The Investigator’s Handbook: South Africa Edition

What the South Africa edition covers

1. South Africa 1. Domestic legal process: who can ask for what, and how

   This chapter explains how a South African investigator obtains subscriber details, communication records, stored data and seized devices from providers and banks inside South Africa, who is allowed to issue each request, and what everyone else (private investigators, journalists, victims) must do instead. It matters because the cybercrime statute that was written to create a preservation and disclosure regime for providers is only partly in force: the sections that would create those directions have not been proclaimed, so the working routes are the older ones.

   Sections in this chapter

   • What is in force: the Cybercrimes Act position
   • Which power for which need
   • Subscriber details and communication records
   • Preservation and retention
   • Stored content, devices and records: warrants
   • Emergency requests
   • User notice and non-disclosure
   • Who may not use these powers, and what to do instead
   • Interception: awareness only
   • How a foreign investigator relates to this law
   • Electronic evidence in court: the basics
   • Worked example (generic)
   • Checklist before you serve or apply

2. South Africa 2. Internet and telecom providers in South Africa

   This chapter shows how to work out which South African provider sits behind a phone number, a domain or an IP address, what the law makes providers record and keep, which statutory duties give you a quick answer on registration details, and where the limits of our own directory are. It is written for an investigator who has a lead and needs to know whom to ask, on what footing, and how fast the law expects an answer.

   Sections in this chapter

   • Regulator and the licensing regime
   • Identifying the provider
   • What providers must keep, and for how long
   • How quickly providers must respond
   • Who to serve: our directory and the limits of what we know
   • Foreign platforms and local requests
   • Worked example (generic)
   • Checklist

3. South Africa 3. Banks, wallets and national reporting: money and complaints

   This chapter covers where a South African fraud victim and an investigator should report, what the customer’s bank is expected to do and how quickly, the two statutory ways funds can be held (the Financial Intelligence Centre’s directive and a High Court preservation order), the complaint ladder up to the financial ombud, and the official figures that show the scale of the problem. We found no single national fraud-reporting portal on the official pages we read, so the order of steps matters.

   Sections in this chapter

   • National reporting: who to tell, and where
   • What the customer’s bank must do, and by when
   • Holding and freezing funds quickly
   • Complaint ladder
   • Wallets, e-money and payment firms
   • Scale: the official figures, with dates
   • Money that leaves the banking system
   • Worked example (generic)
   • Checklist

4. South Africa 4. Cross-border: treaties, platform routes and what South African authorities can send out

   This chapter sets out the treaty position South African authorities work from, how a South African investigator reaches data held abroad, and how a foreign agency reaches providers and banks inside South Africa. The headline for cyber cases is that South Africa signed the Budapest Convention in 2001 but has not ratified it, and the cyber-specific mutual assistance chapter of its own Cybercrimes Act is not in force, so cross-border requests run on the general mutual legal assistance law.

   Sections in this chapter

   • Treaty and instrument position
   • How requests from South Africa reach the major US platforms
   • What South African authorities can send out
   • What a foreign agency should send to reach South African providers and banks
   • Decision flow
   • Checklist

5. South Africa 5. Templates, contacts and quick reference

   This chapter gives the national agencies as their own pages describe them, three ready-to-adapt templates that follow South African law (a preservation request to a domestic provider, a records request and application outline, an emergency request), and a one-page table of who to call first for six common case types. Square brackets are placeholders to replace; delete any line that does not apply. Because the Cybercrimes Act preservation and disclosure directions are not in force (South Africa Chapter 1), the preservation template is a voluntary request, and the records template uses the routes that are in force.

   Sections in this chapter

   • National agencies
   • Template 1: Preservation request to a domestic provider
   • Template 2: Records request and application outlines
   • Template 3: Emergency request
   • Who to call first, by case type
   • Checklist

Every edition also includes the global reference: how data requests work, the seven big platforms, the 116-service directory, country routes, cryptocurrency, evidence handling, templates and a glossary. See the full contents or try the free First 24 Hours checklist.

Related directories for South Africa

• Bank fraud help in South Africa
• Cybercrime agencies in South Africa
• Law-enforcement request hub (LERS)

Questions