Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR testified that delivery of services is not one of the purposes of NIIMS, and that there is no law that establishes the Huduma Namba. He explained that the term Huduma Namba is a communication concept for Kenyans to understand the nature of NIIMS as an integrated identity system, and denied that it was used to engage in a deception campaign and coerce Kenyans to register in NIIMS. He further testified that he was not aware of any law that regulates Article 31(c) of the Constitution, or creates the office of a Data Protection Commissioner or data controllers and processors. 423. Mr. Ochieng accepted that an identity card is required for registration for a Huduma Namba but denied that a Kenyan without an identity card would be filtered by the NIIMS system as a non-citizen. On the verification processes by NIIMS and the logs to the system by other government agencies, he stated that it would be possible to tell where the interactions with the system occurred, and that the Access to Information Act regulates access to such metadata. 424. Mr. Waikwa concluded his cross-examination with questions on the NIIMS system design. The response from Mr. Ochieng was that NIIMS is a hybrid system that has interaction between a master database and functional databases. Further, that there will be no inter-linkages between the functional databases. He disagreed that the way of dealing with data breaches is to have a decentralised system or by minimization of data, but rather to have enough data and secure it. He however admitted that the design of NIIMS can still be technically changed. 425. On cross-examination by Mr. Awele, Mr. Ochieng testified that the existing registration databases are in the National Registration Bureau, the Immigration Department for passports and the Civil Registration Department. He stated that NIIMS introduces biometrical digital data because of the uniqueness of biometrics. He reiterated that the development of the NIIMS software was not an event but a process that started in 2018, before the enabling law was enacted. 426. Mr. Ochieng was cross-examined on the design and security of NIIMS, and stated that architecturally and technically, NIIMS has several layers. These are the data layer, the application system and the users layer, which all use encryption and are therefore adequately secured. Mr. Ochieng also stated that the report by Mr. Omwenga on Government Wide Enterprise Architecture was used as a guideline in the development of NIIMS and has not been formally adopted by the government. He admitted that the security policies of NIIMS have not been published, as this would compromise the system, and also that the public was not informed on the risks but only the benefits of NIIMS. Mr. Ochieng further stated that the Data Protection Policy guidelines as well as internal ministerial guidelines regulate the interoperability mechanisms and misuse of the data. He confirmed that the government had undertaken a Data Protection Impact Assessment of NIIMS whose report was not made public, and that an audit of the system is possible under the Access to Information Act. 427. During re-examination, Mr. Ochieng reiterated his evidence as to the nature of NIIMS and its benefits, its design, and the protection and security safeguards that are in place to protect the data collected by the system. 428. Mr. Brian Gichana Omwenga, the 5th Respondent’s expert witness, deponed that he is a software and systems engineer and an Information Technology Consultant, holding a Master’s Degree in Engineering Systems, Technology and Policy from the Massachusetts Institute of Technology (MIT), and is a Ph.D. Candidate in Computer Science. He also stated that he is a lecturer in Computer Science at the University of Nairobi and is the founding chairman of the Tech Innovators SACCO Ltd, an initiative that seeks to consolidate the Kenyan technology community through an empowered cooperative movement for the support of digital entrepreneurship. Further, that he is also the Chairman of the Industry Technical Committee that sets software and systems engineering standards at the Kenya Bureau of Standards (KEBS), and has previously worked in various capacities for Microsoft PLC, Nokia Research Africa, PricewaterhouseCoopers Kenya and Nokia Research Cambridge in Massachusetts, USA. Mr. Omwenga also averred that he has carried out various consulting assignments that have received several awards and global recognition and his research work has resulted in various published papers and http://www.kenyalaw.org - Page 62/174