The department of justice and constitutional development and other stakeholders have expressed concern about whether the strained fiscus would be able to fund the creation of a Chapter 9 institution aimed at regulating cyber security in SA.
In its submission to the portfolio committee on justice and constitutional development in parliament on Wednesday regarding the Cyber Commissioner Bill — officially named the Constitution Twentieth Amendment Bill — introduced by the DA in 2023, deputy justice minister Andries Nel said cyber security had increasingly become a global concern affecting “our country, both in public and private sectors”.
DA justice and constitutional development spokesperson Glynnis Breytenbach introduced the bill in parliament in October 2023, highlighting the urgent need for a dedicated cyber commissioner to protect personal information at state departments.
Recent cyberattacks resulted in the Postbank suffering cumulative losses of at least R108m by 2021 while more than R17m was stolen when the department of justice and correctional services’ Guardians Fund suffered a breach resulting in the suspension of beneficiary payments in 2021.
In July 2021, port operations were affected following a crippling breach of Transnet’s IT system in a cyberattack that forced several busy ports to run a paper-based system. The SA Weather Service is still fighting to restore its systems after a crippling cyberattack last month.
The DA wanted the cyber commissioner’s powers to include establishing and maintaining cybersecurity capabilities across all state organs and entities dealing with public information, operating a cybersecurity hub for reporting, monitoring and investigating incidents and threats, advising the defence force on cyber-fighting capabilities, and guiding institutions responsible for critical infrastructure.
However, in its presentation in parliament, the justice department’s H du Preez said there was concern about whether the fiscus would be able to fund the creation of an institution that would require “vast financial and human resources bearing in mind the very wide powers, functions and duties that the envisaged cyber commissioner will be exercising”.
Du Preez said an amendment of this nature, which proposes the creation of a new entity, must include detailed costing. “The portfolio committee is advised to consider whether there is a sufficient basis to create a new constitutional entity … over and above existing efforts,” he said, adding that the State Security Agency had since undertaken work on the development of cybersecurity legislation.
Du Preez called on the committee to consider inviting the Treasury to address it on the feasibility of the amendment bill.
Information Regulator chair Pansy Tlakula said: “Cybersecurity is a major challenge in SA, it has to be addressed. [However, it’s] better to capacitate existing institutions than to create new ones.”
Tlakula’s colleague, Tshepo Boikanyo, said: “The bill will create regulatory confusion and uncertainty. The cyber commissioner will not regulate cybersecurity incidents affecting private entities. Establishing a new institution under the current fiscal constraints may not be feasible. The proposed cyber commission will reverse the gains and the inroads that the Information Regulator has made over the last nine years of its existence.”
Meanwhile, the committee also received submissions by the National Prosecuting Authority (NPA) on Constitution Twenty-First Amendment Bill, also known as the Anti-Corruption Bill, introduced by the DA in parliament in 2024.
The bill, according to the DA, seeks to introduce an Anti-Corruption Commission as an independent, Chapter 9 institution focused solely on investigating and prosecuting serious corruption cases.
“Currently, the NPA is the only institution with the power to prosecute those accused of serious corruption and high-level organised crime. In practice, however, the NPA lacks the institutional independence or the resources to effectively prosecute these complex crimes,” the DA has said.
National director of public prosecutions Shamila Batohi said the country had several existing institutions contributing to the fight against corruption, which included the police, Special Investigating Unit, and the NPA, among others.
“There is no need for a new structure; build on what is there,” she said, adding that creating a new Chapter 9 institution “doesn’t guarantee effectiveness”.
The DA has blamed the government for a lack of political will in prosecuting state-capture-era corruption.
The presidency announced in 2023 it had recovered R5.4bn, including R2.9bn in cash out of an estimated R57bn worth of funds that were stolen during the state capture era.
In 2023 the Investigating Directorate Against Corruption (Idac), a unit within the NPA, blamed a shortage of specialised forensic accountants, auditors and financial investigators in its ranks for court defeats in state-capture cases.
On Wednesday, Batohi said: “SA, like many other countries, faces challenges in ensuring accountability in serious, complex and high-level corruption matters. The NPA supports the Idac model as part of a multi-agency model to fight corruption. The Idac needs to be given time to be properly resourced and capacitated.”
She said the NPA would continue to engage with the National Anti-Corruption Advisory Council and justice department to arrive at the best solution for “our country to address its current challenges in prosecuting serious and complex corruption matters”.
“Fighting crime is not easy, it often fights back and it fights dirty,” said Batohi, who has been accused of slacking by opposition party leaders.
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.