The proposed amendments to the ICT Act to regulate social media in democratic Mauritius entail the risk of creating a surveillance state

On 14 April 2021, the Information and Communication Technologies Authority (ICTA) released a Consultation Paper on proposed amendments to the ICT Act for regulating the use and addressing the abuse and misuse of Social Media  in Mauritius. In a nutshell, the paper makes a proposal to amend the law so that all internet communication would have to pass through a centralised proxy server managed by the agency and citizens will have to install a digital self-signed certificate on their devices to allow the server to access, decrypt, segregate social media traffic for analysis for investigative purposes. The technical toolset would be managed by an Enforcement Unit within the ICTA and there would be a National Digital Ethics Committee to decide on how to deal with “illegal and harmful content”.

There are numerous issues with this proposal. The most salient one being that the mechanism would make Mauritius a blanket surveillance state, which is incompatible with the concept of democracy. In fact, no other democracy in the world uses such a blanket system to intercept citizens’ communication in order to regulate social media. Below is a more detailed analysis of the content.

– What is the context for the proposed amendments?
– Preliminary comment about the context
– What are those proposed amendments to the ICT Act?
– Comment about the philosophy underlying the proposal
– What does the Constitution say?
– What are other democratic states doing or trying to do?
– Other key questions posed by the proposed amendments
– What are potential alternatives to the proposed amendments?
– Conclusion

What is the context for the proposed amendments?

There is a perceived need for regulation of social media in Mauritius. The stated objective is to combat illegal and harmful content (and comment) in a way that is not dependent on international social media companies. These platforms are deemed to be not sufficiently responsive to requests from the authorities in terms of:

• time taken to respond,
• community standards which are not as strict as our domestic laws, and
• the Creole language which the platform moderators do not understand.

The paper states that a “minority of individuals or organised groups” are at fault and that “The issue at hand is when these abuses, even though perpetrated by few individuals/groups, go viral, the damage created is very far reaching.”

Preliminary comment about the context

A first comment is that a list of concrete examples is needed here to gauge the extent of the problem at the national level. The list should include detailed information about the “very far reaching damage” created.  The consultation paper does include a table listing the number of incidents reported to the Mauritian Cybercrime Online Reporting System (MAUCORS).

We would however need more details on the following (inter alia):

• the investigation process for the incidents reported,
• the actions taken by the authorities in all of these cases,
• whether these incidents were dealt with locally by law or reported to the social media platforms,
• the results obtained.
• An in-depth analysis of the above would be needed. This would enable a more objective evaluation of the proportionality of the proposed mechanism with respect to the extent of the problem to be addressed. In a nutshell, the question is: How big is the problem of misuse and abuse of social media really in the country that warrants such far-reaching measures?

What are those proposed amendments to the ICT Act?

ICTA is proposing the creation of:

• a  National Digital Ethics Committee (NDEC) as the decision-making body on the contents. The key mandate of the NDEC would be to:

investigate on illegal and harmful content on its own or through interaction with other stakeholders already involved in national security, crime investigation, detection and prevention or through complaints received;

• a Technical Enforcement Unit to enforce the technical measures as directed by the NDEC.
• a  technical toolset to be deployed whereby internet users in Mauritius will have to use a local proxy server as intermediary and will be asked to install a self-signed digital certificate allowing them to be accepted as intermediary by the browser or the app, thereby bypassing the https protocol. The stated objective is to allow the proxy server to:

1. segregate traffic to and from social media sites,
2. decrypt such information
3. analyse and store data for investigations purposes

Comment about the philosophy underlying the proposal

• The adjective “harmful” should be defined clearly with a list of all types of content and the criteria which will be used to classify such content as harmful. Otherwise, this will inevitably lead to questions in the public’s mind about what is allowed and what is not allowed. In other words, the “rules of the game” should be clearly spelt out in advance.
• There is also an inherent risk of potential abuse and misuse by authorities and parties involved in the mechanism if the term “harmful” is not clearly defined. An important matter such as this cannot be open to interpretation, bearing in mind that the principle of potential “alternance”of parties in power is still valid in Mauritius and that there is always a risk of petty power games as a result.
• The adjective “illegal” is clearer as this relates to the laws of the country, which are enacted by parliament, interpreted by courts of justice and implemented by policy-makers.
• More importantly, the main issue with this proposal is a potential conflict with section 12 of the Constitution as highlighted in the paper itself.

What does the Constitution say?

As a reminder, Section 12 of the Constitution of Mauritius states that:

12. Protection of freedom of expression

(1) Except with his own consent, no person shall be hindered in the enjoyment of his freedom of expression, that is to say, freedom to hold opinions and to receive and impart ideas and information without interference, and freedom from interference with his correspondence.

(2) Nothing contained in or done under the authority of any law shall be held to be inconsistent with or in contravention of this section to the extent that the law in question makes provision— (a) in the interests of defence, public safety, public order, public morality or public health;

(b) for the purpose of protecting the reputations, rights and freedoms of other persons or the private lives of persons concerned in legal proceedings, preventing the disclosure of information received in confidence, maintaining the authority and independence of the Courts, or regulating the technical administration or the technical
operation of telephony, telegraphy, posts, wireless broadcasting, television, public exhibitions or public entertainments; or

(c) for the imposition of restrictions upon public officers, except so far as that provision or, as the case may be, the thing done under its authority is shown not to be reasonably justifiable in a democratic society

This section thus states that there can be no interference in our communications except with our consent and except for specific provisions involving public defence, safety, order, morality and health, reputation, privacy, courts authority, technical administration of telecoms and civil service restrictions. BUT, the last line puts everything in perspective as the provisions should be “justifiably reasonable in a democratic society” .

Unfortunately, the proposed amendments to the ICT Act do not seem “justifiably reasonable in a democratic society“.

The proposal is tantamount to blanket surveillance on the citizens of Mauritius without judicial oversight. No warrant would be needed to spy on specific individuals. ALL citizens’ communication would be interfered with in a blanket manner. The proportionality test is here crucial to determine whether such a surveillance system is really warranted in a democratic society like ours. Does this pass the balance of risks/benefits? Fundamentally, this proposal seems to contradict the philosophy of the Data Protection Act which aims to protect citizens’ private data and which was adopted in 2017 (and modelled on the EU GDPR).

What are other democratic states doing or trying to do?

In fact, we do not know of any other democratic state which is using such a system. This would be a first in the world, in the negative sense of the word. As a result, there is a high probability that Mauritius will tumble down in world freedom rankings.

In all the democratic states cited in the consultation paper, the responsibility for moderation and removal of illegal content is or will be vested with the social media platforms (when requested by governments).

• In Germany, the Network Enforcement Act has forced platforms such as Facebook to employ many more moderators for the country and the law provides that the data should be stored by the platforms for only up to 10 weeks (no moratorium is provided by the ICTA for Mauritius).
• In the UK, Ofcom has been tasked with the regulation of social media and the Chief Executive states on the official website that “We won’t censor the web or social media. Free expression is the lifeblood of the internet and it’s central to our democracy, values and modern society.” and “We won’t be responsible for regulating or moderating individual pieces of online content. The Government’s intention is that online platforms should have appropriate systems and processes in place to protect users; and that Ofcom should take action against them if they fall short. We’ll focus particular attention on tackling the most serious harms, including illegal content and harms affecting children.“
• India has recently introduced new Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules which require “significant” social media intermediaries (based on the number of users) to have a local representation with a Chief Compliance Officer, a Nodal Contact Person and a Resident Grievance Officer and the platforms would need to publish regular reports about compliance with a Code of Ethics.
• There have also been intense debates in all cases and some parts of legislations proposed had to be reviewed or are still being reviewed with no successful model emerging for the time being. For instance, large sections of the French Loi Avia were deemed anti-constitutional by the Senate and had to be reviewed.

The key take away here is that State agencies in democratic countries are not endowing themselves with any technical capacity to interfere, intercept and remove any content on social media in comparison with the Mauritian ICTA proposal.

I am not an expert in technology but I assume that the mechanism for intercepting, decrypting and re-encrypting social media traffic requires enormous technical capabilities given the enormous amounts of data (photos, videos, livestreams, etc.) generated daily. It is also very much a moving target because nothing can prevent any social media network from changing some implementation details which might make the system ineffective. Anyway, just by using a Virtual Private Network (VPN), anyone can bypass the system.

Other key questions posed by the proposed amendments

• Will all social media be concerned? Will there be a list which will be published and updated?
• Would the filtering, analysis and classification be done by humans or by a software? If so, would the code be transparent and open to scrutiny?
• What about the potential risk for middleware to be tampered with? (by subcontractors for example)?
• What will be the composition of the National Digital Ethics Committee? What criteria will be used to designate the chairperson and the members?
• What will be their expected volume of work (given that there are enormous amounts of content being created everyday)?
• What criteria will be used for assessing content?
• Will there be hearings in case an individual or group is suspected of creating and disseminating “illegal and harmful content”? Will there be an appeal system?
• What will be the safeguards against misuse and abuse of the mechanism?
• Is there sufficient technical capacity to handle the volume of data generated and shared on social media on the national level? What about potential issues with quality of service on the network which may affect the digital sector of the economy as well as all operations of non-digital firms which use digital tools to effect transactions, promote their products and services, handle internal processes and information?
• Will the digital certificate installation be compulsory? How? What if people refuse? What if people resort to VPNs?
• Have other solutions been explored? How far? Could the analysis be made public? How about strengthening local investigation capacity?
• The issue of monetisation of news content and payments to be made by platforms to local media in the case of Australia is also cited. How is this related to the proposed amendments?
• According to the press communiqué issued by the ICTA, private messaging apps will not be concerned by the amendments. Why is the example of killings following false rumours of child kidnapping spread through WhatsApp in India cited in the proposal?

What are potential alternatives to the proposed amendments?

• The last question in the consultation paper asks citizens if they think that local courts of justice should be empowered to “impose sentences (which include banning use of social media) on persons convicted of offences relating to misuse of social media tools”. How far has this been explored?
• What other preventive measures have been explored (education, sensitisation, digital literacy, etc.)?
• What about using our diplomatic connections at the regional level to enter into negotiation with the social media platforms in order to improve their responsiveness? (eg. AU, SADC)

Conclusion

It is a positive sign that this is at the stage of a public consultation, thus requiring inputs from Mauritian citizens as individuals or groups, hopefully shaping the outcome of the final decision to amend legislation or not. In the same spirit, the next phase of the process should be transparent, that is, it is expected that there be a public report about inputs received and how these inputs are tackled by the ICTA and any other authority involved in the process.

The present proposed amendments do not seem reasonable in terms of the proportionality of the measures with respect to the problem to be tackled and puts Mauritius at risk of becoming a surveillance state with potential abuse and misuse of the technical toolset against its very own citizens, rather than to protect them.

It is thus very important that concerned citizens send their inputs to

Click here to read my final submission to the ITCA in the form of an Analytical Paper