Botswana showcases e-government's privacy pitfalls

Image: g4ll4is used under CC BY 2.0 licence (https://flic.kr/p/dZ2y6b)

This article was originally published in Issue 2 of Southern Africa Digital Rights, an online publication produced under the project "The African Declaration on Internet Rights and Freedoms: Fostering a human rights-centred approach to privacy, data protection and access to the internet in Southern Africa".

Botswana’s venture into electronic government traces back to 2007 with the adoption of the Maitlamo Information and Communication Technology (ICT) Policy.[1] Since then, both digitisation and digitalisation [2] have been integral parts of government policy and have recently been highlighted as the third priority in the current government reset agenda.[3]

Former Deputy Permanent Secretary in charge of information and media, Dr. Jeff Ramsay, highlighted, “E-government was made a top government program in 2008, aligning with global trends.” [4] However, he lamented its limited progress, citing challenges due to conflicting visions and interests.

Nevertheless, there’s been consistent political discourse, as Nkwe notes, [5] indicating Botswana’s dedicated efforts toward promoting e-government. Sebina and Zulu [6] view e-government as a means to prioritize citizens. They refer to Carbo’s three phases for successful e-government: access to information, its effective utilization, and public trust in such information. These expectations could materialise with assured privacy and data protection, along with equitable access to digitisation, thereby ensuring full participation (digitalisation).

Bante et al., in a discussion paper titled ‘E-government and democracy in Botswana: Observational and experimental evidence on the effects of e-government usage on political attitudes’, provide what they call three mechanisms by which e-government may affect people’s attitudes towards government or the system. These they mention as, first, an ‘empowerment mechanism’, in which issues of accessibility and citizen empowerment are realised; second, an ‘appeasement mechanism’, in which e-government may bloat citizens’ satisfaction with the government; and, lastly, an ‘equal treatment mechanism’, in which the trust in systems is enhanced as citizens are likely to be treated fairly and equally. [7]

This article explores whether e-government in Botswana ensures privacy and protects personal data. E-government collects personal information, which if mishandled, might pose a threat to democracy.

Bante et al (2021) highlighted concerns that digital tools enabling increased surveillance might compromise democracy. Moreover, in Africa, including Botswana, there are hurdles to e-government. Nkwe (2012), citing Alshehri and Drew (2010), identifies challenges like inadequate ICT infrastructure, as well as security and privacy issues.

The case of Botswana

For a long time, Botswana has received favourable international ratings in terms of transparency, rule of law, freedoms and prudent economic management. However, Civicus Monitor (2021) observed a decline from a ‘Narrowed’ rating to ‘Obstructed’ in liberties, citing, among others, surveillance of citizens. [8] In recent years, the country experienced several detentions and arrests of individuals under cyber related laws. The Cyber Crime and Computer Related Crimes Act of 2018 [9] has been used to stifle digital expression, along with Section 44 of the Corruption and Economic Crime Act of 1994. [10]

While there is increased digitisation across all sectors, and widespread use of social media, there have also been disturbing incidents of surveillance, resulting in detention of journalists [11] and other users. The confiscation of the mobile phones of journalist Tsaone Basimanebotlhe in 2019 [12] and Reverend Thuso Tiego in 2021 [13] were among such incidents. Basimanebotlhe was reportedly detained, and her devices confiscated because state security agents were looking for the sources behind an article in which photos of some agents had been published. Tiego was reportedly arrested, and his phones confiscated for allegedly violating the Public Order Act of 1967, with the police claiming they needed his phones for their investigations. Tiego’s lawyers have since indicated that they intended suing the state on his behalf. [14]

Domestic, regional and international frameworks

The Botswana Constitution, in Section 12, protects freedom of expression, including access to information. The protection of the right to privacy is also guaranteed in Section 9, which reads:

“Except with his or her own consent, no person shall be subjected to the search of his or her person or his or her property or the entry by others on his or her premises.” [15]

Aside from the constitution there are a number of laws and policies that impact on digital rights, and specifically the right to privacy, in Botswana. These frameworks can be clustered into enabling and disabling laws and policies. Enabling laws and policies are those that are relatively consistent with the constitution, while disabling laws and policies appear to be inconsistent with the constitution.

Enabling laws and policies

Maitlamo ICT Policy – This policy was adopted in 2004 and was meant to facilitate ICT rollout in the country;
Data Protection Act (DPA) of 2018 – this law was meant to provide protections in terms of privacy and personal data. It was only operationalised in October 2021 [16] and to date some parts have not been fully implemented, although the Information Commissioner has been appointed.

Disabling laws and policies

Corruption and Economic Crime Act of 1994 – This law has been used to confiscate the electronic devices of journalists, such as those of Botswana Gazette journalists; [17]
Public Service Act of 2008 – This law has various sections that bar public servants from disclosing government information.
Cyber Crime and Computer Related Crimes Act of 2018 – This law has been used to clamp down on freedom of expression online. It is widely cited in charge sheets; [18]
Criminal Procedure and Evidence (Controlled Investigations) Act of 2022 – A new law that, as a bill, threatened unfettered surveillance and invasion of privacy. Threatening provisions were watered down following public outcry [19] before the law was enacted.

Regional and international frameworks

Botswana is a signatory to the United Nations’ Universal Declaration of Human Rights and International Covenant on Civil and Political Rights, as well as the African Union Convention on Cyber Security and Personal Data Protection (the Malabo Convention), [20] although it has not ratified it yet.

Status of the Data Protection Act (DPA) of 2018

With regard to implementation of the data protection law, to date an Information Commissioner has been appointed and is in the process of setting up a fully-fledged secretariat. While the law ostensibly provides protections for online privacy and personal data, it contains significant exemptions that negate its purpose. Section 3 (b) of the law provides for the exemption of the processing of personal information “by or on behalf of the state where the processing involves national security, defence or public interest” from the provisions of the law.

According to the Africa Cyber Security Report of 2020/21, 55% of people surveyed in Botswana were aware of the data protection law. The findings of the report were released by the government-owned Botswana Fibre Network (BOFINET) in June 2022. [21]

Internet access and affordability

Public perception is that internet connectivity in Botswana is expensive and slow. [22] However, the regulator, the Botswana Communications Regulatory Authority (BOCRA), has maintained that the perception was misinformed.

According to Statistics Botswana’s 2021 fourth quarter (Q4) ICT Statistics Brief, subscriptions of mobile and fixed-line internet increased by 3.4% and 4.6%, respectively, over the third quarter of that year. While fixed-line internet subscriptions remained relatively low, at 101,915 (Q4 2021), up from 97,395 (Q3 2021), mobile internet subscriptions climbed to 2.45 million, up from 2.37 million in Q3 2021. [23]

The figure below shows internet subscriptions from Q1 2018 to Q4 2021.

Source: Statistics Botswana

Opportunities

According to Bante et al (2021), the Botswana government has been introducing one strategy after the other in order to provide universal access to services. The 2015-2021 e-government strategy made provision for several e-government services to be established, such as “online payment systems for water and electricity services; the possibility of individual income or VAT returns; Botswana e-laws and digital livestock identification and trace-back system for cattle”. Other notable proposed e-services were downloadable government forms from government websites.

Threats

The Botswana government’s surveillance practices have become a threat to the acceptance and uptake of e-government services, as more and more people are charged on the basis of information obtained through surveillance. [24]

Ramsay believes this is not unique to Botswana, stating that privacy is under threat globally even in jurisdictions such as most of the European Union (EU), with whistle-blower and data protections. Global mass surveillance is the new normal.

In mid-2022, a letter from the Directorate of Intelligence and Security Services (DISS) circulated on social media, in which the DISS demanded CCTV footage from a Gaborone restaurant. The letter, dated 14 June 2022, request that DISS be furnished with hard drives containing CCTV footage, or any other storage equipment which accommodates and or captures live footage of your restaurant.”

The fear expressed online at the time was that the demand for CCTV footage would expose all guests of the restaurant to potential privacy invasions by the security service.

In another case from 2022, the Botswana Mining Workers Union (BMWU) notified Debswana, which is jointly owned by the Botswana government and the De Beers Group of Companies, of its intention to sue over violations of the right to privacy of mineworkers (The Voice, 19 June 2022).

This followed a court ruling in favour of a company, Infrotac, which had sued Debswana over payment for surveillance services valued at P100 million (±US$10 million). The union considered evidence presented in the Infotrac case as confirmation that workers had been illegally spied on and their right to privacy violated by Debswana. [25] This ruling was overturned later.

On top of concerns around pervasive state surveillance, another challenge to acceptance and use of e-government services in Botswana is continuous power outages and the ‘system is down’ syndrome. Botswana government systems appear to be down regularly and therefore cannot provide e-government services uninterrupted. Sambona (2010) claims that these continuous system failures are due to poor maintenance and infrastructure. [26]

Human rights approach

A human rights approach would entail the PANEL principles of Participation, Accountability, Non-discriminatory, Equality, Empowerment and Legality.

Some of the rights that the DPA provides for the data subjects are the right to withdraw consent, the right to access their information through processor or controller, as well as the right to be informed about the processing of their data. [27]

What is more pronounced in the DPA from the perspective of human rights is a dominating political control.

Botswana’s DPA has significant involvement of the minister. Section 6 (1) gives the minister power to appoint the commissioner and the deputy commissioner while the rest are appointed by the commissioner. This goes against the principles of citizen participation in the establishment of the commission as espoused by various treaties. The minister further has a leeway in giving directions to the commissioner as stated in Section 9. The minister also appears in the appointment of all members of the Appeals Tribunal in Section 45. Section 53 continues to give the minister a blank cheque as s/he can make regulations, “prescribing anything under this Act which is to be prescribed or which is necessary for the better carrying out of the objects and purposes of this act or to give force and effect to its provisions.”

The law, however, provides an element of accountability in the sense that a data controller or processor could be taken to task and face hefty fines for contravening the act according to subsections under Section 51. [28]

Former army top official, Pius Mokgware brought a matter before court accusing his former employers of conducting surveillance on him. He further sued Be Mobile telecommunications company to produce evidence that there was, “systematic monitoring and tapping of phone calls, communications from his cellular phone and general surveillance.” [29]

Conclusion

Instances of violation of privacy rights and personal data protection exist in Botswana. The advent of e-government without proper guidelines and awareness of privacy rights has exposed personal data to abuse. The delay in implementing the 2018 DPA has added to the uncertainty in the industry and raised concern over government’s intentions. This is made worse by formulation of other laws which are inconsistent with the ideals of the rights to privacy and personal data protection. The unfettered exemptions in the DPA dilute the spirit of the act and their amendments as promised by the Information Commissioner are eagerly awaited. For E-government to succeed, it must be human rights oriented and mechanisms be put in place to ensure that it is. E-government involves mass collection of personal data and without the implementation of the DPA, the benefits of digitalisation may not be optimised.

From the research conducted by Africa Cyber Security (2020-21), [30] indications are that personal data is not handled with care and organisations do not invest in enlightening their personnel on security issues.

It is also evident from the DPA that there is space for political interference in the running of the commission. With key commissioners and the whole Appeal Tribunal appointed by the minister, power is congested in one person, and this is inconsistent with principles in the African Declaration of Internet Rights and Freedoms and others. With the government being the largest user of personal information, having a minister as a gatekeeper of possible abuse is too much of conflict of interest and defeats the spirit of the data protection principles.

Food for thought

In light of the conclusion, the following is recommended, that:

The implementation of the DPA be sped up;
E-government be rolled out with protective mechanisms such as a code of conduct for employees;
The DPA be amended to counterbalance the exemptions extended to the state;
E-government instruments be consistent with human rights and right to privacy and personal data protection;
Public education in the form of mass communication advertorials be undertaken to sensitize the public about privacy rights and data protection;
A specific pamphlet of guidelines on issues to consider when dealing with personal data be produced for public officials;
Organisations, including government, be encouraged to train staff who handle personal data on security and human rights implications;
Civil society organisations be involved in public education and be on alert for violations.

* For the purposes of this article, e-government shall mean any electronic service both within and outside government. It shall therefore be used interchangeably with e-service in the government.

Notes

1 https://www.igi-global.com/chapter/e-government-development-in-botswana

2 Digitisation is the specific act of converting analogue information to digital form, while digitalisation involves the broader transformation and utilization of digital technologies to innovate or improve processes, services, or systems.

3 https://yourbotswana.com/2021/05/30/the-new-reset-priorities-for-the-government-of-botswana/

4 https://www.un.org/en/development/desa/publications/global-egovernment-survey-2008.html

5 https://www.academia.edu/31833702/E_Government_Challenges_and_Opportunities_in_Botswana

6 https://www.igi-global.com/chapter/botswanas-e-governmentprogramme/107174

7 https://www.idos-research.de/uploads/media/DP_16.2021.pdf

8 https://findings2021.monitor.civicus.org/country-ratings/botswana.html

9 https://www.bocra.org.bw/cybercrime-and-computer-related-crimes-act-2018

10 https://inkjournalism.org/51/botswana-in-the-grip-of-bad/

11 https://cpj.org/2022/05/botswana-journalists-remain-vigilant-under-new-surveillance-law/

12 https://cpj.org/2021/07/botswana-cellebrite-search-journalists-phone/

13 https://www.mmegi.bw/news/rev-tiego-jailed-to-appear-in-court/news/

14 https://www.facebook.com/photo?fbid=563993185328783&set=pcb.563993258662109