- South Africa will get an ultimate guardian for the online space, in many ways similar to the Public Protector, if the Democratic Alliance has its way.
- The opposition party this week started the formal process to propose a change to the Constitution, to include a Cyber Commissioner.
- Like the Public Protector, that would be an individual with significant power – who would be hard to remove if they fall out of favour with Parliament.
- The commissioner would be able to issue safeguarding directives to any company or organ of state, while specifically advising the military and helping out the police.
- They would also be in charge of online surveillance.
The Democratic Alliance wants South Africa to get another high-powered office, similar to the Public Protector in many regards, to guard the online space against everything from all-out cyber attack to the theft of personal information from the state.
The opposition party this week launched the formal process of proposing an update to the Constitution, to create a Cyber Commissioner among what is formally known as the state institutions supporting constitutional democracy, but typically referred to as Chapter 9 institutions for the section of the Constitution that establishes them: the South African Human Rights Commission, the Auditor-General, the Electoral Commission, and others.
Like the Public Protector and Auditor-General, that commissioner should be an individual South African citizen, the DA has proposed, appointed for a five-year term that can be renewed once, who may have some specialised knowledge of cyber security.
Once in office, that individual would be very hard to remove before the end of their term, likely requiring the same kind of process as getting rid of a Public Protector should Parliament lose faith in them.
And while in office, that person would have a great deal of power over the state and companies.
"At present, South African state departments and critical infrastructure is not sufficiently protected against cyber threats," says the DA in its motivation for the update to the Constitution. "They are also not properly equipped with protecting sensitive public information against hacks."
The party is not alone in that assessment. This week the South African Banking Risk Information Centre (Sabric) decried the "limited capacity of the police and [National Prosecuting Authority] to prevent, detect, investigate, and prosecute cybersecurity breaches" and urged a "substantial investment" to prevent criminals from having free rein online.
The Cyber Commissioner would assist the police with cyber forensics, and at least advise the defence force – as well as any other institutions with critical or vulnerable systems – on preparing cyber defences.
The commissioner would wield that power by way of directives that could be issued to any organ of state or company. Under precedent developed mainly during battles between then Public Protector Thuli Madonsela and then President Jacob Zuma around state spending at his Nkandla homestead, such directives would either have to be either complied with or overturned in court.
In what could be an area of increasing importance, the commissioner would also be the ultimate authority on online surveillance; "[a]ll interception of data capabilities will vest with the Cyber Commissioner", under the DA's draft amendment to the Constitution.
That would put such surveillance under the control of a person who accounts directly to Parliament, rather than to the President or a security minister.
The DA's draft Bill on the matter is now open to public comment until the second week of December.