Big brother is watching over us but getting too personal

In case you missed it, the Government of Kenya just got very personal.

In the last eight months, it has introduced one substantive legislative amendment, one draft policy and two bills seeking to normalise invasive identity registration, digital mass surveillance and tighter controls over how we may access information online.

While working to bring the community and police to work closer together in the Nairobi ward of Kilimani, neighbourhood officers and I often joked how criminals had gone digital while the police had been left analogue.

Recent policy initiatives may have just altered this. Between December 2018 and August 2019, the government has passed substantive amendments to the Registration of Persons Act, requested public views on a Data Protection Bill, the Huduma Namba Bill, the Cyber-Security Bill and a draft national CCTV policy. Taken together, the measures seek to create a comprehensive, integrated big data information eco-system that will access all areas of our lives without our consent.

According to the Interior ministry, more than 31 million Kenyans registered for their Huduma Namba prior to the publication of the draft Huduma Namba bill. The government intends for registration to be mandatory for all and a precondition for essential public and private services.

Last year’s amendments to the Registrations of Persons Act and the Huduma Namba Bill also indicated the introduction of biometric and facial recognition systems.

The draft National CCTV policy released last month for public input seeks to require all public facilities to install compatible CCTV cameras, ensure 24/7 coverage and report all incidents to national and county security agencies. At present, the policy offers no clear mechanism for an independent controller to provide oversight over the collection, processing and the guidelines by which data will be accessed and by whom.

Foreign spies

Kenyans need not fear public CCTV. Introduced in 2012, today there are more than 2,500 state cameras watching major roads and entry points. CCTV cameras have also been installed in most urban commercial facilities. Every day, the technology is used to detect, disrupt and deter criminals, foreign spies, drug traffickers and terrorists. Across the world, citizens are being subjected to mass digital surveillance by governments and big business.

We submit to state surveillance to keep us safe. The use of intrusive technologies does require robust and transparent oversight anchored in law. If these requirements are not met, we threaten our right to privacy, democratic participation and legitimate dissent.

Mass surveillance technology that rely on face recognition systems are often not only discriminatory but notoriously unreliable. In the UK, four out five criminal suspects, mostly people of colour, were found to be innocent after police had made arrests. The UK Office of the Information Commissioner has now warned businesses that they need to demonstrate that the use of surveillance technology is “strictly necessary and proportionate.”

In the US, the MIT Media lab and civil liberty organisations have demonstrated that face-matching software has the capacity to erroneously misidentify 26 elected California representatives as criminals. Like in the UK, mistaken identities have led to wrongful arrests. Innocent people have ended up with criminal records.

This week, the Washington Post gave us another reason for concern. They allege that staff of the world’s third largest producer of smartphones, Huawei, have been secretly and unlawfully intercepting encrypted WhatsApp messages by opposition politicians and sharing these messages with the governments of Uganda and Zambia. Huawei is heavily invested in Kenyan market. They were at the centre of the controversial Sh14.9 billion single sourced procurement to provide state CCTV cameras. In addition, seven per cent of all smart-phones in Kenyan’s hands today are made by Huawei.

The new laws, policies and practices do not seem to have factored these risks. Left unrevised and unanchored in a Data Protection Act, they will allow for invasive breaches of our personal, commercial and social privacy and render our constitutional rights, analogue. As our government gets more interested in us, we need to get more interested in these initiatives.

- The writer is Amnesty International Executive Director. He writes in his personal capacity. Email: [email protected]