence to protect us.
Advances in technologies such as cognitive computing, a catch-all term for intelligently mining multiple unlinked databases, could unlock surveillance powers in current systems. Duncan says that right now, however, the South African government seems to be focussed less on mass surveillance and more on specific targets such as journalists, activists and lawyers.
The problem, Duncan adds, is that there’s little to no transparency or oversight for organisations like the State Security Agency (SSA) and its operations from its key listening post, the National Communications Centre (NCC).
Duncan raises concerns about the passage of the Investigatory Powers Act 2016 in the UK – the so-called “snooper’s charter” – which confers the ability for state security there to monitor pretty much whatever it wants, how it wants including the mass hacking of mobile phones. The Act was passed with little opposition, despite the efforts of privacy activists.
Duncan says that one of the failings in the UK was that campaigns opposed to the law focussed on the technical and legal fight against it, without mustering mass support or sufficiently educating people as to its ramifications. South Africa, she concludes, must do better.
For those sceptical that a mass movement around online privacy rights can be brought about, McKinley points out the success of the Right2Know Campaign itself, which began as 10 activists concerned about the Protection of State Information Bill and gained widespread support in all areas of society.