- KICTANet - KICTANet

Vodafone denies Huawei Italy security risk
by Adam Lane 03 May '19

03 May '19

Dear Patrick Please note that Vodafone have responded to the inaccurate report from Bloomberg. The report is https://www.bbc.com/news/business-48103430 and copied below. You may also be interested in reading this report: https://www.zdnet.com/article/cisco-removed-its-seventh-backdoor-account-th… explaining that Cisco has already found seven “backdoors” into its equipment just this year alone. This is not a Huawei issue, or an espionage issue. It is a global ICT security issue that all companies are constantly struggling with. As you can read (or ask a technical expert), there are many bugs in many products (your apps on your phone are probably being updated on a weekly basis…) due to the nature of software development which are constantly being found and addressed; companies like Cisco and Huawei (along with customers like Vodafone) to the tests and find these (usually) before going to market (though sometimes afterwards) and address them urgently. I am not sure how this issue of bugs in software relates to multinationals illegally collecting and selling business insights. I am sure the local companies have just as many bugs in their software too, and all of us need to collaborate to address them, improve software development standards, and raise the bar. This is not a policy issue, it is a technical issue. You are certainly right that trust is good for business; unfortunately poor journalism such as that by Bloomberg which published before getting the “other side of the story” from Vodafone itself is not helping. I appreciate that you understand this, as you also referenced the ZDnet article which is much better reporting than Bloomberg, including Instead, Huawei says it was "technical flaws in equipment" which were fixed. "These were technical mistakes in our equipment, which were identified and corrected," the spokesperson said. 'The accepted definition of' backdoors' is deliberately built-in vulnerabilities that can be exploited -- these were not such. They were mistakes which were put right." Regards Adam https://www.bbc.com/news/business-48103430 Vodafone denies Huawei Italy security risk Vodafone has denied a report saying issues found in equipment supplied to it by Huawei in Italy in 2011 and 2012 could have allowed unauthorised access to its fixed-line network there. A Bloomberg report said that Vodafone spotted security flaws in software<https://www.bloomberg.com/news/articles/2019-04-30/vodafone-found-hidden-ba…> that could have given Huawei unauthorised access to Italian homes and businesses. The US refuses to use Huawei equipment for security reasons. However, reports suggest the UK may let the firm help build its 5G network. This is despite the US wanting the UK and its other allies in the "Five Eyes" intelligence grouping - Canada, Australia and New Zealand - to exclude the company. Australia and New Zealand have already blocked telecoms companies from using Huawei equipment in 5G networks, while Canada is reviewing its relationship with the Chinese telecoms firm. In a statement, Vodafone said: "The issues in Italy identified in the Bloomberg story were all resolved and date back to 2011 and 2012. "The 'backdoor' that Bloomberg refers to is Telnet, which is a protocol that is commonly used by many vendors in the industry for performing diagnostic functions. It would not have been accessible from the internet. "Bloomberg is incorrect in saying that this 'could have given Huawei unauthorised access to the carrier's fixed-line network in Italy'. "In addition, we have no evidence of any unauthorised access. This was nothing more than a failure to remove a diagnostic function after development. "The issues were identified by independent security testing, initiated by Vodafone as part of our routine security measures, and fixed at the time by Huawei." A Huawei spokesperson said: 'We were made aware of historical vulnerabilities in 2011 and 2012 and they were addressed at the time. "Software vulnerabilities are an industry-wide challenge. Like every ICT [information and communications technology] vendor, we have a well-established public notification and patching process, and when a vulnerability is identified, we work closely with our partners to take the appropriate corrective action." Several European telecoms operators are considering removing Huawei's equipment from their networks. But the firm's cyber-security chief, John Suffolk, has described the firm as "the most open [and] transparent company in the world". In January, Vodafone "paused" the deployment of Huawei equipment in its core networks in Europe until Western governments resolved their security concerns about the company. Huawei has been accused of being a potential security risk and of being controlled by the Chinese government - allegations it has always firmly denied. With the introduction of the 5G network in the UK approaching, telecoms operators say the way it would work, in a highly integrated system alongside 4G, means that excluding Huawei is not realistic without significant cost and delay, That would include potentially removing existing hardware, leading to the UK falling behind other countries. The company is the world's third-largest supplier of mobile phones, behind Samsung and Apple. Senior Director, Public Affairs Huawei Southern Africa Mobile: +254-7909-85886 Read Huawei Kenya’s First Ever Sustainability Report here<https://www.huawei.com/minisite/explore-kenya/pdf/huawei_kenya_csd_report.p…> From: kictanet [mailto:kictanet-bounces+adam.lane=huawei.com@lists.kictanet.or.ke] On Behalf Of Patrick A. M. Maina via kictanet Sent: Tuesday, April 30, 2019 8:59 PM To: Adam Lane <adam.lane(a)huawei.com> Cc: Patrick A. M. Maina <pmaina2000(a)yahoo.com> Subject: [kictanet] [Economic Espionage Risks] Vodafone has 'acknowledged' that it Found Hidden Backdoors in Huawei Equipment (but says the issues were resolved). Dear Listers, These kinds of global reports should concern Kenyan business CEOs and Boards in all sectors (as well as economic / technology policymakers) - unless Kenya has little or no interest in competing regionally or internationally to generate new streams of foreign exchange; and even then, are we able to protect our local "home turf" competitive advantage, should multinational actors decide to illegally collect and sell (or leverage) unfairly acquired local business insights, in order to give affiliated new entrants unfair advantage over local enterprises? These are legitimate and global policy concerns. If such things are happening in advanced, tech-savvy economies, what about here in Africa? Is the world having a party at our expense? Trust is good for business - but its is not wise to trust blindly. If we refuse to learn from others, or from history, it will be difficult for us to hand over to our children/youth a future that proves that we played our part responsibly as present-day custodians. We need to start thinking of our existence in less selfish terms: as a relay race, where it is our duty to ensure that we pass on a better future to our children/youth. Let's wake each other up. We must start BELIEVING in ourselves and LOVING ourselves so that our children can believe in, and love themselves as well. Excerpts below: ------------------------------- Reported by Bloomberg today (30th April 2019): "[Vodafone] identified hidden backdoors in the software that could have given Huawei unauthorized access to the carrier’s fixed-line network in Italy, a system that provides internet service to millions of homes and businesses, according to Vodafone’s security briefing documents from 2009 and 2011 seen by Bloomberg, as well as people involved in the situation. Vodafone asked Huawei to remove backdoors in home internet routers in 2011 and received assurances from the supplier that the issues were fixed, but further testing revealed that the security vulnerabilities remained, the documents show. Vodafone said Huawei then refused to fully remove the backdoor, citing a manufacturing requirement. The April 2011 document was authored by its Chief Information Security Officer at the time, Bryan Littlefair. 'What is of most concern here is that actions of Huawei in agreeing to remove the code, then trying to hide it, and now refusing to remove it as they need it to remain for ‘quality’ purposes,' Littlefair wrote. 'There’s no specific way to tell that something is a backdoor and most backdoors would be designed to look like a mistake,' said Stefano Zanero, an Associate Professor of Computer Security at Politecnico di Milano University. 'That said, the vulnerabilities described in the Vodafone reports from 2009 and 2011 have all the characteristics of backdoors: deniability, access and a tendency to be placed again in subsequent versions of the code,' he said. Vodafone also identified backdoors in parts of its fixed-access network known as optical service nodes, which are responsible for transporting internet traffic over optical fibers, and other parts called broadband network gateways, which handle subscriber authentication and access to the internet... In Vodafone’s case, the risks included possible third-party access to a customer's personal computer and home network, according to the internal documents. However, Vodafone’s account of the issue was contested by people involved in the security discussions between the companies. [who allege that] Vulnerabilities in both the routers and the fixed access network remained beyond 2012 and were also present in Vodafone’s businesses in the U.K., Germany, Spain and Portugal. Vodafone stuck with Huawei because the services were competitively priced, they said." Links: 1. Vodafone found Hidden Backdoors in Huawei Equipment https://www.bloomberg.com/news/articles/2019-04-30/vodafone-found-hidden-ba… 2. Huawei denies existence of ‘backdoors’ in Vodafone networking equipment https://www.zdnet.com/article/huawei-denies-existence-of-backdoors-in-vodaf… Best regards, Patrick. Patrick A. M. Maina [Cross-domain Innovator | Public Policy Analyst - Indigenous Innovations]

5 6

Re: [kictanet] ict practitioners bill is back
by Ali Hussein 02 May '19

02 May '19

Dear Bwana CS KICTANet NEVER asked KEPSA to handle engagements on our behalf. We engaged KEPSA to work as a team. Period. Never, did we abdicate our responsibilities to KEPSA because we are not KEPSA members. If KEPSA gave you that belief then I'm afraid that you were misled. And KEPSA should apologise for misleading you. *Ali Hussein* *Principal* *Hussein & Associates* Tel: +254 713 601113 Twitter: @AliHKassim Skype: abu-jomo LinkedIn: http://ke.linkedin.com/in/alihkassim <http://ke.linkedin.com/in/alihkassim> 13th Floor , Delta Towers, Oracle Wing, Chiromo Road, Westlands, Nairobi, Kenya. Any information of a personal nature expressed in this email are purely mine and do not necessarily reflect the official positions of the organizations that I work with. On Sun, Dec 17, 2017 at 4:53 PM, Joseph Mucheru via kictanet < kictanet(a)lists.kictanet.or.ke> wrote: > Ali Hussein, > > This is the reason I keep off this list. You are calling me a liar and yet > your team asked KEPSA to handle the engagements in this matter. > > With all respect going forward let's follow the agreed engagements between > government and private sector. > > Ahsante Sana! > > JM > > > On 17 Dec 2017 11:17, "Ali Hussein via kictanet" < > kictanet(a)lists.kictanet.or.ke> wrote: > > Bwana CS > > With all due respect. You are a senior government official and shouldn’t > peddle untruths. > > KICTANet HAS NEVER BEEN PART OF KEPSA. > > We have collaborated only once on the ICT BIll. Most of us don’t believe > KEPSA is representative of the wider ICT Industry. > > We welcome dialogue with your ministry and KEPSA on this. We are happy to > be included in the conversation. We however CANNOT endorse a dialogue and > discussions we are not party to. > > *Ali Hussein* > *Principal* > *Hussein & Associates* > +254 0713 601113 <+254%20713%20601113> > > Twitter: @AliHKassim > > Skype: abu-jomo > > LinkedIn: http://ke.linkedin.com/in/alihkassim > > "We are what we repeatedly do. Excellence, therefore, is not an act but a > habit." ~ Aristotle > > > Sent from my iPad > > On 17 Dec 2017, at 9:04 AM, Julius Njiraini via kictanet < > kictanet(a)lists.kictanet.or.ke> wrote: > > Digital forensic expert is involved in investigation of fraud, abuse, > embezzlement, larceny, conversion of any digital device, records and > process. The report is supposed to be presented in courtroom and testify as > expert witness. He is also supposed to corroborate evidence with other > segment of crime scene using relevant laws including evidence act, criminal > procedures code and cyber crime laws as best international laws in other > countries > On Dec 17, 2017 8:32 AM, "Julius Njiraini" <njiraini2001(a)gmail.com> wrote: > >> Thanks for your enlightenment. Am just concerned about new emerging >> fields like information security and forensics which is mainly concerned >> with digital cyber crime and evidence presentation in courtroom. These is >> especially concerns for computer security and forensics professionals >> On Dec 17, 2017 6:12 AM, "Joseph Mucheru via kictanet" < >> kictanet(a)lists.kictanet.or.ke> wrote: >> >>> The absence of dialogue and relying on media reports is a recipe for >>> discord. The current views, sentiments and concerns raised in the group are >>> justified only because there is no dialogue. Kicktanet is part of KEPSA >>> <https://kepsa.or.ke> who we are in constant dialogue even on this >>> topic. Going forward, the need to dialogue through the agreed channels is >>> key; >>> >>> So let me try and give a position on where we are; >>> >>> - I did state that we will need a Practitioners Bill and even >>> clarified to media it would not be the current one >>> - There is currently NO Bill in parliament. The last one lapsed and >>> we would need to start afresh >>> - The bill identified a need/gap in our sector that requires some >>> action, especially since ICT is at the heart of the Governments development >>> agenda >>> - The Industry was opposed with the method/solutions proposed by the >>> Bill but not the fact there is a gap >>> - Other Industries have self regulating bodies and if our sector is >>> to grow, we need to get organised and set this up. Why should government >>> have to do it? >>> - We are exporting our skills regionally and internationally and a >>> need to standardise and demonstrate our skills is key. This is because we >>> are not working in isolation, we are competing with other countries and >>> Kenya must be able to demonstrate consistent and quality skills -- today we >>> are blacklisted on various online jobs platforms because of a few bad >>> apples, while we know we have some of the best talents, we are also losing >>> tenders and business because we have not conformed to specific >>> international standards and so the rating of our products/services falls >>> short. (KBS is working on the standards) >>> >>> And for the accusations... >>> >>> - It was a private members bill and not sponsored by Government (We >>> opposed it in its current form - you know that, otherwise google it). >>> - Responding to questions from the sector does not amount to a >>> "roadside decision", considering the level of engagement we have had on >>> this issue >>> - The Government is there to serve the people of Kenya and not just >>> the sector in isolation >>> - Skills Rating systems used by platforms such as Kuhastle.com, >>> upwork.com., cloudfactory.com, monster.com..etc are examples of ways >>> people are able to build and demonstrate skills both technical and otherwise >>> - I have had engagements on this topic with KEPSA (ICT Sector >>> Committee <https://kepsa.or.ke/sector-comittees/>) - Mike Macharia >>> being the Chair >>> - I saw in social media many of you opposed to ICTAK >>> <http://www.ictak.or.ke/> being enjoined in the supreme court >>> presidential petition, but none came out (Kicktanet included) to >>> support/represent the sector, which was at the heart of the dispute. At the >>> very least ICTAK <http://www.ictak.or.ke/> was willing to come >>> forward. >>> - Similar to the Law Society, The Supreme Court should have chosen >>> the ICT experts from the ICT Industry body? >>> >>> My advice would be for the sector to take the lead and suggest how this >>> need/gap of* "SKILLS RATING" standards etc.. *can be addressed. We are >>> on the same side. If industry does not take the lead, then Government will >>> step in. As it stands, industry has various bodies and you need to agree on >>> how to engage amongst yourselves. We are going to be successful and so let >>> us push in the same direction. >>> >>> Finally, today the official engagement between government and the ICT >>> sector is through KEPSA <https://kepsa.or.ke/> . (KICTAnet, TESPOK, >>> KITOS etc.. are members and even when we engaged on the ICT Practitioners >>> bill, the sector was represented by KEPSA, when we met MPs). >>> >>> The last discussion on Tuesday 14th December 2017 between KEPSA and the >>> Ministry covered the following topics; >>> >>> 1. ICT Policy >>> 2. Kick-off Industry meetings >>> 3. Bills / Opinions - ICT Practitioners Bill >>> 4. PDTP <http://icta.go.ke/digitalent/> + Ajira Digital >>> <http://ajiradigital.go.ke/> (Jobs) >>> 5. Flagship Projects >>> 6. Constituency Development Hubs >>> <http://www.ict.go.ke/constituency-to-get-an-innovation-hub/> >>> 7. ICTA Engagement with Counties >>> 8. Enterprise Kenya >>> 9. Blockchain >>> >>> Thank you! >>> >>> On Sun, Dec 17, 2017 at 3:07 AM, Andrew Alston via kictanet < >>> kictanet(a)lists.kictanet.or.ke> wrote: >>> >>>> Hi All, >>>> >>>> >>>> >>>> So – having seen an article in the standardmedia in which elements of >>>> what I stated below were quoted – and to which there seem to have been >>>> responses – I now need to comment further: >>>> >>>> >>>> >>>> (Article found at: https://www.standardmedia.co.k >>>> e/business/article/2001263257/techies-oppose-move-to-introdu >>>> ce-new-ict-watchdog) >>>> >>>> >>>> >>>> >>>> >>>> *Mucheru, however, denies that the Bill will lock out experts without >>>> formal training insisting the reverse will be the case. “This Bill will >>>> benefit the people who have been working in technical capacity for years >>>> but have not acquired certificates,” he explained. “If they can demonstrate >>>> their proficiency to the Institute then they can get certified and widen >>>> the scope of jobs they can bid or apply for.” * >>>> >>>> So – I have a question – What will be the method of demonstrating >>>> proficiency and how will this be tested – and what will it cost – and how >>>> long will it take. >>>> >>>> >>>> >>>> Now – let me break the questions down a bit >>>> >>>> >>>> >>>> 1. The ICT field is vast – are you going to test proficiency in >>>> programming? In networking? In security? In database administration? In >>>> desktop support? In Linux? Freebsd? Microsoft? Solaris? AIX? What is the >>>> test going to be – and who is going to administer these tests >>>> 2. What makes an industry body more capable of testing proficiency >>>> than Cisco, Juniper, Huawei or any of the other vendors – the bill does * >>>> *NOT** cater for industry standard certification outside of formal >>>> education – it simply is not in there – and if you are not going to accept >>>> these and are going to have this industry body determine proficiency – we >>>> need to know how this will be done and how the people testing proficiency >>>> will be qualified to do it – and in what fields they are qualified to test >>>> proficiency. >>>> 3. What is the cost of this testing of proficiency – does an >>>> individual who has certified as a CCIE at the cost of thousands – and in >>>> some cases tens of thousands – of dollars suddenly need to pay more to >>>> demonstrate something that he has clearly already demonstrated? Who will it >>>> be paid for? How will the money be utilized? Will this be included in the >>>> license fee for the first year? Or will this suddenly cost extra so >>>> someone can make some money? >>>> 4. How does does it take to “demonstrate proficiency” – and if I >>>> bring in someone from outside to train my staff in a new field of >>>> technology – is he going to be made to sit some kind of exam? Or pay some >>>> kind of fee before he can upskill Kenyans? Because – lets be real – that is >>>> not going to happen – it will be the death of bringing in people to impart >>>> knowledge. >>>> >>>> >>>> >>>> Let me be blunt – more than half the authors of the RFC’s within the >>>> IETF would not qualify under the bill as it stands – this means they would >>>> have to “demonstrate” their proficiency – despite the fact that they have >>>> their names on Internet standards – and if people expect these individuals >>>> to sit exams or prove to people that they know what they are doing – >>>> despite the knowledge having been clearly demonstrated (which is why they >>>> are being flown in in the first place, to train Kenyans in skills that are >>>> not available in the country so that those Kenyans can continue to further >>>> upskill and lift up the industry) – you can kiss goodbye to having cutting >>>> edge people coming into this country – it simply won’t happen – and it will >>>> be Kenya that loses out. >>>> >>>> >>>> >>>> Then to comment on this: >>>> >>>> >>>> >>>> >>>> >>>> *Mucheru adds that the Government has held several engagements with >>>> practitioners in the sector on the provisions of the Bill. * >>>> >>>> Correct – there was massive engagement – and the bill was largely >>>> defeated after the industry said it was broken – after people on this list >>>> said it was broken – after it was slammed left right and centre – so yes – >>>> there was engagement – but the article is wrong about the fact that the >>>> engagement agreed that this bill in its current form was a good idea or >>>> represented the correct solution. >>>> >>>> >>>> >>>> >>>> >>>> *“There was consensus that we need to establish a professional body to >>>> regulate the industry,” he said. * >>>> >>>> I have no problem with the concept of a professional body – I have >>>> major problems with forcing a situation where people who have potentially >>>> decades of experience have to suddenly “prove” their skills via some >>>> entirely undefined means at some undefined cost to a bunch of people who >>>> may or may not have anywhere close to the experience or knowledge of the >>>> person being tested. If we said that we had a professional body that people >>>> could register to – and they needed to be registered – and in the event of >>>> *substantiated* complaints the individual could be deregistered and >>>> blacklisted – I would have no problem. It is the arbitrary and >>>> unsubstantiated and undefined criteria for registration that I take >>>> exception to – and that I believe could result in expensive legal >>>> challenges. >>>> >>>> >>>> >>>> Please – do not get me wrong – I do not begrudge anyone who has a >>>> desire to genuinely root out the bad apples and clean up the industry and >>>> remove scam artists and fraudsters. I think that is a noble and pure >>>> objective that should be pursued. I however dispute the fact that this >>>> bill is the right way to go about it – and I dispute the fact that >>>> university degrees have anything to do with competence in this industry – >>>> particularly with the rate that technology evolves – because an individual >>>> doing a 3 year degree who is learning specific technologies in his first >>>> year – by the time he graduates – those technologies are history – and when >>>> he walks into the industry – he is having to self study it all again >>>> ANYWAY. Let me give you examples of technologies that did not exist a year >>>> ago in any real form: >>>> >>>> >>>> >>>> 1. Segment routing – the foundation of network routing going >>>> forward and the replacement to MPLS – how do I know this – because I’ve had >>>> my hands in crafting the specifications and doing a lot of the beta testing >>>> for it – so who is going to test proficiency here – it changes the game – >>>> and the only people qualified to teach it – or gauge the proficiency in it >>>> – do not themselves qualify under this bill to be registered. >>>> 2. Network telemetry processing – first introduced in limited form >>>> in Q3 2015 – and only now becoming main stream – but within a year of it >>>> being main stream – it will replace standard network monitoring entirely – >>>> who is going to teach that with a university degree? >>>> 3. Which university degree teaches BGP? BGP-LU? ISIS? Network >>>> segmentation? IPv6 addressing? >>>> >>>> >>>> >>>> The list is endless – these are things that cannot be learnt through a >>>> degree – they are learnt through industry standard certification or >>>> self-skilling by reading documentation. >>>> >>>> >>>> >>>> So, Mr Mucheru – please – do not read me wrong – I have tremendous >>>> respect for the regulator in this country – and it is testament to how well >>>> the Kenyan industry and the regulatory environment here works that today – >>>> Kenya has higher average mobile broadband speeds than either the US or >>>> South Africa or a lot of other places. It is testament to the regulatory >>>> environment here that we have the high-speed networks we do – and that the >>>> pricing is as low as it is – because the industry is competitive and open >>>> and innovative. This list of things the regulator has gotten right in this >>>> country is long - I do however plead with you, the bill as it stands would >>>> break the industry that all of us – yourself – myself – and so many others >>>> have worked so hard to build. I am NOT against a professional body – I am >>>> NOT against formalizing things – but I beg you – do not walk down the road >>>> of this current bill in its current form – it will be death to this >>>> industry in this country. >>>> >>>> >>>> >>>> Andrew Alston >>>> >>>> >>>> >>>> >>>> >>>> *From: *Andrew Alston <Andrew.Alston(a)liquidtelecom.com> >>>> *Date: *Monday, 4 December 2017 at 01:24 >>>> *To: *KICTAnet ICT Policy Discussions <kictanet(a)lists.kictanet.or.ke> >>>> *Cc: *Liz Wanjiru <lizwanjiru(a)gmail.com> >>>> *Subject: *RE: [kictanet] ict practitioners bill is back >>>> >>>> >>>> >>>> I have to say – personally I cannot think of a worse piece of >>>> legislation that I have seen in recent history. >>>> >>>> >>>> >>>> Let us look at the net effects of this and the problems with it: >>>> >>>> >>>> >>>> 1. Large companies bring in consultants or external people where >>>> necessary to supplement capacity, to train and upskill Kenyan staff etc, >>>> while those guys are here, even for a week or two, they are compensated, >>>> and my reading of this bill is – this would be illegal – because you’d have >>>> to get every consultant you bring in accredited and licensed first – which >>>> is impractical in the extreme >>>> 2. The list of highly skilled people with 20+ years experience who >>>> would not qualify for accreditation under this bill is extensive, globally >>>> and within Kenya – this bill completely stops any form of knowledge >>>> transfer from those individuals and in fact will force a situation where >>>> Kenyan’s who wish to learn from some of the biggest names in the industry >>>> would be forced to go internationally to get that knowledge, rather than >>>> bringing those people in to train locally >>>> 3. It forces Kenyans who have spent years learning and honing their >>>> skills without university qualifications out of work and could well result >>>> in large scale job losses looking at the number of highly skilled >>>> individuals I know of who are working without qualifications >>>> 4. It prevents private companies from making what are normal >>>> business decisions – who they hire and who they pay. That is problematic >>>> in the extreme – in any normal situation if a private company hires staff >>>> that don’t perform – those staff either get fired or the market rejects the >>>> company and the company disappears – standard market dynamics – in this >>>> case – if a company finds extremely talented people they may be forced into >>>> a position where they have to hire less skilled people because someone >>>> can’t meet some accreditation requirement. >>>> 5. The bill has no recognition of prior experience – no recognition >>>> of those who have published papers and are world recognized experts – does >>>> not specify what the “recognized” universities are – does not take into >>>> account industry standard certification (CISSP/CCNA/CCIE/CCDP/JNCIE/JNCIP/JNCIA, >>>> the list is endless) >>>> 6. May well end up in the constitutional court when it deprives a >>>> host of people who have spent their lives working in this industry and have >>>> no other options for a career of the ability to earn a living >>>> >>>> >>>> >>>> The bill relies on the belief that a university qualification some how >>>> makes you better than those without – it’s reasoning that has been >>>> disproved globally for years and years and years – and it flies in the face >>>> of the global industry and the way the ICT industry has worked since the >>>> day it began. It is damaging to the industry in Kenya – it is damaging to >>>> the growth prospects of the economy as a result – it is damaging to the >>>> people of Kenya – and it will destroy the position that Kenya is in as one >>>> of the leaders of the ICT industry on the continent (Kenya already has the >>>> highest average broadband speeds on the continent and significantly better >>>> ICT infrastructure than you will find even in South Africa – it is doing so >>>> well – why break a system that is proving functional?) >>>> >>>> >>>> >>>> I really hope this does not pass – and if it does – will be curious to >>>> see the court challenges and how they play out – but I think this is >>>> madness personally – and in the name of stopping a few bad individuals – >>>> penalizes the entire country and will destroy an industry that employs >>>> thousands. >>>> >>>> >>>> >>>> Andrew >>>> >>>> >>>> >>>> >>>> >>>> *From:* kictanet [mailto:kictanet-bounces+andrew.alston= >>>> liquidtelecom.com(a)lists.kictanet.or.ke] *On Behalf Of *Liz Wanjiru via >>>> kictanet >>>> *Sent:* 04 December 2017 06:43 >>>> *To:* Andrew Alston <Andrew.Alston(a)liquidtelecom.com> >>>> *Cc:* Liz Wanjiru <lizwanjiru(a)gmail.com> >>>> *Subject:* Re: [kictanet] ict practitioners bill is back >>>> >>>> >>>> >>>> Hi, >>>> >>>> >>>> >>>> While trying to push such laws shouldn't they be looking at >>>> credentialing people without formal ICT schooling but have the experience, >>>> knowledge and skills to back them? These people have talent and positively >>>> contribute in the industry. Some countries have learning institutions >>>> credentialing professionals based on their body of work and so long as they >>>> can demonstrate this they are awarded the degrees or other government >>>> approved certifications. Here is an example of such >>>> >>>> >>>> >>>> Link >>>> <http://www.ara.ac.nz/study-options/centre-for-assessment-of-prior-learning-…> >>>> >>>> >>>> >>>> >>>> >>>> Liz >>>> >>>> >>>> >>>> On Mon, Dec 4, 2017 at 3:18 PM, Ahmed Mohamed Maawy via kictanet < >>>> kictanet(a)lists.kictanet.or.ke> wrote: >>>> >>>> I wonder how some of the ground breaking technology companies - such as >>>> for instance Google Kenya, can operate if this bill is passed. >>>> >>>> >>>> >>>> On Sun, Dec 3, 2017 at 4:57 PM, Watila Alex via kictanet < >>>> kictanet(a)lists.kictanet.or.ke> wrote: >>>> >>>> EricKigada: Kenya’s controversial ICT Practitioners Bill 2016 to be tabled in parliament again >>>> >>>> techmoran.com/kenyas-controv… >>>> >>>> https://twitter.com/EricKigada/status/937309893954031616 >>>> >>>> >>>> >>>> Sent from Yahoo Mail on Android >>>> <https://overview.mail.yahoo.com/mobile/?.src=Android> >>>> >>>> >>>> >>>> _______________________________________________ >>>> kictanet mailing list >>>> kictanet(a)lists.kictanet.or.ke >>>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >>>> Twitter: http://twitter.com/kictanet >>>> Facebook: https://www.facebook.com/KICTANet/ >>>> >>>> Unsubscribe or change your options at https://lists.kictanet.or.ke/m >>>> ailman/options/kictanet/ultimateprogramer%40gmail.com >>>> >>>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >>>> for people and institutions interested and involved in ICT policy and >>>> regulation. The network aims to act as a catalyst for reform in the ICT >>>> sector in support of the national aim of ICT enabled growth and development. >>>> >>>> KICTANetiquette : Adhere to the same standards of acceptable behaviors >>>> online that you follow in real life: respect people's times and bandwidth, >>>> share knowledge, don't flame or abuse or personalize, respect privacy, do >>>> not spam, do not market your wares or qualifications. >>>> >>>> >>>> >>>> >>>> >>>> -- >>>> >>>> *Ahmed Maawy* >>>> Head of Corporate Products - Al Jazeera Media Network >>>> Skype: ultimateprogramer >>>> >>>> >>>> _______________________________________________ >>>> kictanet mailing list >>>> kictanet(a)lists.kictanet.or.ke >>>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >>>> Twitter: http://twitter.com/kictanet >>>> Facebook: https://www.facebook.com/KICTANet/ >>>> >>>> Unsubscribe or change your options at https://lists.kictanet.or.ke/m >>>> ailman/options/kictanet/lizwanjiru%40gmail.com >>>> >>>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >>>> for people and institutions interested and involved in ICT policy and >>>> regulation. The network aims to act as a catalyst for reform in the ICT >>>> sector in support of the national aim of ICT enabled growth and development. >>>> >>>> KICTANetiquette : Adhere to the same standards of acceptable behaviors >>>> online that you follow in real life: respect people's times and bandwidth, >>>> share knowledge, don't flame or abuse or personalize, respect privacy, do >>>> not spam, do not market your wares or qualifications. >>>> >>>> >>>> >>>> >>>> >>>> -- >>>> >>>> >>>> >>>> Kind Regards >>>> >>>> Liz Wanjiru >>>> >>>> >>>> >>>> _______________________________________________ >>>> kictanet mailing list >>>> kictanet(a)lists.kictanet.or.ke >>>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >>>> Twitter: http://twitter.com/kictanet >>>> Facebook: https://www.facebook.com/KICTANet/ >>>> >>>> Unsubscribe or change your options at https://lists.kictanet.or.ke/m >>>> ailman/options/kictanet/joe%40mucheru.com >>>> >>>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >>>> for people and institutions interested and involved in ICT policy and >>>> regulation. The network aims to act as a catalyst for reform in the ICT >>>> sector in support of the national aim of ICT enabled growth and development. >>>> >>>> KICTANetiquette : Adhere to the same standards of acceptable behaviors >>>> online that you follow in real life: respect people's times and bandwidth, >>>> share knowledge, don't flame or abuse or personalize, respect privacy, do >>>> not spam, do not market your wares or qualifications. >>>> >>>> >>> >>> >>> -- >>> Joseph Mucheru E.G.H >>> *Cabinet Secretary* >>> Ministry of Information Communications & Technology (ICT) >>> >>> >>> _______________________________________________ >>> kictanet mailing list >>> kictanet(a)lists.kictanet.or.ke >>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >>> Twitter: http://twitter.com/kictanet >>> Facebook: https://www.facebook.com/KICTANet/ >>> >>> Unsubscribe or change your options at https://lists.kictanet.or.ke/m >>> ailman/options/kictanet/njiraini2001%40gmail.com >>> >>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >>> for people and institutions interested and involved in ICT policy and >>> regulation. The network aims to act as a catalyst for reform in the ICT >>> sector in support of the national aim of ICT enabled growth and development. >>> >>> KICTANetiquette : Adhere to the same standards of acceptable behaviors >>> online that you follow in real life: respect people's times and bandwidth, >>> share knowledge, don't flame or abuse or personalize, respect privacy, do >>> not spam, do not market your wares or qualifications. >>> >>> _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > Twitter: http://twitter.com/kictanet > Facebook: https://www.facebook.com/KICTANet/ > > Unsubscribe or change your options at https://lists.kictanet.or.ke/m > ailman/options/kictanet/info%40campusciti.com > > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > > > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > Twitter: http://twitter.com/kictanet > Facebook: https://www.facebook.com/KICTANet/ > > Unsubscribe or change your options at https://lists.kictanet.or.ke/m > ailman/options/kictanet/joe%40mucheru.com > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > > > > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > Twitter: http://twitter.com/kictanet > Facebook: https://www.facebook.com/KICTANet/ > > Unsubscribe or change your options at https://lists.kictanet.or.ke/ > mailman/options/kictanet/info%40alyhussein.com > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > >

19 37

Blockchain in Agriculture
by Erick Mwangi 01 May '19

01 May '19

Gartner, Inc. predicts that, by 2025, 20% of the top 10 global grocers by revenue will be using blockchain for food safety and traceability to create visibility. Being an Agri country i would imagine similar conversations would take center stage. Its quite here re Blockchain. Eric

1 0

[Economic Espionage Risks] Vodafone has 'acknowledged' that it Found Hidden Backdoors in Huawei Equipment (but says the issues were resolved).
by Patrick A. M. Maina 30 Apr '19

30 Apr '19

Dear Listers, These kinds of global reports should concern Kenyan business CEOs and Boards in all sectors (as well as economic / technology policymakers) - unless Kenya has little or no interest in competing regionally or internationally to generate new streams of foreign exchange; and even then, are we able to protect our local "home turf" competitive advantage, should multinational actors decide to illegally collect and sell (or leverage) unfairly acquired local business insights, in order to give affiliated new entrants unfair advantage over local enterprises? These are legitimate and global policy concerns. If such things are happening in advanced, tech-savvy economies, what about here in Africa? Is the world having a party at our expense? Trust is good for business - but its is not wise to trust blindly. If we refuse to learn from others, or from history, it will be difficult for us to hand over to our children/youth a future that proves that we played our part responsibly as present-day custodians. We need to start thinking of our existence in less selfish terms: as a relay race, where it is our duty to ensure that we pass on a better future to our children/youth. Let's wake each other up. We must start BELIEVING in ourselves and LOVING ourselves so that our children can believe in, and love themselves as well. Excerpts below: ------------------------------- Reported by Bloomberg today (30th April 2019): "[Vodafone] identified hidden backdoors in the software that could have given Huawei unauthorized access to the carrier’s fixed-line network in Italy, a system that provides internet service to millions of homes and businesses, according to Vodafone’s security briefing documents from 2009 and 2011 seen by Bloomberg, as well as people involved in the situation. Vodafone asked Huawei to remove backdoors in home internet routers in 2011 and received assurances from the supplier that the issues were fixed, but further testing revealed that the security vulnerabilities remained, the documents show. Vodafone said Huawei then refused to fully remove the backdoor, citing a manufacturing requirement. The April 2011 document was authored by its Chief Information Security Officer at the time, Bryan Littlefair. 'What is of most concern here is that actions of Huawei in agreeing to remove the code, then trying to hide it, and now refusing to remove it as they need it to remain for ‘quality’ purposes,' Littlefair wrote. 'There’s no specific way to tell that something is a backdoor and most backdoors would be designed to look like a mistake,' said Stefano Zanero, an Associate Professor of Computer Security at Politecnico di Milano University. 'That said, the vulnerabilities described in the Vodafone reports from 2009 and 2011 have all the characteristics of backdoors: deniability, access and a tendency to be placed again in subsequent versions of the code,' he said. Vodafone also identified backdoors in parts of its fixed-access network known as optical service nodes, which are responsible for transporting internet traffic over optical fibers, and other parts called broadband network gateways, which handle subscriber authentication and access to the internet... In Vodafone’s case, the risks included possible third-party access to a customer's personal computer and home network, according to the internal documents. However, Vodafone’s account of the issue was contested by people involved in the security discussions between the companies. [who allege that] Vulnerabilities in both the routers and the fixed access network remained beyond 2012 and were also present in Vodafone’s businesses in the U.K., Germany, Spain and Portugal. Vodafone stuck with Huawei because the services were competitively priced, they said." Links: 1. Vodafone found Hidden Backdoors in Huawei Equipmenthttps://www.bloomberg.com/news/articles/2019-04-30/vodafone-found-… 2. Huawei denies existence of ‘backdoors’ in Vodafone networking equipment https://www.zdnet.com/article/huawei-denies-existence-of-backdoors-in-vodaf… Best regards,Patrick. Patrick A. M. Maina [Cross-domain Innovator | Public Policy Analyst - Indigenous Innovations]

1 0

Online discussion on State of Broadband - Policy day
by Mwendwa Kivuva 30 Apr '19

30 Apr '19

Thank you Listers, we have had a great debate so far. There are so many issues that have remained hanging on the first thread. I hope we can continue debate on those issues, and tie the loose ends. We will move on to broadband policies. Here is a brief background. Kenya enacted a National Broadband Strategy in 2013. This was updated to the Draft National Broadband Strategy 2023 <https://ca.go.ke/public-consultation-on-the-national-broadband-strategy-for…> that takes into account recent technological, industry trends and market realities. The Draft strategy went through public participation in March 2019. It covers; Infrastructure and connectivity, Content services and applications, Policy - regulations and Legislation, Capacity building and innovations, Broadband devices, Finance and investment, Privacy and Security, Role of stakeholders in expanding broadband penetration, Governance and delivery framework. The outcome of the public participation has not been released to the public by the National Broadband Strategy Steering Committee. We hope to get an update on that. We also have the ICT Policy 2006, and the yet to be ratified Draft ICT policy 2016. The ICT policy should be the overarching policy on which the other policies in the sector branch from. Probably we will get an explanation on how new ICT related strategies are being drafted without an updated ICT policy. This leads to the following questions: 1. How is the sector regulated and what complimentary policies are in place? 2. What complimentary laws and regulations are in place that either stifle, or promote broadband? 3. How is the business environment for those who want to venture into provision of broadband services? 4. What policy interventions can be put in place to promote broadband uptake? Looking forward to a great policy day. Sincerely, ______________________ Mwendwa Kivuva

4 7

Online discussion on State of Broadband in Kenya
by Mwendwa Kivuva 29 Apr '19

29 Apr '19

Dear Listers, As notified last week, we are conducting an assessment on the state of play and impact of broadband in Kenya, broadly looking at the socio-economic impact on consumers, businesses and various sectors like agriculture, education, healthcare, finance and government. We are looking at real life examples of impact of broadband, challenges we face in increasing impact of broadband and recommendations on interventions needed to address the challenges identified. For this discussion, we define broadband as any fast internet. Fast enough to serve your intended purpose. We can have an extended definition through the discussion. Some of the questions we should answer are: 1. What is the current state of broadband in Kenya? What is the current coverage of broadband in Kenya? Do you have broadband internet in your area? How affordable is the available broadband? 2. What barriers are there in increasing impact of broadband in Kenya? 3. What recommendations can counter the barriers identified in increasing impact of broadband? Looking forward to a grrat debate. Sincerely, ______________________ Mwendwa Kivuva

18 26

[fyi] Mozilla's 2019 Internet Health Report is out. A "must read" source of context and ideas for all ICT stakeholders.
by Patrick A. M. Maina 28 Apr '19

28 Apr '19

Dear Listers, Mozilla's Internet Health Report (2019) presents a human-centric perspective on the current state of the internet. It also offers excellent recommendations on how to make the internet work positively for all stakeholders i.e. private sector, Government and the general public. The report is a "must read" source of context and ideas for all stakeholders interested in having a holistic perspective of emerging 21st Century public-interest issues. Here are some excerpts from the executive summary (published on Mozilla's blog): "The digital environment is a complex ecosystem, just like the planet we live on... The internet has the potential both to uplift and connect us. But it also has the potential to harm and tear us apart... we need to step up and do something if we want the digital world to net out as a positive for humanity rather than a negative... The good news is that more and more people are dedicating their lives to creating a healthier, more humane digital world. This Report is designed to be both a reflection and resource for this kind of work. It is meant to offer technologists and designers inspiration about what they might build; to give policymakers context and ideas for the laws they need to write; and, most of all, to provide citizens and activists with a picture of where others are pushing for a better internet, in the hope that more and more people around the world will push for change themselves. Ultimately, it is by more and more of us doing something in our work and our lives that we will create an internet that is open, human and humane." Please read, engage and share widely within your networks. Thank you! Links: 1. Executive Summary: https://blog.mozilla.org/blog/2019/04/23/its-complicated-mozillas-2019-inte… 2. Mobile Friendly Sitehttps://internethealthreport.org/2019/ 3. The 2019 Internet Health Report (Short Version) https://d20x8vt12bnfa2.cloudfront.net/2019/2019InternetHealthReport_shortve… Brgds,Patrick. Patrick A. M. Maina[Cross-domain Innovator | Independent Public Policy Analyst - Indigenous Innovations]

1 0

Tanzania to limit SIM cards to one per network
by Victor Kapiyo 27 Apr '19

27 Apr '19

Interesting developments in Tanzania. Looks like biometric registration programmes have now become vogue for any initiative from government that calls for registration, and it's not just happening in Kenya with our Huduma Number. _____ Tanzania plans to limit the number of mobile phone numbers an individual can own to a single line per network, in its bid to boost security and tame cybercrime. This will involve a fresh biometric registration of all SIM card holders from May 1 to September. Subscribers have to present their national identification card or its number for registration. According to the sector regulator, the current system is not secure enough and lacks important subscriber details that are vital for the national identity card registration initiated two years ago. https://www.theeastafrican.co.ke/business/Tanzania-to-limit-SIM-cards-to-on…

1 0

Smart Cities Books - Free Downloads
by Bitange Ndemo 26 Apr '19

26 Apr '19

Here are two books from UNESCO on Smart Cities - Very good reads and available for free. https://netexplo.com/notebooks/ Ndemo.

3 2

Huduma Namba Questions
by Grace Bomu 25 Apr '19

25 Apr '19

Listers, There are reports that huduma number data in Machakos County has gone missing. See http://dailyactive.info/2019/04/22/huduma-namba-data-go-missing-in-machakos/ and subsequent reports of arrests and investigations on the matter https://www.kahawatungu.com/2019/04/23/machakos-huduma-namba-registration-a… On asking around, it appears that huduma namba kits use micro SD cards which when full are taken to the Assistant or County Commissioners Office for copying (onto NIIMS?). Got me wondering whether use of SD cards is the practice across the country and the implications for data security and integrity with this method. Other questions I still have from observing the exercise is what the real objective of data collection is. It appears that most adults (with ID cards) may already have had their data in different registries related. I am assuming that this is how eCitizen and IPRS works. And then the question of integrity/accuracy of data when a person gives data about other people eg spouses. Will there be opportunity to know what data is held about me? Would be great to have this explained. Regards, -- Grace Mutung'u Skype: gracebomu @Bomu PGP ID : 0x33A3450F

3 2