SysAdmin Journal · Legislation

My thoughts on the Cybersecurity and Cybercrime Bill

Ish Sookun — Sun, 31 Oct 2021 13:06:51 +0000

This Cybersecurity and Cybercrime Bill was presented to the National Assembly on the 22nd October 2021. It is meant to replace the current Computer Misuse and Cybercrime Act that dates 2003.

A few people asked me about my opinion on the Bill and it is only today that I read the document and I share a few things that I found pertinent about the Bill.

At the beginning of the document, the Budapest Convention on Cybercrime is mentioned and the Bill is said to increase compliance with the same through additional criminal offences related to cybercrime and cybersecurity, improved investigation techniques and increased international cooperation.

I don't see any improved investigation technique in this document. There does not seem anything that will drastically reduce the time to solve a cybercrime.

Anything related to Mutual Assistance, obtaining data from service providers etc, was already possible under current legislation. This Bill will probably reduce the paperwork if there is a will for that but not improve the investigation technique.

What is the Budapest Convention on Cybercrime?

It is the first international treaty that aims to harmonize laws on cybercrime and cybersecurity and increase cooperation among countries. It was initiated by the Council of Europe and opened for signature in November 2001. In two decades, 66 countries have acceded to the convention. Mauritius acceded to the convention in November 2013.

The convention provides a guideline to countries for implementing a legislation against cybercrime. The full guideline is available on the website of the Council of Europe. Some of the main articles of the guideline are (I refer to their article number):

Article 1 — Definitions
Article 2 — Illegal access
Article 3 — Illegal interception
Article 4 — Data Interference
Article 5 — System Interference
Article 6 — Misuse of devices
Article 7 — Computer-related forgery
Article 8 — Computer-related fraud
Article 9 — Offences related to child pornography
Article 10 — Offences related to infringements of copyright and related rights
Article 15 — Conditions and safeguards
Article 19 — Search and seizure of stored computer data
Article 20 — Real-time collection of traffic data
Article 21 — Interception of content data
Article 25 — General principles relating to mutual assistance

The guideline highlights the importance of safeguards and the protection of human rights & liberties in Article 15.

Current Cybercrime legislation

The Computer Misuse and Cybercrime Act came into force in 2003. Although, Mauritius hadn't yet acceded to the Budapest Convention on Cybercrime, the legislation had some provisions as stated in the Convention guideline.

What's new in the Cybersecurity and Cybercrime Bill?

New terms in the glossary of offences

There are a few new definitions of terms that have been added in this Bill, especially to describe the new offences. Among them are the terms:

Cyberbullying

It has been defined as any behaviour by means of information and communication technologies which is repetitive, persistent and intentionally harmful or involves an imbalance of power between the perpetrator and the victim and causes feelings of distress, fear, loneliness or lack of confidence in the victim.

Cyber extortion

It means a form of cybercrime which occurs when a person uses the internet to demand money or other goods or behaviour from another person by threatening to inflict harm to his person, reputation, or property.

Fake profile

An untrue online representation, existent or or non-existent.

Harm

It includes physical, sexual, psychological, emotional or moral abuse, injury, neglect, ill-treatment, degradation, discrimination, exploitation or impairment of health or development.

Pornography

The representation in a book, magazine, photograph, film, computer data or any such other media, a scene of sexual behaviour in any form, that is erotic or lewd and is designed to arouse sexual interest.

Sexual photograph or film

An image or video that depicts nudity or a picture of someone who is engaged in sexual behaviour or posing in a sexually provocative way.

Offences

Misuse of fake profile

Any person who individually, or with other persons, makes use of a fake profile to cause harm shall commit an offence. The penalty can be upto a million rupees fine or a maximum of 20 years imprisonment.

Cyberbullying

Any person who individually, or with other persons, commits cyberbullying, shall commit an offence. The penalty is again, upto a million rupees fine or a maximum of 20 years imprisonment.

Same penalty is mentioned for offences of cyber extorsion, cyberterrorism and revenge pornography.

How these new offences will help deter cybercrime or facilitate the task law enforcement, only time will reveal. In my opinion, new offences won't be of much help if the attitude of cybercrime officers remains the same. Not even a thousand new definitions will help if the officers do not improve their investigation techniques and become accountable.

In 2018 when the ICT Act was amended the then Attorney General, M. Gobin, used the same tune about social media to convince people on how useful the amendment will be to help in cases of online threats such as harassment, sextortion and cyber-bullying. He participated in radio & televised debates (on MBC) and at the University of Mauritius. However, since the amendments were made to the ICT Act, we've seen how poeple voicing out against the government are questioned and/or detained for breach of the ICT Act.

Copyright protection

Downloading pirated software, movies and music

Section 21 of the Bill mentions infringement of copyright and related rights. This section makes the download of music, movies and pirated software a criminal offence liable to upto one million rupees fine or 10 years of imprisonment.

Critical Information Infrastructure & increased penalty

This Bill introduces a definition for Critical Information Infrastructure. The National Cybersecurity Committee will be tasked to select the Critical Information Infrastructures in Mauritius. A system providing life sustaining services (e.g water, health or energy), or has an important effect on the economy, or its disruption could result in massive casualties, will be called a Critical Information Infrastructure.

The penalty for a cybercrime related to a Critical Information Infrastructure is twice the fine for other crimes described in the Bill, i.e upto Rs 2 million and a maximum of 25 years imprisonment.

Failure to moderate content

The failure to moderate content on a webpage, social media page or any other online platform, after having received a notice from an investigatory authority, will be a crime.

Compelling service providers to provide access to store data or collect real-time data

If this Bill is passed, an investigatory authority upon issuance of a Judge's Order, may compel a service provider to provide access to stored data or record real-time traffic data, within its technical capabilities. Any disclosure of the investigation by the service provider will be considered a crime.

A example of traffic data is the history of your everyday websites and online platforms that you visit, including your mobile internet traffic, phone calls, SMS, etc.

A example of stored data is your email content if your email is hosted by the service provider. If your service provider is in Mauritius and the email service is hosted outside Mauritius, then irrespectively the service provider will be compelled to provide access to the emails.

The National Cybersecurity Committee

The Bill introduces a National Cybersecurity Committee. This committee will be composed of fourteen members including a Chairperson that will be appointed by the Prime Minister. A person from the private sector and another from the civil society will be on this committee and both of them will be appointed by the Minister of Technology, Communication and Innovation. Both persons should have experience in the field of cybersecurity and cybercrime.

All members of the committee will be remunerated.

The committee may call upon people who can be of assistance but those persons won't draw any remuneration nor have any voting right at the committee's meetings.

The composition of the committee seems to be tightly controlled by the minister and the committee will operate in complete opacity, although their decisions will impact everyone who use the Internet and other technological services.

The Computer Emergency and Response Team (CERT-MU)

The CERT-MU is mentioned in Section 38. I read and ignored. In my opinion, the CERT-MU acts like a poster for the government to say that they do cybersecurity stuff. I have plenty of un-answered emails in which I questioned CERT-MU on cybersecurity matters. I believe CERT-MU will have to up the game and be more responsive to people irrespective of their religion, caste, color, political background, bank balance, social status, etc.

Will the possession of certain software be criminalised?

Lastly, Section 13 of the Bill states that any person who intentionally procures for use, a computer system or any other device, designed or adapted primarily for the purpose of committing an offence under the Act shall commit an offence.

Let's take a deep breath. Is this bill going to make Tor, Wireshark, tcpdump, Linux distributions, and tons of other operating systems and software, become tools likely for the purpose of committing an offence?

I quote an officer of the Cybercrime Unit who once stood in front of the magistrate and said:

Investigation has also revealed that Applicant is the head or the king pin of a network, well established network [...] Applicant is himself an IT Specialist with mastery of more than three operating systems, Linux is one of them.

With this kind of mentality where the knowledge of an operating system can make you a prime suspect, imagine the havoc or damage that the officers might cause if they find you in possession of network pentesting tools.

A new legislation with the same understaffed, underskilled and underpaid division will not produce results.

ICTA says it will summarize the comments & suggestions, can we trust?

Ish Sookun — Mon, 31 May 2021 03:41:42 +0000

On the 21^st May 2021, the Information and and Communication Technologies Authority (ICTA) issued a communique¹ to mark the end of the comments submission to their consultation paper² on proposed amendments to the ICT Act for regulating the use and addressing the abuse and misuse of Social Media in Mauritius.

In the communique, ICTA expressed satisfaction on the debate that the consultation paper generated. The Officer-in-Charge of ICTA, Jérôme Louis, is quoted as saying that ICTA will publish a document summarizing the comments and suggestions.

Nous allons synthétiser les réponses, et publierons sous peu un document résumant les suggestions et commentaires », indique Jérôme Louis, Officer-in-Charge de l'ICTA.

What can go wrong?

The communique itself gives an inkling on what can go wrong. ICTA mentioned in the communique that Facebook responded to the consultation paper on the 20^th of May 2021. ICTA said that if both parties come to an agreement then there will be no need for a tool to decrypt Facebook traffic.

ICTA selectively quoted three paragraphs from the Facebook’s submission, from which one may be led to believe that Facebook is commending ICTA’s efforts, welcoming the regulation and providing full support to ICTA.

It didn’t make sense to many people who read the communique that a proposal which a few days earlier Google and Mozilla were highly critical about, now Facebook is supporting the same.

I wrote to Jérôme Louis³ on the 22^nd May 2021, asking him whether for transparency sake ICTA could publish the full response received from Facebook. I also copied the Manager of Communications and Consumer Affairs at ICTA, Meera Vayapooree, but none of them replied.

How did « we » get the response from Facebook?

On the 20^th of May, before ICTA informs the public that they received Facebook’s comments, a colleague of mine, Chittesh Sham⁴ wrote to Facebook, telling them that there has been zero response from Facebook so far and questioned them on their indifference to the local authority's attempt to break the chain of trust between Facebook and its users in Mauritius.

Chittesh received a reply⁵ the next morning from Kezia Anim-Addo, the Head of Communications, Facebook Sub-Saharan Africa, who looped in two of her colleagues, mentioning that they might have been already in touch. Chittesh clarified that this is his first attempt to contact Facebook and highlighted the importance again for the organization to react on this matter.

On the 25^th of May 2021, Chittesh wrote to Facebook requesting them for an update, informed them about ICTA's brief publication of Facebook's submission and asked whether they could publish the comments that they sent to ICTA. Facebook replied with their submission attached⁶.

Thanks to the Mauritius Internet Users mailing list & its public archive, we have a record of these communications⁷ for reference.

Conclusion

If Google and Mozilla or the 50 international organizations who criticized ICTA’s proposal didn’t make their statements public then ICTA could have easily led Mauritians to believe that tech companies and international organizations are agreeing with their proposal.

A cheap display of manipulating public opinion was clear in ICTA’s latest communique.

Based on these recent events and knowing the political climate, how political nominees act like dolls on boards, it is difficult to trust ICTA being capable of showing impartiality and producing a concise summary of comments & suggestions that they received during the public consultation exercise.

I will write a separate blog post on what Facebook meant in its 12 pages submission to ICTA.

Cover photo by Ashkan Forouzani on Unsplash.

Internet Society and Mauritius IGF react to ICTA's consultation paper

Ish Sookun — Wed, 19 May 2021 06:27:33 +0000

At last, the Internet Society and Mauritius IGF published their response¹ to the ICTA consultation paper² on regulating social media. I was hoping that Mauritian NGOs would react faster and in a more collaborative way but nevertheless this response is welcomed.

It was easier for me to get in touch with Access Now, Article 19 and the Electronic Frontier Foundation and get a response from them.

Disclaimer: I admit I didn’t reach out to Mahen Busgopaul, whom I have met during past events. However, I reached out³ to Dave Kissoondoyal, who signed an email to ICANN as the President of IGF Mauritius, but I didn’t receive any response.

Ramblings aside, let’s come to gratitude.

The Mauritius IGF and ISOC’s response is signed jointly by Mahendranath Busgopaul, as the Director of Mauritius IGF and Olaf Kolkman as the Principal - Internet Technology, Policy and Advocacy at the Internet Society.

I am grateful to both of them for the response they submitted to the Information and Communication Technologies Authority, which they also released publicly.

In their summary, they highlighted the importance of encryption for both personal and national security. They aligned themselves with the points already raised in the joint civil society statement⁴ by Access Now.

Cover photo, Mahen Busgopaul, Director of Mauritius IGF, photo credits to Harel Mallac⁵.

Writer Ariel Saramandi & ICTA Chairman Dick Ng Sui Wa respond to BBC's journalist on ICTA's consultation paper

Ish Sookun — Sat, 15 May 2021 04:16:40 +0000

On Friday 14^th May 2021, writer Ariel Saramandi and the ICTA Chairman, Dick Ng Sui Wa, spoke on the BBC Newsday¹ programme.

They both spoke on ICTA's consultation paper on proposed amendments to the ICT Act of Mauritius.

Ish Sookun · Ariel Saramandi & Dick Ng Sui Wa respond to BBC's journalist on ICTA's consultation paper

I uploaded a 5m36s extract of the programme on SoundCloud. The programme content is owned by BBC. Its publication here is for solely for information purposes.

https://www.bbc.co.uk/sounds/play/w172xv2mgsm68vl

What did Mozilla & Google say, what did ICTA understand and what does the Chairman tell BBC?

Ish Sookun — Fri, 14 May 2021 16:23:28 +0000

What did Mozilla & Google say?

On Wednesday 12^th May 2021, Mozilla and Google filed a joint submission¹ to the Information and Communications Technologies Authority (ICTA) of Mauritius in response to their consultation paper² on proposed amendments to the ICT Act. I quote from the Mozilla and Google's response;

« As proposed, the ICT Act's technical enforcement measures would work to undermine the trust of the fundamental security infrastructure that currently serves as the basis for the security of at least 80% of websites on the the web that use HTTPS (...) The ICTA's proposal would thus not only put Mauritian's privacy at risk but would also compromise the integrity and security of the system that Mauritius and many other nations depend upon for essential services. The result would be a less secure internet for Mauritian citizens, one that puts them at greater risk of fraud, identity theft, and surveillance. »

In their final remark, they call on ICTA to abandon the idea of implementing the framework proposed in the consultation paper. I quote;

« We agree with the Authority's statement that the "proposed statutory framework will undoubtedly interfere with the Mauritian people's fundamental rights and liberties in particular their rights to privacy and confidentiality and freedom of expression" and urge the Authority not to pursue this approach. »

What did ICTA understand?

On Thursday 13^th May 2021, ICTA released a press communique³ in which they say that for companies like Google or Mozilla expressing themselves on the subject means that it is a global problem and not just affecting Mauritius. I quote:

« Pour l’ICTA, le fait que des compagnies aussi importantes que Google ou Mozilla se soient exprimées sur cette question prouve qu’il s’agit d’une problématique internationale, qui ne touche pas uniquement Maurice. »

What does the Chairman tell BBC?

On Friday 14^th May 2021, i.e today, the Chairman of ICTA, Dick Ng Sui Wa, replied to a journalist's question on BBC Newsday⁴. He started by relating Capitol incidents (in the U.S.A) where five people lost their lives and compared ICTA to Ofcom, UK's communication regulator.

Ish Sookun · BBC Newsday - Journalist questions ICTA Chairman on Google & Mozilla's statement

The journalist stopped him and said that he is comparing ICTA to Ofcom but Google or Mozilla have not said to the British regulator that their measures will place the privacy and security of Internet users at grave risk.

ICTA's Chairman replies, « no, I think they did not contact us directly to say this is not correct. »

I let you all draw your own conclusions.

The cover photo used is property of BBC. Source of the image is the webpage meta information provided at https://www.bbc.co.uk/sounds/stations.

The audio was recorded from BBC Newsday⁴ on 14^th May 2021 and its publication here is solely for information purposes.

Several international NGOs, people affiliated with academia, Google and Mozilla, call on ICTA to abandon the idea of decrypting social media traffic

Ish Sookun — Thu, 13 May 2021 22:40:38 +0000

On Wednesday 12^th May 2021, Access Now, an international NGO that defends digital rights and fights Internet shutdowns, published a joint statement¹ signed by over thirty other NGOs and several individuals affiliated with the school of law from Harvard and Korea University. The statement refers to the consultation paper² published by the ICT Authority (ICTA) proposing amendments to the ICT Act of Mauritius.

These organizations made it clear that ICTA has proposed disproportionate measures which are radical and would set a dangerous precedent. They called on the Mauritian government and ICTA to retract the consultation paper and explore more proportionate and rights-protective measures for the regulation of illegal conduct on social media.

A day later, two major browser makers, Google and Mozilla, filed a joint submission³ in which they say that the technical enforcement measures by ICTA will undermine the trust of the fundamental security infrastructure of websites that use HTTPS. They mention that in the past when a device manufacturer or government entity abused on similar dangerous mechanisms both Google and Mozilla took measures to protect their users and secure their products.

In short, if the government of Mauritius would adopt the proposals of ICTA, Google and Mozilla will take the necessary steps to make sure that Chrome, Android and Firefox users are protected.

Today, exactly one month since the publication of the consultation paper, ICTA has pinned Mauritius on the world map for the wrong reasons. As a responsible regulator and under the current conditions due the pandemic and businesses having been severely affected, the ICT Authority should have facilitated us to export our ICT expertise to the region. Instead, they published a shameful and dictatorial proposal not suitable for a free society, leaving us looking like a joke to the rest of the world. 😐

Cover photo was taken during the Wakashio protest in Port-Louis, Mauritius, on 29 August 2020.

S. Moonesamy's thoughts on ICTA's proposals

Ish Sookun — Sun, 09 May 2021 18:01:27 +0000

Who is S. Moonesamy?

To some of us, in the IT industry, S. Moonesamy is a well-known figure. For the sake of clarity though, I will briefly introduce him in this post.

S. Moonesamy is a recognized member of the DNS community. He has been a Trusted Community Representative (TCR) DNSSEC Root Zone since 2010.

As part of the joint effort to secure the domain name system (DNS) and the Root DNSSEC key management process, a number of persons acting as trusted representatives of the Internet community participate in the root key generation and signing ceremonies. These persons are called Trusted Community Representatives (TCRs).

He is the author of three approved RFCs, Internet standards for the Internet Engineering Task Force (IETF), and has drafted several others, among which my favorite is the draft on traffic peeking.

He currently also serves as the Board Chairman for AFRINIC.

S. Moonesamy published his conclusion on the ICT Authority's consultation paper on 3 May 2021.

Disclaimer: Please note that S. Moonesamy's thoughts are not endorsement from organizations he represents.

S. Moonesamy starts his report with an introduction of the consultation paper published by the Information & Communication Technologies Authority of Mauritius.

The report shows a screenshot of a mobile browser showing a security notification when visiting fb.com saying that the website maybe impersonating www.fb.com to steal financial information.

What is the meaning of the screenshot? It appears to be a proof-of-concept showing what does the browser do if the chain of trust with regards to HTTPS websites is broken. It alerts the user of an impersonation attempt.

He then comments on measures taken by other countries, namely Germany, United Kingdom (UK), France, and the European Union (EU). The EU & the mentioned countries were referred as examples in ICTA's consultation paper.

Commenting on measures taken by NetzDG in Germany through the Network Enforcement Act, S. Moonesamy, refers to a research report by William Echikson and Olivia Knodt of the Counter Extremism Project. In their report Echikson & Knodt conclude that it remains "uncertain whether NetzDG has achieved significant results in reaching its stated goal of preventing hate speech".

In Mauritius, the ICT Act was amended in 2016, and it became more stringent. Did the amendment help to deter cyber bullying or cyber crime?

S. Moonesamy commented on the United Kingdom's Online Harms White Paper specifying that content published by newspapers on the websites will be outside the scope of the regulatory framework.

ICTA's consultation paper, on the other hand, despite saying "social media platforms" and specifying in the communiques that only Facebook will be subject to "filtering", does not amount to enough assurance. The consultation paper itself refers to Section 18(1)(m) of the ICT Act as the mandate of the authority and the reason behind this proposal to regulate social media. However, Section 18(1)(m) is not limited to "social media platforms" but it mentions the Internet and other information and communication services.

While commenting on how social media related offences are handled in Mauritius, S. Moonesamy referred to Section 46 of the ICT Act and said that in some cases the court relied on the dictionary definition of the word « annoyance » because the Act does not define the word.

The lack of a definition causes uncertainty and puts a common person using social media at a significant risk given that it is difficult for the person to know what is permissible.

He refers to a similar provision in the Information & Communications Act of Kenya, which was struck out by the Kenyan High Court on the grounds that individuals do not know the parameters within which their communication falls.

Based on the technical information provided in the consultation paper, S. Moonesamy developed a proof of concept and confirms that it is possible to decrypt the login credentials of social media users.

Cover photo by Markus Winkler on Unsplash.

ICTA's Consultation Paper prepared by specialists, criticized by many

Ish Sookun — Tue, 04 May 2021 08:03:03 +0000

I read the interview of ICTA's Chairman, Dick Ng Sui Wa, published on lemauricien.com.

To a question on errors & contradictions in the paper, the Chairman answered that the paper was prepared by specialists and it was accepted by the Board of ICTA after considering the opinion of the Communications Manager of the ICT Authority. I quote him;

Ce papier, qui ne contient ni erreur ni contradictions, a été rédigé par des spécialistes de la question. Il a été proposé au conseil d’administration qui l’a accepté, après avoir demandé l’avis de la responsable de communication de l’ICTA.

However, the paper prepared by specialists has been criticized by many in Mauritius already, and recently it received criticisms from the Electronic Frontier Foundation (EFF).

Jillian C. York, the Director for International Freedom of Expression at EFF, calls ICTA's consultation paper the most horrifying social media regulatory proposal she's read so far.

I just finished reading all of the details of the amendments to Mauritius' ICT Act and this is, in fact, the most horrifying social media regulatory proposal I've seen so far (THREAD) https://t.co/kdI5VAZhHo
— Jillian C. York (@jilliancyork) April 30, 2021

David Greene, the Civil Liberties Director at EFF, calls the regulatory proposal from Mauritius as one of the worst.

We're seeing really bad internet regulatory proposals around the world. And this new one from Mauritius is one of the worst, raising both free speech and cybersecurity concerns. https://t.co/M2oy0PbrJ1
— David Greene (@davidgreene) April 30, 2021

In the interview, Dick Ng Sui Wa, stresses (again) that only public posts are concerned by the proposal and he does not understand why people are comparing it to ICTA "opening letters and reading them" before the letters reach their ultimate recipients.

This is a major contradiction.

The Chairman of the ICT Authority, very sadly, fails to understand the basic principle of establishing a HTTPS connection. The message in transit, be it a public or private post, is already in an envelope NOT DESTINED FOR ICTA. It's only after opening it ICTA will know that it was intended to be published for the public, a single recipient or a group of recipients.

Dick Ng Sui Wa uses the example of open letters published in newspapers. Intercepting all letters, opening them and reading, to see which is the "open letter" intended for the newspaper, before it reaches the publisher, is what ICTA has proposed in the paper. Simple as that.

Cover photo by Glen Carrie on Unsplash.

ICTA says only public posts on Social Media will be archived — Wrong!

Ish Sookun — Fri, 23 Apr 2021 09:32:31 +0000

On 19 April 2021, the ICT Authority issued a communique to bring some clarifications after people started commenting and reacting on social media about the Consultation Paper that ICTA had published a few days earlier.

After reading the Consultation Paper last week-end, I wrote a blog post explaining how the ICT Authority intends to decrypt Facebook traffic.

I quote paragraph two of ICT Authority's communique.

It has never been the intention of the ICTA to regulate the use of online messaging applications since these types of communication are of a private nature as opposed to public postings on social media platforms.

This above statement is misleading. ICTA itself is amalgamating messaging applications (WhatApp, Telegram, Signal etc) and social media. They should stick to clear and concise examples.

With the proposed toolset the ICT Authority will be able to decrypt & see all content whether of public or private nature on facebook.com, messenger.com and instagram.com. Let us not amalgamate by bringing other communication platforms and divert from the topic.

For simplicity & clarity I refer to Facebook in all my examples.

People communicate via Facebook, whether by publishing posts (private or public), commenting in groups (private or public) and through private messages.

ICTA will filter all incoming/outgoing Internet traffic in Mauritius in order to segregate social media traffic. Then, ICTA says that they will not regulate (ie. decrypt, archive & decide whether to block or not) private social media content but only public postings.

This is wrong, misleading and false.

All traffic to and from Facebook are encrypted. In order for the ICT Authority to identify what is public and what is private they will have to decrypt ALL and archive ALL content of the Facebook users in Mauritius.

Behold! Everybody's pants down. 🤦‍♂️

In a statement on a private radio an ICTA staff said that the proposed infrastructure will allow the ICT Authority to identify the authors of fake accounts through meta information (e.g the public IP address) from the Facebook traffic.

In order to do so, once again, ICTA will have to decrypt and archive all traffic in order to inspect at a later stage whether they have the IP address of someone when an "illegal content" was posted. If they do not archive the data then they will not have the meta information at the time an offence was committed.

Therefore, in my opinion, the ICTA communique is a desperate attempt to control the damage. There is no refuting that the proposed toolset will have to decrypt & archive all of the Facebook content (public posts, private posts, privates messages, private photos, private videos) in order for ICTA to achieve what they say they want to achieve.

Cover photo by Michal Matlon on Unsplash.

ICT Authority's proposal to monitor the Internet, in a nutshell

Ish Sookun — Sun, 18 Apr 2021 23:17:32 +0000

The Information and Communication Technologies Authority (ICTA) invites the public to comment on a Consultation Paper on amendments to the ICT Act which the authority proposes in order to regulate Social Media in Mauritius.

I read the Consultation Paper and in my humble opinion the authors of the paper could not define the problem they want to address.

In Section 3.1 they mention incidents that happened in Myanmar and India based on rumours on WhatsApp and Facebook. Relating issues in Mauritius, the authors mention in Section 3.3 that « we » which I assume to be law enforcement officers face a language barier when reporting offensive and abusive content posted in creole. They mention that in majority of the cases complaints made by local authorities to the social media administrators remain unattended or are not addressed in a timely manner.

It is unclear whom the authors are calling "social media administrators", whether administrators of individual groups/pages on social media platforms or the operators of the service.

There is no mention of any specific case that disturbed social harmony and where social media companies did not collaborate or were slow to respond to the requests of local authorities. The only local data which is shared is a table of incidents reported via the Mauritian Cybercrime Online Reporting System (MAUCORS). The paper mentions a total of 2,051 incidents reported between January 2020 and January 2021.

However, these are incidents reported via an online tool. No further information is provided about specific cases or how many of these online reported incidents were formally lodged, investigated and people prosecuted. Also, what were the difficulties when investigating or prosecuting, whether social media companies did not cooperate etc?

Anyway, half of the 24 pages document talks a lot with no verifiable data in Mauritius on actual cases and yet their conclusion to the « problem » can be summed up as follows:

local authorities should be able to block harmful & illegal content on social media without the intervention of social media companies,
local authorities should be able to identify people who post on social media platforms without the intervention of social media companies.

In order to achieve the above, the authors propose to amend the ICT Act to do three things.

set up a committee called the National Digital Ethics Committee (NDEC), which will comprise of people who will decide what can be deemed « harmful » on the Internet,
set up a technical unit called the Technical Enforcement Unit, which will comprise of ICTA staff personnel who will operate the technical infrastructure of monitoring Internet traffic in Mauritius,
deploy an Internet monitoring infrastructure that will intercept all incoming/outgoing Internet traffic in Mauritius, segregate social media traffic, decrypt the traffic and archive the data for inspection purposes and encrypt the traffic again.

I am not going to focus on the flaws with the NDEC & Enforcement Unit proposals. Let us instead look at what will the technical implementation of this monitoring infrastructure look like.

In a nutshell

ICTA wants to peek into your social media traffic. How can they do that since your social media traffic is encrypted? Let's see.

If the proposed amendments are passed as law and the ICT Authority deploys their Internet monitoring infrastructure, this is what will happen.

You will type facebook.com in your browser but the request won't go to the Facebook servers.
The request will go to the ICTA proxy server.
The proxy server will in turn take your browser's request and forward it to the Facebook servers.
When Facebook returns the login page, it also returns the necessary cryptographic information to start a secure connection using a username & password.
ICTA's proxy server will present you the facebook.com login page with the HTTPS padlock shown in the brower's address bar.
When you enter your username and password and press enter, they will be encrypted and sent to the ICTA's proxy server which has the key to decrypt this information.
The proxy servers reads your username & password, makes a copy and archives it for inspection purposes.
The proxy server then re-encrypts your username & password using the cryptographic information Facebook sent it earlier and sends the encrypted data to facebook.com.
Facebook decrypts it, confirms your username & password, and grants the proxy server access to your Facebook account.
The proxy server decrypts the answer from Facebook, copies it and archives the same, and then re-encrypts the page before sending it to your browser.
This process continues for all transactions between your browser and Facebook, thus allowing the ICT Authority's proxy server to make a copy of everything you do on Facebook.

How does an encrypted communication with Facebook looks like normally?

You make a request to facebook.com, Facebook servers return you an empty box and a public key. You put your username/password inside the box and lock it with the public key. You send the locked box back to Facebook. Now, this box can only be opened with the private key on the Facebook servers and no one else. If someone alongs the way copies the box, it will be useless because the box won't open.

How does an encrypted communication with Facebook in ICTA's new world will look like?

You make a request to facebook.com and the ICTA proxy server sends you an empty box and a public key. Your browser trusts this « facebook.com » which in fact is the ICTA proxy server because it trusts the certificate presented by the proxy server. We will explore this detail later. Now, you put your username/password in the box, lock it with the public key you obtained and send it the ICTA proxy server. The latter unlocks the box with its private key, makes a copy of the data, i.e your username/password. It then puts your username/password in another box which Facebook sent it and locks it with Facebook's public key. Finally, Facebook unlocks the box and confirms your username/password and the rest of the communication follows the same process ensuring every bit of information being copied at the ICT Authority's proxy server.

In cybersecurity terms this is called a Man-In-The-Middle attack, whereby an attacker relays information between two parties who believe they are communicating with each other directly.

Art of deception

For the ICTA proxy server to be able to do this it has to impersonate you when communicating with Facebook and it impersonates Facebook when it communicates with you.

To allow such a deception the ICT Authority will ask you to install a Certification Authority (CA) certificate in your browser. Once you do so, your browser will trust all websites that the ICTA proxy server impersonates.

What happens if you do not install the certificate?

Your browser will tell you that the website you are visiting poses a risk and it will discourage you from continuing. If you decide to accept the risk and continue visiting the site it means you have granted your browser permission to establish a connection with the proxy server despite the risk. Thereafter, everything's the same as specified above. If you neither install the certificate nor accept to continue with a risky & untrusted connection, then you won’t be able to visit the websites that the NDEC decide to actively monitor & regulate.

I specifically did not mention VPN services or Tor because the proposed amendments should simply not pass as law. We should not be talking about how to bypass the infrastructure but rather explain to more people about the implications of these amendments and encourage them to send their comments to socialmediaconsultation@icta.mu by latest 5 May 2021 at 16h00.

You can read comments to the ICT Authority here.

Encrypted communication illustration made by Shelly using icons by freepik.

Cover photo by dole777 on Unsplash.

Mauritius: Cybersecurity Bill

Ish Sookun — Sat, 26 Sep 2020 06:53:46 +0000

The Minister of Technology, Communication and Innovation (TCI), Deepak Balgobin, announced that the Cybersecurity Bill will be introduced to the National Assembly of Mauritius as parliament resumes on the 3rd of November 2020.

I haven't heard about any public consultation regarding this bill, neither have I heard from anyone from the local tech user groups speaking about it. Therefore, I am assuming that none of the active user groups of Mauritius were invited to share their opinion on a legislation that could affect a whole community of internet users in the country.

Copying & pasting a legislation from other parts of the world is not a solution.

Drive slow, drive safe & don't receive penalties

Ish Sookun — Fri, 31 Jul 2020 10:31:35 +0000

Lately I noticed a strong presence of police officers, particularly on roads through sugar cane fields, right after a round-about, where visibility of an officer would be poor from several metres away.

I am writing this because I had to pay a fine for driving above the prescribed speed limit. No! I was not racing. I was driving at a comfortable speed not to doze off on the wheel especially when one is surrounded by green fields on both sides. Alas, what I considered a comfortable and safe speed was unfortunately above the 60 km/h speed limit on that road. I was driving at 76 km/h.

I discourage drivers from speeding, not just to avoid a fine, but for the safety of people using the road.

Since the past two weeks I have been trying to keep my focus on the road while driving slow; that is not to fall asleep. Music helps with that.

What does the law say?

Section 124 of the Road Traffic Act mentions the speed limit. In particular paragraph (4)(a) states that:

Any person who drives a motor vehicle on a road at a speed exceeding a prescribed limit shall commit an offence and shall, on conviction, be liable to a fine not exceeding 5,000 rupees or, in case of a third or subsequent conviction, to a fine exceeding Rs 10,000 rupees.

I was not aware of Section 124(4)(b) until today.

An offender under paragraph (a) shall not be liable to be convicted solely on the evidence of one witness to the effect that, in the opinion of that witness, the offender was driving the motor vehicle at any particular speed.

In most cases of speeding drivers either receive a Fixed Penalty Notice (FPN) by a police officer or receive a Photographic Enforcement Device Notice by post. In the case of the former, if a driver refuses to accept the offence and he/she does not pay the fixed penalty then criminal proceedings are instituted against the driver; where of course the driver may plead "not guilty" and defend himself/herself. I was told so by the police officer issuing the FPN and it corroborates with Section 193 of the Road Traffic Act.

A fixed penalty must be paid within 21 days of notice.

Source: Seventh Schedule of the Road Traffic Act (Mauritius)

The amounts for the fixed penalties for exceeding speed limits were increased in a proposed amendment of the Road Traffic Act in 2018, such that the new penalties became:

Rs 2,500 for exceeding speed limit by not more than 15 km/h.
Rs 5,000 for exceeding speed limit by more than 15 but not more than 25 km/h.
Rs 10,000 for exceeding speed limit by more than 25 km/h.

In order to pay for a fixed penalty, the driver should attend the appropriate Court as specified in the FPN, produce his/her original driving license and National Identity Card, and pay the specified fine.

Payments are done at the Cash Office of the District Courts, between 09h30 - 12h00 and 13h00 - 14h30 on Monday to Friday. The Moka District Court's Cash Office is open on Saturdays also between 09h30 - 11h00. District Courts are closed on Sundays and public holidays.

In case the last day to pay a fine falls on a Sunday or public holiday then payment can be done the next day without any further penalty. Otherwise, the fine amount is doubled if the last day is missed. 🥺

New legislation to replace the Computer Misuse and Cybercrime Act in Mauritius

Ish Sookun — Sat, 25 Jul 2020 10:11:05 +0000

The latest Cabinet decisions, of 24 July 2020, mention the Cabinet's approval for the Ministry of Technology, Communication and Innovation to issue instructions to the Attorney General's office for repealing the current Computer Misuse and Cybercrime Act in order to draft a new a legislation that meets with the evolution of technology and the internet.

This new legislation should accommodate;

new offences for new types of threats and conditions in the cyberspace,
reinforced provisions for critical information infrastructure,
investigation procedures,
international co-operation against cyberthreats,
international best practices,
provisions of Conventions to which Mauritius has adhered such as the Budapest and the African Union Conventions on cybersecurity,
provisions for alignment with the new proposed National Cybersecurity Strategy.

Facebook user in Mauritius arrested for calling Member of Parliament a "dirtbag" in her timeline post

Ish Sookun — Thu, 23 Jul 2020 06:54:27 +0000

This morning l'express reported on its website that a Facebook user, Farihah Ruhomaully, was arrested after having commented on her timeline post, calling a Member of the National Assembly, Tania Diolle, an "opportunist dirtbag".

Image source: lexpress.mu article

Since amendments were made to the ICT Act of Mauritius, politicians, mainly Members of the National Assembly have grown "sensitive" to comments made about them on social media and they show almost zero tolerance to critics that contain harsh words.

The Oxford Advanced Learner's Dictionary defines a dirtbag as:

a dirty or very unpleasant person

So, here, my understanding is that Farihah Ruhomaully got arrested for calling the Member of the National Assembly, an opportunist and a very unpleasant person. 🤔

What does the ICT Act say?

Section 46(h) of the Information and Communication Technologies Act 2001 of Mauritius states the following;

Any person who —
uses, in any manner other than that specified in paragraph (ga), an information and communication service, including telecommunication service, —

(i) for the transmission or reception of a message which is grossly offensive, or of an indecent, obscene or menacing character; or

(ii) which is likely to cause or causes annoyance, humiliation, inconvenience, distress or anxiety to that person;

(iii) for the transmission of a message which is of a nature likely to endanger or compromise State defence, public safety or public order; shall commit an offence.

In December 2018 the Electronic Frontier Foundation wrote that the amendments to the ICT Act of Mauritius poses risks to the freedom of expression.

Provisional Charge

The provisional charge is a criminal procedure law that dates back to the British Colonial Rule of 1852. The Deputy of Public Prosecutions, Satyajit Boolell, wrote in a newsletter in 2015 that "although no reference to a provisional charge is made in our statute books, it has survived as a settled practice and is probably unique to Mauritius."

Update

Farihah Ruhomaully was freed on bail on the same after paying the bail amount of Rs 8,000 and signing a bond of Rs 50,000. Police did not object to her request for bail.

Ministry of Commerce removes the price control over certain products

Ish Sookun — Sat, 04 Jul 2020 08:42:14 +0000

It has been a month now since the sanitary curfew has been lifted in Mauritius and "things" have gradually started to take a normal course; or we are rather accepting the "new normal" trend.

The Government had laid strict guidelines for businesses previously but now they have been easing most of the restrictions. The latest being the removal of price control over certain products which the Ministry of Commerce and Consumer Protection had imposed after receiving complaints of pricing malpractices by supermarkets and shops owners during the curfew period.

As per the cabinet decisions of 3 July 2020, published on the Prime Minister Office's website, the cabinet has "noted" that cases of abusive prices have decreased and thus cabinet decided to remove certain products from the price control. These products include:

Butter
Spreads and margarine
Breakfast cereals
Processed cheese
Pasta
Pulses
Baby and adult diapers

Expect a price hike next time you visit your local supermarket for grocery shopping.

Why the COVID-19 Bill is nothing new?

Nirvan Pagooah — Wed, 13 May 2020 17:46:04 +0000

Just my 2 cents as regards the new COVID-19 Bill. When you compare the COVID-19 Bill to the complexity of the Biometric Identity Case [1] back in 2014, you will understand that, this is a futile battle. Ish Sookun was among the few Mauritians who initiated the battle, sacrificed part of his career, and even went to jail for poking his nose in matters, which I think should not have been opened. If you remember his ordeal [2], you'd probably understand why the COVID-19 Bill is totally pointless and how you're all being hypocrites [3]. Sanjeev Teeluckdharry took the case went to the Privy Council but unfortunately, the State won the case and now everyone is forced to give their biometric data.

It was only a very few who were concerned at that particular time. Later, the government spent around Rs 19 billion on the Safe City Project which breaches basic human privacy but again unfortunately. no one came forward to contest the project. Did we?

Hidden Agendas

It was the same Roshi Bhadain [4] who was the advocate of PKJ. The one who stood for the Government at that time. Today, he's on the other side of the table questioning the integrity of the Government. I'll let you take out your own conclusion. Personal motives or hidden agendas? Roshi Bhadain was the Minister of Technology, Communication and Innovation at the same time when Ish Sookun was arrested.

Roshi Bhadain was totally in favour of the MNIC case which gives power to the government to handle your biometric information and today, he's saying that the government is giving more power to the Police Force. Which is which here? Contradiction.

Everyone have their (hidden) agenda. As soon as it does not concern you, you won't do anything. Bunch of hypocrites, that's who you all are.

Don't call me anti-patriotic because I'm not part of the battle, I'm just fed up being part of the same people working and voicing out again and again, while the people who should be concerned are the majority of our population. I was part of bigger battles, but when you look back at the end of the day, there's nobody to support you, why should I do something now?

Now it's definitely out of the question to give police more power. I totally object to this. The MPF is a fully funded institution using taxpayers' money. They are recruited under the Commission on Public Service. Do whatever you want it isn't going to change. The day the MPF becomes an independent institution, that's the day you'll see the country change.

FOIA

Why isn't anyone concerned about the Freedom of the Information Act which was promised by the same Government back in 2014. The FOIA was on the agenda/manifesto but never put at work. It's already been 1980 days since we're waiting for that. Oh, it does not concern you or your work, that's why.

Source: https://www.lexpress.mu/politique

There is a proverb which says:

It takes a strong fish to swim against the current. Only the dead ones go with the flow.

[1] Madhewoo (Appellant) v The State of Mauritius
and another (Respondents) (Mauritius)
https://www.jcpc.uk/cases/docs/jcpc-2016-0006-judgment.pdf

[2] https://www.lexpress.mu/article/275151/ish-sookun-je-mets-police-au-defi-publier-preuves

[3] https://www.lexpress.mu/article/275408/accuse-sous-pota-ish-sookun-confie-apres-sa-liberation

[4] https://business.mega.mu/2014/04/22/biometric-id-card-mr-bhadain-roshi-law-allows-police-access-database/

Are people abusing the ICT Act of Mauritius?

Ish Sookun — Sat, 18 Apr 2020 15:36:16 +0000

Disclaimer
People who are easily annoyed, distressed or may feel an « inconvenience » should not read this post. I will not be liable for any inconvenience caused to the reader.

Information and Communication Technologies Act 2001

Section 46(h)

Any person who —
uses, in any manner other than that specified in paragraph (ga), an information and communication service, including telecommunication service, —

(i) for the transmission or reception of a message which is grossly offensive, or of an indecent, obscene or menacing character; or

(ii) which is likely to cause or causes annoyance, humiliation, inconvenience, distress or anxiety to that person;

(iii) for the transmission of a message which is of a nature likely to endanger or compromise State defence, public safety or public order; shall commit an offence.

The ICT Act of Mauritius was amended in 2018 and it made a specific section of the legislation more ambiguous than before. Section 46 of the Act describes the offences under that legislation. The amendment introduced words such as humiliation, distress and anxiety to the list of "inconveniences" in part (ii).

The Electronic Frontier Foundation says that the amendments of the ICT Act are in line with the laws of countries such as Egypt, the UAE and Jordan — none of which are democracies.

On 15 April, while the whole country was under curfew, a team of policemen proceeded to arrest a young woman for breach of the ICT Act, after receiving a complaint by a government nominated board member of the ICT Authority.

The Centre for Law and Democracy expressed their concern regarding such an arrest for political satire.

The young woman spent a night in police custody for having posted an image showing a news broadcaster with a captioned photo of the Mauritian Prime Minister and text that joked about world leaders who are going to hold a press conference to ask the Mauritian Prime Minister about his miracle treatment & method for COVID-19.

As it appears the meme or joke caused such annoyance and inconvenience to the ICT Authority's board member that he decided to spend 2 hours at the CCID Cybercrime Unit to complain about it. L'express newspaper reported that the board member expressed on Facebook that he did so for his boss, his PM, and his country.

Now, one may wonder whether this board member of the ICT Authority really has acted out of love for his prime minister or is it a show of loyalty; often the case with persons holding a nominated position in government offices. Whichever reason the complainant may have, this particular incident points towards an abuse of the ICT Act, through the manner of the arrest and act of intimidation on behalf of people of authority.

Updates

A photograph lodged a complaint against the ICTA board member following videos that he posted on his Facebook profile in which he made verbal attacks against the photograph.
After 4 hours of interrogation at the Central Criminal Investigation Division in the presence of his lawyer, the ICT Authority board member, was arrested for the breach of the ICT Act. He will have to spend the night in police custody.
He was released on bail in the afternoon of Sunday 19 April after paying Rs 15,000 and signing an acknowledgement of debt of amount Rs 100,000. He remains accused of breach of the ICT Act of Mauritius.
On Monday 20 April, a Member of the Parliament (representing constituency No. 3), lodged a complaint against the same board member of the ICT Authority at the CCID Cybercrime Unit. He submitted four videos which he claims have been now removed from the Facebook wall of the ICTA board member. The latter is said to have made verbal attacks and threats against the MP in the videos.
On Wednesday 22 April, the young woman who was arrested following the complaint lodged by the ICTA board member, came up with legal retaliation. She is suing the ICTA board member, the Commissioner of the Mauritius Police Force, the Prime Minister and several police officers. In her plaint with summons she mentions a constitutionally "incestuous" relationship between the ICTA board member and the current Prime Minister of Mauritius. She describes the ordeal she was subjected to at the hands of Police officers.

Workshop on Model Law Access to Information

Ish Sookun — Sat, 27 Feb 2016 08:02:00 +0000

It's the second workshop around the subject "Freedom of Information" that I attended within less than six months. The first being last December by the United States Embassy.

I arrived at Saint Georges Hotel yesterday morning for the workshop, slightly late as I had a minor confusion on the parking space of the hotel. The conference room was three-quarter full. I was however a bit disappointed not finding the familiar faces from the previous workshop. I was expecting to find among attendees several others who attended the workshop by the U.S Embassy, since they received the invitation too.

Yesterday's workshop was organized by the Mauritius Council of Social Service (MACOSS) in collaboration with the Centre for Human Rights of the University of Pretoria.

I told myself, okay, it's time to make some new friends. In the third row, though, S. Moonesamy from the Mauritius Internet Users sat and was listening attentively to Kadiri Maxwell from the Open Society. As usual, S. Moonesamy was taking notes on his laptop. He reported back to the group. The message which can be read on the Mauritius Internet Users public archives, also contains the presentations of Kadiri Maxwell (Legal Officer, Open Society Justice Initiative), Chantal Kisoon (Gauteng Provincial Manager, South African Human Rights Commission) and Lola Shyllon (Programme Manager, Freedom of Expression and Access to Information, Centre for Human Rights, University of Pretoria).

A few people asked questions right after the presentation by Kadiri Maxwell. While complementing Mr Maxwell's answers, Ms Kisoon added that she noticed that a media group in Mauritius published a counter that shows the number of days since the current Government promised a Freedom of Information Act. She also said while the action is laudable, it should have been a collective initiative whereby more media groups raised the awareness and exerted pressure, as well as it's needed that the citizens also voice out. When I got my chance to ask a question, I added that the counter is published by La Sentinelle Group in the "politique" section of lexpress.mu. In fact, I showed the counter ticking using my mobile phone. I then added I do not totally blame people for not voicing out. People do not voice out fearing repercussions at work. It's not unknown that people go through political repression once they start voicing out bad practices and corruption occurrences. We cannot expect a total shift in the culture within a few days, but I do hope that the courage shown by a few might push others to re-think, ponder over their inaction.

Chantal Kisoon, Gauteng Provincial Manager, South African Human Rights Commission

Chantal Kisoon's presentation was titled "a view from the inside". During the tea break I had a chat with her which turned out to be inspiring; such that she takes it as a firm duty to convince the younger generation not to be discouraged and to follow the rightful path defending human rights.

During the breaks & lunch, I met several people from different NGOs and Government agencies. We had healthy discussions. I sincerely look forward to more events on the "Freedom of Information" theme so as the pressure builds up enough for concerned agencies to take matters seriously and start working on the bill.

I will elaborate more on the "Model Law on ATI" in a separate blog post.

Freedom of Information Act. When?

Ish Sookun — Sun, 13 Dec 2015 07:48:00 +0000

Last Friday the U.S Embassy organized a workshop on "what would a model of Freedom of Information Act look like for Mauritius". I attended as a member of the Mauritius Internet Users, and introduced myself as a System Administrator at La Sentinelle and a member of the ICT Advisory Council. The workshop happened at Maritim Hotel and along the way I picked up Om and Sun. When we arrived at the hotel the workshop had started. We were shown our seats, which were on different tables. That intrigued me. Each table had eight persons, not from the same group or organization. It struck me that there should be some sort of brainstorming/activity later.

Corrina Zarek, Senior Advisor for Open Government, USA, as she finished a short discourse on the Freedom of Information, invited us to introduce ourselves to the rest of the room.

FOIA gives the legal right to request government for information and government must respond

Corrina took us back in history relating the circumstances under which the first Freedom of Information Act was implemented. That happened in 1766 in Sweden, followed by Finland in 1951. The United States of America adopted the freedom of information laws in 1966. Today around 95 countries in the world have implemented some form of freedom of information legislation, with a dozen countries in the African continent, namely Angola, Rwanda, Uganda, Zimbabwe among others.

Mauritius does not figure in the list

I was attentive and I particularly liked the part where Corrina described the "request process", mentioning the use of email. Yes, I have some very good examples of email requests that government officers did not respond to.

In fact, S. Moonesamy reported back to the group with a summary of the workshop. I recommend reading that as it elaborates the workshop as it happened.

During the lunch time, I had an informal chat with two board members, Gayle Yerriah and Kaushik Jadunundun, of the ICT Authority. I believe it is a positive sign that ICTA board members participated in the Freedom of Information workshop, after the recent Audi issues. I briefly said "hello" to the Officer-in-Charge of the ICT Authority, Trilock Dabeesing, who expressly joined the workshop for lunch. I could not discuss the missing annual reports with him since he was not to be found after lunch. I nevertheless expressed my concerns to Kaushik.

S. Moonesamy talks about the implementation of a Freedom of Information Act

How to prepare after FOIA is enacted?

There was a brainstorming session where participants were shuffled in various groups and asked to come up with a plan on how to prepare the government and requester once the FOIA is enacted. In my group, we discussed whether there should be a centralized information desk or each ministry having an information unit. The group agreed that we could have a separate office like that of the Data Protection Office with a commissioner with "authority" at its head. Each ministry could have an information officer, in the equivalence of data controllers. That way, we'll ensure that each ministry has one person who is well versed in the Freedom of Information Act. We also discussed on the need of training for "front desk"; which comprises of officers answering phone calls, replying emails and attending requests at the office counter. When answering a requester the officer should remind the requester his right according to FOIA and cite the relevant exception in case a piece of information cannot be provided.

Concerning requesters, our group reflected that, contrary to a limited budget which the Data Protection Office seem to be suffering from, this new office should be given a proper budget to make good use of media for information dissemination. Newspapers, TV and radio are good channels to educate citizens about the legislation and how they can exercise their right.

The last activity involved having people in groups of three and they had to act in the role of a requester, information officer and an expert. The situation given was that a road had repairs pending and the requester inquires with the information officer regarding details of the project, who in turn seek this information from the transport expert. The whole thing boils down to a difficult situation where an information officer would usually be crushed between the requester and the lazy/stubborn expert.

Corrina then thanked everyone for taking part in the activities and left it to us on how we should push forward. In fact, at the beginning I did ask Corrina about the outcome of the workshop, whether it'll be a report sent to the government, which might ultimately lie among a pile of files. What happens after the workshop depends on how serious and willing are we to get a Freedom of Information Act in Mauritius.

There was a comment that the press could put pressure and get our voices heard, but then I answered that lexpress.mu has put a counter on it's homepage to show the number of days since the Freedom of Information Act was promised by the current government, but sadly, few people show interest in this.

To be honest, I am not sure of the willingness of people to question the authority and ask for their rights to information. A handful of concerned citizens will raise their voice and might continue the fight though, I just hope to add a little contribution to the collective effort in some way or the other.

Two publications appeared on lexpress.mu following the workshops by Corrina Zarek in Mauritius:

Législation: la Freedom of Information Act en 2016
Il est grand temps que le Freedom of Information Act entre en vigueur