Confronting issues in Kenya’s national identity scheme with Grace Mutung’u – Podcast Episode 17

Podcast: Play in new window | Download

Subscribe: Apple Podcasts | Spotify | Pandora | Email | TuneIn | Deezer | RSS | More

Let’s Talk About Digital Identity with Grace Mutung’u, internet policy advocate and research fellow at CIPIT.

This week, Oscar chats to Grace Mutung’u about challenges for digital identity in Kenya and the various considerations for inclusive national identification, including historical, social and economic issues. She fills us in on the court case against Huduma Namba (Kenya’s national ID platform) that she has been involved in and its recent judgement to rule out unnecessary DNA and GPS data collection, and the framework that must be in place before being fully rolled out.

[Scroll down for transcript]

“We need to think about identities before thinking about applications of digital technologies.”

Grace is a research fellow at the Centre for IP and IT Law (CIPIT) at Strathmore University, studying digital ID and society in Kenya. She has been involved in ICT policy advocacy for over 10 years and was most recently providing support during litigation in Kenya’s digital ID case.

Find Grace on Twitter @bomu.

Find out more about the Centre for Intellectual Property and Information Technology Law (CIPIT) – a think tank and training centre established under Strathmore Law School at cipit.org.

We’ll be continuing this conversation on Twitter using #LTADI – join us @ubisecure!

Go to our YouTube to watch the video transcript for this episode.

 

[Podcast transcript]

[Intro] Let’s Talk About Digital Identity, the podcast connecting identity and business. I am your host Oscar Santolalla.

Oscar Santolalla: Hello and thanks for joining today. Today we’ll hear for the first time how is digital identity in the African continent. So, for that we have a special guest who is Grace Mutung’u. Grace is a research fellow at the Centre for IP and IT Law at Strathmore University in Nairobi studying digital identity and society in Kenya. She has been involved in ICT policy advocacy for over 10 years and was most recently providing support during litigation in Kenya’s digital ID case.

Hello Grace.

Grace Mutung’u: Hi, Oscar. Thanks for having me.

Oscar: It’s a pleasure. I’m happy to have you today on the show. So the first thing I would like to hear from you is how you entered in the world of digital identity? What was your journey?

Grace: I just kind of stumbled upon it. I have been working in ICT policy work here in Kenya. And in 2017, we had the general elections and – something about Kenya is that people take their politics very seriously. For us in the ICT space we were observing use of technology in the elections. And we observed that there was a lot of use of digital identity from two spaces.

One is that the politicians were using identity data from the voters register to target voters, to vote for them. And then at the same time there was also use of social media for political discourse for political mobilisation. And later on, the news came out that one of the political parties had actually engaged the firm Cambridge Analytica for voter targeting and some sort of political manipulation. So after that we really got into the work of advocating for our rights based digital identity for data protection and for political accountability for use of digital identity data.

Oscar: And what would you say are today the main challenges in digital identity that Kenya is facing?

Grace: I’d say one big challenge is that there has been a lot of importation of ideas, technology and hardware. So for example, Kenya is one of the countries in Africa that has always had a legal identity. In Kenya, it’s the normal thing to walk around with a card, a national identity card. It’s very normal to be asked for your card in order to access a building. This just started from a long time ago during the colonial period and then over time it’s become normalised because of the security challenges that we’ve had, the terrorism issues that we’ve had, so it’s very normal to walk around with the paper identity.

But there have been a lot of problems with the paper identity because that identity is also proof of citizenship or status whether one is a resident or whatever else or refugee. So there are people who historically have not been able to get this identity document and therefore they have been unable to access a lot of things – from accessing buildings, to employment, to financial services because it is just so normal that you have to have an identity document in order to access all those things.

So now, the biggest challenge for a country like Kenya which already had a National ID is that digital ID is coming and it is targeted at those who already have identity documents. And then anybody who doesn’t have identity documents is totally excluded from the new system. So that’s one really big challenge.

And then when you think about digital ID generally, for a fact, almost all African countries are implementing a digital ID and by this I mean state digital ID – the state wants to issue a legal digital identity to everybody. But for sure Africans are not largely participating in that economy, in that digital ID industry. So you find that for most of the countries everything from the idea, to the software that is used, to the even algorithms for the identification, everything is imported.

I think the only one case we’ve seen is in Ghana where the cards are printed locally but generally there’s a lot of importation which is, if you think about it holistically is quite dangerous because it means that for a while these countries will be dependent on the suppliers of this technology. And it’s even worse for countries that don’t even insist on the companies coming to set up in their own countries so that there can be some local content. It means that people are not learning about making digital ID. We are not producers of digital ID. We are consumers of digital ID technologies which would really be a pity because it means that a lot of countries will miss out on the economic– on the whole value chain and will just be consumers and spending money on digital ID.

Oscar: That’s true. The first challenge you mentioned is that moving to digital ID made by the government is mostly targeted to the ones who already have a – let’s say the physical ID. So question here is how much of the Kenyan population doesn’t have an ID and what’s the reason why they don’t have it?

Grace: I don’t have the numbers of those who do not have but should have, but for sure some of the most problematic areas are border districts, because as you know most of the borders in Africa were drawn during the colonial period and they cut across the separated communities that had the same cultural or linguistic traditions. So you find that for example in Kenya at the southern border you find that there’s a tribe called Maasai – some are in Kenya and others are in Tanzania. Same with at the northern border with Somalia, we have Somalis from Kenya and Somalis from Somalia, same with the border with Uganda and so on.

So the other thing that happened for example with Kenya is that development has been largely concentrated in the centre which is very far from the borders and these communities for a long time did not get identity documents. There has been a lot of underdevelopment and so even registration of births is least in those areas. So now, the first issue that is always contested is their nationality. Because these communities just move across the border, just the same way this wildebeest migration which happens between Kenya and Tanzania. It’s the same way a pastoralist community like the Masai would move across the border depending on the economic reasons and so on.

So now with this digital ID you know it’s being tied to access to government services. That if somebody wants to get a passport they first have to get a digital ID. But to get a digital ID you need to have gotten either a birth certificate, which is a kind of record of where you were born, or a national ID, which is proof of your citizenship. So those historical problems like how the borders were drawn and also underdevelopment in areas that are far from the capital are some of the problems that have led to these communities not having those identity documents.

We also have communities that have peculiar cases. One of the communities in Kenya that has a problem accessing national ID, and is not a border community, is the Nubian community. This is a community whose ancestors are found in South Sudan but the Nubian community in Kenya – their ancestors were settled there by the British after the world wars. Their ancestors were servicemen and women in the world wars. So administration after administration just denied them or put barriers to them accessing ID and so we have generations of people who can trace their ancestry over 100 years in Kenya but they have difficulty getting those documents.

There are also Arabs at the coast who have most of the problems are historical and most of the problems are tied to citizenship and nationality. And that probably just goes to show us that we need to think about identity before thinking about application of digital technologies because the digital technologies are marketed as this magic bullet that will solve problems of identity in Africa. But from Kenya, for example, you can see that this is not the case. That the historical issues on citizenship and nationality that need to be sorted before digital identities is adopted.

Oscar: Yeah, I can get a feeling of this situation, especially for these minorities that are in the in the borders. So yeah, you already started mentioning the digital ID that is being run in Kenya – already for a project that is being already executed for a while. It’s called Huduma Namba ID. Could you tell us about that project?

Grace: Yeah. So, the project has been marketed as Huduma Namba. Huduma Namba is Swahili for service number. So the idea is to collate all identity information in the different government databases, to harmonise all those databases and then to have a central identity database from which ­­everybody is authenticated whenever they need to receive a government service. So the idea is that, for example, if you need to access the hospital using your national health insurance that when you present yourself, you’ll be authenticated by the national health insurance people sending a request to the central database which is being called the foundational database.

The design, from what we heard during the court case, is that every password would be issued with the card that has a unique number, before a password is issued with the card they would be enrolled, their biometrics would be enrolled in the system. Whenever they needed to access a service, they would provide their card and it would be authenticated in the foundational database.

So, for the case, there were three petitions that were consolidated into one. Their contestations in that case– the first contestation is exclusion. And exclusion is two-fold. First, there are those communities I’ve told you about – the border communities and the minorities who have a problem accessing paper documents, paper identity documents. So there’s low birth registrations in those areas, most of them don’t have the paper ID, the national ID. Therefore, they cannot be enrolled in the system. So that excludes them because the system will be a mandatory– it will be mandatory to be authenticated before you can receive a government service.

And then the other exclusion is that it wasn’t well thought out, this issue of biometrics. For example, the standard biometrics, they wanted to– or they have been collecting is fingerprints and iris and of course the face photograph for facial recognition, which really would work very well for maybe the middle class but it wasn’t properly thought out. And there’s evidence from a previous system, the one for elections, where a lot of people who do like casual laborers, people who work in the mines, women who plait hair, women who wash clothes all day, people who work in the coffee farms, a lot of those people their biometrics are not as legible and so it was difficult to use biometric identification to verify them during the voter registration exercise. And so, yeah, that was one of the contentions, exclusion for those lacking identity documents and then for those lacking proper biometrics.

And then of course, the other big contestation was privacy and data protection because at the time when this system was rolled out, we did not even have a Data Protection Act, so the Data Protection Law was enacted as the case was going on but still the law has not been operationalised. We don’t yet have the office that is supposed to oversee the law. We don’t yet have that office in place. We don’t yet have regulations that give further details on the law. We don’t have regulations on how data processes are going to register. We don’t have regulations on how government is going to handle digital ID data.

One other thing that was a privacy concern was the privacy of children because it was argued that children do not access services by themselves. And so collecting biometrics of children at six years – why would there be a need to authenticate children while they don’t have legal capacity? And then another big contention, I think the biggest one, was collection of DNA data because the scheme also wanted to have a digital DNA data bank. Well, the court found that this quite invasive and it could not be allowed.

So, in a nutshell, that is what brought about the case, basically, the issue of exclusion and also the issue of privacy. One other issue was participation, the people felt that this was such a substantive change in the governance of people that there was need to have a lot of information and a really good space for contestation and negotiation before the system was rolled out in full. Yeah, so that was the other argument, or the other ground, for that petition.

Yeah, the courts agreed on the issue of privacy. It ruled out collection of DNA and GPS data. And it also asked that the government first enacts a framework for digital ID, a comprehensive and sufficient framework before collecting the data and processing it. That is where the process will be, will be going to next. The government has already started drafting regulations. The petitioners are reviewing the judgment to also see how to engage with it and engage the government further. And we are waiting to see and waiting for even operationalisation of the data protection framework so that all the pieces can be in place before the system is fully rolled out.

Oscar: Yeah it sounds like this system has been somehow quite complex and ambitious. Sounds like there have been some problems of design. Since when this was started being designed? So how was supposed to start rolling out taking the identity of people without having all these data protection regulation? So when it started, it was very– some years ago or was done just recently?

Grace: Well, for digital ID, it started a while back. By 2015, the government had already created a platform called IPRS, Integrated Population Registry Services, that collates identity information from all the – or at least a lot of the – government databases that is on one hand. And then on the other hand, it’s also used to authenticate people using their national ID number because like I told you, we’ve had national ID for a long time and it’s very normalised. It’s a normalised thing to identify yourself as you access services.

However, it’s not been universal in the sense of collecting data also from children. And as you know, Kenya is one of those countries like many African countries where the majority of the population is children. And so, one of the rationales for having this Huduma Namba was to actually have identity information on everybody, including children, including those whose births are not registered.

And so, IPRS has been like the umbrella thing but also there have been piecemeal policies and legislations that kind of force people to acquire some sort of digital ID. For example, a lot of government services are only accessible online and through another part of IPRS called eCitizen, which is now like the portal through which people can access services. So services like application for passport or application for a driver’s license or application for a visa for foreigners – all those things are done from that portal. Even business registration is done from that portal. So the last I checked there are around 250 services offered by government that are now exclusively online.

A while back, we also started a policy that for children to access school, they have to produce a birth certificate. And this was kind of meant to make sure that everybody now registers the birth of their child even if you’re doing a late registration so that they can be able to access education. So yeah, those are examples of the piecemeal policies that were aimed at getting everybody to get some sort of identity document. While people are going to get this identity documents, what the government had done is that it had migrated all its services to digital. So, they were creating digital ID, the only piece that was missing in a very universal way across the country was biometrics. This system was being implemented to collect biometric data on everybody.

Oscar: There were already a number of e-government services already running by different institutions, and that’s one of the reasons that was pushed to have this collection of personal data on during last year. So could you tell us also what was your specific involvement during this case in the last months?

Grace: I was supporting the petitioners, providing some research and so on. I also gave testimony on the issue of children and digital identity. I’m of the view that there needs to be more special protection for children because once their data is collected, it’s very difficult to un-digify it or un-digitise it. Once the data is collected, it becomes re-sharable. It becomes very interesting even for analysis. They are still developing their capacity to interact with the law. Yet, when so much information about them, or data about them, is being collected it could be used to make decisions that have legal effect.

For example, the education system. The idea – it’s called National Education Management Information System – the idea is to keep recording the child’s journey at every step and so there was space to collect some objective, factual information like the age of the child, whether the child proceeds from one class to another. But then there’s also space for subjective information like the performance of the child, the reasons for good or bad performance.

Oscar: So Grace, what would you say – what was the main lesson learned from this project?

Grace: I think one lesson learned is that digital ID is the new- or it’s like a way of organising society. And so, all other African countries that are in different points of their digital ID journey, definitely need to look at this case and understands some of the contestations that there were and avoid them if possible. Because if we think about digital ID in that way, as a sovereignty issue, sovereignty of the people, people deciding or people participating and making a decision on how they are going to be governed, it means that the questions of design even conceptualising and designing their digital ID system should be done in a participatory way. It should be done in the most open way. People should have as much information as possible about the new systems and their role in the new system. Once their data is collected, they should have as much agency as possible. They should still be able to view their data. They should still be able to know when their data is used, especially when used for other purposes than what it was collected for.

And also, if the same people also want to analyse their data, it should be possible for them to analyse their data because the design of these systems has an underlying assumption that the only entity that is interested in having collective data is the government, but there are also people or groups of people who may have an interest in such data. And so, a big lesson would be that it’s a high time we started thinking about the conditions under which groups who wanted to view such data would be able to view it, how we can democratise data so that it’s not such a valuable commodity that can only be accessed by the most elites, that it can become something as accessible as how statistical data is normally released to everybody who wants to use it to better understand their society.

Oscar: Yeah, that’s correct. One of the things you say is they need more participation from everybody in the society because people who went to enrol were of course, they trust that it is for the good. They are going to have the digital identity.

Grace: Yeah.

Oscar: But it would depend how it was designed by the government and was maybe not the best way to do it. So, I will also like to hear from– this is mostly from the public sector. If there is something in the digital identity in the private sector that is working and something especially if there are some good successful cases, successful stories in digital identity in Kenya or in the region?

Grace: So in the private sector, I think they are generally further ahead than the government. In fact, in this government project one of the objectives of the government was also to centralise even private data. For example, one of the good examples I think is just the mobile phone number. Because that was some democratisation of a service that was very – was preserved for very few. Back in the day, when there were landlines, landlines was for such few people but now, mobile phones I think, I forget what the figures are but we are over 80%. We have an over 80% penetration rate of mobile phones in the country.

How it becomes like a – not like but a sort of digital ID is that the mobile phone is unique. And at the beginning it was just for communication purposes, but now– you know Kenya, we don’t have a national addressing system. You just have to depend on people to give you directions especially after you are off the main road.

But with the mobile phone, this has really changed because you can give somebody, maybe a delivery service, you just need to give them the general area and then also give them the mobile phone number of where you want it delivered and they’ll be able to contact that person until they get to that particular space. So that has been quite a good – and it’s become so normal that sometimes we forget that this is the use of digital identity.

And now, a farther use of that mobile phone has been in financial inclusion, people who are able to use that identity to send and receive money. And at the beginning, you did not even need a bank account, you did not even need a national ID in order to use mobile money. Now, it has changed with the involvement of the government. The policy’s changed and they require– they tied it to the national ID.

But even with that, I mean it’s such a revolutionary thing that people can send and receive money even then they don’t have bank accounts. And with the way our society is organised in Africa with the whole rural-urban migration, the reason why a service like M-Pesa is such a big deal because it enables people to still connect to their rural people when they’re in urban areas and vice versa.

Now, it has even moved to digital credit, people are getting loans through their mobile phones. It is not all positive. There are very many issues that need to be resolved in that area because the digital lending depends a lot on analysis of mobile data.

Oscar: Grace, any other successful story about digital identity in Kenya?

Grace: Well, I’d say e-government is something that could be a success story if well applied because it takes services closer to the people. It also creates employment. There’s a lot of people who access e-government services through intermediaries which is I think most of the people who don’t have the requisite digital literacy will access e-government services through intermediaries. So, if only these issues were being looked at holistically, for example, the government acknowledged that its intermediaries and their role and had mechanisms to ensure that for example, cost issues are looked into, then e-government makes way more sense than going physically to government offices to receive services. Especially thinking about the size of Kenya and the role of government in a lot of day-to-day services that everybody needs.

So there are things that need to be corrected but definitely e-government is a very good use case for digital ID. In fact, even in the Huduma Namba case, the contention was not about digital ID per se, the contention was on issues like centralising digital ID and how that creates capacity for surveillance. But as far as improving of services is concerned, that is something that everybody can see as something that will be beneficial to most of the society.

Oscar: Sure. I’m sure that in the future this project, Huduma Namba, will be able to meet the needs that Kenyans have today. So what would you say in the future, what is your prediction for Kenya’s digital identity in the years to come?

Grace: I think for sure, there will be a lot of contestations especially where race and nationality issues are concerned. Those ones have to be resolved so for sure there’ll be a lot of contestations. And then something else I predict is that as soon we have a critical mass of Kenyans with all the knowledge that is required, we’ll see a twist in digital ID that was unexpected from all the vendors and all the software dealers who are importing these things from somewhere.

So, I think we are likely to see something organic and homegrown that will surprise everybody who is so intent on forcing centralised digital ID down our throats. I say this because when mobile phones came to Kenya, I don’t think anybody had imagined that there would ever be a mobile money thing. But even when they started I remember like way before mobile money came, people would use mobile money airtime as a way to send money to each other. So you’d send mobile money airtime and then that person would be able to either sell that mobile money airtime to other people and therefore get money or something like that. And this is what eventually changed to become, OK, let’s even have mobile money where you can send money directly instead of sending airtime and then the person has to try and convert that airtime into money.

So, I foresee something similar to that happening. Kenyans for sure are very innovative and they’ll find a way to organically find digital ID being used in a different way that wasn’t anticipated and probably in a much better way that serves the people.

Oscar: Yeah, looking forward to hearing in the future the innovation in digital identity that comes from Kenya. So I will ask you this question I ask to all our guests, if you can give us a tip, a practical advice for anybody to protect our digital identities?

Grace: For me, because I’m an activist I think I keep telling everybody that never imagine you have nothing to hide. So, as much as you may think that these privacy activists are being too noisy with their gospel of– that we need personal privacy and data protection, I keep saying, “No, they are not being too noisy. Never imagine, you have nothing to hide because even when you have nothing to hide there are people who are your type and you know yeah, digital ID is not only about personal identifiable information but it’s also about information of people who are like you.” I think the term they are using now is demographic identifiable information. So, the tip is to care about your privacy because your privacy is also other people’s privacy.

Oscar: Oh yes. Yeah, I couldn’t agree more. Thanks a lot for this interview, Grace. It has been truly enlightening because some people like us, many people are listening to this podcast who are working in digital identity data protection and building, many of us building products or systems is important to know how things work in– like in Kenya and other countries where we don’t hear too much about so it’s very, very useful, many reflections to know. Please let us know how we can find you on the net, what are the best ways for that.

Grace: On Twitter, I am @bomu. I’m also on the CIPIT website, CIPIT is CIPIT.org and we put out a lot of information about issues that are going on especially in the African technology scene and we have a whole section on digital ID and data protection.

Oscar: Excellent. Again, thanks a lot, Grace. It was a pleasure meeting you, talking with you and all the best.

Grace: Thank you so much. It was a pleasure too.

[Outro] Thanks for listening to this episode of Let’s Talk About Digital Identity produced by Ubisecure. Stay up to date with episodes at ubisecure.com/podcast or join us on Twitter @ubisecure and use the #LTADI. Until next time.

[End of transcript]