You are currently viewing State-sponsored phone tapping, hacking claims rock Lesotho
WhatsApp's new feature sparks mixed reactions among Zimbabweans

State-sponsored phone tapping, hacking claims rock Lesotho

By Herbert Moyo

…top lawyer cries foul, “fears” for his life from state agents who allegedly tap his phone and monitor him for handling cases against the government,

…files landmark constitutional suit to nullify intrusive mobile subscriber law.

Despite Lesotho’s status as a democracy, lawyers and other citizens are allegedly at the mercy of state security agents who habitually hack into their mobile phones to access private communications and confidential information in violation of constitutionally enshrined rights to privacy, free expression, religion and association among others.

This according to a top lawyer, Advocate Fusi Sehapi, who has taken it upon himself to petition the Constitutional Court (ConCourt) to nullify the Southern African mountain kingdom’s controversial mobile phone subscriber regulations compelling everyone to register their mobile phone Sim cards.

In his court papers obtained by this publication, Adv Sehapi sensationally alleges there is a pervasive illegal culture of phone tapping and hacking targeting lawyers and others in Lesotho.

He claims his mobile phone is often tapped and he is traced by unknown people “whenever I handle controversial cases against the government and/or politicians to the detriment of my security of person and life”.

Mobile phone service providers and their agents began registering subscribers’ Sim cards in June 2022 in line with regulations gazetted by then Communications Minister, Sam Rapapa, in December 2021. Subscribers are required to submit their personal data and biometric details as a precondition for registering their Sim cards.

By his own admission, Adv Sehapi has thus far refused to register his Sim card. He has also made several, albeit unsuccessful attempts to persuade his mobile service provider and the regulatory Lesotho Communications Authority (LCA) to exempt him from the registration requirements.

Given that he was ‘already under illegal state surveillance’, Adv Sehapi fears that the operationalisation the mobile subscriber regulations will give the state the legal standing to snoop on him and other citizens to the detriment of their security and civil rights.

With the deadline to register all existing Sim cards by 24 June 2023 fast approaching, Adv Sehapi has turned to the ConCourt for relief.

Ministers Nthomeng Majara (Law and Constitutional Affairs), Nthati Moorosi (Communications), the LCA, Vodacom Lesotho, Econet Telecom Lesotho and Attorney General, Rapelang Motsieloa, are the first to sixth respondents respectively in Adv Sehapi’s constitutional application.

Background

Since June 2022, Lesotho’s two mobile communications operators, Econet Telecom Lesotho and Vodacom Lesotho, have been engaged in an exercise to register the Sim cards of their customers as well as recording their personal data and biometric details.

This is in line with the requirements of the Communications (Subscriber Identity Module Registration) Regulations gazette issued on 24 December 2021 by then Communications Minister Rapapa.

The regulations require citizens, diplomats, foreign nationals and visitors to register their Sim cards with mobile service providers or their agents.

The regulations are meant to make it easier for mobile service providers and the LCA to monitor citizens’ private communications and information which can be then passed on to the security agencies should the need arise  but only upon production of a court order.

However, the Directorate on Corruption and Economic Offences (DCEO) – a state agency set up to investigate corruption- will have unfettered access to subscribers’ information and communications as it is exempted from seeking a court order.

There are penalties in the form of fines for failure to comply with the new regulations.

“A licensee who fails to capture, register, deregister, deactivate or keep details of any subscriber as specified in these regulations or as may be stipulated by the Authority (LCA) commits an offence and is liable on conviction to a penalty of M5000 (equivalent of South African Rand 5000) for each Sim card,” the gazette states.

“A licensee who activates any Sim card without capturing, registering and keeping the personal information of a subscriber commits an offence and is liable on conviction to a penalty of M5000 for each Sim card.

“A licensee who fails to comply with provisions of regulations 5 and 6 (which require the licensee to maintain strict confidentiality with regards to subscribers’ information and ensure that such information is not released to a third party except with the consent of the subscriber or a court order) commits an offence and is liable on conviction to a penalty of M100 000.”

A licensee who “misuses” subscribers’ information is liable to a fine of M250 000 per subscriber.

Among the main provisions of the amended regulations is that all new Sim cards be registered and activated within seven days.

Existing Sim cards will have to be captured and registered within 12 months of the new regulations coming into force. Given that the regulations came into force on 24 June 2022, Adv Sehapi and others who are yet to comply have just two months until 24 June 2023 deadline to have registered their existing Sim cards.

Rights violations

With the 24 June deadline fast approaching, Adv Sehapi has turned to the ConCourt.

Among other things, the lawyer wants a “declarator that the Regulations are invalid and unconstitutional for giving the state and its organs access to personal information in violation of rights to information and privacy without the intervention of the courts in violation of the principle that no man maybe a judge in his own cause and that all laws have implied provision on court intervention”.

Adv Sehapi further wants that the regulations nullified to be declared invalid and unconstitutional “for being inconsistent with sections 11 and 14 of the Constitution of Lesotho by forcing the Applicant and others to divulge his “personal information” without his/their consent”.

Sections 11 and 14 of the constitution provide for the right to private and family life as well as freedom of expression respectively.

Illegal phone tapping culture

Adv Sehapi alleges that even without the regulations, Lesotho already has a pervasive culture of illegal phone tapping and hacking of private communications.

If his papers are anything to go by, the court is likely to be treated to explosive details about how is living in fear of his life as a result of a well-orchestrated tapping operation which has presumably by state operatives.

“My phone gets illegally tapped and traced from time to time I handle controversial cases against the government and/or politicians to the detriment of my security of person and life,” Adv Sehapi states in his court papers.

In fact- according to him- the state has a long history of targeting people and persecuting them through illegal phone tapping activities. Hence, allowing the regulations can only give the rights violations a cloak of legality, he argues.

In any event, the state does not have the capacity to safeguard citizens from hackers, he argues. The state has itself been a victim of hackers who have not been brought to book hence it cannot be relied on to protect citizens’ data and information obtained in terms of the mobile subscriber regulations, Adv Sehapi further argues.

“The government has no legal, technological and other effective means of protecting personal information from abuse by hackers, private persons and/or its own officials including security organs once it (information) is in its hands or hands of its organs,” Adv Sehapi states.

“(The) absence of such measures poses a violation and/or threat of my and/or other people’s personal security and life. For instance in the recent past, even government (mobile phone) calls and systems were hacked by persons…who stole government millions from its accounts and such persons are still subject of prosecutions in Courts now. The government calls used to be tapped and traced by an identity called Makhaolaqalo who used to have illegal access to all government official’s communications and reveal them “prophetically” to the public (on Facebook).

“The said Makhaolaqalo, I am told, was a syndicate of private persons operating with government officials and state security personnel to hijack secret government information communication systems. This state of affairs still exists today and government has done nothing to protect itself and remedy it because it has no means to do so. Amidst this situation, the same government wants me to surrender my “personal information” on the promise that it will protect it? I refuse.

“Now, if I surrender my personal information my communications will get tapped and my movements traced by the state security personnel alone and/or private persons and my personal security will be at stake. In the recent past the state security persons have abducted civilians, tortured civilians and even murdered them. A lawyer was recently abducted and tortured by the police. Therefore, surrendering my “personal information” as a lawyer will put my communication with my clients and my security person at stake against the dangerous private persons and state security personnel. Therefore, I refuse to put my life at state by surrendering my personal information to the Respondents.

Media freedom threatened

In justifying the regulations, the state has argued that registration of Sim cards and biometric details of subscribers will help fight crime. It will be easy to trace any suspect who uses their Sim card in the commission of a crime and forward their private communications and other information to the security agencies, the state argues.

However, Adv Sehapi is not convinced. If anything, he argues that the enforcement of the regulations will open the floodgates of abuse of citizens and even greater rights violations by an already repressive state apparatus.

Police informants and other whistleblowers’ cover will be blown open if the regulations are operationalised, he contends.

Even media freedom will be threatened as journalists will have nowhere to hide. Their communications will be tapped and they will be traced by the state, he argues.

US concerns

He is not the only one who is skeptical about the government’s ability to protect citizens’ personal information.

The US embassy in Lesotho has raised similar concerns about the “intrusive” nature of the mobile subscriber regulations “which will touch on the privacy and personal liberties of every Lesotho citizen who owns a telephone”.

“The US Embassy notes that the collection and storage of sensitive personal data pose complex challenges,” the US embassy said in an interview with this reporter in June 2021.

“One such challenge is preventing access by unauthorised users.  In the past year (2020), the computer systems of the government of Lesotho have been subject to repeated penetration by hackers.  This brings several questions to the fore; how will the biometric data collected under these new regulations be protected from unauthorised access?

“What will the government of Lesotho do to protect or compensate its citizens after hackers steal their biometric data? Will the government hire an outside consultant to manage this data, and if so, how will this consultant be selected, managed, and held accountable,” the embassy further asked.

The apocalyptic mark of the beast

Once the regulations kick in, those who will not have registered will have their Sim cards deactivated and they will not be able to make phone calls, use mobile data to access the internet and social media.

In addition, those who use the two service providers’ mobile money platforms (Vodacom’s Mpesa and Econet’s Ecocash) will no longer be able to transact.

And Adv Sehapi- who makes no secret of his strong Christian beliefs- will also attempt to convince the court bench that the regulations should be outlawed as they are allegedly part of a wider, more sinister plot to curtail the constitutionally guaranteed freedom of religion.

In his court papers, he alleges that the real motive behind the regulations “is to actualise the cashless ‘scan me’ system of buying and selling i.e. 666 prophesied and prohibited in the Bible”.

“Almost every item of sale recently bears the secret scan code. This code has three square brackets which, according to my religious beliefs, represents the secret code of 666…Once the involuntary surrender of personal information and Sim registration is completed, the ‘scan me’ system will be functional with the aid of communications systems using 5G towers now installed in every corner of the street in (the capital) Maseru.

“According to my religious book of authority, the Bible, 666 methods of buying and selling will be forced on all persons; great and small, rich and poor, free and slave. And this is exactly what the mandatory Sim card registration is doing as a preliminary step to actualise the sinful 666 methods of buying and selling.

“My spiritual conscience provided for in…the Lesotho Constitution does not augur well with the forced surrender of my personal information to the government and I have a choice to register or to refuse to register my Sim card,” Adv Sehapi argues.

Herbert Moyo is a journalist researching digital surveillance with support from
the Media Policy & Democracy Project (MPDP) jointly run by the University of Johannesburg and Unisa.