Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR system, accuracy of NIIMS and misuse of data. He could not, however, confidently explain what NIIMS was since he was only involved in giving advice at the initial stage. His evidence was that it was the client, the Ministry of ICT, that was involved with designing NIIMS. 453. With respect to biometric registers, it was his evidence that he was only aware that the existing databases were only collecting fingerprints. He stated that he did not know the legal framework on NIIMS but he knew that some law brought it into existence. It was his testimony that the security, privacy and misuse concerns on NIIMS could be addressed if the recommendations he had already given to the government were used. His recommendation entailed the use of a unique identifier on government enterprise architecture, security architecture and predefined security policies. 454. It was also his view that security systems should be predefined in some policy document, noting that some of the personal information to be collected by NIIMS is sensitive. He observed, however that not all information may require the same level of security and protection. It was his deposition that the implementation plans need to be kept secure to make the system secure, and the security process should be predefined so that data is not misused and someone who is not authorized does not access the data. 455. With regard to the issue of encryption of data, his evidence was that he did not know the encryption standard the government employed for the data collected in NIIMS. He further stated that if the government were to predefine its encryption standard for data it collects in NIIMS, it would address the Petitioners’ concerns. 456. On re-examination by Dr. Nyaundi, and Mr. Njoroge Regeru, Mr. Omwenga emphasized that his role was advisory and that his report was not a NIIMS report, but made recommendations to be taken into consideration in the design of NIIMS. He reiterated his evidence on centralized and decentralised identity systems, and that centralized systems offer more protection to data. Further, that NIIMS is both an identity and identification system as the accuracy of its data on identity is what will aid in identification. Mr. Omwenga stated that NIIMS will have various identity attributes in a multi-modal way, and will be more deterministic than probabilistic. In conclusion, he stated that there is competence in our local professionals to design a system such as NIIMS, and denied that it is an archaic system. 457. The 5th Respondent’s second expert witness, Muchemi Wambugu set out in his affidavit extensive details of his qualifications and experience. Of importance for present purposes is that he is a Management Consultant and founder of Sirius Consult which focuses on technology-led organizational transformations. Until 2016,he was a Partner in Technology Consulting Practice and the Advisory Leader for County Initiatives at Price Waterhouse Coopers, Kenya. He had also worked at Deloitte Consulting Ltd in Kenya and IBM Global Services in California, USA. He is therefore an accomplished ICT Management professional with more than 20 years of experience in advising both public and private organizations on business-centric ICT solutions, has extensive experience in global technology implementations, ICT transformation, strategy, operations, governance and programme and change management. 458. Mr. Muchemi averred that he undertook research and authored a report titled the Strengths, Weaknesses, Opportunities and Threats Analysis of the Existing Identification and Registration Systems in Kenya, 2017 and had discovered several weaknesses regarding Kenya’s identity systems. These were a lack of data harmonization; use of birth certificates numbers that do not uniquely identify individuals; duplication of data collection by government agencies; fragmented and uncoordinated registration and vital systems; untrusted relationship between the birth registration and the ID registration process; gathering of data in disparate and disjointed silos; systemic data corruption, data integrity and data quality issues. He had recommended in the said Report, among other things, addressing the gap in the data sharing protocols between government agencies, executing the government systems enterprise to allow for data access, security and governance in dealing with vital national data and the use of block chain to enhance data security. http://www.kenyalaw.org - Page 67/174