- KICTANet - KICTANet

Re: [kictanet] #KeIGF15 Online Discussions Day Five: Emerging Issues
by Barrack Otieno 24 Jul '15

24 Jul '15

Listers, This topic attempts to provide the space to discuss a variety of emerging issues in the Internet space. Question 1. The mandate of WSIS, a meeting of the UN that took place in 2005 in Tunis is coming to an end. The WSIS process gave birth to the Internet Governance Forum (IGF) which is up for renewal at end of this year. >From IGF discussions, there are no concrete proposals to form a permanent UN body for Internet governance. However, the discussions have borne many policies or “soft laws” that have guided relationships various stakeholders. Should the mandate of WSIS be extended for a further 10 years? 2. Should the government of Kenya support a renewal of WSIS? 3. Are there any other emerging issues that the Kenyan Internet Community should pay attention to? The floor is open

1 0

Re: [kictanet] #KeIGF15 Online Discussions Day Three: Internet Economy
by meshack 23 Jul '15

23 Jul '15

We have to admit that the principles and policies of the past have been changed by a revolution (digital revolution) middle men in markets are slowly being thrown to the rare as a end consumer. Time aa a factor in distribution and product delivery, processing has been reduced and the once necesary documentations required in commerce are mostly eliminated. All these as cool as it is has been intergrated into a world were financial services are more founded and targeted to a particular spcial class and tjerefore a sense of security that is much needed to a uninformed consumer is limited to those who are educated or in other words the socially politically and economically aware population. Yes we cannot blame anyone, just the market forces aligning to a most favourable conditions that guarantees success and competitiveness rather than having the services as a social development utility. Sent from Samsung Mobile -------- Original message -------- From: Gideon via kictanet <kictanet(a)lists.kictanet.or.ke> Date: 22/07/2015 12:03 (GMT+03:00) To: memakunat(a)yahoo.com Cc: Gideon <gideonrop(a)gmail.com> Subject: [kictanet] #KeIGF15 Online Discussions Day Three: Internet Economy Listers, First it will be good to know if the government has enough data on the eCommerce environment in Kenya. Thereafter such a study, it will be possible to create a better revenue analysis model that will allow the taxman to benefit at the same time enabling the govt to create a conducive environment to encourage and catalyze the Internet economy. Regards Gideon Rop Hi Barrack, Thank you for the the questions. @ Fred on the issue of taxation for the Internet economy.... I was listening to a representative from Jumia the other day on radio. By her presentation, the volume of merchandise moved per day is quite high and this business is really catching on in Kenya. If I remember they had an increase of 900%in turnover in Africa. While they warn that the high sales have not yet translated into profit, the whole business model is interesting and at some point the government will want a share of the profits. The same will happen to the cloud economy and other Internet businesses, if what happened in Chicago is anything to go by. However, more needs to be done on consumer education and protection. For example, when one buys a phone online and it is faulty, should the online company collect, repair or replace the phone or should the consumer take the phone to the service centre? Consumer protection can either be done through self regulation where the online companies make very good policies on dealing with consumer complaints. Otherwise , the companies cannot be responsive, then the law/its enforcement must be strengthened. Regards, 2015-07-22 7:42 GMT+03:00 Barrack Otieno via kictanet < kictanet(a)lists.kictanet.or.ke>: > Listers, > > The rise of the Internet economy in Kenya has been defined by > different strokes. On one hand there are small entrepreneurs doing > their side hustles from offices, small shops and car boots. They > advertise their merchandise and services on social media and in a > rudimentary form, some deliver merchandise in backpacks from door to > door. > Enter the bigger players who have large websites from where goods and > services are purchased. Their business models differ. We have > companies like OLX, Cheki that provide a platform for users to > interact. They make their money from advertising. Others such as Rupu > and Jumia offer services and merchandise at reduced prices. > > Questions > > 1. Does an adequate legal framework exist to protect consumers from > fraud, deficient goods and services and to assure consumer rights in > the budding Internet economy? > 2. Since the bigger players in the sector are doing well, is time ripe > for the local Internet economy to be taxed to raise money for > government services? > 3. Should other services in the Internet economy such as cloud > services, international online purchases etc be taxed? > 4. As a stakeholder , what are your recommendations on how the > Internet economy can be improved? > > The floor is open, feel free to continue contributing to the > discussions of the previous days. > > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > > Unsubscribe or change your options at > https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

1 0

Publication Review
by ANGEL A 23 Jul '15

23 Jul '15

Dear Listers, I wish to express my appreciation to all the members who participated in my online survey for my Masters Thesis in June 2014 through the Survey Monkey tool. When l was seeking for your participation, l promised to share the results of my findings which l already did. Today, l share an article l co-authored with my supervisors that was based on very Masters Thesis and which has been accepted for publication by an online journal, ProCon Ltd. I have attached the link herewith for your review and would be grateful to read your comments on the issues raised.Thank you. Cybersecurity Strategy’s Role in Raising Kenyan Awareness of Mobile Internet Threats | Procon Ltd. Information & Security: An International Journal | | | | | | | | | | | Cybersecurity Strategy’s Role in Raising Kenyan Awarenes...Publication Type: Journal article preview Authors: Angela Okuku; Karen Renaud; Brandon Valeriano Source: Information & Security: An International Journal, Volu... | | | | View on procon.bg | Preview by Yahoo | | | | | Best regards,Angela. Chevening Alumni. Sent By Mia Ang

1 0

Russia passes law to promote their local software iindustry
by ICT Researcher 23 Jul '15

23 Jul '15

In support of Russian software developers when executingpublic (state or municipal) procurement, the Federal Law N 188-FZ"On Amendments to the Federal Law 'On Information,Information Technologies and Protection of Information'"and Article 14 of the Federal Law "On the contract system inthe sphere of procurement of goods, works and services for stateand municipal needs" was adopted on June 29, 2015 (hereinafter- the "Law"). The Law will come into force on January 1,2016. The Law provides for the creation of a unified register ofRussian computer programs and databases (hereinafter - the"Register of Russian software"). read more: Software Import Substitution: Recent News - Media, Telecoms, IT, Entertainment - Russian Federation | | | | | | | | | | | Software Import Substitution: Recent News - Media, Telec...The Law provides for the creation of a unified register of Russian computer programs and databases (hereinafter - the Register of Russian software). Russian Federat... | | | | View on www.mondaq.com | Preview by Yahoo | | | | |

1 0

Re: [kictanet] [Security Forum] #KeIGF15 Online Discussions Day Three: Internet Economy
by Barrack Otieno 23 Jul '15

23 Jul '15

Many thanks Josiah, First congratulations for the 5th edition of Pivot East Africa and for the good work you are doing, just following the discussion on the Global Entrepreneurship Summit i feel proud of how far the local tech sector has come and the role communities such as skunkworks of which you are among the founder members and the i-hub have done. Back to the discussion your intervention is timely, there is need for a Consumer Protection act and i am aware COFEK has been working on a draft bill, they are on this list and we hope they will be able to provide highlights on the stage at which the bill is in. Best Regards On 7/23/15, Josiah Mugambi <jmugambi(a)gmail.com> wrote: > Wading in one day late on this particular discussion topic, but for good > reason. > > Yesterday we held the 5th edition of Pivot East <http://www.pivoteast.com>, > a regional pitching competition for digital startup companies from East > Africa. Digital entrepreneurs as one might imagine are those that run > mobile and web based or enabled businesses, and are a core part of the > internet economy. Not surprisingly, on average, the most accomplished > companies were in the financial sector. This is a sector where policy tends > to lag behind innovation (think MPESA, crypto currencies and the burgeoning > young companies beginning to play in that space across Africa). One key > question that was asked multiple times by the judges, majority of whom were > investors, was related to consumer protection and legislation for some of > these services. > > I would say that we don't have a strong enough legal framework the governs > some of these new frontiers. However, there must be a healthy tension > between the need to protect consumers from unscrupulous business people > while encouraging innovative uses of technology. With regards to taxing the > internet economy, don't we have corporate taxes that apply across the > board? I don't think it is big enough either especially as many of these > bigger players are already paying taxes as it stands. On stuff like cloud > services, we need to be wary of double taxation as many services > particularly from the US are already taxed. > > > > > -- > Josiah Mugambi > > On Wed, Jul 22, 2015 at 3:55 PM, fredrick Wahome via Security < > security(a)lists.my.co.ke> wrote: > >> Unfortunately those in the leadership will just draft something when it >> deems appropriate time for them without involving the stakeholders n end >> users. >> >> The document will just sit at CA shelves and life goes on. For now am >> concentrating on educating users how to be safe. >> On Jul 22, 2015 11:46 AM, "Grace Mutung'u (Bomu) via Security" < >> security(a)lists.my.co.ke> wrote: >> >>> Hi Barrack, >>> Thank you for the the questions. >>> @ Fred on the issue of taxation for the Internet economy.... >>> >>> I was listening to a representative from Jumia the other day on radio. >>> By >>> her presentation, the volume of merchandise moved per day is quite high >>> and >>> this business is really catching on in Kenya. If I remember they had an >>> increase of 900%in turnover in Africa. While they warn that the high >>> sales >>> have not yet translated into profit, the whole business model is >>> interesting and at some point the government will want a share of the >>> profits. The same will happen to the cloud economy and other Internet >>> businesses, if what happened in Chicago is anything to go by. >>> >>> However, more needs to be done on consumer education and protection. For >>> example, when one buys a phone online and it is faulty, should the >>> online >>> company collect, repair or replace the phone or should the consumer take >>> the phone to the service centre? >>> Consumer protection can either be done through self regulation where the >>> online companies make very good policies on dealing with consumer >>> complaints. Otherwise , the companies cannot be responsive, then the >>> law/its enforcement must be strengthened. >>> >>> Regards, >>> >>> >>> 2015-07-22 7:42 GMT+03:00 Barrack Otieno via kictanet < >>> kictanet(a)lists.kictanet.or.ke>: >>> >>>> Listers, >>>> >>>> The rise of the Internet economy in Kenya has been defined by >>>> different strokes. On one hand there are small entrepreneurs doing >>>> their side hustles from offices, small shops and car boots. They >>>> advertise their merchandise and services on social media and in a >>>> rudimentary form, some deliver merchandise in backpacks from door to >>>> door. >>>> Enter the bigger players who have large websites from where goods and >>>> services are purchased. Their business models differ. We have >>>> companies like OLX, Cheki that provide a platform for users to >>>> interact. They make their money from advertising. Others such as Rupu >>>> and Jumia offer services and merchandise at reduced prices. >>>> >>>> Questions >>>> >>>> 1. Does an adequate legal framework exist to protect consumers from >>>> fraud, deficient goods and services and to assure consumer rights in >>>> the budding Internet economy? >>>> 2. Since the bigger players in the sector are doing well, is time ripe >>>> for the local Internet economy to be taxed to raise money for >>>> government services? >>>> 3. Should other services in the Internet economy such as cloud >>>> services, international online purchases etc be taxed? >>>> 4. As a stakeholder , what are your recommendations on how the >>>> Internet economy can be improved? >>>> >>>> The floor is open, feel free to continue contributing to the >>>> discussions of the previous days. >>>> >>>> _______________________________________________ >>>> kictanet mailing list >>>> kictanet(a)lists.kictanet.or.ke >>>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >>>> >>>> Unsubscribe or change your options at >>>> https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com >>>> >>>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >>>> for people and institutions interested and involved in ICT policy and >>>> regulation. The network aims to act as a catalyst for reform in the ICT >>>> sector in support of the national aim of ICT enabled growth and >>>> development. >>>> >>>> KICTANetiquette : Adhere to the same standards of acceptable behaviors >>>> online that you follow in real life: respect people's times and >>>> bandwidth, >>>> share knowledge, don't flame or abuse or personalize, respect privacy, >>>> do >>>> not spam, do not market your wares or qualifications. >>>> >>> >>> >>> >>> -- >>> Grace L.N. Mutung'u >>> Nairobi Kenya >>> Skype: gracebomu >>> Twitter: @Bomu >>> >>> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >>> >>> >>> _______________________________________________ >>> Security mailing list >>> Security(a)lists.my.co.ke >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>> >> >> _______________________________________________ >> Security mailing list >> Security(a)lists.my.co.ke >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >> > -- Barrack O. Otieno +254721325277 +254-20-2498789 Skype: barrack.otieno http://www.otienobarrack.me.ke/

1 0

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Grace Mutung'u (Bomu) 23 Jul '15

23 Jul '15

Thank you everyone for the enriching contributions.Without cybersecurity, users cannot be assured when transacting online. A special mention to the security experts who have interesting and practical views to the cybersecurity issues. We may need to seek more information from those in bodies such as ICTA, from experts who helped to set up the systems as well as from private sector. Would be interesting to hear how banks achieve security, especially with Internet and mobile banking. The issue of mobile money payments will be part of our discussion tomorrow as we tackle "the Internet Economy". The discussions on all the topics remain open so please continue on. We shall pick all the recommendations and suggestions and present them to stakeholders during the IGF. Hopefully, some of them will find their way into policy and use in our institutions. Once again thank you. Regards, Grace 2015-07-21 18:11 GMT+03:00 Lesley Leposo via Security < security(a)lists.my.co.ke>: > @fredrick > Good point. > I can see why they would use open source software, other than it being > free. > But, my point of view only makes sense if the GOK, businesses and > universities also fostered/sponsored some (moderately) experienced COMODO > tinkerers/hackers. > > On Jul 21, 2015, at 5:55 PM, fredrick Wahome via Security < > security(a)lists.my.co.ke> wrote: > > This far we can say they have tried but one thing I don't understand with > government system is the implementation. Is it that hard or their is some > laxity. With PKI in place most departments are still using FREE systems > like COMODO. But again as a loyal citizen I stopped complaining and just > doing the bit I can even if its sharing information.. > On Jul 21, 2015 5:29 PM, "Mwendwa Kivuva via Security" < > security(a)lists.my.co.ke> wrote: > >> Sorry, here is the website for the Certifying Authority for Kenya's PKI >> http://www.govca.go.ke/# >> >> ______________________ >> Mwendwa Kivuva, Nairobi, Kenya >> >> "There are some men who lift the age they inhabit, till all men walk on >> higher ground in that lifetime." - Maxwell Anderson >> >> >> On 21 July 2015 at 16:56, Mwendwa Kivuva <Kivuva(a)transworldafrica.com> >> wrote: >> >>> Hosea Kandie and Fredick Wahome have raised very important points of >>> institutional frameworks. I just wanted to share the National PKI website >>> which has a tonne of information on what Kenya has done in that regard. >>> http://www.ke-cirt.go.ke/index.php/services/national-pki/ >>> >>> Here is a copy paste from the home page: >>> >>> Kenya’s National Public Key Infrastructure (NPKI) >>> >>> The National Public Key Infrastructure (NPKI) project is coordinated by >>> the Ministry of ICT in collaboration with the Communications Authority of >>> Kenya (CA) and the ICT Authority (ICTA). >>> >>> A Public Key Infrastructure (PKI) refers to a system for the creation, >>> storage and distribution of digital certificates which are used to verify >>> that a particular public key (online identity) belongs to a certain entity. >>> A PKI is a technical infrastructure that comprises of a Root Certification >>> Authority (RCA) and a Certification Authority (CA), referred to as an >>> Electronic Certification Service Provider (E-CSP) in Kenya’s legal and >>> regulatory framework. The PKI creates a framework for protecting >>> communications and stored information from unauthorized access and >>> disclosure by addressing the fundamentals of cyber security – >>> confidentiality, integrity, authentication and non-repudiation. A PKI is >>> key to the rollout of e-transaction services. >>> >>> The Kenya Information and Communications Act, 1998, mandates the >>> Communications Authority of Kenya (CA) to issue a license to a person >>> operating an Electronic Certification Service. In this regard, the >>> Communications Authority of Kenya (CA) has developed a licensing framework >>> for Electronic Certification Service Providers (E-CSPs). >>> >>> Kenya’s National PKI comprises of a Root Certification Authority (RCA), >>> which is managed by the Communication Authority of Kenya (CA) as a >>> regulatory function, and the Government Certification Authority (GCA), an >>> E-CSP which is managed by the ICTA. The NPKI is instrumental towards the >>> effectiveness of the licensing of Electronic Certification Service >>> Providers (E-CSPs) by the Communications Authority since a licensed E-CSP >>> must be accredited by the RCA for its digital certificates to be globally >>> recognized and trusted. >>> >>> The ICT Authority (ICTA), which is the body responsible for the >>> management of the mainstream government ICT services, operates the GCA. >>> Other interested stakeholders who may be issued with an E-CSP license on >>> application include the banking Sector and the Academia. >>> >>> The benefits of a National PKI include: >>> i. Locally available and cheaper digital certificates/signatures; and >>> ii. Operations and services that are within Kenyan law >>> (jurisdiction), among others. >>> >>> ______________________ >>> Mwendwa Kivuva, Nairobi, Kenya >>> >>> "There are some men who lift the age they inhabit, till all men walk on >>> higher ground in that lifetime." - Maxwell Anderson >>> >>> >>> On 21 July 2015 at 11:02, fredrick Wahome via Security < >>> security(a)lists.my.co.ke> wrote: >>> >>>> The fact that there is high internet penetration in Africa / Kenya >>>> where an average of one user for every five has access to affordable >>>> internet has created enabling environment for cyber-criminals. >>>> >>>> By the nature of cyberspace where the perpetrators of cyber-crime >>>> remain ubiquitous. This necessitated a need for legislation to control >>>> crime, and to provide confidence and security in African cyberspace, >>>> leading to the drafting of the Africa Union Convention on Cybersecurity >>>> (AUCC). But some groups like CIPIT and civil society opposed the convention >>>> on the ground that it was prepared without their inputs. Their main >>>> argument is that the convention did not make enough provisions to protect >>>> privacy and freedom of speech. >>>> >>>> Member States have to undertake necessary measures to encourage >>>> the establishment of institutions that exchange information on cyber >>>> threats and the evaluation of vulnerabilities such as Computer >>>> Emergency Response Team (CERT). Kenya has at least done something on this >>>> by establishing KE-CIRT at CA. There is also a masterplan and PKI in place >>>> thou there has been implementation challenges. We will note that most >>>> governments departments have not yet established cybersecurity departments >>>> and this leads to low / lack of budgetary allocation. >>>> >>>> In summary Government bodies, policy networks, scholars, the media, >>>> technology experts and the people need to engage in a global conversation >>>> that will help demystify Cyber-crime and define what it constitutes of and >>>> how Cyber-criminals should be dealt with. >>>> >>>> The role of the media (television, blogs, online news outlets and more) >>>> is critical in the process of educating the public and engaging in a >>>> conversation, as they will be the mediators and curators of information and >>>> discourse on the issue. Thus, a concise and sensible approach, devoid of >>>> fear-mongering and shock practices, should be followed. We all remember >>>> recently how media has mishandled cyber crime news without a very somber >>>> deep analysis >>>> >>>> Since this is an international issue, governments and policy networks >>>> across the world have to come together and discuss openly on what is better >>>> for their citizens. Something like AUCC is a positive move by African states >>>> >>>> Scholars and academics can provide valuable expertise on technological, >>>> psychological, ethical and other issues, while highlighting any misgivings >>>> by those involved in the process. At least Strathmore has tried on this >>>> >>>> The people in their local communities, families and social networks >>>> should help and train each other to increase their peers’ level of Internet >>>> literacy and highlight the advantages of the web. A higher Internet >>>> literacy level can help people protect themselves even better by taking >>>> simple security measures, such as using anti-virus software and identifying >>>> potential risks or scams in their online financial transactions. More is >>>> needed from the technology community to provide awareness to end users even >>>> if through probono program. >>>> >>>> The technology community needs a unity of purpose. Looking at >>>> programmers / developers, DBA, network admins, infosec there has been lack >>>> of proper coordination. Developers are working hard to prove that their >>>> products cant be broken. Infosec on the other hand are working so hard to >>>> prove to blue team / developers that they can break their products. At the >>>> end no one benefit from such a contest. Many technical conferences / >>>> seminars should be encouraged to enable sharing of information / knowledge >>>> in the local technology community. >>>> >>>> Great day comrades. >>>> >>>> >>>> >>>> >>>> >>>> >>>> On Tue, Jul 21, 2015 at 9:28 AM, Stephen Munguti via Security < >>>> security(a)lists.my.co.ke> wrote: >>>> >>>>> Hello all, >>>>> >>>>> I think most of our security concerns stem from internal users and >>>>> this is the reason many banks and telecos refuse to part with this >>>>> information, i could be wrong though >>>>> >>>>> On Tue, Jul 21, 2015 at 8:58 AM, Grace Mutung'u (Bomu) via skunkworks >>>>> <skunkworks(a)lists.my.co.ke> wrote: >>>>> >>>>>> Dear Listers, >>>>>> >>>>>> >>>>>> Kenya has had its fair share of high profile cyber threats, hacking >>>>>> etc, the latest being the alleged compromise of the IFMIS system at >>>>>> NYS/Ministry of Devolution. The country and Africa at large is making >>>>>> efforts to assure cyber-security. These include among others her >>>>>> involvement in the Africa Union Convention on Cybercrime and a proposal for >>>>>> a Cybercrime law, an initiative led by the Office of the Director of Public >>>>>> Prosecutions. Significant financial resources have also been earmarked by >>>>>> government for security and cyber security in particular. There are also >>>>>> partnerships between government and private sector in deploying >>>>>> cybersecurity centres. >>>>>> >>>>>> The private sector has employed practical measures to protect their >>>>>> businesses. However, businesses such as mobile money providers and banks >>>>>> have been shy to divulge their cyber security concerns to protect their >>>>>> interests. >>>>>> >>>>>> Civil society on the other hand has raised concern about the line >>>>>> between protecting the cyber space and creating a facilitative environment >>>>>> for innovators as well as protecting the rights of users. >>>>>> >>>>>> >>>>>> Are our efforts at deterring cyber-crime the correct way to assure >>>>>> cyber security? Are fears about a partnership between government and >>>>>> private sector and the general fears about stifling innovation and human >>>>>> rights in the name of cybersecurity legitimate? Are there other practical >>>>>> approaches that different stakeholders can take to enhance cyber security? >>>>>> >>>>>> >>>>>> Over to you. >>>>>> >>>>>> -- >>>>>> Grace L.N. Mutung'u >>>>>> Nairobi Kenya >>>>>> Skype: gracebomu >>>>>> Twitter: @Bomu >>>>>> >>>>>> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >>>>>> >>>>>> >>>>>> _______________________________________________ >>>>>> skunkworks mailing list >>>>>> skunkworks(a)lists.my.co.ke >>>>>> ------------ >>>>>> List info, subscribe/unsubscribe >>>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>>>>> ------------ >>>>>> >>>>>> Skunkworks Rules >>>>>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>>>>> ------------ >>>>>> Other services @ http://my.co.ke >>>>>> >>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> Best Regards, >>>>> Stephen Munguti. >>>>> >>>>> +254720425104 >>>>> >>>>> _______________________________________________ >>>>> Security mailing list >>>>> Security(a)lists.my.co.ke >>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >>>> >>>> >>>> >>>> -- >>>> >>>> >>>> >>>> >>>> *-------------------------------------* >>>> *Kind Regards**;* >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: >>>> www.secunets.com <http://www.secunets.com/>Cell: +254725264890 >>>> <%2B254725264890>Email: fred(a)secunets.com <fred(a)secunets.com>**Facebook: >>>> secunetstech* >>>> *Twitter: @secunets* >>>> >>>> *Skype: secunets.technologiesExperts in: *Domain Registration, Web >>>> Hosting, Open Source Solutions, Information Security & Training, Digital >>>> Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. >>>> >>>> *"Secure Business Technology"* >>>> >>>> >>>> >>>> ------------------------------------------------------------------------------------------------------------------------------------------------ >>>> *SECUNETS TECHNOLOGIES DISCLAIMER:* >>>> >>>> This email message and any file(s) transmitted with it is intended >>>> solely for the individual or entity to whom it is addressed and may contain >>>> confidential and/or legally privileged information which confidentiality >>>> and/or privilege is not lost or waived by reason of mistaken transmission. >>>> If you have received this message by error you are not authorized to view >>>> disseminate distribute or copy the message without the written consent of >>>> Secunets Technologies and are requested to contact the sender by telephone >>>> or e-mail and destroy the original. Although Secunets Technologies takes >>>> all reasonable precautions to ensure that this message and any file >>>> transmitted with it is virus free, Secunets Technologies accepts no >>>> liability for any damage that may be caused by any virus transmitted by >>>> this email. >>>> >>>> >>>> _______________________________________________ >>>> Security mailing list >>>> Security(a)lists.my.co.ke >>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>> >>> >>> >> >> _______________________________________________ >> Security mailing list >> Security(a)lists.my.co.ke >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >> > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security > > > > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security > -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

4 3

Re: [kictanet] [Security Forum] #KeIGF15 Online Discussions Day Three: Internet Economy
by Barrack Otieno 23 Jul '15

23 Jul '15

Many thanks Fred and Grace for contributing to the discussion thread. We welcome more input from colleagues as we move along. A while back i came across information that COFEK was working on a Consumer protection act similar to the South African one. It would be good to know where they reached or got stuck. The Communications Authority had also launched a series of campaigns to protect consumers which seem to have slowed down after the organization re-branded. However it would be usefull to know the impact such initiatives made in the sector as well. It is my hope that we can get an update from COFEK on the progress made with the bill. Thank you Best Regards On 7/22/15, fredrick Wahome <frewah85(a)gmail.com> wrote: > Unfortunately those in the leadership will just draft something when it > deems appropriate time for them without involving the stakeholders n end > users. > > The document will just sit at CA shelves and life goes on. For now am > concentrating on educating users how to be safe. > On Jul 22, 2015 11:46 AM, "Grace Mutung'u (Bomu) via Security" < > security(a)lists.my.co.ke> wrote: > >> Hi Barrack, >> Thank you for the the questions. >> @ Fred on the issue of taxation for the Internet economy.... >> >> I was listening to a representative from Jumia the other day on radio. By >> her presentation, the volume of merchandise moved per day is quite high >> and >> this business is really catching on in Kenya. If I remember they had an >> increase of 900%in turnover in Africa. While they warn that the high >> sales >> have not yet translated into profit, the whole business model is >> interesting and at some point the government will want a share of the >> profits. The same will happen to the cloud economy and other Internet >> businesses, if what happened in Chicago is anything to go by. >> >> However, more needs to be done on consumer education and protection. For >> example, when one buys a phone online and it is faulty, should the online >> company collect, repair or replace the phone or should the consumer take >> the phone to the service centre? >> Consumer protection can either be done through self regulation where the >> online companies make very good policies on dealing with consumer >> complaints. Otherwise , the companies cannot be responsive, then the >> law/its enforcement must be strengthened. >> >> Regards, >> >> >> 2015-07-22 7:42 GMT+03:00 Barrack Otieno via kictanet < >> kictanet(a)lists.kictanet.or.ke>: >> >>> Listers, >>> >>> The rise of the Internet economy in Kenya has been defined by >>> different strokes. On one hand there are small entrepreneurs doing >>> their side hustles from offices, small shops and car boots. They >>> advertise their merchandise and services on social media and in a >>> rudimentary form, some deliver merchandise in backpacks from door to >>> door. >>> Enter the bigger players who have large websites from where goods and >>> services are purchased. Their business models differ. We have >>> companies like OLX, Cheki that provide a platform for users to >>> interact. They make their money from advertising. Others such as Rupu >>> and Jumia offer services and merchandise at reduced prices. >>> >>> Questions >>> >>> 1. Does an adequate legal framework exist to protect consumers from >>> fraud, deficient goods and services and to assure consumer rights in >>> the budding Internet economy? >>> 2. Since the bigger players in the sector are doing well, is time ripe >>> for the local Internet economy to be taxed to raise money for >>> government services? >>> 3. Should other services in the Internet economy such as cloud >>> services, international online purchases etc be taxed? >>> 4. As a stakeholder , what are your recommendations on how the >>> Internet economy can be improved? >>> >>> The floor is open, feel free to continue contributing to the >>> discussions of the previous days. >>> >>> _______________________________________________ >>> kictanet mailing list >>> kictanet(a)lists.kictanet.or.ke >>> https://lists.kictanet.or.ke/mailman/listinfo/kictanet >>> >>> Unsubscribe or change your options at >>> https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com >>> >>> The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform >>> for people and institutions interested and involved in ICT policy and >>> regulation. The network aims to act as a catalyst for reform in the ICT >>> sector in support of the national aim of ICT enabled growth and >>> development. >>> >>> KICTANetiquette : Adhere to the same standards of acceptable behaviors >>> online that you follow in real life: respect people's times and >>> bandwidth, >>> share knowledge, don't flame or abuse or personalize, respect privacy, >>> do >>> not spam, do not market your wares or qualifications. >>> >> >> >> >> -- >> Grace L.N. Mutung'u >> Nairobi Kenya >> Skype: gracebomu >> Twitter: @Bomu >> >> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >> >> >> _______________________________________________ >> Security mailing list >> Security(a)lists.my.co.ke >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >> > -- Barrack O. Otieno +254721325277 +254-20-2498789 Skype: barrack.otieno http://www.otienobarrack.me.ke/

1 0

#KeIGF15 Online Discussions Day Three: Internet Economy
by Gideon 22 Jul '15

22 Jul '15

Listers, First it will be good to know if the government has enough data on the eCommerce environment in Kenya. Thereafter such a study, it will be possible to create a better revenue analysis model that will allow the taxman to benefit at the same time enabling the govt to create a conducive environment to encourage and catalyze the Internet economy. Regards Gideon Rop Hi Barrack, > Thank you for the the questions. > @ Fred on the issue of taxation for the Internet economy.... > > I was listening to a representative from Jumia the other day on radio. By > her presentation, the volume of merchandise moved per day is quite high and > this business is really catching on in Kenya. If I remember they had an > increase of 900%in turnover in Africa. While they warn that the high sales > have not yet translated into profit, the whole business model is > interesting and at some point the government will want a share of the > profits. The same will happen to the cloud economy and other Internet > businesses, if what happened in Chicago is anything to go by. > > However, more needs to be done on consumer education and protection. For > example, when one buys a phone online and it is faulty, should the online > company collect, repair or replace the phone or should the consumer take > the phone to the service centre? > Consumer protection can either be done through self regulation where the > online companies make very good policies on dealing with consumer > complaints. Otherwise , the companies cannot be responsive, then the > law/its enforcement must be strengthened. > > Regards, > > > 2015-07-22 7:42 GMT+03:00 Barrack Otieno via kictanet < > kictanet(a)lists.kictanet.or.ke>: > > > Listers, > > > > The rise of the Internet economy in Kenya has been defined by > > different strokes. On one hand there are small entrepreneurs doing > > their side hustles from offices, small shops and car boots. They > > advertise their merchandise and services on social media and in a > > rudimentary form, some deliver merchandise in backpacks from door to > > door. > > Enter the bigger players who have large websites from where goods and > > services are purchased. Their business models differ. We have > > companies like OLX, Cheki that provide a platform for users to > > interact. They make their money from advertising. Others such as Rupu > > and Jumia offer services and merchandise at reduced prices. > > > > Questions > > > > 1. Does an adequate legal framework exist to protect consumers from > > fraud, deficient goods and services and to assure consumer rights in > > the budding Internet economy? > > 2. Since the bigger players in the sector are doing well, is time ripe > > for the local Internet economy to be taxed to raise money for > > government services? > > 3. Should other services in the Internet economy such as cloud > > services, international online purchases etc be taxed? > > 4. As a stakeholder , what are your recommendations on how the > > Internet economy can be improved? > > > > The floor is open, feel free to continue contributing to the > > discussions of the previous days. > > > > _______________________________________________ > > kictanet mailing list > > kictanet(a)lists.kictanet.or.ke > > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > > > > Unsubscribe or change your options at > > > https://lists.kictanet.or.ke/mailman/options/kictanet/nmutungu%40gmail.com > > > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > > for people and institutions interested and involved in ICT policy and > > regulation. The network aims to act as a catalyst for reform in the ICT > > sector in support of the national aim of ICT enabled growth and > development. > > > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > > online that you follow in real life: respect people's times and > bandwidth, > > share knowledge, don't flame or abuse or personalize, respect privacy, do > > not spam, do not market your wares or qualifications. > > > > > > -- > Grace L.N. Mutung'u > Nairobi Kenya > Skype: gracebomu > Twitter: @Bomu > > <http://www.diplointernetgovernance.org/profile/GraceMutungu> >

1 0

Re: [kictanet] Anonymous hacks Kenya Defence Forces Twitter account
by Liz Orembo 22 Jul '15

22 Jul '15

Listers, For the day 2 KeIGF online discussion on Cyber Security and Trust, allow me to take you back to last year KICTANet's thread when anonymous Kenya hacked KDF Twitter accounts. Key issues were raised with no follow ups. 1.The govt not consulting local talent which has skills and capacity and 2. appreciation of digital security risks by various industries. It seems like nothing much has changed. How do we take it forward? On Mon, Jul 21, 2014 at 8:22 PM, John Kariuki via kictanet < kictanet(a)lists.kictanet.or.ke> wrote: > Matunda,Listers, > You are right.Breaches on cyber security need serious attention. > > The ICT Policy in 2006 summarized the matter as follows: > > "Electronic Security: The challenge is for the country to establish an > adequate legal framework and capacity to deal with national > security,network security,cyber-crime and cyber-terrorism; and to establish > mechanisms for international cooperation to combat cross-border crimes.An > e-security structure will be developed in collaboration with the relevant > institutions." > Since 2006, matters the situation has become even worse than envisaged at > that time due to increasing use of on-line services and Broadband Networks. > > John Kariuki > > > On Monday, 21 July 2014, 17:38, Matunda Nyanchama via kictanet < > kictanet(a)lists.kictanet.or.ke> wrote: > > > > On this score, I have made some observations: > > - our people don't take seriously such breaches; I read an attitude of > this sort: "it is a small irritant that will come." This is especially so > for the public sector but also (to a small extent) private sector. Indeed, > organizations like banks can afford to underwrite huge losses through > marginal variation in interest rates. > > - there is no concerted effort to develop needed skills in this area in > order to tackle/forestall such problems. With such skills in mind we would > design, implement and continually monitor and respond to incidents based on > best practices. (Note: there are no guarantees that one won't be hacked but > one can minimize such damage as: reputation, loss/modification of > information, etc.) > > - we seriously need leadership in this space nationally (both in public > and private sectors); if there exists any, it is not felt. Such leadership > would be evangelistic in nature pushing for appreciation of such risks and > how to deal with them. Such awareness would raise concern (hopefully) and > thus assure allocation of commensurate resources (people, money, > technology, etc.) to confront the problem. (NB: my experience in North > America tells me that this area is very much underfunded and whatever > little funding comes through would be spent on easy to acquire stuff like > CCTV ... some installed without requisite processes, skills, etc for > maximum gain (ROI) ...) > > - many technology managers (and many others in management) treat security > with obscurity. Keep things obscure and profess security. I once was in a > discussion with a senior official in GoK and heard things such as: we > cannot disclose what measures we have taken to protect government > information because the same can be used by you people to target us! He > failed to appreciate that you can still be hacked with use of known > reconnaissance approaches. OK: if you really want help, get some of our top > talent, give them security clearance and allow them to build robust systems > that assure security. > > - a friend recently gave the story of a manager (a protege of top > management) that kept his job, protected by his benefactors but who many > knew wasn't performing. This manager could continually avoid bringing in > talent that might help him but which talent may also expose his failing! > Only when the organization was hit and top management embarrassed with loss > (material, reputational) did they hire an external consultant whose report > exposed the manager's fraud that he had perpetuated for years on end! ... > long story short, he was given a soft landing, and slowly eased out of the > organization. ... Lesson: get the right talent and skills for the job if > indeed you are committed to delivering in your mandate. > > BTW: we are into consulting and training in this area. I know of bids we > have lost on (despite presenting the best technical proposals) because > of other considerations. Your guess is as good as mine as to why, but don't > be surprised to have some "wired/connected" individuals winning security > assignments but which they can't deliver on; and if they do, the result > would be sloppy and why ... because they engage unskilled people .... > > - Finally (for now), the compliance regime is extremely weak! I know a > thing or two about the Auditor General's office and information security > skills isn't one of their strengths. The focus on financial audit (recently > they reported Kshs 300 + billion unaccounted for) takes all the attention > while other aspects go unattended: critical infrastructure protection, ICT > specification/acquisition/deployment/management/.../disposal ... all go > unattended. > > ... there is a lot to say; let this suffice for today. > > > ---------------------------------------------------------------------------------------------- > Matunda Nyanchama, PhD, CISSP; mnyanchama(a)aganoconsulting.com > Agano Consulting Inc.; www.aganoconsulting.com; Twitter: nmatunda; > <http://twitter.com/#%21/nmatunda>Skype: okiambe > > ---------------------------------------------------------------------------------------------- > Manage your ICT risks! We are the experts you need! The trusted partners > you deserve! > Call: +1-888-587-1150 (Canada) +254-20-267-0743 (Kenya) or > info(a)aganoconsulting.com > Licensed by Communications Commission of Kenya (CCK) > > ---------------------------------------------------------------------------------------------- > "The best revenge is massive success" - Frank Sinatra > > ----------------------------------------------------------------------------------------------- > This e-mail, including attachments, may be privileged and may contain > confidential or proprietary information intended only for the addressee(s). > Any other distribution, copying, use, or disclosure is unauthorized and > strictly prohibited. If you have received this message in error, please > notify the sender immediately by reply e-mail and permanently delete the > message, including any attachments, without making a copy. Thank you. > > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > > Unsubscribe or change your options at > https://lists.kictanet.or.ke/mailman/options/kictanet/ngethe.kariuki2007%40… > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > > > _______________________________________________ > kictanet mailing list > kictanet(a)lists.kictanet.or.ke > https://lists.kictanet.or.ke/mailman/listinfo/kictanet > > Unsubscribe or change your options at > https://lists.kictanet.or.ke/mailman/options/kictanet/lizorembo%40gmail.com > > The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform > for people and institutions interested and involved in ICT policy and > regulation. The network aims to act as a catalyst for reform in the ICT > sector in support of the national aim of ICT enabled growth and development. > > KICTANetiquette : Adhere to the same standards of acceptable behaviors > online that you follow in real life: respect people's times and bandwidth, > share knowledge, don't flame or abuse or personalize, respect privacy, do > not spam, do not market your wares or qualifications. > -- Best regards. Patience is what you admire in the driver behind you, but not in the one ahead.

2 1

Re: [kictanet] #KeIGF15 Online Discussions Day Three: Internet Economy
by Barrack Otieno 22 Jul '15

22 Jul '15

Listers, The rise of the Internet economy in Kenya has been defined by different strokes. On one hand there are small entrepreneurs doing their side hustles from offices, small shops and car boots. They advertise their merchandise and services on social media and in a rudimentary form, some deliver merchandise in backpacks from door to door. Enter the bigger players who have large websites from where goods and services are purchased. Their business models differ. We have companies like OLX, Cheki that provide a platform for users to interact. They make their money from advertising. Others such as Rupu and Jumia offer services and merchandise at reduced prices. Questions 1. Does an adequate legal framework exist to protect consumers from fraud, deficient goods and services and to assure consumer rights in the budding Internet economy? 2. Since the bigger players in the sector are doing well, is time ripe for the local Internet economy to be taxed to raise money for government services? 3. Should other services in the Internet economy such as cloud services, international online purchases etc be taxed? 4. As a stakeholder , what are your recommendations on how the Internet economy can be improved? The floor is open, feel free to continue contributing to the discussions of the previous days.

2 1

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

On 21 July 2015 at 18:11, Lesley Leposo via Security < security(a)lists.my.co.ke> wrote: > I can see why they would use open source software, other than it being > free. > But, my point of view only makes sense if the GOK, businesses and > universities also fostered/sponsored some (moderately) experienced COMODO > tinkerers/hackers. > But surely, why should we use some free or open initiatives like COMODO while we dished out more than $8M of taxpayers money on the National PKI? Is there a problem somewhere? Or this are just allegations On another note, is it possible for somebody in a position of authority, say CA or ICTA to be so kind as to share the implementation status of the National PKI with the community? ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson

1 0

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

Hosea Kandie and Fredick Wahome have raised very important points of institutional frameworks. I just wanted to share the National PKI website which has a tonne of information on what Kenya has done in that regard. http://www.ke-cirt.go.ke/index.php/services/national-pki/ Here is a copy paste from the home page: Kenya’s National Public Key Infrastructure (NPKI) The National Public Key Infrastructure (NPKI) project is coordinated by the Ministry of ICT in collaboration with the Communications Authority of Kenya (CA) and the ICT Authority (ICTA). A Public Key Infrastructure (PKI) refers to a system for the creation, storage and distribution of digital certificates which are used to verify that a particular public key (online identity) belongs to a certain entity. A PKI is a technical infrastructure that comprises of a Root Certification Authority (RCA) and a Certification Authority (CA), referred to as an Electronic Certification Service Provider (E-CSP) in Kenya’s legal and regulatory framework. The PKI creates a framework for protecting communications and stored information from unauthorized access and disclosure by addressing the fundamentals of cyber security – confidentiality, integrity, authentication and non-repudiation. A PKI is key to the rollout of e-transaction services. The Kenya Information and Communications Act, 1998, mandates the Communications Authority of Kenya (CA) to issue a license to a person operating an Electronic Certification Service. In this regard, the Communications Authority of Kenya (CA) has developed a licensing framework for Electronic Certification Service Providers (E-CSPs). Kenya’s National PKI comprises of a Root Certification Authority (RCA), which is managed by the Communication Authority of Kenya (CA) as a regulatory function, and the Government Certification Authority (GCA), an E-CSP which is managed by the ICTA. The NPKI is instrumental towards the effectiveness of the licensing of Electronic Certification Service Providers (E-CSPs) by the Communications Authority since a licensed E-CSP must be accredited by the RCA for its digital certificates to be globally recognized and trusted. The ICT Authority (ICTA), which is the body responsible for the management of the mainstream government ICT services, operates the GCA. Other interested stakeholders who may be issued with an E-CSP license on application include the banking Sector and the Academia. The benefits of a National PKI include: i. Locally available and cheaper digital certificates/signatures; and ii. Operations and services that are within Kenyan law (jurisdiction), among others. ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson On 21 July 2015 at 11:02, fredrick Wahome via Security < security(a)lists.my.co.ke> wrote: > The fact that there is high internet penetration in Africa / Kenya where > an average of one user for every five has access to affordable internet has > created enabling environment for cyber-criminals. > > By the nature of cyberspace where the perpetrators of cyber-crime remain > ubiquitous. This necessitated a need for legislation to control crime, and > to provide confidence and security in African cyberspace, leading to the > drafting of the Africa Union Convention on Cybersecurity (AUCC). But some > groups like CIPIT and civil society opposed the convention on the ground > that it was prepared without their inputs. Their main argument is that the > convention did not make enough provisions to protect privacy and freedom of > speech. > > Member States have to undertake necessary measures to encourage the > establishment of institutions that exchange information on cyber > threats and the evaluation of vulnerabilities such as Computer > Emergency Response Team (CERT). Kenya has at least done something on this > by establishing KE-CIRT at CA. There is also a masterplan and PKI in place > thou there has been implementation challenges. We will note that most > governments departments have not yet established cybersecurity departments > and this leads to low / lack of budgetary allocation. > > In summary Government bodies, policy networks, scholars, the media, > technology experts and the people need to engage in a global conversation > that will help demystify Cyber-crime and define what it constitutes of and > how Cyber-criminals should be dealt with. > > The role of the media (television, blogs, online news outlets and more) is > critical in the process of educating the public and engaging in a > conversation, as they will be the mediators and curators of information and > discourse on the issue. Thus, a concise and sensible approach, devoid of > fear-mongering and shock practices, should be followed. We all remember > recently how media has mishandled cyber crime news without a very somber > deep analysis > > Since this is an international issue, governments and policy networks > across the world have to come together and discuss openly on what is better > for their citizens. Something like AUCC is a positive move by African states > > Scholars and academics can provide valuable expertise on technological, > psychological, ethical and other issues, while highlighting any misgivings > by those involved in the process. At least Strathmore has tried on this > > The people in their local communities, families and social networks should > help and train each other to increase their peers’ level of Internet > literacy and highlight the advantages of the web. A higher Internet > literacy level can help people protect themselves even better by taking > simple security measures, such as using anti-virus software and identifying > potential risks or scams in their online financial transactions. More is > needed from the technology community to provide awareness to end users even > if through probono program. > > The technology community needs a unity of purpose. Looking at programmers > / developers, DBA, network admins, infosec there has been lack of proper > coordination. Developers are working hard to prove that their products cant > be broken. Infosec on the other hand are working so hard to prove to blue > team / developers that they can break their products. At the end no one > benefit from such a contest. Many technical conferences / seminars should > be encouraged to enable sharing of information / knowledge in the local > technology community. > > Great day comrades. > > > > > > > On Tue, Jul 21, 2015 at 9:28 AM, Stephen Munguti via Security < > security(a)lists.my.co.ke> wrote: > >> Hello all, >> >> I think most of our security concerns stem from internal users and this >> is the reason many banks and telecos refuse to part with this information, >> i could be wrong though >> >> On Tue, Jul 21, 2015 at 8:58 AM, Grace Mutung'u (Bomu) via skunkworks < >> skunkworks(a)lists.my.co.ke> wrote: >> >>> Dear Listers, >>> >>> >>> Kenya has had its fair share of high profile cyber threats, hacking etc, >>> the latest being the alleged compromise of the IFMIS system at NYS/Ministry >>> of Devolution. The country and Africa at large is making efforts to assure >>> cyber-security. These include among others her involvement in the Africa >>> Union Convention on Cybercrime and a proposal for a Cybercrime law, an >>> initiative led by the Office of the Director of Public Prosecutions. >>> Significant financial resources have also been earmarked by government for >>> security and cyber security in particular. There are also partnerships >>> between government and private sector in deploying cybersecurity centres. >>> >>> The private sector has employed practical measures to protect their >>> businesses. However, businesses such as mobile money providers and banks >>> have been shy to divulge their cyber security concerns to protect their >>> interests. >>> >>> Civil society on the other hand has raised concern about the line >>> between protecting the cyber space and creating a facilitative environment >>> for innovators as well as protecting the rights of users. >>> >>> >>> >>> Are our efforts at deterring cyber-crime the correct way to assure cyber >>> security? Are fears about a partnership between government and private >>> sector and the general fears about stifling innovation and human rights in >>> the name of cybersecurity legitimate? Are there other practical approaches >>> that different stakeholders can take to enhance cyber security? >>> >>> >>> Over to you. >>> >>> -- >>> Grace L.N. Mutung'u >>> Nairobi Kenya >>> Skype: gracebomu >>> Twitter: @Bomu >>> >>> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >>> >>> >>> _______________________________________________ >>> skunkworks mailing list >>> skunkworks(a)lists.my.co.ke >>> ------------ >>> List info, subscribe/unsubscribe >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>> ------------ >>> >>> Skunkworks Rules >>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>> ------------ >>> Other services @ http://my.co.ke >>> >> >> >> >> -- >> >> Best Regards, >> Stephen Munguti. >> >> +254720425104 >> >> _______________________________________________ >> Security mailing list >> Security(a)lists.my.co.ke >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >> > > > > -- > > > > > *-------------------------------------* > *Kind Regards**;* > > > > > > > > *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: > www.secunets.com <http://www.secunets.com>Cell: +254725264890Email: > fred(a)secunets.com <fred(a)secunets.com>**Facebook: secunetstech* > *Twitter: @secunets* > > *Skype: secunets.technologiesExperts in: *Domain Registration, Web Hosting > , Open Source Solutions, Information Security & Training, Digital > Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. > > *"Secure Business Technology"* > > > > ------------------------------------------------------------------------------------------------------------------------------------------------ > *SECUNETS TECHNOLOGIES DISCLAIMER:* > > This email message and any file(s) transmitted with it is intended solely > for the individual or entity to whom it is addressed and may contain > confidential and/or legally privileged information which confidentiality > and/or privilege is not lost or waived by reason of mistaken transmission. > If you have received this message by error you are not authorized to view > disseminate distribute or copy the message without the written consent of > Secunets Technologies and are requested to contact the sender by telephone > or e-mail and destroy the original. Although Secunets Technologies takes > all reasonable precautions to ensure that this message and any file > transmitted with it is virus free, Secunets Technologies accepts no > liability for any damage that may be caused by any virus transmitted by > this email. > > > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >

1 1

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Grace Mutung'u (Bomu) 21 Jul '15

21 Jul '15

Yes Stephen, I meant thin sims and their security. Just saw some article comparing the two main mobile money services and I understand Equitel also has (normal) SIMS. 2015-07-21 16:48 GMT+03:00 Stephen Munguti <kamitu.sm(a)gmail.com>: > I think we should separate the issue of Equitel from the issue of Thin > sims. Equitel also has a normal sim even though its the first to introduce > the thin sims into kenya > > On Tue, Jul 21, 2015 at 4:34 PM, Grace Mutung'u (Bomu) <nmutungu(a)gmail.com > > wrote: > >> Very interesting turn the discussion has taken. Understandably, Equitel >> is something to watch as it could disrupt the market. many hope it will. >> Are techies here telling us that the security of using Equitel SIM cannot >> be guaranteed unless there are strict internal controls? >> Does this mean we already need laws for what is quite a novel application >> in Kenya? And how does ethics as mentioned by Jaco come in here if at all? >> >> 2015-07-21 16:17 GMT+03:00 Lesley Leposo via Security < >> security(a)lists.my.co.ke>: >> >>> Cool Steve. >>> >>> Now from a policy and regulation standpoint, the fundamental isssue (by >>> far) is that…. >>> >>> A *proprietary* technology is being deployed by a public utility/service. >>> >>> There are always major risks with going “proprietary” vs. >>> standardized/open/open-source. >>> >>> >>> On Jul 21, 2015, at 4:11 PM, Stephen Munguti <kamitu.sm(a)gmail.com> >>> wrote: >>> >>> @ fredrick, >>> >>> I don't think the issue is with Equitel (given that they have normal sim >>> cards in use), I think the issue is the thin sim >>> >>> @lesley >>> >>> noted >>> >>> On Tue, Jul 21, 2015 at 3:52 PM, fredrick Wahome <frewah85(a)gmail.com> >>> wrote: >>> >>>> They would not have prevented thin SIM adoption but they would have >>>> played some politics using science. For now lets hope that Mwangi is going >>>> to disrupt this market and deliver us from monopolization. >>>> >>>> On Tue, Jul 21, 2015 at 3:36 PM, Stephen Munguti via Security < >>>> security(a)lists.my.co.ke> wrote: >>>> >>>>> @lesley, >>>>> >>>>> The key issue is the data exchange between the Safaricom SIM card and >>>>> the phone (this has nothing to do with the Safaricom Servers), bearing in >>>>> mind that there exists a third party between the Safaricom SIM and the >>>>> Phone >>>>> >>>>> On Tue, Jul 21, 2015 at 3:28 PM, Lesley Leposo <leposo(a)unoasystems.com >>>>> > wrote: >>>>> >>>>>> Everyone is griping about the keys (i.e. triplets and session keys >>>>>> derived from that). >>>>>> I think someone needs to be very specific about the security threat >>>>>> involved here and both players aren’t revealing much. >>>>>> >>>>>> IMHO, there are at least 3 areas where security threats can emerge: >>>>>> >>>>>> 1) Normally EAP-SIM would be used to authenticate the client/phone >>>>>> vs. the telco server (Safaricom in this case). >>>>>> The valuable information in this case would be the SIM triplets (and >>>>>> derived session key). Hence, this baseline EAP-SIM needs to be protected >>>>>> (Safaricom knows how this is done). >>>>>> If it isn’t, then we already have a problem that’s not due to >>>>>> thin-siim. >>>>>> >>>>>> 2) For the thin-sim, another EAP-SIM negotiation between the >>>>>> client/phone vs. the overlay sever (Equity in this case). >>>>>> The valuable information again would be the thin-SIM triplets (and >>>>>> derived session key). Hence this overlay EAP-SIM needs to be protected in a >>>>>> manner that Safaricom can’t even see it… this is totally in the domain of >>>>>> how Equity has designed their network and their provisioning. (e.g. by >>>>>> encrypted negotiation & tunnelling directly between the client/phone and >>>>>> the Equity server). >>>>>> >>>>>> 3) For the handsets, they would have to make sure that the telco >>>>>> applications can’t snoop or inject traffic/data into each other’s walled >>>>>> garden - there are 2 walled gardens in this case. The walled garden >>>>>> includes the sim triplets (and derived session key) along with each telco >>>>>> network routes, policies, arp-cache and tcp/ip connections. There exists a >>>>>> possibility of threats due to backwards incompatibility (with phones that >>>>>> can’t fully manage these walled gardens). Perhaps this is what Safaricom is >>>>>> complaining about? >>>>>> >>>>>> On Jul 21, 2015, at 2:20 PM, Mwendwa Kivuva via Security < >>>>>> security(a)lists.my.co.ke> wrote: >>>>>> >>>>>> >>>>>> > @mwendwa, >>>>>> > >>>>>> > Its possible for the owner of the network of the thin sim to be >>>>>> privy to information that only the host network sim should be having. It >>>>>> all comes back to someone internal at Equitel having the proper technical >>>>>> skills and motivation to use the same >>>>>> >>>>>> Stephen, >>>>>> Then we have a major problem right there. I would not like Safaricom >>>>>> to disown any responsibility on their part when my security is compromised >>>>>> because I used thin sim. Therefore any security conscious users would not >>>>>> dare jeopardize their transactions by using thin sim. The question then is, >>>>>> how many of us care about their transaction security? >>>>>> >>>>>> >>>>>> >>>>>> >> >>>>>> >> On Tue, Jul 21, 2015 at 1:52 PM, Mwendwa Kivuva via skunkworks < >>>>>> skunkworks(a)lists.my.co.ke> wrote: >>>>>> >>> >>>>>> >>> Then the trending issue of the day. Equitel. Safaricom had taken >>>>>> Equity to court and sounded a big warning on the use of thin sim. >>>>>> http://www.businessdailyafrica.com/Corporate-News/Safaricom-sounds-warning-… >>>>>> >>> >>>>>> >>> London-based GSMA, the global association of telecoms operators >>>>>> using the GSM technology, wrote to the Kenyan authorities warning of the >>>>>> risks that use of the slim SIM cards pose to the integrity of the mobile >>>>>> telecommunications platforms.The GSMA said the overlay SIM (which is >>>>>> embedded between a normal SIM card and the device) has the potential of >>>>>> harvesting and revealing sensitive data passing the system. >>>>>> >>> >>>>>> >>> Of course we all know Safaricom failed miserably in stopping >>>>>> Equity from progressing with its plans. >>>>>> >>> >>>>>> >>> Now the thin sim is here, and Equitel has said it will encrypt >>>>>> all data to and from the thin sim. Can experts in this area assure us that >>>>>> the use of thin sims will not affect the integrity of M-Pesa transactions? >>>>>> >>> >>>>>> >>> Regards >>>>>> >>> >>>>>> >>> >>>>>> >>> _______________________________________________ >>>>>> >>> skunkworks mailing list >>>>>> >>> skunkworks(a)lists.my.co.ke >>>>>> >>> ------------ >>>>>> >>> List info, subscribe/unsubscribe >>>>>> >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>>>>> >>> ------------ >>>>>> >>> >>>>>> >>> Skunkworks Rules >>>>>> >>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>>>>> >>> ------------ >>>>>> >>> Other services @ http://my.co.ke >>>>>> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> >>>>>> >> -- >>>>>> >> >>>>>> >> Best Regards, >>>>>> >> Stephen Munguti. >>>>>> >> >>>>>> >> +254720425104 >>>>>> > >>>>>> > >>>>>> > >>>>>> > >>>>>> > -- >>>>>> > >>>>>> > Best Regards, >>>>>> > Stephen Munguti. >>>>>> > >>>>>> > +254720425104 >>>>>> >>>>>> _______________________________________________ >>>>>> Security mailing list >>>>>> Security(a)lists.my.co.ke >>>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>>> >>>>>> >>>>>> >>>>> >>>>> >>>>> -- >>>>> >>>>> Best Regards, >>>>> Stephen Munguti. >>>>> >>>>> +254720425104 >>>>> >>>>> _______________________________________________ >>>>> Security mailing list >>>>> Security(a)lists.my.co.ke >>>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>>> >>>> >>>> >>>> >>>> -- >>>> >>>> >>>> >>>> >>>> *-------------------------------------* >>>> *Kind Regards**;* >>>> >>>> >>>> >>>> >>>> >>>> >>>> >>>> *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: >>>> www.secunets.com <http://www.secunets.com/>Cell: +254725264890Email: >>>> fred(a)secunets.com <fred(a)secunets.com>**Facebook: secunetstech* >>>> *Twitter: @secunets* >>>> >>>> *Skype: secunets.technologiesExperts in: *Domain Registration, Web >>>> Hosting, Open Source Solutions, Information Security & Training, Digital >>>> Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. >>>> >>>> *"Secure Business Technology"* >>>> >>>> >>>> >>>> ------------------------------------------------------------------------------------------------------------------------------------------------ >>>> *SECUNETS TECHNOLOGIES DISCLAIMER:* >>>> >>>> This email message and any file(s) transmitted with it is intended >>>> solely for the individual or entity to whom it is addressed and may contain >>>> confidential and/or legally privileged information which confidentiality >>>> and/or privilege is not lost or waived by reason of mistaken transmission. >>>> If you have received this message by error you are not authorized to view >>>> disseminate distribute or copy the message without the written consent of >>>> Secunets Technologies and are requested to contact the sender by telephone >>>> or e-mail and destroy the original. Although Secunets Technologies takes >>>> all reasonable precautions to ensure that this message and any file >>>> transmitted with it is virus free, Secunets Technologies accepts no >>>> liability for any damage that may be caused by any virus transmitted by >>>> this email. >>>> >>>> >>> >>> >>> -- >>> >>> Best Regards, >>> Stephen Munguti. >>> >>> +254720425104 >>> >>> >>> >>> _______________________________________________ >>> Security mailing list >>> Security(a)lists.my.co.ke >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>> >> >> >> >> -- >> Grace L.N. Mutung'u >> Nairobi Kenya >> Skype: gracebomu >> Twitter: @Bomu >> >> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >> >> > > > -- > > Best Regards, > Stephen Munguti. > > +254720425104 > -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

1 0

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Grace Mutung'u (Bomu) 21 Jul '15

21 Jul '15

Very interesting turn the discussion has taken. Understandably, Equitel is something to watch as it could disrupt the market. many hope it will. Are techies here telling us that the security of using Equitel SIM cannot be guaranteed unless there are strict internal controls? Does this mean we already need laws for what is quite a novel application in Kenya? And how does ethics as mentioned by Jaco come in here if at all? 2015-07-21 16:17 GMT+03:00 Lesley Leposo via Security < security(a)lists.my.co.ke>: > Cool Steve. > > Now from a policy and regulation standpoint, the fundamental isssue (by > far) is that…. > > A *proprietary* technology is being deployed by a public utility/service. > > There are always major risks with going “proprietary” vs. > standardized/open/open-source. > > > On Jul 21, 2015, at 4:11 PM, Stephen Munguti <kamitu.sm(a)gmail.com> wrote: > > @ fredrick, > > I don't think the issue is with Equitel (given that they have normal sim > cards in use), I think the issue is the thin sim > > @lesley > > noted > > On Tue, Jul 21, 2015 at 3:52 PM, fredrick Wahome <frewah85(a)gmail.com> > wrote: > >> They would not have prevented thin SIM adoption but they would have >> played some politics using science. For now lets hope that Mwangi is going >> to disrupt this market and deliver us from monopolization. >> >> On Tue, Jul 21, 2015 at 3:36 PM, Stephen Munguti via Security < >> security(a)lists.my.co.ke> wrote: >> >>> @lesley, >>> >>> The key issue is the data exchange between the Safaricom SIM card and >>> the phone (this has nothing to do with the Safaricom Servers), bearing in >>> mind that there exists a third party between the Safaricom SIM and the >>> Phone >>> >>> On Tue, Jul 21, 2015 at 3:28 PM, Lesley Leposo <leposo(a)unoasystems.com> >>> wrote: >>> >>>> Everyone is griping about the keys (i.e. triplets and session keys >>>> derived from that). >>>> I think someone needs to be very specific about the security threat >>>> involved here and both players aren’t revealing much. >>>> >>>> IMHO, there are at least 3 areas where security threats can emerge: >>>> >>>> 1) Normally EAP-SIM would be used to authenticate the client/phone vs. >>>> the telco server (Safaricom in this case). >>>> The valuable information in this case would be the SIM triplets (and >>>> derived session key). Hence, this baseline EAP-SIM needs to be protected >>>> (Safaricom knows how this is done). >>>> If it isn’t, then we already have a problem that’s not due to thin-siim. >>>> >>>> 2) For the thin-sim, another EAP-SIM negotiation between the >>>> client/phone vs. the overlay sever (Equity in this case). >>>> The valuable information again would be the thin-SIM triplets (and >>>> derived session key). Hence this overlay EAP-SIM needs to be protected in a >>>> manner that Safaricom can’t even see it… this is totally in the domain of >>>> how Equity has designed their network and their provisioning. (e.g. by >>>> encrypted negotiation & tunnelling directly between the client/phone and >>>> the Equity server). >>>> >>>> 3) For the handsets, they would have to make sure that the telco >>>> applications can’t snoop or inject traffic/data into each other’s walled >>>> garden - there are 2 walled gardens in this case. The walled garden >>>> includes the sim triplets (and derived session key) along with each telco >>>> network routes, policies, arp-cache and tcp/ip connections. There exists a >>>> possibility of threats due to backwards incompatibility (with phones that >>>> can’t fully manage these walled gardens). Perhaps this is what Safaricom is >>>> complaining about? >>>> >>>> On Jul 21, 2015, at 2:20 PM, Mwendwa Kivuva via Security < >>>> security(a)lists.my.co.ke> wrote: >>>> >>>> >>>> > @mwendwa, >>>> > >>>> > Its possible for the owner of the network of the thin sim to be privy >>>> to information that only the host network sim should be having. It all >>>> comes back to someone internal at Equitel having the proper technical >>>> skills and motivation to use the same >>>> >>>> Stephen, >>>> Then we have a major problem right there. I would not like Safaricom to >>>> disown any responsibility on their part when my security is compromised >>>> because I used thin sim. Therefore any security conscious users would not >>>> dare jeopardize their transactions by using thin sim. The question then is, >>>> how many of us care about their transaction security? >>>> >>>> >>>> >>>> >> >>>> >> On Tue, Jul 21, 2015 at 1:52 PM, Mwendwa Kivuva via skunkworks < >>>> skunkworks(a)lists.my.co.ke> wrote: >>>> >>> >>>> >>> Then the trending issue of the day. Equitel. Safaricom had taken >>>> Equity to court and sounded a big warning on the use of thin sim. >>>> http://www.businessdailyafrica.com/Corporate-News/Safaricom-sounds-warning-… >>>> >>> >>>> >>> London-based GSMA, the global association of telecoms operators >>>> using the GSM technology, wrote to the Kenyan authorities warning of the >>>> risks that use of the slim SIM cards pose to the integrity of the mobile >>>> telecommunications platforms.The GSMA said the overlay SIM (which is >>>> embedded between a normal SIM card and the device) has the potential of >>>> harvesting and revealing sensitive data passing the system. >>>> >>> >>>> >>> Of course we all know Safaricom failed miserably in stopping Equity >>>> from progressing with its plans. >>>> >>> >>>> >>> Now the thin sim is here, and Equitel has said it will encrypt all >>>> data to and from the thin sim. Can experts in this area assure us that the >>>> use of thin sims will not affect the integrity of M-Pesa transactions? >>>> >>> >>>> >>> Regards >>>> >>> >>>> >>> >>>> >>> _______________________________________________ >>>> >>> skunkworks mailing list >>>> >>> skunkworks(a)lists.my.co.ke >>>> >>> ------------ >>>> >>> List info, subscribe/unsubscribe >>>> >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>>> >>> ------------ >>>> >>> >>>> >>> Skunkworks Rules >>>> >>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>>> >>> ------------ >>>> >>> Other services @ http://my.co.ke >>>> >>>> >> >>>> >> >>>> >> >>>> >> >>>> >> -- >>>> >> >>>> >> Best Regards, >>>> >> Stephen Munguti. >>>> >> >>>> >> +254720425104 >>>> > >>>> > >>>> > >>>> > >>>> > -- >>>> > >>>> > Best Regards, >>>> > Stephen Munguti. >>>> > >>>> > +254720425104 >>>> >>>> _______________________________________________ >>>> Security mailing list >>>> Security(a)lists.my.co.ke >>>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>>> >>>> >>>> >>> >>> >>> -- >>> >>> Best Regards, >>> Stephen Munguti. >>> >>> +254720425104 >>> >>> _______________________________________________ >>> Security mailing list >>> Security(a)lists.my.co.ke >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/security >>> >> >> >> >> -- >> >> >> >> >> *-------------------------------------* >> *Kind Regards**;* >> >> >> >> >> >> >> >> *Fredrick Wahome Ndung'uTeam LeaderSecunets Technologies LtdWebsite: >> www.secunets.com <http://www.secunets.com/>Cell: +254725264890Email: >> fred(a)secunets.com <fred(a)secunets.com>**Facebook: secunetstech* >> *Twitter: @secunets* >> >> *Skype: secunets.technologiesExperts in: *Domain Registration, Web >> Hosting, Open Source Solutions, Information Security & Training, Digital >> Forensic Investigations, Web 2.0 Applications & I.C.T Consultancy. >> >> *"Secure Business Technology"* >> >> >> >> ------------------------------------------------------------------------------------------------------------------------------------------------ >> *SECUNETS TECHNOLOGIES DISCLAIMER:* >> >> This email message and any file(s) transmitted with it is intended solely >> for the individual or entity to whom it is addressed and may contain >> confidential and/or legally privileged information which confidentiality >> and/or privilege is not lost or waived by reason of mistaken transmission. >> If you have received this message by error you are not authorized to view >> disseminate distribute or copy the message without the written consent of >> Secunets Technologies and are requested to contact the sender by telephone >> or e-mail and destroy the original. Although Secunets Technologies takes >> all reasonable precautions to ensure that this message and any file >> transmitted with it is virus free, Secunets Technologies accepts no >> liability for any damage that may be caused by any virus transmitted by >> this email. >> >> > > > -- > > Best Regards, > Stephen Munguti. > > +254720425104 > > > > _______________________________________________ > Security mailing list > Security(a)lists.my.co.ke > http://lists.my.co.ke/cgi-bin/mailman/listinfo/security > -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

1 0

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

On 21 July 2015 at 15:36, fredrick Wahome via Security < security(a)lists.my.co.ke> wrote: > I think with the ample time and resources at Safaricom disposal before > this issue was ruled in Equity favor, from business perspective they would > have demonstrated a POC rather than requesting for GSMA which is made up of > people who can be compromised to give their word. That way many potential > customers would have believed Safcom and shy away. > Even if Safaricom had demonstrated POC, would they have managed to sway the political heavyweights not to support the adoption of thin sim? Me think the decision and ruling was made through the corridors of power rather than through Science. ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson

1 0

Re: [kictanet] [Skunkworks] [Security Forum] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

> @mwendwa, > > Its possible for the owner of the network of the thin sim to be privy to information that only the host network sim should be having. It all comes back to someone internal at Equitel having the proper technical skills and motivation to use the same Stephen, Then we have a major problem right there. I would not like Safaricom to disown any responsibility on their part when my security is compromised because I used thin sim. Therefore any security conscious users would not dare jeopardize their transactions by using thin sim. The question then is, how many of us care about their transaction security? >> >> On Tue, Jul 21, 2015 at 1:52 PM, Mwendwa Kivuva via skunkworks < skunkworks(a)lists.my.co.ke> wrote: >>> >>> Then the trending issue of the day. Equitel. Safaricom had taken Equity to court and sounded a big warning on the use of thin sim. http://www.businessdailyafrica.com/Corporate-News/Safaricom-sounds-warning-… >>> >>> London-based GSMA, the global association of telecoms operators using the GSM technology, wrote to the Kenyan authorities warning of the risks that use of the slim SIM cards pose to the integrity of the mobile telecommunications platforms.The GSMA said the overlay SIM (which is embedded between a normal SIM card and the device) has the potential of harvesting and revealing sensitive data passing the system. >>> >>> Of course we all know Safaricom failed miserably in stopping Equity from progressing with its plans. >>> >>> Now the thin sim is here, and Equitel has said it will encrypt all data to and from the thin sim. Can experts in this area assure us that the use of thin sims will not affect the integrity of M-Pesa transactions? >>> >>> Regards >>> >>> >>> _______________________________________________ >>> skunkworks mailing list >>> skunkworks(a)lists.my.co.ke >>> ------------ >>> List info, subscribe/unsubscribe >>> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >>> ------------ >>> >>> Skunkworks Rules >>> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >>> ------------ >>> Other services @ http://my.co.ke >> >> >> >> >> -- >> >> Best Regards, >> Stephen Munguti. >> >> +254720425104 > > > > > -- > > Best Regards, > Stephen Munguti. > > +254720425104

1 0

Re: [kictanet] [Security Forum] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Mwendwa Kivuva 21 Jul '15

21 Jul '15

On 21 July 2015 at 11:00, Jared Koyier via Security <security(a)lists.my.co.ke > wrote: > The biggest question is whether people responsible for CyberSecurity in > government have the resources and technical capacity. Good example is the > recent embarrassing hackingteam exposure in which one of the officers in > the NSIS is captured seeking international help in defacing a simple blog. > Just for the record, here is the email transcript where Kenyan State House operatives were allegedly seeking EXTENAL help to hack Kenya websites https://www.wikileaks.org/hackingteam/emails/?q=kensi.org&mfrom=&mto=&title… a and this his how Nation reported the story: http://mobile.nation.co.ke/news/NIS-WikiLeaks-Hacking-Team-Surveillance/-/1… Of Interest is sometimes back, a Kenyan government agency was giving orders that all websites should be hosted locally. From the Hacking Team fiasco, we can clearly see why the government wants websites to be hosted locally. So that they can just physically seize the computer box instead of having to employ Hackers from Russia to do the dirty job for them. I am surprised Civil Society actors have not come out very strongly to question this move of internal hacking by government. After Snowden, we saw how Civil Society in US came out very strongly to protest the violation of basic rights by the State. The US government had to apologize for the embarrassing revelations, and try to cover it's back. Of course the argument I hear this days is there is no government that does not do cyber espionage. Only that some governments are more adept in their skills than others. Regards ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson

1 1

Re: [kictanet] [Skunkworks] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Barrack Otieno 21 Jul '15

21 Jul '15

Well said with Steve and Explorer, Security matters are tied to value systems. Without values there is no security. I stand to be corrected but in the vision 2030 document we had a pillar that received very little attention. This pillar touched on National values , i think this is where the rain started beating us on the security front. Recent interventions from the government and religious communities have emphasized on collective responsibilities and being your brothers keeper (Nyumba kumi et al). I think the same approach should be applied to stem Cyber Security that is sensitizing users on the importance of confidentiality. This can best be done by implementing Security standards such as ISO 27000 series which break down security into a laymans language. Regards On 7/21/15, Stephen Munguti via skunkworks <skunkworks(a)lists.my.co.ke> wrote: > Hello all, > > I think most of our security concerns stem from internal users and this is > the reason many banks and telecos refuse to part with this information, i > could be wrong though > > On Tue, Jul 21, 2015 at 8:58 AM, Grace Mutung'u (Bomu) via skunkworks < > skunkworks(a)lists.my.co.ke> wrote: > >> Dear Listers, >> >> >> Kenya has had its fair share of high profile cyber threats, hacking etc, >> the latest being the alleged compromise of the IFMIS system at >> NYS/Ministry >> of Devolution. The country and Africa at large is making efforts to >> assure >> cyber-security. These include among others her involvement in the Africa >> Union Convention on Cybercrime and a proposal for a Cybercrime law, an >> initiative led by the Office of the Director of Public Prosecutions. >> Significant financial resources have also been earmarked by government >> for >> security and cyber security in particular. There are also partnerships >> between government and private sector in deploying cybersecurity centres. >> >> The private sector has employed practical measures to protect their >> businesses. However, businesses such as mobile money providers and banks >> have been shy to divulge their cyber security concerns to protect their >> interests. >> >> Civil society on the other hand has raised concern about the line between >> protecting the cyber space and creating a facilitative environment for >> innovators as well as protecting the rights of users. >> >> >> >> Are our efforts at deterring cyber-crime the correct way to assure cyber >> security? Are fears about a partnership between government and private >> sector and the general fears about stifling innovation and human rights >> in >> the name of cybersecurity legitimate? Are there other practical >> approaches >> that different stakeholders can take to enhance cyber security? >> >> >> Over to you. >> >> -- >> Grace L.N. Mutung'u >> Nairobi Kenya >> Skype: gracebomu >> Twitter: @Bomu >> >> <http://www.diplointernetgovernance.org/profile/GraceMutungu> >> >> >> _______________________________________________ >> skunkworks mailing list >> skunkworks(a)lists.my.co.ke >> ------------ >> List info, subscribe/unsubscribe >> http://lists.my.co.ke/cgi-bin/mailman/listinfo/skunkworks >> ------------ >> >> Skunkworks Rules >> http://my.co.ke/phpbb/viewtopic.php?f=24&t=94 >> ------------ >> Other services @ http://my.co.ke >> > > > > -- > > Best Regards, > Stephen Munguti. > > +254720425104 > -- Barrack O. Otieno +254721325277 +254-20-2498789 Skype: barrack.otieno http://www.otienobarrack.me.ke/

2 1

#KeIGF15 Online Discussions Day One: Inclusiveness and Diversity
by Grace Mutung'u (Bomu) 21 Jul '15

21 Jul '15

Listers, Since promulgation of the Constitution, Kenya has become a litigious society, and the ICT/Internet sector has not been spared. For instance, the processes used to constitute public ICT bodies was contested while a good part of the digital migration process also played out in the public galleries. Looking at Kenya's past journey in ICT/Internet governance, has it been inclusive? Are we presently adhering to Article 10 on public participation in local Internet governance matters? Do the present mechanisms facilitate meaningful participation of all including those with disabilities? What are the roles of the various stakeholders and are they all playing their roles? Is the ICT environment in Kenya inclusive—that is, with an atmosphere in which all people feel valued and respected and have access to the same opportunities? What is the state of Universal Access and implementation of Universal Service Fund in Kenya? Are the USF Council members representative of the Internet community in Kenya? Are all stakeholders' interests taken into consideration in forming the USF council? Welcome to the discussion. -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu

5 6

Fwd: [AfrICANN-discuss] CCWG on Enhancing ICANN Accountability Paris - Communiqué
by Barrack Otieno 21 Jul '15

21 Jul '15

Listers, FYI. Regards ---------- Forwarded message ---------- From: Mamadou LO <alfamamadou(a)hotmail.com> Date: Tue, 21 Jul 2015 07:12:30 +0000 Subject: [AfrICANN-discuss] CCWG on Enhancing ICANN Accountability Paris - Communiqué To: "africann(a)afrinic.net" <africann(a)afrinic.net>, "ncsg-discuss(a)listserv.syr.edu" <ncsg-discuss(a)listserv.syr.edu>, "fellowships-alumni(a)icann.org" <fellowships-alumni(a)icann.org>, "outreach_com_2015(a)intgovforum.org" <outreach_com_2015(a)intgovforum.org> FYI Cross Community Working Group on Enhancing ICANN Accountability Paris Communiqué https://www.icann.org/news/announcement-3-2015-07-20-en#prclt-JKT16gbK Regards! Mamadou -- Barrack O. Otieno +254721325277 +254-20-2498789 Skype: barrack.otieno http://www.otienobarrack.me.ke/

1 0

Re: [kictanet] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by 0xexplorer 21 Jul '15

21 Jul '15

IMHO there is still a lot to be done to enhance cyber security. A computer incident response team was setup some time ago however their activities are hardly seen or heard of in the public domain. Secondly the recent Hacking Team leaks revealed agents allegedly acting on behalf of the state to engage in potentially illegal activities. It is a challenge to even assess the readiness of the country to handle significant cyber security incidents. I feel that a culture that encourages information sharing and promoting awareness amongst the general public would be a great start. My two cents. -- 0xexplorer -------- Original Message -------- Subject: [kictanet] #KeIGF15 Online Discussions Day Two: Cyber Security and Trust Time (GMT): Jul 21 2015 05:58:44 From: kictanet(a)lists.kictanet.or.ke To: 0xexplorer(a)protonmail.ch CC: nmutungu(a)gmail.com Dear Listers, Kenya has had its fair share of high profile cyber threats, hacking etc, the latest being the alleged compromise of the IFMIS system at NYS/Ministry of Devolution. The country and Africa at large is making efforts to assure cyber-security. These include among others her involvement in the Africa Union Convention on Cybercrime and a proposal for a Cybercrime law, an initiative led by the Office of the Director of Public Prosecutions. Significant financial resources have also been earmarked by government for security and cyber security in particular. There are also partnerships between government and private sector in deploying cybersecurity centres. The private sector has employed practical measures to protect their businesses. However, businesses such as mobile money providers and banks have been shy to divulge their cyber security concerns to protect their interests. Civil society on the other hand has raised concern about the line between protecting the cyber space and creating a facilitative environment for innovators as well as protecting the rights of users. Are our efforts at deterring cyber-crime the correct way to assure cyber security? Are fears about a partnership between government and private sector and the general fears about stifling innovation and human rights in the name of cybersecurity legitimate? Are there other practical approaches that different stakeholders can take to enhance cyber security?

2 1

#KeIGF15 Online Discussions Day Two: Cyber Security and Trust
by Grace Mutung'u (Bomu) 21 Jul '15

21 Jul '15

Dear Listers, Kenya has had its fair share of high profile cyber threats, hacking etc, the latest being the alleged compromise of the IFMIS system at NYS/Ministry of Devolution. The country and Africa at large is making efforts to assure cyber-security. These include among others her involvement in the Africa Union Convention on Cybercrime and a proposal for a Cybercrime law, an initiative led by the Office of the Director of Public Prosecutions. Significant financial resources have also been earmarked by government for security and cyber security in particular. There are also partnerships between government and private sector in deploying cybersecurity centres. The private sector has employed practical measures to protect their businesses. However, businesses such as mobile money providers and banks have been shy to divulge their cyber security concerns to protect their interests. Civil society on the other hand has raised concern about the line between protecting the cyber space and creating a facilitative environment for innovators as well as protecting the rights of users. Are our efforts at deterring cyber-crime the correct way to assure cyber security? Are fears about a partnership between government and private sector and the general fears about stifling innovation and human rights in the name of cybersecurity legitimate? Are there other practical approaches that different stakeholders can take to enhance cyber security? Over to you. -- Grace L.N. Mutung'u Nairobi Kenya Skype: gracebomu Twitter: @Bomu <http://www.diplointernetgovernance.org/profile/GraceMutungu>

1 0

Re: [kictanet] [Security Forum] #KeIGF15 Online Discussions Day One: Inclusiveness and Diversity
by meshack emakunat 20 Jul '15

20 Jul '15

Hi all, making inclusiveness and diversity a norm within our policy formulation mechanism will require the utilization of governance structures (county governments) ------------------------------ On Mon, Jul 20, 2015 6:07 AM PDT Mwendwa Kivuva via kictanet wrote: >Thank you Grace and Barrack for this important topic. > >I will start by sharing the sentiments of the Speaker of the National >Assembly Justin Muturi. >http://www.nation.co.ke/oped/Opinion/Kenyans-must-be-involved-in-all-proces… >The speaker lamented that public participation ... and consultation in >matters of national building are either not happening, or not enough. >"citizens wanted to be consulted on everything being done on their behalf >by their leaders and that transparency was not optional", he said. > >As it stands, the Communications Authority of Kenya is in limbo after the >court threw out the sitting board pending appeal. Is it possible that there >was proper consultation by the Ministry and Cabinet Secretary of ICT, but >some people did not feel their "interests" were covered well enough and >opted to run to the courts? > >Well, being a member of the CA board may attract bigger allowances, >probably the reason why the litigants did not bother with the important >Universal Service Fund (USF) Council. The USF is supposed to be the >ultimate inclusiveness and diversity tool when it comes to offering a >semblance of uniform communication services to all Kenyans may it be radio, >postal, telecommunications or cyber services. I am yet to see any report on >how the USF Council has contributed to bridging the digital divide using >the funds at their disposal. A little history here will help. The >Universal Service Advisory Council (USAC) was entrenched in the Kenya >Information and Communications act (1998) to advice the then CCK and give >policy guidance in the implementation of the USF. The term of the first >USAC expired in January 2014, and a new Council put in place from May 2014 >to May 2017. I understand there are a few pilot projects that have been >setup across the country by the USF, but we would like to see a report on >the same from the said Council, and probably measure the effectiveness of >these projects. > >There is also the issue of "Multi-stakeholder-ism", how is it playing out >in our ICT landscape? Does the word make any sense to the different >stakeholders? How are partnerships forged between say government and >business community or academia? Well, I have seen many initiatives in the >country where the different stakeholders have partnered and blended really >well to transform the society. A good case is our celebrated ICT hubs >especially in Nairobi ... iHub, iLab, C4Dlab, Nairobi Garage, e.t.c. where >businesses have partnered with the government and academia and the >technical community to give our youth hope and opportunities in life. "The >Kenyan Dream". Truly, multistakeholderism can work. We only need to put >more effort, and recognise the important role eac stakeholder plays. > >Sincerely, > >______________________ >Mwendwa Kivuva, Nairobi, Kenya > >"There are some men who lift the age they inhabit, till all men walk on >higher ground in that lifetime." - Maxwell Anderson

1 0

KICC: INVITATION TO THE GLOBAL ENTREPRENEURS SUMMIT (GES) - 2015 KNOWLEDGE PROGRAM ON 22ND AND 23RD JULY AT KICC
by WANGARI KABIRU 17 Jul '15

17 Jul '15

Warm Greetings Colleagues, There was a query on GES. Some may find this useful ....closer to it. Read and if interested, kindly register directly through the contacts given below - deadline Friday July 17. Blessed day. Regards/Wangari --- Pray God Bless. 2013Wangari circa - "Being of the Light, We are Restored Through Faith in Mind, Body and Spirit; We Manifest The Kingdom of God on Earth". On Friday, 17 July 2015, 10:52, William Kalombo <wkalombo(a)marketingafrica.co.ke> wrote: timetable The Government of Kenya will be co-hosting the 6th Global Entrepreneurship Summit (GES) 2015 jointly with the US Government in Nairobi from 22nd to 24th July 2015. Organized in different parts of the world since 2009, the summit has emerged as a global platform for bringing together entrepreneurs, leading business persons, investors, international & government organizations to strengthen ties as well as to focus on the contribution of entrepreneurship to economic prosperity. As a precursor to the event, the GES 2015 coordinating Committee in conjunction with the KICC has organized an exhibition to show case Kenya’s entrepreneurial and innovative culture on 22nd to 24th July 2015 at the KICC. During the exhibition, there will be a two (2) days knowledge sharing program focussing on innovation and promotion of entrepreneurship. On behalf of The KICC, we wish to cordially invite those who wish to attend the knowledge program set for 22nd and 23rd July to confirm attendance via mail to: geexpo(a)kicc.co.ke. Copy: info(a)marketingafrica.co.ke and: WMairura(a)marketingafrica.co.ke. Kindly include your full names, company details as well as cell number for ease of registration for participation. Registration window closes cob Friday 17th and is on a first come basis. A more detailed program will be shared with those who confirm attendance. We thank you once again for your indulgence and wish you a great week ahead! William Kalombo, Chief Executive Officer, Marketing Africa Limited, P. O. Box 36481 - 00200,Cell: +254 - 0722 – 236 522, NAIROBI – KENYA

1 0

Communications Authority of Kenya in trouble, AGAIN
by Mwendwa Kivuva 17 Jul '15

17 Jul '15

Once upon a time, there used to be a Greek Philosopher called Diogenes of Sinope who lived circa 300BC. With all his flaws aside, Diogenes used to walk during the daytime with a lantern. Asked why he would say, "I am looking for one honest man". His philosophy was the unreasoning behavior of the people around him meant that they do not qualify as human. Fast-forward to modern Kenya, we were lucky to have a learned President by the name of Kibaki whose party DP had a lantern as it's logo. It's no coincidence then that during Kibaki's regime, Kenya experienced high economic growth, and drastic reduction in corruption. The Court of Appeal has rejected the Ministry of ICT request to have the CA board in office pending the appeal. http://www.nation.co.ke/business/Court-rejects-bid-to-keep-CA-board-in-offi… This ruling has several implications, one of them being the appointment of the Director General Francis Wangusi may be deemed null and void because his appointment came when CA did not have a substantive Board in place. Well, that is not what I wanted to talk about. The Ombudsman is probing allegations that the said CA Board has been allocating themselves hefty allowances totaling 10 million in 5 months. http://www.nation.co.ke/business/Ombudsman-probes-claims-of-irregular-allow… If those allegations are true, I wonder why the Cabinet Secretary would want to keep a criminal board at CA. I'm just wondering why honorable Kenyans appointed into positions to oversight running of important institutions like CA turn into hyenas and start devouring the institutions. Is this the reason the community has been advocating for simple reports from CA like the use of Universal Service Funds (USF) to no avail? Are these the people derailing President Uhuru's digital government, and the President's honest fight against corruption? CS Dr. Matiangi, please shine your lantern over at Communications Authority. Yours Sincerely, ______________________ Mwendwa Kivuva, Nairobi, Kenya "There are some men who lift the age they inhabit, till all men walk on higher ground in that lifetime." - Maxwell Anderson

1 0