The hashtag #KeepItOn is a call to action urging the Kenyan government to not shut down the internet during protests against the #RejectTheFinanceBill2024. Internet shutdowns violate basic rights, hurt Kenya's economy, and damage its international standing.  

Kenyans denounce internet shutdown during #RejectFinanceBill2024 protests as a violation of free speech and access to information, despite prior assurances from the Communications Authority. This action violates provisions of the Constitution of Kenya and international human rights law, which guarantee fundamental rights and  freedoms, including freedom of expression, access to information, and peaceful assembly."

In response to the call for public participation on the Finance Bill, 2024, we submitted a detailed analysis with our concerns and proposals on tax-related provisions.

A Kenyan report by KICTANet Working Groups explores ways to improve the digital landscape. Stakeholders provided input for a plan to create a fairer and more inclusive digital space. This plan was presented in March 2024 to the ICT Task Force and aims to guide Kenya towards a thriving digital future.

This memorandum highlights key challenges and proposes solutions for Kenya's ICT budget in the coming fiscal year (2024/25). Presented in January 2024 during the Institute of Economic Affairs annual pre-budget hearing, it aims to influence budget decisions by the Treasury and Parliament for a stronger ICT sector.

A coalition of civil society groups and experts blasts the UN's draft Cybercrime Convention, saying it threatens human rights. They demand stronger protections and clear legal guidelines before it's adopted.

KICTANet is pushing for legal changes to fight online violence against women. They want to update two key laws: the Information and Communications Act (1998) and the Computer Misuse and Cybercrime Act (2018). Their goal is to better define and address online harassment, stalking, and other forms of abuse women face online.

KICTANet submitted a response to Kenya's proposed regulations on Critical Information Infrastructure (CII) protection. Their memorandum focuses on these regulations' impact on cybersecurity and digital rights. KICTANet recommends improvements like clearer definitions, stronger collaboration on cyber threats, and ensuring these regulations don't restrict online freedoms.

KICTANet submitted its feedback on Kenya's proposed amendments to the Information and Communications Act (2023). Their response includes a detailed analysis (likely in a table format) outlining their concerns and suggestions for specific provisions within the bill.

ARTICLE 19 and KICTANet partnered to challenge Kenya's film classification guidelines. They argue the current framework is unconstitutional and lacks proper research. They propose scrapping it and suggest: 1) including more voices in discussions (multi-stakeholder engagement), 2) basing decisions on Kenyan research, and 3) updating laws to align with the constitution.

The Huduma Bill (2021) proposes a major overhaul of Kenya's identification system. It would combine birth/death registration, ID cards, passports, and a national database (Huduma Namba) under one law. To ensure everything is done carefully and transparently, there needs to be an in-depth discussion about the bill's details and the design of the entire system.

This joint memorandum analyzes four draft regulations for Kenya's communication sector: the Kenya Information and Communications (Broadcasting ) Regulations, 2022; the Kenya Information and Communications (Registration of Telecommunications Service Subscribers) Regulations, 2022; the Kenya Information and Communications (Access and  Infrastructure Sharing) regulations; and, the Kenya Information and Communications (Interconnection) Regulations 2022. 

The Kenya ICT Action Network (KICTAnet) presents this memorandum in response to the call by the Ministry of ICT, Innovation and Youth Affairs through a Taskforce on the development of the Data Protection Regulations for public participation on the Data Protection (General) Regulations, 2021, the Data Protection (Registration of Data Controllers and Data Processors) Regulations, 2021, and the Data Protection (Compliance and Enforcement) Regulations, 2021.

1. What are the challenges and opportunities for expanding Internet connectivity, particularly to remote and under-served areas? 

• Community networks require infrastructure deployment and service provision licenses to operate in the telecommunications sector. In the majority of African countries, license categories exist only for national operators and are costly.
• Operators’ licensing, mobile broadband spectrum assignments are also done nationally in exchange for high fees. This exclusive and broad regulatory framework results in inefficient use of spectrum, where either assigned spectrum is not used in rural and remote areas, or regulators do not find enough companies interested in paying those fees and have an unassigned mobile broadband spectrum.  
• The majority of community networks in Africa exist in low-income areas making it challenging to get access to financing and the human capacity required to deploy, operate, and maintain these networks. The initial start-up financing for most of the CNs has been through private grant funding programs.

2. What are the roles of governments and non-government actors in overcoming these challenges?

• Tax incentives.
• Mandating infrastructure sharing (enabling communities to access government infrastructure or infrastructure of established operators).
• Expansion of license-exempt frequencies.
• Adoption of dynamic spectrum licensing and spectrum sharing.
• Streamlining licensing procedures to make them accessible to communities.
• Governments to mandate funding for universal network access, and allocate a portion of that funding for the growth of community networks. 

• Capacity-building at the community level to ensure communities have the knowledge to implement community networks. 
• A structured dialogue between all stakeholders to find ways community networks can be supported and be more widespread in underserved areas. For example, KICTANet has worked with Community Networks for several years, and in 2020, it produced the first Policy brief on Community Networks in the region to act as a dialog document to policymakers. Community networks have been shown to be very effective in achieving affordable access to the internet. 

3. How can small/community/non-profit operators help in promoting the increase of Internet connectivity?

• Social purpose networks such as community networks offer a holistic approach to digital inclusion enabling contextualizing meaningful connectivity with local realities.
• Communities have a wealth of knowledge that remains untapped, these communities are able to mobilize resources and information enabling them to deploy and operate connectivity infrastructure at lower costs. 
• Beyond access community networks create a platform that promotes building local capacities, creation, and distribution of locally relevant content.
• Community networks contribute to local economies, workforce development, and fostering social connections. 

On the 3rd March 2020, the Communications Authority of Kenya (CA) invited all stakeholders to submit their comments with respect to the Draft Dynamic Spectrum Access Framework for Authorisation of the Use of TV White Spaces. The following organizations are herewith submitting their comments with the common objective to help create a quality and affordable telecommunications service to all Kenyans, especially those in rural and underserved areas :

• Kenya ICT Action Network (KICTANet)
• Tunapanda
• Association for Progressive Communications, apc.org
• Internet Society. www.internetsociety.org
• Rhizomatica

General Comments

We welcome the fact that CA is moving forward with TVWS regulation and further that dynamic spectrum management may be considered for other bands in the future. Dynamic spectrum management has the potential to directly address the challenge of underutilised spectrum in rural areas.

We would like to urge CA to move forward with all reasonable haste in implementing TVWS regulation. The current pandemic has brought home to the world how important affordable access to communication when people’s movements are restricted. TVWS technology can enable network operators to offer innovative and affordable connectivity in underserved regions.

Executive Report

ARTICLE 19 Eastern Africa (or ARTICLE 19 EA ) and the Kenya ICT Action Network (or KICTANet ) present this memorandum in response to the call for public participation on the said Data Protection (Civil Registration) Regulations, 2020 currently being considered by the Principal Secretary, State Department of Information Communication and Technologies (or ICT ) and Innovation.

Recommendations

The following is a summary of our key recommendations:
1. The civil registration and identity management framework should be enacted through a stand-alone Act of Parliament. This should be subjected to (bicameral) legislative oversight and effective public participation. Notably, regulations should in practice provide general guidelines of practice, and cannot be used to regulate and create substantive systems which have implications on the effective and proper functioning of government, and which directly affect individuals’ identity.
a. Recommendation: Enact an ‘appropriate and comprehensive’ civil registration and identity management through an Act of Parliament introducing a Bill to amend the Registration of Persons Act (CAP 107).

2. The Data Protection Act (2019) cannot be used to give statutory effect to this civil registration system (or CRS ) as that is not the objective of the Act. CRSs provide the ‘foundation for national identity management systems’1 and are inherently linked to the generation, collection and utilisation of vital statistics which inform a nation’s development agenda, amongst other core functions. In Kenya, national identity management systems are provided for under the Registration of Persons Act (CAP 107) and the Citizenship and Immigration Act, 2011, the Refugees Act all of which legislate on CRS related issues, including national identity and the National Integrated Identity Management System (or NIIMS ) in Kenya.
a. Recommendation: Introduce a bill with these substantive amendments to the Registration of Persons Act which deals with civil registration, to address the inadequacies of the Act relating to civil registration. These regulations should not be anchored under the Data Protection Act, 2019.

3. The Regulations do not comply with the Data Protection Act (2019). In particular:
a. Section 18 of the Data Protection Act (2019), requires the prior registration and certification of all data controllers collecting and processing copious amounts of sensitive personal data by the Data Commissioner. The provisions dealing with automated decision-making provide limited duties for data controllers and limit the rights of data subjects, in violation of the Data Protection
Act (2019).
b. Regulations 10 and 13 impose fees which are not stated and therefore could be a challenge for low income data subjects.
c. The Regulations permit the retention of personal data by data controllers in perpetuity, despite the requirement for data to be retained in accordance with the ‘reasonably necessary' requirement, and in any event, should provide the period of retention.
d. The Regulations do not explicitly cater for, or have a mechanism to ensure that data breaches are notified to both the Data Commissioner, and data subjects, in line with section 43, Data Protection Act (2019) and international standards.
e. The Regulations fail to provide for a mechanism capable of ensuring that the transfer of personal data through a public network is transmitted using strong encryption methods given the known weaknesses of commonly used encryption systems.
f. The Regulations permit the transfer of personal data outside Kenya and directly contravenes sections 48 and 49 of the Data Protection Act (2019) as well as international standards.
g. The Regulations fail to flesh out the ‘adequacy’ requirement.
Recommendation: The government should fast-track the operationalisation of the Office of the Data Protection Commissioner (or ODPC ) to ensure that there is proper oversight over the collection and processing of sensitive personal data in accordance with the Data Protection Act (2019). The provisions of the proposed regulations should comply with the Data Protection Act, 2019.

4. The Regulations should provide explicit ( technical, personnel and procedural ) safeguards to ensure that personal information is accorded the highest safety and security, management and governance protection.

5. In conjunction with civil society and other stakeholders, the Ministry should develop ‘appropriate and comprehensive regulatory frameworks’ which adhere to the High Court’s orders in Consolidated Petitions No. 56, 58 and 59 (2019) and which pay proper homage to the letter and the spirit of the Data Protection Act (2019) and international standards which Kenya is bound by.

Executive Summary

ARTICLE 19 Eastern Africa (or ARTICLE 19 EA ) and the Kenya ICT Action Network (or KICTANet ) present this memorandum in response to the call for public participation on the said Registration of Persons (National Integrated Identity Management System) Regulations, 2020 currently being considered by the Cabinet Secretary, Ministry of Interior, and Coordination of National Government.

Key Recommendations

The following is a summary of our key recommendations:

1. The civil registration and identity management framework should be enacted through a stand-alone Act of Parliament. This should be subjected to (bicameral) legislative oversight and effective public participation. Notably, regulations, which generally provide guidelines of practice, cannot be used to regulate and create substantive systems which have implications on the effective and proper functioning of government, and which directly affect individuals’ identity.
a. Recommendation: Enact an ‘appropriate and comprehensive’ civil registration and identity management through an Act of Parliament introducing a Bill to amend the Registration of Persons Act (CAP 107).

2. The Regulations exceed the ambit of the Registration of Persons Act (CAP 107) and should not provide for the registration of infants and minors.

3. The Registration of Persons Act (CAP 107) should be amended to provide for a specific government entity responsible for the NIIMS, other than the Principal Secretary (whose docket is not named in either Act or the Regulations). All the functions relating to the registration of persons should be with the Principal Registrar and staff under section 4 (and Schedule) of the Registration of Persons Act (CAP 107).

4. The regulations should provide explicit ( technical, personnel and procedural ) safeguards to ensure that registration information is accorded the highest safety and security, management and governance protection. This will ensure that trust is maintained in the digital ecosystem, by providing sufficient protection against abuse by authorised persons (public organs and private entities), independent
contractors, amongst others.

5. The regulations should provide explicit ( technical, personnel and procedural ) safeguards for the collection, processing, use, and transfer of NIIMS data relating to the registration of persons in line with the requirements under the Data Protection Act, 2019.

6. In conjunction with civil society and other stakeholders, the Ministry should develop ‘appropriate and comprehensive regulatory frameworks’ which adhere to the High Court’s orders in Consolidated Petitions No. 56, 58 and 59 (2019) and which pay appropriate homage to the Data Protection Act (2019). This will ensure that the Regulations adhere to and respect fundamental rights of freedom of expression (or FOE ), the right to information (or RTI ), the right to privacy in the Constitution of Kenya, 2010 and international law.

KICTANet’s submission to the intersessional meeting, 2-4 December 2019, New York UN Headquarters: 405 East 42nd Street, New York, NY, 10017 EU Delegation: 666 3rd Ave, New York, NY 10017

Submissions done one 11th November 2019 at the National Assembly

Submission done one 11th November 2019 at the National Assembly Chambers

1. Have criteria for defining what critical ICT infrastructure is.
2. Distinguish between critical ICT infrastructure (Registry, content delivery networks) and traditional critical infrastructure.
3. Question if there is need to put transport and energy infrastructure on the Internet and if so, how is it protected? Anything put on the internet is vulnerable.
4. Acknowledge that business models of ICT companies are different from the traditional models of non-ICT critical infrastructures such as energy utilities and industrial control systems. They require more maintenance and upgrades that translate into much more investments.
5. How do we ensure we have scalable and resilient critical infrastructure? In the past we have seen government institutions invest in white elephants, sending them back to the procurement room before the system goes live.
6. Consider the need for expertise to deal with and protect the infrastructure (developers focusing on software security and information security professionals specializing in critical infrastructure).
7. Consider cybersecurity but avoid raising fear, uncertainty and doubt.
8. Avoid any type of strategy that hacks back. Hacking back will not fix broken infrastructure, and the attribution problem makes it very hard and sometimes impossible to find the real source of attacks. Focus on defense and resilience.
9. Need to have websites running latest versions of software including security updates otherwise we will continue to experience this: https://www.google.com/#q=%22hacked+by%22+site:go.ke. There should be a big focus on identifying XP use and migrating away from XP usage in government and critical infrastructures.

1. Who manages critical infrastructures?
2.  Should the government own/manage/handle infrastructures like the NOFBi?
3. Which infrastructure can the government outsource? Which infrastructure is a security threat to outsource? Who are trusted partners for outsourcing?
4. What is the value of investment in NOFBI while there is no last-mile connectivity? Should the NOFBI operator be able to go the long haul and provide last-mile services to all intended recipient(s) of the service?
5. What levels of approvals are there (change management) for any change to happen in a critical internet resource? (Just last month, a misguided change at KENIC affecting DNSSEC affected the entire .ke domains for a whole day. No domain was accessible).
6. How is the security and integrity of PKI maintained?
7. How are the counties managing ICT county-specific infrastructure and what capacities exist at that level?

1. How fast can we roll out, upgrade, and repaired our fiber optic infrastructure? (There has been a deliberate systematic plot to ensure there are no ducts on wayleaves to pull fiber optic cable within minimum time, and cost-effectively).
2. Can we vet the software that runs on and support critical infrastructure? We have had cases of defective and compromised firmware and compromised software that has payloads executed at certain times by malicious actors. Which software and hardware do we trust? Can we audit this software?
3. What is the role of standards? ( ISO 27000 series Standards on Information Security and the ISO 20,000 series on Service Management).

1. Is it necessary to have an Act on critical infrastructure considering the dynamism and complexity of ICT? Would a few amendments under the KICA 2013 not suffice?
2. Would it perhaps not be useful to have separate acts or regulations for critical internet infrastructure on the one hand, and critical infrastructures like (power and transport) connected to the internet on the other hand? The two types of critical infrastructure are related but require different and specialized approaches.
3. The development of a critical infrastructure policy framework should precede the bill to contextualize the Critical Infrastructure bill. The policy framework should also have an implementation framework, a result of which could be the development of law. Before the development of the policy it may be necessary to conduct a study and expert consultation on the matter that includes a review of global best practices.
4. The protection of critical infrastructure may be better managed under regulations rather than Bills/Acts. This is because in the fast-changing world of IT, what is critical today may not be tomorrow and vice versa. Who would have known five years ago that M-PESA would move beyond just sending money, to becoming a lifestyle for millions of Kenyans aka a critical infrastructure? You don’t manage such issues through hard-wired Acts, but through Regulation.

• Definition of what constitutes critical infrastructure.
• Distinguish between critical internet/ICT infrastructures and critical infrastructures connected to the internet.
• Criteria for identification of CI.
• Threat analysis to various CI in Kenya.
• A risk management framework for the CI.
• The requirement of mandatory minimum protection of critical infrastructure as well as demonstrated assurance through compliance. 
• Coordination framework (including PPP arrangements, lead coordinating org, and perhaps the need for a single body?).
• Investigate frameworks for threat intelligence and information sharing between all concerned stakeholders.
• Incident reporting mechanisms and investigations of possible requirements for breach disclosure to all affected stakeholders.
• Research and development strategies.
• Capacity assessment and development. 
• Funding mechanisms.
• Implementation plan.