According to the Global Fraud Report, an annual publication by Kroll that ranks regions according to their exposure to incidents of cyber fraud, sub-Saharan Africa has the third highest exposure to incidents of cyber fraud in the world.
In the 2016 Cost of Data Breach Study conducted by IBM and the Ponemon Institute, the costs incurred by 19 organisations from nine different industry sectors are examined following the theft of protected personal data. On average, the total organisational cost of a data breach in South Africa is ZAR20.6 million.
According to the study, incidences of cybercrime and cybersecurity breaches are rapidly escalating globally with 64% more security incidents reported in 2015 than in 2014. South Africa is a target for cybercrime on the African continent, due to comparatively high internet connectivity in relation to other African countries. Among the numerous threats posed to South African business by cybercrime is the unlawful acquisition or interference with sensitive data relating to their clientele or business operations, and cyber fraud, in particular wire transfer fraud.
The Global Fraud Report ranks data deletion due to system issues as the most prevalent form of interference with data. Wire transfer fraud accounted for 26 percent of cyber fraud in sub-Saharan Africa, far ahead of the global average of 14 percent. Other forms of cyber-attack included viruses, and email based phishing attacks.
What is cybercrime? It is defined as "any criminal or other offence that is facilitated by or involves the use of electronic communications or information systems, including any device or the internet or any one or more of them" in the Electronic Communications and Transactions Amendment Bill, 2012.
South Africans are defrauded in excess of ZAR2.2 billion each year through online scams and cyber related crimes, according to the South African Banking Risk Information Centre.
On 12 February 2016 the Government Communications and Information Services database was hacked by "hactivist" group "Anonymous", resulting in a leak of the names, phone numbers, email addresses and passwords of approximately 1500 government employees.
On 16 February 2016 the South African Department of Water Affairs was hacked by the same group, resulting in the leak of sensitive data including usernames, passwords, full names, identity numbers, highly sensitive data and details of projects undertaken by that department.
At the 2015 Security Summit, held in Johannesburg, it was revealed that South Africa suffered more cybercrime attacks than any other country in Africa during a six-week period leading up to the summit.
In response to the elevated threat of cybercrime, the South African Reserve Bank announced, on 23 August 2016, the establishment of a special forum of "all South Africa's major financial institutions" to put together contingency measures to protect critical financial infrastructure from a prolonged cyberattack.
According to Reserve Bank Governor Lesetja Kganyago, "As a central bank and a regulator in the financial sector, the bank would be remiss in its duty if it ignored the growing risks emerging from the financial services sector’s increasing reliance on cyberspace and the internet."
The escalation of cybercrime in South Africa has elicited legislative intervention from government in the form of the draft Cybercrimes and Cybersecurity Bill (the Bill). On 28 August 2015, the Department of Justice and Constitutional Development invited public comment on the Bill.
The Department of Justice and Constitutional Development was mandated to review the cybersecurity laws of South Africa to ensure that these laws provide for a coherent and integrated cybersecurity legal framework.
Having regard to the commentary of the public, a revised version of the Bill was tabled in Parliament on 21 February 2017, which has created several new offences for unlawful cyber activity including "revenge porn".
In terms of the Bill, the following activities are criminalised:
• unlawful securing of access to data, a computer programme, a computer data storage medium or a computer system
• unlawful acquisition of data
• unlawful acts in respect of software or hardware tools
• unlawful interference with data or a computer programme
• unlawful interference with a computer data storage medium or computer system
• unlawful acquisition, possession, provision, receipt or use of password, access codes or similar data or devices
• cyber fraud
• cyber forgery and uttering
• cyber extortion
• certain aggravated offences
• attempting, conspiring, aiding, abetting, inducing, inciting, instigating, instructing, commanding or procuring to commit an offence
• theft of incorporeal properties
• unlawful broadcast or distribution of data messages which incites damage to property or violence
• unlawful broadcast or distribution of data messages which is harmful
• unlawful broadcast or distribution of data messages of intimate image without consent.
The Bill imposes an array of penalties on offenders on conviction, who will be liable for fines or imprisonment for up to 15 years.
It also creates infrastructure, such as the Cyber Response Committee and 24/7 Point of Contact, to promote cybersecurity within South Africa.
The Portfolio Committee on Justice and Correctional Services will now process the Bill, prior to referral to the National Council of Provinces.
This Bill address the immediate and costly threat cybercrime poses to business in South Africa, and is a positive legislative leap in the anti-corruption space.
Written by Krevania Pillay, an associate at Hogan Lovells (South Africa)