Johannesburg - Police may in the future be able to seize your phone, iPad or laptop without a warrant. They can view your pictures and messages and if these are deemed “harmful”, you could land in jail for up to three years.
In a bid to fight cybercrime, police gazetted their draft search and seizure rules for cybercrimes committed in SA.
The gazette, which is currently open for public comment, falls under the Cybercrimes Act (CCA) which was partly introduced by President Cyril Ramaphosa at the end of 2021. Following its promulgation, SAPS was given 12 months to formulate its own Standard Operating Protocols (SOPs) around the investigation, search, access or seizure of items used for cybercrime.
The CCA defines three types of harmful messages that have been criminalised in SA. These include messages which incite damage to property or violence, threaten people with damage to property or violence, or unlawfully contain an intimate image, will be deemed illegal should the proposal be adopted.
Anna Collard, a cybercrime expert and senior vice-president: content strategy and evangelist at KnowBe4 Africa, said South Africans should now be extremely wary of what messages they send as they will be prosecuted should they be found guilty.
“A data message will be harmful if it intimidates, encourages or harasses a person to harm him or herself or any other person. This also includes cyberbullying without the threat of violence. For example, a person who is encouraged by others on social media to commit suicide.
“It will also be considered harmful if it is inherently false in nature and it is aimed as causing harm, for example sharing misinformation such as fake news that incites violence.”
Distribution of intimate images without consent, for example, nude pictures of someone without their consent, will also be prosecuted, said Collard.
“Revenge porn as well as taking pictures of people changing in a gym locker room and sharing them with friends on a WhatsApp group will also be illegal.”
The message is an offence if the person is male, female, transgender, or intersex and it offends their sexual integrity or dignity.
“Even if you can’t see the person’s face in the image, this offence applies if the message identifies the person in the text or in other information contained in the message.
“All of the above applies to both private and public conversations, for example, WhatsApp groups and chainmail-type messages shared among contacts.
“The bill doesn’t distinguish between a creator and sharer and holds any person who makes available, broadcasts, or distributes malicious communications equally accountable in the eyes of the law.”
But experts caution that a balance must be found. The Criminal Procedure Act and the SOPs include consent as a circumstance in which a warrant is not required.
SAPS said the CCA provides a new legal framework for addressing cybercrime in South Africa as well a range of new cybercrime offences.
“It also provides mechanisms to preserve electronic evidence in the cyber domain, to conduct search, access and seizure operations in respect of an article as defined in the CCA and the gathering of data connected to both cyber and other crimes committed by means of, or facilitated through, the use of an article.
“The basic principle to be followed for all digital forensic activities is to ensure the integrity, reliability, authenticity and eventual admissibility of evidence in a court of law, of processes and procedures relating to the data and computer programs held on computer systems and computer data storage mediums.”
The draft rules also noted that an individual’s right to privacy, as well as other fundamental rights, must always be respected, and any infringement of these rights may only be justified in terms of the law. But Collard added that in order for the act to become fully functioning a few more urgent things need to happen.
“We need more awareness, and education needs to happen to make the public as well as businesses aware of the implications of this legislation and what it means for their people.
“Law enforcement will have to be seriously upskilled to understand the implication of the law itself as well as principles of cybercrime and cybersecurity.
“Especially parents of kids and teenagers interested in cybersecurity will have to be very careful, as the possession of tools that could be considered as hacking tools are an offence.”
Professor and chair for Artificial Intelligence (AI) in cybersecurity in the School for Data-Science and Computational Thinking at Stellenbosch University, Bruce Watson, said the move by SAPS is standard practice around the world and South Africa has been slow to get on board.
“It’s a good thing we have some sort of standardisation. Cyber issues will continue to grow. I do think it will make people a bit nervous, but people need to be aware of what they send,” he said.
“SAPS can say that search and seizure without a warrant is because they suspect an imminent crime or potential destruction of evidence. They need to have reasonable suspicion. The danger for citizens is that it’s easier to explain to a judge afterwards if someone’s rights were trampled on. We may see some overreach by the police but we must trust in the judges,” he said.
“This is a great time for us to think. Even if I am not the original author of harmful messages, by distributing it I am equally guilty. Cybersecurity is sorely lacking. I am excited.
“If you look at the messages sent during the July unrest and what harm those caused … We can now also tackle cyberbullying. I do believe the proposed legislation will go a long way to address these problems,” he said
Stephen Osler, a cybercrime expert and co-founder and business development director at Nclose, agrees with Collard and Watson, adding that police have taken a step in the right direction.
“However, I think this is something that could have been implemented a long time ago, but better to have it now than not have it at all. Anything that can better protect South Africans in the digital space is always needed,” said Osler.
Senior associate at Power Singh Inc, Tina Power, said SOPs are intended to provide guidance on steps to be taken when handling digital evidence.
“Additionally, the draft SOP notes that the right to a fair trial is paramount, and the responsibility of the investigation and prosecution team in terms of gathering, preserving and presenting evidence to a court fairly and objectively, remain of utmost importance.”
Power stressed that In terms of the general guidelines, no activity involving the search, access or seizure should be undertaken without obtaining the appropriate authorisation, such as obtaining lawful consent or a search warrant.
“It’s important to emphasise that section 14 of the Constitution gives everyone the right to privacy, including not to have one’s person, home or property searched, nor one’s possessions seized, or the privacy of one’s communications infringed. Searches and seizures have the potential to limit a person’s privacy rights but can also serve as a necessary means for gathering evidence, in turn enabling the constitutionally protected right to a fair trial,” she said.