Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR children, and alien card number in respect of registered foreigners resident in Kenya, as well as facial image and fingerprints of all available fingers. Secondly, since some registrants may have distorted fingerprints, NIIMs has fingerprint-extraction software programmed to repair distorted fingerprints prior to either templatization or matching. Thirdly, where repair is impossible or where fingerprints are unavailable, other data points would, collectively, be used for purposes of uniquely identifying the affected individuals. He therefore deposed that no individual will be denied a Huduma Namba on account of either lack of, or distorted, fingerprints. 440. Mr. Omwenga expressed the opinion that the enrolment rejection of a genuine individual trying to enrol is a definite impossibility. In his view, associating NIIMS with India’s Aadhaar is inaccurate based on the fact that the analysis by Mr. Anand and the conclusions derived therefrom were made on the unfounded assumption that NIIMS is architecturally and functionally similar to Aadhaar. Further, Aadhaar, as was described by Mr. Anand, is a singular identity system which relies, solely, on fingerprint matching. He noted that the analysis by Mr. Anand does not disclose whether there were corrective measures in place to remedy the alleged high rates of false rejections and false acceptance. Conversely, NIIMS is a multimodal identity system that relies on both biometric and biographical matching. Therefore, whereas Aadhaar is probabilistic, NIIMS is deterministic. He further averred that the said analysis disregards the inherent difference in both context and population demographics between India and Kenya, and neither does it take into account the operationalization difference between the implementation of NIIMS and the implementation of Aadhaar, that is while Aadhaar was commercialized, NIIMS was not. 441. According to Mr. Omwenga, ideally, multimodal identity systems such as NIIMS comprise several functional programmes that are variously derived from different source codes. However, the sensitive components of identity systems such as the various deduplication algorithms, encryption and decryption programmes, security programmes, amongst others, ought to be derived from closed source software as opposed to open source software regardless of the cost implication, for several reasons. First, sensitive programmes that run on open source software are vulnerable to cyber-attacks. 442. Secondly, open source software rides on the presumed goodwill of the coding community which assumption is flawed since open source software attracts all and sundry, including persons with malicious intent. A third reason is that closed source software fosters accountability unlike open source software which does not inspire accountability for the simple reason that the general public is a non-entity. Lastly, whereas the innovation cost of the open source software is borne by the general coding community, the costs attributable to additional services, assistance or added functionality are non-transferable and open source software is therefore not entirely free. 443. Mr. Omwenga further averred that NIIMS will only maintain a national master population register in electronic form, the NIIMS database and the type of personal information that will be kept in the said national master population register is expressly stipulated in the NIIMS digital data capture form and will be kept as encrypted templates. Therefore, without the requisite decryption key, a third party will not be able to unmask any encrypted personal information. That even if one was able to gain unauthorized access to the NIIMS database and unmask the personal information kept therein, it would be of insignificant commercial value. In his view, however, even if the purported ‘massive’ costs of data breaches were to be internalized, NIIMS would still pass a costbenefit analysis. 444. With regard to the contents of Dr. Thomas Fisher’s affidavit, Mr. Omwenga observed that four (4) of the exhibits therein are authored by Privacy International which is not a party to these proceedings, and no evidence has been tendered to show whether the said documents have, at the very least, been peer-reviewed. Further, that the exhibit on the United Nations Principles and Recommendations for a Vital Statistics System is inapplicable to the issues of content, procedures, responsibilities and rights of data subjects, and the pros and cons of a national master population register. He observed that the World Bank Group has expressly disclaimed the findings, interpretations and conclusions expressed in the exhibit on “Privacy Design: Current Practices in Estonia, India and Austria” at the first page of the said document. It was therefore his averment that the said documents are http://www.kenyalaw.org - Page 65/174