Handling take-down notices and spam complaints as an ISP
How a South African ISP should deal with take-down notices and spam complaints under ISPA's code, and how to keep a reliable record of each one.
By Achekam · · 5 min read · For Telecoms businesses in South Africa
The e-mail arrives on a Friday afternoon. A law firm says a website hosted on your network is publishing its client's copyrighted photographs and demands that you take it down. Ten minutes later the support desk forwards a complaint from an overseas mail provider: one of your business customers' servers has been sending spam all week. Neither customer has any idea yet.
For a South African ISP that belongs to the Internet Service Providers' Association, both situations are governed by ISPA's Code of Conduct, and both leave a paper trail that ISPA, a court or the complainant may ask to see later. This article sets out what the code expects, how to work through each kind of notice, and how to keep the records so they stand up when someone asks for them.
No duty to watch, but a duty to act
ISPA's code places no general obligation on members to monitor their customers' services. An ISP is not expected to read its customers' traffic or police every website it hosts. But the code requires members to act on unlawful content they become aware of, to run a take-down procedure, and to keep a record of all take-down notices and the material taken down for at least three years.
The trigger is awareness. Once a notice arrives, the ISP knows, and doing nothing is no longer an option. ISPA's Code of Conduct for members sets out the obligations and links to ISPA's own take-down procedure, which members should follow alongside their internal steps.
Working through a take-down notice
A take-down procedure turns a stressful e-mail into a routine. A workable internal sequence:
- Log the notice the moment it arrives: who sent it, when, what content it names, and where that content sits on your network.
- Check what you are being asked to do against ISPA's procedure and your customer terms.
- Tell the customer whose service hosts the content, unless there is a lawful reason not to.
- Act on the content as the procedure and the law require, and record exactly what was removed or disabled, and when.
- Reply to the complainant and file the reply.
- Close the record with a short note of the outcome.
A word of caution on step 4. For some kinds of unlawful material, simply holding a copy can itself be an offence, so take legal advice before storing removed content and, where in doubt, record a description of it rather than the material.
Customer information stays protected
Complainants often ask an ISP to say who its customer is. ISPA's code requires members to gather or keep customer information only as the law permits, and not to sell or distribute it to anyone else without the customer's written consent, except where the law requires it. A demand letter on its own is not the law requiring disclosure. Record the request, the basis for your answer and, if you do disclose, the legal requirement or the customer's written consent that allowed it.
Spam: three obligations
ISPA's code requires members not to send or promote spam themselves, to take reasonable measures to stop others using their networks for spam, and to provide a facility for handling spam complaints about their networks and react to them quickly. It adds that members' terms and conditions must give them the right to suspend or terminate customers who breach the terms or fair use policies.
That last point matters before any complaint arrives. ISPA's code also requires acceptable use policies, available before any service agreement starts, in which customers commit not to send spam. If your agreements carry that policy and the right to suspend, you can act firmly when a customer's server is compromised; if they do not, you are negotiating with a customer while your network's reputation suffers.
A spam complaint record should show:
- the complaint and its source, with the evidence supplied;
- the customer and service identified;
- what you asked the customer to do, or what you did (warning, temporary block, suspension);
- the date the problem stopped, and how you checked.
A file that shows what happened
Records kept in an inbox or a shared drive full of loose files are hard to rely on when ISPA's compliance audit, a spot check or a lawyer asks for them. ISPA's code requires members to submit an annual statement confirming compliance and to co-operate with ISPA's annual audits and spot checks, so the records will be looked at.
In Achekam, Document Centre is a folder-based store where a business uploads files or whole folders, previews, renames, moves, tags, archives and searches them. A new version of a file keeps the earlier ones, so an updated notice log never overwrites what it said before. Three other features help a take-down file hold up:
- Fingerprints. Every stored file gets a SHA-256 fingerprint, a value that changes if the file's contents change. Recording it alongside the notice lets you show later that the copy you produce is the one you filed.
- Upload checks. Executable files are refused by default and every upload passes a malware check. Notices sometimes arrive with attachments you would rather not open, and the check applies to every one you upload.
- Controlled sharing. When ISPA or your lawyer needs to see a notice, a document can be shared by e-mailing a personal link with an expiry, an optional one-time code and download allowed or not, and the share can be revoked once they are done.
A simple folder layout keeps it usable: one folder per year, a sub-folder per notice or complaint named with the date and a short reference, and a running log that lists every case with its outcome. Tag each case as take-down or spam so the year's count is a search away.
Keeping it for long enough
The code's minimum for take-down notices and removed material is at least three years. Archive closed cases rather than deleting them, and only remove a case once it is past that period and no dispute or legal matter is still open. What ISPA's code asks before a contract starts covers the acceptable use policy and terms that make these steps enforceable, and what RICA allows when recording calls deals with another kind of record an ISP keeps.
Before the next notice arrives
Write your take-down and spam procedures on one page each, name the people who handle them, and create the folder structure now. The Friday afternoon e-mail is much easier to handle when the first step is opening a ready-made folder.
General guidance only, not advice on your own circumstances. Tax and payroll rules change: check the current position with the authority or your adviser.
