Regulation of Interception of Communications and Provision of Communication-Related Information Act, 2002 (Act 70 of 2002)Chapter 4 : Execution of directions and entry warrants29. Assistance by decryption key holder |
| (1) | If a decryption direction or a copy thereof is handed to the decryption key holder to whom the decryption direction is addressed by the authorised person who executes that decryption direction or assists with the execution thereof, the decryption key holder concerned must within the period stated in the decryption direction— |
| (a) | disclose the decryption key; or |
| (b) | provide the decryption assistance, specified in the decryption direction concerned, to the authorised person concerned. |
| (2) | In complying with a decryption direction, a decryption key holder— |
| (a) | must only disclose such decryption key or provide such decryption assistance which is necessary to obtain access to the encrypted information specified in that decryption direction or to put that encrypted information in an intelligible form; |
| (b) | may only disclose the decryption key or provide the decryption assistance to the authorised person who executes that decryption direction or assists with the execution thereof; and |
| (c) | may not disclose any other information, which is not specified in that decryption direction, relating to the customer in respect of whose encrypted information the decryption key has been disclosed or the decryption assistance has been provided. |
| (3) | A decryption key holder to whom a decryption direction is addressed and who is in possession of both the encrypted information and the decryption key thereto— |
| (a) | may use any decryption key in his or her possession to provide decryption assistance; and |
| (b) | must, in providing such decryption assistance, make a disclosure of the encrypted information in an intelligible form. |
| (4) | A decryption key holder who, in terms of a decryption direction, is required to provide decryption assistance in respect of any encrypted information, will be regarded as having complied with that requirement if he or she— |
| (a) | instead of providing such decryption assistance, discloses any decryption key to the encrypted information that is in his or her possession; and |
| (b) | makes such a disclosure, in accordance with the decryption direction concerned, to the authorised person to whom, and by the time by which, he or she was required to provide the decryption assistance. |
| (5) | If a decryption key holder to whom a decryption direction is addressed, is— |
| (a) | not in possession of the encrypted information; or |
| (b) | incapable, without the use of a decryption key that is not in his or her possession, to comply fully with that decryption direction, the decryption key holder concerned must endeavour to comply, to the best of his or her ability, with that decryption direction. |
| (6) | If a decryption key holder to whom a decryption direction is addressed, is in possession of different decryption keys, or combinations of decryption keys, to the encrypted information— |
| (a) | it will not be necessary, for purposes of complying with the decryption direction concerned, for the decryption key holder to disclose any decryption keys in addition to those the disclosure of which, alone, is sufficient to enable the authorised person to whom they are disclosed to obtain access to the encrypted information and to put it into an intelligible form; or |
| (b) | the decryption key holder may select which of the decryption keys, or combination of decryption keys, to disclose for purposes of complying with the decryption direction concerned. |
| (7) | If a decryption direction is addressed to a decryption key holder who— |
| (a) | has been in possession of the decryption key to the encrypted information, but is no longer in possession thereof; |
| (b) | if he or she had continued to have the decryption key in his or her possession, he or she would have been required by virtue of the decryption direction to disclose it; and |
| (c) | is in possession of any information that would facilitate the obtaining or discovery of the decryption key or the provision of decryption assistance, he or she must disclose all such information as is in his or her possession to the authorised person who executes the decryption direction or assists with the execution thereof. |
| (8) | An authorised person to whom a decryption key has been disclosed under this section— |
| (a) | may use the decryption key only in respect of the encrypted information, and in the manner and for the purposes, specified in the decryption direction concerned; and |
| (b) | must, on or before the expiry of the period or extended period for which the decryption direction concerned has been issued, with the written approval of the applicant who made the application for the issuing of a decryption direction, destroy all records of the disclosed decryption key if, in the opinion of the applicant concerned— |
| (i) | no criminal proceedings or civil proceedings as contemplated in Chapter 5 or 6 of the Prevention of Organised Crime Act, will be instituted in connection with such records; or |
| (ii) | such records will not be required at any such criminal or civil proceedings for purposes of evidence or for purposes of an order of court. |