Critical Infrastructure Protection Amendment Bill: briefing & public hearings day 1

Meeting report

Briefing by Committee Content Advisor

Dr Irvin Kinnes, Committee Content Advisor, said that the Critical Infrastructure Protection Bill [B 22-2017] was tabled in Parliament on 15 September 2017. It replaced the National Key Points Act (102 of 1980). The Bill dealt with the process of the declaration of national key points. It talks to the safeguarding of critical infrastructure and persons inside the critical infrastructure area. The Bill provides for the establishment of a National Infrastructure Council. It also provides for designation and functions of inspectors, amongst others. It allocates roles and functions to the Council and the National Commissioner of Police.

In 2015, the SA History Archive (SAHA), was joined by the Right2Know Campaign, in terms of a Promotion of Access to Information application for the Minister of Police to declare the list of national key points. The Minister of Police withdrew an appeal against the court judgment [SA History Archive vs Minister of Police, 2013/32512] that the list must be provided, and obliged by making the list of 204 national key points available on 16 January 2016. The court judgment declared the refusal of the Minister of Police, in terms of the Promotion of Access to Information Act (PAIA), unconstitutional.

Dr Kinnes said that the Minister of Police was responsible for the appointment of the members to serve in the Critical Infrastructure Council. There were five members to serve on the Council and they were from the private sector, appropriately qualified, knowledgeable and experienced. The members would be subject to a public process, and the Portfolio Committee had to be informed of the top five candidates nominated. The Head of Department (HOD) of the government department had to designate an official on an ad hoc basis. The Minister must consult Cabinet before appointing officials listed in Section 3(b). The Secretary of Police was the chairperson of the Council. Members subjected to the public process were appointed for a period not exceeding four years. The Minister can remove member after due process on grounds of misconduct, incapacity or incompetence. The members to serve on the Council must have a top secret security clearance certificate, should not have been sentenced in the Republic to imprisonment without the option of a fine, and cannot have a direct or indirect personal financial interest in any critical infrastructure.

The Council had to advise the Minister on guidelines for the identification of potential critical infrastructure, and receive and consider applications for their declaration as critical infrastructure. The Council must also make recommendations to the Minister on applications for the declaration as critical infrastructure, and evaluate, monitor and review the implementation of policy and legislation related to the protection of critical infrastructure. The National Commissioner must establish and maintain the administrative systems and procedures necessary for the implementation and enforcement of the Act, and support the Minister in the administration of the Act.

The other roles of the National Commissioner was to effect cooperation between the South African Police Service (SAPS), other organs of state and the private sector as it related to the protection of critical infrastructure; develop uniform standards, guidelines and protocols for consideration by the Council regarding critical infrastructure, and evaluate and review security assessments; consider any draft of a prescribed security policy or plan submitted, and compile and submit quarterly reports to the Council. The offences and penalties for those in contravention of the Act carried lengthy prison sentences.

Discussion

The Chairperson wanted to know about the developments in other jurisdictions in relation to the Critical Infrastructure Protection Amendment Bill. What was the trend in other jurisdictions?

The Committee’s Researcher responded that the current Bill tabled before the Committee was very much in line with international trends in countries like Finland, Switzerland, Netherlands and Germany. The issue that was raised on taking pictures of the critical infrastructure was also common in all the other legislations. There was nowhere where an individual could be allowed to take pictures or videotape any critical infrastructure. The only area where the Bill could be improved in the South African context was greater focus on the private sector’s collaboration in critical infrastructure. In general, the Bill was in line with international standards.  

Ms D Kohler Barnard (DA) asked whether there was signage in place to warn people not to take pictures in those buildings and structures identified as national key points. The signs would be especially helpful to tourists who liked to take pictures of these national key point buildings, and they might get arrested for not knowing the repercussions.

Ms M Molebatsi (ANC) asked about the functions of the National Commissioner, as stipulated in the Bill, as this was not clear from the presentation. It would also be important to ascertain whether the Council to be established could request a review of the issues not covered by the National Commissioner.

Mr M Maake (ANC) pointed out that the Bill should ensure that even a person who had been sentenced outside of South Africa did not serve on the Council. Was the National Commissioner a member of the Council? It was also unclear if there any interviews were taking place for the appointment of the members to serve on the Council.

Dr Kinnes responded that there was a provision for signage for the buildings that were considered as critical infrastructure. The Council could review some of the issues that had not been covered by the National Commissioner. There was a provision that the National Commissioner could look at policy related matters. The National Commissioner was not the member of the Council, but responsible only for ensuring that the Council was able to operate smoothly and in accordance with the rules. There was a loophole that was identified on the sentencing, as the Bill did not speak about the person that had been sentenced outside of South Africa, and this was something that the Committee should look into.

Briefing by South African Reserve Bank (SARB)

Ms Shenaaz Meer, Assistant General Counsel: SARB, said that the SARB had the primary responsibility for promoting financial stability. The Financial Stability Oversight Committee (FSOC) had to maintain, protect and enhance financial stability. Financial Sector Regulation Act, 9 of 2017 (FSRA) had been assented to by the President on 22 August 2017. The FSRA would become effective in parts as determined by the Minister of Finance by notice in the Government Gazette.

SARB was proposing an insertion of “may” in Section 12 (9). Financial stability was critical for the country’s economy, and was inherent in the functioning of SARB to protect and enhance financial stability.It was therefore imperative that the SARB was consulted on matters affecting financial stabilty. In this context, the SARB proposed that, to the extent that section 9(2) and section 9(3) of this Bill affected the financial stability of the Republic, the National Commissioner must consult with the SARB. Cooperation under section 9 was aligned with the requirements under section 11(2)(c) of the FSRA, in terms of which the SARB was obliged to have regard to the roles and functions of other organs of state exercising powers that affected aspects of the economy. The proposed wording would strenghten the co-operation between the relevant parties in ensuring that adequate and effective consultation took place in matters affecting financial stability.

Discussion

The Chairperson welcomed the SARB presentation, saying it was constructive, including the proposal that was made. The cooperation and coordination between different spheres was also welcomed by the Committee.

Mr Maake wanted to know who was being referred to as the ‘financial customers.’ The Committee should hear whether the SARB was foreseeing any complications if the suggested clause was not amended. What could those complications be? It would be helpful if the Committee could be provided with an example or a case where the financial sector could be compromised. What were the factors that could compromise financial stability? What was the reason for proposing of insertion of “must” instead of “may” in Section 12 (9).

Ms Molebatsi asked for more information on the consultation with the National Commissioner. What must happen in this consultation process? What was the type of consultation that SARB envisaged? What would happen in the consultation if things did not meet the expectations of the SARB?

Mr Z Mbhele (DA) wanted to know the opinion of SARB on the consultation process, especially about the importance of the inclusion of the SARB in consultations that would in any way see the SARB being taken on board in a meaningful way.

Ms Meer responded that ‘financial customer’ was explicitly defined in the FSRA, and this was a very wide definition. The consultation process was to ensure that financial stability matters which affected the economy were taken on board. It was very hard to stipulate which factors must be taken into consideration in the consultation process, but this process ensured that there was transparency and open consultation. In essence, SARB would like to see financial stability being one of the components to be discussed in the consultation process. It would be pointless for SARB to sit in the Council where matters of financial stability were not going to be discussed. It was concerning that the definition of head of government did not necessarily cover the SARB, as the entity was classified as an organ of state. There might be complications regarding signage or coordination between government departments and organs of state if the suggested clause was not amended. The FSRA focused specifically on coordination and cooperation between government departments, and this was because of the global economic crisis.

Ms Meer said that financial stability was not defined as an end to itself, but described it as being similar to price stability. It was clear that the process of monitoring and evaluating financial stability had an impact on the society at large, including on economic growth, development and employment creation. It was actually very hard to cite an example where there would be factors compromising financial stability, as there would be various factors that would need to be taken into consideration. There were many aspects on the Bill that may have a ripple impact on financial stability. The compromise on financial stability might have an impact on economic growth and job creation prospects and the development of the country at large. Consultation would ultimately improve coordination and this then would create a better and stable society.

The removal of “must” would have a different effect, as the SARB wanted “must” to be inserted so as enforce the consultation process and involvement in matters impacting on financial stability. The current clause allowed the Minister to have discretion in relation to the consultation process.

Briefing by Gautrain Management Agency

Mr Ntheri Magoai, Senior Executive Manager: Compliance and Legal Services, Gautrain Management Agency, said that the Agency’s mandate included acting on behalf of the Gauteng province in managing the relationship between the province and the concessionaire; ensuring that the interests of the province were protected; managing the assets related to the Gautrain project; and promoting their preservation and maintenance. The Agency exercised the rights and performed the duties of the province in terms of the concession agreement.

Bombela Concession Company (“the Concessionaire”) was appointed to design, build, operate, maintain, and partially finance the Gautrain project. The Bill defined a “person in control of critical infrastructure” as, amongst others, “the owner”; or a person who “occupies, possesses, is in control of, or is responsible for the operation or administration” of critical infrastructure; or “the head of any organ of state who occupies, possesses, is in control of, or is responsible for the operation or administration of a critical infrastructure”.

The practical connotations of the above definition were that either the Gauteng provincial government, the Gautrain Management Agency, the Bombela Operating Company, or Mega Express could unilaterally apply for the declaration of the Gautrain infrastructure, for which they were responsible, as critical infrastructure. Despite any of the said parties not having been consulted by the other prior to an application for declaration as critical infrastructure being lodged, a party could be held responsible for the implementation of security measures prescribed in clauses 24 and 25 of the Bill. Similarly, a tenant could, given the current definition, apply for declaration of rented infrastructure as critical infrastructure, without the prior consent of the landlord. It proposed the insertion of a proviso, in a new clause 24(9) of the Bill, to the effect that in a public private partnership (PPP), the private partner is responsible for the discharge of the duties prescribed in clause 24 of the Bill, which reads: “(9) To the extent that a Concession Agreement, or similar arrangement, exists in respect of critical infrastructure, the Concessionaire, or its equivalent, shall be responsible for the discharge of the responsibilities prescribed in this section and section 25”.

Mr Magoai said that there was also a proposal for the insertion of a proviso, in clause 18(1) of the Bill, to the effect that an application for the declaration of infrastructure that was subject to a PPP as critical infrastructure, may be lodged only by a head of an organ of state which owns, was in control of, or was responsible for the administration of that infrastructure. The following wording was proposed: “18. (1) A person in control of an infrastructure may, in the prescribed manner and format, lodge with the National Commissioner an application contemplated in section 16(1) to have such infrastructure declared as critical infrastructure; provided that, in the case of infrastructure in respect of which a Concession Agreement or similar arrangement exists, only the head of an organ of state that owns, is in control of, or is responsible for the administration of the infrastructure may lodge such an application.” A proviso similar to the above was recommended in respect of leased infrastructure, the owner of which is not an organ of state.

Discussion

Ms Kohler Barnard wanted to know about the status or update in regard to the possible inclusion of the Gautrain as a national key point. Was Gautrain identified as a national key point? What was giving the Agency an impression and the feeling that Gautrain could be considered as a national key point?

Mr Magoai responded that Gautrain was not considered as critical infrastructure, but this had been contemplated at some stage. The Agency had done some ground work in trying to establish whether or not the Gautrain system could not be declared as a national key point. There were a number of challenges that had been encountered and the Agency believed the contemplation of Gautrain as a national key point could slow down its operation. The idea of considering Gautrain as a national key point was still on the cards, and the Agency still remained concerned that this might have the same impact as expressed above. The Agency was particularly concerned that Gautrain might be considered as critical infrastructure because it met the requirements of critical infrastructure. That was one of the reasons the Agency had considered prudent to make a submission to the Committee.

Ms Molebatsi asked if the Agency was at ease with this concession, as this had not been made clear from the presentation. What could put the Agency at ease with this concession?

Mr Magoai replied that the Agency did not have a challenge with the concessionaire, but it believed that a concessionaire had been appointed for a period of 16 years to run the system and would be responsible for all the functions in relation to running the system. The concern of the Agency was that the Bill as it is would interfere with the concession agreement. The Agency did not specifically have a problem with a concessionaire, but there might be a pitfall in future if the Bill was to be left as is.

Mr Maake commented that he understood why the Agency wanted Section 18(1) of the Bill to be amended, as the proposed amendment was covering everybody. It was clear that there was still a problem around the issue of the concessionaire.

Mr Magoai responded that Section 18(1) was proposing that only the head of an organ of state that owns, is in control of, or is responsible for the administration of the infrastructure, may lodge such an application. Section 24(9) dealt with the entity that would be responsible for the discharge of the responsibilities prescribed in this section, and section 25. There was Mbombela Concession Company that was responsible for running with the system, together with its contractor. Section 24(9) would make it easier to identify who was responsible for running the system or performing a specific function.

Mr Mbhele commented that he had a problem with the crafting of laws with specifics in mind, instead of crafting laws for general application.

Briefing by the Banking Association of South Africa (BASA)

The BASA representative said that BASA supported the tenor of the Bill, which was aimed at ensuring that South Africa maintained a robust and sustainable approach to the protection of South Africa’s critical infrastructure in the interests of the state and all citizens. BASA further supported the mechanisms in the Bill to promote a spirit of cooperation between the various role players in order to provide a multi-disciplinary approach to deal with critical infrastructure protection. It supported the Bill in general.

The Bill did not explicitly include banks, as they fall outside the definition of ‘basic public service’. However, banks could be declared ‘critical infrastructure’ by the Minister of Police if the Commissioner made an application for such in terms of Clause 16 of the Bill. The Minister may have the authority to declare the infrastructure of key banks as critical infrastructure. This would include branches, ATMs and data centres, among others. This would be over and above the elements that fall under the scope of the Cybercrimes and Cybersecurity Bill.

The BASA representative said it proposed that if the Minister declared a ‘financial institution,’ as defined in the FSRA, a critical infrastructure, it should be done in consultation with the Financial Stability Oversight Committee as defined in the FSRA. Subsection 4(a) states: ‘In the event that the infrastructure referred to in an application partly consists of … any possible critical information infrastructure, the National Commissioner must, before making any recommendations, refer the application to the cyber response committee.’ Members of the ‘cyber response committee,’ established in section 53 of the Cybercrimes and Cybersecurity Bill, include representatives from the South African Reserve Bank, National Treasury and the Financial Intelligence Centre. This consultation process provided assurance that the banking industry supervisory bodies would be consulted with respect to cyber matters.

Discussion

Mr Mbhele commented that while the Bill made provision for the consultation of relevant stakeholders, including the formation of ad hoc committees and standing committees to assist the National Commissioner. However, the general concern was around the general trend of SAPS management when it came to consultation with stakeholders in certain instances, with the firearms control environment being the most glaring example. In most cases, one would find out that consultation with stakeholders was either not effective or substantive, or things went wrong despite the consultation process.

BASA responded that it supported the process of inclusion of consultation with the National Treasury and the SARB. 

Ms Kohler Barnard suggested that there was a need to look very closely at the proposed members of the Council, especially since there was no consideration of members in the financial and trading entities, who would understand the operation of finance and banks. It was unclear why the members of the Department of Communication had been included in the Council. It would be impossible to declare all banks and their entities as critical infrastructure, as people could go to jail for taking a picture of an ATM. One did not want South Africa to become a major police state just for the protection of entities. There was a need to go back to the drawing board regarding the members to serve on the Council. There was an indication that the SARB was a national key point, but the assumption was that the presentation was primarily based on any possibility of including banks as critical infrastructure.  

BASA replied that the presentation was indeed merely about the possibility. There should be more concentration on who sat on the Council in respect of financial stability, as this would be critically important in how the Bill was crafted going forward.

Mr P Mhlongo (EFF) asked whether the reference to banks referred to banks in general, as this would be impossible to manage. It was unclear if the reference to the banks was perhaps related to the SARB as an entity, with a regulatory authority over the country’s banks.

BASA responded that it was simply saying that the SARB should be consulted if the banks were to be considered as critical infrastructure, as they were the regulatory authority responsible for financial stability.

Briefing by Greenpeace Africa

Mr Happy Khambule, Climate and Energy Political Advisor: Greenpeace Africa, said that Greenpeace Africa was a not-for-profit organisation which campaigned to further the vision of an Africa where people lived in harmony with nature in a peaceful state of environmental and social justice. In developing its campaign strategies, it took great care to reflect its fundamental respect for democratic principles and to seek solutions for, and promote open, informed debate about society's environmental choices. Greenpeace Africa also ensured the financial independence from political or commercial interests at all times. All its environmental work reflected the core values of Greenpeace organisations throughout the world, and included “bearing witness” to environmental destruction in a peaceful way, using non-violent confrontation to raise the level and quality of public debate. The work that was done was in the public interest. Democratic countries throughout the world accepted that NGOs played an important role in a healthy democracy, despite the fact that in some cases the actions undertaken may result in minor infringements of the law. These acts were nevertheless justifiable because they were necessary to avert greater harm to public interest.

If the Critical Infrastructure Protection Bill were to be enacted in its present form, it would criminalise many of the activities which Greenpeace undertook to promote public debate. It would expose its activists to the risk of imprisonment for up to 30 years for activities such as entering premises, hanging banners and filming, even if there was no actual prejudice to the interests which the Bill sought to protect. Greenpeace Africa associated with, and endorsed, the submissions made by the Right2Know. The organisation believed that the Bill was unconstitutional because it limited fundamental rights in the Bill of Rights in ways that were unnecessarily restrictive and disproportionate.

The organisation was also concerned that the Bill represented a shift away from the core principles on which the Constitution was based, towards the restriction and repression of dissent, ostensibly in the interests of national security. The definitions were vague and wide, this meant that nuances were lost in the process. The actual harm must be real and not perceived. The bill afforded the security manager wide – and seemingly unfettered -- discretion as to what conditions may be imposed on those that enter the premises of defined critical infrastructure.

Mr Khambule said that the impact of this Bill would discourage legitimate expressions of rights. In some cases, there was good reason to believe that the National Key Points Act had been used to shield public officials and institutions from legitimate public scrutiny. The Bill imposed blanket restrictions on the Constitutional rights of freedom to receive or impart information, access to information; the right to unarmed, peaceful assembly, protest and picketing, instead of enabling these rights to be balanced against the interests of the Bill. The interests which the Bill sought to protect could be adequately protected using measures which were much less restrictive of fundamental rights. The Bill imposed draconian penalties for very broadly defined crimes, which included acts that did not actually pose a threat to the critical infrastructure or the provision of basic public services. There was a need for clarifying how the Bill was to be interpreted, and since many of the provisions of the Bill were open to interpretation, it was very important to clarify that it had to be interpreted in ways that minimised the infringement of fundamental rights. This could be achieved by inserting a section dealing specifically with interpretation and amending the long title and preamble, both of which were referred to as aids in interpreting legislation.

Section 3 (Application of Act) could be expanded to deal with both the application and interpretation of the Act. It should include a subsection which states explicitly that the provisions of the Act must not be interpreted as limiting sections 16, 17 and 32 of the Constitution, except to the extent necessary to prevent significant harm or damage to critical infrastructure or the disclosure of information or images that would have the effect of causing significant interruptions to the delivery of basic public services, or significant prejudice to public safety or national security. This must make it clear that only measures that were in the public interest may be taken. For example, it should read: “to provide for measures to be put in place for the protection, safeguarding, and resilience of critical infrastructure, in the public interest;".

Mr Khambule pointed out that the Bill criminalised a very broad range of acts, including potentially inconsequential acts that could be considered to be "tampering", regardless of whether or not they may cause such severe prejudice. It was essential that inconsequential acts and omissions were not criminalised. In order to achieve this, the definition of "threat" in section 1 and “offences” in section 26 must be qualified, using phrases such as "severely prejudice" or "significant," and appropriate defences must be introduced, possibly in section 26.

In conclusion, Greenpeace Africa remained opposed to the enactment of such sweeping security legislation in the absence of credible evidence of the existence of serious threats which could not be adequately addressed by existing legislation. The Bill must be amended to accord with the Constitution by adopting less restrictive measures to achieve the purposes of the Bill.

Discussion

The Chairperson asked if there was a specific jurisdiction that could be provided to the Committee with legislation that Greenpeace Africa felt was appropriate to deal with critical infrastructure.

Ms Kohler Barnard commented that Greenpeace Africa was a global organisation and all the issues that had been raised by the organisation should have been taken into consideration. The Bill was draconian in nature and the Committee should avoid the humiliating experience of having this piece of legislation turned back because it was deemed unconstitutional. The number of the issues that had been raised showed that the Bill could be challenged in court, especially the aspect where an individual could be sentenced to 20 years for protesting outside critical infrastructure. A number of issues in the Bill would need to go back to the drawing board in order to be in line with the Constitution, and the Bill at the moment seemed to go over and beyond the Constitution.

Mr Mbhele said that the definition of “offences” should be narrowed down to security measures, as this was kind of the hinge in the arena of critical infrastructure. The focus seemed to be on preventing the case where a security installation in the critical infrastructure would be compromised. The National Assembly and National Council of Provinces’ buildings were considered as national key points, but most people loved to take pictures of these buildings when visiting Parliament. It must be made clear in the Bill that a disruption was not about whether there was picketing or demonstration outside critical infrastructure buildings, but whether the picket was disruptive to the functioning or integrity of the critical infrastructure.

Mr Mhlongo also requested that the Committee should be presented with best practices that had been observed elsewhere, since Greenpeace was a global organisation. The general understanding was that the Bill was still in its initial phase and therefore needed more inputs. Africa needed to develop its own defence mechanism in order to be able to reduce wars happening in countries like the Democratic Republic of Congo (DRC). The continent should not be blinded by these so-called “rights,” or it would be impossible to develop these defence capabilities to the fullest. The state must be able to protect its own secrets, but it must not come up with useless measures to cover up corruption, and should look after the genuine interests of the nation. It was impossible to say that South Africans were safe when the weapons that were being dumped by the West were likely to end up in South Africa. It was really absurd to say that South African should be more transparent when there were countries running intercontinental ballistic missiles. Who was giving these countries the right to develop weapons of mass destruction?

Mr Maake said that it was problematic for the organisation to suggest that there should be an inclusion of “significant” or “severe” damage to the critical infrastructure, as this inherently inferred that small damage should not be viewed as troubling. It was unfortunate that Greenpeace Africa did not deal with the existing gaps in the Bill.

Ms Molebatsi asked about how the long title should be written if it had been shortened, as suggested by the organisation.

Mr Khambule responded that Greenpeace Africa was not a violent organisation and therefore would not engage in any violent activity, and this was the issue that must be noted. The little disruption that the organisation could do would qualify as a nuisance. The inclusion of “significant” or “severe damage” was to avoid the abuse of power by those who were in enforcement, and therefore it was critically important to be able to apply ones’ minds on a case by case basis on what could be construed as severe or significant damage. The inclusion of private sector involvement was another way of increasing transparency and diversification of views and inputs.

Greenpeace Africa did not have a position as yet on the makeup of the Council. The Committee would be provided with a written response on the best practices from other jurisdictions. Greenpeace Africa included the African Commission on Human Rights’ version on dealing with issues related to critical infrastructure. The European Court had a recent judgment on issues similar to dealing with critical infrastructure. The organisation was aware of the security issues that engulfed the continent, but there was still a belief that there should be a level of transparency.

The Bill was adding more laws and adding more provisions on secrecy, and there was already legislation that dealt with issues on national security. The Bill did not need to deal with issues that were already dealt with in other legislation. This Bill simply meant that someone could get arrested or subject to fine for taking a “selfie” in Parliament, for example. The issues of national security could be dealt with in other existing legislation, and there was an entity dealing primarily with issues of national security.

The short title of the Bill was appropriate as it is, if the Bill were to be passed.

It must be taken into consideration that there were many ways in which these kinds of legislation could be used in disempowering civil society on the ground. The Bill had implications for civil society in terms of picketing or demonstrating freely.

The Chairperson reminded Greenpeace Africa to forward to the Committee the best practices from other jurisdictions, as requested by Members.

The meeting was adjourned.