Score change: The score declined from 4 to 3 after two malfunctions in undersea cables caused weeks of reduced speeds for South African internet users in early 2020, while electric infrastructural issues continued to interrupt access.

Internet penetration has expanded rapidly in South Africa. According to the latest data from the International Telecommunication Union (ITU), the internet penetration rate reached 56 percent in 2017. DataReportal’s “Digital 2020” report cites a figure of 62 percent internet penetration in 2019.1 According to the 2018 General Household Survey conducted by Statistics South Africa, the national statistics agency, nearly 65 percent of South African households have at least one member who can access the internet at home, work, or school, or in internet cafés,2 an increase from 53 percent in 2015.3 The majority of internet users (60 percent) access the internet through their mobile devices.4

The government has prioritized access to free public Wi-Fi with the adoption of its broadband policy, the SA Connect program, in 2013.5 SA Connect aims to provide universal affordable, high-quality, high-speed broadband access to all South Africans. Phase 1 of the project involves rolling out broadband to schools, clinics, police stations, and other government facilities, particularly in underserved communities. However, a 98.7 percent cut in the budget of the Department of Telecommunications and Postal Services greatly limited the efficiency of the program in the 2018–19 financial year.6 Mobile operators are obligated to contribute to SA Connect implementation as part of their license conditions. According to the May 2018 SA Connect progress report, mobile operators had connected 4,366 schools out of the 5,250 that were targeted for connectivity in a five-year period.7

Several other initiatives have enjoyed modest success in rolling out public Wi-Fi in metropolitan areas, including Cape Town, Durban, Johannesburg, Tshwane,8 and the Ekurhuleni municipality.9 Similar projects are also being rolled out in other provinces and towns across the country.10

The fiber market in South Africa has grown at an exponential rate. Most suburban areas of the major urban centers (including Pretoria, Cape Town, Johannesburg, Durban, and Port Elizabeth) are already covered with fiber-optic cables, and new “last mile” providers of fiber have begun to wire homes by connecting to competitive internet backbones run by larger operators. At least 12 companies provide fiber network infrastructure,11 with partially state-owned Telkom providing 157,400 kilometers (97,800 miles) of fiber, the largest share as of 2018, which connects more than 2.5 million premises; other companies provide a considerably smaller share of fiber.12

According to the “Digital 2020” report, the average mobile internet connection speed in South Africa is 31.4 Mbps, while the average speed for a fixed-line connection is 26.9 Mbps.13 This represents a significant improvement in connection speeds in comparison to the same period in 2018. South Africa has an average download speed of 8.4 Mbps, which is 75th out of 200 countries assessed by Cable, a UK-based telecommunications company.14

The availability of the internet has been significantly limited by power cuts introduced in 2019 by the national power company, Eskom, to stave off years of mismanagement.15 Since 2019, Eskom has been conducting load-shedding on a regular basis due to reduced power-generating capacity resulting from technical faults caused by lack of maintenance at power stations, as well as operational, structural, and financial problems.16 The situation is expected to continue for the immediate future.17 Mobile operators have been experiencing challenges in ensuring that their cell phone towers remain online during power outages resulting from a wave of thefts organized by criminal syndicates that steal the batteries from the towers.18

In January and February 2020, damage to the West African Cable System (WACS) and South Atlantic 3 (SAT-3) undersea cable caused a service disruption that lasted for weeks in South Africa and other southern and west African states.19 MTN and Vodacom users in South Africa reportedly experienced reduced connection speeds as a result of the cable damage.20 Some providers were rerouted to other cables, such as SEACOM and EASSy, to accommodate the infrastructure problem.21 There were additional WACS and SAT-3 breaks at the end of March 2020, causing slow internet speeds.22 These additional breaks were repaired by April 3, 2020, and affected only Telkom customers.23

Due to the COVID-19 pandemic and the national lockdown declared by the government, many businesses had to shift their operations online. In April 2020, the Independent Communications Authority of South Africa (ICASA) announced a “temporary release of high demand spectrum” during the national state of disaster to ease network congestion, maintain quality broadband services, and allow service providers to lower costs.24 At the end of the coverage period, ICASA was engaged in a process of seeking applications for the permanent allocation of additional spectrum, which is expected to increase the quality of broadband access and potentially lead to a decrease in pricing.25

High costs remain a primary obstacle to access. Recent market trends show that users are spending a greater proportion of income, at the individual and household level, on data, and less on voice or SMS services.26

Prepaid mobile data remains unaffordable for most South Africans.27 As of June 2019, the average cost of 1GB of mobile data was 2.17 percent of the average monthly income in South Africa.28 The high cost contributes to the relatively low rates of internet use.29 In the first quarter of 2020, the average cost of 1GB of mobile data was $6.51, which places South Africa 33rd out of 46 African countries for which there are figures available on the affordability of mobile data.30 Though mobile operators are gradually providing more low-cost data packages to lower-income customers,31 the vast majority of South Africans without internet access are those earning less than 7,200 South African rands ($500) per month (representing 42 percent of the population). Those without internet access have pinpointed the high costs as the main reason for their lack of connectivity.32

ICASA has taken steps to address the high cost of data in two ways. The introduction of the End-User and Subscriber Service Charter Regulation Amendment of 2018, which came into force in April 2019, requires service providers to give users the option to roll over their data bundles from month to month for a maximum period of three years; to transfer their data to another user within the same network; and to provide opt-in and opt-out choices for out-of-bundle data charges, which are considerably more expensive, upon exhaustion of their data.33 In December 2019, ICASA announced a regulatory impact assessment of the new regulations’ effects.34

In November 2018, ICASA also commenced a market inquiry into mobile broadband services, as part of an initiative to reduce the cost of communication by promoting competition in the ICT (information and communication technologies) sector through possible regulation of the mobile broadband market.35 In November 2019, ICASA published a discussion document as part of the inquiry in which it identified various aspects of the mobile broadband market that are insufficiently competitive (see A4).36 The inquiry was initially expected to be completed by early 2020 but as of the end of the coverage period the completion date was unclear.37

In December 2019, the final report of the Competition Commission of South Africa was released. The Commission had launched its inquiry into the data service market in August 2017, to attempt to establish the reasons for the high cost of data and make recommendations to reduce the cost. The report indicated that the average price of data is higher in South Africa than in other African countries and has not declined as significantly over time as the prices in these other countries.38 The Commission also raised concerns about the fact that smaller prepaid data bundles were found to be more expensive than larger postpaid data bundles, which has a negative effect on poorer consumers who tend to make use of smaller prepaid data bundles. The Commission made a number of recommendations aimed at reducing the cost of data. Among the key recommendations were requiring Vodacom and MTN to reduce tariffs substantially; directing mobile operators to offer all prepaid subscribers a limited amount of free daily data; and establishing an industry-wide approach to zero-rating educational content, with special consideration for content in African languages.

Vodacom and MTN, which together control 80 percent of the market, subsequently reached agreements with the Commission that include several concessions aimed at making internet access more affordable.

• Vodacom agreed to reduce prices across all categories of data bundles by over 30 percent beginning April 1, 2020.
• Vodacom expanded the range of zero-rated websites on its network to include the websites of all public universities, colleges and schools and seven job search portals, as well as Wikipedia and Facebook Flex.
• MTN agreed to reduce the price of all 30-day pre-paid data bundles beginning May 1, 2020, with the price of 1GB reduced by more than 30 percent.
• MTN provided each of its customers with 20MB of daily free data and expanded its list of zero-rated websites to include 500 websites focusing on healthcare, job searches, and public benefit organisations.39

Currently, zero-rated offerings by mobile operators essentially offer free internet access to a few OTT services such as free basics on Facebook, Twitter, and educational services including D6 Communicator for schools and Vodacom e-school learning apps.40 The range of zero-rated websites provided by Vodacom and MTN has been expanded following the agreements they reached with the Competition Commission in April and May 2020.41 A few other services are partially zero-rated in that users receive them as part of a paid package. However, zero-rated services are often used by South Africans who are already connected to reduce their costs of access, and not necessarily as their exclusive means of accessing the internet.42

Though the country has achieved nearly 100 percent 3G network coverage, there are disparities in internet access between urban and rural dwellers.43 Internet penetration is significantly higher in urban areas. According to data published by Research ICT Africa in July 2018, a majority of urban dwellers (61 percent) have access to the internet, compared with a minority of rural dwellers (40 percent).44 In terms of the gender gap, Research ICT Africa reported that 12 percent more men have access to the internet than women.45 Access to the internet among youths is relatively high, at 70 percent, compared with 53 percent of the general population.46 The higher rate of youth connectivity is no doubt influenced by the high level of access to smartphones by young people; 71 percent of youths have smartphones, compared with 55 percent of the general population.

Importantly, SIM card registration requirements (see C4), which include proof of residence, present an obstacle to mobile phone usage for many South Africans who live in informal settlements.

Inequalities in internet access have been made starker by the reliance on connectivity during the COVID-19 pandemic. The impact of this inequality has been particularly impactful in the field of education. All schools across South Africa were closed on March 18, 2020, as part of the government’s measures to curb the spread of the virus; they remained closed at the end of the reporting period. Though many schools shifted to e-learning, students who do not have access to affordable internet and electronic devices have largely been left behind. In order to host online classes, teachers also require access to affordable high-speed internet at home, which some do not have. Many government-funded schools have been unable to implement online classes at all due to these challenges. The major mobile operators have implemented various interventions, in part by accelerating the implementation of zero-rating educational websites.47

There is no evidence that the government exercises control over internet infrastructure for censorship or to restrict connectivity.

The government does not have direct control over the country’s internet backbone or its connection to the international internet, and there have been no intentional disruptions to connectivity. International internet connectivity is facilitated via five undersea cables—SAT-3, SAFE, WACS, EASSy, and SEACOM—all of which are owned and operated by a consortium of private companies.48 Several operators oversee South Africa’s national fiber networks, including partly state-owned Telkom and privately owned MTN, Vodacom, Cell-C, Neotel-Liquid, and Broadband Infraco. Internet traffic between different networks is exchanged at internet exchange points (IXPs) located in Johannesburg, Cape Town, and Durban, which are operated by South Africa’s nonprofit Internet Service Providers’ Association (ISPA) and NapAfrica.49 The three IXPs are hosted in vendor-neutral data centers owned by the South African firm Teraco.50

South Africa has a competitive ISP market. The ISPA currently has 193 members in South Africa, which are mostly private enterprises.51 However, the fixed-line connectivity market is dominated by Telkom, of which the government has a 40 percent share; the government owns an additional 12 percent share of Telkom through the state-owned Public Investment Corporation.52 Telkom effectively possesses a monopoly of the fixed-line connectivity market, despite the introduction of a second national operator, Neotel, in 2006. There are four major mobile carriers—Vodacom, MTN, Cell-C, and Telkom Mobile—the first three of which are privately owned. In addition to the major players, there is also a data-only mobile network operator, Rain, which is a relatively new entrant to the market.

ICASA’s discussion document on market competitiveness, published in November 2019, notes that the MTN and Vodacom market share dominance in certain locations poses a barrier to entry for other would-be competitors.53

The licensing processes for fixed and mobile phones, as well as internet services, are overseen by ICASA and are clear and easily accessible on ICASA’s website.54 The licensing fees imposed by ICASA are reasonable and do not impose an undue barrier to the diversity of service providers.

While no informal connections between licensees or prospective licensees and government officials is required for service providers, ICASA is seen by some as a “fractured and weak” institution, which affects its capacity to execute its mandate, including licensing.55

The autonomy of the regulatory body, ICASA, is protected by the constitution. A transparent and participatory appointment process involving parliamentary oversight is guaranteed by the law that established ICASA.56 There is, however, a perception that in practice, political interference is a problem in the agency and that membership on the ICASA board is open only to supporters of the ruling party.57

ICASA’s independence has also been compromised by encroachments on its mandate by a number of government entities. In addition to ICASA, the .za Domain Name Authority (.ZADNA), the Universal Service and Access Agency of South Africa (USAASA), and the Department of Communications and Digital Technologies (DCDT)—formed in June 2019 as a result of the merger of the Department of Telecommunications and Postal Services and the Department of Communications58—have regulatory power over ICTs. The proliferation of regulatory bodies has led to redundancy and poor coordination and contributes to the perception that the country lacks a comprehensive approach to the regulation of ICTs.

In 2016, the cabinet approved the National Integrated ICT Policy White Paper,59 which outlines the overarching policy framework aimed at transforming South Africa into an inclusive and innovative digital and knowledge society.60 One of the bills proposed in the white paper is the ICT Sector Commission and Tribunal Bill. The bill would consolidate regulation of the ICT sector through the introduction of an ICT sector commission and tribunal.61 The legislation had not yet been passed by the end of the coverage period, but the DCDT has indicated that it still intends to proceed with the bill as part of its phased approach to implementing the National Integrated ICT Policy White Paper.62 Another key bill emanating from the white paper that would have significantly impacted supply-side aspects of the ICT sector is the ECA Bill, which was published in 2017 for public comment. The bill was withdrawn by the minister of telecommunications and postal services in February 2019, citing the need for “further consultations.”63 The bill had been widely criticized for granting extensive powers to the DCDT by giving it a greater role in oversight of the sector, raising concerns that this would erode the independence of ICASA.64 The ECA Bill was also intended to facilitate the implementation of a wholesale open access network (WOAN) as a model for spectrum allocation.65 This aspect of the legislation also drew further criticism for undermining the role of ICASA in the allocation and management of spectrum.66

Another key actor in the regulation of ICTs is the Film and Publication Board (FPB), which traditionally regulates the distribution of films, games, and other publications. The Films and Publications Act of 1996 was amended in 2019 to extend the authority of the FPB to regulate such content on the internet (see B3).67 The Act was signed into law by the president in October 2019, but the commencement date had not yet been announced by the end of the reporting period.68 In 2016, the FPB signed a memorandum of understanding with ICASA to address regulatory overlaps created by the proposed amendments, which will effectively create cojurisdiction over online content.69 These proposals further complicate the regulation of online content. However, it remains unclear how the two bodies will implement the agreement.

Access providers and other internet-related groups are active in lobbying for a better legislative and policy environment for the sector. In 2009, the ISPA was recognized as a self-regulatory body by the Department of Communications, and it exercises authority over its members through transparent processes (see B3).70

Neither the state nor other actors block or filter internet and other ICT content, and there is no evidence of blocking or content filtering on mobile phones.

In December 2019, the South African Law Reform Commission published a discussion paper on sexual offenses in which it proposed that new legislation be adopted to require ISPs to automatically block all adult content.71 Users would then have the option of having the content unblocked upon verification of their age. The purpose of the proposal is to protect children from being exposed to adult content, but the ISPA has argued that the measure amounts to an undue limitation on freedom of expression since pornography is not illegal in South Africa.72 It remains to be seen whether the government will prepare draft legislation in line with the recommendation.

State and nonstate actors do not frequently force publishers, content hosts, or digital platforms to delete legitimate content. Decisions on takedowns for online content are made not by the state but by the self-regulatory body, the ISPA.73 In 2017, a controversial case of content removal made headlines when the news website Black Opinion was taken down by its web host after the ISPA received a complaint that the site was inciting racial hatred.74 Linked to a land-rights lobbying group called Black First Land First, the news site had published articles criticizing “white monopoly capital.”75 The website was restored two weeks after it was taken down.76

The Electronic Communications and Transaction Act (ECTA) requires ISPs to respond to takedown notices regarding illegal content such as child pornography, defamatory material, or copyright violations. Members of the ISPA—the industry’s representative body—are not held liable for third-party content that they do not create or select, though they can lose their protection from liability if they do not respond to takedown requests.77

Google reported that it received a single request from the South African government, backed by a court order, for the removal of content on Google+ between January and June 2018. Google agreed to remove the content, which was reportedly related to online harassment.78

Restrictions on the internet are generally transparent and proportional, with a few exceptions. The ISPA takes a self-regulatory approach to restricting access to unlawful internet and digital content hosted by its members. This process is in accordance with the takedown procedures provided in the ECTA79 and is guided by the ISPA’s complaints procedures.80 ISPs often err on the side of caution by taking down content upon receipt of a notice to avoid litigation (see B2), and there is no incentive for providers to defend the rights of the original content creator if they believe the takedown notice was requested in bad faith.

Though no specific reference is made to a proportionality test as a consideration in restricting access, the ISPA code of conduct requires members to respect freedoms of speech and expression as guaranteed by the constitution, and to act lawfully and cooperate with law enforcement agencies.81 There is an internal appeals process available to those who may be aggrieved by the ISPA’s actions, as well as an avenue for appeal in the courts.82

The ISPA reports annually on activities related to restrictions on content. The reports indicate that the majority of takedown notifications result in content removal: In 2019, approximately half of the more than 550 takedown notices lodged with the ISPA were accepted. The most common basis for content being removed is copyright and trademark infringement. Other reasons for removal include fraud, malware or phishing, defamation, hate speech, harassment, and invasion of privacy.83

Once it enters into force, the Films and Publications Amendment Act will empower the FPB to issue takedown orders for content adjudged to be prohibited. The amendment has been criticized by the ISPA for, among other things, exceeding the mandate of the FPB and opening online content to state censorship given the quasi-government nature of the FPB and its limited capacity compared to the courts in adjudicating justifiable limitations to freedom of expression.84 The Act was signed into law by the president in October 2019, but it had not implemented by the end of the coverage period.85 Draft regulations to implement the Act published by the FPB in July 2020, after the coverage period, appear to classify all website owners as “internet service providers,” vastly expanding the administrative costs of hosting a website, and require all online content providers to submit all online content to the FPB for oversight. The Act had not come into effect as of the publication of the draft regulations, potentially rendering the regulations unconstitutional.86

Although the government does not limit or manipulate online discussions, online self-censorship is a growing concern in South Africa. Particularly in the run-up to the 2019 national and provincial elections, the severity of online attacks against journalists increased sharply (see C7), leading to greater self-censorship online. In particular, the leader of the Economic Freedom Fighters (EFF) political party, Julius Malema, has on several occasions attacked and encouraged attacks against journalists online. Analysts contend that these attacks form part of a well-orchestrated cyberbullying strategy to deter other journalists and commentators from issuing reports or utterances critical of the EFF.87

Despite the perception that online self-censorship by journalists has increased, ordinary citizens and journalists, including those who have been subjected to online abuse, continue to report on politically sensitive issues.88

Score change: The score improved from 2 to 3 as political information manipulation declined in the wake of the 2019 elections and the government responded strongly to misinformation about the COVID-19 pandemic.

Manipulation of the online space by political actors—including through bogus social media profiles, targeted commenting on social media posts, and bots—is a growing problem in South Africa, especially during the 2019 elections. Election-related disinformation did not persist after the elections, though there was a spike of misinformation relating to COVID-19, prompting a strong government response.

False information about symptoms, prevention, and cures for COVID-19 spread online in South Africa, particularly over WhatsApp, early in the pandemic.89 Alongside emergency regulations that criminalized sharing COVID-19 misinformation (see C1), which led to several arrests early in the pandemic (see C3), the government partnered with technology companies and fact-checkers to mitigate the spread of such information.90 The strong response appears to have contributed to a reduction in the spread of rumors and hoaxes about COVID-19 online.

The political disinformation that plagued the May 2019 elections declined in the aftermath of the vote. In the run-up to the elections, the online space was weaponized not only by the EFF but also by other major political parties and their supporters to discredit critics and spread disinformation.91 A study conducted on political disinformation on Twitter in South Africa between 2014 and 2018 revealed that main political and interest groups, including ANC- and EFF-related accounts, were most active in manipulating the platform, likely using bots and trolls.92

News reports in 2017 revealed the execution of a coordinated online campaign by supporters of the powerful Gupta family to influence and confuse public opinion through the proliferation of disinformation. Hundreds of automated bots on Twitter harassed journalists who reported critically about the Gupta family and their ties to former president Jacob Zuma.93 The campaign, which produced 220,000 tweets and hundreds of Facebook posts, also targeted political figures including then-finance minister Pravin Gordhan and then-deputy president Cyril Ramaphosa, with the purpose of discrediting them.94

The government and the ruling ANC has not attempted to overtly influence the editorial lines of media outlets. However, in March 2019, the ANC’s head of elections, Fikile Mbalula, reportedly attempted to coerce the South African Broadcasting Corporation (SABC), the public broadcaster, to increase its coverage of the ANC’s election campaigns; Mbalula accused the SABC of a “clampdown” and “blackout” of the party’s campaign activities.95

The government has at times attempted to control media content, particularly on the 24-hour news channel ANN7 and the New Age newspaper,96 both formerly owned by the Gupta family and both of which served as the mouthpiece of the ANC government.97 The 2013 purchase of the Independent Group, a large media conglomerate, by ANC ally Iqbal Survé, and persistent interference with the SABC, have taken a toll on fair and balanced media content in South Africa.98

The ongoing state capture inquiry, which examines the influence of the Gupta family and other powerful interests on the government, revealed in January 2019 that several journalists received monthly bribes from the contracting firm Bosasa (now known as African Global Operations) to inform the company of potential negative stories about it, as well as to write articles that presented Bosasa in a flattering light.99

For the most part, there are no economic or regulatory constraints that significantly affect users’ ability to publish content online. The online environment in South Africa is net neutral, although net neutrality has not been expressly provided for in law or policy.100 The ISPA is at the forefront in promoting net neutrality and believes that it is essential for the transparent management of networks and the prevention of anticompetitive behavior.101 The government has indicated that it intends to include net neutrality in an expected amendment to the ECTA.102

The role of politicized advertising may affect economic viability. In the past, the Gupta-owned progovernment ANN7 news channel and New Age newspaper (see B5) routinely received a massive share of government advertising, reaching in the hundreds of millions of rands.103

In 2017, the FPB proposed revisions to the tariff structure that would require online streaming services to pay a licensing fee per film and per series season that they offer, as opposed to the current structure, which involves payment of a flat fee.104 The size of the fee was criticized by industry stakeholders as unjustifiable (in relation to the actual cost of classification) and prohibitive for smaller competitors providing content streaming services.105 If adopted, these revisions would benefit content distributors with fewer titles, while those with more content would pay significantly more than the current license fee of 795,000 South African rands ($55,000), which was imposed in 2016.106 Although some major content distributors such as Google, Apple, and MultiChoice had paid the license fees by the end of 2017, other major players such as Netflix and Microsoft refused to pay. In February 2020, Netflix entered into an agreement with the FPB to subject itself to the FPB’s jurisdiction and oversight, which implies that it will have to pay the relevant fees.107 The revisions to the fee structure that were proposed in 2017 had not yet been passed by the end of the reporting period.

Online media in South Africa is vibrant, representing a wide range of international and national viewpoints and perspectives.

Web-only news platforms, such as the Daily Maverick and News24, have become particularly popular in recent years, with key news stories often broken online before in print or broadcast outlets, illustrating how online media is growing as a primary news source.

While content in both English and Afrikaans is well-represented online, 9 of South Africa’s 11 official languages are underrepresented on the internet, including on government websites. Additionally, the perspectives of women, rural dwellers, persons with disabilities, sexual minorities, and ethnic and religious minorities are underrepresented and marginalized in the media, including online media.108

Neither the government nor nonstate actors restrict the use of digital tools for mobilization and campaigning. South Africa has a robust online community that addresses contemporary social, economic, and political issues. In 2018, successful social media campaigns addressed issues such as the blood donation drive by the South African National Blood Services (SANBS), the changing nature of traditional family structures, and gender stereotyping.109 In September 2019, an online movement under the hashtag #ImStaying celebrated positive aspects of living in South Africa to act as a counter-narrative to negativity about the country, though the page has attracted criticism for racial insensitivity and elitism.110

Local sources report that pressure by online advocacy groups has had an impact on ICASA, which introduced the End-User and Subscriber Service Charter Regulation Amendment on February 28, 2019, and also commenced a market inquiry into mobile broadband services that could result in lower data costs (see A2).

In 2016, civil society groups advocated a move to bring down the high cost of digital communications, using the hashtag #DataMustFall.111 The government responded positively to the campaign, and in 2017, the Competition Commission launched an inquiry with the aim of understanding critical elements within the market and value chain that lead to high prices for data services, and ultimately to make recommendations that could lower the cost of data. The Commission concluded its inquiry in December 2019 and made several recommendations aimed at decreasing the price of data (see A2).112

Score change: The score declined from 5 to 4 as the government enacted state of disaster regulations that limited freedom of expression online during the COVID-19 pandemic.

There are no specific legislative provisions to protect online modes of expression. However, the constitution provides for freedom of the press and freedom of expression, among other guarantees. It also includes constraints on “propaganda for war; incitement of imminent violence; or advocacy of hatred that is based on race, ethnicity, gender, or religion and that constitutes incitement to cause harm.”113 The right of access to information held by the state, and in limited circumstances by private bodies, is also guaranteed by the constitution.114 These rights apply to all members of the public and to journalists equally, whether they operate online or offline. However, observers have expressed concern that, if signed into law, the Films and Publications Amendment Act will make online content vulnerable to censorship (see B3).

In March 2020, the government declared a three-month state of disaster under the Disaster Management Act of 2002 in response to the COVID-19 pandemic. The regulations issued under the state of disaster imposed a national lockdown, limiting freedom of expression, freedom of movement, and other rights that are derogable under the Constitution.115 The state of disaster remains in place as of September 2020 following numerous extensions by the government, amid numerous losses in the courts to legal challenges that contested the validity of the regulations.116

In a positive development for internet freedom, in July 2018, South Africa voted in favor of a UN Human Rights Council (UNHRC) resolution on “the promotion, protection, and enjoyment of human rights on the internet.”117 South Africa had previously voted against a 2016 version of the resolution, siding with repressive countries such as China, Russia, and Saudi Arabia.118

The judiciary is generally regarded as independent and in recent years has been seen as the branch of government that has been most dedicated to upholding the rule of law by constraining the executive and legislative branches from arbitrary actions.119

The police and other law enforcement agencies have been criticized for failing to adequately investigate and prosecute EFF supporters who have threatened and attacked journalists, contributing to an environment of impunity and threatening rights guaranteed in the constitution.120

A number of laws are vulnerable to being misused to prosecute online journalists and activists. The offense of crimen injuria, or insulting the dignity of a person, has been invoked to prosecute online harassment.121

The state of disaster regulations passed in March 2020 criminalize “any statement, through any medium, including social media, with the intention to deceive any other person about COVID-19; COVID-19 infection status of any person; or any measure taken by the Government to address COVID-19.” The penalty is a fine or imprisonment of up to six months, or both.122

Defamation is a criminal offense, though prosecutions are rare and, until recently, defamation charges were not brought against people for online activity. The ANC committed to scrapping criminal defamation in September 2015, but there have been no moves to introduce legislation to fulfill this promise.123

A draft Cybercrimes and Cybersecurity Bill, first introduced in 2015, was criticized by civil society activists for its ambiguous language, which they claim has the potential to infringe on freedom of expression.124 In the second version of the bill, introduced in 2017, a chapter on “malicious communications” would penalize the dissemination of a “data message which is harmful,” the definition of which includes content that is “inherently false,” without further specifications.125 The bill also contained a number of provisions that were vaguely worded, leading to concerns that it could be used to censor political speech online,126 while other aspects of the bill would enhance the state’s surveillance powers (see C5).

In October 2018, a substantially revised third version of the bill was presented by the Department of Justice and Constitutional Development. The legislation, renamed the Cybercrimes Bill, no longer contained language on cybersecurity.127 It also addressed the ambiguous definition of “unlawful,” bringing it in line with the Protection of Personal Information (POPI) Act of 2013, and dispensed with crimes related to “critical infrastructure.”128 This version was passed by the National Assembly in November 2018. An amended version of the bill was adopted in July 2020, after the coverage period, and now awaits signature by the President.129

Score change: The score declined from 6 to 5 after several internet users were arrested for spreading false information relating to the COVID-19 pandemic online.

No individual was prosecuted, detained, or sanctioned by the state for protected political, social, or religious speech online during the coverage period. However, at least eight individuals were arrested during the coverage period for spreading false information related to COVID-19. The arrests were made pursuant to the state of disaster regulations, which prohibit the intentional dissemination of false information relating to the virus.130 One of those detained, Stephen Birch, was arrested for circulating misleading information about test kits online and charged under the March 2020 emergency regulations.131 Celebrity Somizi Mhlongo was charged with violating the regulations for suggesting during an Instagram Live stream that Transport Minister Fikile Mbalula told him that the state of disaster lockdown would be extended; Mhlongo turned himself into the police and was released on bail.132

South Africa has few restrictions on anonymous communication or encryption. There are no laws requiring internet users, website owners, or bloggers in South Africa to register with the government or any of its agencies to operate. Users are also not required to use their real names when posting comments on the internet, including on social media platforms.

The Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA) of 2002, however, compromises users’ rights to anonymous communication by requiring mobile subscribers to provide national identification numbers, copies of national identification documents, and proof of physical address to service providers.133 An identification number is legally required for any SIM card purchase, and registration requires proof of residence and an identity document.134 Beyond privacy concerns, the RICA requirements can be an obstacle to mobile phone usage for the many South Africans who live in informal settlements with no recognized address.

Users are not explicitly prohibited from using encryption to safeguard their communications. However, RICA empowers a judge to force the disclosure of decryption keys or to require assistance in decryption in specified circumstances, upon approval of a request made by the police, military, intelligence, or other law enforcement agencies.135

Strong concerns about potentially unchecked government surveillance powers over online activity remain, but some legal safeguards related to surveillance do exist. RICA does not permit the blanket collection of telecommunications metadata but provides for a stringent process for the targeted collection of metadata, the interception of communications, and the decryption of private communications, all of which require a court order.136

In September 2019, a High Court ruled that numerous provisions of RICA were unconstitutional.137 The Amabhungane Centre for Investigative Journalism had filed a case in April 2017 challenging the constitutionality of RICA on several fronts. The High Court ruled that the bulk surveillance conducted by the National Communication Centre (NCC) is unlawful because there is no legislation that authorizes the state to conduct such interception of private communications. The ruling postponed the resulting invalidation of RICA for two years to permit parliament to pass legislation amending the unconstitutional provisions and imposed interim changes to the law. The interim changes include requiring the NCC to notify individuals who have their communications intercepted within 90 days after the surveillance has been terminated and to disclose in its application when the target of surveillance is a journalist or lawyer.

Under RICA, the threshold for granting a court order is low, oversight is insufficient, and in the past users did not have to be informed that their communications had been intercepted.138 A loophole allows communications to be intercepted under the Criminal Procedure Act, which lacks certain safeguards and has been abused by law enforcement agencies.139 Up to 95 percent of court orders involving the interception of communications are not approved by a RICA judge; most of the court orders outside of RICA are for metadata. The metadata of between 70,000 and 195,000 mobile users is collected every year.140 Telecommunications service providers are also required to store the metadata of all customers for three to five years, a provision that concerns privacy advocates.141

South Africa has the technical capacity to undertake bulk and targeted surveillance, and it has been acknowledged that bulk surveillance is being undertaken by various government agencies.142 This is particularly concerning because RICA’s oversight applies only to domestic signal interception and not to the interception of foreign signals (which originate outside South Africa but pass through or terminate in the country), which include communications such as emails.143 The NCC is responsible for intercepting foreign signals and does so without oversight. According to reporting from Privacy International, published in August 2019, South African security agencies claim that while bulk surveillance is meant to focus on foreign communications, their surveillance system is unable to discern between international and domestic communications and therefore collects both.144

The South African police possess international mobile subscriber identity (IMSI) catcher technology, also known as “stingrays,” which permit the bulk interception of mobile phone traffic, although the extent of its use is uncertain.145 The Ministry of State Security does not believe that IMSI catchers are governed by RICA, and use is therefore unregulated.146 The government has claimed that the technology is used only for national security matters.147 Nonetheless, consistent weaknesses in oversight mechanisms within the state security departments leave surveillance open to abuse; in addition, the interception of communications that originate outside South Africa are essentially unregulated.148 In light of the September 2019 court ruling on RICA, the state’s use of IMSI catchers is illegal unless new legislation is passed to regulate such use for bulk surveillance.

South Africa's intelligence services are also reported to be using a social media analytics and monitoring tool called Media Sonar, which allows for the searching and analyzing of social media content of users within a defined geolocation and the use of keyword searches.149

Journalists have been frequently targeted for surveillance by the state, usually as a means of identifying confidential sources.150 For example, in May 2018, it emerged that the telephone conversations of investigative journalist Jacques Pauw had been intercepted while he was reporting on state capture during the Zuma administration.151 Nonstate actors have also targeted journalists for surveillance purposes. In March 2018, the Mail & Guardian disclosed that the telephone records of journalist Athandiwe Saba, who had reported critically on the Railway Safety Regulator, were obtained by a private investigator hired by the regulator, likely with the assistance of the police or National Prosecuting Authority.152

In a 2018 report by Citizen Lab, a Canadian internet watchdog, South Africa is listed as one of 45 countries worldwide using Pegasus, a targeted spyware software developed by the Israeli technology firm NSO. Pegasus is known to be used by governments to spy on journalists, human rights defenders, and the opposition.153

Concerns over the potentially unchecked government surveillance powers over online activity remain, but they were somewhat addressed when Dr. Setlhomamaru Isaac Dintwe was appointed as the inspector general of intelligence (IGI) in 2017, after the position had been vacant for an extended period.154 As an independent actor accountable to parliament, the IGI was expected to strengthen oversight mechanisms for intelligence agencies and determine their compliance with the legislative framework and constitution.155 However, upon assuming office, Dintwe had difficulty fulfilling his mandate as a result of interference by leadership in the intelligence community. In April 2018, he filed an urgent court application to prohibit Arthur Fraser, the director general of the State Security Agency (SSA), from intervening in the execution of his mandate.156 Fraser was subsequently transferred out of the SSA.157

Beyond RICA, the POPI Act serves as South Africa’s legal framework protecting the constitutional right to privacy. POPI includes provisions to protect users’ online security, privacy, and data, and allows an individual to bring civil claims against those who contravene the law (see C6).158

In February 2019, a private company, Vumacam, commenced the installation of 15,000 CCTV cameras in a number of Johannesburg suburbs,159 as part of an effort to address rising crime. Vumacam sells its footage to security companies operating in neighborhoods within its coverage area. Analysts expressed concern that the CCTV network is potentially a tool for unchecked mass surveillance and racialized profiling of black and brown people in public spaces.160 Vumacam denied that its cameras are enabled with facial recognition technology and stated that it is not building a database on the movements of private citizens or engaging in racial profiling.161 Concerns have also been raised that Vumacam is not registered with the Private Security Industry Regulatory Authority.162

Provisions in the Cybercrimes and Cybersecurity Bill that could have enhanced the state’s interception powers were removed in October 2018 (see C2).

The Protection of Personal Information Act of 2013, South Africa’s data protection framework, entered fully into force on July 1, 2020, after the coverage period. RICA provides for a legal process for the interception of communications, and service providers are, under certain circumstances, required to aid the government in surveillance (see C5).

POPI entered fully into force following a presidential proclamation in June 2020. A few elements of POPI had entered into force by presidential proclamation in 2014, including the establishment of the South African Information Regulator, which was not able to act in the six-year interim. The deadline for implementation of POPI is July 1, 2021.163

POPI establishes safeguards for the processing of personal data, including requirements for consent, retention limitations, and notice and limitations on automated processing and cross-border data transfers. POPI defines personal data broadly, covering information about individuals, their beliefs, and their legal identity, and also establishes more extensive safeguards for especially sensitive personal data. The law includes a standard set of exceptions, including national security and criminal matters. Penalties for contravening the law are stiff, including prison terms and fines of up to 10 million South African rands ($650,000).164

According to RICA, service providers, including ISPs, are required to use systems with the technical capacity for communications to be intercepted; they are also required to retain customer metadata for three to five years.165 RICA specifically requires service providers to intercept and provide the communications of their customers upon a judge’s directive.166 In practice, however, the bulk of requests for information are not made through RICA and are thus not transparent or subject to appeal (see C5). However, neither RICA nor POPI impose data localization requirements.

While the ECTA does not require ISPs to actively monitor content or to seek information on unlawful activity, the minister of communications may, under certain circumstances, require ISPs to provide information on illegal activities of their users or information that facilitates the identification of users.167

Cases of extralegal intimidation or violence reported against bloggers, journalists, and online users declined sharply after the May 2019 elections. Women and LGBTQ+ people routinely experience online harassment in South Africa.

In March 2020, Azarrah Karim, a journalist for the online newspaper News24, was fired at by police officers while covering police dispersing crowds with rubber bullets in Johannesburg during the first day of the lockdown, even after she identified herself as press.168 Karim was later mocked by officers when she filed a statement at the local police station.169

Members of the EFF, including leader Julius Malema, have attacked and encouraged attacks against journalists online on several occasions. In March 2019, for example, veteran journalist Karima Brown mistakenly posted a message directed to her staff on a WhatsApp Group that included EFF members. In response, Malema posted a screenshot of the message that contained Brown’s mobile number on Twitter. Brown then received a barrage of abusive and threatening messages from EFF supporters.170 Several other journalists, including Adriaan Basson of News24171 and Pauli van Wyk of the Daily Maverick, have also faced online attacks by Malema and supporters of the EFF.

Although the EFF has threatened online journalists more prominently and apparently with more frequency than other political actors, supporters of the ANC have also been known to threaten and harass online critics. In September 2018, a prominent ANC member allegedly sent Sunday Times journalist Qaanitah Hunter an image of a gun in a text message, in response to an article she wrote about former president Zuma.172

The South African National Editors’ Forum (SANEF) took the EFF to court over allegedly enabling the intimidation and harassment of journalists. The case was dismissed for technical reasons relating to the legislative provisions that SANEF attempted to rely on, which the court ruled were not applicable. 173

Online harassment on the basis of gender and sexuality is rampant in South Africa, and racist language is common. Almost one-quarter of South African women report experiencing online gender-based violence, according to an August 2020 report by Pollicy, a technology consulting firm, that surveyed 536 South African women.174 In a 2018 report by Gender Links, 30 percent of women journalists surveyed reported experiencing some form of online violence.175 A survey of LGBTQ+ youth released in April 2020 found that 82 percent reported experiencing harassment online because of their identity.176 A report from PeaceTech Lab and Media Monitoring Africa found a sharp increase in racist and racially discriminatory terminology online during the May 2019 elections.177

South Africa is highly vulnerable to cybersecurity threats on many fronts, though independent news outlets and opposition voices were not subject to targeted technical attacks during the coverage period.

In February 2020, Nedbank announced that one of its third-party service providers had been hacked, leading to the theft of the personal data of 1.7 million customers including their names, ID numbers, telephone numbers, physical addresses, and email addresses.178 In October 2019, several major South African banks were targeted by a distributed denial-of-service (DDoS) attack that was aimed at extracting ransom payments from them.179 The City of Johannesburg also reported a breach of its network in October 2019 after its systems were attacked by a group calling themselves the Shadow Kill Hackers who demanded payment in Bitcoin and threatened to publish the data online if they were not paid.180 The city was forced to shut down its website and billing services in an effort to contain the attack.

Government websites are often hacked. Most of the hacks are perpetrated by amateur hackers with no apparent political motivations other than to advertise their skills. The government website of the National Cybersecurity Hub, whose objective is to protect South African citizens and businesses online, was hacked in August 2018.181 These attacks are usually short-lived, with the websites restored within a few days.182

The ECTA contains provisions that protect against cyberattack by criminalizing access or interception of an individual’s data without permission; interference with an individual’s data without permission; unlawful production, sale, procurement, design, distribution, or possession of a device used to overcome security measures or the protection of data; the use of such a device to unlawfully overcome security measures for the protection of data; and interference with an information system that protects data.183