Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 866. The 5th Respondent also maintain that there are sufficient safeguards in law and that Kenya has adequate infrastructure to protect data, and point to the various levels of security applied to safeguard the collected data, namely that the data is encrypted, and access is restricted using almost impenetrable and highly sophisticated mechanisms in line with international best practices, assuring confidentiality and integrity of data. Further, that NIIMS adopted UNICEF remedial measures which addressed the gaps in data sharing protocol between government agencies, underwent sufficient tests and trials, and was benchmarked on errors that was a problem in other jurisdictions including India, in order to provide a system that will not be threatened by malicious individuals. 867. The 5th Respondent further submits that their experts had demonstrated that there are no deficiencies in the NIIMS system design, and that the data in the custody of the State is well secured. That Mr. Brian Omwenga, who was its expert witness, was categorical that access and security of the data is subject to three common modes of authentication, namely, something you know, such as a password; something you have, such as an access card; and finally something you are, such as biometrics. Further, that the said expert stated that any or all of three modes of authentication may be incorporated in identity systems, and that while it has become common practice to combine the said modes, it is generally agreed that a most robust factor of authentication and identification is based on biometrics. 868. It was the further submission of the 5th Respondent that the evidence of the expert witness was that identity systems entail the maintenance of population registers which contain selected personal information, including biometrics, pertaining to each member of the resident population of a country, and that the population registers may either be centralized, decentralized or a combination of both. Further that they could also be manual or electronic, and that the United Nations Principles and Recommendations for a Vital Statistics System, provides that a population register need not take a specific form. 869. It was also argued by counsel for the 8th and 9th Interested Parties that the use of integrated databases, including DNA databases is now one of the most effective tools in fighting crime especially crimes involving violence, terrorism and sexual offences. The said Interested Parties argue that the consolidated Petitions are predicated on the theory that governments should be treated with suspicion and are not to be trusted with data or are incapable of responsibly dealing with data, yet millions of Kenyans have entrusted their most private data with private entities and social media companies including Facebook, Twitter, Tinder, and Google, who retain such data in cloud repository servers. 870. The last limb of the arguments made on the inadequacy of the safeguards of personal data, was on the paucity of information on the security features of NIIMS. The 1st Petitioner’s submissions on this aspect were that the thrust of the Respondents’ arguments were on “security by obscurity”, which is a largely elementary and discredited approach to data security, and is also a convenient means of ensuring that neither the Petitioners, nor this court, nor any data subject, will be able to verify the truth of the Respondents’ unsupported assertions concerning the security of data, the technical constraints on purpose creep, or any of the other design features that might mitigate the concerns raised in these petitions, given that once a biometric system is compromised, it is compromised forever. 871. The 1st Petitioner further submits that the Respondents have furnished no information on how individuals will learn of, let alone address, flaws in original data registered associated with their person, or false positives and negatives generated through the (non-public) algorithms being employed, at any stage (enrolment or authentication, for example). In addition, that there is no information concerning how the Respondents will address discrepancies in existing administrative data housed in functional institutional databases. 872. The 2nd Petitioner on its part submits that Loyford Muriithi one of the Respondent’s experts, in his evidence on cross-examination admitted that a certain level of information on architecture can be shared without compromising the system, to facilitate critique and understanding of the system by persons skilled in the art of http://www.kenyalaw.org - Page 144/174