Election 2019: IEC and Information Regulator must prepare for possible social media manipulation

In light of the announcement of the hacking and holding to ransom of the server of the Liberty Group on Sunday, issues of South Africa's cybersecurity have been once again highlighted.

South Africans have had first-hand experience with the suffocating embrace, the disorientation and the chipping away at truth that fake news and social media attacks can have on the political landscape.

It was the British PR and “reputation management” firm, Bell Pottinger, contracted by the Gupta family, supposedly to manage their Oakbay account, which helped place the rhetoric of “white monopoly capital” in ANCYL president Collen Maine's mouth.

It was Bell Pottinger's Victoria Geoghegan who attempted to buff and salvage Gupta associate Duduzane Zuma's slight reputation in the country. The firm's strategy, after many public rebuttals and denials, was finally exposed in a string of emails between Geoghegan, Zuma, and various other players in the State Capture feeding frenzy under Jacob Zuma's overtly permissive open-purse watch.

Bell Pottinger, after years of acting across the globe with impunity, had its reputation so tarnished through its collaboration with Zuma and the Gupta family, that the firm collapsed before going into administration. This was as a direct result of exposure in the #GuptaLeaks of Bell Pottinger's manipulation of the South African political landscape.

Writing for the Guardian in May 2017, Alex Hern warned that Facebook had become a key electoral battleground in the UK and that researchers in that country were investigating how automated accounts could be used to “alter political debates online”.

“One of the most powerful players in the British election is also one of the most opaque. With just over two weeks to go until voters go to the polls, there are two things every election expert agrees on: what happens on social media, and Facebook in particular, will have an enormous effect on how the country votes; and no one has any clue how to measure what’s actually happening there,” Hern began his piece.

Hern quotes Professor Philip Howard, of the University of Oxford's “Internet Institute” as saying “I think that there have been several democratic exercises in the last year that have gone off the rails because of large amounts of misinformation in the public sphere.”

In April 2018, the Information Regulator, Pansy Tlakula, issued a statement with regard to the breach by Facebook of the data of some 59,777 South African users which potentially had been shared with Cambridge Analytica.

Tlakula, the country's former chief electoral officer, was appointed in December 2016, by then-president Jacob Zuma, to head the newly-established Information Regulator conjured to life to ensure compliance with the Protection of Personal Information (Popi) Act and the Promotion of Access to Information Act (PAIA).

Tlakula, after successfully managing and overseeing two national and two local government elections, resigned as chief electoral officer following allegations of maladmistration with regard to the procurement of a lease for the Riverside Office Park in Centurion as the headquarters for the IEC.

In April 2018 Tlakula announced that the IR had written to Facebook to establish if the Cambridge Analytica leak had in fact occurred, the extent of it, and what interim measures were being put in place to prevent a repeat of the breach.

“The alleged Facebook data breach follows the data breach which occurred in mid-October 2017 in which it was reported that 27.2 GB database file name: 'masterdeeds' compromised on the Go Vault platform operated by Dracore,” said Tlakula in a statement adding “following these reports the regulator wrote to all the parties that were implicated in the alleged breach and subsequently convened a meeting of various government institutions involved in the investigation of the alleged material data breach.”

These institutions included, she said, the SAPS, the Hawks, the National Prosecuting Authority (NPA), Department of Rural Development, the National Credit Regulator and the Association of Credit Bureaus.

“The meeting agreed to establish a task team comprising of the representatives of the above mentioned institutions to ensure a multi-disciplinary approach to the investigation.”

Daily Maverick sent several emails and follow-up emails to the address Tlakula listed in her media statement and which is also listed on the IR website with a list of questions.

We waited for a week for a reply or an acknowledgment of receipt but none was forthcoming. These were the questions we would have liked the IR to reply to.

• 
  

  What has come out of the Chief Information Regulator’s enquiries with Facebook about the Cambridge Analytica breach?

  
  


• 
  

  A task team comprising the representatives of the South African Police Service specifically the Hawks, the National Prosecuting Authority (NPA), Department of Rural Development, the National Credit Regulator and the Association of Credit Bureaus was set up following the Cambridge Analytica data breach. What work has the task team undertaken?

  
  


• 
  

  What does the inclusion of the Hawks and NPA signify?

  
  


• 
  

  What is the responsibility of Facebook and Twitter in relation to ensuring that the platforms they provide are not used by foreign powers to interfere in the sovereignty of another nation, including in another nation’s elections?

  
  


• 
  

  The EU’s new General Data Protection Regulation (GDPR) sets a new standard for privacy regulation across the world. The EU has indicated that any organisations that don't comply with the GDPR will be fined heavily. This would include South African firms that hold EU customers' personal data. What is the Chief Information Regulator doing to attune South African companies to the need to comply?