Johannesburg - A far-reaching cyber security and crime draft law gives key powers to the State Security, Defence, Police and Telecommunications ministries – powers which stretch into economic and labour environments and require private sector compliance.
The 128-page Cyber Crimes and Cyber Security Bill in clause 58 gives the state security minister the power to determine what should be included in “national critical information infrastructure”.
Inclusion is possible if it “appears” to the minister that such information is of such “strategic nature” that any interferences, loss, damage, immobilisation or disruption may results in the following:
- Prejudice the security, defence, law enforcement or international relations of South Africa.
- Prejudice the health and safety of the public.
- Interfere or disrupt any essential service.
- Cause any major economic loss.
- Destabilise the economy of South Africa.
- Create a public-emergency situation.
The state security minister can afford the affected private organisation an opportunity to make representation.
If the private sector entity is included in the national critical information infrastructure, that organisation must “at its own cost take steps to the satisfaction of the cabinet minister” to comply, clause 58(6) states. If the organisation fails to do so, according to clause 58(7), fines and/or imprisonment of no more than two years may be imposed on conviction.
While such provisions appear to be part of a major security push, the Justice Department is touting the bill as a “milestone” in implementing the National Development Plan, or South Africa’s blueprint to reduce poverty and inequality by 2030.
“It is estimated that cyber-related offences are escalating and currently exceed a value in excess of R1 billion annually,” the department said.
Other provisions of the Cyber Crimes and Cyber Security Bill require the various security ministers to establish a host of cyberspace-related structures.
A “cyber security centre” will be established under the state security minister, a “national cyber crime centre” by the SAPS national police commissioner, and the defence minister is directed to establish a “cyber command” for military intelligence.
The telecommunications and postal services minister must establish a “cyber security hub” to sign service-level agreements with all private and public institutions.
Among this hub’s functions is to co-ordinate “general cyber security activities in the private sector”, obtain compliance and trigger incident response teams to be established by each sector.
Fines of up to R10 million and/or 10 years’ imprisonment can be imposed following a guilty verdict for unlawfully accessing or intercepting “national critical information infrastructure” and “critical data”.
Such critical data is described as information that is “of importance for the protection of security, defence and international relations” of South Africa, the enforcement of a law and the protection of public safety.
The bill has been published on the Justice Department’s website. The deadline for public comment is November 30, 2015.
The Star