Cyberlaw, Cybercrime in Kenya - ICT & Telecommunications Law in Kenya

THE 'INDONESIAN' JOB

2012-02-06T18:20:00.002+03:00

by Michael Murungi
Nairobi

In the wake of reports that an Indonesian hackerhad launched an attack on 103 websites belonging to various institutions in theGovernment of Kenya, I shared my thoughts with Sammy Mwangi of BusinessPost.

The gloatpost on www.direxer.com attributed to themystery ‘Indonesian’ hacker who reportedly defaced 103 Government of Kenyawebsites.

How canyou define cyber crime in simple terms and what entails cyber crime? Cyber crime generalrefers to any unlawful act that is committed by the use of computers, theInternet and other information and communications technology. The definition isalso being expanded to include unlawful acts that target computers, theInternet and other information and communications technologies.

What is the state of cyber security inthe country?

Under the Kenya Information and Communications Act, it is theCommunications Commission of Kenya (CCK) has the functions of promoting publicconfidence in the integrity and reliability of electronic records andelectronic transactions and promoting and facilitating efficient delivery ofpublic sector services by means of reliable electronic records. The CCK is in theprocess of establishing a cyber security management framework. Already, it hasestablished a Computer Incident Response Team Co-ordination Centre(KE-CIRT/CC). The role of the CIRT/CC is ‘to co-ordinate computer securityincident response’ at the national level in co-ordination with local, regionaland international CIRTs. It will carry out research and analysis on computersecurity and facilitate the development of a national public key infrastructure.

I think the CIRT will fill in a big informationgap that confronts anyone looking for authoritative statistics about theincidence and typology of cybercrime in Kenya. What we have are anecdotes,unconfirmed media reports, gloat reports posted by reported hackers in obscurewebsites, etc. I see the CIRT soon establishing itself as the focal point inhelping us to triangulate information from the Cyber Crime Police Unit, theNational Security Intelligence Service and victims of hacking. What is clear is that Kenya is notdifferent from many other countries – with the increased use of computers andother communications technologies, the criminal enterprise is increasinglymoving into the domain of cyberspace and very many offences are being committedthere, including banking and credit card fraud, theft of personal information,illegal access to and damage of information system (malicious hacking), e.t.c.

What wereyour thoughts and feelings when you heard that someone had hacked into over 100government websites?

My thoughts were that this was probably thebiggest hack that the Kenyan government has suffered yet. I thought about thechallenges of pursuing, arresting and prosecuting cyber offenders and how newways of committing the offences always seem to come up with every advance insecurity technology.

It isobvious that the relevant institutions were not prepared for such an attack.What in your view should have been the right approach to handle this?

I don’t think that it is obvious that theGovernment was unprepared. That is a common judgment that people like to passagainst the Government. The only information that is in the public domain isthat over one hundred government websites were defaced by a black hat(malicious) hacker who claimed to be operating from Indonesia. There is noinformation in the public domain that I am aware of that gives us theparticulars of the hack such as the security architecture that was running onthe government system that was hacked or indeed, the nature of thevulnerability or loophole that the hacker exploited. Without that information,I think it is unfair to say that the Government was unprepared. You would recallthat last year, the government established the national computer incidentresponse team which has the facilitation and co-ordination of theCommunications Commission of Kenya.

I do not yet have all the particulars about thenature of the Government’s action in response to the hack but from theinformation that is available to the public, I believe that the right approachhas been taken. The government appears to have galvanized its first responders –comprising of the members of the CIRT and security experts – to forensicallyexamine and perhaps monitor activity on the compromised information system, tolater take it offline and thereby deny the hacker access to it and to begin apost-mortem of the hack. I have noted that some of the websites that the hackerwas reported to have hacked were restored even less than a day after theattack.

What entails the security of a server? In my opinion: Architecture and Hardware;Software; Redundancy; People and Processes

Architecture and Hardware/Physical security – thecomputer system has to be in a physical location that is protected from naturaland man-made disasters and hazards. The building or the facility in which it isinstalled has to be safe and secure. I know that most institutions are nowconsidering the cloud but still the security of the physical infrastructure ofthe cloud service provider should be an important consideration.

Software/Data integrity – The information systemwill need to be protected by a software architecture that controls and managesaccess to it, detects and prevents unauthorized access and continually updatesitself with the latest improvements in order to seal loopholes that may belatent in the system or continually detected or created by hackers, botnets andother malware.

Redundancy – The system will need to be backed-up or mirroredso that the data and information stored in it is replicated on one or moreother server installed at a different (offsite) location This other server willbe on stand by to take over from the parent server where the latter server iscompromised. This is essential for business continuity planning.

People and Processes – The system as well as thegeneral computer environment of which it is a part will need to be managed andused by people who understand and apply the best practices in information anddata security. The personnel will have the knowledge, tools and resources toanticipate and respond to an attack on the system.

And howdo we attain that security in the country?

There is no shortage of information, tools andknowledge resources about how to secure your data in Kenya. What governmentdepartments need to do is to reduce their dependency on the central governmentin matters of information security. The information and data networks of thegovernment are as many as there are government institutions and thisinfrastructure can only be as secure as the most vulnerable one in the group.Beyond the policy directions and the information security standards that aredeclared by the central government, it is the responsibility of individualinstitutions to formulate and apply their own information security strategy inline with the best practices. In the same way that the fire extinguisherinstalled at the reception comes in handy in putting out an electrical fire andpreventing a major fire disaster in the office, the central government’sresponse, including the CIRT, should only serve as a complement to theindividual institution’s security response plan. Having said that, it is alsoimportant for the central Government to review its entire informationinfrastructure and to designate the components of it that are critical – eg forpurposes of national security – and in need of special protection in their useand management.

As theGovernment pushes on with getting most of its services online, which is a goodthing, do you feel there is relevant capacity and expertise to protect thedata?

I think that the capacity is there and there isno shortage of knowledge. Kenya has a CIRT, the Directorate of e-Government inthe Office of the President, the Communications Commission of Kenya, the KenyaICT Board, the National Communications Secretariat, government informationtechnology officers, government training institutions and courses on ICTSecurity and management, ICT training budgets for individual institutions,access to free online resources on ICT security.

How canyou rate the performance of the recently formed Computer Incident Response Team(CIRT)?

I do not have any information about it so farthat would enable me to rate its performance.

Does thecountry have a policy framework aimed at the protection of data or laws thatare specific to cyber crime?

Yes it does. The Constitution of Kenya 2010 isvery clear about data protection, especially data that relates to anindividual. It establishes the right to privacy, including the right not tohave one’s personal information unnecessarily required or disclosed, as aconstitutional right. It also establishes the right of access to publicinformation. The Kenya Information and Communications Act, 1998 createsnumerous offences with regard to data protection: unauthorized access to aninformation system and data; unauthorized interception of a computer service;damaging or denying access to a computer system; unauthorized modification ofcomputer material; unauthorized access to a protected computer system.

What doyou think needs to be done on the issue of cyber security not only by thegovernment but by all stakeholders?

I think a lot has been done and more is beingdone. Reference groups and forums that involve the government, the privatesector, civil society, individual and institutional experts, etc are animportant driver of reform and improvement in compelling national issues andcybersecurity is one of them. Oneof the greatest challenges in detecting, preventing, investigating andprosecuting cyber crime is the trans-boundary nature of many of these crimes.If indeed the recent hack into Kenya’s government systems was perpetrated by acitizen of Indonesia operating from his country, it all comes down to how thehacker can be traced, pursued and prosecuted in Indonesia or Kenya. This wouldnecessarily require co-operation between Kenya’s law enforcement and Indonesia’sriding on the strength of a mutually binding agreement or understanding betweenthe two central governments (whether by being common signatories to aninternational treaty or agreement or by having mutually outlawed ‘hacking’ inboth countries, etc.).

Cyber Law in Kenya, a book by Michael M. Murungi

2011-12-31T12:26:00.000+03:00

Cyber Law in Kenya

by Michael M. Murungi

List Price: $103.00
Eligible for Free Standard Shipping on U.S. Prepaid Orders
Imprint: Kluwer Law International
Published: 8/16/2011
ISBN: 9789041136800
Paperback: 256 pages

Click here to preview this book on Google Books

Click here to purchase

Description by Kluwer Law International

Derived from the renowned multi-volume International Encyclopaedia of Laws, this practical guide to cyber law – the law affecting information and communication technology (ICT) – in Kenya covers every aspect of the subject, including intellectual property rights in the ICT sector, relevant competition rules, drafting and negotiating ICT-related contracts, electronic transactions, privacy issues, and computer crime. Lawyers who handle transnational matters will appreciate the detailed explanation of specific characteristics of practice and procedure.

Following a general introduction, the book assembles its information and guidance in seven main areas of practice: the regulatory framework of the electronic communications market; software protection, legal protection of databases or chips, and other intellectual property matters; contracts with regard to software licensing and network services, with special attention to case law in this area; rules with regard to electronic evidence, regulation of electronic signatures, electronic banking, and electronic commerce; specific laws and regulations with respect to the liability of network operators and service providers and related product liability; protection of individual persons in the context of the processing of personal data and confidentiality; and the application of substantive criminal law in the area of ICT.

Its succinct yet scholarly nature, as well as the practical quality of the information it provides, make this book a valuable time-saving tool for business and legal professionals alike. Lawyers representing parties with interests in Kenya will welcome this very useful guide, and academics and researchers will appreciate its value in the study of comparative law in this relatively new and challenging field.

The Arab Spring, the Occupy Movement & Anonymous: A Socio-political epiphany?

2011-12-30T16:16:00.001+03:00

By Michael Murungi

Nairobi, December 2011

Do not be mistaken - the Arab Spring is not a season in the Islamic calendar, or a revolutionary mattress technology from the Middle East; the Occupy Movement is not a U.S. government programme to move sub-prime mortgage defaulters into public parks; and Anonymous is not an online discussion forum for people recovering from alcoholism. These three terms possibly identify the archetypes of a momentous socio-political revolution that is unfolding before our very eyes.

What do the Arab Spring, the Occupy Movement, the Russian Protests and the activities of the hacker collective Anonymous have in common? I will give you a clue – in the Arab Spring, in an act of self immolation, Mohammed Bouazizi, a street vendor, sets himself alight in protest against the government in December 2010, and becomes the spark that ignites a wave of revolutionary civilian protests across seventeen states in the Arab world throughout 2011; in the Occupy Movement, citizens besiege Wall Street, the symbol of American capitalism, in a September 2011 protest against rising corporate greed and impunity in the face of an economic recession and declining societal welfare, inspiring similar protests in over 85 countries; in the Russian protest, pockets of discontent about flawed legislative elections in November 2011 snowball into the largest anti-government protests in two decades in a country that was once the nerve centre of the largest bloc of communist states; and finally, Anonymous, a loosely organized group of computer hackers carries out co-coordinated malicious and devastating (but allegedly ‘socially responsible’) hacking activity against perceived ‘socially irresponsible’ government and corporate targets.

The first thing that these movements have in common is that they feed from each other – the Occupy Movement was said to be partly inspired by the Arab Spring; the rear guard to the Arab Spring’s street protests was a cyber campaign in which Anonymous compromised many government websites and databases; and in laying out the principal demands of the Russian Protests, Sergy Udaltsov, the leader of a revolutionary anti-capitalist movement, cited the Occupy Movement and borrowed its popular refrain, ‘We (the people) are the 99%’.

But there is another subtle yet very important similarity – these movements powerfully illustrate a shift in political and social power, a reality check on how governments will wield their power in an increasingly globalized (and socially networked) world. Each movement is like a continental release of the latest edition of what is the longest running show on political Broadway – the rise of the common citizen against the authority of government, the good old tale of David vs Goliath, Joe Public vs Big Brother; Tom, Dick, Harry and Jane against all the King’s men.

The story of the moral: The power of the www

These movements owe a large part of their success to the power of the world wide web, and more particularly, to some of its defining characteristics: its distributed and globalized nature; its openness as a free democratic space for social interactions; its challenge to conventional methods of governmental control or regulation; and its capacity to offer a high level of both anonymity and control over one’s content. Many of these movements were organized and coordinated over social networks such as Facebook and Twitter. In the Arab spring, while governments scrambled to control radio and television, alternatives such as Facebook posts, Twitter feeds and YouTube videos coming from the heart of the uprising became the fodder of conventional news reporting in international media and defined the rest of the world’s view about the movement.

This power of the web is illustrated by two unlikely headlines that could easily have passed off as stand-up jokes not more than a year ago. The first one is: ‘Arabs Inspire America’s Social Justice Movement’. Who would have imagined that America would look to the Arab world for inspiration in social justice - which is much more than oil and Persian carpets - with two unfinished American-led wars in Islamic countries and with America’s popular media’s projection of the American-Arab cultures as representing the dichotomies of the liberal versus the ultra-conservative, the free versus the oppressed, libertarians versus well-adjusted slaves and even good versus evil? This is a phenomenon that in my opinion could not have been achieved without the world wide web. To achieve the same success in the pre-internet world, I imagine that one would have had to mount a massive propaganda campaign to shift America's social conditioning about the Arab world. And the campaign would not have the benefit of images, videos and posts from the frontlines of the Arab uprising because without social media, Americans’ view of the uprising would be based on radio, tv and print news from sources controlled by the Arab governments and repackaged by America's news networks. The fact that the wave of the Arab spring caused a ripple in North America in such a short time is largely about the power of like-minded groups (or ‘cells’ depending on your perspective) to communicate with each other and to organize themselves into action through the medium of the world wide web.

The other unlikely headline: ‘UK Considers Censorship of Twitter & Blackberry Messenger’. This was in the wake of the protests, riots, arson and looting that swept through parts of London in August 2011 following what was a peaceful protest against the shooting to death by the police of Mark Duggan, a young man whom the police described as a suspected criminal. The protest appears to have morphed into a localized violent civil retaliation against perceived social inequalities and government failure. The UK government was reported to be considering internet censorship following ‘reports that the Blackberry Messenger service was used by looters to organise their activities, and that inflammatory and inaccurate accounts of events on social media sites may have incited disturbances’ (see Wikipedia on the London protests). The last time before this that the British government had opened its mouth about Internet censorship, it was in chorus with the international community as it expressed its condemnation of certain Arab governments’ chokehold on the Internet, social media and independent news reports at the height of the Arab spring. Such is the power of the world wide web – seriously underestimated by governments and offering equal opportunities to both looters and anarchists on the one hand and to civilian revolutionaries on the other to do what they do best (About the arson and looting that was part of the London protests, ‘Lulu Rose’ wittily tweeted: “The Youth of the Middle East rise up for basic freedoms. The Youth of London rise up for a HD ready 42” Plasma TV”).

The moral of the story: A social, economic and political epiphany

The curtain has not yet come down on the worldwide Broadway show – as I blog, something is about to give in Syria, Russia is on edge, an economic storm is hanging over Europe whose implications for social order are only too scaring to contemplate and in Sub-Saharan Africa social conditions are ripe for an opening night of the show. The story is still unfolding but so far, I think the movements may have pushed the collective consciousness of humanity to cross certain socio-political milestones:

- For the corporation and the capitalist movement: It should no longer be all about the bottom line – beginning with the devastating American economic crisis and culminating in the Occupy Movement, new terminology has come to the fore that begins to define the emerging new world order – social capitalism, corporate shared value, social business and (rather ineptly in my view) ‘benevolent capitalism’. It is the notion that the welfare of society should be at the centre and no longer at the edges of the corporate strategy. That business objectives should be inextricably linked with social progress; that capitalists should no longer continue to prosper at the expense of the broader society. (see this blog post on the Harvard Business Review). A number of socially conscious corporations have been living the idea – which others have fashionably sought to emulate in the name of corporate social responsibility (CSR). Shared value and CSR are not even removed cousins. CSR has mostly been about the occasional corporate lets-go-and-visit-a-children’s-home day. Shared value is more than just practicing random acts of charity. It is about the viability of the business enterprise being yoked together with positive social outcomes such as spreading the gains of the business to the employees and the larger society.

- For governments: in an increasingly socially networked information society, the balance of power has shifted (more heavily) to the citizen. The World Wide Web has melted geographic, cultural and ideological boundaries between societies. Disparate groups of individuals across different countries and cultures can now coalesce into a distributed group mind through social networks and blogs. A revolutionary idea in one corner of the globe goes viral and inspires a movement in another corner. Whether a government survives or thrives will depend on its understanding of and reaction to this shift in power.

- For the citizen: (I excerpt from my earlier post on 'We-government) More than any other time in the unfolding story of humanity, you have the power to engage with and impact your world. You have at your disposal tools that give you unlimited access to information and command over knowledge. In the domain of cyberspace, you can project your persona and share your thoughts, ideas, dreams and even your fears and concerns with the rest of the world, and you can do this anonymously, from the convenience of your private spaces and in a way that gives you absolute control over your own content. This is a great power. But the true measure of an individual is not in how much power he holds but in how he wields it. We-government is about taking advantage of the increased democratic space offered by the ability to engage with government and society to add one’s voice to the governance and social justice discourse. It is taking advantage of the power of current and emerging communication technologies to move from being a passive recipient of government services to an engagement with government and society that is qualitative, sustained and capable of harnessing the participation of like-minded citizens in causes that contribute to the progress of humanity.

HIGH COURT AUTHORIZES TAKING OF EVIDENCE BY VIDEO CONFERENCE

2011-10-02T16:55:00.008+03:00

The video conferencing terminal installed at the Nairobi Law Courts in October 2010.

Livingstone Maina Ngare v Republic [2011]eKLR
High Court of Kenya at Nairobi, Criminal Revision No. 88 of 2011
The Hon. Mr. Justice Fred A. Ochieng
July 28, 2011

By M.M. Murungi

The High Court has allowed the taking of evidence in a criminal trial by videoconference. In a case in which two witnesses resident in the USA expressed their reluctance to travel to Kenya to give evidence because they feared for their safety, the High Court has ruled that the magistrate’s court was wrong in declining an application by the prosecution to have the evidence given by video conference. The Court has cleared the way for the evidence of the two witnesses to be given and received through videoconferencing terminals placed at the Kenyan embassy in the USA and the Nairobi Law Courts.

In October 2010, Kenya’s Judiciary had commissioned video conferencing terminals installed at the Nairobi and Mombasa Law Courts (see separate story - click here) and the Court of Appeal had heard a number of procedural applications argued by lawyers appearing by video link. However, the participation of the advocates and their parties was consent-based to guard against the possibility of parties challenging the legality of the use of videoconferencing as a way of receiving evidence.

In this case, Livingstone Ngare (the respondent) was on trial in the Nairobi Chief Magistrate’s court on a charge of obtaining an advantage without lawful consideration (one can call it obtaining an unjust enrichment) contrary to section 65(1) of the Prevention of Corruption Act. The prosecution had called eleven out of thirteen witnesses. The last two witnesses, who were resident in the United States of America and who the prosecution described as being extremely crucial to the case, feared for their safety and did not want to enter Kenya. They had allegedly received threats of violence on account of the testimony that they were about to give.

Following a request by the prosecution that the court should relocate the trial to the USA for the purpose of receiving the evidence of the two witnesses, the Chief Justice of Kenya published a notice in Kenya’s official gazette designating Kenya’s embassy in Washington D.C. as a court for the purposes of the evidence of the two witnesses. However, because the respondent raised strong objections to this, the arrangement was abandoned.

The prosecution then made an application for the evidence of the witnesses to be received by way of video-link (through a video conferencing terminal located at the Kenyan Embassy in Washington and the other at the Nairobi Law Courts). The trial magistrate rejected the application on the ground that there was no legislation providing for the taking of evidence by video-link. The magistrate observed that the application of video conferencing technology in the courts of other countries was supported by specific legislation on the taking of video evidence.

The State moved to the High Court asking it to review and reverse the magistrate’s decision.

In opposing the application, the respondent proffered several objections to the taking of evidence by video-link or video conference. He argued that it was against the law for a court to:
• Sit outside its territorial jurisdiction;
• Abdicate its duty to control its processes and to give the supervision of a
remote witness to another person;
• Issue orders in respect of a procedure which has no lawful application; and
• Deny an accused person his right to a fair trial by abdicating its control over witnesses and its immediate ability to punish for perjury.

In dismissing the respondent’s arguments and allowing the prosecution’s application, Justice Fred Ochieng made the following findings:
• The High Court has the power to review a decision of a subordinate court if it was satisfied that any finding, sentence or order recorded or passed; or the regularity of any proceedings of that court did not meet the required standards of correctness, legality or propriety.

• Even in the absence of legislation, a trial court was obligated to make orders dispensing with technicalities of procedure if it would result in substantive justice.

• Since the video terminal through which the testimony of the two witnesses was to be received was located in Nairobi-Kenya, the respondent was wrong in arguing that the court would be sitting outside the territorial jurisdiction of Kenya.

• In Republic v Kipsigei Cosmas Sigei & another, in which the High Court of Kenya considered the admissibility of evidence contained in a video recording, Justice GBM Kariuki had stated that the absence of specific legislation on video evidence did not outlaw the admission of such evidence, and the High Court had ‘a duty to adopt a common sense approach [and] …inherent power to do justice in accordance with the law…[The Court] must respond to and keep pace with advancements in science and technology and societal changes’.

• In R. v Misic [2002] 2 LRC 1, the New Zealand Court of Appeal, while considering the question whether a computer programme existing in electronic form or the hard disk on which it was recorded were a ‘document’ for the purpose of the law of evidence, observed that a piece of papyrus, a page of parchment, a copper plate or a tablet of clay on which information was recorded were all documents. The document exists because there is a material record of information. The existence of information, rather than the medium on which it was made, was the definitive feature.

• In the English case of R v Maqsud Ali [1966] 1 QB 688, in which a tape record of a conversation was admitted in evidence even though the only witness who had overheard it was not conversant with the language and could not make out what was said, the English Court of Criminal Appeal had held that a tape recording is admissible in evidence provided the accuracy of the recording can be proved, the voices recorded properly identified and that the evidence is relevant and otherwise admissible. The Court nevertheless stated that such evidence ‘should always be regarded with some caution’ and each case would depend on its own circumstances such that no exhaustive set of rules may be laid down by which the admissibility of such evidence may be judged.

• In R v Davis (2008) UKHL 36, the United Kingdom House of Lords observed that even though face-to-face confrontation with trial witnesses was important, such confrontation was not necessarily an indispensable element of the constitutional right of an accused person to face his accusers. It may be dispensed with where it is necessary for public policy and where the reliability of the testimony is otherwise assured.

• In that case, the House of Lords further observed that the use of one-way closed-circuit television procedure, where it was necessary to further an important state interest, ‘did not impinge upon the truth-seeking or symbolic purposes of the Confrontation Clause’.

• In India, in what is arguably one of the leading judicial opinions in the Commonwealth on the use of video conferencing in giving and receiving evidence, the Supreme Court considered the case of The State of Maharashtra v Praful [2003] INSC 207, in which a witness who was willing to give evidence had stated that he was not ready to travel to India for that purpose. The High Court had ruled that it was mandatory for the witness to be in the actual physical presence of the court building. The Supreme Court observed that in video conferencing, both parties are in the presence of each other and that as long as the accused or his lawyer/attorney was present when the evidence was recorded by video conferencing, that amounted to recording the evidence in the ‘presence’ of the accused and such a procedure of taking evidence was in accordance with the law.

• In this case, the Supreme Court addressed itself to practical aspects of setting up the video conference and how to deal with certain concerns about the procedure that may be typically raised by parties opposed to it.

• In the case at hand, the High Court of Kenya ruled that it would allow the taking of evidence from the two witnesses by video conference. A judicial officer would be present in Washington at the witnesses’ video terminal to administer the oath and to ensure that the witnesses were present and that they were not coached, harassed or otherwise interfered with. At the other video terminal in Nairobi would be the trial court and its officers, the accused person, his lawyer and the prosecutor or state attorney. The accused would have every opportunity to cross-examine the witnesses as they were practically in his presence.

• The Judge observed that if the prosecution was forced to close its case without taking the evidence of the two witnesses by video conferencing, a procedure that would not prejudice the respondent, this would imperil the public interest in having all the evidence laid before the court in order for it to arrive at a just decision.

• The decision of the trial magistrate to exclude video conferencing as the medium of receiving the testimony of the two witnesses was ruled to be improper and an order was made for the evidence to be given at the expense of the prosecution.

FROM E-GOVERNMENT TO ‘WE-GOVERNMENT’: AN ALTERNATIVE VIEW OF CITIZEN POWER IN THE INFORMATION SOCIETY

2011-09-10T13:22:00.004+03:00

Michael M. Murungi
Nairobi
September 2011

In the popular view of e-government, the citizen is seen very much as a passive recipient of government services, and government is traditionally seen as the flawed outcome of a compromise between chaos and social stability; a necessary bureaucratic evil which should be provoked less and tolerated more.

Recently, I had the pleasure of working with The Hon. Mr. Justice P.N. Waki, a Judge of Appeal in the Court of Appeal of Kenya who is also the Chairman of the Judiciary ICT Committee, in imagining and presenting an alternative view of e-government to a gathering of scholars, ICT professionals, students, entrepreneurs and government officials at the 12th Strathmore University Annual ICT Conference held between 2-3 September under the theme: ‘ICT for Development – People, Policy & Practice’. This alternative view is ‘we-government’ (a phrase and idea I first heard from Aleem Walji, Practice and Innovation Manager at the World Bank) and it was presented in the form of Justice Waki’s keynote speech - ‘Alternative Approaches to E-Government’ - delivered at the opening of the conference:

Debunking conventional wisdom
“Electronic Government (or in short 'e-Government') essentially refers to ‘The utilization of information and communication technologies to improve and enhance the efficiency and effectiveness of service delivery in the public sector’. His Excellency the President is on record, stating that e-Government is one of the main priorities of the Government towards the realization of national development goals and objectives for wealth and employment creation.

The Government has an e-Government Strategy outlining the objectives and processes for the modernization of Government, the enhancement of transparency, accountability and good governance; making the Government more result-oriented, efficient and citizen-centred; and enabling citizens and business to access Government Services and Information as efficiently and as effectively as possible through the use of internet and other ICTs. An institutional framework has been established under the Directorate of E-government to oversee and coordinate the implementation of the e-Government Strategy.

I may not be able to offer any alternative model of e-government that would be conceptually or institutionally better than the one adopted by our Government. However, since the topic I have been requested to speak on is fairly wide I will endeavour to offer a prescription for an alternative approach by the citizen towards e-government.

Conventional wisdom about the relationship between the citizen and e-government defines the citizen’s interaction with the government’s ICT infrastructure as a one-way street on which government content and other services are delivered to the citizen. In this scenario, even though some level of interactivity may be involved, the citizen is seen very much as a passive recipient of government services, and government is traditionally seen as the flawed outcome of a compromise between chaos and social stability; a necessary bureaucratic evil which should be provoked less and tolerated more.

We-government
The alternative view of e-government that I offer is therefore the Citizen’s perspective -- a view that places the citizen right into the heart of government affairs and makes him or her an active collaborator in the affairs of government. E-government thus becomes, ‘we-government’.

We-government is about taking advantage of the increased democratic space offered by the ability to engage with government to add one’s voice to the governance discourse. It is taking advantage of the power of current and emerging communication technologies to move from being a passive recipient of government services to an engagement with government that is qualitative, sustained and capable of harnessing the participation of like-minded citizens.

The convergence of telephony, radio, broadcasting and computer media has been one of the defining characteristics of the information age. More than any other time in the unfolding story of humanity, we have tools that enable us to have unlimited access to information, and command over knowledge and knowledge systems. In the domain of cyberspace, we can project our persona and share our thoughts, our dreams and even our fears and concerns with the rest of the world, and we can do this anonymously or openly, from the convenience of our homes and offices and even as we travel. Most importantly, we can do this in a way that gives us absolute control over our own content.

Today, when an idea is written on paper, it is known only to the writer and those to whom that paper is transferred. The diffusion of the idea and its possible contribution to the information heritage of humanity is restricted by the limitations of the time, effort and resources that have to go into the mere act of distributing the paper. On the other hand, if that idea is typed on a computer and published on a blog or on a social media platform, it is instantaneously available to billions of people. If any time, effort and resources have to be expended on it, it is in enriching it and transforming it from an idea to a product or other useful application. This is because while the writing on the paper is dormant, the bit, which is the smallest element of an electronic record, is alive with electro-magnetic energy. This electro-magnetic energy is the propulsion fuel for cyberspace – the bit can travel across space instantaneously; it is discoverable by internet search engines; it has the artificial intelligence to identify and aggregate itself with correlated data-streams in cyberspace.

Citizen power
So what does this mean for we-government?

It means that the citizen has the opportunity to engage and collaborate with government on a level that makes him or her a worthy partner in governance and democracy. I will demonstrate this with three examples:

¬The first is using cyberspace as the new space for social and political organization. Recent international news reports have made us witnesses to the fall of governments and the re-organization of the social, political and economic affairs of countries through popular uprisings organized and coordinated using the power of social media. The bloody and chaotic aftermath of most of these uprisings is not an indictment of social media but a demonstration of the consequences of violence and a breakdown of the rule of law. Without condoning the loss of life, violence and destruction that has characterized these uprisings, something may be said about the positive role that social media can potentially play in social organization and the expression of citizen needs to government.

The second is the act of Crowdsourcing. According to Wikipedia, crowdsourcing is the act of outsourcing tasks that were traditionally performed by an employee or a contractor to an undefined, large group of people or community through an open call. Through crowdsourcing, the public may be invited to develop a new technology, carry out a design task - also known as community-based design or design by democracy - or help capture, systematize or analyze large amounts of data. A good example is Wikipedia itself – a free online encyclopaedia written and edited collaboratively by largely anonymous internet volunteers. A local example is Ushahidi, where citizen reports of crime and violence are used to map the incidence and distribution of crime and help with the co-ordination of relief efforts. You can begin to see how much a government would stand to benefit by crowdsourcing the collective wisdom of its citizens for an idea or a solution to a problem.

Finally, there is citizen entrepreneurship that is driven by e-government. By this I mean the opportunity for the citizen to take advantage of the availability of public information online, to abstract that information and incorporate it into new applications and products that add value to the information. Early in July this year, His Excellency the President launched the Open Data initiative in which massive sets of raw statistical data and other public information was released to the public in electronic format. At the same time, the National Council for Law Reporting, a service state corporation in the Judiciary, launched an online archive of Kenya Gazette editions spanning over 100 years and the records of Kenya’s Parliamentary debates spanning over 50 years. Far from the enrichment of society that comes from this democratization of knowledge and information, application developers can transmute this information into applications that structure it and present it in ways that add governance value. One example is using non-aggregated demographic data to develop a visually interactive map of the number and distribution of households with access to basic social amenities.

Ask not what the government can do for you....
In conclusion then, the approach of ‘we-government’ that emerges is one in which the citizen shifts from asking ‘what can the government do for me’ to asking the following:

• How can I add my civic voice to the citizen governance forums that exist in cyberspace in a way that meaningfully represents my personal or communal interests to the government?

• How can I contribute my skills and knowledge online in a way that contributes to participatory and communal problem solving that meets current and emerging challenges in governance and democracy?

• And finally, how can I use the knowledge that I have gained in Strathmore University to develop computer applications or other innovations that lead to better use and understanding of public information while at the same time making me a rich and famous ICT entrepreneur?”

BEING GENUINE ABOUT ‘FAKE’ PHONES

2011-09-01T10:48:00.008+03:00

By Michael M. Murungi
August 2011
Nairobi

Image courtesy of www.rediff.com

It has been recently reported in the Kenyan press that the Communications Commission of Kenya (CCK), which is the regulatory body for the ICT, telecoms and broadcasting industry, has either directed or is considering directing telecommunications service operators to deny service to the owners of ‘fake’ cell phone handsets. It has been further reported that the criteria that is to be applied in identifying the ‘fake’ handsets over the telecommunications operators' networks is those handsets without International Mobile Equipment Identity (IMEI) Numbers or those whose IMEI numbers are otherwise not discoverable over the network. The move is said to be considered necessary in the interests of combating counterfeiting and the sale and use of substandard telecommunications terminal equipment.

So many other things have been said and continue to be said in this debate and I would like to weigh in. I will discuss the premise and the merits of the proposed directive by CCK by tendering and then analyzing the following propositions:

- A distinction needs to be made and maintained between ‘fake’ and ‘counterfeit’.
- Not all counterfeit phones are necessarily substandard.
- The assignment of an IMEI number to a cellular phone handset is not necessarily a statement that it meets prescribed regulatory or industrial quality standards
- The fact that a phone does not have a manufacturer’s IMEI number assigned to it does not mean that it is irredeemably incapable of being made uniquely identifiable on a cellular network
- Denying service to the owners of non-IMEI numbered cell phones is a blunt weapon for combating counterfeiting because it tramples on the constitutional and legal rights of consumers.

Fake versus Counterfeit
First, the quality of any debate is as good as the choice of the words used in it. Let us first disambiguate that all-encompassing term ‘fake’. Its plain and ordinary meaning would be ‘a thing made to appear otherwise than it actually is’. A friend of mine was once the victim of a popular confidence trick on the streets of Nairobi – a con artist pretends to be in a rush to dispose of a high grade phone through a quick pay-as-you-walk sidewalk transaction. As he walks along giving the potential buyer momentary glimpses of the phone and explaining its features, he explains that his subtle approach and the rushed transaction is necessary to avoid municipal authorities who clamp down on sidewalk hawking. At some point during the transaction, the phone that is shown to the buyer is swapped with a toy imitation filled with compacted mud to give it the weight of the genuine phone. Now that’s a ‘fake phone’ in the truest sense of the term. It is fake in the sense that even though it looks like a phone, and it does not do what a cellular phone does – it cannot receive and make communications over a cellular network.

There is another nuance of the general term ‘fake’ which is more pertinent to this debate. A nuance of the term that is more aptly used with a brand name eg fake Nokia, fake Samsung, etc. It refers to an imitation of a cell phone which far from looking like a cell phone and doing what a cell phone does (it can make communications over a cellular network) it has been made in imitation of or is falsely marketed as the product of a certain manufacturer so as to be passed off fraudulently or deceptively as that manufacturer’s brand. Ladies and gentlemen, let us avail ourselves of the subtleties of the English language and refer to this one as a counterfeit rather than a fake. This discussion is not about fake phones. It is about fake Nokias, fake Samsungs, fake ZTEs, fake Huaweis, etc.

Counterfeit versus sub-standard
Not all counterfeit phones are necessarily substandard. A substandard phone is one that has not complied with one or more standards on health, safety, electromagnetic compatibility (EMC), use of radio spectrum and other requirements that may be declared or adopted by the CCK, the Kenya Bureau of Standards or other regulatory authority. Counterfeits refer strictly to products made to fraudulently imitate or pass off as the brands of another (usually more widely known or reputable) manufacturer. It is possible that a counterfeit cell phone may meet the standards declared for terminal equipment, even though it may be qualitatively inferior to the genuine cell phone. If the phone falls short of a standard declared by CCK and/or the KBS, this is a matter within the jurisdiction of the CCK and the KBS. However, counterfeiting is a matter for the Anti-Counterfeiting Agency (ACA) established by the Anti-Counterfeiting Act which came into force in 2009. But nothing would prevent the CCK and the KBS from collaborating with the ACA in locating counterfeit phones.

By the way, when it comes to counterfeits, there are those products that use branding that is visibly indistinguishable from genuine products, and then there are those that use branding that is substantially imitative of genuine products but having a distinguishing feature in their branding – say a brand name that reads a little different from the name of the imitated brand – SQNY for SONY, SOMSUNG for SAMSUNG, NOKLA for NOKIA. While the ACA may use its powers to deal decisively with the first category of products, I would say not so fast with the latter. First of all, in both cases, all action by the ACA has to be based on complaints by manufacturers. In the case of products for which on their face there is an attempt, however feeble, to distinguish them from those of another manufacturer, it may not be for the ACA to decide what degree of similarity amounts to a fraudulent imitation or passing off. That is a matter for the courts and based on decided cases, the similarity threshold is substantially high – products may be substantially similar but that does not mean that they are identical. Substantial similarity is not necessarily fraudulent imitation.

Substandard phones versus phones without IMEI numbers
International Mobile Equipment Identity (IMEI) number is a unique number used to identify a cellular phone handset over a GSM network (not to be confused with an International Mobile Subscriber Identity (IMSI) number which is stored on a SIM card and can be used to uniquely identify the SIM card). IMEI numbers are allocated by the GSMA, an association representing the interests of mobile operators worldwide (www.gsm.org). It unites most of the world’s mobile operators ‘as well as more than 200 companies in the broader mobile ecosystem, including handset makers, software companies, equipment providers, internet companies and media and entertainment organizations’.

There is a popular misconception that the allocation of an IMEI number to a cell phone implies that it is approved or complies with regulatory requirements. This misconception might be based on what was for a long time the British-European approach in the type-approval of telecommunications terminal equipment. The linkage between regulatory approval and IMEI allocation was removed in April 2000 with the introduction of European Radio and Telecommunications Terminal Equipment (R&TTE) Directive. ‘Since that date, IMEIs have been allocated by the British Approvals Board for Telecommunications (BABT) or one of several other regional administrators acting on behalf of the GSM Association to legitimate GSM terminal manufacturers without the need to provide evidence of approval’. The RTTE is the last word in compliance for Radio and Telecoms equipment sold in the European content. The directive marked a shift in regulatory approach from gatekeeping to surveillance – the standards which a manufacturer has to comply with are declared and rather than conducting audits of manufacturing facilities and carrying out product tests, manufacturers are left to self-certify and to apply quality control systems. This means that a product will reach the product much faster. Where it does not comply with the declared standards, it is likely to be found out, recalled and penalties imposed on the manufacturer. – see: This link and this one.

The GSM Association, which allocates the IMEIs, is not a regulatory body but a voluntary membership industry association. It may not be an express requirement of Kenyan law that every cell phone handset must have an IMEI number. Understandably, this should be the subject of standards or guidelines declared from time to time by regulatory or standard bodies or agreed among the industry’s fraternity. It would then appear that if a cell phone manufacturer based in, say, a recovering communist country in Asia, decides to exercise its discretion not to join the GSM Association and not to have IMEI numbers embedded into their products, it would have the liberty to do so.

Phones without IMEI numbers versus phones that will never be traced to their users
Just because a phone does not have an IMEI number does not mean that it is irredeemably destined to perdition. India has showed us that such phones can be loaded with software that embeds on them second-generation IMEI numbers making them uniquely identifiable over a cellular phone network. Back in 2009, India’s Department of Telecom (DoT) had asked telecommunications operators to bar services to phones without IMEI numbers – many of the handsets assembled in India or imported from one Asian country did not have IMEI numbers that would enable security agencies to trace the location of the phone user. The DoT directive came after investigations into a terrorist attack in the country revealed that the mobile phones used by the suspected terrorists did not have valid IMEI numbers. Talks between the DoT and an association of telecommunications operators in India led to the development of special software for generating genuine IMEI numbers. Consumers with non-IMEI-numbered handsets would have the software loaded into their phones at a fee and their handsets would be recognized on the networks of their GSM providers using the second-generation IMEI number. This reportedly brought salvation to over 16 million phone users. See this story.

Consumer welfare
Last but not least – denying service to cell phones without IMEI numbers would prejudice the rights of unsuspecting consumers who may have purchased a counterfeit phone in good faith and in the honest belief that it was a genuine phone. Consider also that the allegedly ‘fake’ cell phones are said to be sold alongside their genuine counterparts in regular business establishments that are licenced by the CCK and municipal authorities.

I say more power to the ‘war’ against counterfeits but the consumer level is not the front at which this war is to be waged. The Anti-Counterfeiting Agency has very wide-ranging powers in the prevention of counterfeiting and the seizure of counterfeit goods. As much as possible, the ACA and other government agencies would focus their approach in preventing counterfeit goods from reaching the consumer. An approach that involves the forceful deprivation of the consumer of genuinely purchased property or service without compensation, such as denying service to all owners of non-IMEI numbered cell phones, is a blunt instrument because it tramples on the constitutional and legal rights of consumers (the consumer’s right to compensation for loss or injury arising from defects in goods or services is now a Constitutional right – Article 46 - a priori the right not to be deprived of one's personal property (or the functional use of it for that matter) without just and fair compensation).

A SCHEDULE OF LAWS AND REGULATIONS ON ICT, MEDIA & BROADCASTING LAWS IN KENYA

2011-06-24T08:39:00.001+03:00

By Michael M. Murungi

There are many laws that bear relevance to the subject of ICT (including media and broadcasting) in Kenya. While a number of them may have nothing more than a passing reference to a computer system or the recognition of the use electronic records in statutory transactions, others have a more direct relevance on account of the breadth with which they address themselves to one or more aspect of ICT. The laws listed below fall in the latter category and are, in my opinion, the entry points for any discussions on ICT law in Kenya.

While I have endeavored to make the list as comprehensive as possible and will also endeavor to keep it updated, it is not necessarily exhaustive or representative of all the laws of Kenya that may be directly or indirectly relevant to ICT, media and broadcasting. To access all the Laws of Kenya, go to: www.kenyalaw.org - the National Council for Law Reporting.

1. The Constitution of Kenya, 20¬¬10
The supreme law of Kenya, promulgated in August 2010 and replacing the now repealed Constitution of Kenya.

Tags: The republic, human rights, right to privacy, right to information, use of appropriate technology in government services, place of ICT in ministerial portfolios, national security, structure of government
http://www.kenyalaw.org/klr/index.php?id=7

2. The Kenya Information and Communications Act, 1998
The framework legislation for the information, communications, media and broadcasting sub-sectors. Establishes the Communications Commission of Kenya as the industry regulator.
Tags: Communications Commission of Kenya (CCK), Kenya Communications Secretariat, Communications Appeal Tribunal, Telecommunications services, radio communications, broadcasting services, licensing and enforcement, electronic transactions, digital signatures, e-government, universal service, faire competition and equal treatment, consumer protection, dispute resolution.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

3. Media Act, 2007
Legislation providing for the establishment of the Media Council of Kenya; for the conduct and discipline of journalists and the media and for the self-regulation of the media.
Tags:Media Council of Kenya, media regulations, complaints and dispute resolution, watershed period, media complaints commission;
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

4. Kenya Communications Regulations, 2001
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998
Tags:Issue, suspension and revocation of licenses for telecommunications and radio communications services, national numbering plan, tariff regulation, interconnection, roaming agreements, type approval of equipment, offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

5. The Kenya Communications (Broadcasting) Regulations, 2009
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further and more particular provisions on the regulation of broadcasting services.
Tags: Broadcasting license, concentration of media power/ownership, broadcasting services; satellite, cable and subscription management services; digital broadcasting; content regulation; censorship; parental control; watershed period; programme code; complaints procedure, offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

6. The Kenya Information and Communications (Dispute Resolution) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further and more particular provisions on dispute resolution between licensees and between licensees and consumers.
Tags: Power of the CCK to resolve disputes; procedure for filing, hearing, withdrawal and determination of disputes, offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

7. Kenya Information and Communications (Tariff) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on the regulation of prices, charges and levies imposed for information and communications services by a licensee under the Act.
Tags: Regulated services; promotion; special offer; ICT service; tariff setting; tariff rates; tariff approval; investigation of tariffs; tariff guidelines; economics; sunk costs; vertical integration; cross-subsidization; offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

8. The Kenya Information and Communications (Compliance Monitoring, Inspections and Enforcement) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on monitoring compliance with and enforcing the provisions of the Act by the CCK
Tags: Principles and procedures of monitoring and enforcement; reports by licensees; investigations; penalties and offences; civil proceedings; legal remedies.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

9. The Kenya Information and Communications (Fair Competition and Equality of Treatment) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on fair competition among licensee and their fair treatment.
Tags: Market segments; market power; abuse; anti-competitive agreements and practices; unfair competition; discrimination; market dominance; monopoly; investigation; interconnection obligations; book of accounts; non-preferential treatment of subscribers; exemptions; offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

10. The Kenya Information and Communications (Interconnection and Provision of Fixed Links, Access and Facilities) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on interconnection and access between licensees of ICT services.
Tags: Interconnection; facilities provider; facilities acquirer; interconnection agreement; interoperability; local access provider; network facility; calling line identity; co-location; end-to-end connectivity; point of interconnection; interconnection charges; billing settlement; technical specifications and standards; interconnection dispute resolution; quality of service; confidentiality; network access facilities; offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

11. The Kenya Information and Communications (Consumer Protection) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on the protection of consumers of ICT services.
Tags: Consumer protection; commercial code of conduct; outage credit; subscriber service; rights of customers; rights of consumers; customer care; complaint handling procedure; persons with disabilities; protection of children; customer information; confidentiality; operator assistance; calling line identification; emergency services; billing; consumer satisfaction; quality of service monitoring; offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

12. The Kenya Information and Communications (Numbering) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on the allocation and management of numbers and addresses for electronic communications, postal services.
National communication and numbering plan; communications addresses; communication number; mobile service identity; planning, allocation and administration of numbers; electronic addresses; offence and penalty.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

13. The Kenya Information and Communications (Importation, Type Approval and Distribution of Communications Equipment) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions for the regulation of the importation, distribution and the type of communications equipment.
Tags: Communication equipment; national standards; type approval; type acceptance; Kenya Bureau of Standards; technical evaluation; certificate; complaint procedure; exemptions; equipment disposal; offence and penalty.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

14. The Kenya Information and Communications (Radio Communications and Frequency Spectrum) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on frequency spectrum assignment and management.
Tags: Frequency spectrum, harmful interference, radio emission, spectrum assignment of frequency, transmitter, radio communication license, obligations of licensees, sharing of frequencies, frequency spectrum pricing, type approval and inspection, monitoring and inspection, misuse of frequencies.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

15. The Kenya Information and Communications (Universal Access and Service) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on the implementation of universal access and service provision and the administration of the Universal Service Fund
Tags: Universal service fund, Universal Service Advisory Council, subsidies, loans, grants, public voice telephony, unserved areas, universal service levy, universal service programs/projects, manner of funding,
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

16. The Kenya Information and Communications (Licensing and Quality of Service) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on monitoring the quality of ICT services.
Quality of service standards, principles of developing quality service ser v ice, licensing for services, market structure, measurement, reporting and record keeping, duty of care to the public and consumers, transitional provisions.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

17. The Kenya Information and Communications (Electronic Certification and Domain Name Administration) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on the licensing and regulation of certification authorities and domain name administrators.
Tags: Certification service providers, foreign service providers, certification personnel, certification practice statement, subscriber, time stamp, subscriber identity verification method, liability and obligations of certification service providers and subscribers, suspension, renewal and revocation of certificates, performance audits, security guidelines, incident handling, confidentiality, winding up of a certification service provider, records management, domain names, country code top level, ccTLD, domain name administrator, registrar, registrant, repository, subdomain, winding up of administrators, offences and penalties.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

18. The Kenya Information and Communications (Postal and Courier Services) Regulations, 2010
Regulations made by the Minister in charge of information and communications in consultation with the Communications Commission of Kenya under the Kenya Information & Communications Act, 1998 to make further provisions on the regulation of postal and courier services.
Tags: Postal and courier license, issuance of postage stamps, postal articles, disposal of undeliverable articles, prohibited articles, postal security and safety, compensation, use of technology, universal service obligation, extra-terrestrial offices of exchange (ETOEs), penalty, post code, commemorative stamps, basic postal services
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

19. The Transfer of Assets by the Postal Corporation of Kenya to the Postal Corporation of Kenya Pension Scheme Order, 2010
Tags: Regulations made by the Deputy Prime Minister and Minister for Finance under the Kenya Information and Communications Act, 1998 for the transfer of the immovable property and assets of the Postal Corporation of Kenya to the corporation’s pension scheme.
Transfer of assets, immovable property
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

20. Penal Code (Chapter 63)
An of Parliament that establishes a code of criminal law, containing principles of criminal law, various criminal offences and the punishments prescribed for them.
Defines an electronic record, making a false document or electronic record, making electronic records without authority, uttering a false electronic record, felony, misdemeanour, forgery, theft, information as a thing capable of being stolen
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

21. Evidence Act (Chapter 80)
An Act of Parliament declaring the law of evidence
General principles of evidence, admissibility, res gestae, facts, production of documents, hearsay, production of electronic records as evidence, electronic evidence, electronic signature, presumptions on evidence, burden of proof.
http://www.kenyalaw.org/kenyalaw/klr_app/frames.php

3G SPECTRUM UTILIZATION FEES: HIGH COURT NULLIFIES TRIBUNAL'S DECISION IN SAFARICOM COMPLAINT

2011-06-15T07:01:00.006+03:00

Image courtesy of www.safaricom.co.ke

By Michael M. Murungi

Republic v Communications Appeal Tribunal & another ex parte Safaricom Ltd [2011] eKLR
High Court at Nairobi
Justice D. Musinga
May 30, 2011

On May 30, 2011, the High Court (D. Musinga, J) allowed a judicial review application filed by Safaricom Ltd against the Communications Appeal Tribunal, the Minister for Information and Communications and the Communications Commission of Kenya (CCK). In its decision, the Court issued an order quashing the decision of the Tribunal in which it (the Tribunal) had dismissed an appeal filed by Safaricom against the manner in which CCK had computed the fees payable by Safaricom on account of its utilization of the frequency spectrum for 3G services for the period of July 2008-June 2009. Though the decision of the High Court turned on a technicality - it quashed the Tribunal’s decision after it found that at the time that the Tribunal made its decision, it had not been properly constituted, in that the terms of service of its members had expired and had not been properly renewed by the Minister – the substance of the dispute raises important issues for the regulation of the ICT sub-sector.

Safaricom’s main complaint was that the CCK having later reviewed the methodology for computing the frequency utilization fees in respect of 3G services, it would be prejudiced in that its competitors or other telecommunications services providers would pay a manifestly lower fee. As far as can be deduced from the judgment of the High Court, the following points capture the origin and substance of the dispute:
• Under the Kenya Information & Communications Act, the CCK has the power to issue various types of licences for the provision of information and telecommunications services.
• CCK also has the power to determine the fees chargeable for each licence category.
• In 2007, CCK issued Safaricom with a licence to operate a 3G telecommunications network. By the end of the 2009 financial year, Safaricom was the only operator with a licence in that category.
• One of the terms under which Safaricom’s licence was issued was that Safaricom was to pay an initial licence fee of USD 25 million and subsequently, to pay the fees ‘related to the use of the frequency spectrum resource’ (spectrum utilization fee).
• In order to determine the amount of spectrum utilization fees that Safaricom was to pay for the period of June 2008-July 2009, the CCK looked at Safaricom’s 3G returns and basing its calculation on the number of transmitters within Safaricom’s network, CCK arrived at a fee of Kshs. 135,450,000 (aprox. USD 1.5 million).
• Subsequently, apparently out of a change in the methodology of computing the spectrum utilization fee, other telecommunications services provides who applied for 3G licences would pay a lower spectrum utilization fee than Safaricom.
• Safaricom had argued that the fee charged by the CCK in the 2008-2009 financial year was discriminatory against it and that charging a lower fee to new entrants would put it at a significant competitive disadvantage.
• However, CCK denied the allegation of discrimination stating that at the material time, Safaricom was the only holder of a 3G licence, that the CCK applied international best practices in the computation of the fees and that in any case, the lowering of the fee to subsequent operators had not been the subject of Safaricom’s complaint before the tribunal.

Regarding the terms of office of the members of the Tribunal:
• The Communications Appeal Tribunal is established by section 102 of the Kenya Information and Communications Act, 1998.
• The Tribunal’s membership is to consist of a Chairman and:
• Two other members having expert knowledge of the matters likely to come before the Tribunal and;
• Two other members nominated by the Media Council established by the Media Act, 2007 (This provision was included in the Act through an amendment that came into force on January 2, 2009).
• The members are to hold office for three years and are eligible for reappointment for one further term of the same duration.
• The initial appointment of the members of the Tribunal that presided over Safaricom’s appeal was published in a Gazette Notice dated February 23, 2007, which stated the effective date of their appointment to be February 1, 2007. Safaricom argued that this meant that their term would expire on January 31, 2010.
• The Minister had issued letters of appointment to the existing three Members of the Tribunal purporting to renew their terms with effect from February 1, 2010, though the appointments were not published in the Kenya Gazette until September 17, 2010.
• The Tribunal rendered its decision on Safaricom’s appeal on February 1, 2010.

In his judgment, Justice D. Musinga made the following findings and orders:
• When an Act of Parliament requires a Minister to appoint a person to a public office, such appointment has to be effected and actualized by publication in the Kenya Gazette on its due date. The appointment cannot be done by merely writing to the person so appointed without notification in the Kenya Gazette. The Minister’s letter of appointment cannot be a substitute for the requirement that the appointment be published in the Gazette.
• The Communications Appeal Tribunal was created by statute and the appointment of its members could not be a private matter between the Minister and its members. Such appointments had to be made public by publication in the Kenya Gazette, and the publication must be done as soon as possible. It is improper in law for the persons appointed to start performing their public duties in terms of their appointment or re-appointment before the publication of their appointment in the Kenya Gazette.
• By the time that the Minister was re-appointing the Chairman and the two members, he ought to have appointed two more members [nominated by the Media Council as required by section 102 of the Act. The failure to appoint the required number of members meant that the Tribunal was not properly constituted after January 31, 2010. It was also doubtful whether the Minister had consulted with the Attorney General before making the appointments as required by law.
• As the Tribunal was not properly constituted when it heard and determined the appeal, the purported proceedings were null, void and of no legal consequence.
• As far as the substance of the case was concerned, the Tribunal had properly considered Safaricom’s appeal and taken into account all the relevant considerations in arriving at its decision. There had been no discrimination against Safaricom. However, because the Tribunal was not properly constituted at the time that it made its decision, the decision was of no consequence.
• Final orders:
a. Tribunal’s decision quashed;
b. Minister for Information and Communications directed to appoint and convene a proper and lawful Communications Appeal Tribunal in accordance with section 102 of the Kenya Information and Communications Act.
c. Once a proper Tribunal is constituted, it is to hear, re-consider and determine Safaricom’s appeal.

Advocates/Attorneys:
Mr. Kipkosgei for the Tribunal and the Minister
Mr. Ohaga for Safaricom Ltd
Mr. Wambua Kilonzo for the CCK

Some thoughts from the Second Session of the Committee on Development Information, Science and Technology (CODIST-II)

2011-05-23T07:54:00.002+03:00

Addis Ababa, Ethiopia
2nd – 5th May, 2011

In Addis Ababa, the elements of time and culture are warped, at least from the perspective of one conditioned to the Gregorian calendar and ‘official UN-language’ communications. The crossover from the Gregorian to the Ethiopian Calendar, which comes with a gain of over seven years in time difference – a quantum leap, even for the furthest seeking inter-continental traveler – comes with a sub-system of verbal and written communications that is predominantly in native Amharic. It is always on assault on my sense of cultural and time awareness, and yet always welcome as an organic alternative to the elements of Kenyan-western culture that are the staple diet of my social interactions back home.

Between May 1st and 5th 2011, government and international agency representatives, ICT experts, scientists, civil society representatives and media met at the United Nations Conference Centre in Addis Ababa, Ethiopia for the second meeting of the United Nation’s Economic Commission for Africa’s Committee on Development Information Science and Technology (CODIST-II).

The overall theme of CODIST-II “Innovation for Industrial Development in Africa” is aimed at exploring the extent to which African countries have harnessed the power of innovation to enhance industrial development on the continent and the extent to which industrial development has been linked to the countries innovation systems.

Even in this cultural and time vortex, I was not to be entirely forsaken by my faculties of cognition and expression. During the conference, and particularly during the parallel sessions of the Sub-Committee on ICT, I caught myself, on more than one occasions, addressing the delegates on what I thought about the subject of the day: formulating appropriate legislative frameworks for the knowledge/information society:

First, in following up on a very enlightening presentation by Dr. Mohamed Chawki (Senior Judge in Egypt and Chairman, International Association of Cybercrime Prevention (AILCC)) titled ‘Best Practices and Enforcement in Cybersecurity: Legal, Institutional and Technical Measures” I submitted:

‘As we talk about formulating appropriate legal regimes for the information society, let us also remain aware of the fact that cybercrime is evolving and changing, even faster than the law can hope to catch up with it. In almost all fields of crime prevention, you will notice that the law is always a late comer. In that regard, we need to avail ourselves of the artifice by which judges liberally and creatively interpret and extend the old law to meet with the emerging forms of crime. If you look at a number of cybercrimes, you will see that it is not so much a new form of crime that has emerged but a new way of committing an old crime probably with a greater magnitude of public harm. If one hacks into a bank’s mainframe and fraudulently transfers money electronically to his account, he has as effectively stolen that money in the old law’s sense as if he had broken into the bank’s safe and emptied the money into his bag. In a number of such cases, it is not the typology of crime that has changed but the ecology and the methodology of the crime. Having said that, and not to trivialize the debate about the need for appropriate legislative frameworks, there is still something to be said about the need to have a legal regime that incorporates the emerging terminology of crime. Better still a legal regime that looks beyond the reach of legislative enactments to nurture a culture of jurisprudence in which judges extend the old law to its elastic limit in meeting the demands of the evolving ecology of the criminal enterprise – like the principles of the common law of England evolved and developed through the opinions of the English Judiciary’.

Later, at a breakout session on cybersecurity and cybercriminality, the floor was open to submissions on two subjects:
- How can a balance be attained between the need to protect national security on the one hand and the need to respect the right to freedom of information?
- The challenges and the solutions in combating cybercrime in Africa.

On balancing between national security and freedom of information:
‘The balance between these two often opposed interests is probably not one that we should labour to define academically because it is a balance that reveals itself through a set up of certain elements in the social and governance order. On the one hand, we need a citizenry and a civil society fraternity that is accorded (and takes advantage of) the democratic space to exercise and enforce the freedom of information – the better if the right of access to public information is expressly recognized as a human right as Kenya’s new Constitution has done in section 3 - on the other hand, a government that has a genuine understanding of the circumstances in which the interests of national security override the freedom of information coupled with the application of limitation measures that are reasonably necessary in a democratic state; and in between these two, a Judiciary that has the independence and competence to authoritatively declare the rights and limitations of either side through determinations of disputes that embody these conflicting propositions’.

On the challenges and solutions in combating cybercrime in Africa:
‘A few years ago during the consultative process that led to the enactment by Kenya’s parliament of the Persons With Disabilities Act of 2003, I remember asking a Member of Parliament involved in one of the technical committees of Parliament if the Act was going to be made available in Braille. He threw back his head in laughter. I did not find the humour in my inquiry but I took the reaction as a ‘no’ answer. I share this anecdote with you because I have observed the same contradiction with regard to cyberlaws – the laws that African legislatures are enacting to regulate cyberspace are not available in cyberspace! In quite a number of countries, we find that governments that are considering making cyberlaws are not able to benefit from the technical knowledge that other African countries has applied in enacting their cyberlaws because the whole process – from the consultative forums on the need to reform the law, to the deliberations of the Committee and the debates of parliament on the Bill and even the content of the final enactment itself – are offline. This is a challenge to not only the making of domestic legislation but to the harmonization of cyberlaws across geographical boundaries. I think the solution to this challenge is self-evident and I need not go into it.

On the same subject:
‘Perhaps one of the biggest challenges is inadequacies in the knowledge and resource capacity of law enforcement agencies to detect, prevent and combat cybercrime and, even more importantly, to handle victims of cybercrime. The main challenge is that the new terminology of cybercrime, the sophistication of the tools and methods used to commit cybercrimes and the fact that these crimes are committed in a domain that challenges the notions of national territory or geographical boundaries – notions that largely define the approach of conventional law enforcement.

I think the solution to this would be two-pronged. First, tailor the training for law enforcement to focus on the extent to which certain types of cybercrime can be detected, arrested and prosecuted using the ‘old law’ - and this relates to my earlier submission in the plenary session about how the Judiciary can also liberally interpret and apply the old law. By focusing on the old law, law enforcement will be working with what is familiar and the learning curve will not necessarily be as steep as absorbing the emerging notions and terminologies of cybercrime. For instance, a person who commits an online fraud after ‘phishing’ for personal information may be as effectively prosecuted for the good old charge of ‘obtaining goods or money by false pretences’ as he would be for ‘aggravated unauthorized access to computer data’.

However, having said that, there is need, ultimately, for law enforcement to acquire all the knowledge and tools that fully meets and anticipates the cunning and ever evolving sophistry of the cybercrime enterprise. Perhaps the starting point would be to establish a working group within law enforcement with varied composition that serves as a reference point for accumulating the technical knowledge and directing the administrative arrangements necessary to deal with cybercrime and at the same time, building a critical mass of law enforcement officers in a special squad continuously trained in the prevention, arrest and prosecution for cybercrime.

RECOMMENDATIONS OF THE BREAKOUT SESSION ON CYBERSECURITY AND CYBER CRIMINALITY

The chairman of the session, Dr. Mohamed Chawki identified two front burner issues in the cybercrime and cyber security sphere for discussion, as follows:
1. Finding a balance between national security and the right to freedom
of information; and
2. Fighting Cybercrime in Africa: Challenges and Solutions.
From various contributions by participants, it was recommended that to strike the much needed balance between national security interests and basic freedoms of citizens, member states should:
• Set basic standards for classification of information as either public or private;

• Create synergy between government, civil society and the judiciary to establish a balance between competing interests;

• Work towards developing regional and sub-regional guidelines which set out ways of ensuring the security of states without derogating the right of citizens to access information;

• Improve cybercrime and cybersecurity awareness using the vehicles of civil society, academic and religious institutions;

• Crating International Guidelines on Access to Information;

• Give the right to access information the status of a human right as a basic minimum;

• Work towards establishing international standards/best practice metrics for rating governments on measures initiated to create an enabling environment for effective civil society activities as well as ensure the independence of the judiciary.

On measures geared towards boosting the fight against cybercrime, participants recommended that member states should:
• Encourage proactive law enforcement and legal re-engineering to meet the dynamics of cyberspace;

• Improve ICT proficiency levels of parliamentarians so that ICT Legislations can be better drafted to suit the IT environment;

• Create a pool of expertise in ICT law drafting;

• Re-inject ex-cybercriminals into the law enforcement process;

• Develop a new breed of IT savvy law enforcement officers as well as reflect the subject of ICT in curricula across all levels of education;

• Promote advocacy in the areas of cybercrime and cybersecurity to galvanize
stakeholder action;

• Bring information on extant cybercrime legislation and cybersecurity initiatives into the public domain to facilitate effective reviews and provide adequate data for planning.

• Create channels of reporting as well as collect and compile case studies of cybercrime activities;

• Improve political will to fight cybercrime and make appropriations for cybersecurity in national budgets.

Participants also advocated for:
• Improved donor agency funding for civil society initiatives on cybercrime and cybersecurity to give them a better voice in the fight against cybercrime.

• Intensive stakeholder engagement with policy makers at all levels to facilitate government action.
Recommendations reproduced courtesy of the United Nations Economic Commission for Africa (UN-ECA). For more information about this event, go to www.uneca.org/codist

JUDICIARY COMMISSIONS ELECTRONIC CASE MANAGEMENT SYSTEM FOR ELDORET LAW COURTS

2011-02-20T16:57:00.013+03:00

(Click image to enlarge) A window into the open-source-based case management software installed and commissioned at the Eldoret Chief Magistrate’s Court.

See news video

By Michael M. Murungi

On February 15, 2011, Chief Justice J.E. Gicheru commissioned an electronic case management system at the Eldoret Chief Magistrate’s Court. In an initiative that has set a new milestone in project implementation, change management and the uptake of information and communications technology in an organ of government that has hitherto been perceived as conservative and insular, the court can now electronically manage a case from the filing state to its final disposition, all the while providing information to litigants, advocates and the public through web-based and mobile phone applications.

The Project, which was commissioned by the Chief Justice, Mr. J.E. Gicheru, on February 15, 2011, began in the last quarter of 2009. It was conceptualized and co-managed by Mr. C. Mbogo, the Chief Magistrate at the Eldoret Law Courts, and the United States Agency for International Development (USAID), which was also the financier. The National Council for Law Reporting (NCLR), a state corporation under the Judiciary with the mandate of publishing judicial opinions and the Laws of Kenya, came into the project as a quality assurance provider and even more importantly, to install and customize the case management software.

The input end of the project sounded like just any other shopping list for an ICT project – a server, a network switch, desktop computers, a computer network, document scanners and software. However, the outputs established this project as Kenya’s most successful and comprehensive initiative (so far) in implementing electronic case management. The case management software, which has been installed and customized from open source code by the NCLR, collapses the broad range of administrative functions that go into the management of a paper-based case files into an electronic window, improving information management and retrieval and even more importantly, providing an interactive module for managing timely and contextually relevant communications to litigants and advocates about the progress of litigation. It features a case management system, a parties management module, a document management system and an SMS engine. The functional utility of the system can best be illustrated as follows:
i. Once a case is filed, an electronic record of the entire case file is created and the docket of pending cases is updated in real time;
ii. In the evening of that day, the Registrar of the court receives an auto-generated report showing the status of the pending cases docket;
iii. Later, the plaintiff and his advocate receive an auto-generated text message by mobile phone or email informing them that no defence had been filed in the case within the time prescribed by law and that they were at liberty to apply for summary judgment;
iv. The same week, the Registrar receives an auto-generated report detailing all cases due for summary judgment and he allocates them electronically to the various Judicial Officers in the station.
v. Throughout the hearing of the application for summary judgment, the presiding Judicial Officer is able to manage the case diary by timeously obtaining the transaction history of the case file and cross-referencing or profiling information relating to the parties and advocates such as unpaid adjournment fees; the reasons advanced for adjournments, etc.

The success of the project may have come as a pleasant surprise to many both within and outside the Judiciary because of the remarkable way in which it made a departure from previous approaches in the implementation of ICT projects in the Judiciary.

Starting small versus going big
Conventionally, improvement initiatives that have changed the game plan in court operations, particularly those that have the input of a development partner, begin at the highest echelons of the Judiciary – the Court of Appeal which sits in Nairobi, the capital city. However, this project was exclusively packaged for the lowest court in the hierarchy – the Magistrate’s or Subordinate Court – and it picked on a court located not in the capital or in any of the two major cities of Kenya, but in Eldoret town, a trading centre that has only recently shed its ‘small-town’ status (and boasting what is arguably the highest per capita concentration of record-breaking long distance runners in the world).

Getting formal versus getting practical
Save for a select team comprised of a judicial officer, two staffers from the court registry, USAID and NCLR and occasional reference to the local Court Users Committee, the project’s reference group was lean and localized. Its composition, meetings and work-plan was not preceded by the flurry of correspondence and the administrative formalities that are typical of many projects in the government. Its approach was simple: a development partner was looking for a suitable locus for a quick-win/high impact initiative to improve the administration of justice; the Eldoret Chief Magistrate, like many heads of court stations in Kenya, was looking for a solution to the challenges of managing an ever-growing paper-based registry with little resources; and the NCLR, out of both magnanimity and enlightened self-interest (a digitized registry would mean easier and faster collection of Judicial opinions from the Judiciary) was ready to leverage on its surplus of ICT expertise in assisting its parent institution in managing its registry. A mutuality of needs led to a meeting of minds with the focus being on getting the work done with the greatest economy of time and other resources. This, however, is not to say that the project did not have the administrative support and guidance of the leadership of the Judiciary.

Home grown and open-source vs externally sourced and off-the-shelf solutions
While the hardware components of the project and the Windows suite of office applications for the desktop computers were supplied by external vendors, the case management software, which is the kernel of the project, was customized from open source code and installed, tested and documented by the NCLR. The NCLR also trained 80 members of the Eldoret Law Courts staff on the use of the software. The staff of the Court’s registry were involved in systems analysis and helped the NCLR ICT Department to capture their workflow processes and to map them into the architecture of the software. The procurement of vendor goods was done exclusively by USAID but in accordance with technical specifications and terms of reference developed by the court registry’s staff in consultation with the NCLR. Particular emphasis was placed on the need for a system that was organic both in the manner in which it was developed and in its functionality – a preference for a software solution that is open yet secure and interoperable; one that easily lends itself to being modeled on the existing workflow processes of the registry and for which the customization, training and technical support could be provided from within the Judiciary. At best, equipment and software vendors were dealt with at arms length.

International procurement: thinking globally versus acting locally
A procurement system was used that addressed the imperatives of the short project calendar on the one hand and compliance with best practices in procurement on the other. The USAID, which was the project financier, was also the custodian and manager of the project’s funds and its office in Eldoret town was the reference point for all procurement and other project management activities. Lengthy procurement processes have come to define the success or failure of many projects and programmes in the government. Particularly where those processes are to be done in accordance with the rules of an international development partner, the rule of thumb for ensuring the effectiveness of the procurement function would be to think global but act locally. I care to provide no further elaboration than to say that though I cannot claim any particular familiarity with USAID’s procurement procedures, it was evident that this project is particularly illustrative of the point.

Management change versus change management
The Eldoret Chief Magistrate, being the chief executive officer of the court station, had the managerial wherewithal to just lean back in his chair and decree that his registry staff should all have prepared themselves for the changer-over from the paper-based system to the electronic system by the end of the project. But his approach was different. He and the station’s middle management would be the frontline users of the system. If they could not use the system and meaningfully interact with the managers’ module in a way that improved their ability to manage the registry and make managerial decisions, then no member of staff would be obliged to use it. Secondly, the registry staff were not to serve the system, rather, it was to serve them – it was to be customized according to their suggestions and all training under the project was to be provided not merely on the use of the system but tailored with regard to the differentials in ICT knowledge and experience among the staff. Certificates of training were to be issued to all staff.

Grand plans versus quick wins
At the time when the project was conceptualized, the Judiciary was in the process of developing an ICT Policy and Strategic Plan. A great amount of stakeholder and professional input went into the planning exercise and there were concerns that perhaps the project should be postponed until a later date when it could be evaluated within the context of the policy and plan once it had been developed. However, the prevailing opinion was that whatever the wording of the policy and plan would be, one of its goals would be to encourage judicial administrators to come up with innovative solutions to meeting the challenges of managing their court stations, and this project being one such initiative, it needed to be incubated and nurtured. This sentiment was vindicated on the day of the project’s Commissioning when Justice PN Waki, Judge of Appeal and Chairman of the Judiciary ICT Committee observed in his speech that “from an ICT governance perspective, this project appears to have met the threshold for a successful case-study with a high potential for a phased rolling-out to other court stations”.

(Courtesy of the System analysis, design and implementation team at the National Council for Law Reporting: Michael Mayaka – Systems Developer; Martin Mbui – Systems Administrator).

KENYA’S NEW CONSTITUTION SETS NEW STANDARDS FOR PRIVACY AND DATA PROTECTION

2011-01-17T20:18:00.003+03:00

By Michael Murungi
January 2010

The subject of individual privacy in Kenya does not easily lend itself to academic investigation. Kenyan law on the subject remains sketchy and even with the improved level of the enjoyment of civil liberties and democratic governance that the country has experienced in the last three decades, individual assertions of the right to privacy have not translated into a watershed legal claim where the country’s courts proceed to issue eloquent and authoritative pronouncements on this area of law. That, however, is not to say that an impression cannot be made of Kenyan conceptions of privacy from both individual or community practices and written law.

Popular discourse on privacy and personal data protection in Kenya has long been the pet subject of banking law, particularly as it relates to the protection of personal financial information. However, the subject has more recently been thrown into relief by its association with data protection in the context of the increased use of information and communications technologies (ICTs), the distributed and trans-boundary nature of modern day communications and the emergence of the globalized information society.

The old constitutional order
For a long time, the right to privacy had not been expressly legislated as a constitutional norm in Kenya. It was only expressed as a broad constitutional norm encompassed in the right against unlawful entry, search and seizure of one’s property and effects and interference with a person’s ‘correspondence’. In section 76 of the now repealed Constitution, it was provided:

‘Except with his own consent, no person shall be subjected to the search of his person or his property or the entry by others on his premises.’

Section 79 provided that:

‘Except with his own consent, no person shall be hindered in the enjoyment of his freedom of expression, that is to say, freedom to hold opinions without interference, freedom to receive ideas and information without interference, freedom to communicate ideas and information without interference (whether the communication be to the public generally or to any person or class of persons) and freedom from interference with his correspondence.’

The rights expressed in these provisions were made subject to the standard constitutional exceptions to the enjoyment of individual rights: the interests of national defence, public order and morality, the rights of other persons and the exercise of authority by state officers.

While constitutional and statute law alike offered no legal definition of the term ‘personal information’, certain Acts of Parliament contained provisions restricting the collection and use of certain types of information relating to the identity and the communications of individual persons. However, the restrictions were narrowly contextualized and their cumulative effect did not meet the threshold for what could be termed as a general legal framework for privacy and data protection.

As a corollary, there was no express constitutional right to confidentiality and the protection of personal information. As a matter of fact, the first reference to the concept of confidentiality in the Kenyan constitution was in setting out one of the circumstances in which the individual’s freedom of expression and from interference with his correspondence may be limited – the protection of information received in confidence. Kenyan practice on the right to privacy and confidentiality has hitherto been guided largely by the Common law – a system of law developed from the judicial opinions of the English judiciary.

A quantum leap, legally
On August 27, 2010, Kenya promulgated a new constitution – The Constitution of Kenya, 2010. Some minutes past 1030 Hrs that sunny Friday morning at Uhuru Park in Nairobi, Kenyans pressed the reset button on, among other things, their set of national values, the bill of rights and their system and structure of government. As far as privacy and data protection is concerned, the new Constitution makes an emphatic break with the tradition, the wording and even spirit of the repealed Constitution. At the stroke of President Mwai Kibaki’s declaration of the promulgation, Kenyans’ rights to privacy, to access to public information and the right to object to unnecessary demands for personal information leapt out of legal obscurity to claim their place in the new bill of rights among constitutionally elite rights such as the right to life and freedom of expression.

Under Article 31 of the new Constitution, every person has the right to privacy, which includes the right not to have their person, home or property searched; their possessions seized; information relating to their family or private affairs unnecessarily required or revealed; or the privacy of their communications infringed.

In Article 35, every citizen has the right of access to information held by the State; and any information held by another person which is required for the exercise or protection of any right or fundamental freedom. Further, every person has the right to the correction or deletion of untrue or misleading information that affects him or her. Finally, the provision to the public of timely and accurate information is included in Article 232’s articulation of the values and principles that should guide public institutions in fulfilling their service to the public.

Even to moderate civil libertarians and advocates of privacy and transparent governance, this shift is a quantum leap for Kenya’s jurisprudence and one can only begrudge the fact that it has taken such a long time. In the wording of these new species of rights can be found the spirit of seven key principles that have been incorporated in three instruments that are reference points in the international discourse on privacy and data protection: the Council of Europe’s Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data; the United Nations Guidelines Concerning Computerized Personal Data Files and the OECD Guidelines on the Protection of Privacy and Trans-border Flows of Personal Data. Those principles are:
• Notice—persons should be given notice when their data is being collected;
• Purpose and disclosure— personal information should only be used for the purpose for which it has been stated;
• Consent—the information should not be disclosed without the knowledge and consent of the person to whom it relates;
• Security—the information should be kept secure from any potential abuses;
• Access—subjects should be allowed to access their personal information and make corrections to any inaccuracies; and
• Accountability – those who collect and manage the information are in an ethico-legal relationship with the subjects for which they should be transparent and accountable.

In due course, Kenya’s parliament or the Judiciary should, through statutory enactments and judicial opinions, make further provisions relating to more particular aspects of data protection, such as the typology and classes of personal information and their differential treatment and a delineation of the circumstances that would constitute a reasonable demand for or disclosure of personal information. So will an organic Kenyan jurisprudence on privacy and data protection emerge and evolve.

Identity-related Crimes: A Profile of East Africa from a Kenyan Perspective

2010-12-20T07:57:00.007+03:00

By Michael M. Murungi
(Based on a Presentation made at the UNODC 5th Meeting of the Core Group of Experts on Identity-related Crime, Vienna International Centre, Vienna, Austria, December 6-8, 2010)

(Click image to enlarge)

By resolution 2009/22, the Economic and Social Council (ECOSOC), concerned about the serious threats posed by economic fraud and identity-related crime and by other illicit activities that those forms of crime support and concerned also about the use of new ICT technologies to perpetrate such crimes, reiterated the need to have effective domestic powers to detect and investigate, prosecute and punish as well as mechanisms for international cooperation to prevent and combat these forms of crime.
In 2007, ECOSOC requested the United Nations Office on Drugs and Crime (UNODC) to provide legal expertise or other forms of technical assistance to Member States reviewing or updating their laws dealing with transnational fraud and identity related crime.
Pursuant to that request, UNODC, in consultation with the United Nations Commission on International Trade Law, established a Core Group of Experts (CGE) on identity-related crime, bringing together on a regular basis representatives from Governments, private sector, international and regional organizations and academia to pool experience, develop strategies, facilitate further research and agree on practical action against identity-related crime. The CGE’s work is aimed at assisting the UNODC to comply with ECOSOC’s request to collect, develop and disseminate:
a. material and guidelines on the typology of identity-related crime and on relevant criminalization issues to assist Member States in establishing new identity-based criminal offences and the modernization of existing offences;
b. Technical assistance material for training, such as manuals, compilations of useful practices or guidelines or scientific, forensic or other reference material for law enforcement officials and prosecution authorities in order to enhance their expertise and capacity.
c. A set of useful practices and guidelines to assist Member States in establishing the impact of such crimes on victims;
d. A set of material and best practices on public-private partnerships to prevent economic fraud and identity-related crime.

The Core Group of Experts has held five meetings; the first meeting was held in Courmayeur, Italy, on 29 and 30 November 2007; and the other five meetings were held in Vienna, Austria, on 2 and 3 June 2008; 20 to 22 January 2009 and most recently, 6-8 December 2010. The latter meeting included the input of a wider group of new experts co-opted into the group, including yours truly, who presented his assessment of identity-related crime in East Africa in General and East Africa in particular.

East Africa has a union of five countries – Burundi, Kenya, Rwanda, Tanzania and Uganda. The East African Community (EAC) is the regional intergovernmental organisation of the East African Union. The Treaty for Establishment of the East African Community was signed on 30 November 1999 and entered into force on 7 July 2000 following its ratification by the original three Partner States – Kenya, Uganda and Tanzania. The Republic of Rwanda and the Republic of Burundi acceded to the EAC Treaty on 18 June 2007 and became full Members of the Community with effect from 1 July 2007.

Progressively, the East African Region is moving towards political, social and economic integration: it established a Customs Union in 2005, a Common Market in 2010, a Monetary Union remains an imminent possibility by 2012 and ultimately a Political Federation of the East African States.

The Union has a combined population of more than 125 million people, a land area of 1.82 million sq kilometres and a combined Gross Domestic Product of $73 billion (2009). Kenya, Tanzania and Uganda have the highest populations with each country exceeding 30 million (40 million for Kenya) and Burundi and Rwanda having 9 and 10 million respectively.

The countries of union countries differ significantly in terms of population, cultural, ethnic patterns, and in the availability of natural resources. However, according to the United Nations’ assessment, these countries have in common some of the lowest economic indicators and standards of living and face severe development challenges.

Kenya, Tanzania and Uganda share a similar legal system/tradition. They are all former colonies of Britain and their laws are largely descended from the English Common law. Burundi and Rwanda, on the other hand, are former colonies of Belgium and France and they both have civil law legal systems.

General Observations about the Legal Framework on Identity-related Crime in East Africa

Generally, just like many other regions in the world, East Africa has its share of identity related crimes, ranging from the serious and transnational to the minor and localized offences. Money laundering and human trafficking remains a major concern for both East Africa’s governments and its international partners. New patterns of criminal activities have emerged in the last decade due to the widespread availability and use of the mobile phone and to a limited extent, the internet. This, among other things, have prompted the EA countries to move towards enacting cyberlaws that define computer and identity-related offences, including some related to identity. However, even though the Union has adopted a general agreement of principles on Cyberlaw and individual country commitments to the enactment of new laws, the pace and flavour of the implementation has hardly been uniform.

International Law
From the records of the United Nations, the following is the status of the EA countries with respect to four major international instruments concerned with cybercrime and identity related crime:
• United Nations Convention against Transnational Organized Crime and the Protocols thereto – Kenya has signed and acceded; Tanzania & Rwanda have ratified; Burundi and Uganda have signed
• United Nations Convention against Corruption – Burundi has acceded; all the other EA states have ratified.
• Council of Europe Convention on Cybercrime – South Africa has for a long time been the only African country to accede to the Convention, though to be fair to other countries, this being by definition a European regional convention, it has served only as a model for many non-European countries and the failure to accede to it is not necessarily a reflection of a country’s attitude towards combating cybercrime.
• UNCITRAL Model Law on Electronic Commerce –This model law has been the touchstone of principles and practices for many countries, including East African countries, in the formulation of cyberlaw legislation.

Municipal Law
Because of their common English descent, most of the Constitutional, criminal and procedural laws of three of the East African countries – Kenya, Tanzania & Uganda - are similar. On August 27, Kenya promulgated a new Constitution which replaced the old Constitution negotiated by the country’s founding fathers with the former English colonialists in the 1960s. In the three countries, with the new Constitution of Kenya being the recent exception, the right to privacy has not been expressly legislated as a constitutional or statutory right. Rather, it has been expressed as a broad constitutional norm encompassed in the freedom from unlawful entry into one’s premises, the search and seizure of one’s property and effects and freedom from interference with one’s correspondence. As a corollary, there has been no express constitutional right to confidentiality and the protection of personal information. The practice on the right to privacy and confidentiality has been guided by the English Common law as applied through judicial opinions.

However, Kenya’s new Constitution expressly creates the right to privacy (section 31) - Every person has the right to privacy, which includes the right not to have—
(a) their person, home or property searched;
(b) their possessions seized;
(c) information relating to their family or private affairs unnecessarily required or revealed; or
(d) the privacy of their communications infringed.

Identity-related offences
In the three countries, identity-related offences are captured in the general corpus of criminal law, in what may now be referred to as traditional statutory offences that punish identity-related crime. These include the following and their related offences:
o Obtaining by false pretences
o Forgery
o Fraud
o Impersonation and falsification of identity
o Theft

The East African Cyberlaw Framework was an initiative of the East African Community with the support of UNCTAD, to develop a general framework on legislative approaches to cyberlaw. The framework was adopted in June 2010. It seeks to promote regional harmonisation in the legal response to the challenges raised by the increasing use and reliance on ICTs for commercial and administrative activities and outlines agreed features to be transposed into national legislation in order to address the various issues identified in respect of: Electronic transactions, electronic signature and authentication, data protection and privacy, consumer protection and computer crime.

On the subject of Data Protection and Privacy, the framework provides as follows:

“For the purposes of the Framework, ‘data protection’ is used… to describe those obligations placed upon those entities that process information about living individuals, generally referred to as ‘personal data’. A data protection regime will also grant certain rights upon individual data subjects.

The application of data protection rules may be limited only to private sector entities or public bodies. A sectoral regulatory response may be appropriate to address specific uses and abuses of personal data, whether driven by domestic or foreign concerns, such as the financial services sector.

In terms of the entity responsible for the processing, the following minimum obligations represent international best practice in the area:

• To comply with certain ‘principles of good practice’ in respect of their processing activities, including accountability, transparency, fair and lawful processing, processing limitation, data accuracy and data security.

• To supply the individual with a copy of any personal data being held and processed and provide an opportunity for incorrect data to be amended.

The cost of regulation will be a critical factor in data protection. The cost associated with a comprehensive or omnibus approach, specifically the establishment of a dedicated regulatory authority, will generally be excessive for most developing countries, especially if borne by the private sector through licensing or notification fees. However, in terms of addressing privacy concerns vis-à-vis public sector infringements, an authority independent from government will generally be necessary in order to provide the necessary trust and assurance in its activities. The regulatory authority may not have an exclusively data protection remit, which mitigates the costs involved.

Whilst a self-regulatory or co-regulatory approach may be appealing in terms of minimising the public costs of regulation, its success depends on a sufficiently strong and active private sector, willing and able to fund the regulatory activity. It is also unlikely to be appropriate in terms of the public sector use of personal data.

The Task Force recognises the critical importance of data protection and privacy and recommends that further work needs to be carried out on this issue, to ensure that (a) the privacy of citizens is not eroded through the Internet; (b) that legislation providing for access to official information is appropriately taken into account; (c) the institutional implications of such reforms and (d) to take into account fully international best practice in the area.”

Status of implementation of cyberlaws
Any person carrying out an inquiry into this subject soon enough becomes aware of the dearth of country information on crime statistics including the typologies of cybercrimes and their differential distribution, the status of the implementation of international/regional country obligations, the text of laws and bills and even more importantly, victim data. As far as my best efforts could establish:
• Burundi is still at the stage of drafting its cyberlaws in conformity with the Framework;
• In Rwanda, a draft information and communication technology (ICT) bill was prepared in 2009 covering e-signatures, consumer protection, privacy, and content regulation. In early 2010, the country prepared a draft criminal law on cybercrime. Rwandan laws on digital copyright and e-contracting were passed in early 2010.
• In Uganda, the legislature passed the Electronic Transactions Act and the Electronic Signatures Act in October 2010. The fate of the third bill, the Computer Misuse Act, could not be immediately established.
• In Tanzania, the Law Reform Commission to the Ministry of Justice and Constitutional Affairs has proposed separate bills on Cyber crimes, regulation of electronic transactions and e-communications, privacy and data protection and the amendment of the Evidence statute.
• In Kenya, the Kenya Communications (Amendment) Act 2008 came into force on January 2, 2010. This Act amended the Kenya Communications Act of 1998 to rename it the Kenya Information and Communications Act, 1998 and to introduce to it provisions on e-transactions, e-signatures, consumer protection, and computer crime.

Key provisions of Kenya Information & Communications Act, 1998 on Privacy/Identity Data Protection
Ministerial regulations on privacy of telecommunication
The KIC Act empowers the Minister for Information and Communications to make regulations with respect to ‘the privacy of telecommunication’. The contravention of the Minister’s regulation would attract a fine of USD 4,375 or imprisonment for a term of up to 3 years or to both imprisonment and fine. However, no special regulations have been made under this section.

Prohibition against unlawful interception and disclosure of a message
The Act also makes it an offence for a telecommunications operator to intercept or disclose a message sent through the operator’s system or to disclose the statement or account of its subscriber. The prescribed punishment for the offence is a fine not exceeding USD 4375 or to imprisonment for a term of up to 3 years or to both imprisonment and fine.

Prohibition against disclosure of personal information through radio communication apparatus
Except where the authority of the Minister for Internal Security has been given, the Act forbids any person from using radio communication apparatus with the intention of obtaining information on the contents, the sender or addressee of any message. It also forbids, expect in the course of legal proceedings, the disclosure by any person of any information as to the contents, sender or addressee of any message coming to him or her through a radio communication. A conviction for contravening any of these provisions will lead to a fine of up to USD 12,500 or imprisonment for up to 5 years or both fine and imprisonment.

• Theft of information – the legislation introduced an amendment to section 267 of Kenya’s Penal Code which defines things that are capable of being stolen for the purpose of the offence of stealing or theft. The amendment, now in subsection (9) of the Code, states that ‘Information is capable of being stolen’.
• Unauthorised access to computer data
• Access with intent to commit offences
• Unauthorised access to an interception of computer service - Knowingly securing access to a computer system for the purpose of obtaining any computer service or intercepting any function or any data held in the system.
• Unauthorized modification of computer material - Knowingly doing an act which causes an unauthorized modification of data held in any computer system.
• Damaging or denying access to a computer system
• Unauthorized disclosure of password - Knowingly disclosing any password, access code, or any other means of gaining access to any program or data held in any computer system:
◦ for any wrongful gain;
◦ for any unlawful purpose; or
◦ knowing that the disclosure is likely to cause prejudice to any person.
• Electronic fraud - With intent to procure an advantage, fraudulently causing loss of property to another person by an input, alteration deletion or suppression of data; or any interference with the functioning of a computer system.
• Knowingly creating, publishing or availing an electronic signature certificate for any fraudulent or unlawful purpose.
• Unauthorized access to protected system - Securing or attempting to secure access to a protected system in contravention of the law.
• Re-programming of mobile telephone - Not being a manufacturer of mobile phone devices or an authorized agent of such manufacturer, knowingly or intentionally, changes or interferes with the operation of mobile telephone equipment identity.

With the widespread use of the mobile telephone in East Africa, (for example, over half of the Kenyan population has access to a mobile phone), a new pattern of offences began to emerge.
o Kidnappings – with the kidnappers using the convenience of the mobile phone to get in touch with the victim’s family and make a ransom demand
o Hoax promotions/raffles – where a subscriber is called by a person purporting to be from a mobile service provider or a company running a promotion and informed that they have won a prize in a draw and in order for them to collect their money they need to pay – via mobile money transfer – an ‘administrative charge’
o Or being falsely advised to dial a certain code ostensibly to register but the effect of dialing that code transfer’s airtime to the criminal’s number
o A number of these crimes were being committed by convicts who had unathorised access to mobile phones while in custody.
In July 2009, Kenya’s President Mwai Kibaki directed the Ministry of Information and Communication to establish a databank of all mobile telephone subscribers. The directive was preceded by the President’s concern over a reported increase in phone-related crime.

Administrative/Institutional Framework for Combating Identity Related Crime:
In Kenya, the Police Service is the principal law enforcement agent. According to the department's website (www.kenyapolice.go.ke), it is organized into twelve 'Formations' based on both administrative functions and crime typologies. Out of these twelve formations, the following deal with particular types of crimes:
• General Service Unit – for riots and offences of public order
• Criminal Investigation Department -
• Anti-stock Theft Unit – for livestock theft
• Traffic Police Department
• Tourism Police Unit
• Maritime Police Unit
• Diplomatic Police Unit

Three other police units are important in discussions of identity-related offences even though their place within the administrative structure of the Police Service could not be immediately established:
• The Serious Crimes which deals with offences such as money laundering, kidnapping and organized crime;
• The Anti-Banking Fraud Unit;
• The Anti-Terrorism Unit.

Evidently, identity-related crime is not given any special treatment as a sub-category or thematic subject both from a criminal justice or law enforcement perspective. There is therefore no general conceptual framework or official public study on identity-related crimes. Moreover, information on these types of crimes is not necessarily disaggregated from the general crime statistics that are compiled and published by the Kenya Police.

These crime statistics published by the Kenya Police for various types of crime between 2006 and 2008 are presumably (because the report does not say so) reports of crime incidents recorded at police stations throughout the country and not necessarily actual convictions for the crimes.

The categories of crimes included in the table above are those that are related to identity crime. Though I have included them in the table, it is not clear from the statistics what range of crimes are covered by the expressions ‘other offences against persons’ or ‘other Penal Code offences’.

Identity crime typology and victim issues
Based on decided cases and media reports, the most common types of identity-related crimes in East Africa (whether committed in their traditional sense or with the aid of information and communications technology) include:
• Human trafficking
• Money laundering
• Terrorism
• Fraud, forgery, impersonation and theft
• Unlawful access to, modification, damage or theft of information in a computer system
• Unlawful modification of mobile phone equipment identity

Even far from the immediate loss and damage suffered that is the consequence of the direct consequence of identity crimes on the part of the victim, there are other challenges for victims of such crimes that relate to access to legal aid and justice:

• Because identity crime is not sufficiently mapped or studied by law enforcement, there is inadequate information for both potential victims and victims on how to avoid and mitigate the effects of such offences.
• Inadequate legal framework – While laws on certain aspects of identity related crime are lacking or insufficient, existing laws focus mostly on the punishment of the criminal and less on regulating the collection and management of personal information.
• The subject of the technical measures and minimum compliance standards for protecting information, communications and commercial systems not captured in legislation
• East Africa’s governments have been challenged that they have not fully complied with the minimum standards for the elimination of identity related transnational crimes – human trafficking, money laundering, economic fraud, organized crime/terrorism.
• Poor crime reporting and crime mapping. Though prosecutions for identity related crimes are conducted, data on such cases is not compiled at the provincial or national level, and any data compiled is not readily available to the public.
• Poor access to legal aid:
◦ Poor victim access to knowledge on basic laws, prevention and self-help
◦ High cost of professional legal aid
◦ Poor forensic and prosecutorial knowledge and skills on the part of law enforcement
• Difficulties of jurisdiction and mutual-legal assistance in dealing with transnational crimes

The following scenario extracted from the U.S. State Department Trafficking in Persons Report, June 200 is illustrative of the plight of victims of identity-related crimes:
‘Police reportedly arrested foreign trafficking victims for being in [the country] without valid identity documents; in most cases, they pled guilty to immigration violations and were quickly deported. The government did not provide legal alternatives to the removal of victims to countries where they would face hardship or retribution.’

The way forward:
• First, a baseline study on the incidence, typology and distribution of identity-related crimes will need to be conducted in order to proved both aggregated and disaggregation regional and country-specific information. Such a study will provide the empirical information that will form the basis for understanding and decision making.
• There is need for improved tracking and reporting of identity-related crime by law enforcement and other government departments in the chain of justice and the sharing of this information with the public.
• Capacity building interventions for law enforcement and civil society groups focusing on forensics, investigative and prosecutorial techniques, preservation of evidence and the protection of and handling of victims.
• Information, education & awareness focusing on potential victims and victims of identity-related crime will need to be developed for both victims and law enforcement agencies.
• Legislative reform – The East African member states will need to follow up on their obligations under the EA Cyberlaw Framework to prepare, sponsor and pass legislation incorporating international best legislative standards on data protection and identity-related crime.
• Considering the important role of the private sector in the processing of personal and financial information, in the development of technologies for protection of personal information and ensuring the security and confidentiality of computer-based transactions and in its ability to assist law enforcement in the prevention, detection and punishment of identity-related crime and the protection of victims, it is imperative that countries consider a framework of co-operation between the public and private sectors in this regard.
• Finally, considering the transboundary nature of many identity-related crimes, international legal obligations as well as mutual co-operation between countries in dealing with translocated victims of identity-related crimes will need to be legislated or institutionalized.

The World e-Parliament Conference 2010: Kenya Showcases an XML version of the online Laws of Kenya

2010-11-15T13:39:00.005+03:00

By Michael M. Murungi
November 2010

A sneek preview of the XML version of the National Council for Law Reporting’s Laws of Kenya database.

Between October 20 and 22 of 2010, parliamentarians, hansard editors and parliamentary librarians, ICT technocrats and librarians; representatives of international organizations as well as ICT professionals converged at the Pan-African Parliament in Johannesburg-South Africa for the 2010 edition of the World e-Parliament Conference.

Kenya's delegation to the conference included Members of Parliament: the Hon. David E. Ethuro, the Hon. Wavinya Ndeti the Asst. Minister for Youth and Sports; the Hon. Danson M. Mwakulegwa; and the representatives of the research and ICT units in the office of the Clerk of the National Assembly led by Mr. Clement Nyandierie, the Director of Information and Research and Mr. Owino Harrison the Head of ICT. Kenya's National Council for Law Reporting (NCLR), the official publisher of the Kenya Law Reports and the Laws of Kenya, was represented by the writer.

The Conference was organized by The Global Centre for ICT in Parliament (GCiP) in partnership with the United Nations and the Pan-African Parliament. The GCiP represents a broad partnership initiative of the United Nations Department of Economic and Social Affairs (UNDESA) and the Inter-Parliamentary Union, inspired by the outcome of the World Summit on the Information Society. Since its founding in 2006, the Centre has made significant progress in bringing together the parliamentary community of the world around the idea that sharing knowledge and good practices in the use of information and communications technologies helps make democracy stronger and more responsive to citizens. The African Parliamentary Knowledge Network (APKN) is a network of African Parliaments which supports capacity building activities, common information services, sharing experiences and best practices among African parliaments. It builds on regional and continental dimensions to create synergies and the critical mass necessary to deliver high quality and sustainable services for all Africans.

Among the presentations made by the Kenyan delegates was Hon. Wavinya Ndeti's address at a break-away session of the conference under the theme Parliaments and the Media in the Information Age and the writer's joint presentation with the UNDESA titled ‘The Development and Status of the Revision, Consolidation and Publishing of the Laws of Kenya/Unveiling an XML Online Database of the Laws of Kenya’ under the thematic session: Advances in XML at the International Level.

The latter presentation was a showcase of an XML version of the full text of the Laws of Kenya that the NCLR has developed with the technical assistance of the UNDESA under the auspices of the Africa i-Parliaments Action Plan. This plan is an Africa-wide initiative implemented by the UNDESA to empower African Parliaments to better fulfill their democratic functions by supporting their efforts to become open, participatory, knowledge-based and learning organizations. It builds on the experiences, lessons learned and tools and applications developed during the implementation of the initiative 'Strengthening Parliament's Information Systems in Africa'. These tools include AKOMA NTOSO (Architecture for Knowledge-Oriented Management of African Normative Texts using Open Standards and Ontologies) which defines a set of simple, technology-neutral electronic representations of parliamentary, legislative and judiciary documents and provides an enabling framework for the effective exchange of machine readable documents; and BUNGENI Parliamentary and Legislative Information System, a solution for drafting, managing, consolidating and publishing legislative and other parliamentary documents that makes them more open and accessible to citizens.

The NCLR's engagement with the Africa i-Parliaments Action and its endorsement of the XML platform stems from the following important considerations:
• While section 35 of the Constitution of Kenya 2010 declares the citizen’s right of access to public information, actual access to public legal information is limited by among other factors, the nature of the platforms on which this information is deployed.
• The creation, management and deployment of Kenya’s public legal information, which includes the Laws of Kenya; the Parliamentary Hansard; Legal Notices; Gazette Notices and Judicial Opinions; is not predicated on a common standard that would allow easy exchange and aggregation of the information, reduced time-lags in making the information accessible to the public via web, mobile and other electronic publishing media and most importantly, enabling the citizen to obtain actual and reliable access to contextually relevant information.
• Due to the diversity of the public institutions in the public legal information domain, public legal documents that are ‘born digital’ are not available for the public access end of the chain. While a majority of the public legal materials are managed and deployed as paper-based (eg the Kenya Gazette) stand-alone document-centric representations of information (eg the Parliamentary Hansard), others such as the online version of the Laws of Kenya are stored in relational databases.
• While the disadvantages for citizen access related to the paper-based and document-centric platforms would be self evident, relational databases cannot meet all the demands of electronic publishing because they process data independently of its context. Traditional databases may be well suited for data that fits into rows and columns, but cannot adequately handle rich data such as audio, video, nested data structures or complex documents, which are characteristic of typical web content.
• There is need for institutions that create and publish public legal information to develop and/or adopt a software architecture for the deployment of that information in technology-neutral and inter-operable representations and secondly, to open access to the information through web, mobile and other applications.
• The Information Technology industry has coalesced around a standard technology for Open Document Formats known as Extensible Markup Language (XML). XML is a set of rules for encoding documents in machine readable form. It is defined in the XML 1.0 Specification produced by the World Wide Web Consortium (W3C) and several other related specifications. XML is an application profile of Standard Generalized Markup Language (ISO 8879)
• XML's design goals emphasize simplicity, accessibility, openness and universality, extensibility and usability over the Internet.

In the first part of the joint presentation, the writer explained the role and function of the NCLR and related the efforts that it has applied in providing access to public legal information in Kenya. With particular focus on the Laws of Kenya, he demonstrated the challenges and the inadequacies of the three methods in which the NCLR deploys its legal information: an interactive online MySQL database, downloadable PDF documents, and in printed paper. In the second part of the presentation, Mr. Ashok Hariharan, a Software Development Co-ordinator at UNDESA, showcased the XML database of the NCLR's Laws of Kenya which features full length display of individual Acts; auto-suggested full-text search by keyword; easy search engine discovery; and capacity to provide point-in-time legislation.

The NCLR is working with UNDESA to prepare the XML database of the laws for deployment on the NCLR website.
Other countries whose parliaments have made significant advances in adopting XML as a publishing standard include Brazil and the United Kingdom. The European Parliament is also developing a harmonized schema that meets the diversity of languages and publishing formats used of its different members.

The writer is an ICT Legal Expert and the Editor/CEO of the National Council for Law Reporting.

2010-10-16T15:37:00.015+03:00

INSIDE KENYA'S FIRST VIRTUAL COURT SESSION

By Michael M. Murungi

Court of Appeal Judge Mr. Justice M. Ole Keiwua (seated front) flanked by Jean Muthoni, a court clerk, presides over Kenya's first virtual court session at the Nairobi Law Courts. On the screen in front of him are lawyers making submissions from a video-conference terminal at the Mombasa Law Courts, about 400 Kms away from the Judge's terminal.

See news video

On 11^th October, 2010, Justice M. Ole Keiwua, a Judge of the Court of Appeal of Kenya, presided over the hearing of an application for extension of time within which to file a notice of appeal in the case of Yasmin Abdulkarim t/a Y.A. Ali Advocates v. Southern Credit Banking Corporation Ltd, Mombasa Civil Application NAI 161 of 2010. Such applications are routinely heard and disposed by the Court of Appeal. However, the special thing about this particular session was that the presiding judge was sitting at the Nairobi Law Courts while the lawyers for both parties made their submissions from the Mombasa Law Courts, over 400 kilometres away, in what may very well have been East Africa’s first video-conferenced court session.

This virtual court session was the first in a series of three other sessions that were the run-up to the launch by Chief Justice J.E. Gicheru of the Judiciary’s ICT Policy and Strategic Plan 2011-2013 at a public ceremony on October 14, 2010. The policy and plan outlines the Judiciary’s policy and strategic approach in incorporating information technology as an aid in the administration of justice. The virtual court was a showcase of some of the ICT initiatives and projects anticipated in the Strategic Plan. During the launch ceremony at the Chief Justice’s Garden outside the Nairobi Law Courts, invited guests were treated to a virtual court session beamed live through large flat-screen monitors installed at Garden.

Video-conferencing technology

The Virtual Court is a concept that seeks to build on the positive use of video conferencing technology by firstly interlinking court stations and ultimately linking court stations with prisons and other locations in order to dispense with the need to produce an accused person in court; or for parties, advocates, witnesses and court staff to appear personally before a judicial officer; and for the Judiciary to save administrative costs and time.

The virtual court features a high capacity point-to-point fibre optic link between the Mombasa Law Courts and the Nairobi Law Courts. On both terminals there is a videoconference room with acoustically enhanced room design and state-of-the-art video-conferencing technology - video cameras, large screen video display/monitors, a sound-system and information processing equipment.

By prior arrangement, all persons involved in a case that has been designated for hearing through videoconference will have been informed and their consent obtained. On the time when the hearing or proceeding is scheduled, a communication link is established between the two terminals so that a live video of the presiding Judge/Magistrate is displayed to the accused person, litigant or lawyer at one terminal (the remote terminal) and in turn a live video of the accused person, litigant or lawyer and the other persons present will be displayed at the Judge’s/Magistrate’s terminal (court terminal).

For the purpose of the pilot phase of the virtual court concept, all the parties and their advocates and witnesses will be at the remote terminal and the court terminal will only have the judge or magistrate, a court clerk a designated technical co-ordinator and any other court official as the judge or magistrate may direct. The pilot phase will not feature the examination of witnesses, evidence or exhibits by advocates or parties located at different terminals.

Prior informed consent and legal uncertainties

However, due to the novelty of this concept and being cautious that there may be certain legal uncertainties surrounding the use of the video-conferencing in the hearing court cases, parties or advocates whose cases have been selected for hearing using the virtual court concept are asked to give their consent to the arrangement. Once the consent has been obtained, the parties indicate that they understand and agree to abide by The Guidelines for Virtual Court Sessions, a set of administrative guidelines which the Judiciary has developed to guide all persons participating in the virtual court.

Some of the legal uncertainties became hilariously evident during the first virtual court session.

Does the term 'appearance in person' include a virtual appearance

The rules that govern the procedure in civil and criminal proceedings in the courts of Kenya are the Civil Procedure Act and Rules, the Appellate Jurisdiction Act, the Court of Appeal Rules and the Criminal Procedure Act. Invariably, the Acts and rules use the terms 'in person or by advocates' in their references to how a litigant or an accused person may appear in court. The uncertainty here would be whether a virtual appearance may be considered to be within the meaning an appearance 'in person'.

What is the geographical location of the virtual court?

The physical location of a court is a matter that is hard woven into the formal documents and procedural niceties of the courts of Kenya. References to where the court is 'sitting' and where a court order was issued carry important legal-procedural implications. Generally, cases are heard and determined at the physical location where the registry in which they were filed is located. With the first virtual court, the Judge was sitting in Nairobi as he presided over a case filed in the Mombasa Court Registry. When he had finished hearing the application and was in the course of concluding his ruling, Judge Ole Keiwua wondered aloud whether the court order was to be considered as having been issued in Nairobi or in Mombasa. The advocates at the Mombasa terminal looked momentarily at each other and then looked back at the Judge with suppressed laughter obviously as amused by the conundrum as they were unprepared for it.

Examination of witness demeanour and exhibits

The (impersonal?) nature of virtual interactions may raise the question whether a judicial officer would be in a position to qualitatively observe the demeanour of witnesses (an important aspect in determining the credibility of a witness) or to effectively inspect a piece of evidentiary material such as a physical exhibit. This was demonstrated when noticing that one of the lawyers appearing on the screen was having trouble finding a provision of law in his copy of the Court of Appeal Rules, Judge Ole Keiwua said, “Regrettably in the circumstances I cant hand over my copy to you” to the accompaniment of further laughter.

Do the recently enacted provisions on electronic transactions eliminate some of these uncertainties?

Section 83G of the Kenya Information & Communications Act, 1998 provides for the recognition of electronic records. It states that where any law provides that information or other matter shall be in writing, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is rendered or made available in an electronic form; and accessible so as to be usable for a subsequent reference. While it would strain the interpretation of this section to argue that it expressly gives legal recognition to virtual court appearances, the argument that the Act in itself does not necessarily outlaw virtual court sessions would be equally if not more compelling. Perhaps proponents of the latter argument would find support from no lesser a law than the newly promulgated Constitution of Kenya 2010.

The Constitution of Kenya 2010

Part 1 of the Constitution establishes the Judiciary and prescribes the manner in which judicial authority shall be exercised. In section 159, it states that Judicial authority is derived from the people and vests in, and shall be exercised by, the courts and tribunals established by or under this Constitution. One of the principles set out in the Constitution as one which shall guide the courts in the exercise of judicial authority sounds like the opening line of a submission by a lawyer who is opposing an argument by his counterpart challenging the legality of proceedings conducted in a virtual court: 'Justice shall be administered without undue regard to procedural technicalities'. Further, in section 232, the values and principles of public service are stated as including: 'efficient, effective and economic use of resources … responsive, prompt, effective, impartial and equitable provision of services'. The savings in time and physical and financial resources and the improvements in the provision of judicial services that would result from the effective application of the virtual court concept would answer directly to the high ideals of public service provided in the Constitution.

Once the virtual court concept has been successfully piloted, the Judiciary plans t0 roll it out along with other initiatives outlined in its ICT Policy & Strategic Plan 2011-2013.

LEGALITY OF ELECTRONIC DOCUMENTS: SCANNED DOCUMENT ‘NOT AN ORIGINAL’

2010-04-01T18:29:00.003+03:00

Republic v Public Procurement Administrative Review Board Ex-parte Kenya Medical Supply Agency & 3 others [2010] eKLR

High Court at Nairobi (Nairobi Law Courts), Jeanne Gacheche, J., March 4 2010

Reported by Michael M. Murungi

The High Court of Kenya has held that a scanned document may not be regarded as an ‘original’ for the purposes of the Public Procurement and Disposal Act, 2005 particularly where in its guidelines to potential bidders, a procuring entity requires the submission of ‘original’ documents. In an application to review the decision of the Procurement Review and Appeals Board in which the Board had applied a recently enacted law recognising the legality of electronic documents and the originality of documents rendered in electronic form, the High Court reversed the Board’s decision and excluded the application of the new electronic documents law from the Procurement Act.

This case was probably the first definitive judicial test for the newly enacted provisions of the Kenya Information and Communications Act, 1998 (formerly the Kenya Communications Act, 1998) regarding the recognition of electronic documents. One of the aims of the amendments, which were introduced through the Kenya Communications (Amendment) Act, 2008 and which came into force on January 2, 2009, was to eliminate legal uncertainties as to the validity of electronic documents, electronic signatures and electronic transactions.

Statutory Interpretation

The decision highlights what may be an awkward dilemma for legislative drafting and statutory interpretation: Where one Act of Parliament excludes the application of any other Act in the interpretation of its provisions and a later Act makes provisions of a general nature to be applied in the interpretation of all other Acts, how is the apparent conflict between the two Acts to be resolved. While the section 5 of the Public Procurement and Disposal Act, 2005 provides that where there is a conflict between the Act or the regulations made under it and any other Act in matters relating to procurement and disposal, the Procurement Act and its regulations are to prevail, the provisions of the Kenya Information and Communications Act, 1998 recognizing the legality of electronic documents and ‘electronic originals’ is to apply to all Acts of Parliament, particularly to those that contain provisions providing for documents to be in writing.

Legal recognition of electronic records and ‘electronic originals’

One of the new provisions enacted through the Kenya Communications (Amendment) Act of 2008 was section 83G which was inserted in the Kenya Information and Communications Act, 1998. The section provides:

‘Where any law provides that information or other matter shall be in writing then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is:-

(a) rendered or made available in an electronic form; and

(b) accessible so as to be usable for a subsequent reference’.

This provision expressly recognizes the legality of electronic documents and extends its application to other Acts of Parliament providing for any matter or document to be done in writing.

A new section 83i of the Act provides:

‘ Where any law requires information to be presented or retained in its original form, that requirement is met by an electronic record if:

(a) there exists a reliable assurance as to the integrity of the information from the time when it was first generated in its final form as an electronic message or otherwise; and

(b) where it is required that information be presented, that information is capable of being displayed to the person to whom it is to be presented’.

For the purposes of paragraph 1(a), it is further provided that the criteria for assessing the integrity of the information shall be whether the information has remained complete and unaltered, apart from the addition of any endorsement and any change which arises in the normal course of communication, storage and display; and further, that the standard of reliability required shall be assessed in the light of the purpose for which the information was generated and in light of all the relevant circumstances.

This provision expressly recognizes that a document may, subject to the conditions specified, be deemed to be an ‘original’ even if it does not exist in paper form and where it is merely an electronic abstraction or representation of a paper document.

However, the conflict between these provisions and the Public Procurement and Disposal Act, 2005 was thrown into relief when a dispute over the procedure followed in the procurement of HIV-AIDS drugs by the government came to the courts.

The dispute

In March of 2009, a consortium of agencies and firms involved in procurement and supply chain management comprised of the Kenya Medical Supply Agency (KEMSA), Crown Agents, the agency for German Technical Co-operation (GTZ) and John Snow Inc. advertised a tender for the supply of anti-retroviral drugs on behalf of Kenya’s Ministry of Health. Among other requirements, the Instructions to Tenderers provided that bidders were to submit ‘an original and … copies’ of their bidding documents, including a price schedule, and that ‘in the event of any discrepancy between them, the original shall govern’. It was further provided that the original and all copies of tender documents were to ‘be typed or written in indelible ink and …. signed by the tenderer’.

One of the bidders for the supply of the drugs was Hetero Drugs Ltd. In the evaluation of the tender documents for all the bidders, the consortium declared Hetero’s bid non-responsive ostensibly because it had contravened the Instructions to Tenderers by submitting a scanned copy of a price schedule instead of an ‘original document’. Hetero’s bid was therefore disqualified at the preliminary stage and ultimately, the tender was awarded to three pharmaceutical companies.

Hetero moved to the Public Procurement Administrative Review Board, a statutory body established to deal with complaints from parties to a public procurement process. After considering the arguments of both Hetero and the consortium, the Board relied on section 83G of the Kenya Information & Communications Act, 1998 to find that Hetero’s price schedule ‘was acceptable as an original’ even though it was a scanned copy. The Board decided in favour of Hetero and ordered the consortium admit Hetero’s bid and also to carry out a fresh evaluation of all the tenders.

The consortium then filed judicial review proceedings in the High Court challenging the decision of the Board. The consortium’s argument was that whereas section 83G of the Kenya Information and Communications Act provided for situations where ‘the law’ required that information be submitted in writing, the requirement in this case was not contained in a law but in bidding guidelines.

‘The [Board] failed to appreciate that the effect of its decision is to give tenderers the liberty to submit copies of documents where originals are required therefore making it impossible for procuring entities to establish the authenticity of documents. The entire purpose of the Public Procurement and Disposal Act which is to make public procurement a fair, transparent and accountable process will be defeated if tenderers are allowed to submit copies of documents instead of originals.’

The Board also relied on section 5 of the Public Procurement and Disposal Act, which provided that if there was a conflict between the Act or the regulations thereunder and any other Act or regulations in matters relating to procurement and disposal, the Act or the regulations ‘shall prevail’.

The definitive question before the High Court then became: Does a scanned document qualify as an original document for purposes of the tender and generally, for purposes of the Public Procurement and Disposal Act?

The decision of the High Court

Lady Justice J. Gacheche, who presided over the judicial review application, made the following holdings:

- Under the Public Procurement and Disposal Regulations 47 and 48 made under the Public Procurement and Disposal Act, it is a mandatory requirement that tenders are to be submitted ‘in the required format’ and that a ‘procuring entity is to reject all tenders which are not responsive. Under section 64 of the Act, a tender is responsive ‘if it conforms to all the mandatory requirements set out in the tender documents’.

- Though the Court noted the proviso to section 64 which provided that ‘minor deviations that do not materially depart from the requirements set out in the tender documents’ would not render the tender non-responsive, the requirements that the bids should be compliant were mandatory and to be fulfilled to the letter. One of such requirements was that the tender was to be submitted in the required format.

- The Public Procurement and Disposal Act did not cater for matters pertaining to e-procurement yet the copy that the Board attempted to admit was a scanned copy instead of the original.

- The Kenya Information and Communications Act section 83G was a direct contradiction of the requirement in the Instructions to Tenderers prepared by the consortium that bidders were to prepare an ‘original’ and to clearly mark the original bid documents and the copies. The Public Procurement and Disposal Act prevailed over the Kenya Information and Communications Act in matters pertaining to public procurement and disposal.

- The Board had no jurisdiction to waive the obvious mandatory statutory requirements. It had exceeded its jurisdiction in dealing with issues that were not pleaded before it and in doing so, it had reached a wrong conclusion. Its decision was ultra vires.

Application allowed, order of certiorari issued quashing the decision of the Procurement Review and Appeals Board.

The advocates for the various parties in the litigation were: Miss Malik for the applicant (the Consortium); Mr. A. Ombwayo for the first respondent (The Review and Appeals Board); Dr. Muma for the first interested party (Hetero) and Mr. Nguli for the second and third interested parties (Lords Health Care Ltd and Ranbaxy Laboratory Ltd).

KENYA'S DRAFT NEW CONSTITUTION AND ITS IMPLICATIONS FOR ICT

2010-03-17T08:10:00.036+03:00

March 2010

By Michael M. Murungi

Image courtesy of: www.wired.com/

After almost two decades of talk about constitutional reforms in Kenya, the events of this year’s reform calendar are so far the closest that the country has come to enacting a new constitution. There is a lingering sense of optimism in the man and woman on the street about what the new constitutional order will mean for Kenya – that Kenya will become a better place. Some of this optimism may be overstated. At the dawn of the coming into force of the new constitution, we will still need to purge our national conscience of the hatred and divisions that continue to blind our love for one another; we will need to shift from being a people who merely obey the law to being genuinely good-natured people; from tolerance to understanding; from cleaning our environment to being the kind of people who have a reverence and respect for mother nature. After the confetti has settled down and after someone has cleaned up the party mess will come the great disillusionment. Public officers will not necessarily fall into alignment with the best practices in work ethics and service delivery at the stroke of a new constitution; our politicians will not immediately emerge from an epiphany with the radiance of enlightenment and begin to espouse the politics of honour, integrity and respect for each other.

This is because a great nation is not made by a great constitution but by a great people. As Ralph Waldo Emerson was once paraphrased by Wallace Wattles, Shakespeare was never made by the study of Shakespeare, but by the thinking of Shakespearean thoughts. Even with the most well-drafted constitution in the world and with the best prescription for a framework for governing our political, social and economic affairs, we will remain in tyranny if we do not have at least a critical mass of Kenyans who think, act and speak the highest and noblest of virtues. For a long time in the United States and up to the changes that came out of the Civil Rights Movement of the 1960’s, persons of colour did not have equal access to social amenities – they were even obliged by law to give up their bus seats for the more fairer-skinned citizens. Yet as early as 1788, the United States Declaration of Independence had declared boldly that it was a self-evident truth that “all men are created equal...” and the 14^th amendment to the Constitution had provided since 1868 that “No State shall deprive any person of life, liberty, or property, without due process of law; nor deny to any person within its jurisdiction the equal protection of the laws..” It was not until the Civil Rights Movement that a critical mass of Americans stared down into the country’s conscience and resolved to purge from it the stain of institutional racial segretation and discrimination. The jury is still out on whether Americans are living Martin Luther King Jr.'s dream of racial harmony.

Having said that, I think there is still something to be said about the need to have a well-drafted Constitution that captures national values, declares the rights of citizens and the limits of state power, and establishes a structure of government that is transparent and accountable and derives its mandate and legitimacy from the people. Having read the Draft New Constitution (February 23, 2010 version) I wondered what implications it would have for Kenya’s burgeoning ICT industry; what the proposed framework of government would mean for the ICT political leadership in the country and what the provisions of the new constitution portend for the following pertinent issues in the information society:

Privacy and confidentiality

Freedom of expression

The right of access to public information

Press freedom

Consumer rights

The place of ICT leadership in the organization of the affairs of Government

1. PRIVACY AND CONFINDETIALITY

Save as a broad constitutional norm encompassed in the freedom from unlawful entry into one’s premises, the search and seizure of one’s property and effects and freedom from interference with one’s correspondence, the right to privacy is not expressly legislated as a constitutional or statutory norm in Kenya. As a corollary, there is no express constitutional right to confidentiality and the protection of personal information. Kenyan practice on the right to privacy and confidentiality is guided largely by English Common law – a system of law which has developed from the judicial opinions of the English judiciary.

Perhaps the fullest expression that the right to information privacy may be given in the information age is the right to informational self determination, i.e., the right of the individual to determine what information about himself should be communicated to others and the circumstances under which that may be done, as was enunciated by the German Federal Constitution Court in the 1983 case relating to the country's population census.

Privacy and the current Constitution of Kenya

The current Constitution provides for the protection for the individual against “the search of his person or property or the entry by others on his premises.” The right to individual privacy not expressly legislated.

However, section 79(1) which guarantees the freedom of expression includes “freedom from interference with… correspondence”.

Privacy and the Draft New Constitution

In the Draft New Constitution,

Article 31 provides:

“ Privacy:

Every person has the right to privacy, which includes the right not to have-

their person, home or property searched;

their possessions seized;

information relating to their family or private affairs unnecessarily required on revealed; or

the privacy of their communications infringed”.

2. FREEDOM OF EXPRESSION

The freedom to express and receive information has not only been a defining value of the information society but is also hardwired into the architecture of the Internet - an open and collaborative platform where people freely and in most cases anonymously share information and ideas. Existing as well as emerging communications technologies have redefined the way regulatory authorities look at information censorship and thrown into redundancy traditional means of controlling the flow of information within and outside their national boundaries.

Freedom of Expression and the current Constitution of Kenya

In the current Constitution, freedom of expression is guaranteed under section 79(1). The right encompasses “freedom to hold opinions without interference, freedom to receive ideas and information without interference, freedom to communicate ideas and information without interference (whether the communication be to the public generally or to any person or class of persons) and freedom from interference with his correspondence”.

Freedom of Expression and the Draft New Constitution

Article 33(1) of the proposed new Constitution:

“ Every person has the right to freedom of expression, which includes –

a. freedom to seek, receive or impart information or ideas;

b. freedom of artistic creativity; and

c. academic freedom and freedom of scientific research

(2) The right to freedom of expression does not extend to:

a. propaganda for war;

b. incitement to violence;

c. hate speech or

d. advocacy of hatred”.

PRESS FREEDOM

Press Freedom and the current Constitution of Kenya

The current constitution does not bear any express reference to the ‘press’ or ‘the media’. This has often been interpreted by some observers to mean that press freedom is not recognized as a constitutional norm. Others have held the interpretation that press freedom is by necessary implication included in the constitutional guarantee protecting the freedom of expression and “the freedom to communicate ideas and information”.

However, even in the absence of an express reference to the term ‘media’ or ‘press’, section 79 of the current Constitution guarantees that “no person shall be hindered in the enjoyment of his freedom of expression, that is to say, freedom to hold opinions without interference, freedom to receive ideas and information without interference, freedom to communicate ideas and information without interference (whether the communication be to the public generally or to any person or class of persons)”.

Press Freedom and the Draft New Constitution

In the proposed Draft New Constitution:

Article 34 provides: “(1) Freedom and independence of electronic, print and all other types of media is guaranteed, but does not extend to [propaganda for war, incitement to violence, hate speech or advocacy of hatred that constitutes ethnic incitement, vilification of others or incitement to cause harm or is discriminatory].

(2). The state shall not –

a. exercise control over or interfere with any person engaged in broadcasting, the production or circulation of any publication or the dissemination of information by any medium; or

b. penalise any person for any opinion or view or the content of any broadcast, publication or dissemination.

(3). Broadcasting and other electronic media have freedom of establishment, subject only to licensing procedures that –

a. are necessary to regulate the airwaves and other forms of signal distribution; and

b. are independent of control by government, political interests or commercial interests.

(4). All state-owned media shall-

a. be free to determine independently the editorial content of their broadcasts or communications;

b. be impartial;

c. afford fair opportunity for the presentation of divergent views and dissenting opinions;

(5). Parliament shall enact legislation that provides for the establishment of a body, which shall-

a. be independent of control by government, political interests or commercial interests;

b. r reflect the interests of all sections of the society;

c. s set media standards and regulate and monitor compliance with those standards.

Comment: This provision would effectively divest the Communications Commission of Kenya (currently the converged regulator for broadcasting, ICT, radio communications and postal services) of all of its regulatory powers over the broadcasting industry. The provision appears to be self-contradictory in two important respects:

Firstly, if it is the intention of subsection (3)(a) to leave CCK with the power to 'regulate the airwaves and other forms of signal distribution", and CCK being by definition a government entity under the administrative ambit of the Ministry of Information and Communications, how is CCK not to be regarded as being "independent of control of government" as provided in subsection (3)(b)?

Secondly, if as is provided in subsection (2) the state is not to interfere with any person engaged in broadcasting or to penalize such person for the content of a broadcast, how is that to be reconciled with the State's duty to enforce the constitutional prohibition against the broadcasting of hate speech (subsection (1)) and other violations of constitutional and statute law by broadcasters? In the absence of an express statement in the draft new constitution making subsection (2) subject to the provisions of subsection (1), this ambiguity may result in a constitutional/legal impasse.

RIGHT OF ACCESS TO PUBLIC INFORMATION

Information is the raw material for the emerging knowledge economy. Public information, in particular, is part of the common heritage of humanity. Maximising access to this information promotes justice and the rule of law. It is therefore important that organisations that have the right to publish public information and the government bodies that create or control that information avail it to the public in a form that is accurate, timely and accessible.

Access to public information and the current Constitution of Kenya

Though the constitutionally guaranteed freedom of expression includes the right to “receive ideas and information without interference” the current constitution does not create any public right to information held by the state. In January 2007, the Kenyan Ministry of Information and Communications published a “draft Freedom of Information Policy”, designed to “provide a framework for the implementation of the Freedom of Information Bill and review of existing laws, regulations and procedures”. The Policy follows a draft Government Bill published in 2005, as well as a draft Freedom of Information Bill developed by the Kenyan Section of the International Commission of Jurists (ICJ) in 2006. The ICJ Bill has since been presented to parliament by Professor Prof. Anyang’ Nyong’o, but has not yet been discussed;4 the status of the government bill is unclear. (see Article 19 ‘Statement on Kenya’s Freedom of Information Policy’ Feb. 2007, p. 1 http://www.article19.org/pdfs/publications/kenya-foi-policy.pdf).

Access to public information and the Draft New Constitution

Under the proposed new constitution:

Article 35. (1) Every citizen has the right to access-

a. information held by the State; and

b. Information held by another person and required for the exercise or protection of any right or fundamental freedom.

(2) Every person has the right to the correction or deletion of untrue or misleading information that affects the person.

(3) The State shall publish and publicize any important information affecting the nation.

Article 232 (Values and principles of public service)

(1) The values and principles of public service include:

(f) transparency and provision to the public of timely, accurate information.

CONSUMER RIGHTS

In the emerging digital economy where technology is rapidly taking the place of personal interactions in the supply of goods and services, the consumer has become both more empowered and more vulnerable. Strong consumer protection regimes are an imperative for an internet-driven globalized market.

Consumer Rights and the current Constitution

The current constitution does not make any provisions declaring the rights of consumers. Consumer protection has hitherto remained the subject of statutory enactments/Acts of Parliament. The Kenya Information and Communications Act, 1998 and its Kenya Communications Regulations 2001 make various provisions for the protection of consumers of ICT services.

Consumer Rights and the Draft New Constitution

Under Article 46 (1) of the proposed new Constitution, all Consumers have the right-

a. to goods and services of reasonable quality;

b. to the information necessary for them to gain full benefit from goods and services;

c. to the protection of their health, safety and economic interests; and

d. to compensation for loss or injury arising from defects in goods or services.

THE PLACE OF ICT IN THE ORGANIZATION OF THE FUNCTIONS OF GOVERNMENT

It may be understood why in the old economy most governments put transport and communications under one ministerial/executive docket. The two involved merely the use of technology in the movement or relay of a thing or a message from one geographical location to another. In the new economy, with the technological merger of the computing, media and telecommunications industries, communications technology has advanced from being merely a conduit for the conveyance of messages, to a technological space where a broader range of social and commercial human interactions take place. Over time, because of its potential to transform business and organization, ICT has exceeded its transport counterpart to establish for itself a unique place in the corporate and government structure. There is no longer any synergy to be achieved by thematically aligning ICT with transport in the organization of corporate or government affairs.

Organization of the Functions of Government in the Current Constitution

Section 16 of the current constitution empowers Parliament or the President to establish the offices of Minister of Government and for the appointment of Ministers from among persons elected to the National Assembly. The Constitution does not define the ministerial portfolios that may be established or the number of ministers who may be appointed. The Ministers, along with the President, the Vice-President, the Prime Minister and two Deputy Prime Ministers, comprise the cabinet whose function is to aid and advise the President in the government of Kenya.

In the current structure and organization of government, there are 40 ministries, under which the Ministry of Information and Communications is separate and distinct from the Ministry of Transport. The functions of each Ministry are outlined in Presidential Circular No. 1 of 2005.

The executive functions of the Ministry of Information and Communications extend to:

· Information and Broadcasting Policy.

· Development of the film industry and licensing.

· Kenya Broadcasting Corporation

· Kenya News Agency(KNA)

· Kenya Institute of Mass Communication

· Kenya Film Classification Board

· Communications Policy

· Communications Commission of Kenya(CCK)

· Telkom Kenya

· Postal Corporation of Kenya (PCK)

· National Communications Secretariat

· Communications Appeals Tribunal

· Kenya College of Communications Technology(KCCT)

· Gilgil Telecommunications Industries

Under the Ministry of Transport:

· Transport Policies

· Kenya Railways

· Kenya Railways Training School

· Kenya Ports Authority (KPA)

· Kenya Airports Authority (KAA)

· Kenya Ferry Services

· Kenya National Shipping Line

· National Road Safety Council

· Transport Licensing Board

· Registration and Insurance of Motor Vehicles

· Motor Vehicle Inspection Unit

· Kenya Civil Aviation Authority (KCAA)

· East African School of Aviation

· Kenya Meteorological Department

· Kenya Meteorological Training College

· Bandari Maritime College

The Organization of the Functions of Government and the Draft New Constitution

In Article 186 of the Draft New Constitution which is titled ‘Respective functions and powers of national and county governments’, it is provided that:

“(1) Except as otherwise provided by this Constitution, the functions and powers of the national government and the county governments, respectively, are as mentioned in the Fourth Schedule.

The Fourth Schedule goes on to list 35 functions of the National Government. Number 18 on the list is worded thus:

“Transport and co of mmunications, including, in particular –
Road traffic, road construction,
railways;
marine navigation;
civil aviation;
pipelines;
space travel;
postal services;
telecommunications;
radio and television broadcasting”.

Under the Schedule, aspects of the old economy (eg road traffic, railways, pipelines, etc) are clustered together with those of the new economy (telecommunications, radio and broadcasting). Neither the main body of the Draft Constitution nor the Schedule bears any express reference to ICT.

Comment: Two interpretations may be made of the wording and style of the Fourth Schedule. Firstly, it may be said that for the purposes of executive control, the Schedule prescribes no distinction between transport and communications/ICT. Secondly, it may well be that the Schedule is not a prescription of the number and designation of ministerial portfolios in the government but merely a general statement about what the functions of government and that it imparts no obligation on the executive to bring transport and ICT under one Ministerial docket.

The Draft New Constitution should not be ambivalent about the proper place of ICT in the affairs of government. This is because ICT continues to be the transformative driving force in the emerging information society and the information economy. Kenya’s own Vision 2030, which is the national development blueprint for steering the country into economic prosperity for the next twenty years, seeks to leverage on ICT as a stimulus for economic development.