Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR online article by Dr. Hans Varghese Mathews titled “Flaws in the UIDAI Process” published in the Economic and Political Weekly, 26 February 2016, Ll No. 9 which found that in India’s population of approximately 1.2 billion, approximately 10 million people (0.8%) would be excluded from the system as a result of false positive matches. 35. According to Mr. Anand, independent research conducted over a period of time had established that deduplication is by no means a natural consequence of the introduction of an identification system that relies on biometrics. His opinion was that the Kenya government had not taken this body of evidence into account, given its over-reliance on the assumption that biometric uniqueness is beyond question. He further expressed the view that because the reliability of any biometric-based identification system depends on mathematical calculations, it is critical to have public disclosure of the technical data on the deduplication algorithm, and that this should be published along with the sample data so that experts can analyse it. His testimony was that he was not aware that the Kenyan State had publicly disclosed the algorithms used to identify “duplicate” biometric data. 36. It was Mr. Anand’s evidence that there could also be failure of biometrics at authentication stage. He defined ‘biometric authentication’ as a comparison between the biometric parameter (iris or fingerprint) versus what was stored during enrolment and termed it as a biometric comparison across time. He took the position that for this to succeed all the time, an important pre-condition must exist, namely the condition of immortality or, in other words, that the individual’s chosen biometric parameter does not change across their entire life time. This, he stated, is not the case for both iris and fingerprints, and even for DNA, as mutation or a radiation exposure alters DNA. 37. Mr. Anand testified that while laboratory results on biometric authentication show a high probability of success of around 99%, the real-world data is very different. It was his testimony that women and poorer citizens, including manual labourers, domestic workers, homeless people, and agricultural workers were the most likely segments of the population to be excluded by biometric authentication. He supported his averment by citing the experience in India, where studies demonstrated high rates of exclusion. He further cited section 5 of India’s Aadhaar Act which, although not yet adequately implemented to date, at least recognizes that special measures would be needed to address exclusion of large categories within the population. He concluded that to his knowledge, Kenya has no such provision in connection with the implementing legislation authorizing the establishment of NIIMS. 38. On the security of data collected through NIIMS, Mr. Anand averred that it is self-evident in computer security that nothing is truly secure, and the relevant considerations are the costs and benefits of collecting and keeping data. His view was that centralised databases such as Aadhaar and NIIMS hold so much data that the cost- benefit ratio tilts in favour of hackers or those who want to compromise the personal data. It was his testimony that the number of times the Aadhaar database has leaked is beyond counting. Further, that data leaks caused by centralization is not a perception, but an outcome that can neither be avoided nor mitigated. According to Mr. Anand, this realization forms the basis of the design of modern-day computer systems where decentralization becomes the central design principle. He termed NIIMS as an archaic design compared to modern-day system architectures and equated it to “a horse-bungee drawn by a lame horse on the digital highway” whose digital journey was bound to end in failure. 39. With regard to how NIIMS would negatively affect Kenya’s security, Mr. Anand averred that given the complexity of the NIIMS project, all parts must be audited through public disclosures or else terrorists or spies can infiltrate the NIIMS system by exploiting its inherent weakness. It was his averment that this happened in Aadhaar, where numerous cases of enemies of the state masquerading as citizens obtained Aadhaar numbers. He made reference to various internet sources for this statement, and concluded that it is in the public interest that the state discloses the algorithms and systems used to construct the NIIMS project for national security reasons. 40. Mr. Anand’s conclusion was that the NIIMS project is functionally, architecturally and technologically similar to the Aadhaar system and suffers from the same flaws. In his view, while the Kenyan government may promise http://www.kenyalaw.org - Page 8/174