Cybercrime still a scary reality
New Cybercrimes Bill: 'Although it is the first to articulate the complete range of activities that constitute cybercrime, all internet users must still be vigilant.'
Although South Africa’s new Cybercrimes Bill articulate the complete range of activities and penalties that constitute cybercrime, it still doesn’t replace caution and all internet users must still be vigilant, warned the South African Institute of Professional Accountants (SAIPA).
Ragiema Thokan-Mahomed, Legal, Ethics and Compliance Executive at SAIPA said, “South Africa’s new Cybercrimes Bill is currently under consideration by the National Council of Provinces, having been greatly simplified after its previous draft. While other laws have defined cybercrime as it relates to their particular domain, the new bill is the first to articulate the complete range of activities that constitute cybercrime and penalties for those perpetrating them.”
Ragiema said the new bill also describes legal and policing responsibilities and powers, obligations of electronic communications service providers and financial institutions, assistance given and received in foreign cybercrime investigations, and several other subjects.
According to Ragiema, the South African Banking Risk Information Centre reported that South Africa had the third highest number of cybercrime victims worldwide in 2018, resulting in around R2,2 billion loss each year.
Ragiema added the bill is a welcome addition and aligns South African law with international legal trends. It is always a possibility that cybercriminals are based in other countries so international agreements and foreign enforcement agencies are then required to coordinate among themselves, using the correct protocols.
“The weakest link in information security is people. Organisations and individuals alike must be particularly aware of social engineering, which is any technique used to deceive a computer system’s users into surrendering their login information, downloading a malicious program or phishing,” Ragiema said.
“The only way to overcome these threats is by conditioning staff to never give out their login credentials – or any other sensitive information – through emails or web pages, and never to click links without checking that the authors are who they say they are.
“Organisations should also engage the services of a security expert to carry out readiness audits on their system security at least twice a year. Larger entities should also invest in threat detection systems that can monitor network traffic and data access for unauthorised activity.
“Some newer systems are artificial intelligence (AI) enabled so they can intelligently learn activity patterns normally associated with data tampering or fraud, and raise the alarm as they occur. No matter how careful a person or organisation is, they may still fall victim to cybercrime. So they will inevitably need both legal and police assistance to resolve the issue.”
An outstanding feature of the Cybercrimes Bill is the establishment of a designated Point of Contact, which the Cabinet member responsible for policing is obliged to establish, equip, operate and maintain. Although the form of this entity is not specified, Ragiema said that one could imagine a dedicated enforcement unit with a call centre.
