October 2015 - KICTANet

CIO100 Symposium and Awards
by Harry Hare | African eDevelopment Resource Centre 27 Oct '15

27 Oct '15

Hello All, I would like to interest you to this year¹s CIO100 Symposium and Award scheduled for 5th and 6th November at the Enashipai Resort and Spa. Please see the current agenda here https://cio100.topi.com/. We are still looking for speakers with working knowledge on Internet of Things, Enterprise Architecture and IT Leadership. If you have any of these competencies, please drop me a note. Hope to see you all in Naivasha as we celebrate excellence in IT. Kindest Regards and apologies for cross-posting. Harry Hare Director | African eDevelopment Resource Centre PO Box 49475 00100 | Nairobi, Kenya Kenya +254 20 4041646 | Cel +254 725 650044 Nigeria + 234 814 636 4611

2 1

Planned amendments bode ill for Communications Authority
by Mwendwa Kivuva 26 Oct '15

26 Oct '15

Greetings, Walubengo seems to have captured the controversial issues surrounding the new KICA amendments where the executive is unsurprising powers from the "independent" Communications Authority. The emphasis of the community is that these amendments are unconstitutional and will not be allowed to pass. read on ... http://www.nation.co.ke/oped/blogs/dot9/walubengo/-/2274560/2921856/-/xolkx… There is a proposed bill, the Miscellaneous Amendment Bill 164 of 2015 <http://kenyalaw.org/kl/fileadmin/pdfdownloads/bills/2015/StatuteLaw__Miscel…> that proposes to move most of the communications regulatory powers to the Cabinet secretary. It is not clear why the Executive suddenly wants to become the regulator in a day and age when global practice seems to be to keep the two as separate as possible. In seeking to understand the rationale, one needs to look at the 'Memorandum of Objects and Reason’ section, which states as follows: *‘The Bill seeks to amend the Kenya Information And Communications Act, 1998 section 2 of 1998) so as firstly to align it with the Competitions Act, 2014 in respect of the criteria for being a dominant market* *undertaking and secondly to harmonize the regulation making power so that it is exercised by the Cabinet Secretary in consultation with the Authority’.* Two aims seem to drive the new amendments. One is to put the contentious issue of dominance under the Competition Authority rather than the Communications Authority. The second is to enhance the Cabinet Secretary’s role in communication regulatory matters. For those with a little bit of communications history, it is easy to see the deliberate shift towards the old days when communications regulation was strictly under the Minister of Transport and Communications. In those days, prior to the Kenya Communications Act 1998, the then Kenya Posts and Telecommunications Corporation (KPTC), a fully-owned government parastatal, was the father, mother and grandparent of all regulatory matters in Kenya. The performance of regulation then is well documented and it was clearly a case study in ‘how not to regulate’. So it still beats all logic, despite the intended rationale for the amendments, why a modern, self-declared digital government would want to drag the whole country back to the so-called dark days. *'DEPARTMENT OF THE ICT MINISTRY'* Indeed, the Kenyan Constitution (2010) anticipates and clearly states that we should have a more independent regulator than what we have always had. As stated in Article 34: Section (5)-: *‘ Parliament shall enact legislation that provides for the establishment of a body, which shall—* *(a) be independent of control by government, political interests or commercial interests;* *(b) reflect the interests of all sections of the society; and* *(c) set media standards and regulate and monitor compliance with those standards.’* Several court battles have recently been filed against the current regulator simply because their decisions, however well-intentioned were deemed not to have been undertaken by an independent regulator as envisioned in the new constitution. Why, then, would the government deliberately plan to set itself up for more of these court battles by proposing amendments that clearly make the regulator a department of the ICT Ministry and therefore not independent from the Executive? *JUST WIND UP THE CA* Most of the proposed amendments are about replacing the role of the regulator with that of the Cabinet secretary by inserting the words ‘The Cabinet secretary in consultation with the Communication Authority shall make regulations for…’ As an example, see Section 5(b)(5) on ‘Freedom of the media’. The new proposals say that ‘The Cabinet secretary in consultation with the Communication Authority shall make regulations for the better carrying out of the provisions in this section’. In Section 27(d) on ‘SIM cards’, the new proposals say that ‘The Cabinet secretary in consultation with the Communication Authority may make regulations with respect to SIM Card registration, storage, retention, transfers….’ There are many other amendments of similar a nature, and the clear message is that the regulator cannot make operational decisions unless in consultation with the minister. Indeed, one could argue that it is effectively the other way round - the Minister making the decision in consultation with the regulator. If the famous voting machine in Parliament, otherwise known as the "tyranny of numbers", is anything to go by, these amendments are likely to pass. However, the government should do Kenyans a favour thereafter and wind up the Communications Authority of Kenya, since its role will essentially have been absorbed by the Ministry. *Mr Walubengo is a lecturer at the Multimedia University of Kenya's Faculty of Computing and IT. Twitter: @jwalu Email: jwalubengo(a)mmu.ac.ke <jwalubengo(a)mmu.ac.ke>* ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson

8 11

IGF 2015 Brazil Request for Civil society Speakers
by Ephraim Percy Kenyanito 24 Oct '15

24 Oct '15

Dear all, The IGF Secretariat has requested names of two potential speakers from the civil society stakeholder group to participate in the opening and closing ceremonies of the 2015 IGF. Kindly send your suggestions on the lists by Wednesday Oct 28th so that the Internet Governance Civil Society Co-ordination Group (CSCG) and the MAG can organise for onward transmission to the IGF Secretariat. Regards, -- Best Regards, Ephraim Percy Kenyanito Website: http://about.me/ekenyanito Twitter: @ekenyanito PGP: E6BA8DC1

1 0

Nominations for 2015 ICT Value Awards
by Salesio Kiura 23 Oct '15

23 Oct '15

Dear all, Online Nominations for the 3rd Annual ICT Value Awards, hosted by the ICT Association of Kenya (ICTAK) is ongoing. ( http://www.ictak.or.ke/events/ictvaawards2015) Attached is concept detailing: - *Eligibility for the Awards* - *Nomination and selection process* *- **Objectives and Award Categories* *and other information.* For further information (including how to partner with the Association) Please contact the Association secretariat using: Tel.: 0721 754 218 /OR/ 0739 595 224 email: ictva(a)ictak.or.ke OR info(a)ictak.or.ke ======= 2013 event: http://www.ictak.or.ke/events/past-event-2013-ict-value-awards 2014 even: http://www.ictak.or.ke/events/2014ictvalueawards Best regards, Dr. Salesio M. Kiura Chairman, ICTVA 2015 Committee Email: chairman(a)ictak.or.ke ===== Give thanks for everything since: *All works for good to those that love the LORD!*

1 0

Re: [kictanet] Planned amendments bode ill for Communications Authority
by Barrack Otieno 21 Oct '15

21 Oct '15

Oops, i had forgotten that we can Sosion the amendments. Thank you for that enlightenment Kivuva. Lets watch the next steps. Regards On 10/21/15, Mwendwa Kivuva <lordmwesh(a)gmail.com> wrote: > Barrack, these amendments will not be allowed to pass, even with tyranny > of numbers because any bills passed should be inline with the constitution. > Any laws enacted that contradict the constitution are null and void. We > have several precedence in case law where laws that were passed by > parliament were reversed by court. > > Regards > On Oct 21, 2015 9:57 AM, "Barrack Otieno via kictanet" < > kictanet(a)lists.kictanet.or.ke> wrote: > >> Ali, Colleagues, >> >> This is purely a leadership issue Ali, fortunately there is a time and >> season for everything. The current stewards of the sector will be >> remembered for their deeds or misdeeds. The same laws will be amended >> some day by another parliament that is full of wisdom not numbers. >> >> Regards >> >> On 10/21/15, Ali Hussein via kictanet <kictanet(a)lists.kictanet.or.ke> >> wrote: >> > Mwendwa >> > >> > Thanks for bringing this up. >> > >> > On a light note..Does my brother Walu still have a job at the Uni? :-) >> > >> > Seriously though, this sort of thing just takes us back 10+ years to >> > the >> > days of KANU. >> > >> > Ministry - Policy & Leadership >> > Regulator - Regulate >> > >> > How difficult is that? >> > >> > I recall that after the new constitution was promulgated the hopes of >> > the >> > industry was that we will have a more robust and independent Regulator >> > fashioned around the US Regulator - The Federal Communications >> Commission. >> > >> > It is my humble view that we owe it to the world to set the highest >> > standards for Regulation & Policy Formulation in the world as we are >> > now >> a >> > recognised leader in innovation in the mobile space. Instead of the >> > Executive looking to surround itself with more regulatorY powers they >> would >> > do better to recognise their role of formulating & guiding policy & >> > leadership to move this country forward in the ICT Sector. >> > >> > Thanks & Regards >> > >> > Ali Hussein >> > ali(a)hussein.me.ke >> > >> > +254 713 601113 >> > Twitter: @AliHKassim >> > Skype: Abu-Jomo >> > LinkedIn: http//ke.linkedin.com/in/alihkassim >> > Blog: www.alyhussein.com >> > >> >> On Oct 21, 2015, at 10:01 AM, Mwendwa Kivuva via kictanet >> >> <kictanet(a)lists.kictanet.or.ke> wrote: >> >> >> >> Greetings, >> >> >> >> Walubengo seems to have captured the controversial issues surrounding >> the >> >> new KICA amendments where the executive is unsurprising powers from >> >> the >> >> "independent" Communications Authority. The emphasis of the community >> >> is >> >> that these amendments are unconstitutional and will not be allowed to >> >> pass. >> >> >> >> read on ... >> >> >> http://www.nation.co.ke/oped/blogs/dot9/walubengo/-/2274560/2921856/-/xolkx… >> >> < >> http://www.nation.co.ke/oped/blogs/dot9/walubengo/-/2274560/2921856/-/xolkx… >> > >> >> >> >> There is a proposed bill, the Miscellaneous Amendment Bill 164 of 2015 >> >> < >> http://kenyalaw.org/kl/fileadmin/pdfdownloads/bills/2015/StatuteLaw__Miscel… >> > >> >> that proposes to move most of the communications regulatory powers to >> the >> >> Cabinet secretary. >> >> >> >> It is not clear why the Executive suddenly wants to become the >> >> regulator >> >> in a day and age when global practice seems to be to keep the two as >> >> separate as possible. >> >> >> >> In seeking to understand the rationale, one needs to look at the >> >> 'Memorandum of Objects and Reason’ section, which states as follows: >> >> >> >> ‘The Bill seeks to amend the Kenya Information And Communications Act, >> >> 1998 section 2 of 1998) so as firstly to align it with the >> >> Competitions >> >> Act, 2014 in respect of the criteria for being a dominant market >> >> >> >> undertaking and secondly to harmonize the regulation making power so >> that >> >> it is exercised by the Cabinet Secretary in consultation with the >> >> Authority’. >> >> >> >> Two aims seem to drive the new amendments. One is to put the >> >> contentious >> >> issue of dominance under the Competition Authority rather than the >> >> Communications Authority. The second is to enhance the Cabinet >> Secretary’s >> >> role in communication regulatory matters. >> >> >> >> For those with a little bit of communications history, it is easy to >> >> see >> >> the deliberate shift towards the old days when communications >> >> regulation >> >> was strictly under the Minister of Transport and Communications. >> >> >> >> In those days, prior to the Kenya Communications Act 1998, the then >> Kenya >> >> Posts and Telecommunications Corporation (KPTC), a fully-owned >> government >> >> parastatal, was the father, mother and grandparent of all regulatory >> >> matters in Kenya. >> >> >> >> The performance of regulation then is well documented and it was >> clearly a >> >> case study in ‘how not to regulate’. >> >> >> >> So it still beats all logic, despite the intended rationale for the >> >> amendments, why a modern, self-declared digital government would want >> >> to >> >> drag the whole country back to the so-called dark days. >> >> >> >> 'DEPARTMENT OF THE ICT MINISTRY' >> >> >> >> Indeed, the Kenyan Constitution (2010) anticipates and clearly states >> that >> >> we should have a more independent regulator than what we have always >> had. >> >> >> >> As stated in Article 34: Section (5)-: >> >> >> >> ‘ Parliament shall enact legislation that provides for the >> >> establishment >> >> of a body, which shall— >> >> >> >> (a) be independent of control by government, political interests or >> >> commercial interests; >> >> >> >> (b) reflect the interests of all sections of the society; and >> >> >> >> (c) set media standards and regulate and monitor compliance with those >> >> standards.’ >> >> >> >> Several court battles have recently been filed against the current >> >> regulator simply because their decisions, however well-intentioned >> >> were >> >> deemed not to have been undertaken by an independent regulator as >> >> envisioned in the new constitution. >> >> >> >> Why, then, would the government deliberately plan to set itself up for >> >> more of these court battles by proposing amendments that clearly make >> the >> >> regulator a department of the ICT Ministry and therefore not >> >> independent >> >> from the Executive? >> >> >> >> JUST WIND UP THE CA >> >> >> >> Most of the proposed amendments are about replacing the role of the >> >> regulator with that of the Cabinet secretary by inserting the words >> >> ‘The >> >> Cabinet secretary in consultation with the Communication Authority >> >> shall >> >> make regulations for…’ >> >> >> >> As an example, see Section 5(b)(5) on ‘Freedom of the media’. The >> >> new >> >> proposals say that ‘The Cabinet secretary in consultation with the >> >> Communication Authority shall make regulations for the better carrying >> out >> >> of the provisions in this section’. >> >> >> >> In Section 27(d) on ‘SIM cards’, the new proposals say that ‘The >> >> Cabinet >> >> secretary in consultation with the Communication Authority may make >> >> regulations with respect to SIM Card registration, storage, retention, >> >> transfers….’ >> >> >> >> There are many other amendments of similar a nature, and the clear >> message >> >> is that the regulator cannot make operational decisions unless in >> >> consultation with the minister. >> >> >> >> Indeed, one could argue that it is effectively the other way round - >> >> the >> >> Minister making the decision in consultation with the regulator. >> >> >> >> If the famous voting machine in Parliament, otherwise known as the >> >> "tyranny of numbers", is anything to go by, these amendments are >> >> likely >> to >> >> pass. >> >> >> >> However, the government should do Kenyans a favour thereafter and wind >> up >> >> the Communications Authority of Kenya, since its role will essentially >> >> have been absorbed by the Ministry. >> >> >> >> Mr Walubengo is a lecturer at the Multimedia University of Kenya's >> Faculty >> >> of Computing and IT. Twitter: @jwalu Email: jwalubengo(a)mmu.ac.ke >> >> <mailto:jwalubengo@mmu.ac.ke> >> >> ______________________ >> >> Mwendwa Kivuva, Nairobi, Kenya >> >> >> >> "There are some men who lift the age they inhabit, till all men walk >> >> on >> >> higher ground in that lifetime." - Maxwell Anderson >> >> >> >> _______________________________________________ >> >> kictanet mailing list >> >> kictanet(a)lists.kictanet.or.ke >> >> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >> >> >> >> Unsubscribe or change your options at >> >> >> https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com >> >> >> >> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder >> >> platform >> >> for people and institutions interested and involved in ICT policy and >> >> regulation. The network aims to act as a catalyst for reform in the >> >> ICT >> >> sector in support of the national aim of ICT enabled growth and >> >> development. >> >> >> >> KICTANetiquette : Adhere to the same standards of acceptable behaviors >> >> online that you follow in real life: respect people's times and >> bandwidth, >> >> share knowledge, don't flame or abuse or personalize, respect privacy, >> do >> >> not spam, do not market your wares or qualifications. >> > >> > >> >> >> -- >> Barrack O. Otieno >> +254721325277 >> +254-20-2498789 >> Skype: barrack.otieno >> http://www.otienobarrack.me.ke/ >> >> _______________________________________________ >> kictanet mailing list >> kictanet(a)lists.kictanet.or.ke >> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >> >> Unsubscribe or change your options at >> https://lists.kictanet.or.ke/mailman/options/kictanet/kivuva%40transworldaf… >> >> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >> for people and institutions interested and involved in ICT policy and >> regulation. The network aims to act as a catalyst for reform in the ICT >> sector in support of the national aim of ICT enabled growth and >> development. >> >> KICTANetiquette : Adhere to the same standards of acceptable behaviors >> online that you follow in real life: respect people's times and >> bandwidth, >> share knowledge, don't flame or abuse or personalize, respect privacy, do >> not spam, do not market your wares or qualifications. > -- Barrack O. Otieno +254721325277 +254-20-2498789 Skype: barrack.otieno http://www.otienobarrack.me.ke/

1 0

Re: [kictanet] Africa Domain Name System Forum 4th to 6th March 2016, Marrakech, Morroco
by Barrack Otieno 21 Oct '15

21 Oct '15

Listers, The 4th Africa Domain Name System Forum will be held in Marrakech Morroco from 4th to 6th March 2016 prior to the ICANN 55 meeting. The Africa Domain name system is an annual open event for stakeholders in the Domain Name Industry in Africa organized by Africa Top Level Domains Organization, the Internet Corporation for Assigned Names and Numbers and the Internet Society. The forum enables registries , registrars and other stakeholder in Africa to share experiences, interact and learn from each other about the domain name system. As a multi stakeholder forum ,the meeting seeks to foster cross border collaboration between registries , registrars and registrants as well as other stakeholders the objectives being inter alia to inspire and encourage local stakeholders (government, registrars, registries, and registrants in the domain name industry to interact at local and International level as well as equipping African Registries and Registrars with the requisite domain name industry business strategies. We will be providing further details regarding registration, sponsorship and exhibition opportunities. Thank you Best Regards -- Barrack O. Otieno +254721325277 www.aftld.org Skype: barrack.otieno

1 0

Fwd: [AfrICANN-discuss] Africa Strategy session , Tuesday 20th, 11-12.15, Room L4 Foyer
by Barrack Otieno 20 Oct '15

20 Oct '15

Listers, You may want to join remotely. Time zone UTC+1 Regards ---------- Forwarded message ---------- From: Dandjinou Pierre <pdandjinou(a)gmail.com> Date: Tue, 20 Oct 2015 00:48:10 +0100 Subject: [AfrICANN-discuss] Africa Strategy session , Tuesday 20th, 11-12.15, Room L4 Foyer To: "africann(a)afrinic.net" <africann(a)afrinic.net> Dear Participants to ICANN 54 and listers, Chers Participants a ICANN 54 et listiers, As you already know, there will be an update on the implementation of ICANN's Africa Strategy at a session scheduled for Tuesday 20th, from 11-12.15 in Room L4 Foyer. Here is the proposed agenda : Comme vous le savez, il est prevu une mise a jour sur la mise en oeuvre de la strategie africaine de l'ICANN pour l'Afrique le Mardi 20 Octobre de 11 a 12.15 dans la salle L4 Foyer; Voici l'ordre du jour propose : - Welcome and presentation of the Africa Strategy (20mn) - Q/A (25mn) - Preparations for Marrakech (10mn) - Q/A (10mn) - AoB (a-Funding mechanisms for the Africa strategy; b-ICANN's presence in Africa..) (10mn) Remote participation will be possible at https://meetings.icann.org/en/dublin54/schedule/tue-africa-strategy Pierre Dandjinou Cotonou - 229 90 087784 / 66566610 Dakar 221 77 639 30 41 www.scg.bj skype : sagbo1953 -- Barrack O. Otieno +254721325277 +254-20-2498789 Skype: barrack.otieno http://www.otienobarrack.me.ke/

1 0

Re: [kictanet] kictanet Digest, Vol 101, Issue 34
by Mose Karanja 16 Oct '15

16 Oct '15

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 We saw what the Kenyan government testing site was when they were thinking of getting Hacking Team surveillance software: kahawatungu, a website focused on reporting corruption. That is why the Kenyan judiciary should have oversight over the operations of security agencies especially when interception of communication is involved. There have been sustained efforts for the last 5 years by the NIS especially to bypass judicial warrants in their operations. Privacy online is not about something to hide. It is about something to lose. Freedom to be who you are. Freedom online is a continuation of freedom offline. Encrypt encrypt encrypt. -----BEGIN PGP SIGNATURE----- wsFcBAEBCAAQBQJWIVtpCRD9FdIdFSlVLwAAUFwP/3FE2vsxH8v73OBB2fFr 1BGVXqkLAhJ0sPoHIaN0pFrLRjq9AjyShZGrq4UpJW+mgscN7babTA+WbB4O scTy+b1luOQFShQUIxhj45U1QUKylbnd9Aq21HilXQr7LaUKSRYmNl1IhKtH xcZDrJ/T/ukh2NE2QDMDNjutT3GSXfxIoVWK/zJZfljMUMUb7uSYXM2K/Up7 L8s8/VPAVVPKU/dh8OW3SdULtrwHAvR296Lm1pnNb/7ndYcTymtfZE9KHn+6 JP834IuYE/UJvzvklrYTlXvemetijEiPTp9d8jgwIzLyY6rxaZDVb/DsFOsN ss9kpnmFWUwS15sIfBU0K1ID77RvzY5E6tghTo2A71oZvBTZPQiQXv0ABwLB 3URn+IvPb6yhNPZnNyuoZ72jYh1CKMJTz2VrcuqmEpQc5DhfZv+NvNQWxHEO OSarF4NDnLt/zm3trlkR8Q9ZviRNWcLLw9SktiadQWXBxvjVYxgFdLDgRTUW aKdstOXazQh2C+8WhQosWXB7coyTvtyJMMV23zCluYQD965SzmtrtYerrl3A PQi5bgChDO6Ayy35C3v8xm/x6b2gZNVFpL6mfw1/0YpMswBagxoXf7asLAr1 AszKFGLmCZy/9JvFTRXvWRV8i/Pl+BUMb0e8fNQnVg1iyzcL62Xquozzqbre hR2f =wJgQ -----END PGP SIGNATURE----- On 16 October 2015 at 22:41, <kictanet-request(a)lists.kictanet.or.ke> wrote: > Send kictanet mailing list submissions to > kictanet(a)lists.kictanet.or.ke > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > or, via email, send a message with subject or body 'help' to > kictanet-request(a)lists.kictanet.or.ke > > You can reach the person managing the list at > kictanet-owner(a)lists.kictanet.or.ke > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of kictanet digest..." > > Today's Topics: > > 1. FinFisher, how the government contacted a Germany company to > spy on its citizens (Mwendwa Kivuva) > 2. Re: FinFisher, how the government contacted a Germany company > to spy on its citizens (John Kieti) > > > ---------- Forwarded message ---------- > From: Mwendwa Kivuva <Kivuva(a)transworldafrica.com> > To: "Security Forum All information security discussions in Africa are > done here (Hacking, Decryptions, Security management, physical security, > Disastor Recovery, Security Assessments etc etc)" <security(a)lists.my.co.ke>, > KICTAnet ICT Policy Discussions <kictanet(a)lists.kictanet.or.ke> > Cc: > Date: Fri, 16 Oct 2015 20:59:18 +0300 > Subject: [kictanet] FinFisher, how the government contacted a Germany > company to spy on its citizens > > Whose communication is safe? It seems nobody if the research below by > CitizenLab is to go by. If you are a person of interest, the government > reads everything you read and write. > > Where is the threat if government uses hacking to safeguard it's citizens? > Here is a short answer; "research and revelations about Hacking Team’s > Remote Control System (RCS), a competitor product, have also made it clear > that some government customers used these tools to target their political > opponents, rather than security threats to their citizens." > > This is how the government is spying on you. > > https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/ > > This post describes the results of Internet scanning we recently conducted > to identify the users of FinFisher, a sophisticated and user-friendly > spyware suite sold exclusively to governments. We devise a method for > querying FinFisher’s “anonymizing proxies” to unmask the true location of > the spyware’s master servers. Since the master servers are installed on > the premises of FinFisher customers, tracing the servers allows us to > identify which governments are likely using FinFisher. In some cases, we > can trace the servers to specific entities inside a government by > correlating our scan results with publicly available sources. Our results > indicate 32 countries where at least one government entity is likely using > the spyware suite, and we are further able to identify 10 entities by > name. Despite the 2014 FinFisher breach, and subsequent disclosure of > sensitive customer data, our scanning has detected more servers in more > countries than ever before. > > *Executive Summary* > > FinFisher is a sophisticated computer spyware suite, written by > Munich-based FinFisher GmbH, and sold exclusively to governments for > intelligence and law enforcement purposes. Although marketed as a tool for > fighting crime,1 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> the > spyware has been involved in a number of high-profile surveillance abuses. > Between 2010 and 2012, Bahrain’s government used FinFisher to monitor some > of the country’s top law firms, journalists, activists, and opposition > political leaders.2 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Ethiopian > dissidents in exile in the United Kingdom3 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> and > the United States4 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> have > also been infected with FinFisher spyware. > > In 2012 and 2013, Citizen Lab researchers and collaborators,5 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>published > several reports analyzing FinFisher spyware, and conducted scanning that > identified FinFisher command and control (C&C) servers in a number of > countries. In our previous research, we were not yet able to differentiate > between FinFisher *anonymizing proxies *and *master* servers, a > distinction that we make in this work. > > When a government entity purchases FinFisher spyware, they receive a *FinSpy > Master*—a C&C server that is installed on the entity’s premises.6 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The > entity may then set up *anonymizing proxies* (also referred to as “ > *proxies*” or “*FinSpy Relays*” in the FinFisher documentation), to > obscure the location of their master. Infected computers communicate with > the anonymizing proxy, which is “usually”7 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> set > up on a Virtual Private Server (VPS) provider in a third country. The > proxy then forwards communications between a victim’s computer and the > Master server. > > We first describe how we scanned the Internet for FinFisher servers and > distinguished masters from proxies (*Part 1: Fishing for FinFisher*). We > then outline our findings regarding 32 governments and 10 specific > government entities that we believe are using FinFisher (*Part 2: Country > Findings*). Finally, we highlight several cases that illuminate > connections between different threat actors (*Part 3: A Deeper Analysis > of Several Cases*), before concluding (*Conclusion*). > > *Kenya* > > *National Intelligence Service* > > We found a FinFisher server in a range of IP addresses registered to a > Kenyan user named “National Security Intelligence.” Kenya’s National > Intelligence Service (NIS) was formerly known as the National Security > Intelligence Service (NSIS). > > Kenya’s NSIS replaced the former Directorate of Security Intelligence > (DSI), commonly known as the “Special Branch”.52 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>The > NIS is known as one of Kenya’s security institutions with the biggest > budgetary allocation—along with the Kenya National Defence Forces and the > National Police Service—and considered to be among the country’s critical > security organs in the new constitution.53 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> In > 2014, Human Rights Watch named the NIS, as well as the Anti-Terrorism > Police Unit and other Kenyan intelligence agencies, as being implicated in > abuses including torture, disappearances, and extrajudicial killings.54 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> > > The powers of the NIS were expanded significantly in December 2014 when > the Parliament of Kenya rushed to pass the controversial Security Laws > (Amendment) Bill.55 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The > amendments came following a series of deadly terrorist attacks by the > militant group al-Shabab, including the 2013 killing of 67 people at the > Westgate shopping mall in Nairobi.56 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>This > bill expanded the powers of the NIS to monitor communications without a > warrant, as well as expanding their powers to search and seize private > property.57 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Article > 62 of the amended bill authorized NIS agents to “do anything necessary to > preserve national security” and to detain individuals on simply the > suspicion of engaging in acts which pose a threat to national security.58 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Section > 66 of the bill amended the National Intelligence Services Act, permitting > the Director General of the NIS to monitor communications or “obtain any > information, material, record, document or thing” in order to protect > national security, without court oversight, leading rights organization > Article 19 to argue that the amendment “effectively [gives]*carte blanche* to > the Director-General to order mass surveillance of online communications”. > 59 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> While > a court ruling in February 2015 struck down some provisions of the > amendment, the provisions enhancing the powers of the NIS remained.60 > <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> > > More here: > https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/ > > > ---------- Forwarded message ---------- > From: John Kieti <jkieti(a)gmail.com> > To: KICTAnet ICT Policy Discussions <kictanet(a)lists.kictanet.or.ke> > Cc: > Date: Fri, 16 Oct 2015 22:25:32 +0300 > Subject: Re: [kictanet] FinFisher, how the government contacted a Germany > company to spy on its citizens > Use of sophisticated spy-ware software by NIS will invite commensurate > effort among researchers, developers and others of the profession to offer > anti-spyware solutions that work - all in the name of human rights and > fundamental privacy protection. > > On Fri, Oct 16, 2015 at 8:59 PM, Mwendwa Kivuva via kictanet < > kictanet(a)lists.kictanet.or.ke> wrote: > >> Whose communication is safe? It seems nobody if the research below by >> CitizenLab is to go by. If you are a person of interest, the government >> reads everything you read and write. >> >> Where is the threat if government uses hacking to safeguard it's >> citizens? Here is a short answer; "research and revelations about Hacking >> Team’s Remote Control System (RCS), a competitor product, have also made it >> clear that some government customers used these tools to target their >> political opponents, rather than security threats to their citizens." >> >> This is how the government is spying on you. >> >> >> https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/ >> >> This post describes the results of Internet scanning we recently >> conducted to identify the users of FinFisher, a sophisticated and >> user-friendly spyware suite sold exclusively to governments. We devise a >> method for querying FinFisher’s “anonymizing proxies” to unmask the true >> location of the spyware’s master servers. Since the master servers are >> installed on the premises of FinFisher customers, tracing the servers >> allows us to identify which governments are likely using FinFisher. In >> some cases, we can trace the servers to specific entities inside a >> government by correlating our scan results with publicly available >> sources. Our results indicate 32 countries where at least one government >> entity is likely using the spyware suite, and we are further able to >> identify 10 entities by name. Despite the 2014 FinFisher breach, and >> subsequent disclosure of sensitive customer data, our scanning has detected >> more servers in more countries than ever before. >> >> *Executive Summary* >> >> FinFisher is a sophisticated computer spyware suite, written by >> Munich-based FinFisher GmbH, and sold exclusively to governments for >> intelligence and law enforcement purposes. Although marketed as a tool for >> fighting crime,1 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> the >> spyware has been involved in a number of high-profile surveillance abuses. >> Between 2010 and 2012, Bahrain’s government used FinFisher to monitor some >> of the country’s top law firms, journalists, activists, and opposition >> political leaders.2 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Ethiopian >> dissidents in exile in the United Kingdom3 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> and >> the United States4 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> have >> also been infected with FinFisher spyware. >> >> In 2012 and 2013, Citizen Lab researchers and collaborators,5 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>published >> several reports analyzing FinFisher spyware, and conducted scanning that >> identified FinFisher command and control (C&C) servers in a number of >> countries. In our previous research, we were not yet able to differentiate >> between FinFisher *anonymizing proxies *and *master* servers, a >> distinction that we make in this work. >> >> When a government entity purchases FinFisher spyware, they receive a *FinSpy >> Master*—a C&C server that is installed on the entity’s premises.6 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The >> entity may then set up *anonymizing proxies* (also referred to as “ >> *proxies*” or “*FinSpy Relays*” in the FinFisher documentation), to >> obscure the location of their master. Infected computers communicate with >> the anonymizing proxy, which is “usually”7 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> set >> up on a Virtual Private Server (VPS) provider in a third country. The >> proxy then forwards communications between a victim’s computer and the >> Master server. >> >> We first describe how we scanned the Internet for FinFisher servers and >> distinguished masters from proxies (*Part 1: Fishing for FinFisher*). >> We then outline our findings regarding 32 governments and 10 specific >> government entities that we believe are using FinFisher (*Part 2: >> Country Findings*). Finally, we highlight several cases that illuminate >> connections between different threat actors (*Part 3: A Deeper Analysis >> of Several Cases*), before concluding (*Conclusion*). >> >> *Kenya* >> >> *National Intelligence Service* >> >> We found a FinFisher server in a range of IP addresses registered to a >> Kenyan user named “National Security Intelligence.” Kenya’s National >> Intelligence Service (NIS) was formerly known as the National Security >> Intelligence Service (NSIS). >> >> Kenya’s NSIS replaced the former Directorate of Security Intelligence >> (DSI), commonly known as the “Special Branch”.52 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>The >> NIS is known as one of Kenya’s security institutions with the biggest >> budgetary allocation—along with the Kenya National Defence Forces and the >> National Police Service—and considered to be among the country’s critical >> security organs in the new constitution.53 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> In >> 2014, Human Rights Watch named the NIS, as well as the Anti-Terrorism >> Police Unit and other Kenyan intelligence agencies, as being implicated in >> abuses including torture, disappearances, and extrajudicial killings.54 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> >> >> The powers of the NIS were expanded significantly in December 2014 when >> the Parliament of Kenya rushed to pass the controversial Security Laws >> (Amendment) Bill.55 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The >> amendments came following a series of deadly terrorist attacks by the >> militant group al-Shabab, including the 2013 killing of 67 people at the >> Westgate shopping mall in Nairobi.56 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>This >> bill expanded the powers of the NIS to monitor communications without a >> warrant, as well as expanding their powers to search and seize private >> property.57 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Article >> 62 of the amended bill authorized NIS agents to “do anything necessary to >> preserve national security” and to detain individuals on simply the >> suspicion of engaging in acts which pose a threat to national security.58 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Section >> 66 of the bill amended the National Intelligence Services Act, permitting >> the Director General of the NIS to monitor communications or “obtain any >> information, material, record, document or thing” in order to protect >> national security, without court oversight, leading rights organization >> Article 19 to argue that the amendment “effectively [gives]*carte >> blanche* to the Director-General to order mass surveillance of online >> communications”.59 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> While >> a court ruling in February 2015 struck down some provisions of the >> amendment, the provisions enhancing the powers of the NIS remained.60 >> <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> >> >> More here: >> https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/ >> >> _______________________________________________ >> kictanet mailing list >> kictanet(a)lists.kictanet.or.ke >> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >> >> Unsubscribe or change your options at >> https://lists.kictanet.or.ke/mailman/options/kictanet/jkieti%40gmail.com >> >> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >> for people and institutions interested and involved in ICT policy and >> regulation. The network aims to act as a catalyst for reform in the ICT >> sector in support of the national aim of ICT enabled growth and development. >> >> KICTANetiquette : Adhere to the same standards of acceptable behaviors >> online that you follow in real life: respect people's times and bandwidth, >> share knowledge, don't flame or abuse or personalize, respect privacy, do >> not spam, do not market your wares or qualifications. >> > > > > -- > > John Kieti > Phone: +254-735-764242 // +254-722-764242 > Twitter: @johnKieti // Skype: jkieti > Blog: gmeltdown.com <http://www.gmeltdown.com> // LinkedIn: > https://ke.linkedin.com/in/*kieti* <https://ke.linkedin.com/in/kieti> > > The ordinary just won't do > > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > > -- Mose Karanja +254 724 162536 | @Mose_Karanja <https://twitter.com/Mose_Karanja> PGP: 0x1529552F <https://twitter.com/Mose_Karanja>

1 0

FinFisher, how the government contacted a Germany company to spy on its citizens
by Mwendwa Kivuva 16 Oct '15

16 Oct '15

Whose communication is safe? It seems nobody if the research below by CitizenLab is to go by. If you are a person of interest, the government reads everything you read and write. Where is the threat if government uses hacking to safeguard it's citizens? Here is a short answer; "research and revelations about Hacking Team’s Remote Control System (RCS), a competitor product, have also made it clear that some government customers used these tools to target their political opponents, rather than security threats to their citizens." This is how the government is spying on you. https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/ This post describes the results of Internet scanning we recently conducted to identify the users of FinFisher, a sophisticated and user-friendly spyware suite sold exclusively to governments. We devise a method for querying FinFisher’s “anonymizing proxies” to unmask the true location of the spyware’s master servers. Since the master servers are installed on the premises of FinFisher customers, tracing the servers allows us to identify which governments are likely using FinFisher. In some cases, we can trace the servers to specific entities inside a government by correlating our scan results with publicly available sources. Our results indicate 32 countries where at least one government entity is likely using the spyware suite, and we are further able to identify 10 entities by name. Despite the 2014 FinFisher breach, and subsequent disclosure of sensitive customer data, our scanning has detected more servers in more countries than ever before. *Executive Summary* FinFisher is a sophisticated computer spyware suite, written by Munich-based FinFisher GmbH, and sold exclusively to governments for intelligence and law enforcement purposes. Although marketed as a tool for fighting crime,1 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> the spyware has been involved in a number of high-profile surveillance abuses. Between 2010 and 2012, Bahrain’s government used FinFisher to monitor some of the country’s top law firms, journalists, activists, and opposition political leaders.2 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Ethiopian dissidents in exile in the United Kingdom3 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> and the United States4 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> have also been infected with FinFisher spyware. In 2012 and 2013, Citizen Lab researchers and collaborators,5 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>published several reports analyzing FinFisher spyware, and conducted scanning that identified FinFisher command and control (C&C) servers in a number of countries. In our previous research, we were not yet able to differentiate between FinFisher *anonymizing proxies *and *master* servers, a distinction that we make in this work. When a government entity purchases FinFisher spyware, they receive a *FinSpy Master*—a C&C server that is installed on the entity’s premises.6 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The entity may then set up *anonymizing proxies* (also referred to as “*proxies*” or “*FinSpy Relays*” in the FinFisher documentation), to obscure the location of their master. Infected computers communicate with the anonymizing proxy, which is “usually”7 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> set up on a Virtual Private Server (VPS) provider in a third country. The proxy then forwards communications between a victim’s computer and the Master server. We first describe how we scanned the Internet for FinFisher servers and distinguished masters from proxies (*Part 1: Fishing for FinFisher*). We then outline our findings regarding 32 governments and 10 specific government entities that we believe are using FinFisher (*Part 2: Country Findings*). Finally, we highlight several cases that illuminate connections between different threat actors (*Part 3: A Deeper Analysis of Several Cases*), before concluding (*Conclusion*). *Kenya* *National Intelligence Service* We found a FinFisher server in a range of IP addresses registered to a Kenyan user named “National Security Intelligence.” Kenya’s National Intelligence Service (NIS) was formerly known as the National Security Intelligence Service (NSIS). Kenya’s NSIS replaced the former Directorate of Security Intelligence (DSI), commonly known as the “Special Branch”.52 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>The NIS is known as one of Kenya’s security institutions with the biggest budgetary allocation—along with the Kenya National Defence Forces and the National Police Service—and considered to be among the country’s critical security organs in the new constitution.53 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> In 2014, Human Rights Watch named the NIS, as well as the Anti-Terrorism Police Unit and other Kenyan intelligence agencies, as being implicated in abuses including torture, disappearances, and extrajudicial killings.54 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The powers of the NIS were expanded significantly in December 2014 when the Parliament of Kenya rushed to pass the controversial Security Laws (Amendment) Bill.55 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> The amendments came following a series of deadly terrorist attacks by the militant group al-Shabab, including the 2013 killing of 67 people at the Westgate shopping mall in Nairobi.56 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…>This bill expanded the powers of the NIS to monitor communications without a warrant, as well as expanding their powers to search and seize private property.57 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Article 62 of the amended bill authorized NIS agents to “do anything necessary to preserve national security” and to detain individuals on simply the suspicion of engaging in acts which pose a threat to national security.58 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> Section 66 of the bill amended the National Intelligence Services Act, permitting the Director General of the NIS to monitor communications or “obtain any information, material, record, document or thing” in order to protect national security, without court oversight, leading rights organization Article 19 to argue that the amendment “effectively [gives]*carte blanche* to the Director-General to order mass surveillance of online communications”.59 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> While a court ruling in February 2015 struck down some provisions of the amendment, the provisions enhancing the powers of the NIS remained.60 <https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/…> More here: https://citizenlab.org/2015/10/mapping-finfishers-continuing-proliferation/

2 1

Proposed Amendments to KICA in Statute Law Misc. Amendment Bill 2015
by Victor Kapiyo 15 Oct '15

15 Oct '15

Dear all, Pls see below, link to the Statute Law Misc. Amendment Bill 2015, which proposes to amend several laws, including KICA. According to the objects and reasons: Kenya Information And Communications Act, of 1998 - Firstly to align it with the Competitions Act, 2014 in respect of the criteria for being a dominant market undertaking and secondly to harmonize the regulation making power so that it is exercised by the Cabinet Secretary in consultation with the Authority. The Competition Act (No. 12 of 2010 - The Bill seeks to amend the Competition Act so as to clarify that the power to Prescribe, as specified in the Act is to be exercised by the Cabinet Secretary in consultation with the Authority. http://kenyalaw.org/kl/fileadmin/pdfdownloads/bills/2015/StatuteLaw__Miscel… Victor Kapiyo ==================================================== *“Your attitude, not your aptitude, will determine your altitude” Zig Ziglar*

3 3