From: Abdalah Hamis

World’s second-biggest mobile phone company, Vodafone, said government agencies in a small number of countries in which it operates have direct access to its network, enabling them to listen in to calls.

Vodafone on Friday published a “Disclosure Report” which said that while in many of the 29 countries in which it operates, government agencies need legal notices to tap into customers’ communications, there are some countries where this is not the case.

http://3.bp.blogspot.com/-xbM3U6tKB7Q/U5GRLftLOLI/AAAAAAAAWwM/NI6vfFeCwLU/s1600/Screenshot_1.png

In this report we provide an overview of some of the legal powers under the law of Tanzania that government agencies have to order Vodafone’s assistance with conducting real-time interception and the disclosure of data about Vodafone’s customers.

PROVISION OF REAL-TIME LAWFUL INTERCEPTION ASSISTANCE

The Electronic and Postal Communication Act The Electronic and Postal Communication Act, 2010 (the “EPOCA”) does not specifically make provision for interception of customer communications. However, the existence of intercept powers can be implied from section 120 of the EPOCA which provides that
no person, without lawful authority under the EPOCA or any other written law can intercept, attempt to intercept, or procure any other person to intercept or attempt to intercept any communications. An application must be made under ‘any other law’ to the director of public prosecution (the “DPP”) for authorisation to intercept or listen to any customer communication transmitted or received.

Only public officers or an officer appointed by the Tanzania Telecommunications Regulatory Authority (the “TCRA”) and authorised by the Ministry of Science and Technology and the Ministry of Home Affairs may be permitted to intercept such communications.

Section 120 of the EPOCA provides that any person who, without lawful authority under the EPOCA or any other written law:

a. intercepts, attempts to intercept, or procures any other person to intercept or attempt to intercept any communications; or

b. discloses, or attempts to disclose to any otther person the contents of any communications, knowingly or having reason to believe that the information was obtained through the interception of any communications in contravention of this section; or
c. uses or attempts to use the contents of any communications, knowingly having reason to believe that the information was obtained through the interception of any communications in contravention of this section, commits an offence. This section therefore implies that any person with lawful authority may intercept customer communications.

Tanzania Intelligence and Security Service Act The Tanzania Intelligence and Security Service Act [Cap 406 R.E. 2002] (the “TISSA”) provides that the Tanzania Intelligence and Security Service (the “Service”) has a duty to collect by investigation or otherwise, to the extent that it is strictly necessary, and analyse and retain, information and intelligence in respect of activities that may on reasonable grounds be suspected of constituting a threat to the security of Tanzania or any part of it. Section 15 of TISSA further provides that the Service has the power to investigate any person or body or persons whom or which it has reasonable cause to consider a risk, or source of risk, of a threat to state security and that the Service may conduct any investigations which are required for the purposes of providing security assessments. Section 10 of TISSA provides that the Director-General of the Service shall have the command, control, direction, superintendence and management of the Service and all matters connected with it and that all orders and instructions to the Service shall be issued by the Director-General subject to any orders issued by the President of the United Republic of Tanzania, unless the Minister responsible for intelligence and security directs otherwise in writing.

Tanzania Intelligence and Security Service Act The Tanzania Intelligence and Security Service Act [Cap 406 R.E. 2002] (the “TISSA”) provides that the Tanzania Intelligence and Security Service (the “Service”) has a duty to collect by investigation or otherwise, to the extent that it is strictly necessary, and analyse and retain, information and intelligence in respect of activities that may on reasonable grounds be suspected of constituting a threat to the security of Tanzania or any part of it. Section 15 of TISSA further provides that the Service has the power to investigate any person or body or persons whom or which it has reasonable cause to consider a risk, or source of risk, of a threat to state security and that the Service may conduct any investigations which are required for the purposes of providing security assessments. Section 10 of TISSA provides that the Director-General of the Service shall have the command, control, direction, superintendence and management of the Service and all matters connected with it and that all orders and instructions to the Service shall be issued by the Director-General subject to any orders issued by the President of the United Republic of Tanzania, unless the Minister responsible for intelligence and security directs otherwise in writing.

Criminal Procedure Act

Section 10 of the Criminal Procedure Act [Cap 20 R.E. 2002] (the “CPA”) provides/grants the powers to police officer(s) to investigate the facts and circumstances of a case where a police officer has reason to suspect the commission of an offence. Further, section 10(2) of the CPA specifically provides for the police officers’ powers, by order in writing, to require the attendance of any person (natural or legal) who from information given or in any other way appears to be acquainted with the circumstances of a case, or who is in possession of a document or any other thing relevant to the investigation of a case to attend or to produce such document or any other thing.

DISCLOSURE OF COMMUNICATIONS DATA

The Electronic and Postal Communication Act

Section 91 of the EPOCA provides that there shall be a database kept with the TCRA in which all subscriber information will be stored. Every application services licensee must submit to the TCRA a monthly list containing its subscribers information.

Further, Regulation 4(2)(b) of the the Electronic and Postal Communication (Telecommunications Traffic Monitoring System) Regulations 2013 (the “TTMS Regulations”) provide that the TCRA shall acquire, install, operate and maintain
traffic monitoring and measurement devices at the operator’s premises. Moreover, regulation 8 of the TTMS Regulations provides, inter alia, that the Traffic Monitoring System shall collect call detail records without any interception of contents of communications such as voice or SMS. Call detail records have been defined as information generated by telephone exchanges which contain details of calls originating from, terminating at or passing through the exchange. In addition,
regulation 13(4) of the TTMS Regulations provides that the TCRA must ensure that call detail records data are collected for the exclusive purpose of monitoring compliance with the TTMS Regulations; they are encrypted and stored with the
last three digits of the calling numbers hashed in order to protect confidentiality; and call detail records collected are not transmitted or given to third parties, public or private, except as permitted by law.

The EPOCA provides that information may only be disclosed by an authorised person where it is required by any law enforcement agency, court of law or other lawfully constituted tribunal authority with respect to subscriber information.
However, pursuant to the Electronic and Postal Communications (Licensing) Regulations, 2011 (the “Licensing Regulations”) a licensee may collect and maintain
information on individual consumers where it is reasonably required for its business purposes. It further provides that the collection and maintenance of information on individual consumers must be: (a) fairly and lawfully collected and
processed; (b) processed for identified purposes; (c) accurate; (d) processed in accordance with the consumer’s other rights; (e) protected against improper or accidental disclosure; and (f) not transferred to any party except as permitted by any terms and conditions agreed with the consumer, as permitted by any permission or approval of the Authority, or as otherwise permitted or required by other applicable laws or Regulations.

Under section 99 of the EPOCA a person shall not disclose any information received or obtained in exercising his powers or performing his duties in terms of the EPOCA except:

(a) where the information is required by any law enforcement agency, court of law or other lawfully constituted tribunal;

(b) notwithstanding the provision of this section, any authorized person who executes a directive or assists with execution thereof and obtains knowledge or information of any communication may;

(i) disclose such information to another law officer to the extent that such disclosure is necessary for the proper performance of the official duties of the
authorised person making or the law enforcement officer receiving the disclosure; or
(ii) use such information to the extent that such use is necessary for the proper performance of official duties.

NATIONAL SECURITY AND EMERGENCY POWERS

The National Security Act

The National Security Act [Cap 47 R.E. 2002] (the “NSA”), which makes provisions relating to state security, states in section 15 that where the DPP is satisfied that there is reasonable ground for suspecting that an offence under the NSA has been or is about to be committed, and that some person may be able to furnish information with regard thereto, he may, by writing under his hand, authorise a named officer to require that person to give a police officer any information in his power relating to such suspected or anticipated offence.

Tanzania Intelligence and Security Service Act Section 5 of TISSA gives authority to the Service to obtain, correlate, and evaluate intelligence relevant to security, and
to communicate any such intelligence to the Minister and to persons whom, and in the manner which, the Director-General considers it to be in the interests of security. In doing so the Service shall cooperate as far as practicable and necessary with such other organs of state and public authorities within or outside Tanzania as are capable of assisting the Service in the performance of its functions.

Constitution of United Republic of Tanzania The Constitution of United Republic of Tanzania 1977 as amended from time to time (the “Constitution”) provides
the Parliament with the power to enact and enable measures to be taken during a state of emergency or in normal times in relation to persons who are believed to engage in activities which endanger or prejudice the security of the nation.
Article 31 of the Constitution provides that any law enacted by Parliament shall not be void for the reason only that it enables measures to be taken during a state of emergency or in normal times in relation to persons who are believed to engage in
activities which endanger or prejudice the security of the nation, which measures derogate from the right to life.

OVERSIGHT OF THE USE OF POWERS

Other than as outlined above there is no judicial oversight over these powers. However, section 114 of the EPOCA provides that the TCRA may take enforcement measures against any person who contravenes licence conditions, regulations and
provisions of the EPOCA.