Some time towards the end of 2015 the Communications Authority of Kenya (CA) released six documents that would amend the Kenya Information and Communications Act, for public comment.
Public Consultations on Draft Kenya Information and Communications Regulations
These documents were zero drafts, which means they are the first versions and are not yet even on the path to becoming laws as they are not even in parliament.
The proposed amendments drafts address the following issues:
- Universal Access and Service
- Infrastructure Sharing
- Cyber security
- Electronic Transactions
- Electronic Certification and Domain Names Administration
Some disclaimers from me.
First, I read all the documents except the one on broadcasting. It was excruciatingly long and it covers an industry I was not interested in (which is not to say it’s not important).
Second, I’m not a lawyer nor have I ever attended a class on law.
Lastly, while there’s a lot that’s great with these proposed amendments – the section on electronic transactions comes to mind – this post will be looking at everything that’s wrong.
Unfortunately, I’ve gotten criticism that I’m always looking for the negative aspect in things, but somebody’s got to be that guy!
Now that that’s done let’s get into it.
In the definition of cybercrime:
"any activity in which a computer system or network are a tool, a target or a place of criminal activity. This shall include offences against the confidentiality, integrity and availability of computer systems and copyright-related offences."
We have copyright-related offences described as part of cybercrime. That phrase should be removed from the definition. It is misplaced here. The potential damage caused by this, compared to the other crimes listed, is minor.
This may lead to exaggerated punishments for the mere mistake of uploading the wrong picture, video or audio online.
If there’s a need to cover copyright-related offences then the copyright law should be amended to add computer related violations which is the best place for them.
In section 4, Attack on Computer Systems, it is stated that it shall be an offence to:
1. gain or attempt to gain unauthorized access to part or all of a computer system or exceed authorized access;
2. gain or attempt to gain unauthorized access to part or all of a computer system or exceed authorized access with intent to commit another offence or facilitate the commission of such an offence;
3. remain or attempt to remain fraudulently in part or all of a computer system;
4. hinder, distort or attempt to hinder or distort the functioning of a computer system;
5. enter or attempt to enter data fraudulently in a computer system;
6. damage or attempt to damage, delete or attempt to delete, deteriorate or attempt to deteriorate, alter or attempt to alter, change or attempt to change computer data fraudulently.
This section makes no effort to distinguish between attempts and actual attacks. Other laws have different sentences for attempts and actual attacks, I don’t see why this can’t be the same for cyber crimes.
Also, the law makes no mention of intent, which makes white hats, who discover vulnerabilities for pay and for fun, particularly exposed. This also applies to section 5 on Computerised Data Breaches, which states:
"participate in an association formed or in an agreement established with a view to preparing or committing one or several of the offences provided for under this Convention."
The above makes white hat groups and security consultants, such as AfricaHackOn, vulnerable.
Section 6, Content Related Offences, part f states:
"threaten, through a computer system, to commit a criminal offence against a person for the reason that they belong to a group distinguished by race, colour, descent, national or ethnic origin or religion where such membership serves as a pretext for any of these factors, or against a group of persons which is distinguished by any of these characteristics"
The singular word gender, is missing and should be added as discrimination against women is rampant. Leaving out this one word excludes half the population, a population that has historically been sidelined and left unprotected. I hope this will be corrected in the next draft.
Section 6, part h states:
"deliberately deny, approve or justify acts constituting genocide or crimes against humanity through a computer system."
This should be removed.
It’s vague, largely depends of the views of historians and also assumes to try to control how people think also I doubt that a similar law exists for offline line equivalents, but I could be wrong.
Some of the proposed amendments by the Communications Authority of Kenya address cyber security & electronic transactions. Tweet
Section 7, Operation and use of cybercafes and public wireless hotspots states that Operators of Cyber Cafes and Public Wireless Hotspots shall:
1. identify users before providing them with services;
2. provide a system for user registration which ties each user to a mobile phone number. Operators of cyber cafes and public wireless hotspots shall be required to inform users of their service that it is illegal to use an unregistered mobile phone number for registration and access to cyber cafe and public wireless hotspot services;
3. Information collected in (b) shall be made available to the authority for further action, as and when is deemed necessary.
4. maintain a register for all its clients;
5. install Closed Circuit TeleVision (CCTV) cameras to record the identify of its clients;
6. use Public Internet Protocol (IP) addresses for its computers;
7. ensure that system logs are retained in their original for periods of not less than one (1) year from the date of the communication. The Authority may issue guidelines on retention of communication logs from time to time.
8. required to report any cyber-crime incidents to the Authority within 24-hours and as may be prescribed by the Authority from time to time;
**9.**required to obtain an authorization from the Authority to provide cyber-café and public wireless hotspot services;
**10.**submit compliance returns to the Authority as may be prescribed from time to time.
This entire section should be removed as it’s wholly impractical and a violation of several constitutional rights particularly the one of privacy.
The information collected can be arbitrarily demanded by the authority without a court order so if this section is to remain, and it shouldn’t, there needs to be some sort of oversight provided by a judge. Finally implementing this will be expensive both on the side of the operators and that of regulator. It also adds yet another license to do business in part I that will impede the ease of doing business. Further the meaning of public wireless hotspots is not defined at all.
Part 5 Scope of Application states:
"These Regulations shall apply to any service provider. Such service providers shall require an authorization from the Authority."
Given the broad definition of service provider:
"any public or private entity that provides to users of its service the ability to communicate by means of a computer program, computer, computer system, or network, including the services that support the development or utilization of computer programs and/or the creation, storage, retrieval, processing, management, and deletion of computer data, traffic data, and content data; and/or any other entity that processes or stores computer data, content data, or traffic data on behalf of such service as set forth in this paragraph or users of such service."
This applies to anyone trying to sell anything with an online component including using platforms like Facebook and twitter.
Implementation of the need of authorization will be difficult if not impossible, perhaps some thought should be given to adding thresholds.
Response from the Communications Authority of Kenya
Those are the few of the things that I found. I made sure to post these to the CA and though I was past the deadline I got a response, see screen shot above. I felt for the first time really part of the law making process and having done my part as a good citizen. It remains to be seen if any of my comments will be taken into the next version of the draft.
The comment section below is open for any thoughts, comments or questions.
Cover Image, Communications Authority of Kenya