- KICTANet - KICTANet

Friendly reminder: ICT End year review
by Liz Orembo 23 Jan '18

23 Jan '18

Greetings listers, This is another friendly reminder to those who haven't shared their views. Please fill out this simple questionnaire here. https://goo.gl/forms/kzk3MxrWgW4MIsdT2 This survey is part of a wider research evaluating the performance of the sector, and it will inform our engagements this year. Thanks to all who already took the survey. -- Best regards. Liz. PGP ID: 0x1F3488BF

1 0

Zuku can share your private data with strangers
by Wamathai (HapaKenya) 23 Jan '18

23 Jan '18

http://www.techweez.com/2018/01/17/zuku-gives-out-private-data/ >From experience, he says that when you use the Zuku customer care hotline and get on phone with a rep, they proceed to share personal details (Full name, residence, phone number and email) without verifying that the person they are sharing the information with is actually the customer in question.

2 1

Data Protection: We can innovate, leapfrog
by Nanjira Sambuli 23 Jan '18

23 Jan '18

Interesting work in India to enforce Data Protection. Useful reference for when we jumpstart that push for our own legislation, and it’s enforcement. http://m.deccanherald.com/?name=http://www.deccanherald.com/content/655018/… Data Protection: We can innovate, leapfrog About 27% of Indias population is still illiterate or barely literate. Most privacy policies and terms of services for web and mobile applications are in English and therefore it is only 10% of us who can actually read them before we provide our consent. Even if we can read them, we may not have the necessary legal training to understand them. According to a tweet thread by Pat Walshe (@privacymatters), the Tetris app, a popular video game, has a privacy policy that details the third-party advertising companies that they share data with. These third-parties include "123 Ad Networks; 13 Online Analytics companies; 62 Mobile Advertising Networks; 14 Mobile Analytics companies. The linked privacy policies for Tetris run to 407,000 words, compared to 450,000 words for the entire Lord of the Rings trilogy." The child aged four and above that plays the game and her parents need an intermediary to deal with the corporations hiding behind Tetris. Unlike the European Union, which has more than 37 years of history when it comes to data protection law, India is starting with a near blank slate after the Supreme Court confirmed that privacy is a constitutionally-guaranteed fundamental right in the Puttaswamy case judgement. While we would want to maintain adequacy and compatibility with the EU General Data Protection Regulation (GDPR) because it has become the global standard, we must realise that there is an opportunity for leapfrogging. This article attempts to introduce the reader to three different visions for intermediaries that have emerged within the Indian data protection debate around the accountability principle. I will also provide a brief sketch of an idea that we are developing at the Centre for Internet and Society. This is an incomplete list as there must be more proposals for regulatory innovation around the accountability principle that I am currently unaware of. n Account Aggregators: The India Stack ecosystem that has been built around the Aadhaar programme first proposed intermediaries called Account Aggregators. Account Aggregators manage consent artifacts. India Stack has traditionally been described as having four layers -- presenceless, paperless, cashless and consent. The consent layer is supposed to feature Account Aggregators. If, for example, a data subject wanting an insurance policy visits an insurance portal, the portal would collect personal information and a consent artifact from her and pass it on to multiple insurance companies. These insurance companies would send personalised bids to the portal, which would be displayed on a comparative grid to enable empowered selection. The data structure consent artifact has been provided in the Master Direction from RBI titled "Non-Banking Financial Company Account Aggregator Directions," published in September 2016. How does this work? The fields includes (i) identity and optional contact information; (ii) nature of the financial information requested; (iii) purpose; (iv) the identity of the recipients, if any; (v) URL/address for notifications when the consent artifact is used; (vi) consent artifact creation date, expiry date, identity and signature/digital signature of the Account Aggregator; and (vii) any other attribute as may be prescribed by the RBI. While Account Aggregators make it frictionless for the grant of consent and also for the harvesting of consent by data controllers, it does not make it easy for you to manage and revoke your consent. n Data Trusts: Most recently, Na.Vijayashankar, a Bengaluru-based cybersecurity and cyberlaw expert, has proposed intermediaries called Data Trusts registered with the regulator and who (i) will work as escrow agents for the personal data (which would be classified by type for different degrees of protection); (ii) will make privacy notices accessible by translating them into accessible language and formats; (iii) disclose data minimally to different data controllers based on the purpose limitation; (iv) issue tokens or pseudonymous identifiers and monetise the data for the benefit of the data subject. To ensure that Data Trusts truly protect the interests of the data subject, Vijayashankar proposes three requirements: (a) public performance reviews (b) audits by the regulator and (c) "an arms-length relationship with the data collectors." In his proposal, Data Trusts are firms with "the ability to process a real-time request from the data subject to supply appropriate data to the data collector." n Learned Intermediaries: The Takshashila Institution published a paper titled Beyond Consent: A New Paradigm for Data Protection, authored by Rahul Matthan, partner at the law firm Trilegal. Learned Intermediaries would perform mandatory audits on all data controllers above a particular threshold. Like Vijayashankar, Matthan also requires these intermediaries to be certified by an appropriate authority. The main harm that he focuses on is, bias or discrimination. He proposes three stages of audit which are designed for the age of Big Data and Artificial Intelligence: "(i) Database Query Review; (ii) Black Box Audits; and (iii) Algorithm Review". Matthan also tentatively considers a rating system. Learned Intermediaries are a means to address information asymmetry in the market by making data subjects more aware. The impact of churn on their bottom-lines, it is hoped, will force data controllers to behave in an accountable manner, protecting rights and mitigating harms. n Consent Brokers: Finally, I have proposed the model of a Consent Broker by modifying the concept of the Account Aggregator. Like the Account Aggregator proposal, we would want a competitive set of consent brokers who will manage consent artifacts for data subjects. However, I believe there should be a 1:1 relationship between data subjects and consent brokers so that the latter compete for the business of data subjects. Like Vijayashankar, I believe that the consent broker must have an "arms-length distance" from data controllers and must be prohibited from making any money from them. Consent brokers could also be trusted to take proactive actions for the data subjects, such as access and correction. The need of the hour is the production of regulatory innovations and robust discussions around them for all the nine privacy principles in the Justice AP Shah committee report -- notice, choice and consent, collection limitation, purpose limitation, access and correction, disclosure of information, security, openness and accountability. (The writer is Executive Director, Centre for Internet and Society, Bengaluru) Regards, Nanjira. Sent on the move.

1 0

Building Owners Impeding Telecom Services Roll-out Due To Lack Of Laws – Tom Makau
by Sidney Ochieng (princelySid) 23 Jan '18

23 Jan '18

Building Owners Impeding Telecom Services Roll-out Due To Lack Of Laws – Tom Makau https://tommakau.com/2018/01/21/building-owners-impeding-telecom-services-r… Lots of common sense suggestions here, the CA and ministry should take notes. Without the base infrastructure the Information Age we’re hoping to skip to will not come. 4G/wireless is not the answer to this countries connection needs, not with its caps or costs

4 4

Re: [kictanet] Kenya as a cryptocurrency center of excellence
by Nanjira Sambuli 22 Jan '18

22 Jan '18

This discussion could benefit greatly from this piece, juxtaposed against the real, urgent challenges in KE that could be addressed by the blockchain. Essentially about an ethos that would underlie any such centre, physical or intellectual: https://t.co/M3A8SYcTr8 Regards, Nanjira. Sent on the move. > On 20 Jan 2018, at 23:25, Mwendwa Kivuva <Kivuva(a)transworldafrica.com> wrote: > > Well put Mbugua. I came across this statement from the Switzerland where they have a vision to be a Crypto-Nation. Estonia too seem keen to be ahead. http://www.trustnodes.com/2018/01/19/switzerland-become- > > Good thing is, our ICT CS has stimulated the industry to think of how blockchain will benefit our society. > >> On Friday, 19 January 2018, Mbugua Njihia via kictanet <kictanet(a)lists.kictanet.or.ke> wrote: >> The Central Bank of Kenya with its measured and risk averse stance should be leading the charge, roping in the banks, microfinance institutions, telco’s and innovators to try find the best fit and possible use cases which have the potential to scale, become sustainable and benefit most from the properties and features that blockchain technology presents. Ama? >> Complete thought here - http://www.mbuguanjihia.com/business/kenya-cryptocurrency-center-excellence… >> >> Regards, >> Mbugua Njihia >> >> ᐧ > > > -- > ______________________ > Mwendwa Kivuva, Nairobi, Kenya > twitter.com/lordmwesh > > >

2 1

Re: [kictanet] KeNIC's OFFICIAL COMMUNICATION ON .KE DOMAINS SERVICE DISRUPTION EXPERIENCED ON FRIDAY 19TH JANUARY 2018
by Harry Delano 21 Jan '18

21 Jan '18

Hey Elly, Just a correction, on a light note. It's Listers, as opposed to 'listeners'.. While we appreciate this communication, there are a few disturbing issues I take note of in the brief from Kenic, and a clarification would suffice:- 1. Why would a module upgrade be carried out on a live registry database, literally throwing the entire country .KE space into a spin, for almost two days..? Was an offline upgrade test run conducted..? 2. Why did it take two days for this communique to be released, albeit much late in the day as chaos reigned..? 3. Any disaster recovery strategies in place, to mitigate such..? Any timelines..? Were laid protocols followed in this strategy..? Do we have a failover in place for the Registry..? 4. Any assessment of the impact of this outage,on the .KE space, technically and economically..? I believe most if not all stakeholders would shudder at &take great exception at such light handling of a major registry outage that's currently the backbone of the entire country's digital framework, considering the chaos that ensued in the aftermath. I honestly suggest all protocol be now put forward by Kenic to ensure the .KE space is urgently certified as a national security infrastructure. Harry On 19 Jan 2018 18:26, "Senior System Administrator via kictanet" < kictanet(a)lists.kictanet.or.ke> wrote: Dear Listeners, Kindly find attached the official communication from KeNIC offering apology and explanation on the cause and status of the .KE domains services disruption. Thank you. Kind Regards, ................................................... Elly Kadenyo Senior System Administrator snrsysadmin(a)kenic.or.ke +254 0720062293 _______________________________________________ kictanet mailing list kictanet(a)lists.kictanet.or.ke https://lists.kictanet.or.ke/mailman/listinfo/kictanet Twitter: http://twitter.com/kictanet Facebook: https://www.facebook.com/KICTANet/ Unsubscribe or change your options at https://lists.kictanet.or.ke/ mailman/options/kictanet/harry26001%40gmail.com The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development. KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.

2 2

CSOs AND BLOGGERS CALL FOR PARTICIPATION IN THE KICTANet ACCESS TO INFORMATION WORKSHOP
by mwara gichanga 21 Jan '18

21 Jan '18

Dear All, The Kenya ICT Action Network (KICTANet) in partnership with the Global Partners Digital(GPD), is organizing a one day workshop on 31st January on Access to Information. This is a training workshop targeting Civil Society Organizations and Bloggers. It will include the following:-1.How to request information. 2.Scope of the ATI act and gaps.3.How to access and use published information. If interested, kindly send an email to lizorembo(a)kictanet.or.ke and mwaragichanga(a)kictanet.or.ke, with details of your organization, title and blog site (for bloggers) Due to limited slots, we encourage you to register early as we will take the first applications. Please let us know if you have any queries. Warm Regards Mwara GichangaKICTANet Team

1 0

Kenya as a cryptocurrency center of excellence
by Mbugua Njihia 20 Jan '18

20 Jan '18

The Central Bank of Kenya with its measured and risk averse stance should be leading the charge, roping in the banks, microfinance institutions, telco’s and innovators to try find the best fit and possible use cases which have the potential to scale, become sustainable and benefit most from the properties and features that blockchain technology presents. Ama? Complete thought here - http://www.mbuguanjihia.com/business/kenya-cryptocurrency-center-excellence… *Regards,* Mbugua Njihia ᐧ

2 1

Government going for blockchain technology
by Bernard Kioko 20 Jan '18

20 Jan '18

This is good http://kenyanwallstreet.com/kenya-govt-sets-blockchain-artificial-intellige…

3 2

The reality of Mobile Money interoperability is finally here
by Ali Hussein 20 Jan '18

20 Jan '18

Listers Interesting development. The Telco sector with policy push from MOICT is finally testing interoperability of Mobile Money across Networks. This is a step in the right direction. This list has long advocated for this. It is gratifying to see that this is happening now. Kudos to MOICT and CS Mucheru for pushing this through. Kudos to the telcos for making it happen. I'm however curious as to the headline of the story:- Mobile Money deal spells doom to M-Pesa <https://businesstoday.co.ke/mobile-money-deal-spells-doom-m-pesa/> Interoperability may very well cement and increase M-Pesa's dominance in the space. This battle is not going to be won on the promise of withdrawing and sending money. Increasingly people want convenience beyond cash-outs and peer to peer transfers. The players who will win are those who understand and execute the following:- 1. Super Focus on the customer 2. A one stop shop Virtual Bank - Payments, deposits, savings etc. 3. Brand Equity built on the principle that the customer ALWAYS comes first. My sense is that the interoperability 'promise' for laggard brands will go the way of the Number Porting Promise. There is no short cut to succeeding in business and serving your customer with excellence. For those expecting the government to help them vanquish their business rivals they have a long way to wait.. The winner here is the customer. The price for the telcos and other mobile money service provider is that you now have a level playing field.. Sort of.. :-) *Ali Hussein* *Principal* *Hussein & Associates* Tel: +254 713 601113 Twitter: @AliHKassim Skype: abu-jomo LinkedIn: http://ke.linkedin.com/in/alihkassim <http://ke.linkedin.com/in/alihkassim> 13th Floor , Delta Towers, Oracle Wing, Chiromo Road, Westlands, Nairobi, Kenya. Any information of a personal nature expressed in this email are purely mine and do not necessarily reflect the official positions of the organizations that I work with.

4 3