CYBERCRIMES AND CYBERSECURITY BILL

1 REPUBLIC OF SOUTH AFRICACYBERCRIMES ANDCYBERSECURITY bill (As introduced in the National Assembly (proposed section 75); explanatory summary ofBill published in Government Gazette No. 40487 of 9 December 2016)(The English text is the off cial text of the bill )(MINISTER OFJUSTICE ANDCORRECTIONALSERVICES)[B 6 2017]ISBN 978-1-4850-0355-7No. of copies printed ..800 BILLTo create offences and impose penalties which have a bearing on cybercrime ; tocriminalise the distribution of data messages which is harmful and to provide forinterim protection orders; to further regulate jurisdiction in respect ofcybercrimes; to further regulate the powers to investigate CYBERCRIMES ; to furtherregulate aspects relating to mutual assistance in respect of the investigation ofcybercrime; to provide for the establishment of a 24/7 Point of Contact; to furtherprovide for the proof of certain facts by affidavit.

2 To impose obligations onelectronic communications service providers and financial institutions to assist inthe investigation of CYBERCRIMES and to report CYBERCRIMES ; to provide for theestablishment of structures to promote CYBERSECURITY and capacity building; toregulate the identification and declaration of critical information infrastructuresand measures to protect critical information infrastructures; to provide that theExecutive may enter into agreements with foreign States to promote CYBERSECURITY ;to delete and amend provisions of certain laws; and to provide for mattersconnected the Republic of South Africa enacts as follows: ARRANGEMENT OF SECTIONSS ectionsCHAPTER securing of acquiring of acts in respect of software or hardware interference with data or computer interference with computer data storage medium or computer acquisition, possession, provision, receipt or use of password, accesscodes or similar data or forgery and , conspiring, aiding, abetting, inducing, inciting, instigating,instructing.

3 Commanding or procuring to commit of verdictsCHAPTER 3 MALICIOUS message which incites damage to property or message which is of data message of intimate image without to protect complainant pending finalisation of criminal communications service provider or person in control of computersystem to furnish particulars to on finalisation of criminal 5 POWERS TO INVESTIGATE, SEARCH AND ACCESS OR Operating of provisions in this for and access to, or seizure of, certain to be searched for, accessed or seized under search application for search warrant or amendment of for, access to, or seizure of article without search warrant with consentof person who has lawful authority to for, access to or seizure of article involved in commission of offencewithout search for, access to and seizure of article on arrest of member of law enforcement agency or or hindering police official or investigator and authority toovercome conferred upon police official or investigator to be conducted in decentand orderly manner with due regard to rights of other search, access or seizure and restriction on use of instrument, device,password or decryption key or information to gain information under oath or by way of on disclosure of of indirect communication.

4 Obtaining of real-time communica-tion-related information and archived communication-related preservation of data of evidence application for preservation of evidence of data for, access to and seizure of data where no authorisation is requiredCHAPTER 6 MUTUAL of provisions in this requests for assistance and with order of designated foreign State of outcome of request for mutual assistance andexpedited disclosure of traffic of direction requesting foreign mutual assistanceCHAPTER 724/7 POINT OF and functions of 24/7 Point of ContactCHAPTER of certain facts by affidavitCHAPTER 9 OBLIGATIONS OF ELECTRONIC COMMUNICATIONS SERVICEPROVIDERS AND FINANCIAL of electronic communications service providers and financialinstitutionsCHAPTER 10 STRUCTURES TO DEAL WITH Response structures supporting points and private sector computer security incident response

5 SharingCHAPTER 11 CRITICAL INFORMATION INFRASTRUCTURE of critical information of critical information infrastructures to ensure complianceCHAPTER 12 AGREEMENTS WITH FOREIGN Executive may enter into agreementsCHAPTER 13 GENERAL Director of Public Prosecutions must keep statistics of or amendment of title and commencementSchedule45101520253035 CHAPTER this Act, unless the context indicates otherwise access , for purposes of Chapter 5, includes, without limitation, to make use ofdata, a computer program, a computer data storage medium or a computer systemor their accessories or components or any part thereof or any ancillary device orcomponent to the extent necessary to search for and seize an article; article means any data, computer program, computer data storage medium orcomputer system which (a)is concerned with, connected with or is, on reasonable grounds, believed to beconcerned with or connected with the commission or suspected commission;(b)may afford evidence of the commission or suspected commission.

6 Or(c)is intended to be used or is, on reasonable grounds, believed to be intended tobe used in the commission,of an offence in terms of Chapter 2 or sections 16, 17 or 18 or any other offencewhich may be committed by means of, or facilitated through, the use of such anarticle, whether within the Republic or elsewhere; computer means any electronic programmable device used, whether by itself oras part of a computer system or any other device or equipment or any part thereof,to perform predetermined arithmetic, logical, routing, processing or storageoperations in accordance with set instructions and includes all (a)input devices;(b)output devices;(c)processing devices;(d)computer data storage mediums; and(e)other equipment and devices that are related to, connected with or used withsuch a device; computer data storage medium means any device or location from which dataor a computer program is capable of being reproduced or on which data or acomputer program is capable of being stored by a computer system, irrespective ofwhether the device is physically attached to or connected with the computersystem; computer program means data representing instructions or statements that,when executed in a computer system, causes the computer system to perform afunction; computer system means (a)one computer.

7 Or(b)two or more inter-connected or related computers, which allow theseinter-connected or related computers to (i) exchange data or any other function with each other; or(ii) exchange data or any other function with another computer or a computersystem; Criminal Procedure Act means the Criminal Procedure Act, 1977 (Act No. 51of 1977); Customs and Excise Act means the Customs and Excise Act, 1964 (Act No. 91of 1964); Customs Control Act means the Customs Control Act, 2014 (Act No. 31 of2014); data means electronic representations of information in any form; data message means data generated, sent, received or stored by electronicmeans, where any output of the data is in an intelligible form; designated judge means a designated judge as defined in section 1 of theRegulation of Interception of Communications and Provision of Communication-related Information Act, 2002; electronic communications service provider means any person who providesan electronic communications service under and in accordance with an electroniccommunications service licence issued to such person under Chapter 3 of theElectronic Communications Act, 2005 (Act No.)

8 36 of 2005), or who is deemed tobe licensed or exempted from being licensed as such in terms of the ElectronicCommunications Act, 2005;551015202530354045505560 financial institution means a financial institution as defined in section 1 of theFinancial Services Board Act, 1990 (Act No. 97 of 1990); foreign State means any State other than the Republic; Intelligence Services Act means the Intelligence Services Act, 2002 (Act of 2002); Intelligence Services Control Act means the Intelligence Services Control Act,1994 (Act No. 40 of 1994); International Co-operation in Criminal Matters Act means the InternationalCo-operation in Criminal Matters Act, 1996 (Act No. 75 of 1996); investigator means any person who is not a member of the South African PoliceService and who is (a)identified and authorised in terms of a search warrant contemplated in section27(3); or(b)requested by a police official in terms of sections 29(2), 30(3) or 31(4),to, subject to the direction and control of the police official, assist a police officialwith the search for, access or seizure of an article; magistrate includes a regional court magistrate; Magistrates Courts Act means the Magistrates Courts Act, 1944 (Act No.

9 32of 1944); National Commissioner means the National Commissioner of the SouthAfrican Police Service, appointed by the President under section 207(1) of theConstitution of the Republic of South Africa, 1996; National Prosecuting Authority Act means the National Prosecuting AuthorityAct, 1998 (Act No. 32 of 1998); output of a computer program means any (a)data or output of the data;(b)computer program; or(c)instructions,generated by a computer program; output of data means having data displayed or in any other manner; payment system institution means a clearing system participant, a designatedclearing system participant, a designated settlement system, a designated settle-ment system operator, a designated settlement system participant, a PCH systemoperator, a Reserve Bank settlement system, a Reserve Bank settlement systemparticipant, a payment system, a settlement system, a settlement system participantor a system operator, as defined in the National Payment System Act, 1998 (Act of 1998), or any other entity or system subject to that Act; person means a natural or a juristic person.

10 Police official means a member of the South African Police Service as definedin section 1 of the South African Police Service Act, 1995 (Act No. 68 of 1995); Prevention of Organised Crime Act means the Prevention of Organised CrimeAct, 1998 (Act No. 121 of 1998); Protection from Harassment Act means the Protection from Harassment Act,2011 (Act No. 17 of 2011); public available data means data which is accessible in the public domainwithout restriction; Public Finance Management Act means the Public Finance Management Act,1999 (Act No. 1 of 1999); Public S