- KICTANet - KICTANet

Policy Hackathon on Huduma Bill 2019
by Linda Bonyo 10 Sep '19

10 Sep '19

Dear Listers, The Lawyers Hub is hosting a hackathon this Friday and Saturday on Huduma Bill as we seek to better the bill through public participation in innovative policy making. The Bill impacts Kenyas and we hope that we can use Design thinking at the policy hackathon to come up with valuable insights that will benefit the registration of communities, individuals, Asylum seekers among-st other interest groups. We will run sessions on understanding Good ID governance systems with the support of Omidyar Network. Today’s session runs from 11am to 2pm and if you prefer Saturday it will be on all day. RSVP here : ( https://www.eventbrite.com/e/policy-hackathon -on-huduma-bill-2019-digital-identity-tickets-71200052273 ) Let us know if you have any further questions on the numbers below. -- ______________________________________________ *Linda Bonyo* (Ms.) | CEO, *Lawyers Hub * Tech for Justice ACK Garden House| Block D, 6th Floor |Upper Hill, Nairobi| Kenya Email: bonyo(a)*lawyershub.ke* <bonyo(a)lawyershub.ke> | Skype*:* lawyershubke Tel: +254(0)207840228 Mobile : +254784840228 www.lawyershub.org | www.lawyershub.ke | *_**__________________________________________________________* *DISCLAIMER: The information contained in or accompanying this e-mail is intended for the use of the stated recipient only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Any views or opinions presented herein are solely those of the author and do not necessarily represent those of the Lawyers Hub.*

2 1

Policy Hackathon on Huduma Bill 2019
by Linda Bonyo 06 Sep '19

06 Sep '19

Dear Listers, The Lawyers Hub is hosting a hackathon this Friday and Saturday on Huduma Bill as we seek to better the bill through public participation in innovative policy making. The Bill impacts Kenyas and we hope that we can use Design thinking at the policy hackathon to come up with valuable insights that will benefit the registration of communities, individuals, Asylum seekers among-st other interest groups. We will run sessions on understanding Good ID governance systems with the support of Omidyar Network. Today’s session runs from 11am to 2pm and if you prefer Saturday it will be on all day. RSVP here : ( https://www.eventbrite.com/e/policy-hackathon -on-huduma-bill-2019-digital-identity-tickets-71200052273 ) Let us know if you have any further questions on the numbers below. -- _______________________________________________________ *Linda Bonyo* (Ms.) | Partner, *Bonyo Mwongela & Company Advocates | Lawyers Hub* Immigration & Tech Law Practitioners. Notary Public| Commissioner of Oaths| Advocate High Court of Kenya Email: *bonyo(a)immigrationlawyer.co.ke <bonyo(a)immigrationlawyer.co.ke>* | bonyo(a)lawyershub.ke *Skype:* immigrationlawyer.ke Tel: +254(0)202211313 +254733221313 +254725372113 www.immigrationlawyer.co.ke | www.lawyershub.org | Nairobi, Kenya. *_**_____________________________________________________________________* *DISCLAIMER: The information contained in or accompanying this e-mail is intended for the use of the stated recipient only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Any views or opinions presented herein are solely those of the author and do not necessarily represent those of Bonyo Mwongela & Company Advocates.*

1 0

Caution! Data Quantity Does NOT Equal Data Quality - ICTworks
by Adam Lane 05 Sep '19

05 Sep '19

interesting and useful research from Uganda https://www.ictworks.org/data-quantity-equal-data-quality/ Caution! Data Quantity Does NOT Equal Data Quality Posted by Guest Writer Uganda tax authority Revenue administrations collect large amounts of data on individuals and firms in the course of their work. Increasingly, this data is digitised. The use of digital technologies has the potential to greatly improve the efficiency and effectiveness of tax administration. In tax collection, as in so many other areas of activity, the realisation of the potential benefits of digital technologies can be a challenging and drawn-out process. It is not simply a matter of purchasing hardware, designing software and training staff. Systems may appear to function well, at least for some purposes, but significantly underperform in terms of accuracy, efficiency or effectiveness. Tax administrations have access to large amounts of data, but they do not always manage that data effectively. The Case of Uganda Revenue Authority Data Quality The Uganda Revenue Authority (URA) uses automated digital processes to a higher degree than most tax administrations in Africa. In How Clean is our Taxpayer Register? Jova Mayega, Robert Ssuuna, Muhammad Mubajje, Milly I. Nalukwago and Lawrence Muwonge report on Data Management in the Uganda Revenue Authority. They undertook an assessment with the URA to study one important aspect of its own data management practices: the management and accuracy of one of its most important data bases, the taxpayer register. They focus on the taxpayer register for two main reasons. Registration of a taxpayer is the building block of tax administration on which hinges the effectiveness of other processes and procedures such as filing, payment, assessment, collection, auditing, reporting The integrity of the taxpayer register is fundamental to effective tax administration. It facilitates compliance monitoring Specifically, the study addresses the following questions: What are the data gaps in the taxpayer register? What are the root causes of these gaps? What challenges does the URA face in maintaining a clean tax register? What can the URA do to ensure and maintain a clean tax register? To answer the questions, they employed two main research methods: analysis of the taxpayer register, and staff interviews. They accessed the detailed taxpayer register and analysed the data that had been entered on all the variables in the TIN application form. Our interest was to check the correctness of this information and identify gaps. To identify the root causes as well as the challenges that the URA faces in maintaining a clean tax register, they held interviews and focus group discussions with staff involved in the data management process as well as the data users. uganda data quality issues 5 Data Quality Issues for Uganda Revenue Authority They discovered considerable problems of inaccurate data and, primarily as a result of the activities of tax agents, a high level of duplication of the same telephone numbers and email addresses, and possession of multiple taxpayer identification numbers. These inaccuracies reflect a number of factors, including inadequate design of registration forms and procedures, and the low priority given to verification and the accuracy of the register. 1. Taxpayers supply the URA with wrong information. The process of applying for a TIN follows self-service principles. The URA largely depends on the information that taxpayers declare. Our analysis showed that vital information, such as address, contact details and bank account details, is often wrong. For example, 147 TIN holders had bank account numbers recorded as ‘0’. For another 110 they were ‘0000000000’. The home address given for 64 TINs was a building in Kampala called Crested Towers that is in reality unoccupied. 2. Taxpayers have the same contact information. A total of 581,574 individual taxpayers – 44 per cent of the total number registered – have contact details, especially telephone numbers and email addresses, that are identical to those of at least one other registered taxpayer. The level of duplication is sometimes high. They found that 16,017 individual taxpayers had recorded the same national identification number; 6,173 had the same passport number; 3,360 shared a single email address; and 1,742 had given the same phone number 3. Possession of multiple Tax Identification Numbers They were able to identify 29,511 individual taxpayers (2.4per cent of the total) and 27 companies (0.02 per cent of the total number of non-individual taxpayers) who possessed more than one TIN. 4. Outdated Tax Identification Numbers These are TINs given to taxpayers before the implementation of e-tax in 2009. They are no longer applicable. However, they identified in the taxpayer register, as of the end of June 2018, 185,705 of these outdated TINs belonging to company directors or partners in business partnerships. 5. Inactive taxpayers A predictable result of the big increase in the numbers of registered taxpayers is an increase in the proportion who are inactive, defined as those who have not engaged in any transaction with the URA over the previous two years. This increase in inactivity is confined almost entirely to individual taxpayers. The rate of inactivity for companies and other corporate bodies has barely changed. Data Quality Root Causes There are broadly three immediate causes of the problems they list above with the accuracy of the taxpayer register. Starting with the most specific – and the most easily-remediable – they are: The design of the taxpayer registration form: The TIN application form can accept any information entered. Some fields are mandatory, but taxpayers can fill in anything to bypass system requirements. The design of the IT system used for registration: At the point of taxpayer registration, the e-tax system does not validate some of the newly declared information against information that might already be in URA databases. The behaviour of various categories of people who use the system: They found that three categories of people contribute to the errors found in the taxpayer register: taxpayers themselves, URA staff, and tax agents. Some TIN applicants are simply not honest with their information. Some URA staff are negligent. Unregistered tax agents/brokers offering tax services as a business. How to Fix Data Quality Issues The current databases have a number of data gaps, especially in regard to data quality. The URA thus needs to invest significant resources both in the short and the long term to ensure that the already available data is usable and that the new data is of sufficient quality. The URA needs to hire staff to deal solely with the registration process and tax register maintenance. Registered taxpayers should be required to confirm or amend their details regularly, possibly every two years. The government should integrate URA IT systems with those of other government and/or private agencies. The URA management needs to address the issue of negligent behaviour of staff responsible for new taxpayer registrations. Taxpayers need to be continuously sensitised on how to register for a TIN and how to amend their registration details in case of any changes. The URA collects a lot of information from taxpayers in the process of administering tax. This information is very useful in guiding decision making, enforcing compliance and also for research purposes. -------------------------------------------------- M: +254-790985886<tel:+254-790985886> Senior Director, Public Affairs Huawei Southern Africa region

1 0

EAIGF Save the Date and Call for Topics
by Liz Orembo 04 Sep '19

04 Sep '19

Dear listers We are pleased to announce that the East Africa Internet Governance Forum (EAIGF) will take place on 17th-18th October 2019 at the East Africa Community Headquarters in Arusha, Tanzania. East Africa Internet Governance Forum (EAIGF) is a platform for inclusive multilateral, multi-stakeholder and multilingual discussion on issues pertinent to enhancing Internet development in East Africa and Internet Governance issues. First convened in 2008, the EAIGF thus creates a Community of Practice allows a sustaining foundation for meaningful participation of East African stakeholders in Internet public policy debates at the national, regional and international level. The EA-IGF model allows for the informed participation, contribution and engagement of community members through the sharing of experiences and skills, solving common problems and challenges, the creation of new knowledge and increasing local capacity and talent. This year the EAIGF will be held in October 17 – 18, 2019 in Arusha, Tanzania. More on EAIGF can be found on the website: http://eaigf.africa/ . We are also reaching out to you to help us develop the theme and program for the forum. Please take a minute to fill out this form: https://docs.google.com/forms/d/1zokc9nmePFMIOudXk31xCiUURjS3-QGeppG0pT0WUL… The EAIGF will be preceded by the East Africa School of Internet Governance which will take place on 14th-15th October at the same venue. Information on registration and EASIG will follow shortly. -- Best regards. Liz. Sent on behalf of the EAIGF secretariat.

2 1

Fwd: [AfrICANN-discuss] TR: Registrations open for the online course: Artificial Intelligence: Technology, Governance, and Policy Frameworks
by Barrack Otieno 03 Sep '19

03 Sep '19

Listers, This might be of interest. Best Regards ---------- Forwarded message ---------- From: Mamadou LO <alfamamadou(a)hotmail.com> Date: Mon, 2 Sep 2019 09:41:10 +0000 Subject: [AfrICANN-discuss] TR: Registrations open for the online course: Artificial Intelligence: Technology, Governance, and Policy Frameworks To: "africann(a)afrinic.net" <africann(a)afrinic.net> De : NCSG-Discuss <NCSG-DISCUSS(a)LISTSERV.SYR.EDU> de la part de Marilia Maciel <mariliamaciel(a)GMAIL.COM> Envoyé : lundi 2 septembre 2019 04:02 À : NCSG-DISCUSS(a)LISTSERV.SYR.EDU <NCSG-DISCUSS(a)LISTSERV.SYR.EDU> Objet : Registrations open for the online course: Artificial Intelligence: Technology, Governance, and Policy Frameworks Dear all, Applications are open for the second edition of Diplo's online course on Artificial Intelligence until the 16th of September. The course provides an interdisciplinary coverage of the topic, encompassing technical, political, legal, economic, security, and ethical issues related to AI. It will start on the 7th of October and will be conducted over a period of ten weeks. Detailed information can be found on the course webpage<https://www.diplomacy.edu/courses/ai>. You can contact me in case you have any questions. ______________________________ Marília Maciel Digital Policy Senior Researcher | DiploFoundation WMO | 7bis, Avenue de la Paix | 1202 Geneva - Switzerland MariliaM(a)diplomacy.edu<mailto:[email protected]> | @MariliaM www.diplomacy.edu<http://www.diplomacy.edu/> -- Barrack O. Otieno +254721325277 +254733206359 Skype: barrack.otieno PGP ID: 0x2611D86A

1 0

Fwd: Netexplo Spotting session for the Netexplo 100 2020
by Bitange Ndemo 03 Sep '19

03 Sep '19

I am a member of the UNESCO's Netexplo Academic Network that spots new innovations and nominates them to an annual conference in Paris. Please circulate the attached request for next year. Ndemo. ---------- Forwarded message --------- From: Brigitte LASRY <blasry(a)netexplo.org> Date: Mon, Sep 2, 2019 at 4:54 PM Subject: Netexplo Spotting session for the Netexplo 100 2020 To: Bitange Ndemo <bndemo(a)bitangendemo.me> Cc: Brigitte Lasry <blasry(a)netexplo.org> Dear Bitange , I hope that all is well with you, as we discussed it previously, we would like to proceed with a spotting session, starting now in September through the end of November. We hope that it is a good time for you to organize it with your students. In order to help you organize the spotting session, I am sending you the link of a PPT presentation of the whole process: https://drive.google.com/file/d/1CxAAkZoU8QfRRg79OdpngIHh4nk3uB4M/view?usp=… As we mentioned it before, we have developed a submission form on our own Netexplo platform. The problem is that, so far, the full access of the template is only accessible to you upon request. Actually, only we, see the list of projects submitted by your students, but, at any time, upon your request, we can export the full template and send it to you. Here is the link to the submission form: https://www.netexplo.org/en/proposition/43a005fc As a reminder, please note what we are looking for (not exhaustive): - innovation related to internet or digital tech - creation or emergence since 2018 - originality - likely impact I also suggest that before submitting a project, yours students first check on Netexplo website https://www.netexplo.com/n100/ that the project they want to submit has not already been submitted and is not part of previous Netexplo 100. Please don’t hesitate to contact me should you have any questions. All the best, Brigitte Brigitte LASRY I Head of International University Network +33 6 61 17 58 60 264 rue du Faubourg Saint-Honoré 75008 Paris blasry(a)netexplo.org Netexplo.com

1 0

Techweek-Nairobi-2019 - CALL FOR PAPERS DEADLINE NOW EXTENDED TO SEPTEMBER 16 - RESENDING
by Odhiambo Washington 03 Sep '19

03 Sep '19

Greetings, We are pleased to announce that the TechWeek program committee has extended the deadline for TechWeek Nairobi 2019 *CALL FOR PAPER**S UNTIL SEPTEMBER 16th 2019.* For submission of your proposals please go to https://papers.techweek.co.ke/user/login.php?event=101 <https://www.afpif.org/fr/afpif10/appel-a-communication/> For more information please visit Techweek's website here: https://www.techweek.co.ke TechWeek Secretariat -- Best regards, Odhiambo WASHINGTON, Nairobi,KE +254 7 3200 0004/+254 7 2274 3223 "Oh, the cruft.", grep ^[^#] :-)

1 0

Copyright bill 2017 and President Uhuru's directive to Senate and National Assembly
by Grace Githaiga 03 Sep '19

03 Sep '19

Listers Two weeks ago, during the burial of the Late John De Mathew, President Kenyatta urged both the Senate and National Assembly to fasten the Copyright Bill 2017 as he is ready to sign it. There were complaints from different speakers that the late musician had over 300 songs to his name but only reaped benefits from very few of them. The President directed that the music copyright office be moved from the AG’s office to the Ministry of ICT where CA can monitor which service provider has played what song. In addition, CA was directed that renewal of licenses for various broadcasters and providers be pegged to those who had paid the artistes royalties. The copyright bill 2017 http://www.parliament.go.ke/sites/default/files/2018-09/COPYRIGHT%20%28AMEN… Section 24 proposes to include 35 (A) on Protection of Internet Service Provider and 35(B) on Take down notice. On the takedown request, section 35 (B) (g) requires a complainant to attach an affidavit or any other declaration attesting to claim of ownership, validity of the rights, good faith and setting out any efforts to have entities responsible for making the content available to remove the content; (h) be copied to the Board, Communication Authority and the recognised umbrella association of service providers. In 35 (B) (4), an Internet Service Provider shall, upon receipt of a valid takedown notice, notify the person responsible for making available the alleged infringing content and provide them with a copy of the notice as soon as is practicable. However, in (5) the Internet Service provider shall disable access to the material within forty-eight business hours unless it receives a counter notice fulfilling the requirements set out for a takedown notice and contesting the contents of the takedown notice. See, an artiste can complain, but a service provider can receive a counter notice. How does this help to protect copyright? This issue of exploitation of creatives has gone on for long. Should we not be thinking through of better ways that do not claw back on formal complaints? Will the moving of the music copyright office from AG to ICT Ministry cure the exploitation problem? ---------------------------------------------------------------------------------- Grace Githaiga Twitter: @ggithaiga Skype: gracegithaiga Linkedin: https://www.linkedin.com/in/gracegithaiga ...the most important office in a democracy is the citizen. So, you see, that’s what our democracy demands. It needs you!----Barrack Obama.

1 0

UNDESA Internship in the Secretariat of the Internet Governance Forum (IGF)
by Grace Githaiga 02 Sep '19

02 Sep '19

Might be of interest to someone here. ---------- Forwarded message ---------- From: UNOG-IGF <igf(a)un.org> Date: Mon, 2 Sep 2019 10:06:13 +0000 Subject: [Wg-oe] UNDESA Internship in the Secretariat of the Internet Governance Forum (IGF) To: UNOG-IGF <igf(a)un.org> This is a kind reminder that there is an open internship position of the United Nations Department of Economic and Social Affairs (UNDESA) at the Internet Governance Forum (IGF) Secretariat in Geneva, Switzerland. Interested stakeholders are invited to review the internship requirements at the IGF website: https://www.intgovforum.org/multilingual/content/undesa-internship-in-the-s… and submit their applications as soon as possible. Best regards, IGF Secretariat _______________________________________________

1 0

Fresh new collection of free, Self Paced learning courses: IoT, AI, Blockchain
by John Matogo 02 Sep '19

02 Sep '19

Dear Listers, Have a look at this updated list of new ICT courses, all are free and self paced. Very good for your continuous learning. Kindly share with others that may benefit from this learning and certification. Topics covered include: - AI - IoT - Blockchain - Web Development - Data Science and Analytics, - and many more. Check them out here: Link to courses <https://developer.ibm.com/digitalnation/africa/courses/> Regards. JM

3 2

Kibaki’s letter gave birth to Kenya’s famed Silicon Savannah
by Grace Githaiga 01 Sep '19

01 Sep '19

...The journey to that phone call had begun at an insurance industry dinner two years earlier, in early 2006, at the Panari Hotel in Nairobi. Then, Mr Kagwe was the guest of honour. After his speech, a journalist had asked him to state the one thing he hoped to achieve at the ICT ministry. He told the journalist that he wanted Kenyans to communicate easily and cheaply with the world. At the time it cost Sh35 per minute to make a phone call within the Safaricom network during peak hours and up to Sh50 per minute to other networks. These high costs made Kenyans wait until off-peak hours to make cheaper calls, which often clogged the Safaricom network in the evening, rendering it impossible for anyone to get through. This state of affairs led then Safaricom CEO Michael Joseph to accuse Kenyans of peculiar calling habits, causing a PR crisis for the company. Internet connections, on the other hand, were a nightmare. Read more on: https://www.nation.co.ke/news/Kibaki-s-letter-that-delivered-broadband-inte… Best regards Grace Githaiga -- Grace Githaiga Co-Convenor, Kenya ICT Action Network

6 5

Fwd: [Internet Policy] Age Appropriate Design code - part of UK Data Protection Act 2018
by Barrack Otieno 31 Aug '19

31 Aug '19

Listers, This is for your information and attention. Best Regards ---------- Forwarded message --------- From: Richard Hill via InternetPolicy <internetpolicy(a)elists.isoc.org> Date: Thu, 29 Aug 2019, 5:16 pm Subject: [Internet Policy] Age Appropriate Design code - part of UK Data Protection Act 2018 To: <internetpolicy(a)elists.isoc.org> As part of the process to turn the GDPR into UK law last year, an amendment was passed requiring the ICO (UK Data Protection Authority) to develop an Age Appropriate Design Code to recognize that children (anyone under 18) are a vulnerable group who deserve extra protections regarding their personal data. The attached booklet, produced by the 5Rights foundation give an easy explanation of the Code that was developed by the ICO. It also explains how the Code can be easily implemented without complicated age verification. Best, Richard _______________________________________________ To manage your Internet Society subscriptions or unsubscribe, log into the Member Portal at https://admin.internetsociety.org/622619/User/Login and go to the Interests tab within your profile. - View the Internet Society Code of Conduct: https://www.internetsociety.org/become-a-member/code-of-conduct/

1 0

KICTANet resources available for you!
by Grace Githaiga 27 Aug '19

27 Aug '19

Hello Listers This is to bring to your attention that there are several resources available on the KICTANet website. They are categorized into reports, policy briefs, submissions that KICTANet has made to several policy making bodies, and several IGF reports. They can be found here: https://www.kictanet.or.ke/?page_id=40115 Listers are also welcome to blog on our platform '_the KICTANet Post'_ on any ICT policy and regulatory topical issues. For more information, please get in touch with Liz Orembo (lizorembo(a)kictanet.or.ke) or Mwendwa Kivuva (lordmwesh(a)gmail.com) Please see the _KICTANet post_ here: https://www.kictanet.or.ke/?page_id=28812 Best regards Grace Githaiga -- Grace Githaiga Co-Convenor, Kenya ICT Action Network

2 1

Fwd: [Internet Policy] Internet-enabled space crime
by Barrack Otieno 26 Aug '19

26 Aug '19

Learned Listers, Interesting quagmire, interested in local perspectives. Regards ---------- Forwarded message --------- From: Richard Bennett via InternetPolicy <internetpolicy(a)elists.isoc.org> Date: Sun, Aug 25, 2019 at 5:48 AM Subject: [Internet Policy] Internet-enabled space crime To: ISOC Policy <internetpolicy(a)elists.isoc.org> An astronaut unlawfully accessed her wife’s bank accounts from the International Space Station. The couple are going through a bitter divorce, custody battle, etc. This is apparently the first crime to be committed in space, so the jurisdiction issues are somewhat interesting as they are with all Internet-enabled crimes. Presumably US law applies since the bank is located in the US, but I don’t really know. https://www.nytimes.com/2019/08/23/us/nasa-astronaut-anne-mcclain.html "Ms. McClain acknowledged that she had accessed the bank account from space, insisting through a lawyer that she was merely shepherding the couple’s still-intertwined finances. Ms. Worden felt differently. She filed a complaint with the Federal Trade Commission and her family lodged one with NASA’s Office of Inspector General, accusing Ms. McClain of identity theft and improper access to Ms. Worden’s private financial records. "Investigators from the inspector general’s office have since contacted Ms. Worden and Ms. McClain, trying to get to the bottom of what may be the first allegation of criminal wrongdoing in space. "“I was pretty appalled that she would go that far. I knew it was not O.K.,” Ms. Worden said.” Opinions? RB — Richard Bennett High Tech Forum Founder Ethernet & Wi-Fi standards co-creator Internet Policy Consultant _______________________________________________ To manage your Internet Society subscriptions or unsubscribe, log into the Member Portal at https://admin.internetsociety.org/622619/User/Login and go to the Interests tab within your profile. - View the Internet Society Code of Conduct: https://www.internetsociety.org/become-a-member/code-of-conduct/ -- Barrack O. Otieno +254721325277 +254733206359 Skype: barrack.otieno PGP ID: 0x2611D86A

2 1

Fwd: [NRIs List] Inviting Parliamentarians to the IGF
by Barrack Otieno 26 Aug '19

26 Aug '19

Listers, This might be of interest to our Honourable Members of Parliament, Senate, National Assembly and County Assembly. For colleagues working in County Governments share this with your MCA's and Mps. Regards Please note the registration deadlines. ---------- Forwarded message --------- From: <sandra(a)eurodig.org> Date: Sat, Aug 24, 2019 at 1:07 AM Subject: [NRIs List] Inviting Parliamentarians to the IGF To: <igfregionals(a)intgovforum.org> Cc: <IGF2019(a)medienstadt-leipzig.org> Dear NRI colleagues, the Host of this year’s IGF, the German Ministry of Economic Affairs and Energy, is paying particular attention to invite parliamentarians from across the world. In this respect I would like to encourage you to forward the “Save the date Message” enclosed to parliamentarians in your country or region. Parliamentarians from countries on the DAC-List are eligible to apply for travel support with the IGF Secretariat until *31. August 2019.* Details about the application, visa and registration process you can also find enclosed. If you prefer the “Save the date Message” in other languages (like French, Spanish, Chinese, Portuguese, Arabic, Russian) kindly contact IGF2019(a)medienstadt-leipzig.org. Best Sandra _______________________________________________ Igfregionals mailing list Igfregionals(a)intgovforum.org To unsubscribe or manage your options please go to http://intgovforum.org/mailman/listinfo/igfregionals_intgovforum.org -- Barrack O. Otieno +254721325277 +254733206359 Skype: barrack.otieno PGP ID: 0x2611D86A

1 0

Block-Chain & AI Task Force Report - August LawTech Meetup
by Linda Bonyo 18 Aug '19

18 Aug '19

Lawyers Hub and the Block Chain Association of Kenya will meet this Friday evening to discuss the recently released Report by the Block Chain & AI Task-force. Tickets are absolutely free and available here on eventbrite link ( https://www.eventbrite.com/e/lawtech-nairobi-august-meet-up-on-kenya-block-… ) We hope to see you there for this month’s edition of Nairobi LawTech Meetup as we discuss Policy/ Regulations that impact emerging technologies. Kindly contact info(a)lawyershub.ke for any clarification or queries. Sincerely, Linda Bonyo Lawyers Hub. -- ______________________________________________ *Linda Bonyo* (Ms.) | CEO, *Lawyers Hub * Tech for Justice ACK Garden House| Block D, 6th Floor |Upper Hill, Nairobi| Kenya Email: bonyo(a)*lawyershub.ke* <bonyo(a)lawyershub.ke> | Skype*:* lawyershubke Tel: +254(0)207840228 Mobile : +254784840228 www.lawyershub.org | www.lawyershub.ke | *_**__________________________________________________________* *DISCLAIMER: The information contained in or accompanying this e-mail is intended for the use of the stated recipient only. It may contain confidential, proprietary or legally privileged information. No confidentiality or privilege is waived or lost by any mistransmission. If you receive this message in error, please immediately delete it and all copies of it from your system, destroy any hard copies of it and notify the sender. You must not, directly or indirectly, use, disclose, distribute, print, or copy any part of this message if you are not the intended recipient. Any views or opinions presented herein are solely those of the author and do not necessarily represent those of the Lawyers Hub.*

1 0

Looking for opportunities to work as a transcriber
by meshack emakunat 18 Aug '19

18 Aug '19

Hello, Listers, Apology for the relevance of this post on the forum. A friend is in need of a work from home jobs such as transcriber or any relevant. This is to sustain the ever demand for her project funding. She is currently doing her masters at Egerton and I have no other way to help rather than reach out to members the group. Name: Grace WanyoikeTelephone: 0780851625Email: wanyoikewairimu(a)gmail.com I hope someone is in need of data analysis, transcription or writer services.

1 0

KRA to tax income from apps downloaded in Kenya
by King Of Zamunda 16 Aug '19

16 Aug '19

Hello Listers, I just came across this on the dailies https://www.businessdailyafrica.com/news/KRA-to-tax-income-from-apps-downlo… What are your thoughts? [image: Mailtrack] <https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=sig…> Sender notified by Mailtrack <https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=sig…> 08/15/19, 04:25:22 PM

4 4

Public participation on the national CCTV policy: deadline 14 August
by Alice Munyua 16 Aug '19

16 Aug '19

5 4

Fwd: [Open Position] Senior Program Officer, DFS Regulatory & Consumer Protection Technologies
by Rafe Mazer 16 Aug '19

16 Aug '19

Colleagues, See below interesting position with Gates for those with FinTech, ICT and regulatory backgrounds. All the best Rafe > From: Himanshu Nagpal > Subject: [Open Position] Senior Program Officer, DFS Regulatory & Consumer Protection Technologies > > Dear FSP team and partners, > > As you know, we have been ramping up our efforts in the area of DFS risk mitigation; with an emphasis on leveraging technology. > > To further accelerate this body of work we have just opened a new role on my team for a Senior Program Officer, DFS Regulatory & Consumer Protection Technologies. > > The focus of this newly created role is to leverage technology to enable financial regulators in managing the risks posed by emerging financial services models without impeding the innovation required to drive financial inclusion. Our aim is to ensure that the progress being made in financial inclusion remains robust and increases the likelihood for technology to drive inclusive growth and poverty alleviation while protecting consumers and their confidence in the system > > Key areas of focus will include: > Consumer protection including fraud, over indebtedness, grievance redressal, disclosure, informed consent, literacy, product suitability among other topics. > Regulatory tools and data systems for effective market supervision of consumer protection and market conduct. > Anti-money laundering and countering the financing of terrorism. > Technology capacity building for financial regulators in low-middle income countries (LMICs) > > In terms of skills and experience we are hoping to find someone who has experience in both regulatory/policy and technology domains; preferably at a one or more of the following types of institutions: a) leading financial regulatory authority, b) reg-tech/risk management solutions provider, or c) global financial services institution driving their regulatory and compliance agenda. > > I request you to please share this job opening amongst your networks to help us build a strong pipeline of candidates. > > Thanks a lot in advance for your help, > > Best Regards > Himanshu > Himanshu Nagpal > Deputy Director > Financial Services for the Poor > www.gatesfoundation.org

1 0

Fwd: CRYPTO-GRAM, August 15, 2019
by Nelson Kwaje 15 Aug '19

15 Aug '19

Hello members, this info might be helpful to some. ---------- Forwarded message --------- From: Bruce Schneier <schneier(a)schneier.com> Date: Thu, Aug 15, 2019 at 8:51 AM Subject: CRYPTO-GRAM, August 15, 2019 To: <nelson(a)web4all.co.ke> Crypto-Gram August 15, 2019 by Bruce Schneier Fellow and Lecturer, Harvard Kennedy School schneier(a)schneier.com https://www.schneier.com A free monthly newsletter providing summaries, analyses, insights, and commentaries on security: computer and otherwise. For back issues, or to subscribe, visit Crypto-Gram's web page <https://www.schneier.com/crypto-gram.html>. Read this issue on the web <https://www.schneier.com/crypto-gram/archives/2019/0815.html> These same essays and news items appear in the Schneier on Security <https://www.schneier.com/> blog, along with a lively and intelligent comment section. An RSS feed is available. ** *** ***** ******* *********** ************* In this issue: 1. Palantir's Surveillance Service for Law Enforcement <#m_9172732402594497067_cg1> 2. Zoom Vulnerability <#m_9172732402594497067_cg2> 3. Identity Theft on the Job Market <#m_9172732402594497067_cg3> 4. John Paul Stevens Was a Cryptographer <#m_9172732402594497067_cg4> 5. A Harlequin Romance Novel about Hackers <#m_9172732402594497067_cg5> 6. Hackers Expose Russian FSB Cyberattack Projects <#m_9172732402594497067_cg6> 7. Science Fiction Writers Helping Imagine Future Threats <#m_9172732402594497067_cg7> 8. Attorney General William Barr on Encryption Policy <#m_9172732402594497067_cg8> 9. Software Developers and Security <#m_9172732402594497067_cg9> 10. Insider Logic Bombs <#m_9172732402594497067_cg10> 11. Wanted: Cybersecurity Imagery <#m_9172732402594497067_cg11> 12. ACLU on the GCHQ Backdoor Proposal <#m_9172732402594497067_cg12> 13. Another Attack Against Driverless Cars <#m_9172732402594497067_cg13> 14. Facebook Plans on Backdooring WhatsApp <#m_9172732402594497067_cg14> 15. How Privacy Laws Hurt Defendants <#m_9172732402594497067_cg15> 16. Disabling Security Cameras with Lasers <#m_9172732402594497067_cg16> 17. More on Backdooring (or Not) WhatsApp <#m_9172732402594497067_cg17> 18. Regulating International Trade in Commercial Spyware <#m_9172732402594497067_cg18> 19. Phone Pharming for Ad Fraud <#m_9172732402594497067_cg19> 20. Brazilian Cell Phone Hack <#m_9172732402594497067_cg20> 21. AT&T Employees Took Bribes to Unlock Smartphones <#m_9172732402594497067_cg21> 22. Supply-Chain Attack against the Electron Development Platform <#m_9172732402594497067_cg22> 23. Evaluating the NSA's Telephony Metadata Program <#m_9172732402594497067_cg23> 24. Exploiting GDPR to Get Private Information <#m_9172732402594497067_cg24> 25. Side-Channel Attack against Electronic Locks <#m_9172732402594497067_cg25> ** *** ***** ******* *********** ************* Palantir's Surveillance Service for Law Enforcement *[2019.07.15]* <https://www.schneier.com/blog/archives/2019/07/palantirs_surve.html> Motherboard got its hands on <https://www.vice.com/en_us/article/9kx4z8/revealed-this-is-palantirs-top-se…> Palantir's Gotham user's manual, which is used by the police to get information on people: The Palantir user guide shows that police can start with almost no information about a person of interest and instantly know extremely intimate details about their lives. The capabilities are staggering, according to the guide: - If police have a name that's associated with a license plate, they can use automatic license plate reader data to find out where they've been, and when they've been there. This can give a complete account of where someone has driven over any time period. - With a name, police can also find a person's email address, phone numbers, current and previous addresses, bank accounts, social security number(s), business relationships, family relationships, and license information like height, weight, and eye color, as long as it's in the agency's database. - The software can map out a person's family members and business associates of a suspect, and theoretically, find the above information about them, too. All of this information is aggregated and synthesized in a way that gives law enforcement nearly omniscient knowledge over any suspect they decide to surveil. Read the whole article -- it has a lot of details. This seems like a commercial version of the NSA's XKEYSCORE. Boing Boing post <https://boingboing.net/2019/07/12/leaked-palantir-gotham.html>. Meanwhile <https://www.engadget.com/2019/07/12/fbi-social-media-monitoring-tool-rfp/>: The FBI wants to gather more information from social media. Today, it issued a call for contracts for a new social media monitoring tool <https://www.fbo.gov/index?s=opportunity&mode=form&id=fe943e551236e0e62ee084…>. According to a request-for-proposals (RFP), it's looking for an "early alerting tool" that would help it monitor terrorist groups, domestic threats, criminal activity and the like. The tool would provide the FBI with access to the full social media profiles of persons-of-interest. That could include information like user IDs, emails, IP addresses and telephone numbers. The tool would also allow the FBI to track people based on location, enable persistent keyword monitoring and provide access to personal social media history. According to the RFP, "The mission-critical exploitation of social media will enable the Bureau to detect, disrupt, and investigate an ever growing diverse range of threats to U.S. National interests." ** *** ***** ******* *********** ************* Zoom Vulnerability *[2019.07.16]* <https://www.schneier.com/blog/archives/2019/07/zoom_vulnerabil.html> The Zoom conferencing app has <https://tidbits.com/2019/07/09/zoom-and-ringcentral-exploits-allows-remote-…> a <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-a…> vulnerability <https://boingboing.net/2019/07/09/wontfix.html> that allows someone to remotely take over the computer's camera. It's a bad vulnerability, made worse <https://medium.com/bugbountywriteup/zoom-zero-day-4-million-webcams-maybe-a…> by the fact that it remains even if you uninstall the Zoom app: This vulnerability allows any website to forcibly join a user to a Zoom call, with their video camera activated, without the user's permission. On top of this, this vulnerability would have allowed any webpage to DOS (Denial of Service) a Mac by repeatedly joining a user to an invalid call. Additionally, if you've ever installed the Zoom client and then uninstalled it, you still have a localhost web server on your machine that will happily re-install the Zoom client for you, without requiring any user interaction on your behalf besides visiting a webpage. This re-install 'feature' continues to work to this day. Zoom didn't take the vulnerability seriously: This vulnerability was originally responsibly disclosed on March 26, 2019. This initial report included a proposed description of a 'quick fix' Zoom could have implemented by simply changing their server logic. It took Zoom 10 days to confirm the vulnerability. The first actual meeting about how the vulnerability would be patched occurred on June 11th, 2019, only 18 days before the end of the 90-day public disclosure deadline. During this meeting, the details of the vulnerability were confirmed and Zoom's planned solution was discussed. However, I was very easily able to spot and describe bypasses in their planned fix. At this point, Zoom was left with 18 days to resolve the vulnerability. On June 24th after 90 days of waiting, the last day before the public disclosure deadline, I discovered that Zoom had only implemented the 'quick fix' solution originally suggested. This is why we disclose vulnerabilities. Now, finally, Zoom is taking this seriously and fixing it for real. EDITED TO ADD (8/8): Apple silently released <https://www.theverge.com/2019/7/10/20689644/apple-zoom-web-server-automatic…> a macOS update that removes the Zoom webserver if the app is not present. ** *** ***** ******* *********** ************* Identity Theft on the Job Market *[2019.07.18]* <https://www.schneier.com/blog/archives/2019/07/identity_theft_.html> Identity theft is getting more subtle: "My job application was withdrawn by someone pretending to be me <https://www.bbc.com/news/business-48995846>": When Mr Fearn applied for a job at the company he didn't hear back. He said the recruitment team said they'd get back to him by Friday, but they never did. At first, he assumed he was unsuccessful, but after emailing his contact there, it turned out someone had created a Gmail account in his name and asked the company to withdraw his application. Mr Fearn said the talent assistant told him they were confused because he had apparently emailed them to withdraw his application on Wednesday. "They forwarded the email, which was sent from an account using my name." He said he felt "really shocked and violated" to find out that someone had created an email account in his name just to tarnish his chances of getting a role. This is about as low-tech as it gets. It's trivially simple for me to open a new Gmail account using a random first and last name. But because people innately trust email, it works. ** *** ***** ******* *********** ************* John Paul Stevens Was a Cryptographer *[2019.07.19]* <https://www.schneier.com/blog/archives/2019/07/john_paul_steve.html> I didn't know that Supreme Court Justice John Paul Stevens "was also a cryptographer for the Navy <https://epic.org/2019/07/justice-john-paul-stevens-1920.html> during World War II." He was a proponent of individual <https://www.law360.com/health/articles/1179418/3-times-justice-stevens-boos…> privacy <https://epic.org/privacy/justice_stevens.html>. EDITED TO ADD (8/12): More <https://stationhypo.com/2019/07/17/remembering-the-honorable-john-paul-stev…> on his cryptography career. ** *** ***** ******* *********** ************* A Harlequin Romance Novel about Hackers *[2019.07.19]* <https://www.schneier.com/blog/archives/2019/07/a_harlequin_rom.html> Really <https://arstechnica.com/gaming/2019/07/talk-cyber-to-me-ars-reads-a-harlequ…> . ** *** ***** ******* *********** ************* Hackers Expose Russian FSB Cyberattack Projects *[2019.07.22]* <https://www.schneier.com/blog/archives/2019/07/hackers_expose_.html> More nation-state activity in cyberspace, this time from Russia <https://www.zdnet.com/article/hackers-breach-fsb-contractor-expose-tor-dean…> : Per the different reports in Russian media, the files indicate that SyTech had worked since 2009 on a multitude of projects since 2009 for FSB unit 71330 and for fellow contractor Quantum. Projects include: - *Nautilus* -- a project for collecting data about social media users (such as Facebook, MySpace, and LinkedIn). - *Nautilus-S* -- a project for deanonymizing Tor traffic with the help of rogue Tor servers. - *Reward* -- a project to covertly penetrate P2P networks, like the one used for torrents. - *Mentor* -- a project to monitor and search email communications on the servers of Russian companies. - *Hope* -- a project to investigate the topology of the Russian internet and how it connects to other countries' network. - *Tax-3* -- a project for the creation of a closed intranet to store the information of highly-sensitive state figures, judges, and local administration officials, separate from the rest of the state's IT networks. BBC Russia, who received the full trove of documents, claims there were other older projects for researching other network protocols such as Jabber (instant messaging), ED2K (eDonkey), and OpenFT (enterprise file transfer). Other files posted on the Digital Revolution Twitter account claimed that the FSB was also tracking students and pensioners. ** *** ***** ******* *********** ************* Science Fiction Writers Helping Imagine Future Threats *[2019.07.23]* <https://www.schneier.com/blog/archives/2019/07/science_fiction_1.html> The French army is going to put together <https://www.bbc.com/news/world-europe-49044892> a team of science fiction writers to help imagine future threats. Leaving aside the question of whether science fiction writers are better or worse at envisioning nonfictional futures, this isn't new. The US Department of Homeland Security did the same thing over a decade ago, and I wrote about it <https://www.schneier.com/essays/archives/2009/06/how_science_fiction.html> back then: A couple of years ago, the Department of Homeland Security hired a bunch of science fiction writers to come in for a day and think of ways terrorists could attack America. If our inability to prevent 9/11 marked a failure of imagination, as some said at the time, then who better than science fiction writers to inject a little imagination into counterterrorism planning? I discounted the exercise <http://www.wired.com/dangerroom/2007/05/homeland_securi/> at the time, calling it "embarrassing." I never thought that 9/11 was a failure of imagination. I thought, and still think, that 9/11 was primarily a confluence of three things: the dual failure of centralized coordination and local control within the FBI, and some lucky breaks on the part of the attackers. More imagination leads to more movie-plot threats <https://www.schneier.com/essay-087.html> -- which contributes to overall fear and overestimation of the risks. And that doesn't help keep us safe at all. Science fiction writers are creative, and creativity helps in any future scenario brainstorming. But please, keep the people who actually know science and technology in charge. Last month, at the 2009 Homeland Security Science & Technology Stakeholders Conference in Washington D.C., science fiction writers <http://www.washingtonpost.com/wp-dyn/content/article/2009/05/21/AR200905210…> helped the attendees think differently about security. This seems like a far better use of their talents than imagining some of the zillions of ways terrorists can attack America. ** *** ***** ******* *********** ************* Attorney General William Barr on Encryption Policy *[2019.07.24]* <https://www.schneier.com/blog/archives/2019/07/attorney_genera_1.html> Yesterday, Attorney General William Barr gave a major speech on encryption policy -- what is commonly known as "going dark." Speaking at Fordham University in New York, he <https://techcrunch.com/2019/07/23/william-barr-consumers-security-risks-bac…> admitted <https://twitter.com/charlie_savage/status/1153692366966013952> that adding backdoors decreases security but that it is worth it. Some hold this view dogmatically, claiming that it is technologically impossible to provide lawful access without weakening security against unlawful access. But, in the world of cybersecurity, we do not deal in absolute guarantees but in relative risks. All systems fall short of optimality and have some residual risk of vulnerability a point which the tech community acknowledges when they propose that law enforcement can satisfy its requirements by exploiting vulnerabilities in their products. The real question is whether the residual risk of vulnerability resulting from incorporating a lawful access mechanism is materially greater than those already in the unmodified product. The Department does not believe this can be demonstrated. Moreover, even if there was, in theory, a slight risk differential, its significance should not be judged solely by the extent to which it falls short of theoretical optimality. Particularly with respect to encryption marketed to consumers, the significance of the risk should be assessed based on its practical effect on consumer cybersecurity, as well as its relation to the net risks that offering the product poses for society. After all, we are not talking about protecting the Nation's nuclear launch codes. Nor are we necessarily talking about the customized encryption used by large business enterprises to protect their operations. We are talking about consumer products and services such as messaging, smart phones, e-mail, and voice and data applications. If one already has an effective level of security say, by way of illustration, one that protects against 99 percent of foreseeable threats is it reasonable to incur massive further costs to move slightly closer to optimality and attain a 99.5 percent level of protection? A company would not make that expenditure; nor should society. Here, some argue that, to achieve at best a slight incremental improvement in security, it is worth imposing a massive cost on society in the form of degraded safety. This is untenable. If the choice is between a world where we can achieve a 99 percent assurance against cyber threats to consumers, while still providing law enforcement 80 percent of the access it might seek; or a world, on the other hand, where we have boosted our cybersecurity to 99.5 percent but at a cost reducing law enforcements [sic] access to zero percent the choice for society is clear. I think this is a major change in government position. Previously, the FBI, the Justice Department and so on had claimed that backdoors for law enforcement could be added without any loss of security. They maintained that technologists just need to figure out how—an approach we have derisively named "nerd harder <https://boingboing.net/2018/01/12/imaginary-numbers.html>." With this change, we can finally have a sensible policy conversation. Yes, adding a backdoor increases our collective security because it allows law enforcement to eavesdrop on the bad guys. But adding that backdoor also decreases our collective security because the bad guys can eavesdrop on everyone. This is exactly the policy debate we should be havingnot the fake one about whether or not we can have both security and surveillance. Barr makes the point that this is about "consumer cybersecurity," and not "nuclear launch codes." This is true, but ignores the huge amount of national security-related communications between those two poles. The same consumer communications and computing devices are used by our lawmakers, CEOs, legislators, law enforcement officers, nuclear power plant operators, election officials and so on. There's no longer a difference between consumer tech and government tech -- it's all the same tech. Barr also says: Further, the burden is not as onerous as some make it out to be. I served for many years as the general counsel of a large telecommunications concern. During my tenure, we dealt with these issues and lived through the passage and implementation of CALEA the Communications Assistance for Law Enforcement Act. CALEA imposes a statutory duty on telecommunications carriers to maintain the capability to provide lawful access to communications over their facilities. Companies bear the cost of compliance but have some flexibility in how they achieve it, and the system has by and large worked. I therefore reserve a heavy dose of skepticism for those who claim that maintaining a mechanism for lawful access would impose an unreasonable burden on tech firms especially the big ones. It is absurd to think that we would preserve lawful access by mandating that physical telecommunications facilities be accessible to law enforcement for the purpose of obtaining content, while allowing tech providers to block law enforcement from obtaining that very content. That telecommunications company was GTEwhich became Verizon <https://biglawbusiness.com/william-barr-would-bring-telecom-chops-to-justic…>. Barr conveniently ignores that CALEA-enabled phone switches were used to spy <https://www.schneier.com/blog/archives/2007/07/story_of_the_gr_1.html> on <https://spectrum.ieee.org/telecom/security/the-athens-affair> government officials in Greece in 2003—which seems to have been an NSA operation—and on a variety of people in Italy <https://en.wikipedia.org/wiki/SISMI-Telecom_scandal> in 2006. Moreover, in 2012 every CALEA-enabled switch sold to the Defense Department had security vulnerabilities <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2028152>. (I wrote about all this, and more, in 2013 <https://www.schneier.com/blog/archives/2013/06/the_problems_wi_3.html>.) The final thing I noticed about the speech is that is it not about iPhones and data at rest. It is about communications—data in transit. The "going dark" debate has bounced back and forth between those two aspects for decades. It seems to be bouncing once again. I hope that Barr's latest speech signals that we can finally move on from the fake security vs. privacy debate, and to the real security vs. security <https://opensource.com/article/18/6/listening-susan-landau> debate. I know where I stand on that: As computers continue to permeate every aspect of our lives, society, and critical infrastructure, it is much more important to ensure that they are secure from everybody -- even at the cost of law-enforcement access -- than it is to allow access at the cost of security. Barr is wrong, it kind of is like these systems are protecting nuclear launch codes. This essay previously appeared <https://www.lawfareblog.com/attorney-general-william-barr-encryption-policy> on Lawfare.com. EDITED TO ADD: More <https://arstechnica.com/tech-policy/2019/07/tech-firms-can-and-must-put-bac…> news <https://www.wsj.com/articles/barr-revives-debate-over-warrant-proof-encrypt…> articles <https://www.nytimes.com/2019/07/23/us/politics/william-barr-encryption-secu…> . EDITED TO ADD (7/28): Gen. Hayden comments <https://twitter.com/GenMhayden/status/1153722298861535232>. EDITED TO ADD (7/30): Good response <https://blog.erratasec.com/2019/07/why-we-fight-for-crypto.html> by Robert Graham. ** *** ***** ******* *********** ************* Software Developers and Security *[2019.07.25]* <https://www.schneier.com/blog/archives/2019/07/software_develo.html> According to a survey <https://www.zdnet.com/article/no-love-lost-between-security-specialists-and…>: "68% of the security professionals surveyed believe it's a programmer's job to write secure code, but they also think less than half of developers can spot security holes." And that's a problem. Nearly half of security pros surveyed, 49%, said they struggle to get developers to make remediation of vulnerabilities a priority. Worse still, 68% of security professionals feel fewer than half of developers can spot security vulnerabilities later in the life cycle. Roughly half of security professionals said they most often found bugs after code is merged in a test environment. At the same time, nearly 70% of developers said that while they are expected to write secure code <https://learn.gitlab.com/c/2019-global-develope>, they get little guidance or help. One disgruntled programmer said, "It's a mess, no standardization, most of my work has never had a security scan." Another problem is it seems many companies don't take security seriously enough. Nearly 44% of those surveyed reported that they're not judged on their security vulnerabilities. ** *** ***** ******* *********** ************* Insider Logic Bombs *[2019.07.26]* <https://www.schneier.com/blog/archives/2019/07/insider_logic_b.html> Add to the "not very smart criminals" file <https://www.zdnet.com/article/siemens-contractor-pleads-guilty-to-planting-…> : According to court documents, Tinley provided software services for Siemens' Monroeville, PA offices for nearly ten years. Among the work he was asked to perform was the creation of spreadsheets that the company was using to manage equipment orders. The spreadsheets included custom scripts that would update the content of the file based on current orders stored in other, remote documents, allowing the company to automate inventory and order management. But while Tinley's files worked for years, they started malfunctioning around 2014. According to court documents <https://www.scribd.com/document/419389583/5948342-0-19339>, Tinley planted so-called "logic bombs" that would trigger after a certain date, and crash the files. Every time the scripts would crash, Siemens would call Tinley, who'd fix the files for a fee. ** *** ***** ******* *********** ************* Wanted: Cybersecurity Imagery *[2019.07.29]* <https://www.schneier.com/blog/archives/2019/07/wanted_cybersec.html> Eli Sugarman of the Hewlettt Foundation laments <https://www.lawfareblog.com/sorry-state-cybersecurity-imagery> about the sorry state of cybersecurity imagery: The state of cybersecurity imagery is, in a word, abysmal. A simple Google Image search for the term proves the point: It's all white men in hoodies hovering menacingly over keyboards, green "Matrix"-style 1s and 0s, glowing locks and server racks, or some random combination of those elements—sometimes the hoodie-clad men even wear burglar masks. Each of these images fails to convey anything about either the importance or the complexity of the topic—or the huge stakes for governments, industry and ordinary people alike inherent in topics like encryption, surveillance and cyber conflict. I agree that this is a problem. It's not something I noticed until recently. I work in words. I think in words. I don't use PowerPoint (or anything similar) when I give presentations. I don't need visuals. But recently, I started teaching at the Harvard Kennedy School, and I constantly use visuals in my class. I made those same image searches, and I came up with similarly unacceptable results. But unlike me, Hewlett is doing something <https://hewlett.org/wp-content/uploads/2019/07/Reimagining-Visuals-for-Cybe…> about it. You can help: participate in the Cybersecurity Visuals Challenge <https://www.openideo.com/challenge-briefs/cybersecurity-visuals>. EDITED TO ADD (8/5): News article <https://www.theverge.com/2019/8/4/20751880/cybersecurity-stock-images-conte…>. Slashdot thread <https://idle.slashdot.org/story/19/08/04/1711201/7000-contest-seeks-better-…> . ** *** ***** ******* *********** ************* ACLU on the GCHQ Backdoor Proposal *[2019.07.30]* <https://www.schneier.com/blog/archives/2019/07/aclu_on_the_gch.html> Back in January, two senior GCHQ officials proposed <https://www.lawfareblog.com/principles-more-informed-exceptional-access-deb…> a specific backdoor for communications systems. It <https://www.lawfareblog.com/exceptional-access-devil-details-0> was <https://blog.cryptographyengineering.com/2018/12/17/on-ghost-users-and-mess…> universally <https://www.benthamsgaze.org/2018/12/06/new-threat-models-in-the-face-of-br…> derided <https://www.lawfareblog.com/detecting-ghosts-reverse-engineering-who-ya-gon…> as unworkable -- by me <https://www.lawfareblog.com/evaluating-gchq-exceptional-access-proposal>, as well. Now Jon Callas of the ACLU explains why <https://www.davisvanguard.org/2019/07/the-ghost-user-ploy-to-break-encrypti…> . ** *** ***** ******* *********** ************* Another Attack Against Driverless Cars *[2019.07.31]* <https://www.schneier.com/blog/archives/2019/07/another_attack_.html> In this piece of research, attackers successfully attack <https://arxiv.org/pdf/1906.09765.pdf> a driverless car system -- Renault Captur's "Level 0" autopilot (Level 0 systems advise human drivers but do not directly operate cars) -- by following them with drones that project images of fake road signs in 100ms bursts. The time is too short for human perception, but long enough to fool the autopilot's sensors. Boing Boing post <https://boingboing.net/2019/07/06/flickering-car-ghosts.html>. ** *** ***** ******* *********** ************* Facebook Plans on Backdooring WhatsApp *[2019.08.01]* <https://www.schneier.com/blog/archives/2019/08/facebook_plans_.html> This article <https://www.forbes.com/sites/kalevleetaru/2019/07/26/the-encryption-debate-…> points out that Facebook's planned content moderation scheme will result in an encryption backdoor into WhatsApp: In Facebook's vision, the actual end-to-end encryption client itself such as WhatsApp will include embedded content moderation and blacklist filtering algorithms. These algorithms will be continually updated from a central cloud service, but will run locally on the user's device, scanning each cleartext message before it is sent and each encrypted message after it is decrypted. The company even noted <https://www.forbes.com/sites/kalevleetaru/2019/05/28/facebook-is-already-wo…> that when it detects violations it will need to quietly stream a copy of the formerly encrypted content back to its central servers to analyze further, even if the user objects, acting as true wiretapping service. Facebook's model entirely bypasses the encryption debate by globalizing the current practice of compromising devices by building those encryption bypasses directly into the communications clients themselves and deploying what amounts to machine-based wiretaps to billions of users at once. Once this is in place, it's easy for the government to demand that Facebook add another filter -- one that searches for communications that they care about -- and alert them when it gets triggered. Of course alternatives like Signal will exist for those who don't want to be subject to Facebook's content moderation, but what happens when this filtering technology is built into operating systems? The problem is that if Facebook's model succeeds, it will only be a matter of time before device manufacturers and mobile operating system developers embed similar tools directly into devices themselves, making them impossible to escape. Embedding content scanning tools directly into phones would make it possible to scan all apps, including ones like Signal, effectively ending the era of encrypted communications. I don't think this will happen -- why does AT&T care about content moderation -- but it is something to watch? EDITED TO ADD (8/2): This story is wrong. Read my correction <https://www.schneier.com/blog/archives/2019/08/more_on_backdoo.html>. ** *** ***** ******* *********** ************* How Privacy Laws Hurt Defendants *[2019.08.02]* <https://www.schneier.com/blog/archives/2019/08/how_privacy_law.html> Rebecca Wexler has an interesting op-ed <https://www.latimes.com/opinion/story/2019-07-30/consumer-data-privacy-laws…> about an inadvertent harm that privacy laws can cause: while law enforcement can often access third-party data to aid in prosecution, the accused don't have the same level of access to aid in their defense: The proposed privacy laws would make this situation worse. Lawmakers may not have set out to make the criminal process even more unfair, but the unjust result is not surprising. When lawmakers propose privacy bills to protect sensitive information, law enforcement agencies lobby for exceptions <https://repository.law.umich.edu/mlr/vol111/iss4/1/> so they can continue to access the information. Few lobby for the accused to have similar <https://scholarship.law.cornell.edu/clr/vol99/iss5/1/> rights. Just as the privacy interests of poor, minority and heavily policed communities are often ignored <https://www.sup.org/books/title/?id=25115> in the lawmaking process, so too are the interests of criminal defendants, many from those same communities. In criminal cases, both the prosecution and the accused have a right to subpoena evidence so that juries can hear both sides of the case. The new privacy bills need to ensure that law enforcement and defense investigators operate under the same rules when they subpoena digital data. If lawmakers believe otherwise, they should have to explain and justify that view. For more detail, see her paper <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3428607>. ** *** ***** ******* *********** ************* Disabling Security Cameras with Lasers *[2019.08.02]* <https://www.schneier.com/blog/archives/2019/08/disabling_secur.html> There's a really interesting video <https://www.zerohedge.com/news/2019-08-01/watch-hong-kong-protesters-using-…> of <https://boingboing.net/2019/07/31/just-dont-have-a-face-2.html> protesters in Hong Kong using some sort of laser to disable security cameras. I know nothing more about the technologies involved. EDITED TO ADD (8/14): LIDAR from self-driving cars has damaged <https://www.theinquirer.net/inquirer/news/3069427/sony-a7r-ii-camera-destro…> security cameras before. ** *** ***** ******* *********** ************* More on Backdooring (or Not) WhatsApp *[2019.08.02]* <https://www.schneier.com/blog/archives/2019/08/more_on_backdoo.html> Yesterday, I blogged about <https://www.schneier.com/blog/archives/2019/08/facebook_plans_.html> a Facebook plan to backdoor WhatsApp by adding client-side scanning and filtering. It seems that I was wrong, and there are no such plans. The only source for that post was a Forbes essay <https://www.forbes.com/sites/kalevleetaru/2019/07/26/the-encryption-debate-…> by Kalev Leetaru, which links to a previous Forbes essay <https://www.forbes.com/sites/kalevleetaru/2019/05/28/facebook-is-already-wo…> by him, which links to a video presentation <https://developers.facebook.com/videos/2019/applying-ai-to-keep-the-platfor…> from a Facebook developers conference. Leetaru extrapolated a lot out of very little. I watched the video (the relevant section is at the 23:00 mark), and it doesn't talk about client-side scanning of messages. It doesn't talk about messaging apps at all. It discusses using AI techniques to find bad content on Facebook, and the difficulties that arise from dynamic content: So far, we have been keeping this fight [against bad actors and harmful content] on familiar grounds. And that is, we have been training our AI models on the server and making inferences on the server when all the data are flooding into our data centers. While this works for most scenarios, it is not the ideal setup for some unique integrity challenges. URL masking is one such problem which is very hard to do. We have the traditional way of server-side inference. What is URL masking? Let us imagine that a user sees a link on the app and decides to click on it. When they click on it, Facebook actually logs the URL to crawl it at a later date. But...the publisher can dynamically change the content of the webpage to make it look more legitimate [to Facebook]. But then our users click on the same link, they see something completely different -- oftentimes it is disturbing; oftentimes it violates our policy standards. Of course, this creates a bad experience for our community that we would like to avoid. This and similar integrity problems are best solved with AI on the device. That might be true, but it also would hand whatever secret-AI sauce Facebook has to every one of its users to reverse engineer -- which means it's probably not going to happen. And it is a dumb idea, for reasons Steve Bellovin has pointed out <https://www.cs.columbia.edu/~smb/blog/2019-08/2019-08-01.html>. Facebook's first published response was a comment <https://news.ycombinator.com/item?id=20587643> on the Hacker News website from a user named "wcathcart," which Cardozo assures me is Will Cathcart, the vice president of WhatsApp. (I have no reason to doubt his identity, but surely there is a more official news channel that Facebook could have chosen to use if they wanted to.) Cathcart wrote: We haven't added a backdoor to WhatsApp. The Forbes contributor referred to a technical talk about client side AI in general to conclude that we might do client side scanning of content on WhatsApp for anti-abuse purposes. To be crystal clear, we have not done this, have zero plans to do so, and if we ever did it would be quite obvious and detectable that we had done it. We understand the serious concerns this type of approach would raise which is why we are opposed to it. Facebook's second published response was a comment <https://www.schneier.com/blog/archives/2019/08/facebook_plans_.html#c6796703> on my original blog post, which has been confirmed to me by the WhatsApp people as authentic. It's more of the same. So, this was a false alarm. And, to be fair, Alec Muffet called foul <https://medium.com/@alecmuffett/on-the-latest-facebook-messenger-conspiracy…> on the first Forbes piece: So, here's my pre-emptive finger wag: Civil Society's pack mentality can make us our own worst enemies. If we go around repeating one man's Germanic conspiracy theory, we may doom ourselves to precisely what we fear. Instead, we should—we must—take steps to constructively demand what we actually want: End to End Encryption which is worthy of the name. Blame accepted. But in general, this is the sort of thing we need to watch for. End-to-end encryption only secures data in transit. The data has to be in the clear on the device where it is created, and it has to be in the clear on the device where it is consumed. Those are the obvious places for an eavesdropper to get a copy. This has been a long process. Facebook desperately wanted to convince me to correct the record, while at the same time not wanting to write something on their own letterhead (just a couple of comments, so far). I spoke at length with Privacy Policy Manager Nate Cardozo, whom Facebook hired last December <https://www.schneier.com/blog/archives/2019/02/facebooks_new_p.html> from EFF. (Back then, I remember thinking of him -- and the two other new privacy hires -- as basically human warrant canaries. If they ever leave Facebook under non-obvious circumstances, we know that things are bad.) He basically leveraged his historical reputation to assure me that WhatsApp, and Facebook in general, would never do something like this. I am trusting him, while also reminding everyone that Facebook has broken so many privacy promises <https://phys.org/news/2018-03-facebook-history-privacy.html> that they really can't be trusted. Final note: If they want to be trusted, Adam Shostack and I gave them a road map <https://onezero.medium.com/a-new-privacy-constitution-for-facebook-a7106998…> . Hacker News thread <https://news.ycombinator.com/item?id=20585794>. EDITED TO ADD (8/4): Slashdot covered <https://tech.slashdot.org/story/19/08/03/0031206/did-whatsapp-backdoor-rumo…> my retraction. ** *** ***** ******* *********** ************* Regulating International Trade in Commercial Spyware *[2019.08.05]* <https://www.schneier.com/blog/archives/2019/08/regulating_inte.html> Siena Anstis, Ronald J. Deibert, and John Scott-Railton of Citizen Lab published <https://www.lawfareblog.com/proposed-response-commercial-surveillance-emerg…> an editorial calling for regulating the international trade in commercial surveillance systems until we can figure out how to curb human rights abuses. Any regime of rigorous human rights safeguards that would make a meaningful change to this marketplace would require many elements, for instance, compliance with the U.N. Guiding Principles on Business and Human Rights <https://www.ohchr.org/documents/publications/GuidingprinciplesBusinesshr_eN…>. Corporate tokenism in this space is unacceptable; companies will have to affirmatively choose human rights concerns over growing profits and hiding behind the veneer of national security. Considering the lies <https://www.theguardian.com/technology/2015/jul/06/hacking-team-hacked-firm…> that have emerged from within the surveillance industry, self-reported compliance is insufficient; compliance will have to be independently audited and verified and accept robust measures of outside scrutiny. The purchase of surveillance technology by law enforcement in any state must be transparent and subject to public debate. Further, its use must comply with frameworks setting out the lawful scope of interference with fundamental rights under international human rights law and applicable national laws, such as the "Necessary and Proportionate <https://necessaryandproportionate.org/principles>" principles on the application of human rights to surveillance. Spyware companies like NSO Group have relied on rubber stamp approvals by government agencies whose permission is required to export their technologies abroad. To prevent abuse, export control systems must instead prioritize a reform agenda that focuses on minimizing the negative human rights impacts of surveillance technology and that ensures -- with clear and immediate consequences for those who fail -- that companies operate in an accountable and transparent environment. Finally, and critically, states must fulfill their duty to protect individuals against third-party interference with their fundamental rights. With the growth of digital authoritarianism and the alarming consequences that it may hold for the protection of civil liberties around the world, rights-respecting countries need to establish legal regimes that hold companies and states accountable for the deployment of surveillance technology within their borders. Law enforcement and other organizations that seek to protect refugees or other vulnerable persons coming from abroad will also need to take digital threats seriously. ** *** ***** ******* *********** ************* Phone Pharming for Ad Fraud *[2019.08.06]* <https://www.schneier.com/blog/archives/2019/08/phone_farming_f.html> Interesting article <https://www.vice.com/en_us/article/d3naek/how-to-make-a-phone-farm> on people using banks of smartphones to commit ad fraud for profit. No one knows how prevalent ad fraud is on the Internet. I believe it is surprisingly high -- here's an article <https://www.emarketer.com/content/five-charts-the-state-of-ad-fraud> that places losses between $6.5 and $19 billion annually -- and something companies like Google and Facebook would prefer remain unresearched. ** *** ***** ******* *********** ************* Brazilian Cell Phone Hack *[2019.08.07]* <https://www.schneier.com/blog/archives/2019/08/brazilian_cell_.html> I know there's a lot of politics associated with this story, but concentrate on the cybersecurity aspect for a moment. The cell phones of a thousand Brazilians, including senior government officials, were hacked <https://www.bloomberg.com/news/articles/2019-07-24/brazil-hackers-target-1-…> -- seemingly by actors much less sophisticated than rival governments. Brazil's federal police arrested four people for allegedly hacking 1,000 cellphones belonging to various government officials, including that of President Jair Bolsonaro. Police detective João Vianey Xavier Filho said the group hacked into the messaging apps of around 1,000 different cellphone numbers, but provided little additional information at a news conference in Brasilia on Wednesday. Cellphones used by Bolsonaro were among those attacked by the group, the justice ministry said in a statement on Thursday, adding that the president was informed of the security breach. [...] In the court order <https://politica.estadao.com.br/blogs/fausto-macedo/wp-content/uploads/site…> determining the arrest of the four suspects, Judge Vallisney de Souza Oliveira wrote that the hackers had accessed Moro's Telegram messaging app, along with those of two judges and two federal police officers. When I say that smartphone security equals national security, this is the kind of thing I am talking about. ** *** ***** ******* *********** ************* AT&T Employees Took Bribes to Unlock Smartphones *[2019.08.08]* <https://www.schneier.com/blog/archives/2019/08/att_employees_t.html> This wasn't a small operation <https://arstechnica.com/tech-policy/2019/08/att-employees-took-bribes-to-un…> : A Pakistani man bribed AT&T call-center employees to install malware and unauthorized hardware as part of a scheme to fraudulently unlock cell phones, according to the US Department of Justice. Muhammad Fahd, 34, was extradited from Hong Kong to the US on Friday and is being detained pending trial. An indictment alleges that "Fahd recruited and paid AT&T insiders to use their computer credentials and access to disable AT&T's proprietary locking software that prevented ineligible phones from being removed from AT&T's network," a DOJ announcement <https://www.justice.gov/usao-wdwa/pr/leader-conspiracy-illegally-unlock-cel…> yesterday said. "The scheme resulted in millions of phones being removed from AT&T service and/or payment plans, costing the company millions of dollars. Fahd allegedly paid the insiders hundreds of thousands of dollars—paying one co-conspirator $428,500 over the five-year scheme." In all, AT&T insiders received more than $1 million in bribes from Fahd and his co-conspirators, who fraudulently unlocked more than 2 million cell phones, the government alleged. Three former AT&T customer service reps from a call center in Bothell, Washington, already pleaded guilty and agreed to pay the money back to AT&T. ** *** ***** ******* *********** ************* Supply-Chain Attack against the Electron Development Platform *[2019.08.08]* <https://www.schneier.com/blog/archives/2019/08/supply-chain_at.html> Electron is a cross-platform development system for many popular communications apps, including Skype, Slack, and WhatsApp. Security vulnerabilities <https://www.contextis.com/en/blog/basic-electron-framework-exploitation> in the update system allows someone to silently inject malicious code into applications. From a news article <https://arstechnica.com/information-technology/2019/08/skype-slack-other-el…> : At the BSides LV security conference on Tuesday, Pavel Tsakalidis demonstrated a tool he created called BEEMKA <https://www.contextis.com/en/blog/basic-electron-framework-exploitation>, a Python-based tool that allows someone to unpack Electron ASAR archive files <https://github.com/electron/asar> and inject new code into Electron's JavaScript libraries and built-in Chrome browser extensions. The vulnerability is not part of the applications themselves but of the underlying Electron framework—and that vulnerability allows malicious activities to be hidden within processes that appear to be benign. Tsakalidis said that he had contacted Electron about the vulnerability but that he had gotten no response—and the vulnerability remains. While making these changes required administrator access on Linux and MacOS, it only requires local access on Windows. Those modifications can create new event-based "features" that can access the file system, activate a Web cam, and exfiltrate information from systems using the functionality of trusted applications—including user credentials and sensitive data. In his demonstration, Tsakalidis showed a backdoored version of Microsoft Visual Studio Code that sent the contents of every code tab opened to a remote website. Basically, the Electron ASAR files aren't signed or encrypted, so modifying them is easy. Note that this attack requires local access to the computer, which means that an attacker that could do this could do much more damaging things as well. But once an app has been modified, it can be distributed to other users. It's not a big deal attack, but it's a vulnerability that should be closed. ** *** ***** ******* *********** ************* Evaluating the NSA's Telephony Metadata Program *[2019.08.12]* <https://www.schneier.com/blog/archives/2019/08/evaluating_the_1.html> Interesting analysis: "Examining the Anomalies, Explaining the Value: Should the USA FREEDOM Act's Metadata Program be Extended? <https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3434358>" by Susan Landau and Asaf Lubin. *Abstract:* The telephony metadata program which was authorized under Section 215 of the PATRIOT Act, remains one of the most controversial programs launched by the U.S. Intelligence Community (IC) in the wake of the 9/11 attacks. Under the program major U.S. carriers were ordered to provide NSA with daily Call Detail Records (CDRs) for all communications to, from, or within the United States. The Snowden disclosures and the public controversy that followed led Congress in 2015 to end bulk collection and amend the CDR authorities with the adoption of the USA FREEDOM Act (UFA). For a time, the new program seemed to be functioning well. Nonetheless, three issues emerged around the program. The first concern was over high numbers: in both 2016 and 2017, the Foreign Intelligence Surveillance Court issued 40 orders for collection, but the NSA collected hundreds of millions of CDRs, and the agency provided little clarification for the high numbers. The second emerged in June 2018 when the NSA announced the purging of three years' worth of CDR records for "technical irregularities." Finally, in March 2019 it was reported that the NSA had decided to completely abandon the program and not seek its renewal as it is due to sunset in late 2019. This paper sheds significant light on all three of these concerns. First, we carefully analyze the numbers, showing how forty orders might lead to the collection of several million CDRs, thus offering a model to assist in understanding Intelligence Community transparency reporting across its surveillance programs. Second, we show how the architecture of modern telephone communications might cause collection errors that fit the reported reasons for the 2018 purge. Finally, we show how changes in the terrorist threat environment as well as in the technology and communication methods they employ—in particular the deployment of asynchronous encrypted IP-based communications—has made the telephony metadata program far less beneficial over time. We further provide policy recommendations for Congress to increase effective intelligence oversight. ** *** ***** ******* *********** ************* Exploiting GDPR to Get Private Information *[2019.08.13]* <https://www.schneier.com/blog/archives/2019/08/exploiting_gdpr.html> A researcher abused the GDPR <https://www.bbc.com/news/technology-49252501> to get information on his fiancee: It is one of the first tests of its kind to exploit the EU's General Data Protection Regulation (GDPR) <https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679&f…>, which came into force in May 2018. The law shortened the time organisations had to respond to data requests, added new types of information they have to provide, and increased the potential penalty for non-compliance. "Generally if it was an extremely large company -- especially tech ones -- they tended to do really well," he told the BBC. "Small companies tended to ignore me. "But the kind of mid-sized businesses that knew about GDPR, but maybe didn't have much of a specialised process [to handle requests], failed." He declined to identify the organisations that had mishandled the requests, but said they had included: - a UK hotel chain that shared a complete record of his partner's overnight stays - two UK rail companies that provided records of all the journeys she had taken with them over several years - a US-based educational company that handed over her high school grades, mother's maiden name and the results of a criminal background check survey. ** *** ***** ******* *********** ************* Side-Channel Attack against Electronic Locks *[2019.08.14]* <https://www.schneier.com/blog/archives/2019/08/side-channel_at_2.html> Several high-security electronic locks are vulnerable to side-channel attacks <https://www.reuters.com/article/us-locks-cyber-exclusive/exclusive-high-sec…> involving power monitoring. ** *** ***** ******* *********** ************* Since 1998, CRYPTO-GRAM has been a free monthly newsletter providing summaries, analyses, insights, and commentaries on security technology. To subscribe, or to read back issues, see Crypto-Gram's web page <https://www.schneier.com/crypto-gram.html>. You can also read these articles on my blog, Schneier on Security <https://www.schneier.com>. Please feel free to forward CRYPTO-GRAM, in whole or in part, to colleagues and friends who will find it valuable. Permission is also granted to reprint CRYPTO-GRAM, as long as it is reprinted in its entirety. Bruce Schneier is an internationally renowned security technologist, called a security guru by the Economist. He is the author of over one dozen books -- including his latest, Click Here to Kill Everybody <https://www.schneier.com/books/click_here/> -- as well as hundreds of articles, essays, and academic papers. His newsletter and blog are read by over 250,000 people. Schneier is a fellow at the Berkman Klein Center for Internet and Society at Harvard University; a Lecturer in Public Policy at the Harvard Kennedy School; a board member of the Electronic Frontier Foundation, AccessNow, and the Tor Project; and an advisory board member of EPIC and VerifiedVoting.org. Copyright © 2019 by Bruce Schneier. ** *** ***** ******* *********** ************* Mailing list hosting graciously provided by MailChimp <https://mailchimp.com/>. Sent without web bugs or link tracking. This e-mail was sent to: nelson(a)web4all.co.ke *You are receiving this e-mail because you subscribed to the Crypto-Gram newsletter.* unsubscribe from this list <https://schneier.us18.list-manage.com/unsubscribe?u=f99e2b5ca82502f48675978…> update subscription preferences <https://schneier.us18.list-manage.com/profile?u=f99e2b5ca82502f48675978be&i…> Bruce Schneier · Harvard Kennedy School · 1 Brattle Square · Cambridge, MA 02138 · USA

1 0

Kenya:- Kenya Finance Bill 2019:- Taxation of digital economy
by Ephraim Percy Kenyanito 08 Aug '19

08 Aug '19

*Kenya:-* Kenya Finance Bill 2019:- Taxation of digital economy In order to tap into the fast growing digital economy, the Bill proposes to tax income accruing through a digital marketplace by introducing a new charging section. Although this is a welcome move to increase the tax base, it is still not clear how international digital platforms with no physical presence in Kenya will be taxed. In this regard, it is expected that special rules may soon be formulated detailing the operational mechanics of how taxation of the digital economy will be undertaken. (It can be found here:- http://www.parliament.go.ke/sites/default/files/2019-07/Finance%20Bill%2C%2…) Below are the relevant portions of the proposed laws: * Section 3: Section 3 of the Income Tax Act is proposed to be amended by inserting the words highlighted: o (1). Subject to, and in accordance with this act, a tax to be known as income tax shall be charged each year of income upon all the income of a person, whetherresident or non-resident, which accrued in or was derived from Kenya o (2). Subject to this Act, income upon which tax is chargeable under this Act is income in respect of + A. Gains or profits from: # Any business, for whatever period of time carried on; # Any employment or services rendered; # Any right granted to any other person for use or occupation of property; + B. Dividends or interest + C. a pension, charge or annuity; ii. Any withdrawals from, or payments out of, a registered pension fund or a registered provident fund or a registered individual retirement fund; and (iii) any withdrawals from a registered home ownership savings plan + D.income chargeable to tax includes income accruing through a digital marketplace + e. ‘Digital marketplace’ means a platform that enables the direct interaction between buyers and sellers of goods and services through electronic means + E. AN amount deemed to be the income of any person under this Act or by rules made under this Act; + F. Gains accruing in the circumstances prescribed in, and computed in accordance with, the Eight Schedule + G. Subject to section 15(5A), the net gain derived on the disposal of an interest in a person, if the interest derives twenty per cent or more of its value, directly or indirectly, from immovable property in Kenya; and + H. A natural resource income * Section 5 of the Value Added Tax Act, 2013 is proposed to be amended by inserting the words highlighted o 1. A tax, to be known as the value added tax, shall be charged in accordance with the provisions of this Act on - + (a). A taxable supply made by a registered person in Kenya + b. The importation of taxable goods; and + c. The supply of taxable services o 2. The rate of tax shall be: + A. in the case of zero-rated supply, 0% or + In the case of goods listed in section B of the first schedule 8% + In any other case, 16% of the taxable value of the taxable supply, the value of imported taxable goods or the value of a supply of imported taxable services. o ...7. The provisions of subsection (1) shall be applicable to supplies made through a digital marketplace o 8. For the purposes of this section, a ‘digital marketplace’ means a platform that enables the direct interaction between buyers and sellers of goods and services through electronic means -- Best Regards, Ephraim Percy Kenyanito Digital Program Officer *ARTICLE 19 EASTERN AFRICA * *DEFENDING FREEDOM **OF EXPRESSION AND INFORMATION* W _https://www.article19.org/regional-office/eastern-africa/ _Tw @article19eafric Fa _facebook.com/article19org <http://facebook.com/article19org> _PGP Fingerprint: B0FA394AF73DEB7AA1FDC7360CFED26DE6BA8DC1

4 3

Fwd: [NRIs List] youth IGF Africa meeting 2019
by Barrack Otieno 07 Aug '19

07 Aug '19

Might be of interest to those who attended Kenya IGF. Regards ---------- Forwarded message --------- From: Mahamat Silim <silimof(a)gmail.com> Date: Wed, 7 Aug 2019, 3:23 pm Subject: [NRIs List] youth IGF Africa meeting 2019 To: <igfregionals(a)intgovforum.org> Dear all, It is great news that the coming African Internet Governance Forum (AfIGF-VIII) meeting will be held from 10-12 September 2019 in N’Djamena, Chad. The youth IGF Africa coordination has the great pleasure to invite all of you for the preparation of its coming event that will be held on 9th of September 2019 in N’Djamena. Therefore, the youth IGF Chad has been appointed as a focal point of this event. For the success of the initiative, please join the WhatsApp <https://chat.whatsapp.com/JrojZ0uHKzf105nekIp0hS> and google group <https://groups.google.com/forum/#!forum/youthigf-africa>. Best Regards, The Coordination -- - *President of United Nations Association of Chad (UNA-Chad) * - *2017-2018 Chadian Youth Delegate to the UN* - *Youth IGF Africa Coordinator* - *Co-Founder and Secretary-General of Chadian Medical Organization (OMT) * - *Member of ISOC- Chad* _______________________________________________ Igfregionals mailing list Igfregionals(a)intgovforum.org To unsubscribe or manage your options please go to http://intgovforum.org/mailman/listinfo/igfregionals_intgovforum.org

2 1

Digital-Nation Africa new and emerging technologies learning platform
by John Matogo 06 Aug '19

06 Aug '19

Dear colleagues , Have a look at this updated learning platform of Digital-Nation Africa. Available at: www.digitalnationafrica.com This release has new features: 1) Newly revamped Job Advisor tool available directly from the menu bar throughout the site with new advanced search capability and much improved UI/UX. 2) New Courses page available from the menu bar that includes list of all Digital-Nation Africa courses broken down by learning paths and journeys with easy navigation and search capability. 3) New look and feel UI/UX 4) updated chatbot virtual assistant along with the live support agent capability 5) a much improved and new "My Dashboard" with 3 tabs Skills, Tools and Jobs for users to see all their courses progress and badges earned, along with a Tools tab with access to a free Cloud account, Demos and Product trials. Also added is a Job bookmarking feature where a user can bookmark their favorite jobs from Job Advisor tool and view their bookmarked jobs on their Dashboard Jobs tab. 6) many new inspiration ideas in the Innovator Get Inspired page over 74 ideas 7) a brand new underlying architecture and design based on the latest microservices technology, multi-tenancy support, dynamic updates, easier content development platform, DevOps, performance improvements and much more. Check it out at www.digitalnationafrica.com It is available free of charge. BR. JM

1 0

Huduma Bill 2019
by Grace Githaiga 06 Aug '19

06 Aug '19

ListerS Has anyone come across any document that outlines what a good digital id law should look like? Here is Kenya's Huduma Bill 2019. http://www.hudumanamba.go.ke/wp-content/uploads/2019/07/12-07-2019-The-Hudu… There will an open public forum for public participation tomorrow (Wednesday) organized by the Ministry of Interior starting 9.00 am to 1.00 pm at the Kenya School of Government, Lower Kabete Campus, off Lower Kabete Road. Best regards Grace Githaiga -- Grace Githaiga Co-Convenor, Kenya ICT Action Network

7 7