Provision of Real-time Lawful Interception Assistance

FRAMEWORK LAW NO. 013-2002 ON TELECOMMUNICATIONS

Articles 54(a) and 55 of the Framework Law No. 013-2002 of 16 October 2002 on telecommunications in the Democratic Republic of Congo (DRC) (Framework Law) provides for the interception of communications in two scenarios: firstly in the context of judicial cases where an authorisation has been granted by the Attorney General of the Republic (‘Attorney General’); and secondly interceptions authorised by the Minister of the Interior in relation to national security, protection of the essential elements of the scientific, economic and cultural potential of the country, or the prevention of crime and organised crime.

Article 54(a) of the Framework Law prohibits the interception, phone-tapping, recording, transcription and disclosure of correspondence issued by telecommunications without prior permission of the Attorney General. Article 55 of the Framework Law stipulates that for the purpose of providing evidence in a court of law, it is necessary for the Attorney General to order the interception, recording and transcription of correspondence transmitted through telecommunications.

Article 59 of the Framework Law requires that interceptions authorised by the Minister of the Interior must have a purpose to:

i. seek information relating to national security;

ii. protect the essential elements of the cultural, scientific or economic potential of the DRC; or

iii. prevent crime and organised crime.

Disclosure of Communications Data

Article 13 of the Standard Licence for the provision of mobile communications services based on GSM technology provides that each telecommunication company shall submit information on a monthly basis to the Authority for Regulation concerning:

• the number of subscribers at the end of each month;
• the average call time;
• the total number of billing items;
• the number of calls from mobile telephones to fixed-line telephones, and from fixed-line telephones to mobile telephones;
• the disconnection rate;
• the BSC-number dynamics;
• the quantity and RF channel number via BTS; and
• the BTS number dynamics.

THE FRAMEWORK LAW

Article 52 of the Framework Law provides that the secrecy of correspondence transmitted through communications is guaranteed by law in the DRC. The confidentiality of correspondence can only be lifted in cases where it is strictly in the public interest as provided by the law.

Article 53 of the Framework Law reinforces this by stating that the public operator of telecommunications and other telecommunications service providers and members of their staff are required to respect the secrecy of customers’ communications.

Article 4 of Law No. 014-2002 creating the Regulatory Authority for Post and Telecommunications of Congo, (ARPTC Law) states that the Regulatory Authority can conduct site visits, conduct investigations and studies, and collect all the necessary data required for this purpose.

National Security and Emergency Powers

The Framework Law gives the government powers to requisition telecommunications facilities for reasons of public security.

Paragraph 3 of Article 46 of the Framework Law stipulates that any employees of telecommunications facilities that are requisitioned may be required to provide their services to the competent authority.

For the purpose of public security or defence of the national territory or in the interest of the public service of telecommunications, the State may prohibit all or part of the use of telecommunications during a period that it may determine.

If Article 46 is not complied with, then the Decree Law No. 1-61 of 25 February 1961 regarding measures of state security, right of search, internment and surveillance together with its accompanying Ministerial Order 05/02 of 22 April 1961 can be applied. Article 4 of this Decree Law establishing measures of state security, right of search, detention and surveillance (Decree Law on the National Security) specifies that any violence or act likely to prevent or impede the search pursuant to the provisions of the Decree shall constitute a presumption of guilt.

These powers are reserved for use in exceptional circumstances, such as emergencies.

Oversight of the Use of Powers

The authorisation of the Attorney General applies for a maximum period of six months unless renewed. The authorising decision for interception by the Attorney General should include the reasoning for the use of interception, the offence leading to the use of the interception and its duration (Article 56 of the Framework Law).

This authorisation of the Minister of the Interior shall be given in writing and by justifiable decision. The authorisation must be proposed by the Minister of Defence and security or by the Head of the Intelligence Services (Article 60 of the Framework Law).

Any breach of Article 52 of the Framework Law constitutes an offence in respect to Criminal Code in the DRC.

Censorship-related Powers

SHUT-DOWN OF NETWORK AND SERVICES

Telecommunications Framework Law No.013/2002

Article 46 of the Telecommunications Framework Law No.013/2002 provides that the State may prohibit the use of telecommunication facilities (such as Vodacom’s network), in full or in part, for any period of time, as it deems fit, in the interests of public security or national defence, the public telecommunications service, or for any other reason.

More generally, under Article 42 and 50, the government may revoke (temporarily or permanently) the licence of a telecommunications operator (such as Vodacom) if the operator does not comply with the conditions of its licence; does not comply with the legislation in force; or refuses to grant access to its network facilities to officers of the Criminal Investigation Department (who are responsible for investigating breaches of the law) when such access is requested. Under Article 43, the government may also withdraw an operator’s licence if the telecommunications operator becomes wholly owned by foreign nationals. If the government were to withdraw Vodacom’s licence, this would in effect shut-down Vodacom’s network.

Ministerial Decree No.003/CAB/MIN/PTT/K/2000

In addition, Ministerial Decree No. 003/CAB/ MIN/PTT/K/2000 dated 31 January 2000 allows the Ministry of Telecommunications to suspend the services of the network operator (in full or in part) pursuant to the order of a public authority. If needed, the public authorities and, in particular, the Ministry of Defence can ‘requisition the network’ without giving rise to any claim for compensation. This Ministerial Decree is superseded by the Telecommunications Framework Law No. 013/2002.

However, it is considered relevant to licences issued before the passing of the Telecoms Framework Law No. 013/2002.

Constitutional Powers

Article 85 of the Constitution provides that the President of the Republic may declare a state of emergency or state of war when circumstances threaten seriously and immediately the independence or the integrity of the national territory, or when they cause the interruption of the normal functioning of institutions. The President may only do so after consultation with the Prime Minister and the presidents of the two Parliament chambers. Such a declaration is done by Decree and will last for 30 days’ duration, which may be extended by the Parliament for successive periods of 15 days. Certain additional powers are enabled during such a period which may extend to ordering the shut-down of a network such as Vodacom’s. However, in practice, Article 46 of the Telecommunications Framework Law No. 013/2002 is more likely to be relied upon, given the breadth and strength of its powers.

BLOCKING OF URLS & IP ADDRESSES

Telecommunications Framework Law No.013/2002

Given the nature of the powers provided under Article 46 of the Telecommunications Framework Law No. 013/2002 – in particular those described directly below under ‘Power to take control of Vodacom’s network’, it is feasible that the government might order, or implement, the blocking of URLs and IP addresses on Vodacom’s network.

POWER TO TAKE CONTROL OF VODACOM’S NETWORK

Telecommunications Framework Law No.013/2002

With the powers provided for under Article 46 of the Telecommunications Framework Law No. 013/2002 (please see above under ‘Shut-down of network and services’), the State may also requisition (or order its officials to requisition) telecommunication facilities. In such instances, the personnel normally working at these facilities may be required to provide their services to the competent authority, if so requested. This could, in effect, mean that the government could take control of Vodacom’s network, requiring Vodacom staff to operate the network on its behalf.

Oversight of the Use of Powers (Censorship-related)

TELECOMMUNICATIONS FRAMEWORK LAW NO.013/2002

There are a posteriori (after the event) possibilities for judicial oversight and the annulment of illegal use of powers with respect to the Telecommunications Framework Law 2002.

The Supreme Court may be seized of an action for annulment for excess use of power in respect of any administrative decisions issued by central government authorities on the grounds of incompetence, defect, violation of the law or misappropriation of power and procedure. These are grounds that individuals may invoke to obtain the annulment of an illegal order to shut down a network or services.

CONSTITUTIONAL POWERS

The Constitutional Court was installed in 2013 but became operational in 2015. It is responsible for monitoring the constitutionality of laws and acts having the force of law. Appeals may also be effected against the unconstitutional use of power by the administrative authorities, making such use of power invalid or unenforceable.

Encryption and Law Enforcement Assistance

1. Does the government have the legal authority to require a telecommunications operator to decrypt communications data where the encryption in question has been applied by that operator and the operator holds the key?

No. The Framework Law (see ‘Provision of real-time lawful interception assistance’ earlier in this chapter for the full statutory citation) is sanctioned with penal provisions and, according to rules and principles of statutory interpretation applicable in the DRC, penal statutes are subject to strict construction. It is not allowed to resolve ambiguities of penal provisions with presumptions: the offence or the exception must clearly be stated in the law; ‘decryption’ is not stated in the law.

Furthermore, Article 52 of the Framework Law provides that the secrecy of correspondence transmitted through communications is guaranteed by law in the DRC. The confidentiality of correspondence can only be breached strictly in cases of the public interest as provided by the law. Article 53 of the Framework Law reinforces this by stating that the public operator of telecommunications and other telecommunications service providers and members of their staff are required to respect the secrecy of customers’ communications.

The legal intercept provisions set forth in clause 55 of the Framework Law do not clearly impose the obligation to decrypt on mobile network operators subjected to lawful intercept obligations. The only actions required under lawful intercept are interception, recording and transcription.

2. Does the government have the legal authority to require a telecommunications operator to decrypt data carried across its networks (as part of a telecommunications service or otherwise) where the encryption has been applied by a third party?

No. For the reasons set out in Question 1 above.

3. Can a telecommunications operator lawfully offer end-to-end encryption on its communications services when it cannot break that encryption and therefore could not supply a law enforcement agency with access to cleartext metadata and the content of the communication on receipt of a lawful demand?

A telecommunications operator can offer end-to-end encryption on its communication service without breaching its existing law enforcement obligations. However, a telecommunications operator would need to obtain authorisation (ie, a licence) for the supply of the service from the Regulatory Authority in accordance with the Framework Law. Article 34 of the Framework Law provides that ‘cryptology services’ means any and all services aimed at transforming, using secret keys, intelligible information or signals into information or signals that are unintelligible for third parties, or vice versa, using hardware or software specifically designed for this purpose. Article 35 of the Framework Law provides that to protect the State’s internal and external security and national defence interests, the provision, operation and use of cryptology tools or services are governed by: (1) the prior declaration regime if the tools or service can only be used to authenticate a communication or check the integrity of the message transmitted; and (2) the authorisation regime, with a written consultation of the Ministries responsible for national defence and internal security, in all other cases.

4. Please provide examples in this jurisdiction where legislation which predated the advent of commercial encryption (which Vodafone estimate to be circa 1990) has been applied to contemporary cases involving encryption.

No such legal precedents exist.