Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR the internet, citizens can use two core functionalities provided by the identity card, both of which are essential to the development of e-government. 472. The first PIN-code allows citizens to authenticate their identity so that the corresponding e-service knows the identity of the user. This is a first step that provides basic enabling infrastructure to provide personalized services and information via online means. The second PIN-code is used to sign documents or approve transactions online. Based on the foregoing, the authentication of an individual’s identity in a digital environment in Estonia is dependent on what an individual has, a PIN code, as opposed to what an individual is, biometrics. Mr. Muriithi therefore averred that the inherent risk of an identity authentication based on what an individual has is not foolproof as anyone who accesses an individual’s PIN-code can represent himself as being the individual in question, hence arrogate unto themselves the said individual’s identity. 473. According to Mr. Muriithi, in order to avoid the risks inherent in the Estonian identity model, the government of Kenya consciously resorted to premise the authentication of an individual’s identity, in a digital environment, on what an individual is, instead of what they have. 474. It was also his averment that whereas NIIMS uses data capture kits manufactured by IDEMIA/OT Morpho, it does not use any OT Morpho software. He averred that all the hardware components of NIIMS, including the data capture kits, were screened for any software including but not limited to data-mining software before their respective programming in Kenya. Further, all the registration and encryption programmes that run on the said hardware components of NIIMS were developed and installed locally by the government of Kenya. In the premises, NIIMS does not use OT Morpho deduplication algorithms. 475. It was also Mr. Muriithi’s deposition that during the design architecture of NIIMS, the government of Kenya anticipated the possibility of certain individuals missing some biometric features or having biometric features that may not be captured by the biometric data capture kits. Accordingly, it adopted specific design features to obviate possible exclusion of such individuals and included the use of additional biometric features such as facial images and biographical information such as date of birth, parentage information, residency information, birth certificate serial number, national identity card number and alien card number to corroborate fingerprint matching; the digital capture of all the fingerprints from available fingers of an individual with a view to maximizing the probability of perfect fingerprint matching; and the use of dactyloscopic (fingerprint) experts to manually counter-check every enrolment rejected by the fingerprint deduplication algorithm on the basis of attempted multiple enrolment by the same individual. In the circumstances, it is highly unlikely that an individual may be denied enrolment in the national master population register on the basis of either missing fingers or having distorted fingerprints. 476. Mr. Muriithi further averred that being a multimodal identity system, NIIMS has several programmes that variously perform specialized tasks which collectively result in the creation of a digital biometric national master population register from which respective identities of individuals may be established with precision. Some of the said programmes were derived from open source software whereas some were derived from closed source software depending on the sensitivity of the tasks performed by the said programme(s) and the attendant procurement costs. 477. Specifically, the costly programme that perform non-sensitive tasks were derived from open source software, which explains why NIIMS data capture kits were programmed to run on android operating system. On the other hand, programmes that perform critical and highly sensitive tasks such as encryption and deduplication were derived from closed source software in respect of which the government of Kenya restricts the sharing, viewership and modification of the underlying source codes to essential personnel only. He expressed the view that it would therefore amount to veritable irresponsibility on the part of the Kenyan government to disclose, to the general public, the very codes that found the programme meant to guarantee the safety of personal data of its citizens and foreign nationals resident in Kenya. http://www.kenyalaw.org - Page 70/174