Electronic Communications Security Pty Ltd Act

1. In this Act, indicates- otherwise context the unless “Board” means the Board of Directors of Comsec contemplated in section 8; “Chief Executive Officer” means the Chief Executive Officer contemplated in section 13; “communication” means communication as defined in an regulation for the providing “Companies Act” means the Companies Act, 1973 (Act No. 61 of 1973); “Comsec” means Electronic Communications Security (Pty) Ltd established section 2; “critical electronic communications” means electronic communications held by organs of state which are necessary for the protection of the national security of the 15 Republic; “critical electronic communications infrastructure” means electronic communica- tions products or systems used to transmit and store or transmit or store critical electronic communications; “Intelligence Services” means the Intelligence Services as contemplated in an Act 20 of Parliament providing therefor; “joint standing committee” means the Joint Standing Committee on Intelligence established by section 2 of the Intelligence Services Control Act, 1994 (Act No. 40 of 1994); “Minister” means the Minister as defined in an Act of Parliament providing for the 25 Intelligence Services; “organ of state” means an organ Constitution; “prescribe” means prescribe by regulation; “telecommunication service provider” means a telecommunication service pro- 30 vider as defined in an Act of Parliament providing for the regulation of interception of communications; “this Act” includes the regulations. of state as defined in section 239 of the Establishment of Comsec

2. There is hereby established a juristic person to be known as Electronic 35 Communications Security (Pty) Ltd. 4 GAZETTE. GOVERNMENT No. 24356 6 FEBRUARY 2003 Act No. 68. 2002 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT. 2002 Principal objective of Comsec

3. The principal objective of Comsec is to ensure that critical electronic communi- cations are protected and secure. Incorporation of Comsec 4. ( 1 1 The Minister must effect the incorporation of Comsec in terms of the 5 Companies Act. ( 2 ) Notwithstanding the Companies Act or any other law, the State is the sole shareholder of Comsec. ( 3 ) Notwithstanding the Companies Act. the Minister or a person designated by him or her must. on behalf of the State. sign the memorandum and articles of association and 10 all other documents necessary for the incorporation of the company. ( 4 ) The Registrar of Companies must- ( a / register the memorandum and subsection (3 ): articles of association as signed in terms of Ih) incorporate the company as a private cornpan)' under the name "Electronic 15 (c) Communications Security (Pty) Ltd": and issue to the company a certificate to commence business with effect from the date of the company's incorporation. Provision of Companies Act not applicable to Comsec under certain circumstance

5. A provision of the Companies Act does not apply to Comsec where the Minister of 20 Trade and Industr?. has issued a declaration under section 6. Request for exemption from application of provision of Companies Act 6. i 1 ( a ) The Minister may. on the recommendation of Comsec, request the Minister of Trade and Industry to declare the whole or part of a provision of the Companies Act not applicable to Comsec. 35 (Dl The request must be fully motivated. ( 2 ) The Registrar of Companies must publish particulars about the request and motivation contemplated publication will compromise national security. in subsection ( 1 ) by notice in the Gazette, unless such ( 3 ) The Minister of Trade and Industry may, by notice considered the request contemplated grounds that the non-application of the provision of the Companies Act will- in the Gazette, after having in subsection (1) and if satisfied on reasonable to Comsec ( N ) contribute to the efficient!, of Comsec and reduce its operating costs; ( h i not reduce or limit the accountability of Comsec as a public institution or detract from the requirements of transparencv regarding its functioning and operations: and ( c / not be detrimental to the interests of the State. employees of Comsec or claims of creditors of Comsec. 30 35 declare. with effect from the date stated in the notice, the whole or part of a provision of the Companies Act not applicable to Comsec. 40 Functions 7. ( 1 ) The functions of Comsec are to- ( a ) protect and secure critical electronic communications against unauthorised access or technical. electronic or any other related threats; 45 ( b ) provide. with the concurrence of the National Intelligence Agency defined in 1994 (Act No. 38 of 1994), section 1 of the Intelligence Services Act. verification services for electronic communications security systems, prod- ucts and services dsed by organs of state; ( c ) provide and co-ordinate research and development with regard to electronic 50 communications security systems, products, services and any other related services; ( d ) perform any other function not inconsistent with this Act that is necessary for the effective functioning of Comsec. " ( 2 ) For purposes of the functions contemplated in subsection ( l ) , Comsec must- 55 6 No. 24356 Act No. 68,2002 GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT, 2002 5, ( a ) develop, design, procure, invent, install or. maintain secure electronic communications systems or products and do research in this regard; (b) provide secure electronic communications services, systems and products; ( c ) provide cryptographic services; (d) train and support users of the electronic communications systems, products 5 and related services; and ( e ) provide consultancy services on the security and protection of electronic communications services, systems and products. (3) Subject to applicable labour law, Comsec may, with the approval of the Minister acting with the concurrence of the Minister responsible for an entity or establishment of 10 the State which performs duties similar to those referred to in subsection ( 2 ) , integrate such an entity or establishment into Comsec. (4) Comsec may cooperate with any organisation in the Republic or elsewhere to achieve its objectives. ( 5 ) Comsec, the members of its Board and its employees must, in the performance of 15 -their functions in terms of this Act, comply with the policies and regulations relating to security of communications made in terms of the National Strategic Intelligence Act, 1994 (Act No. 39 of 1994). (6) The head of a telecommunication service provider must. at the request of Comsec and at Comsec’s expense, render such assistance as may be necessary for the execution 20 of the functions of Comsec contemplated in this section. ( 7 ) Comsec is exempted from the licensing requirements contemplated in- ( a ) the Broadcasting Act, 1999 (Act No. 4 of 1999); and ( b ) the Telecommunications Act, 1996 (Act No. 103 of 1996). CHAPTER 2 25 GOVERNANCE OF COMSEC Board of Directors 8. ( 1 ) Comsec must be managed and controlled in accordance with this Act by a Board of Directors appointed by the Minister after consultation with Cabinet. ( 2 ) The business and operational plans of Comsec must be approved by the Board 30 with the concurrence of the Minister. (3) The Board represents Comsec. Composition of Board 9. ( 1 ) The Board is made up of not more than nine members of whom- chairperson; ( a ) one is the non-executive (bi not more than four are executive directors, one of whom must be designated 35 by the Minister as the Chief Executive Officer: and ( c i the rest are additional non-executive members, consisting of persons approved by the Minister on the basis of relevant expertise. ( 2 ) A majority of the members of the Board forms a quorum at any meeting of the 40 Board. (3) On an equality of votes in any meeting of the Board, the chairperson has a casting vote in addition to a deliberative vote. Terms of office of members of Board 10. (1 ) A non-executive member ( a ] holds office for a period of three years which the Minister may extend for of the Board- 45 further periods of three years each or such shorter periods as the Minister may determine; ( b ) serves on the terms and conditions determined by the Minister and specified in the letter of appointment of the and member; (c) may resign by giving three months’ written notice to the Minister or 50 as and appointment; stipulated in the letter of appointment. (2) An executive member of the Board- f a ) holds office for a period determined by the Minister in the letter of 55 8 No. 24356 Act No. 68,2002 GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (I") LTD ACT, 2002 (b) may resign by giving three months' written notice to the Minister or as stipulated in the letter of appointment. (3) The names of the Board members may be kept confidential. Remuneration of members of Board

11. Amember of the Board, except the executive directors and any appointed member 5 who holds a post or office in the Public Service or any institution, organisation or body established by or under any other law and funded wholly or partly by the State, may be remunerated on a daily basis at a rate determined by the Minister with the concurrence of the Minister of Finance. office from Removal

12. The Minister may in the prescribed manner remove any member from office on the grounds of misconduct, incompetence or incapacity or failure of the Board to ~ obtain the necessary security clearance. CHAPTER 3 CHIEF EXECUTIVE OFFICER 10 15 Functions of the Chief Executive Officer

13. The Chief Executive Officer is responsible for the administration and the general management and control directions and instructions issued by the Board. of the day-to-day functioning of Comsec, subject to the Employment of personnel 14. (1) The Chief Executive Officer must appoint the employees of Comsec, subject to such remuneration, allowances and service benefits as the Board may determine. ( 2 ) In filling posts, the evaluation competence. knowledge and the need achieve a staff complement broadly representative of the South African population, according to race, gender and disability. of persons must be based on training, skills, to redress the imbalances of the past, so as to (3) The Minister or any other Minister may, at the request of Comsec, second an employee to Comsec in accordance with an Act Intelligence Services or section 15(3) of the Public Service Act, 1994 (Proclamation No. 103 of 1994), as of Parliament providing for the 20 25 30 (4) For as long as an employee is seconded to Comsec, Comsec must reimburse the by such department to the relevant department for the remuneration and allowances paid employee, and for any other expenditure arising from the secondment of that employee. Employment of employees of Security Services be. may case the 15. (1) Any employee involved in an electronic communications security function in 35 in Chapter 11 of the security services contemplated in any establishment or entity contemplated in section 7(3), may be made an employment offer by Comsec. the Constitution, or ( 2 ) ( a ) The remuneration, benefits and privileges offered by Comsec may not be less than those payable to the employee by the previous employer immediately prior to his 40 or her transfer. (b) Prior to the transfer of an employee, an agreement must have been reached between the employer, Comsec and the Minister, and with the concurrence Minister of Finance, where applicable- of the (i) as to whether accrued leave and sick leave should be wholly or partially 45 carried over to Comsec; (ii) as to whether the monetary value of such benefits should be payable wholly or partially to the employee prior to transfer; and Comsec. by portion which (iii) as to which portion of the costs of the transferred benefits is to be carried by and employer the 50 I - approval and 10 No. 24356 Act No. 68,2002 GOVERNMENT GAZEITE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LTD ACT, 2002 r, (3) The agreement contemplated in subsection (2)(b):must also deal with any other existing contractual obligation between the employer and the employee. (4) An offer contemplated in subsection (1) may only be made to employees who are in the service of the respective employers when the offer is made. (5) An employee who accepts the offer Contemplated in subsection (1) is not entitled 5 to any ,voluntary severance package. (6) An officer who is a member of Government Employees Pension Fund and who is employed by Comsec may- ( a ) choose to become a dormant member of such Fund, and from the date of exercising such choice the officer must, despite the provisions of any other 10 law, be regarded to be a dormant member of the Fund; ( 6 ) choose to remain a member of the Fund, in which case Comsec is responsible for the employer's contribution to the Fund; (ci request to become a member of any other registered pension fund, and withdraw from the Government Employees Pension Fund in accordance with 15 the Government Employees Pension Law, 1996 (Proclamation 1996). No. 21 of CHAPTER 4 SECURITY MATTERS Security clearance

16. No person may be appointed as a member of the Board or as an employee of Comsec without a security clearance certificate issued by the National Intelligence Agency in accordance with the National Strategic Intelligence Act, 1994 (Act No. 39 of 1994). CHAPTER 5 SERVICE DELIVERY Analysis of electronic communications security needs, and business agreement I I 20 25 17. (1) The head of an organ of state must ensure that the organ of state under his or her administration procures and accesses electronic communications products with the verification of Comsec. 30 ( 2 ) The head of an organ of state must, at the request in the prescribed manner, submit to the Board an analysis of the electronic communications security needs of the organ of state under his or her administration. of the Board and 35 year. second thereafter in every (3) The Board must make its request six months after Comsec's incorporationl and (4) Expenditure on the procurement or accessing of electronic communications products by an organ of state which has not complied with a request contemplated in subsection ( 2 ) must be regarded as unauthorised expenditure for the purposes Public Finance Management Act, 1999 (Act No. 1 of 1999). of the (5) The Board must. after having considered an analysis contemplated in subsection 40 ( 2 ) and if satisfied that Comsec should attend to the electronic communications security needs, enter into a business agreement with the relevant organ provisioning of the necessary services. of state for the (6) Comsec may enter into business agreements to regulate its relationship with 45 organs of state. CHAPTER 6 FINANCIAL MATTERS Funding of Comsec 18. (1) Funding and capital to start operating Comsec must be obtained from funds Finance. the of between Minister the agreed and Minister to (2) The funds of Comsec consist of- 50 12 No. 24356 Act No. 68,2002 GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LTD ACT, 2002 ( a ) monies received from Parliament as part of,the Vote of the Intelligence Services in terms of the Security Services Specld,Account Act, 1969 (Act No. 81 of 1969); ( b ) monies received for services provided as stipulated in the business agreements organs with into entered of state; 5 ( e ) funds, finances and grants contemplated in subsection (d) donations and bequests contemplated in subsection (8). (7); (3) The rates used for determining the cost of service must be reasonably market related and periodically approved by the Minister of Finance. (4) Comsec must perform its functions (5) The Board must prepare a strategic plan which as a basis for recommending to the Minister how excess funds may be retained and used by the Board. (6) Payment for services provided by Comsec to an organ of state must be made in it must use in an efficient and cost-effective manner. 10 accordance with the business agreement between the parties. ( 7 ) The Minister may. after a request from Comsec, request special funding or any 15 for the effective other special financial arrangement, including government grants, functioning of Comsec from the Minister of Finance. . (8) Comsec may. with the approval of the Minister, accept donations and bequests, subject to the Public Finance Management Act, 1999 (Act No. 1 of 1999). (9) The books and records of accounts and financial statements of Comsec must be 20 e' audited annually by the Auditor-General in Special Account Act, 1969 (Act No. 81 of 1969). accordance with the Security Services (10) The Chief Executive Officer must, at the end of each financial year, submit the in accordance with the report of the Auditor-General and the annual report compiled Public Finance Management Act, 1999 (Act No. 1 of 1999), to the Minister and the joint 25 standing committee for consideration. ( 1 1 ) Comsec may acquire shares in any other company registered in the Republic in terms of the Companies Act. CHAPTER 7 GENERAL 30 Intellectual property 19. ( I ) Notwithstanding the provisions of any other law, all intellectual property rights in any product, service, item, method or any other thing of any nature relating to secure communications technology or systems developed, designed or invented as contemplated in section 7(2) by Comsec or its employees, vest in Comsec. 35 (2) The Board must direct how the product, service, item, method or any other thing by Comsec in the in subsection (1) is to be utilised of any nature contemplated achievement of its objective. Exemption from application of this Act 20. ( 1 ) The Minister may, at the request of an organ of state, exempt such organ of 40 state from the application of this Act if the exemption will not compromise national security. (2) The request contemplated in subsection (1) must be fully motivated. Critical electronic communications infrastructure 21. (1) Comsec must for its own account provide protection to critical electronic 45 communications infrastructure, such as computer systems and programmes of organs of state. (2) Comsec must coordinate research and development regarding any security risk that may arise in relation to critical electronic communications infrastructure. (3) The Minister may, on the recommendation of Comsec, identify critical 50 communications infrastructure and request Comsec to provide the necessary protection. 14 No. 24356 Act No. 68,2002 Regulations GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LID ACT, 2002 22. ( 1 ) The Minister may, after consultation with the 7 joint standing committee, make regulations regarding- ( a ) functions consistent with this Act to be performed by Comsec; (b) the conditions for the appointment (c) security requirements with regard different organs of state; of directors to the Board; to electronic communications of the (4 conditions of employment and any other benefits of employees of Comsec, on the advice of the Board; of the employees ( e ) labour relations cf, transitional arrangements consistent with implementation of this Act; and of Comsec; this Act with regard to the 5 10 (g) any other matter that the Minister may consider necessary to prescribe in order to achieve the objects of this Act, (3) A regulation made under this Act may provide that any person who contravenes a 15 provision thereof, or fails to comply therewith, is guilty of an offence and on conviction liable to a fine or to imprisonment for a period not exceeding five years. Offences and penalties 23. (1) Any person is guilty of an offence if he or she- ( a ) interferes or tampers with any electronic communications system or product 20 of an organ of state; ( h ) contravenes section 17(1) or (c) not being a director or employee of Comsec, by word, conduct or demeanour ( 2 ) ; pretends that he or she is a director or employee of Comsec; (dl being a director or employee of Comsec, omits to carry out his or her duty or 25 performs an act in conflict with his or her duty. ( 2 ) Any person convicted of an offence in terms of this Act is liable, in the case of contravention of- ( a ) subsection (I)(a), to a fine or to imprisonment for a period not exceeding 10 years; ( h ) subsection (l)(b). (c) or (d), to a fine or to imprisonment for a period and 30 not exceeding one year. Limitation of liability

24. The Minister, Comsec or any of its employees is not liable for anything done in good faith in terms of furthering the objectives of this Act, unless that act constituted gross negligence. 35 Savings and liabilities 25. ( 1 ) All assets, liabilities. rights and duties, including funds, resources and administrative records, of an entity or establishment of the State which ceases to exist by virtue of an integration contemplated in section 7(3) vest upon such integration Comsec, and must be regarded to have been acquired or incurred by Comsec this Act. in terms of in 40 ( 2 ) The registrar of deeds must, upon production to him or her of a certificate by the Minister that immovable property described in the certificate vests in Comsec by virtue of subsection ( I ) , make the necessary entries and endorsements in register, title deed or other document in his or her office, so as to give effect to that subsection. or on any relevant 45 (3) No duty, office fee or any other charge endorsement made in terms of subsection (2). is payable in respect of any entry or (4) Disciplinary proceedings instituted prior to the commencement of this Act and not 50 yet completed when this Act took effect, must be concluded in terms of the law under which the proceedings were instituted. 16 No. 24356 Act No. 68,2002 Amendment of laws GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (F'TY) LTD ACT, 2002 T

26. The laws mentioned in the first column of Schedule 1 are hereby amended to the extent set out in the third column of that Schedule. Short title and commencement t

27. This Act is called the Electronic Communications Security (Pty) Ltd Act, 2002, 5 and comes into operation on a date determined by the President by proclamation in the Gazette. 18 No. 24356 Act No. 68,2002 GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (PTY) LTD ACT, 2002 SCHEDULE 1 7 ? (Section 26) LAWS AMENDED (0. and-vear of Act ict No. 81 of 1969 ihort title iecurity Services Special iccount Act, 1969 k t No. 83 of 1982 Protection of Information Act. 1982 Act No. 66 of 1995 Labour Relations Act, 1995 3xtent of repeal or amendment

1. The amendment of section 2 by he substitution for paragraph ( a ) )f the following paragraph: “(a) the performance of the ’unction and the duty of the Na- .ional Intelligence Agency and he South African Secret Service 1s referred to in the National Strategic Intelligence Act, 1994, md” .

2. The substitution for section 5 3f the following section: “Investment of balances

5. Moneys standing to the :redit of the account which are not required for immediate use or as a reasonable working balance, may be invested in such manner as may be determined by the President [Executive Deputy President] or Minister respon- sible for the National Intelligence Agency, [or] the South African Secret Service or Comsec with the concurrence of the Minister of Finance.”.

1. The amendment of section 1 b) the substitution for the definition of “security matter” of the fol- lowing definition: “ ‘security matter’ includes any matter which is dealt with by Comsec as defined in section 1 of the Electronic Communications Security (Pty) Ltd Act, 2002, or the Agency or the Service as de- fined in section l of the Intelli- gence Services Act, 1994, or which relates to the functions of Comsec or that Agency or Ser- vice or to the relationship existin! between any person and Comsec - or that Agency or Service.”.

1. The amendment of section 2 b the deletion in paragraph (b) of the word “and”, and by the addi. tion of the following paragraph: “ ( d ) Comsec.”. 20 No. 24356 Act No. 68,2002 GOVERNMENT GAZETTE, 6 FEBRUARY 2003 ELECTRONIC COMMUNICATIONS SECURITY (PN) LTD ACT, 2002 Vo. and year of Act ict No. 75 of 1997 ihort title 3asic Conditions of Employment k t , 1997 c 4ct No. 55 of 1998 3mployment Equity Act, 1998 Extent of repeal or amendment I. The amendment of the defini- tion of “public service” in sec- tion 1 by the deletion in para- graph (b) of the word “and”, and by the addition of the following paragraph: “ ( d ) Comsec.”.

2. The amendment of subsection [l)(a) in section 3 by the deletion 3f the second “and”, and by the addition of the following para- graph: “(cj the directors and staff of Comsec.”.

1. The amendment of the defini- tion of “public service” in sec- tion 1 by the deletion in para- graph (b) of the word “and”, and by the addition of the following paragraph: “ ( d ) Comsec.”.

2. The amendment of section 4 by the substitution for subsection (3) of the following subsection: “(3) This Act does not apply to members of the National Defence Force, the National Intelligence Agency or the South African Se- cret Service or to the directors and staff of Comsec.” . - -