Vodafone Reveals Government Requests for Subscriber Information

By Ashnah Kalemera & Juliet N. Nanfuka
The true extent of governments’ surveillance and monitoring of citizens’ communications across the world remains largely unknown. This is despite legislative rights provisions for privacy and increased calls for data protection of citizens in their communications.
Last month, Vodafone became the first telecomuminications company to reveal the extent of government surveillance of its subscribers. In its Law Enforcement Disclosure Report, the company revealed that governments in some of the 29 countries in which it operates – including in Africa – are requesting its subscribers’ data sometimes without warrants. In addition, government agencies also listen in on subscribers’ conversations and monitor their whereabouts through wires connected to the Vodafone networks.
However, the British company and world’s second largest mobile phone operator could not disclose the full extent of surveillance in nine of the countries it operates in due to legal provisions prohibiting the disclosure of information relating to government wiretapping and interception of communications.
Vodafone operates in eight African countries, namely the Democratic Republic of Congo, South Africa, Lesotho, Tanzania, Mozambique (in all of which it operates as Vodacom), Kenya (as Safaricom), Egypt and Ghana. In 2013, the company received around 100,000 requests from African governments for metadata such as phone numbers, addresses, device locations and times of calls and text messages.
The report cites the Tanzanian government as having made the highest number of requests – 98, 765. Authorities in Congo made 436 requests while in Lesotho 488 requests, were made.
Due to laws restricting the disclosure of information related to law enforcement, Vodafone was unable to publish statistics on the other five African states where it has operations.
According to the report, in Egypt, local criminal laws prohibit the disclosure of national security-related information and other matters related to law enforcement. In Ghana, unclear legal restrictions on access to, transfer and disclosure of electronic records meant that Vodafone was unable to publish information on the demands made. “We have asked the [Ghana] authorities for guidance: however, we have not yet received a reply.” said the report.
Vodafone was also unable to publish statistics related to the Kenyan government’s request for individual communications data due to unclear provisions in the Official Secrets Act and the National Intelligence Services Act. Unclear legal provisions in Mozambique meant that the same statistics could not be published.
Similarly, South Africa’s Regulation on Interception of Communication and Provision of Communication-related Information Act prohibits the disclosure of the fact that any demand for lawful interception or communications data has been issued under the Act. Accordingly, Vodafone did not publish any statistics for the country.
The legal provisions preventing Vodafone from indicating the exact number of government requests for its subscriber information, instances of lawful interceptions or even any indication of interception capabilities, is telling of the degree to which some governments will go to hide the extent of their surveillance.
In the report, Vodafone disclosed that it had not implemented the technical requirements necessary to enable lawful interception in Congo, Kenya, Lesotho, Ghana, Tanzania and Mozambique and as such had not received any demands from those authorities for lawful interception assistance.
Vodafone Communication Interception and Data Requests in Africa
(Source: Country-by-country disclosure of law enforcement assistance demands Report)

Country Communications meta data requests Implementation of technical capacity for lawful interception
Democratic Republic of Congo 436 None
Egypt Disclosure of information is unlawful
Ghana Disclosure of information is unlawful None
Kenya Disclosure of information is unlawful None
Lesotho 488 None
Mozambique Disclosure of information is unlawful None
South Africa Disclosure of information is unlawful
Tanzania 98,765 None

Vodafone reported that similar to Egypt and South Africa, the disclosure of information related to interception of communications and government data requests was unlawful in India, Qatar, Romania and Turkey.
In Europe, Italy made the highest metadata requests to the company – a total of 605,601. This was followed by Hungary (75,938), Spain (48,679) and Portugal (28,145). The governments of Albania, Ireland and Malta made 7,667, 4,124 and 3,773 metadata requests respectively. Two requests were received from Belgium and three from France. From the South Pacific, 760 metadata requests were received from Fiji.
The report states that Australia, Germany, Greece, the Netherlands, New Zealand and the United Kingdom were the only countries whose authorities published statistics on interception of communications and requests for communications metadata.
Vodafone’s report brings to the fore the intermediary liability challenge faced by many other telecommunications service providers across the world. The company published its statistics in an effort to urge all states to publish annual data on the surveillance and monitoring of citizens via digital technologies. Indeed, a similar recommendation was made by a research report published in May 2014 on the State of Internet Freedoms in East Africa. The report revealed the use of legal and extra-legal means to snoop on citizens under the guise of national security in the six countries studied – Burundi, Ethiopia, Kenya, Rwanda, Tanzania and Uganda.
While Vodafone has broken its silence on this highly secretive issue, it remains to be seen whether other service providers will follow suit or whether governments will change their legal provisions to allow for increased transparency in surveillance.

Launch of the Internet Freedoms in East Africa 2014 Report

Today, the Collaboration on International ICT Policy in East and Southern Africa (CIPESA) launches The State of Internet  Freedoms in East Africa research report which is an Investigation into the policies and practices defining internet freedom in East Africa.
Thought leaders in the East African ICT industry  have gathered in Kampala, Uganda for the launch of this pivotal report.
The report  presents the findings of an exploratory study on the state of internet freedoms in Burundi, Ethiopia, Kenya, Rwanda, Tanzania and Uganda.  The research  reviewed  policy  developments  and  actions  related  to  internet freedoms over the period 2010 to April 2014.
As the day progresses, emerging themes will be explored by the attendees who will share their early thoughts on the findings as well as explore issues related to internet freedom in East Africa.
The report can be found here.
See the day’s programme here.

New Laws in Uganda Restrict Citizens’ Rights

By Juliet Nanfuka
Recently introduced laws and regulations in Uganda have caused a stir both within the country and internationally for restricting citizens’ rights to freedom of expression on the internet and offline.
The most contentious of these are the Anti-Pornography Act 2014, the Public Order Management Act 2013, the Anti-Homosexuality Act 2014, the 2014 Press and Journalist regulations and the Non Government Organisation (NGO) Amendment bill. They are criticised for creating unwarranted restrictions to liberties granted by the country’s 1995 constitution.
As a result, the space in which civil society, the media and citizens can enjoy constitutionally granted rights to freedom of expression, opinion, assembly, and information is steadily shrinking.
In an April 2014 brief, CIPESA takes a look at how the recently enacted laws and proposed amendments impact on citizens’ rights, including internet rights, as well as on the work of human rights defenders. Read the full brief here.

Towards an African Declaration on Internet Rights

As internet usage continues to grow in Africa, so does the interest by governments to monitor users’ online activities. This has led to a clash between internet rights promoters and governments in some African countries.
On February 12–13, 2014, participants from several African civil society organisations involved in promoting human rights and internet rights convened in Johannesburg, South Africa to draft an African Declaration on Internet Rights and Freedoms. The meeting was organised by the Association for Progressive Communications (APC) and Global Partners Digital in collaboration with the Media Rights Agenda, Media Foundation for West Africa and the Kenya Human Rights Commission.
Many countries justify their tough stance on internet freedom as necessary to fight cybercrime, promote peace and maintain national security. Whereas some of these policies and practices have been adopted by authoritarian regimes to retain power, others were in response to national crisis contexts such as hate speech and terrorism. Ultimately, the measures have often had chilling effects on access to information, freedom of expression, privacy and data protection.
Participants in this meeting called for the promotion of an open, free and accessible internet. Issues identified as the most crucial and still hindering internet growth in Africa that need immediate action were: improving access to internet including the development and promotion of localised multi-lingual content; addressing internet infrastructure obstacles; capacity building for users; and the need to create a balance between freedom of expression and privacy of users.
Others identified were data protection, addressing gender inequalities and gender-based violence against women online, and adopting supportive ICT policies that promote freedom of expression online and equitable access to information.
Due to increased internet freedom violation incidents coupled with regressive policies being made in many countries, the need for a well-defined Internet Intermediary Liability (ILL) regime has also become increasingly apparent. Another meeting held on February 10-11, 2014 organised by the APC with support from Google Africa discussed the responsibility that may be placed on intermediaries in implementing monitoring and control mechanisms laid down by the laws.
At the regional level, there are legal and regulatory frameworks like the Africa Charter on Declaration of Principles on Freedom of Expression in Africa, which provide limited protection for internet rights and the liability of internet intermediaries. It was noted that such frameworks could act as building blocks for individual countries to draw up best practices on ILL regimes.
There was consensus that such existing frameworks should be the basis for adopting a general guide with definitions of terms on Internet intermediary liability. This guide would act as central referencing document on which individual countries would base their national IIL regimes.
During the discussions, participants charted their thoughts on a best practice guide for an IIL regime for Africa by asking the below questions:
Untitled
 
While responding to these questions, participants recognised that intermediaries can play a crucial role in promoting Internet freedoms in Africa.
Meanwhile, the meeting also reviewed recent policy and practice developments in Uganda, Kenya, South Africa and Nigeria since the 2011 Intermediary Liability in Africa research. It identified a need to increase awareness among different stakeholder groups of the importance of clear regulatory frameworks for intermediary liability to secure rights on the internet; and for stronger collaboration to advocate for best practice internet intermediary regulatory measures in Africa.
The outcomes of both these meetings will form the basis for the draft civil society Africa Declaration on Internet Rights and Freedoms, which will be launched at the ninth global Internet Governance Forum (IGF) in Istanbul, Turkey September 2-5, 2014. The declaration will be available for public input throughout the period leading up to IGF 2014.

Exploring The State of Internet Freedom in Africa

What is the price of security? Should it be your online freedom? 
By Juliet Nanfuka
Where do human rights and online rights meet? Is there a clash between online freedom and human rights? Is there room for self-regulation? These are some of the questions that a recently concluded online discussions report on Internet freedom in Africa explores.
Participants from Uganda, Kenya and Nigeria used online platforms to discuss these issues over a four week period at the end of 2013.
A key theme that came out of the report is the recognition of the increased numbers of internet users across the continent and parallel to this, increased measures taken by governments on surveillance of citizens. This, in turn, has brought to the fore many questions about freedom of expression and privacy.
Many countries are faced with contradictory policies when it comes to freedom of expression especially when it is placed alongside national security and stability. As a result, freedom of expression is threatened by restrictive legal measures that infringe on the access and sharing of information. In addition to these are the legal permissions granted to governments with regards to accessing information about users. Requests from African governments, although few, appear to be politically motivated according to the Google Transparency Reports.
In light of this, a participant asked a key question that also raises concerns about censorship, “How much can you restrict if those with no restriction can interact with and pass on information to the restricted using alternative methods of communication?” This led to the recognition of the conflict that exists between online freedom of expression and the state. Such was seen in the 2011 politically motivated ‘Walk to Work’ protests in Uganda in which the national communications regulatory authority, the Uganda Communications Commission, instructed ISPs to block access to social networking sites like Twitter and Facebook for 24 hours. More on this can be found here Internet Freedom in Africa Under Threat.
The report, prepared by the Collaboration on International ICT Policy in East and Southern Africa (CIPESA) in partnership with Paradigm Initiative Nigeria (PIN) can be downloaded here.