Today I had the opportunity to attend a seminar organized by the Ministry of Information & Communications and Samsung SDS as part of the implementation of Kenya’s National Public Key Infrastructure (NPKI). The project is undertaken within the framework of the Kenya Transparency & Communications Infrastructure Project (KTCIP), a World Bank funded initiative that will help Kenya achieve a number of the goals under the ICT pillar of Vision 2030.

The presentations from the team from Korea consisted of representatives of Samsung SDS (who won the International tender for Kenya’s NPKI implementation) as well as representatives from some of the key actors in Korea’s own NPKI. The Korean presentations were interesting, informative and very well prepared. Over the period of a few hours they were able to take the relatively complex subject of National Public Kenya Infrastructure and unpack it in a way that was both easy to understand as well as clear and straightforward. They left no shadow of doubt as to whether Samsung SDS can successfully implement this project. They also shared the organizational structure for the project, which is as follows:

During the course of their presentations the team from Korea shared the high level plan for the implementation of Kenya’s SDS. They made it clear that they had spent a good deal of time working closely with Government officials responsible from the Kenyan side.

In describing the structure and hierarchy that has proven successful in Korea for the implementation and operation of their NPKI, the team shared the following diagram.

At the very top, there is the Ministry responsible for the NPKI, they provide the legal and regulatory framework, national authentication plan and other high level functions. Below them is the “Root Certification Authority” an organization known as the Korea Internet Security Agency (KISA), which provides operation of the National Authentication system, licensing/accreditation of certificate authorities (CA) to provide service to the public as well as development of technical standards. Below them are the accredited CAs of which Korea has 5 who provide certificate issuance and management services to the public.

In a presentation which came later, the Korean team shared the proposed structure for the Kenyan implementation which had been arrived at after consultations with Government. The diagram is as follows.

In this structure, Government who will be responsible for legal and regulatory framework, national authentication plan, other high level functions as well as licensing and auditing are to be represented by the Communications Commission of Kenya (CCK). Below them and responsible for operation of the Root Certification Authority is CCK. Below that are a proposed “Government CA” which will issue certificates for Government agencies and employees and a proposed “Private Sector CA” which will issue certificates to the rest of the country.

I have a big problem with this structure. First and foremost because CCK is being proposed as BOTH the licensing authority as well as the licensed operator of the Root Certification Authority. The potential for conflict of interest is immediately evident, not to mention the fact that the end-to-end integrity of a structure that ensures top-down accountability is rendered completely void. Even worse was the mumbled suggestions by some of the government participants at the seminar that CCK might also act as the Government CA. In addition that is the fact that a project as crucial as this has not gone through a proper stakeholder consultative process and is seemingly being shoved down our throats. In his closing remarks a director a the E-Government directorate asked the ICT Board to engage stakeholders further and receive input before moving too far.

I raised this point as a question during the Q & A session at the end of the seminar and would like to emphasise that it would be very wrong for CCK to be the Root Certification Authority for a number of reasons:

The Government should immediately consider adopting a Public Private Partnership approach for the implementation of Kenya’s NPKI. This is especially timely because we now have a fully ratified Public Private Partnership Policy that provides a variety of models for project implementation. This will not only ensure involvement from crucial stakeholders but also free the Root Authority from the problems highlighted above (and probably many others) while at the same time ensuring that enough private sector energy and enthusiasm is infused into the project so that it moves with speed and determination. Success stories such as KENIC and TEAMS show that it is not only possible but that it can be done with ease.