The risks and costs of ICTA’s Proposed Amendments appear to far outweigh their likely benefits
By Thiruthiraj A. Pather
In any democratic country, citizens should commend and encourage initiatives such as the ongoing public consultation of the ICTA with regard to its ‘Proposed Amendments to the ICT Act for Regulating the Use and Addressing the Abuse and Misuse of Social Media in Mauritius’.
Social media hackers. Pic – ehacking.net
The ICTA’s Proposed Amendments may seem technically sound at first glance. Yet, these amendments should not be analysed through a biased and/or incomplete approach. Their societal, economic, business, financial, political and legal consequences should be thoroughly and objectively scrutinised through a holistic lens. In this respect, nine key points, inter alia, may be considered.
1.Freedom of Expression and Test of Constitutionality
The Proposed Amendments advocate for a “technical toolset” which would interfere with the social media traffic of each Internet user in Mauritius via a filtering system. The social media traffic will be segregated, decrypted, archived, inspected (as and when required) and re-encrypted. All local users would therefore be forced to accept the interference of the ICTA, through the automatic installation of a self-signed certificate, if they wish to access their social media accounts.
Consequently, the Proposed Amendments do not allow for the consent of users and would not pass the test of constitutionality pursuant to Article 12(1) of the Constitution of Mauritius.
In the face of anti-freedom-of-expression measures, Mauritians must reflect on the kind of country and society they want to live in and bequeath to their children.
2. Definitions of Social Media and Technological Convergence
The Proposed Amendments apply solely to social media traffic. In this respect, the ICTA’s technical toolset would segregate social media traffic from all incoming and outgoing Internet traffic in Mauritius. Yet, today, there is no universally-accepted definition of Social Media and the Consultation Paper does not shed any light on the definition chosen by the ICTA.
As the technological convergence phenomenon broadens, the boundaries between social media and non-social media traffic will increasingly blur. The implications of such a phenomenon must be understood as they will determine the scope of the Proposed Amendments in terms of Internet traffic which may be intercepted.
3. The Independence of the NDEC Members
The competencies, independence and ethical conduct of each and every member of the National Digital Ethics Committee (NDEC) are fundamental to the effectiveness of the Proposed Amendments. Yet, the Consultation Paper does not define the criteria which will be used to objectively and openly assess independence, calibre and repute of these members.
4. A Treasure Trove for Hackers
The Governments of the US and other advanced economies, and even giant tech companies like Facebook and Google, are not immune from the risk of cyberattacks and the dire consequences of data breaches, as demonstrated by last year’s cyberattacks whereby thousands of organisations across the globe, including several departments/agencies of the US Federal Government, the NATO, the UK Government, the European Parliament, Microsoft were targeted.
In the face of such events, we can, rightly so, question the ability of Mauritius to set up and maintain a technical system which would be immune from cyberattacks. Will the Proposed Amendments not create a treasure trove for hackers and facilitate their tasks? Most importantly, will the Proposed Amendments not put the State of Mauritius in a situation where it will put at risk the privacy and safety of the citizens it is bound to protect and defend?
5. The EU General Data Protection Regulation (GDPR)
The European Union (EU) is a critical export market and economic partner for our country. In this connection, companies dealing with data subjects in the EU must comply with the GDPR. The Data Protection Act 2017 was purposely introduced in response to the requirements of the GDPR, given the importance of the EU market for Mauritius. Yet, the Proposed Amendments are awkwardly in contradiction with the EU-GDPR.
With the Proposed Amendments, there is no doubt that companies based in Mauritius will have to inform their EU data subjects that their personal data are being intercepted, decrypted, archived and inspected by the ICTA/State of Mauritius. The following what-if scenarios must, consequently, be considered:
What if the EU data subjects do not give their consent to such an interception? Should the concerned Mauritian-based companies stop their businesses with their European counterparts? Should these companies relocate to other jurisdictions? If so, what would be the likely business, economic and social effects for Mauritius?
What if Mauritian companies are found to be in violation of the GDPR due to the technical toolset and legal provisions forced on them by the ICTA? Will the ICTA/State of Mauritius pay for the applicable fines of up to EUR 20 million per company?
What if the personal data of EU data subjects intercepted and archived by the ICTA are hacked and freely disseminated worldwide through online platforms? What would be the impact of such an incident on the international reputation of Mauritius?
6. The International Reputation of Mauritius
The Mauritian jurisdiction is currently blacklisted by the EU and the UK. We can no more count on the DTAA with India to bolster the Global Business sector. The competitiveness of the country’s tax regime is eroding due to external pressures (OECD & EU) and the fragile position of public finances. What about democracy?
In its ‘Democracy Report 2021’, the V-Dem Institute classified Mauritius among the top-10 autocratising countries in the world, highlighting that ” Mauritius is only an electoral democracy.”
Given the current context, bearing in mind the severe impact of the COVID-19 pandemic on our economy, can we afford to further jeopardise the democratic image of Mauritius and further erode its global competitiveness?
7. Tourists and Foreign Investors, High-Calibre Professionals and HNWI
As Mauritius gradually moves out of the Covid-19 sanitary crisis, the borders will be re-opened. Potential tourists will be aggressively enticed to visit our “pristine beaches”. Foreign investors, high-calibre professionals and High-Net-Worth Individuals (HNWI) will be proactively and strongly convinced to invest in or relocate to Mauritius.
Will potential tourists, foreign investors, high-calibre professionals and high-net-worth individuals be eager to visit, do business with or relocate to a country where their personal data will be legally intercepted, decrypted, archived and inspected? If not, what are the likely effects on the Mauritian economy?
8. A Treasure Trove for Politically-Motivated Individuals (PMIs)
The reservoir of personal data, which will be created and maintained by the ICTA, will not only be a treasure trove for hackers, it will also be one for PMIs. It is therefore judicious to ask ourselves the following questions:
Will the NDEC be capable of formulating effective safeguards whilst tech-pioneering countries are yet to formulate any fail-proof safeguards in relation to such matters and are facing much difficulty in fighting the dark web?
What if the political neutrality of the ICTA officers, entrusted with the responsibility to use the proposed “data analysis software with an advanced reporting feature” to analyse intercepted traffic, is compromised?
What if the ICTA’s reservoir of personal data falls under the control of a group of politically-motivated individuals powered by artificial-intelligence technologies? What would be the impact on the functioning of the country’s democratic system?
What if the personal data of high-ranking Mauritian politicians are leaked to foreign agencies? What would be the impact on our country’s sovereignty and geopolitical strategy?
Overall, the risks and costs of the Proposed Amendments appear to far outweigh their likely benefits.
Whilst the ICTA rightly strives to effectively address the pressing issue of social media misuse, it must make sure that its proposed actions do not lead to the creation of a Pandora’s Box which can wreak havoc on our Paradise Island.
Former French government scholarship holder, Thiruthiraj Pather is the founder of the consulting firm Lapidus Azuri Consulting. He has over 14 years of professional experience in the areas of corporate strategy, investment and business intelligence, having worked with large foreign and Mauritian companies. In 2016-17, he played a major role, as consultant, in the development of the 2017-2026 national master plan for SMEs in Mauritius.
65 years ago Mauritius Times was founded with a resolve to fight for justice and fairness and the advancement of the public good. It has never deviated from this principle no matter how daunting the challenges and how costly the price it has had to pay at different times of our history.
With print journalism struggling to keep afloat due to falling advertising revenues and the wide availability of free sources of information, it is crucially important for the Mauritius Times to survive and prosper. We can only continue doing it with the support of our readers.
The best way you can support our efforts is to take a subscription or by making a recurring donation through a Standing Order to our non-profit Foundation.