Electronic Communications Security (Pty) Ltd Act [No. 68 of 2002]


Government Gazette
REPUBLIC OF SOUTH AFRICA

Vol. 452 Cape Town 6 February 2003 No. 24356
THE PRESIDENCY No. 189 6 February 2003 It is hereby notified that the President has
assented to the following Act, which is hereby published for general information:–
No. 68 of 2002: Electronic Communications Security (Pty) Ltd Act, 2002.


2 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68, 2002 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT, 2002
t
(English text signed by the President.) (Assented to 30 January 2003.)
ACT To provide for the establishment of a company that will provide electronic communications security products and services to organs of state; and to provide for matters connected therewith.
CHAPTER 1
Definitions
1. In this Ac , unless the con ext th rwise i di ate - 5 “Board” means the Board of Directors of Comsec contemplated in section 8; “Chief Executive Officer” means the Chief Executive Officer contemplated in section 13; “communication” means communication as defined in an Act of Parliament providing for the regulation of interception of communications; 10 “Companies Act” means the Companies Act, 1973 (Act No. 61 of 1973); “Comsec” means Electronic Communications Security (Pty) Ltd established by section 2; “critical electronic communications” means electronic communications held by organs of state which are necessary for the protection of the national security of the 15 Republic; “critical electronic communications infrastructure” means electronic communica- tions products or systems used to transmit and store or transmit or store critical electronic communications; “Intelligence Services” means the Intelligence Services as contemplated in an Act 20 of Parliament providing therefor; “joint standing committee” means the Joint Standing Committee on Intelligence established by section 2 of the Intelligence Services Control Act, 1994 (Act No. 40 of 1994); “Minister” means the Minister as defined in an Act of Parliament providing for the 25 Intelligence Services; “organ of state” means an organ of state as defined in section 239 of the Constitution; “prescribe” means prescribe by regulation; “telecommunication service provider” means a telecommunication service pro- 30 vider as defined in an Act of Parliament providing for the regulation of interception of communications; “this Act” includes the regulations.
Establishment of Comsec
2. There is hereby established a juristic person to be known as Electronic 35 Communications Security (Pty) Ltd.
4 No. 24356 GOVERNMENT GAZETTE. 6 FEBRUARY 2003
Act No. 68. 2002 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT. 2002
Principal objective of Comsec
3. The principal objective of Comsec is to ensure that critical electronic communi- cations are protected and secure.
Incorporation of Comsec
4. ( 1 1 The Minister must effect the incorporation of Comsec in terms of the Companies Act.
( 2 ) Notwithstanding the Companies Act or any other law, the State is the sole shareholder of Comsec.
( 3 ) Notwithstanding the Companies Act. the Minister or a person designated by him or her must. on behalf of the State. sign the memorandum and articles of association and all other documents necessary for the incorporation of the company.
(4) The Registrar of Companies must- ( a / register the memorandum and articles of association as signed in terms of
Ih) incorporate the company as a private cornpan)' under the name "Electronic
(c) issue to the company a certificate to commence business with effect from the
subsection (3 ):
Communications Security (Pty) Ltd": and
date of the company's incorporation.
Provision of Companies Act not applicable to Comsec under certain circumstance
5. A provision of the Companies Act does not apply to Comsec where the Minister of Trade and Industr?. has issued a declaration under section 6.
Request for exemption from application of provision of Companies Act
6. i 1 ( a ) The Minister may. on the recommendation of Comsec, request the Minister of Trade and Industry to declare the whole or part of a provision of the Companies Act not applicable to Comsec.
(Dl The request must be fully motivated. ( 2 ) The Registrar of Companies must publish particulars about the request and
motivation contemplated in subsection ( 1 ) by notice in the Gazette, unless such publication will compromise national security.
( 3 ) The Minister of Trade and Industry may, by notice in the Gazette, after having considered the request contemplated in subsection (1) and if satisfied on reasonable grounds that the non-application of the provision of the Companies Act to Comsec wi l l -
( N ) contribute to the efficient!, of Comsec and reduce its operating costs; ( h i not reduce or limit the accountability of Comsec as a public institution or
detract from the requirements of transparencv regarding its functioning and operations: and
( c / not be detrimental to the interests of the State. employees of Comsec or claims of creditors of Comsec.
declare. with effect from the date stated in the notice, the whole or part of a provision of the Companies Act not applicable to Comsec.
Functions
7. ( 1 ) The functions of Comsec are to- ( a ) protect and secure critical electronic communications against unauthorised
access or technical. electronic or any other related threats; ( b ) provide. with the concurrence of the National Intelligence Agency defined in
section 1 of the Intelligence Services Act. 1994 (Act No. 38 of 1994), verification services for electronic communications security systems, prod- ucts and services dsed by organs of state;
( c ) provide and co-ordinate research and development with regard to electronic communications security systems, products, services and any other related services;
(d ) perform any other function not inconsistent with this Act that is necessary for the effective functioning of Comsec.
5
10
15
20
35
30
35
40
45
50
" ( 2 ) For purposes of the functions contemplated in subsection ( l ) , Comsec must- 55
6 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT, 2002
5,
(a) develop, design, procure, invent, install or. maintain secure lectronic communications systems or products and do research in this regard;
(b) provide secure electronic communications services, systems and products; ( c ) provide cryptographic services; (d) train and support users of the electronic communications systems, products 5
and related services; and ( e ) provide consultancy services on the security and protection of electronic
communications services, systems and products. (3) Subject to applicable labour law, Comsec may, with the approval of the Minister
acting with the concurrence of the Minister responsible for an entity or establishment of 10 the State which performs duties similar to those referred to in subsection ( 2 ) , integrate such an entity or establishment into Comsec.
(4) Comsec may cooperate with any organisation in the Republic or elsewhere to achieve its objectives.
( 5 ) Comsec, the members of its Board and its employees must, in the performance of 15 -their functions in terms of this Act, comply with the policies and regulations relating to security of communications made in terms of the National Strategic Intelligence Act, 1994 (Act No. 39 of 1994).
(6) The head of a telecommunication service provider must. at the request of Comsec and at Comsec’s expense, render such assistance as may be necessary for the execution 20 of the functions of Comsec contemplated in this section.
( 7 ) Comsec is exempted from the licensing requirements contemplated in- (a ) the Broadcasting Act, 1999 (Act No. 4 of 1999); and (b) the Telecommunications Act, 1996 (Act No. 103 of 1996).
CHAPTER 2
GOVERNANCE OF COMSEC
25
Board of Directors
8. ( 1 ) Comsec must be managed and controlled in accordance with this Act by a Board of Directors appointed by the Minister after consultation with Cabinet.
( 2 ) The business and operational plans of Comsec must be approved by the Board 30 with the concurrence of the Minister.
(3) The Board represents Comsec.
Composition of Board
9. ( 1 ) The Board is made up of not more than nine members of whom- ( a ) one is the non-execu ive chairp rson; 35 (bi not more than four are executive directors, one of whom must be designated
( c i the rest are additional non-executive members, consisting of persons by the Minister as the Chief Executive Officer: and
approved by the Minister on the basis of relevant expertise. ( 2 ) A majority of the members of the Board forms a quorum at any meeting of the 40
(3) On an equality of votes in any meeting of the Board, the chairperson has a casting Board.
vote in addition to a deliberative vote.
Terms of office of members of Board
10. (1 ) A non-executive memb r of the Board- 45 (a ] holds office for a period of three years which the Minister may extend for
further periods of three years each or such shorter periods as the Minister may determine;
(b) serves on the terms and conditions determined by the Minister and specified in the letter of appointment of the memb r; and 50
(c) may resign by giving three months’ written notice to the Minister or as stipulated in the letter of appointment.
(2) An executive member of the Board- fa) holds office for aperiod etermined by the Minister in the letter of
appointment; and 55
8 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (I") LTD ACT, 2002
(b) may resign by giving three months' written notice to the Minister or as stipulated in the letter of appointment.
(3) The names of the Board members may be kept confidential.
Remuneration of members of Board
11. Amember of the Board, except the executive directors and any appointed member 5 who holds a post or office in the Public Service or any institution, organisation or body established by or under any other law and funded wholly or partly by the State, may be remunerated on a daily basis at a rate determined by the Minister with the concurrence of the Minister of Finance.
Removal from office 10
12. The Minister may in the prescribed manner remove any member of the Board from office on the grounds of misconduct, incompetence or incapacity or failure to
~ obtain the necessary security clearance.
CHAPTER 3
CHIEF EXECUTIVE OFFICER 15
Functions of the Chief Executive Officer
13. The Chief Executive Officer is responsible for the administration and the general management and control of the day-to-day functioning of Comsec, subject to the directions and instructions issued by the Board.
Employment of personnel 20
14. (1) The Chief Executive Officer must appoint the employees of Comsec, subject to such remuneration, allowances and service benefits as the Board may determine.
( 2 ) In filling posts, the evaluation of persons must be based on training, skills, competence. knowledge and the need to redress the imbalances of the past, so as to achieve a staff complement broadly representative of the South African population, 25 according to race, gender and disability.
(3) The Minister or any other Minister may, at the request of Comsec, second an employee to Comsec in accordance with an Act of Parliament providing for the Intelligence Services or section 15(3) of the Public Service Act, 1994 (Proclamation No. 103 of 1994), as the case may be. 30
(4) For as long as an employee is seconded to Comsec, Comsec must reimburse the relevant department for the remuneration and allowances paid by such department to the employee, and for any other expenditure arising from the secondment of that employee.
Employment of employees of Security Services
15. (1) Any employee involved in an electronic communications security function in 35 the security services contemplated in Chapter 11 of the Constitution, or in any establishment or entity contemplated in section 7(3), may be made an employment offer by Comsec.
( 2 ) (a) The remuneration, benefits and privileges offered by Comsec may not be less than those payable to the employee by the previous employer immediately prior to his 40 or her transfer.
(b) Prior to the transfer of an employee, an agreement must have been reached between the employer, Comsec and the Minister, and with the concurrence of the Minister of Finance, where applicable-
( i ) as to whether accrued leave and sick leave should be wholly or partially 45
(ii) as to whether the monetary value of such benefits should be payable wholly or
(iii) as to which portion of the costs of the transferred benefits is to be carried by
carried over to Comsec;
partially to the employee prior to transfer; and
the employ r and which portion by Comsec. 50
I -
10 No. 24356 GOVERNMENT GAZEITE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LTD ACT, 2002
r,
(3) The agreement contemplated in subsection (2)(b):must also deal with any other
(4) An offer contemplated in subsection (1) may only be made to employees who are
(5) An employee who accepts the offer Contemplated in subsection (1) is not entitled 5
(6) An officer who is a member of Government Employees Pension Fund and who is
(a) choose to become a dormant member of such Fund, and from the date of
existing contractual obligation between the employer and the employee.
in the service of the respective employers when the offer is made.
to any ,voluntary severance package.
employed by Comsec may-
exercising such choice the officer must, despite the provisions of any other 10 law, be regarded to be a dormant member of the Fund;
( 6 ) choose to remain a member of the Fund, in which case Comsec is responsible for the employer's contribution to the Fund;
(c i request to become a member of any other registered pension fund, and withdraw from the Government Employees Pension Fund in accordance with 15 the Government Employees Pension Law, 1996 (Proclamation No. 21 of 1996).
I
CHAPTER 4 I
SECURITY MATTERS
Security clearance 20
16. No person may be appointed as a member of the Board or as an employee of Comsec without a security clearance certificate issued by the National Intelligence Agency in accordance with the National Strategic Intelligence Act, 1994 (Act No. 39 of 1994).
CHAPTER 5 25
SERVICE DELIVERY
Analysis of electronic communications security needs, and business agreement
17. (1) The head of an organ of state must ensure that the organ of state under his or her administration procures and accesses electronic communications products with the verification and approval of Comsec. 30
( 2 ) The head of an organ of state must, at the request of the Board and in the prescribed manner, submit to the Board an analysis of the electronic communications security needs of the organ of state under his or her administration.
(3) The Board must make its request six months after Comsec's incorporationl and thereafter in every second year. 35
(4) Expenditure on the procurement or accessing of electronic communications products by an organ of state which has not complied with a request contemplated in subsection ( 2 ) must be regarded as unauthorised expenditure for the purposes of the Public Finance Management Act, 1999 (Act No. 1 of 1999).
( 2 ) and if satisfied that Comsec should attend to the electronic communications security needs, enter into a business agreement with the relevant organ of state for the provisioning of the necessary services.
(6) Comsec may enter into business agreements to regulate its relationship with organs of state. 45
(5) The Board must. after having considered an analysis contemplated in subsection 40
CHAPTER 6
FINANCIAL MATTERS
Funding of Comsec
18. (1) Funding and capital to start operating Comsec must be obtained from funds
(2) The funds of Comsec consist of- agreed to betw en th Minister a d the Minister of Fi ance. 50
12 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LTD ACT, 2002
(a) monies received from Parliament as part of,the Vote of the Intelligence Services in terms of the Security Services Specld,Account Act, 1969 (Act No. 81 of 1969);
( b ) monies received for services provided as stipulated in the business agreements entered into with organs of state; 5
( e ) funds, finances and grants contemplated in subsection (7); (d) donations and bequests contemplated in subsection (8).
(3) The rates used for determining the cost of service must be reasonably market
(4) Comsec must perform its functions in an efficient and cost-effective manner. 10 (5) The Board must prepare a strategic plan which it must use as a basis for
recommending to the Minister how excess funds may be retained and used by the Board. (6) Payment for services provided by Comsec to an organ of state must be made in
accordance with the business agreement between the parties. ( 7 ) The Minister may. after a request from Comsec, request special funding or any 15
other special financial arrangement, including government grants, for the effective functioning of Comsec from the Minister of Finance. . (8) Comsec may. with the approval of the Minister, accept donations and bequests, subject to the Public Finance Management Act, 1999 (Act No. 1 of 1999).
audited annually by the Auditor-General in accordance with the Security Services Special Account Act, 1969 (Act No. 81 of 1969).
(10) The Chief Executive Officer must, at the end of each financial year, submit the report of the Auditor-General and the annual report compiled in accordance with the Public Finance Management Act, 1999 (Act No. 1 of 1999), to the Minister and the joint 25 standing committee for consideration.
( 1 1 ) Comsec may acquire shares in any other company registered in the Republic in terms of the Companies Act.
related and periodically approved by the Minister of Finance.
(9) The books and records of accounts and financial statements of Comsec must be 20 e'
CHAPTER 7
GENERAL 30
Intellectual property
19. ( I ) Notwithstanding the provisions of any other law, all intellectual property rights in any product, service, item, method or any other thing of any nature relating to secure communications technology or systems developed, designed or invented as contemplated in section 7(2) by Comsec or its employees, vest in Comsec. 35
(2) The Board must direct how the product, service, item, method or any other thing of any nature contemplated in subsection (1) is to be utilised by Comsec in the achievement of its objective.
Exemption from application of this Act
20. ( 1 ) The Minister may, at the request of an organ of state, exempt such organ of 40 state from the application of this Act if the exemption will not compromise national security.
(2) The request contemplated in subsection (1) must be fully motivated.
Critical electronic communications infrastructure
21. (1) Comsec must for its own account provide protection to critical electronic 45 communications infrastructure, such as computer systems and programmes of organs of state.
(2) Comsec must coordinate research and development regarding any security risk that may arise in relation to critical electronic communications infrastructure.
(3) The Minister may, on the recommendation of Comsec, identify critical 50 communications infrastructure and request Comsec to provide the necessary protection.
14 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LID ACT, 2002
Regulations
22. ( 1 ) The Minister may, after consultation with the 7 joint standing committee, make regulations regarding-
(a) functions consistent with this Act to be performed by Comsec; (b) the conditions forthe appointment of directors to he B ard; 5 (c) security requirements with regard to electronic ommunications of the
(4 conditions of employment and any other benefits of employees of Comsec, on
( e ) labour relations of the employees of Comsec; 10 cf, transitional arrangements consistent with this Act with regard to the
(g) any other matter that the Minister may consider necessary to prescribe in order
(3) A regulation made under this Act may provide that any person who contravenes a 15
different organs of state;
the advice of the Board;
implementation of this Act; and
to achieve the objects of this Act,
provision thereof, or fails to comply therewith, is guilty of an offence and on conviction liable to a fine or to imprisonment for a period not exceeding five years.
Offences and penalties
23. (1) Any person is guilty of an offence if he or she- (a) interferes or tampers with any electronic communications system or product 20
(h ) contravenes section 17(1) or ( 2 ) ; (c) not being a director or employee of Comsec, by word, conduct or demeanour
(dl being a director or employee of Comsec, omits to carry out his or her duty or 25
of an organ of state;
pretends that he or she is a director or employee of Comsec;
performs an act in conflict with his or her duty. ( 2 ) Any person convicted of an offence in terms of this Act is liable, in the case of
(a) subsection (I)(a), to a fine or to imprisonment for a period not exceeding 10
(h ) subsection (l)(b). (c) or (d), to a fine or to imprisonment for a period not
contravention of-
years; and 30
exceeding one year.
Limitation of liability
24. The Minister, Comsec or any of its employees is not liable for anything done in good faith in terms of furthering the objectives of this Act, unless that act constituted 35 gross negligence.
Savings and liabilities
25. ( 1 ) All assets, liabilities. rights and duties, including funds, resources and administrative records, of an entity or establishment of the State which ceases to exist by virtue of an integration contemplated in section 7(3) vest upon such integration in 40 Comsec, and must be regarded to have been acquired or incurred by Comsec in t rms of this Act.
( 2 ) The registrar of deeds must, upon production to him or her of a certificate by the Minister that immovable property described in the certificate vests in Comsec by virtue of subsection ( I ) , make the necessary entries and endorsements in or on any relevant 45 register, title deed or other document in his or her office, so as to give effect to that subsection.
(3) No duty, office fee or any other charge is payable in respect of any entry or endorsement made in terms of subsection (2) .
(4) Disciplinary proceedings instituted prior to the commencement of this Act and not 50 yet completed when this Act took effect, must be concluded in terms of the law under which the proceedings were instituted.
16 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LTD ACT, 2002
Amendment of laws T
26. The laws mentioned in the first column of Schedule 1 are hereby amended to the extent set out in the third column of that Schedule.
Short title and commencement t
27. This Act is called the Electronic Communications Security (Pty) Ltd Act, 2002, 5 and comes into operation on a date determined by the President by proclamation in the Gazette.
18 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT, 2002
SCHEDULE 1 7 ?
(Section 26)
LAWS AMENDED
(0. and-vear of Act ict No. 81 of 1969
k t No. 83 of 1982
Act No. 66 of 1995
ihort title iecurity Services Special iccount Act, 1969
Protection of Information Act. 1982
Labour Relations Act, 1995
3xtent of repeal or amendment 1. The amendment of section 2 by he substitution for paragraph (a) )f the following paragraph:
“(a) the performance of the ’unction and the duty of the Na- .ional Intelligence Agency and he South African Secret Service 1s referred to in the National Strategic Intelligence Act, 1994,
md” . 2. The substitution for section 5 3f the following section:
“Investment of balances
5. Moneys standing to the :redit of the account which are not required for immediate use or as a reasonable working balance, may be invested in such manner as may be determined by the President [Executive Deputy President] or Minister respon- sible for the National Intelligence Agency, [or] the South African Secret Service or Comsec with the concurrence of the Minister of Finance.”. 1. The amendment of section 1 b) the substitution for the definition of “security matter” of the fol- lowing definition: “ ‘security matter’ includes any matter which is dealt with by Comsec as defined in section 1 of the Electronic Communications Security (Pty) Ltd Act, 2002, or the Agency or the Service as de- fined in section l of the Intelli- gence Services Act, 1994, or which relates to the functions of Comsec or that Agency or Ser- vice or to the relationship existin! between any person and Comsec - or that Agency or Service.”.
1. The amendment of section 2 b the deletion in paragraph (b) of the word “and”, and by the addi. tion of the following paragraph: “ (d) Comsec.”.
20 No. 24356 GOVERNMENT GAZETTE, 6 FEBRUARY 2003
Act No. 68,2002 ELECTRONIC COMMUNICATIONS SECURITY (PN) LTD ACT, 2002
Vo. and year of Act ict No. 75 of 1997
c
4ct No. 55 of 1998
ihort title 3asic Conditions of Employment k t , 1997
3mployment Equity Act, 1998
Extent of repeal or amendment I. The amendment of the defini- tion of “public service” in sec- tion 1 by the deletion in para- graph (b) of the word “and”, and by the addition of the following paragraph: “ ( d ) Comsec.”.
2 . The amendment of subsection [l)(a) in section 3 by the deletion 3f the second “and”, and by the addition of the following para- graph: “(cj the directors and staff of
Comsec.”.
1. The amendment of the defini- tion of “public service” in sec- tion 1 by the deletion in para- graph (b) of the word “and”, and by the addition of the following paragraph: “ ( d ) Comsec.”.
2. The amendment of section 4 by the substitution for subsection (3) of the following subsection:
“(3) This Act does not apply to members of the National Defence Force, the National Intelligence Agency or the South African Se- cret Service or to the directors and staff of Comsec.” .
- -