Roland Giesler | 4 Oct 2005 15:50
Gravatar

Interception Act now in effect

Sorry, I didn't look up the url  (I received this in email)
-Roland
 
 Interception Act now in effect
  
BY PAUL VECCHIATTO, ITWEB CAPE TOWN CORRESPONDENT
   
[Cape Town | ITWeb, 4 October 2005] - Legislation dealing with the interception of communications is now in effect after being published in the Government Gazette with the date of operation set at 30 September.
 
The Regulation of Interception of Communications and Provision of Communications-Related Information Act, number 70 of 2002, and also known as RICA, was passed by Parliament and promulgated on 30 December 2002.

However, its date of coming into effect was suspended until a notice appeared in the Government Gazette. The notice appeared last week. The suspended implementation was to allow for companies to comply with the Public Access to Information Act.

Wim Mostert of attorneys Mostert Opperman Goodburn says this means the Act, with the exception of sections 40 and 62(6), is already law.

In terms of the Act, no one may intercept “direct” (predominantly oral discussions) or “indirect” communications (which includes telephone, cellphone, e-mail, instant messaging and SMS). Offences are punishable by a fine of up to R2 million or imprisonment of up to 10 years.

The Act also places the onus on Internet service providers (ISPs) and cellular network providers to make it possible to intercept e-mails and cellphone calls. They will have to install the necessary technology and set up data lines to provincial interception centres at their own cost.

Furthermore, ISPs and cellphone operators will have to retain e-mail and call-related information for specified periods. However, the state can only intercept communications after obtaining a court order.

The sections that are not operational yet deal with cellphone users giving the network operators personal information and become operational from 31 November.

Employee e-mail rules change

Mostert says this Act will dramatically impact the way in which companies manage employee e-mails.

He says that unless an employee's “written consent” is obtained, e-mail may only be monitored if all the following conditions are met:

(1) The practice of monitoring of e-mails must be authorised by the employer's CEO or by a person to whom such authority has been delegated.
(2) The monitored e-mail must relate to the business of the employer or must be sent/received by an employee in the course of carrying on the business of the employer.
(3) The purpose of the monitoring must be to monitor or keep record of e-mails to:
(a) Establish the existence of facts;
(b) Investigate or detect unauthorised use of the e-mail system; or
(c) To secure the effective operation of the e-mail system.
(4) “Reasonable efforts” must be used to inform employees and third-parties “in advance” that e-mail may be monitored.

Failure to comply constitutes an offence punishable by a fine of up to R2 million or imprisonment of up to 10 years, he says.

Mostert says it is advisable for all employers to implement and maintain a formal company policy on the monitoring of all communications as soon as possible, including e-mail, phone and mail. Existing policies must be reviewed to ensure compliance with the Act, he says.

He says additional measures should include employee awareness training, amending customer contracts, e-mail disclaimers and automated disclosures where calls are recorded.
Tristan Seligmann | 5 Oct 2005 00:13

Re: Interception Act now in effect

* Roland Giesler <roland@...> [2005-10-04 15:50:28 +0200]:

> The Act also places the onus on Internet service providers (ISPs) and
> cellular network providers to make it possible to intercept e-mails and
> cellphone calls. They will have to install the necessary technology and set
> up data lines to provincial interception centres at their own cost. 
> 
> Furthermore, ISPs and cellphone operators will have to retain e-mail and
> call-related information for specified periods. However, the state can only
> intercept communications after obtaining a court order. 

Am I the only one that finds this utterly sickening? Right now, I feel
the urge to either throw up, or cry myself to sleep, or both.
--

-- 
Tristan Seligmann
Claude Coetzer | 5 Oct 2005 07:36
Picon

Re: Interception Act now in effect

Greetings all,

>
> He says that unless an employee's "written consent" is obtained, e-mail may
> only be monitored if all the following conditions are met:
>

Do the same conditions apply to telephone conversations ?
It seams easier to meet all the conditions than get "written consent".

BTW, I am developing a Primary Rate ISDN voice logger, and am looking for some test sites.
The hardware (developed locally) has been ICASA approved.
If you are interested please drop me an email.

Thanks
Claude Coetzer

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

Rob Lith | 5 Oct 2005 08:38

Re: Interception Act now in effect

Hi

Voice logging can/is done by default with Asterisk using PRIs without  
much development if any - what ICASA approval do you need for  
recording equipment? Is it the line interfaces, the recording device  
or something else?

The only documented specification I can find "TE-002 FUNCTIONAL  
REQUIREMENTS FOR AUTOMATIC ANSWERING AND RECORDING EQUIPMENT" which  
covers recording equipment is dated JANUARY 1996.

And this says that unless call recording is done by participants it  
is an unlawful deed as well as a criminal act.

"2.2 Recording of the conversation by third party
The recording of a private telephone conversation by an outsider or  
third party not taking
part in the actual conversation, constitutes an actual invasion of  
the privacy of the
individual and is therefore an unlawful deed as well as a criminal act."

I think in the case of capturing calls on a PRI it is not between  
participants. It is a third party to the call.

I think this is circumvented by announcing that "for quality control  
(or other purposes) your call may be recorded".

Is the archaic specification superseded by something more up to date?

Regards
Rob

On 5 Oct 2005, at 07:36, Claude Coetzer wrote:

> Greetings all,
>>
>> He says that unless an employee's "written consent" is obtained, e- 
>> mail may
>> only be monitored if all the following conditions are met:
>
> Do the same conditions apply to telephone conversations ?
> It seams easier to meet all the conditions than get "written consent".
>
> BTW, I am developing a Primary Rate ISDN voice logger, and am  
> looking for some test sites.
> The hardware (developed locally) has been ICASA approved.
> If you are interested please drop me an email.
>
> Thanks
> Claude Coetzer
>
> =====================< IOZ >======================
> To unsubscribe, mail <majordomo@...>
> with "unsubscribe ioz" in the body of your message
> ==================================================
>

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

Claude Coetzer | 5 Oct 2005 09:25
Picon

Re: Interception Act now in effect

Heya,

My device had to pass certain sections of TBR 4, the IEC 60950 safety test and a EMI test.
I did not know that you could use the Asterisk PRI in monitor mode, I thought the PRI would have to terminate on
the PCI card.

I am still unclear on when recording telephone conversations is legal.
Is recording someones telephone conversations the same as reading his e-mail ?
If one party in the conversation knows that he is being recorded, then is it legal ?

Regards
Claude

On Wed, 05 Oct 2005 08:38:35 +0200, Rob Lith
<rob@...> wrote:

>
> Hi
>
> Voice logging can/is done by default with Asterisk using PRIs without
> much development if any - what ICASA approval do you need for
> recording equipment? Is it the line interfaces, the recording device
> or something else?
>
> The only documented specification I can find "TE-002 FUNCTIONAL
> REQUIREMENTS FOR AUTOMATIC ANSWERING AND RECORDING EQUIPMENT" which
> covers recording equipment is dated JANUARY 1996.
>
> And this says that unless call recording is done by participants it
> is an unlawful deed as well as a criminal act.
>
> "2.2 Recording of the conversation by third party
> The recording of a private telephone conversation by an outsider or
> third party not taking
> part in the actual conversation, constitutes an actual invasion of
> the privacy of the
> individual and is therefore an unlawful deed as well as a criminal act."
>
> I think in the case of capturing calls on a PRI it is not between
> participants. It is a third party to the call.
>
> I think this is circumvented by announcing that "for quality control
> (or other purposes) your call may be recorded".
>
> Is the archaic specification superseded by something more up to date?
>
> Regards
> Rob
>
> On 5 Oct 2005, at 07:36, Claude Coetzer wrote:
>
>> Greetings all,
>>>
>>> He says that unless an employee's "written consent" is obtained, e-
>>> mail may
>>> only be monitored if all the following conditions are met:
>>
>> Do the same conditions apply to telephone conversations ?
>> It seams easier to meet all the conditions than get "written consent".
>>
>> BTW, I am developing a Primary Rate ISDN voice logger, and am
>> looking for some test sites.
>> The hardware (developed locally) has been ICASA approved.
>> If you are interested please drop me an email.
>>
>> Thanks
>> Claude Coetzer
>>
>> =====================< IOZ >======================
>> To unsubscribe, mail <majordomo@...>
>> with "unsubscribe ioz" in the body of your message
>> ==================================================
>>
>
>
> =====================< IOZ >======================
>  To unsubscribe, mail <majordomo@...>
> with "unsubscribe ioz" in the body of your message
> ==================================================
>

--

-- 
“For every complex problem there is an answer that is clear, simple, and wrong.” — H L Mencken

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

Roland Giesler | 5 Oct 2005 10:30
Gravatar

RE: Interception Act now in effect

Claude Coetzer wrote:
> I am still unclear on when recording telephone conversations is legal.
> Is recording someones telephone conversations the same as
> reading his e-mail ?
> If one party in the conversation knows that he is being
> recorded, then is it legal ?

It's legal to record any conversation that you are part of.  Just like
email.  You don't have to say "I'm recording this", you may simply record
it.  Even if the other party says "no", you still have the right to record.
If they don't want it recorded, they must then end the call or keep quiet.
Recently at a DoE meeting certain parties wanted to video record the
meeting.  The DoE threw their toys out of the cot and insisted the record
may not take place.  That is completely illegal behaviour of the DoE part,
both because the recording party was part of the meeting and is entitles to
keep a record of the meeting in which ever way is suitable, but moreso
because government should be help accountable for what it's officials say
and do (although this is not pertinent to the point here) 

As soon as you are not party to the conversation, then you have to get the
consent of the involved parties to record it.  Voice, email, post, whatever.
Basically that's it. 

Roland

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

Claude Coetzer | 5 Oct 2005 11:13
Picon

Re: Interception Act now in effect


>
> As soon as you are not party to the conversation, then you have to get the
> consent of the involved parties to record it.  Voice, email, post, whatever.
> Basically that's it.
>

BUT this does not tie up with your initial e-mail. Thus my confusion.

He says that unless an employee's “written consent” is obtained, e-mail may only be monitored if all
the following conditions are met:  ( And the conditions are listed... )

So you can monitor e-mails without "written consent", does this apply to voice as well ?

Regards
Claude

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

Roland Giesler | 5 Oct 2005 12:03
Gravatar

RE: Interception Act now in effect

Claude Coetzer wrote:
>> As soon as you are not party to the conversation, then you have to
>> get the consent of the involved parties to record it.  Voice, email,
>> post, whatever. Basically that's it. 
>> 
> 
> BUT this does not tie up with your initial e-mail. Thus my confusion.
I think it does. See below.
> 
> He says that unless an employee's "written consent" is
> obtained, e-mail may only be monitored if all the following
> conditions are met:  ( And the conditions are listed... )
The issue here is "monitoring".  You keep a copy of mail people send you,
right?  That's not monitoring.  It's your email.  As soon as someone else
starts recording emails sent to you, that's monitoring and you need
permission for that.
(If the act does not define monitoring, then we have a problem, but I'm
looking it up so see what it says)

>The conditions listed were:
>(1) The practice of monitoring of e-mails must be authorised by the
employer's CEO or by a person to whom such authority has been delegated.
This is the "owner" of the business, so in a way it's "his/her" email...

> (2) The monitored e-mail must relate to the business of the employer or
must be sent/received by an employee in the course of carrying on the
business of the employer.
So again, it pertains only to the business' mail, not personal mail sent via
gmail for example.

>(3) The purpose of the monitoring must be to monitor or keep record of
e-mails to: 
>(a) Establish the existence of facts;
>(b) Investigate or detect unauthorised use of the e-mail system; or
>(c) To secure the effective operation of the e-mail system.
This is all part of the course of normal operations of a business.  Who
happens to be the owner and party to the email exchange.

> So you can monitor e-mails without "written consent", does
> this apply to voice as well ?
You cannot monitor private email without written consent, only a business
can "monitor" (in essence really record) it's own email.  The same goes for
phone calls, but whereas it's fairly easy to determine if an email is
private or personal, based on the recipient's email address, it's not so
easy with phone calls.  If my wife were to call me at work and wisper sweet
nothings into my ear, she should be aware that it will be considered a
business operation, and may be recorded.  If she doesn't like that, then she
should call me on my cellphone and not make use of the business
infrastructure for the purpose of private conversation. And so on and so
forth...

It's pretty straightforward, really.  <flamesuit>But trust the lawyers to
make it more complex in time... ;-)</flamesuit>

Regards

Roland

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

Anthony Walker | 5 Oct 2005 13:21
Picon

Re: Interception Act now in effect

Hi

You should have provisions for monitoring (email,voice,web etc)  in all
employment contracts, even prior to RICA this was common.

regards
Anthony

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================

steve | 5 Oct 2005 20:03

Re: Interception Act now in effect


On Wed, 5 Oct 2005, Claude Coetzer wrote:

> My device had to pass certain sections of TBR 4, the IEC 60950 safety
> test and a EMI test. I did not know that you could use the Asterisk PRI
> in monitor mode, I thought the PRI would have to terminate on the PCI
> card.

You can't use Asterisk as a "passive probe" on a PRI - you have to use 2 
PRI ports - one in and one out.  Asterisk is fairly transparent but 
wouldn't commit that its 100%.

Steve

=====================< IOZ >======================
 To unsubscribe, mail <majordomo@...>
with "unsubscribe ioz" in the body of your message
==================================================


Gmane