‘Spy Bill’ Doesn’t Ban Encryption

IN the course of following the ‘spy bill’ saga, I encountered Mr Binneman’s excited article in The Namibian – ‘the end of the Internet in Namibia!’ – with increasing mystification. I don’t question his concern, and no doubt his hysterics are sincere, but I wonder if we are talking about the same law.

Seeing other lurid accounts of the Spy Bill, I decided actually to read the Act.Unfortunately Government ministers have done themselves no favours with their typical knee-jerk reaction to criticism on any topic. Probably, since the Communications Act was professionally drafted, they do not understand it themselves. But let us concentrate on this ‘banning’ of encryption as bewailed by Mr Binneman – I scanned the text of the entire Act and the word did not appear once. How can you ban something not mentioned? And ‘Decryption’ occurs in the following two instances only:A) ‘Any staff member employed in an interception centre may do anything necessary in order to perform the interception or monitoring concerned (as well as any decoding or decryption necessary to make the information in question intelligible) and must forward all information obtained from these activities to the person who made the request referred to in subsection (5).’[Sub-Section 5) reads: ‘The Director-General must designate a staff member in the Namibia Central Intelligence Service as the head of every interception centre’.]And: B) ‘(2) The Authority may require any licensee or any provider of telecommunications services to provide any information necessary to make any connection or in order to decrypt or interpret any information that the Authority may require in order to exercise the power referred to in subsection (1).’But notice that this section is sandwiched between subsections (1) and (3):'(1) In order to monitor compliance with the provisions of this Act the Authority may -(a) use any radio apparatus to monitor telecommunications by radio waves;(b) connect any equipment to the network of any licensee or the provider of any telecommunicationsservice in order to monitor any aspect of the network that may be relevant for theperformance of any function of the Authority under this Act.’'(3) The power referred to in subsection (1) may only be exercised in order to gather general or statistical information relating to telecommunications or to determine any technical question relating to any network that may be relevant to the compliance with any provision of this Act, but the power may not be used to obtain the contents of any message or information transmitted over that network, [my italics] or to obtain any information relating to the behaviour of any customer or user of any telecommunications service.’This makes it clear that any monitored and/or decrypted communications is purely for technical purposes in monitoring the regulatory provisions of the Act, and prohibits any perusal of the contents of the information contained in such communication. So much for spying.What about the apparently more worrying provision in my section A? First, the only persons authorised to do any decoding or decrypting are the Heads of every interception centre. There can’t be too many of these. Secondly, we should realise that these dreaded ‘interception’ centres are virtual – software – they are not Abu Ghraib style sinister buildings with razor wire and tinted windows, occupied by spooks with equally tinted shades. Every carrier, telecoms and datacomms in every IT-based country, without exception as far as I am aware, provides ‘interception centre’ services to the government administration which hosts them, whether this is publicised or not. In fact, most carriers, network and equipment providers actively market such products to their administrations. The Monitoring Centre system of Nokia/Siemens is an example. So we must not think that commercial providers are being dragged kicking and screaming into the world of surveillance – it is a lucrative business for them. As far as decryption is concerned, again, every data communications operator, will provide a ‘backdoor’ or ‘master key’ so that legitimate law enforcement agencies, even in the purest of democracies, can intercept and decode encrypted communications, if the legal processes (warrants etc) have been complied with. No administration would allow any communications company on its territory to operate without such a provision. This is nothing to do with a Bush-style ‘war on terror’ scam, but a necessary countermeasure to organised crime, especially international drug trafficking, of which Namibia unfortunately is an integral part (see your leading feature last Tuesday).This is also not, as has been ignorantly claimed, akin to giving ‘everyone’ a copy of the key to your house, but more like allowing the security company a master key to yours and other houses. Of course you can say: how do we trust the security company?, but that is a philosophical, infinitely recursive, and unanswerable question.So I have to break it to nervous Namibian journalists, that the ‘interception’ measures in the Act are nothing new or untypical. They are in place in every sophisticated country, whatever the name of the law is which authorises them, and almost without doubt, they are already in place here. The new Act simply regularises the position, as it should. Finally, another quote from the Act:The provisions of this Part [the part 6 ‘interception’ conditions] are not construed so -(a) as to prohibit the use of any specific type of technology;(b) as to compel service providers to perform any action that would make the provision of any class of telecommunications service uneconomical or technically infeasible;(c) as to obtain or store any information that in the normal use of any technology or protocol will not come to its knowledge or would not be readily available.Feel better now? The Internet in Namibia is not at an end. Don’t panic. Take a good anti-paranoia medication.Bill TorbittWindhoek