Nubian Rights Forum & 2 others v Attorney General & 6 others; Child Welfare Society & 9 others (Interested Parties) [2020] eKLR 231. Ms. Munyua averred that the digital features and infrastructure of digital identification projects have very different implications from their analogue legal identification initiatives. She contended that, contrary to the assertions by the Respondents, the addition of biometrics like iris scans, ear lobe geometry and DNA data is a dramatic expansion of the existing legal identification system which goes beyond mere digitization. It was her averment that biometric and DNA linked digital identification creates profound threats of invasive privacy violations, and the potential for misuse is very high. In her view, the linking of databases has the potential to turn the NIIMS system into a pervasive means of identification, tracking, and control, as well as increase the risk of large-scale data breaches, concerns that were serious enough to require that the government allows sufficient discussion, examination and scrutiny through public consultations. 232. Ms. Munyua contended that NIIMS, like other similar national biometric identification systems, was a centralised database of the most intimate details of a country’s residents. That through the legislation authorising NIIMS, the government was contemplating collecting a wide range of extremely sensitive information, including DNA, iris scans, earlobe geometry, and fingerprints. It was not clear, according to Ms. Munyua, what purpose collecting all of this highly sensitive information serves and whether the means proposed in the law are the minimum necessary to accomplish this purpose. 233. She averred that it was increasingly universally recognized that data collected is data at risk; that the more sensitive information is stored in a centralized database, the more significant becomes the risk of harm to all people if that system gets breached. It was her deposition that while it is tempting to use biometrics as an easy way of ensuring the uniqueness of enrollees to a system, such use increases the risk associated with an identification system. In her view, if and when a biometric database is breached, DNA and fingerprints cannot simply be reset like a password, and it was also far from clear that biometrics are the only way to ensure uniqueness and avoid duplicative enrolment. 234. Ms. Munyua averred that a breach of an identification database is not just a theoretical harm. To illustrate, she cited the situation in India where, despite the government’s claims that the Aadhaar database was ‘100% secure’, there have been repeated reports of the demographic data being compromised, which has made it difficult to trust the resilience of the system against malicious practices. Citing an online article, she observed that a private citizen in India had been able to buy access to all of the demographic data in the Aadhaar database for just 500 rupees (Kshs 727). She further observed that other online reports indicated that it was possible to purchase editing rights to the Aadhaar demographic database for a mere 2,000 rupees (Kshs 2909). 235. In further illustration of the risks of digital identifications, Ms. Munyua gave the example of Estonia whose system, which had allowed cryptographic keys to be generated on a smartcard rather than a general-purpose computer, had been praised for its security and sophistication.. She averred that the system had, however, become vulnerable when the cryptographic library was compromised, necessitating significant measures to mitigate the risk. It was her contention that despite the fact that Estonia has a small population and boasts a highly developed infrastructure and a very technologically savvy population, it was necessary to take significant measures to mitigate the risk of breaches. In her view, it was unclear whether Kenya has the resources or infrastructure to mitigate a similar breach of NIIMS. 236. In supporting the position taken by the Petitioners that Kenya should have used ‘open source’ in the design of NIIMS, Ms. Munyua deposed that her company embraces ‘open source’. She stated that the term referred to “something people can modify and share because its design is publicly accessible.” She further averred that "the open source way" and “open source projects, products, or initiatives embrace and celebrate principles of open exchange, collaborative participation, rapid prototyping, transparency, meritocracy, and community-oriented development.” She argued that as a company embracing open source, Mozilla has found significant benefits in open sourcing all of its codes, including for products like Firefox, as this allows many individuals, including security researchers around the world, to find and report vulnerabilities in its codes. Ms. Munyua argued therefore http://www.kenyalaw.org - Page 35/174