Score Change: The score improved from 4 to 5 because internet penetration rates in South Africa increased, according to some measurements.

Internet penetration has expanded rapidly in South Africa. According to the latest data from the International Telecommunication Union (ITU), the internet penetration rate reached 56 percent in 2017. DataReportal’s Digital 2022 report found that the internet penetration rate was 68.2 percent as of January 2022.1 According to the 2020 General Household Survey conducted by Statistics South Africa, the national statistics agency, 74.1 percent of South African households have at least one member who can access the internet at home, work, school, public hotspots, or internet cafés.2

The government has prioritized access to free public Wi-Fi with the adoption of its broadband policy, the SA Connect program, in 2013.3 Phase one of the project involved rolling out broadband to schools, clinics, police stations, and other government facilities, particularly in underserved communities. Despite challenges with the rollout of the project’s first phase, cabinet approved the rollout of the second phase4 but did not allocate the project any funds in the 2022–23 budget.5 Mobile operators are obligated to contribute to the SA Connect implementation as part of their license conditions. As of May 2022, the minister of communications and digital technologies announced that telecommunications operators will be providing internet to 18,520 schools, 5,731 clinics and hospitals, 8,241 traditional authority offices and 949 libraries over the next following months.6

Several other initiatives have enjoyed modest success in rolling out public Wi-Fi in metropolitan areas, including Cape Town, Durban, Johannesburg, Tshwane,7 and the Ekurhuleni municipality.8 Similar projects are also being rolled out in other provinces and towns across the country.9

In March 2022, the minister of public works and infrastructure published the National Infrastructure Plan 2050, which lay out the government’s plans to provide 10 gigabytes (GB) of free mobile data every month to South African households by 2024 and 50 GB by 2026.10

The fiber-optic network in South Africa has grown at an exponential rate. Most suburban areas of the major urban centers are already covered with fiber-optic cables, and new “last mile” providers of fiber-optic cables have begun to wire homes by connecting to competitive internet backbones run by larger operators. At least 12 companies provide fiber-optic network infrastructure,11 with partially state-owned Telkom providing 157,400 kilometers (97,800 miles) of cables, the largest share as of 2018, connecting more than 2.5 million premises; other companies provide fiber-optic connections to a considerably smaller share of buildings.12

The majority of users (64.1 percent) access the internet through their mobile devices.13 According to DataReportal’s Digital 2022 report, the median mobile internet connection speed in South Africa was 30.54 megabits per second (Mbps), while the median speed for a fixed-line connection was 29.73 Mbps, a decline from the previous year.14 The United Kingdom–based telecommunications company Cable reported that the average download speed in South Africa was 19.94 Mbps as of September 2021.15

The availability of the internet has been significantly limited by power cuts introduced in 2019 by the national power company, Eskom, to stave off years of mismanagement.16 Since 2019, Eskom has conducted load-shedding on a regular basis due to reduced power-generating capacity that is caused by a lack of maintenance at power stations, as well as operational, structural, and financial problems.17 Mobile operators have struggled to ensure their cell phone towers remain online during power outages due to a wave of thefts of tower batteries organized by criminal syndicates.18

In January and February 2020, damage to the West African Cable System (WACS) and South Atlantic 3 (SAT-3) undersea cable caused a service disruption that lasted for weeks in South Africa and other southern and west African states.19 MTN and Vodacom users in South Africa reportedly experienced reduced connection speeds as a result of the cable damage.20 Some providers were rerouted to other cables, such as SEACOM and the Eastern African Submarine Cable System (EASSy), to accommodate the infrastructure problem.21 There were additional WACS and SAT-3 breaks at the end of March 2020, causing slow internet speeds.22 These additional breaks were repaired by April 2020, and affected only Telkom customers.23

Due to the COVID-19 pandemic and the national lockdown declared by the government, many businesses had to shift their operations online. In April 2020, the Independent Communications Authority of South Africa (ICASA)—the country’s communications and broadcasting regulator—announced a “temporary release of high demand spectrum” during the government-declared state of disaster to ease network congestion, maintain quality broadband services, and allow service providers to lower costs.24 The temporary allocation was later extended until November 2021.25

In September 2021, ICASA announced it would reconsider plans to permanently allocate the additional spectrum.26 The regulator had announced it would seek applications for the spectrum in April 2020 to increase the quality of broadband access and potentially lower prices. Service provider Telkom and television station eTV sued the government over the plan, arguing that further allocation would entrench the dominance of providers MTN and Vodafone (see A4).27 In February 2022, ICASA announced that Cell C, Liquid Telecoms, MTN, Rain Networks, Telkom, and Vodacom would take part in the first South African spectrum auction in March 2022.28 The auction was concluded towards the end of March and amassed more than 14.4 billion rands ($897,000).29

High costs remain a primary obstacle to access in South Africa, with digital inequality increasing as more South Africans connect to the internet.30

In 2021, the average cost of 1 GB of mobile data was 1.41 percent of the average monthly income in South Africa, according to the Alliance for Affordable Internet.31 In December 2021, the average cost of 1 GB of mobile data was $5.78, which places South Africa 10th out of 14 countries in which mobile service providers MTN and Vodacom operate.32 Though mobile service providers are gradually providing more low-cost data packages to lower-income customers,33 the vast majority of South Africans without internet access are those earning less than 7,200 rands ($450) per month (representing 42 percent of the population). Those without internet access have pinpointed the high costs as the main reason for their lack of connectivity.34

ICASA has taken steps to address the high cost of data in two ways. The introduction of the End-User and Subscriber Service Charter Regulation Amendment of 2018, which came into force in April 2019, requires service providers to give users the option to roll over their data bundles from month to month for a maximum period of three years; to transfer their data to another user within the same network; and to provide opt-in and opt-out choices for out-of-bundle data charges, which are considerably more expensive, upon exhaustion of their data.35 In December 2019, ICASA announced a regulatory impact assessment of the new regulations’ effects.36

South Africa’s data prices remain high compared to other African countries. In 2021, South Africa ranked 34 out of 47 on the Research ICT Africa Mobile Pricing index.37 An investigation launched in 2017 by the Competition Commission of South Africa found that the average price of data had not declined as significantly over time as the prices in other African countries.38 During the coverage period, ICASA reported that all leading mobile network operators lowered their prices for prepaid 1 GB bundles.39 During the previous coverage period, Vodacom and MTN, which together control 80 percent of the market, reached agreements with the Competition Commission that include several concessions aimed at making internet access more affordable. The concessions included reducing prices for data bundles, expanding the range of zero-rated websites (websites individuals can access at no cost), and providing a daily amount of free data.40

Currently, zero-rated offerings by mobile operators essentially offer free internet access to a few over-the-top (OTT) media services such as free basics on Facebook, Twitter, and educational services including D6 Communicator for schools and Vodacom e-school learning apps.41 A few other services are partially zero-rated in that users receive them as part of a paid package. However, zero-rated services are often used by South Africans who are already connected to reduce their costs of access, and not necessarily as their exclusive means of accessing the internet.42

Though the country has achieved nearly 100 percent third-generation (3G) network coverage, there are disparities in internet access between urban and rural dwellers, in part due to cost.43 According to the 2019 General Household Survey, only 1.2 percent of people in rural areas had access to the internet at home, compared to 7.2 percent of those in urban areas and 15.4 percent of those in major metropolitan areas. Similarly, a majority of urban dwellers (59.5 percent) and people in major metropolitan areas (67.8) had access to the internet on mobile devices, compared to a minority of rural dwellers (44 percent).44

The Alliance for Affordable Internet reported that as of February 2022, 16.4 percent of men and 12.1 percent of women had “meaningful internet connectivity,” which they define as fourth-generation (4G) network speeds, smartphone ownership, daily use, and unlimited access at a location relevant to them.45 There is also an urban-rural digital divide; 15.9 percent of users living in urban regions have meaningful connectivity comparted to only 5.7 of individuals in rural areas.46 Access to the internet among youth is relatively high, at 70 percent, compared to 53 percent of the general population.47

Importantly, SIM card registration requirements (see C4), which include proof of residence, present an obstacle to mobile phone usage for many South Africans who live in informal settlements.

Inequalities in internet access have been made starker by the reliance on connectivity during the COVID-19 pandemic. Many government-funded schools were unable to implement online classes though major mobile operators implemented various interventions, in part by accelerating the implementation of zero-rating educational websites.48

There is no evidence that the government exercises control over internet infrastructure to censor content or to restrict connectivity.

The government does not have direct control over the country’s internet backbone or its connection to the international internet, and there have been no intentional disruptions to connectivity. International internet connectivity is facilitated via five undersea cables—SAT-3, WACS, the South Africa Far East (SAFE) cable, EASSy, and SEACOM—all of which are owned and operated by a consortium of private companies.49 Google’s new undersea cable, Equiano, was installed after the coverage period in South Africa; Google selected partially state-owned Telkom as its landing partner.50 Several operators oversee South Africa’s national fiber-optic cable networks, including Telkom and the privately owned MTN, Vodacom, Cell-C, Neotel-Liquid, and Broadband Infraco. Internet traffic between different networks is exchanged at internet exchange points (IXPs) located in Johannesburg, Cape Town, and Durban, which are operated by South Africa’s nonprofit Internet Service Providers’ Association (ISPA) and NapAfrica.51 The three IXPs are hosted in vendor-neutral data centers owned by the South African firm Teraco.52

South Africa has a competitive internet service provider (ISP) market. The ISPA currently has 205 members in South Africa, which are mostly private enterprises.53 However, the fixed-line connectivity market is dominated by Telkom, of which the government has a 40 percent share; the government owns an additional 12 percent share of Telkom through the state-owned Public Investment Corporation.54 There are four major mobile carriers—Vodacom, MTN, Cell-C, and Telkom Mobile—the first three of which are privately owned. In addition to the major players, there is also a data-only mobile network operator, Rain, which is a relatively new entrant to the market.

In March 2021, ICASA released the findings of a 2018 inquiry on competition in the mobile broadband services market,55 which claimed that Vodacom and MTN dominate the field. Draft regulations proposed alongside the findings aim to regulate the two providers more stringently, with particular focus on exclusionary pricing schemes.56

The licensing processes for fixed and mobile phones, as well as internet services, are overseen by ICASA and are clear and easily accessible on ICASA’s website.57 The licensing fees imposed by ICASA are reasonable and do not impose an undue barrier to the diversity of service providers.

While no informal connections between licensees or prospective licensees and government officials is required for service providers, ICASA is seen by some as a “fractured and weak” institution, which affects its capacity to execute its mandate, which includes licensing.58

The autonomy of the regulator, ICASA, is protected by the constitution. A transparent and participatory appointment process involving parliamentary oversight is guaranteed by the law that established the body.59 There is, however, a perception that in practice, political interference is a problem in the agency, and that membership on the ICASA board is open only to supporters of the ruling party.60

ICASA’s independence has also been compromised by encroachments on its mandate by other government entities. In addition to ICASA, the .za Domain Name Authority (.ZADNA), the Universal Service and Access Agency of South Africa (USAASA), and the Department of Communications and Digital Technologies (DCDT)—formed in June 2019 as a result of the merger of the Department of Telecommunications and Postal Services and the Department of Communications61 —have regulatory power over information and communications technologies (ICTs). The proliferation of regulatory bodies has led to redundancy and poor coordination and contributes to the perception that the country lacks a comprehensive approach to ICT regulation.

In 2016, the cabinet approved the National Integrated ICT Policy White Paper,62 which outlines the overarching policy framework aimed at transforming South Africa into an inclusive and innovative digital and knowledge society.63 One of the bills proposed in the white paper is the ICT Sector Commission and Tribunal Bill. The bill would consolidate regulation of the ICT sector through the introduction of an ICT sector commission and tribunal.64 The legislation had not yet been passed by May 2022, but the DCDT has indicated that it still intends to proceed with the bill as part of its phased approach to implementing the National Integrated ICT Policy White Paper.65

Another key actor in the regulation of ICTs is the Film and Publication Board (FPB), which traditionally regulates the distribution of films, games, and other publications. The Films and Publications Act of 1996 was amended in 2019 and enacted in March 2022 to extend the authority of the FPB to regulate such content on the internet (see B3).66 67 In 2016, the FPB signed a memorandum of understanding with ICASA to address regulatory overlaps created by the proposed amendments, which will effectively create cojurisdiction over online content.68 These proposals further complicate the regulation of online content. However, it remains unclear how the two bodies will implement the agreement.

Access providers and other internet-related groups are active in lobbying for a better legislative and policy environment for the sector. In 2009, the ISPA was recognized as a self-regulatory body by the Department of Communications, and it exercises authority over its members through transparent processes (see B3).69

Neither the state nor other actors block or filter internet and other ICT content, and there is no evidence of blocking or content filtering on mobile phones.

State and nonstate actors do not frequently force publishers, content hosts, or digital platforms to delete legitimate content. Decisions on takedowns for online content are made not by the state but by the self-regulatory body, the ISPA.70

The Electronic Communications and Transaction Act (ECTA) requires ISPs to respond to takedown notices regarding illegal content such as child pornography, defamatory material, or copyright violations. Members of the ISPA—the industry’s representative body—are not held liable for third-party content that they do not create or select, though they can lose their protection from liability if they do not respond to takedown requests.71

Google reported that it received six requests for the removal of content from the South African government between July and December 2021, all relating to defamation. The company removed one piece of content pursuant to one defamation request; the other five requests did not result in removals.72

Restrictions on the internet are generally transparent and proportional, with a few exceptions. The ISPA takes a self-regulatory approach to restricting access to unlawful internet and digital content hosted by its members. This process is in accordance with the takedown procedures provided in the ECTA73 and is guided by the ISPA’s complaints procedures.74 ISPs often err on the side of caution by taking down content upon receipt of a notice to avoid litigation (see B2), and there is no incentive for providers to defend the rights of the original content creator if they believe the takedown notice was requested in bad faith.

The ISPA code of conduct requires members to respect freedoms of speech and expression as guaranteed by the constitution, and to act lawfully and cooperate with law enforcement agencies, though no specific reference is made to a proportionality test as a consideration in restricting access.75 There is an internal appeal process available to those who may be aggrieved by the ISPA’s actions, as well as an avenue for appeal in the courts.76

The ISPA reports annually on activities related to restrictions on content. The reports indicate that most takedown notifications result in content removal: In 2021, less than half of the more than 700 takedown notices lodged with the ISPA were accepted. The most common basis for content being removed is copyright and trademark infringement. Other reasons for removal include fraud, malware or phishing, defamation, hate speech, harassment, and invasion of privacy.77

The Films and Publications Amendment Act, which was implemented in March 2022,78 empowers the FPB to issue takedown orders for content adjudged to be prohibited (see A5). The amendment has been criticized by the ISPA for, among other things, exceeding the FPB’s mandate and opening online content to state censorship, given the quasi-government nature of the FPB and its limited capacity compared to the courts in adjudicating justifiable limitations to freedom of expression.79

Draft regulations to implement the Act published by the FPB in July 2020 appear to classify all website owners as “internet service providers,” vastly expanding the administrative costs of hosting a website, and require all online content providers to submit all online content to the FPB for oversight. The draft regulations have not been approved as of June 2022.

Although the government does not limit or manipulate online discussions, online self-censorship is a growing concern in South Africa. Particularly in the run-up to the 2019 national and provincial elections, the severity of online attacks against journalists increased sharply (see C7), leading to greater self-censorship online. In particular, the leader of the Economic Freedom Fighters (EFF) political party, Julius Malema, has on several occasions attacked and encouraged attacks against journalists online. Analysts contend that these attacks form part of a well-orchestrated cyberbullying strategy to deter other journalists and commentators from issuing reports or utterances critical of the EFF.80

Despite the perception that online self-censorship by journalists has increased, ordinary citizens and journalists, including those who have been subjected to online abuse, continue to report on politically sensitive issues.81

Manipulation of the online space by political actors—including through bogus social media profiles, targeted commenting on social media posts, and bots—is a growing problem in South Africa and was especially apparent during the 2019 elections. Election-related disinformation did not persist after the elections, though there was a spike of misinformation relating to COVID-19, prompting a strong government response.

The political disinformation that plagued the May 2019 elections declined in the aftermath of the vote. In the runup to the elections, the online space was weaponized not only by the EFF but also by other major political parties and their supporters to discredit critics and spread disinformation.82

The government and the ruling African National Congress (ANC) have not attempted to overtly influence the editorial lines of media outlets. However, in March 2019, the ANC’s head of elections, Fikile Mbalula, reportedly attempted to coerce the South African Broadcasting Corporation (SABC), the public broadcaster, to increase its coverage of the ANC’s election campaigns; Mbalula accused the SABC of a “clampdown” and “blackout” of the party’s campaign activities.83

The 2013 purchase of the Independent Group, a large media conglomerate, by ANC ally Iqbal Survé, and persistent interference with the SABC have taken a toll on fair and balanced media content in South Africa.84

The state capture inquiry that examined the influence of the Gupta family and other powerful interests on the government revealed in January 2019 that several journalists received monthly bribes from the contracting firm Bosasa (now known as African Global Operations) to inform the company of potential negative stories about it, as well as to write articles that presented it in a flattering light.85 In January 2020, disclosures revealed that security forces had paid 20 million rands ($1.2 million) to the African News Agency, a newswire company operated by the Independent Group, to carry positive stories about former president Jacob Zuma. The company has denied any wrongdoing.86

For the most part, there are no economic or regulatory constraints that significantly affect users’ ability to publish content online. The online environment in South Africa is net neutral, although net neutrality has not been expressly provided for in law or policy.87 The ISPA is at the forefront of promoting net neutrality and believes that it is essential for the transparent management of networks and the prevention of anticompetitive behavior.88 The government has indicated that it intends to include net neutrality in an expected amendment to the ECTA.89

The Film and Publications Amendment Act, which came into effect in March 2022, requires commercial distributors to classify all online content by submitting it to the FPB prior to its publication or by self-classifying it.90 Noncommercial distributors—those who publish content for personal use—are not required to classify their content. The Act penalizes failing to register with the FPB as a distributor with a fine of 150,000 rands ($9,300) and failing to classify content with a fine of 500,000 rands ($31,000).91

Politicized advertising may impact the economic viability of online outlets. In the past, the Gupta-owned progovernment ANN7 news channel and New Age newspaper, both of which ceased operations in 2018, routinely received a massive share of government advertising, extending up to hundreds of millions of rands.92

Some online platforms are required to pay licensing fees. In November 2020, the FPB finalized revisions to the tariff structure that would require online streaming services to pay a licensing fee per film and per series season that they offer, as opposed to the current structure, which involves payment of a flat fee.93 When originally proposed in 2017, the size of the fee was criticized by industry stakeholders as unjustifiable (in relation to the actual cost of classification) and prohibitive for smaller competitors providing content streaming services.94 The revised fees benefit content distributors with fewer titles, while those with more content pay significantly more than the previous license fee of 795,000 rands ($49,500).95 After some initial resistance, all major content distributors—including Google, Apple, Netflix, and the South African company MultiChoice—registered with the FPB and paid the flat license fees.96

Content published by journalists online is overseen by a self-regulatory body, the Press Ombudsman, which is an independent body set up by the media industry to adjudicate public complaints. Membership in the Press Ombudsman is voluntary.97

Online media in South Africa is vibrant, representing a wide range of international and national viewpoints and perspectives.

Web-only news platforms, such as the Daily Maverick and News24, have become particularly popular in recent years, with key news stories often broken online before in print or broadcast outlets. While content in both English and Afrikaans is well-represented online, the other 9 of South Africa’s 11 official languages are underrepresented on the internet, including on government websites. Additionally, the perspectives of women, rural dwellers, persons with disabilities, LGBT+ people, and ethnic and religious minorities are underrepresented and marginalized in the media, including online media.98

In February 2022, an expert panel appointed by the president revealed that false information that spread on social media contributed to the violence that occurred during the civil unrest in July 2021, which was largely fueled by economic inequality.99

False information about symptoms, prevention, and cures for COVID-19 spread online in South Africa, particularly over WhatsApp, early during the pandemic.100 Alongside emergency regulations that criminalized sharing COVID-19 misinformation (see C1)—leading to several arrests at the start of the pandemic (see C3)—the government partnered with technology companies and fact-checkers to mitigate the spread of such information.101 The strong response appears to have contributed to a reduction in the spread of rumors and hoaxes about COVID-19 online.

Neither the government nor nonstate actors restrict the use of digital tools for mobilization and campaigning. South Africa has a robust online community that addresses contemporary social, economic, and political issues. For instance, in 2018, successful social media campaigns addressed issues such as the blood donation drive by the South African National Blood Services (SANBS), the changing nature of traditional family structures, and gender stereotyping.102 In 2019, an online movement under the hashtag #ImStaying celebrated positive aspects of living in South Africa to act as a counter-narrative to negative messaging about the country, though the page has attracted criticism for racial insensitivity and elitism.103

Local sources report that pressure by online advocacy groups has had an impact on ICASA’s efforts to address affordability barriers to internet access (see A2).

Score Change: The score improved from 4 to 5 because the government lifted the COVID-19-related state of disaster, which had curtailed online expression, and the court affirmed protections for journalists’ access to information.

There are no specific legislative provisions to protect online modes of expression. However, the constitution provides for freedom of the press and freedom of expression, among other guarantees. It also includes constraints on “propaganda for war; incitement of imminent violence; or advocacy of hatred that is based on race, ethnicity, gender, or religion and that constitutes incitement to cause harm.”104 The right of access to information held by the state, and in limited circumstances by private bodies, is also guaranteed by the constitution.105 These rights apply to all members of the public and to journalists equally, whether they operate online or offline.

In March 2020, the government declared a three-month state of disaster under the Disaster Management Act of 2002 in response to the COVID-19 pandemic. The regulations issued under the state of disaster imposed a national lockdown, limiting freedom of expression, freedom of movement, and other rights that are derogable under the constitution.106 The state of disaster was terminated in April 2022 and regulations and directions made pursuant to it were repealed immediately.107

The judiciary is generally regarded as independent and in recent years has been seen as the branch of government that has been most dedicated to upholding the rule of law by constraining the executive and legislative branches from arbitrary actions.108 In May 2022, the Western Cape High Court ruled that journalists had the right to access information held by private bodies in order to report on matters of public interest, in its Tiso Blackstar Group & Other v Steinhoff Int. Holdings NV decision.109

Observers have expressed concern that, the Films and Publications Amendment Act, which was operationalized in March 2022, will make online content vulnerable to censorship (see B3).

Several laws are vulnerable to being misused to prosecute online journalists and activists. The offense of crimen injuria, or insulting the dignity of a person, has been invoked to prosecute online harassment.110

The state of disaster regulations passed in March 2020 criminalized any statement, including on social media, intended to spread COVID-19 disinformation; expose the COVID-19 infection status of any person without their consent; or spread misinformation about any government measure taken to address the pandemic. The penalty was a fine or imprisonment of up to six months, or both.111 The state of disaster was repealed in April 2022 (see C1).

Defamation is a criminal offense, though prosecutions are rare and, until recently, defamation charges were not brought against people for online activity. The African National Congress (ANC) committed to scrapping criminal defamation in September 2015, but there have been no moves to introduce legislation to fulfill this promise.112

In May 2021, the government passed the Cybercrimes Act, 2020, which contains some provisions regulating online speech. For instance, the law bars electronic content that incites or threatens violence to people or damage to property, and criminalizes the nonconsensual sharing of intimate images. In December 2021, following a presidential proclamation, certain sections of the law relating to intercepting data and unlawfully accessing computer systems were enacted (see C8).113 Violators of those provisions face a penalty of up to three years’ imprisonment, a fine, or both. These prohibitions do not directly criminalize online activities protected under international human rights standards; however, some commentators suggested the provision barring incitement to violence might be used to prosecute people for social media posts supporting the July 2021 unrest (see C3).114

Score Change: The score declined from 6 to 5 because authorities arrested an internet user and charged them for inciting violence during the July 2021 riots for their Twitter posts defending former president Zuma and criticizing the government.

When former president Zuma was sentenced to 15 months’ imprisonment for contempt of court in relation to an ongoing corruption investigation in early July 2021, fatally violent riots broke out in KwaZulu-Natal and Gauteng provinces in support of Zuma. South African authorities committed to prosecuting people who supported the unrest on social media.115 In August 2021, Zamaswazi Majozi and Duduzile Zuma-Sambudla were arrested for social media posts they made during the riots: Majozi posted with the Twitter account @__AfricanSoil, which was a leading voice in the Radical Economic Transformation political faction;116 Zuma-Sambudla is Zuma’s daughter and made posts supporting him. Both were charged under the 1956 Riotous Assemblies Act, and one was released on bail in late August; neither were charged for any specific posts on social media.117 According to research from the DFRLab, Zuma-Sambudla had engaged in celebratory posts during the violence and posted pictures of participants along with the caption “Amandla [Power];” DFRLab did not find evidence that any of her posts directly incited violence.118 Majozi also used Twitter to defend former president Zuma and attack his critics. In March 2022, Majozi’s case was struck from the court roll following numerous requests from the state prosecuting authority to postpone the hearing.119

Also in August 2021, South African police released a statement that authorities had identified people spreading “inflammatory messages on various social media platforms advocating for violence” and “warned” them that doing so is a criminal offense.120 A February 2022 report on the riots revealed that the minister of police had identified 12 individuals who made incendiary social media posts, but only charged a few for incitement to violence.121

At least eight individuals were arrested in early 2020 for spreading false information related to COVID-19; none appear to have been sentenced. The arrests were made pursuant to the state-of-disaster regulations, which prohibited the intentional dissemination of false information relating to the virus.122 One of those detained, Stephen Birch, was arrested and charged for circulating misleading information about test kits online.123 Celebrity Somizi Mhlongo was charged with violating the regulations for suggesting during a livestream on Instagram that Transport Minister Fikile Mbalula told him that the lockdown would be extended; Mhlongo turned himself into the police and was released on bail.124

South Africa has few restrictions on anonymous communication or encryption. There are no laws requiring internet users, website owners, or bloggers to register with the government or any of its agencies. Users are also not required to use their real names when posting comments on the internet, including on social media platforms.

The Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA) of 2002, however, compromises users’ rights to anonymous communication by requiring mobile subscribers to provide national identification numbers, copies of national identification documents, and proof of physical address to service providers.125 An identification number is legally required for any SIM card purchase, and registration requires proof of residence and an identity document.126 In March 2022, ICASA published the Draft Numbering Plan Regulations, which, if passed, will require users to provide biometric data when purchasing or registering a SIM card.127

Users are not explicitly prohibited from using encryption to safeguard their communications. However, RICA empowers a judge to force the disclosure of decryption keys or to require assistance in decryption in specified circumstances, upon approval of a request made by the police, military, intelligence, or other law enforcement agencies.128 Similarly, the Cybercrimes Act, which was passed in May 2021, includes provisions obligating companies to decrypt data to facilitate the search and seizure of stored data under the provisions of that law (see C6).129

Strong concerns about potentially unchecked government surveillance powers over online activity remain, but some legal safeguards related to surveillance do exist. RICA does not permit the blanket collection of telecommunications metadata but provides for a stringent process for the targeted collection of metadata, the interception of communications, and the decryption of private communications, all of which require a court order.130

In September 2019, a High Court ruled that numerous provisions of RICA were unconstitutional;131 the amaBhungane Centre for Investigative Journalism had filed a case in 2017 challenging its constitutionality on several fronts. The presiding judges found that bulk surveillance conducted by the National Communication Centre (NCC) was unlawful because there is no legislation that authorizes the state to conduct such interception of private communications. The ruling postponed the resulting invalidation of RICA for two years to permit Parliament to pass legislation amending the unconstitutional provisions while imposing interim changes to the law. The interim changes included requiring the NCC to notify individuals who have their communications intercepted within 90 days after the surveillance is terminated and to disclose in its application when the target of surveillance is a journalist or lawyer. The High Court ruling was confirmed by the Constitutional Court in February 2021 and extended the period before RICA’s invalidation to three years.132 In September 2021, the designated RICA judge, Justice Bess Nkabinde, expressed concerns that unlawful interception of communication of private and public officials continued despite the law being declared unconstitutional.133

Under RICA, the threshold for granting a court order is low, oversight is insufficient, and in the past users did not have to be informed that their communications had been intercepted.134 A loophole allows communications to be intercepted under the Criminal Procedure Act, which lacks certain safeguards and has been abused by law enforcement agencies.135 Up to 95 percent of court orders involving the interception of communications are not approved by a RICA judge; most of the court orders outside of RICA are for metadata; metadata of between 70,000 and 195,000 mobile users is collected every year.136 Telecommunications service providers are also required to store the metadata of all customers for three to five years, a provision that concerns privacy advocates.137

The South African government has the technical capacity to undertake bulk and targeted surveillance, and it has been acknowledged that bulk surveillance is undertaken by various government agencies.138 The NCC is responsible for intercepting foreign signals and does so without oversight; the agency has disclosed that the content it intercepts includes local signals as well.139

The South African police possess international mobile subscriber identity (IMSI) catcher technology, also known as “stingrays,” which permit the bulk interception of mobile phone traffic, although the extent of its use is uncertain.140 The Ministry of State Security does not believe that IMSI catchers are governed by RICA, and their use is therefore unregulated.141 The government has claimed that the technology is used only for national security matters.142 Nonetheless, consistent weaknesses in oversight mechanisms within the state security departments leave surveillance open to abuse; in addition, the interception of communications that originate outside South Africa are essentially unregulated.143 The court rulings on RICA rendered the state’s use of IMSI catchers illegal unless new legislation is passed to regulate such use for bulk surveillance.

South Africa's intelligence services are also reported to be using a social media analytics and monitoring tool called Media Sonar, which allows for the searching and analyzing of social media content of users within a defined geolocation and using keyword searches.144

Journalists have been frequently targeted for surveillance by the state, usually as a means of identifying confidential sources.145 For example, in March 2021, the online outlet News24 disclosed that officers with the police intelligence division had targeted its journalists with location tracking and communications interception tools, apparently in response to the outlet’s investigation into unrest within the division.146

In a 2018 report by Citizen Lab, a Canadian internet watchdog, South Africa was listed as one of 45 countries worldwide using Pegasus, a targeted spyware software developed by the Israeli technology firm NSO. Pegasus is known to be used by governments to spy on journalists, human rights defenders, and the opposition.147

Beyond RICA, the Protection of Personal Information (POPI) Act serves as South Africa’s legal framework protecting the constitutional right to privacy. It includes provisions to protect users’ online security, privacy, and data, and allows an individual to bring civil claims against those who contravene the law (see C6).148

RICA provides for a legal process for the interception of communications, and service providers are, under certain circumstances, required to aid the government in surveillance (see C5).

The POPI Act of 2013, South Africa’s data protection framework that entered fully into force on July 1, 2020, had been partially implemented by presidential proclamation in 2014, including the establishment of the South African Information Regulator, which was not able to act in the six-year interim.149 The law establishes safeguards for the processing of personal data, including requirements for consent, retention limitations, and notice and limitations on automated processing and cross-border data transfers. POPI defines personal data broadly, covering information about individuals, their beliefs, and their legal identity, and it establishes more extensive safeguards for particularly sensitive personal data. It includes a standard set of exceptions, including national security and criminal matters. Penalties for contravening the law are stiff, including prison terms and fines of up to 10 million rands ($620,000).150

In May 2021, the government passed the Cybercrimes Act, 2020, which establishes broad authority for officials to access data stored by service providers and other companies when those data relate to cybercrimes that the law defines. Along with several provisions that relate to online activities (see C2), the act establishes a broad range of violations relating to computer use. Seizure of data generally requires a warrant, though the law establishes a broad range of exceptions.

Amendments to the state of disaster regulations (see C1) published in April 2020 required telecommunications providers and ISPs to share the geolocation data of people known to have or suspected of having contracted COVID-19 as a part of the national contact tracing effort. The state of disaster was lifted in April 2022 and regulations and directions made pursuant to it were immediately repealed.151 The Information Regulator, a government agency, subsequently called on the National Department of Health and the National Institute for Communicable Diseases to develop a plan to lawfully process personal information that was collected during the pandemic.152

According to RICA, service providers, including ISPs, are required to use systems with the technical capacity for communications to be intercepted; they are also required to retain customer metadata for three to five years.153 RICA specifically requires service providers to intercept and provide the communications of their customers upon a judge’s directive.154 The Cybercrimes Act also expands the scope of real-time communications interception under RICA.155 In practice, however, the bulk of requests for information are not made through RICA and are thus not transparent or subject to appeal (see C5).

Neither RICA nor POPI impose data localization requirements. However, in April 2021, the DCDT published the Draft National Policy on Data and Cloud for comment.156 If the draft policy is passed, data generated in South Africa would become property of the government regardless of where the company is located. The government would be the trustee for all “government data”—an ambiguous term that authorities have failed to clarify—generated within the borders of South Africa.

While the ECTA does not require ISPs to actively monitor content or to seek information on unlawful activity, the minister of communications may, under certain circumstances, require ISPs to provide information on the illegal activities of their users or information that facilitates the identification of users.157

Under the Film and Publications Amendment Act, enacted in March 2022, internet access providers who have knowledge that their services are being used to host or distribute child pornography, war propaganda, or content that incites violence and hatred of an identifiable group, are required to report to the police details on the person maintaining, hosting, distributing, or in any way contributing to the circulation of this content.158

Cases of extralegal intimidation or violence reported against bloggers, journalists, and online users in South Africa declined sharply after the May 2019 elections. Women and LGBT+ people routinely experience online harassment.

In March 2020, Azarrah Karim, a journalist for the online newspaper News24, was shot at by police officers while covering police dispersing crowds with rubber bullets in Johannesburg during the first day of the COVID-19 lockdown; she had identified herself to the officers as a member of the press.159 Karim was later mocked by officers when she filed a statement at the local police station.160

Members of the EFF, including leader Julius Malema, have attacked and encouraged attacks against journalists online on several occasions. In March 2019, for example, veteran journalist Karima Brown mistakenly posted a message directed to her staff on a WhatsApp group that included EFF members. In response, Malema posted a screenshot of the message that contained Brown’s mobile number on Twitter. Brown then received a barrage of abusive and threatening messages from EFF supporters.161 Several other journalists, including Adriaan Basson of News24162 and Pauli van Wyk of the Daily Maverick, have also faced online attacks by Malema and supporters of the EFF.

In November 2021, during local elections, Fikile Mbalula, the minister of transport and the head of elections for the ANC, blamed SABC’s coverage of the local elections for ANC’s poor performance and accused SABC’s chief editor of bias. The South African National Editors Forum (SANEF) called on Mbalula to immediately cease making such statements, as similar behavior has in other instances encouraged cyberbullying by ANC party members and supporters on social media.163

Online harassment based on gender and sexuality is rampant in South Africa, and racist language is common. In June 2022, after the coverage period, the South Africa Human Rights Commission (SAHRC) denounced Afrikaans musician, Steve Hofmeyer, for social media posts he made that the SAHRC claim were intentionally discriminatory toward LGBT+ people.164 Almost 25 percent of the 536 South African women surveyed in August 2020 by the technology consulting firm Pollicy reported experiencing online gender-based violence.165 In a 2018 report by Gender Links, 30 percent of women journalists surveyed reported experiencing some form of online violence.166 A survey of LGBT+ youth released in April 2020 found that 82 percent reported experiencing harassment online because of their identity.167 A report from PeaceTech Lab and Media Monitoring Africa found a sharp increase in racist and racially discriminatory language online during the May 2019 elections.168

Score Change: The score declined from 3 to 2 because South Africa experienced a significant number of cyberattacks, including attacks on government agencies and state-owned companies which disrupted their ability to operate normally.

Independent news outlets and opposition voices have not been subject to technical attacks in several years. However, South Africa is vulnerable to cybersecurity threats on many fronts.

Since mid-2021, South Africa has suffered a significant number of cyberattacks, especially those targeting critical infrastructure. According to the Interpol African Cyberthreat Assessment Report released in October 2021, South Africa has the highest number of targeted ransomware and business email compromise attacks.169

In July 2021, Transnet, a state-owned company that is the custodian of South Africa ports, railways, and pipelines, suffered a major ransomware attack that forced the company to rely on manual operations.170 Hackers gained access to personal data, financial reports, and other documents.171

In September 2021, the Department of Justice and Constitutional Development (DOJ) experienced a ransomware attack, during which at least 1,200 files containing personal information were leaked.172 The attack and its disruption of the department’s computer systems significantly delayed child maintenance payments to beneficiaries.173

In December 2021, following a presidential proclamation, Chapter 2 of the Cybercrimes Act became operational,174 criminalizing the unlawful interference with computer systems, and the illegal access, interception, and possession of data, including passwords. This provision replaced parts of the ECTA that protected against cyberattacks by criminalizing access, interception, or interference of an individual’s data without permission; unlawful production, sale, procurement, design, distribution, or possession of a device used to overcome security measures or the protection of data; the use of such a device to unlawfully overcome security measures for the protection of data; and interference with an information system that protects data.175