R2K briefing: Critical Infrastructure Protection Bill

Briefing document: Critical Infrastructure Protection Bill

Parliament is considering a new Bill to replace the National Key Points Act, an apartheid-era security law. Its name is the Critical Infrastructure Protection Bill – the public has been asked to comment on the Bill by 1pm, Friday 24 November 2017.

This Bill is a revision of a draft Bill which was published for comment in June 2016.

What’s wrong with the ‘National Key Points Act’?

The Bill seeks to replace the National Key Points Act, an apartheid security law passed in 1980 to deal with the perceived threat of sabotage to apartheid infrastructure. This Act was strongly recognised as an undemocratic and unconstitutional law even though it remained intact during the transition to democracy and has now found a second life in the post-apartheid era. (See our fact sheet on the National Key Points Act here.)

The purpose of the National Key Points Act is to identify buildings and locations whose functioning is considered vital to national security; any such site is declared to be a ‘National Key Point’. Once this happens, the owners of the site are responsible for putting certain security measures in place (the level of security is tailored to the importance of the site). Under the Act it is a crime to reveal any information whatsoever about the security measures – the maximum penalty is three years in prison or a R10,000 fine.

The National Key Points Act got a lot of public attention during the Nkandla scandal, after journalists revealed that the homestead of President Jacob Zuma had been declared a National Key Point and public funds were used to upgrade the buildings and infrastructure; some of these upgrades were not related to security. But for years before that the Act had been used to undermine transparency and accountability, at a local level, especially affecting community protesters and environmental activists.

The Act has been criticised for undermining transparency (even the list of National Key Points was a secret). In a number of cases, public bodies and private companies used their status as a national key point to refuse to provide information to the public – for example, refineries have refused to give environmental compliance information because they are national key points,

The Act has also been invoked to suppress protests the right to protest. Although the Act doesn’t provide any prohibition on protest, police and other officials routinely try to stop protests at national key points. Police claim to have a policy prohibiting protests within 100m of national key points; R2K has never seen such a policy.

The list of National Key Points had long been a secret; in 2015, R2K and SAHA finally got a court order that forced police to release a list of the National Key Points (the list is available here).

What’s wrong with the Critical Infrastructure Protection Bill?

In light of the controversy around the National Key Points Act, the former Minister of Police, Nathi Mthethwa, promised a review of the Act in May 2013. In 2016, the Civilian Secretariat for Police Service published a Draft Critical Infrastructure Protection Bill for public comment, which R2K roundly criticised.

The Critical Infrastructure Protection Bill has a similar purpose and function to the National Key Points Act. Sites that would previously have been National Key Points will now be known as ‘Critical Infrastructure’ (CI).

What are the criteria for determining CI?

The considerations include:

16(2)(a) whether the loss, damage, unlawful disruption or immobilisation of such infrastructure may severely prejudice—
(i) the functioning or stability of the economy of the Republic;
(ii) the public interest with regard to safety and the maintenance of law and order;
(iii) the provision of basic public services; or
(iv) national security;

As well as

17(b) the strategic importance, including the potential impact of destruction, disruption, failure or degradation of such an infrastructure or the interruption of a service which might affect the Republic’s ability to function, deliver basic public services or maintain law and order;
17(e) the effects or the risk of a destruction, disruption, failure or degradation of such an infrastructure on—
(i) the environment;
(ii) the health or safety of the public or any segment of the public; or
(iii) any other infrastructure that may negatively affect the functions and functioning of the infrastructure in question;
(f) the size and location of any population at risk;
(g) historic incidents of destruction, failure or degradation of such infrastructure;
(h) the level of risk or threats to which such an infrastructure is exposed;

What this means:

This Bill could apply to any public sector body or private companies that meets these criteria. This would apply to nearly 200 existing national key points, but by elevating provision of basic services to more traditional ‘national security’ imperatives, the Bill would actually take a much wider approach than the 1980 Act. Any entity responsible for service delivery could fall under the Bill’s protection.

Who declares CI?

• Unlike the National Key Points Act, which invests this power solely in the Minister of Police, this Bill appears to create a more negotiated process.
• The Minister must take into account recommendations of a CI Council, made up of government representatives and private sector representatives.
• While institutions have an opportunity apply to be declared CI, such application must be announced in the government gazette for public comment.

Will there be transparency around CI?

• The Bill appears to guarantee that all new CI will be publicly declared in the gazette, meaning the list of CI will no longer be a protected secret.
• The Minister is obliged to table a detailed annual report to Parliament on the protection of CI, though it is not specified whether this would be tabled in open Parliament or, more likely, tabled in secret before Parliament’s intelligence committee.
• The owners of CI are required to clearly signpost the site/building as being a declared CI
• The ‘offences and penalties’ section strictly prohibit the sharing of any information about security measures at CI, or the recording of CI for any purpose.

Harsh criminalisation of protest, in peaceful, disruptive and violent forms

• Any disruption or obstruction to the functioning of a CI is an offence under the Bill and one could be prosecuted up to 20 years for interfering in anyway with CI. This could include peaceful, disruptive protest that is specifically designed to target important institutions – for example, a sit-in in Parliament or SABC, etc.
• Tampering, damaging or destroying CI, which might otherwise result in charges under the common law crime of malicious damage to property, would carry a maximum penalty of 30 years.
• These are new offences – they are not contained in the apartheid-era Act.

Severe limitation on freedom of speech and access to information

• Disclosing any information about security measures at CI (e.g. fences at Nkandla, turnstiles at Parliament, metal detectors at the SABC) carries a 20-year penalty, unless protected by the Protected Disclosures Act or any other law. While this exception is an improvement on the earlier draft of the Bill and the existing Act, it falls short of providing a full public interest defence. For example, revelations about security upgrades at Nkandla would not have been protected by the PDA, but were still in the public interest. In reality this formulation provides less protection to whistleblowers than in the current version of the Secrecy Bill.
• The Bill prohibits any filming and photographing of any aspect of CI if such is prohibited in a notice by the owners, or if such is ‘for unlawful purpose’, with a penalty of up to 20 years imprisonment. In practical terms, the addition of ‘unlawful purpose’ is no relief – it places power in the hands of a security official on the scene to risk an unlawful act being commissioned when he or she observes someone taking video footage at OR Tambo airport or the Gauteng provincial legislature or any other location. Effectively this draws a veil of secrecy around many of these institutions. This is a new offence; it is not contained in the existing Act.
• Aside from everything else, the penalties in the new Bill are significantly higher than in the existing Act. The highest penalty for exposing information about a National Key Point is three years in prison or a R10,000 fine.
• In general, these penalties and offences lack a harms test – any penalty for causing harm to security should be linked to the extent of the harm done by the action, not to the action itself.

These are just a few of the problems with the Critical Infrastructure Protection Bill. The Bill is open for comment until 1pm Friday 24 November.