Malicious communications

With the commencement of the Cybercrimes Act on the 1^st of December, it is now a crime to send WhatsApp and other messages, and to create social media posts that threaten to harm others, or which result in violence or damage to property. 

South Africa’s cybersecurity legislation is now largely in line with global standards governing the criminalisation of cybercrime. This follows the proclamation of the commencement of most of the sections of the Cybercrimes Act No. 19 of 2020 (the Act) by President Cyril Ramaphosa on the 30 November 2021.[1],[2] Along with key provisions of the Protection of Personal Information Act (POPIA) governing data security which were implemented on 1^st July, they address issues around data protection, privacy, abuse, and attack.

Not a moment too soon, when considering how social media was used by “influencers” to fan the unrest and looting in July.  The Act categorises certain actions as criminal offences, for which penalties include substantial fines and imprisonment of up to 15 years or both for guilty parties.

The wide definition of data message tomean “data generated, sent, received or stored by electronic means, where any output of the data is in an intelligible form”; therefore, includes messages sent by SMS, WhatsApp, Twitter, Facebook, Instagram, online videos, other messaging, and networking or social media platforms i.e., virtually all messages. While the circle to address the context, content, consequences, and to punish guilty parties is closed by Part II: Malicious Communications of the Act.

Of note is the definition of “disclosing” a data message to include, not only sending the entire message, or only a link to it, but by merely storing it on a network where it can be viewed, copied or downloaded. The incitement to damage property or by threatening damage to property includes corporeal and incorporeal property, while the communications include not only specific individuals, but those connected to them such as family and to groups of people who share identifiable characteristics – “without limitation”.  Unlike section 17 of the Riotous Assemblies Act No. 17 of 1956, however, where intention is not a requirement for incitement to public violence, it is a requirement here.

Sections 13 to 15 read as follows:

PART II: MALICIOUS COMMUNICATIONS

Definitions

13. In Part II, unless the context indicates otherwise—

‘‘damage to property’’ means damage to any corporeal or incorporeal property;

‘‘disclose’’ in respect of a data message referred to in sections 14, 15 and 16, means
to—

1. send the data message to a person who is the intended recipient of the electronic communication or any other person;
2. store the data message on an electronic communications network, where the data message can be viewed, copied or downloaded; or
3. send or otherwise make available to a person, a link to the data message that has been stored on an electronic communication network, where the data message can be viewed, copied or downloaded;

‘‘group of persons’’ means characteristics that identify an individual as a member of a group, which characteristics include without limitation, race, gender, sex, pregnancy, marital status, ethnic or social origin, colour, sexual orientation, age, disability, religion, conscience, belief, culture, language, birth or nationality;

‘‘related person’’ means any member of the family or household of a person or any other person in a close relationship with that person; and

‘‘violence’’ means bodily harm.

Data message which incites damage to property or violence

14. Any person who discloses, by means of an electronic communications service, a data message to a person, group of persons or the general public with the intention to incite—

1. the causing of any damage to property belonging to; or
2. violence against,

a person or a group of persons, is guilty of an offence.

Data message which threatens persons with damage to property or violence

15. A person commits an offence if they, by means of an electronic communications service, unlawfully and intentionally discloses a data message, which—

(a) threatens a person with—

1. damage to property belonging to that person or a related person; or
2. violence against that person or a related person; or

(b) threatens a group of persons or any person forming part of, or associated with, that group of persons with—

1. damage to property belonging to that group of persons or any person forming part of, or associated with, that group of persons; or
2. violence against the group of persons or any person forming part of, or

associated with, that group of persons, and a reasonable person in possession of the same information, with due regard to all the circumstances, would perceive the data message, either by itself or in conjunction with any other data message or information, as a threat of damage to property or violence to a person or category of persons contemplated in paragraph (a) or (b), respectively.

[1] Assented: Government Gazette Notice No. 321 of 1 June 2021
[2] Proclamation: Government Gazette Notice No.R.42 of 30 November 2021