July 2017 - KICTANet

Poor show by IEBC: Data Protection in year 2017 and the case of raw voter registration data
by Mwendwa Kivuva 03 Jul '17

03 Jul '17

Dear Listers, Today I'm wearing my CISA hat. IEBC has launched a voter verification tool both through sms, and web query at http://voterstatus.iebc.or.ke/voter If you are privacy conscious, and a little bit paranoid, you will realize that IEBC is doing badly with how they are exposing raw data of nearly 20 million Kenyans to the world. Anybody with basic programing skills can be able to harvest the raw data through an automated search. If you search any random number with the format of Kenya ID numbers, say hypothetically 12345678, you will realize you can pull up citizen's details, at least ID number, and name, and where they live. Basic security tips would require the system to have a captcha to prevent automated harvest of the information, and also have a challenge questions like date of birth to supplement the ID number, therefore thwart any mischievous individuals from harvesting the rich data Can IEBC correct the anomaly? Attached is a sample demo screenshot. Of course there is the other thing of strange ID numbers finding their way into the voter register. Voter Details for Id: 12345678 Id / Passport Number 12345678 Primary Name KIBET Secondary Name KIRUI Birth Date 01/01/1994 Gender M Polling Station Code 101 Polling Station LELACH PRIMARY SCHOOL County KERICHO Contituency BURETI Ward CHEPLANGET ______________________ Mwendwa Kivuva, Nairobi, Kenya twitter.com/lordmwesh

11 12

Re: [kictanet] Poor show by IEBC: Data Protection in year 2017 and the case of raw voter registration data
by Mark Kipyegon 03 Jul '17

03 Jul '17

SMS is not a secure implementation of two factor authentication. On 30 Jun 2017, at 10:40, "kictanet-request(a)lists.kictanet.or.ke" <kictanet-request(a)lists.kictanet.or.ke> wrote: > > A simple 2 Factor Authentication mechanism via SMS would suffice to start > with.

7 10

Fw: [Internet Policy] Capital I or small i(nternet)
by WANGARI KABIRU 03 Jul '17

03 Jul '17

Blessed Monday to all! Interesting discussion in the ISOC circles. Legal usage and who defines what is correct - a unique position with a "said multistakeholder model" Is the CAPS or lower case more on Brand, identity, ownership, (de)centralisation? A good point also is distinction between WWW and Internet (or internet). Be blessed. Regards/Wangari --- Pray God Bless. 2013Wangari circa - "Being of the Light, We are Restored Through Faith in Mind, Body and Spirit; We Manifest The Kingdom of God on Earth". On Sunday, 2 July 2017, 20:30, Richard Hill <rhill(a)hill-a.ch> wrote: #yiv9895996481 #yiv9895996481 -- _filtered #yiv9895996481 {panose-1:2 4 5 3 5 4 6 3 2 4;} _filtered #yiv9895996481 {font-family:Calibri;panose-1:2 15 5 2 2 2 4 3 2 4;} _filtered #yiv9895996481 {font-family:Tahoma;panose-1:2 11 6 4 3 5 4 4 2 4;}#yiv9895996481 #yiv9895996481 p.yiv9895996481MsoNormal, #yiv9895996481 li.yiv9895996481MsoNormal, #yiv9895996481 div.yiv9895996481MsoNormal {margin:0in;margin-bottom:.0001pt;font-size:12.0pt;}#yiv9895996481 a:link, #yiv9895996481 span.yiv9895996481MsoHyperlink {color:blue;text-decoration:underline;}#yiv9895996481 a:visited, #yiv9895996481 span.yiv9895996481MsoHyperlinkFollowed {color:purple;text-decoration:underline;}#yiv9895996481 p.yiv9895996481MsoAcetate, #yiv9895996481 li.yiv9895996481MsoAcetate, #yiv9895996481 div.yiv9895996481MsoAcetate {margin:0in;margin-bottom:.0001pt;font-size:8.0pt;}#yiv9895996481 span.yiv9895996481BalloonTextChar {}#yiv9895996481 span.yiv9895996481EmailStyle19 {color:#1F497D;}#yiv9895996481 .yiv9895996481MsoChpDefault {} _filtered #yiv9895996481 {margin:1.0in 1.0in 1.0in 1.0in;}#yiv9895996481 div.yiv9895996481WordSection1 {}#yiv9895996481 Dear Ayden, Thank you for bringing this to our attention. I would recommend reading at least pages 1-3, 14, and 23-24 and of the Supreme Court judgment, which is at: https://www.supremecourt.gov/opinions/16pdf/15-1194_08l1.pdf I wonder to what extent the court’s thinking was influenced by the fact that the law they struck down did not refer to the Internet, but to the “Web”. I’m sure we all agree that there is only one World Wide Web, so the correct usage is the proper noun, Web, when referring to the WWW (as opposed to using web to refer to the generic technology, as in “a private company can operate a private web, also referred to as an intranet”). Be that as it may, the court referred to “the Internet” or “the internet” without defining either term. As I’ve explained elsewhere[1] there are many definitions of the term “Internet”. The one that I like best is the 1995 definition of the US Federal Networking Council[2]: “the global information system that:(i) is logically linked together by a globally unique address space based on the Internet Protocol (IP) or its subsequent extensions/follow-ons;(ii) is able to support communications using the Transmission Control Protocol/Internet Protocol (TCP/IP) suite or its subsequent extensions/follow-ons, and/or other IP-compatible protocols; and(iii) provides, uses or makes accessible, either publicly or privately, high level services layered on the communications and related infrastructure described herein." This definition would appear to me to apply to a particular global system, which system should be referred to by a proper noun, that is “the Internet”. However, it is interesting to note that the telephone network is also a global system that is (i) logically linked together by a globally unique address space and (ii) is able to support communications using protocols. Yet nobody would think of referring to the telephone network with a proper noun, as “the Telephone Network”. Is that because the telephone network does not provide high-level services on top of its infrastructure? That is, do we think of “the Internet” because of “the World Wide Web”? And, if there were no World Wide Web, would we think of “the internet” as infrastructure, which is what Justice Alito seems to do? Thanks again and best,Richard [1] Richard Hill (2014), "The Internet, its governance, and the multi-Stakeholder model", Info, vol. 16. no. 2, March 2014[2] See footnote xv of Robert E. Kahn and Vinton G. Cerf . “What Is The Internet (And What Makes It Work)” December, 1999, available at: http://www.cnri.reston.va.us/what_is_internet.html ------ On Sun, 2 Jul 2017, Richard Hill wrote: Show original message Also interesting: oral argument from oyez.org: https://www.oyez.org/cases/2016/15-1194 I recommend a whole thing, one of my favourite excerpts: ----- Elena Kagan So -- so a -- so a person in this situation, for example, cannot go onto the President's Twitter account to find out what the President is saying today? Robert C. Montgomery That -- that's correct, Your Honor. Elena Kagan Not only the President. I mean, we're sort of aware of it because the President now uses Twitter. ----- Marcin Cieślak Internet Society Poland From: InternetPolicy [mailto:internetpolicy-bounces@elists.isoc.org] On Behalf Of Ayden Férdeline Sent: Saturday, July 1, 2017 19:50 To: Roland Perry Cc: internetpolicy(a)elists.isoc.org Subject: Re: [Internet Policy] Capital I or small i(nternet) Sorry to resurrect an old thread, but I found this interesting: a majority of the US Supreme Court has capitalised the 'I' in Internet, treating it as a proper noun, in a recent decision: https://motherboard.vice.com/en_us/article/pay5ek/internet-or-internet-the-… Best wishes, Ayden Férdelinelinkedin.com/in/ferdeline -------- Original Message --------Subject: [Internet Policy] Capital I or small i(nternet)Local Time: April 23, 2017 3:06 PMUTC Time: April 23, 2017 2:06 PMFrom: roland(a)perry.co.ukTo: internetpolicy(a)elists.isoc.org I'm old enough to regard the correct term as 'Internet' not 'internet'; for example in regular press releases, news stories etc. Does ISOC (or is that iSOC) have advice about this for the world at large?-- Roland Perry_______________________________________________

1 0

KeNIC Opens up 2nd Level Domains
by Ali Hussein 03 Jul '17

03 Jul '17

Dear all KeNIC has just announced the opening up of the .ke 2nd level domains. What does this really mean? Simply put for example is that your domain can now be www.wanjiku.ke instead of www.wanjiku.co.ke. This is huge and the Registrar and user community have been agitating for this for many years. Kudos to the KeNIC team led by Abdalla Omari and the Board. This was way overdue. So from a commercial perspective these are interesting times:- fa.ke anyone? :-) Or how about ca.ke; Ni.ke, Co.ke? ma.ke? #LetTheGamesBegin! Regards *Ali Hussein* *Principal* *Hussein & Associates* Tel: +254 713 601113 Twitter: @AliHKassim Skype: abu-jomo LinkedIn: http://ke.linkedin.com/in/alihkassim <http://ke.linkedin.com/in/alihkassim> 13th Floor , Delta Towers, Oracle Wing, Chiromo Road, Westlands, Nairobi, Kenya. Any information of a personal nature expressed in this email are purely mine and do not necessarily reflect the official positions of the organizations that I work with.

5 4

3RD quarter Sector Statistics Report 2016/2017
by Mark O. Okuttah 01 Jul '17

01 Jul '17

Dear Listers, Kindly find the link leading to the 3rd quarter Sector Statistics Report released today. http://www.ca.go.ke/index.php/statistics Mark Okuttah

2 1