Inside plan that could allow spying on citizens

President Uhuru Kenyatta’s directive that Sh1 billion held by the Communications Authority be moved to the Directorate of Criminal Investigations and the publication of the Cyber Crimes Bill 2017 that gives police enormous powers to snoop on electronic content, have renewed fears of government plans to spy on citizens.

The National Assembly has given the public until Tuesday to submit views on the proposed law whose drafters say is intended to prevent and control cybercrime.  

But technology service providers say the Bill needs a major overhaul to ensure some of its provisions do not offend the Constitution.

The Bill, published in September last year, gives “special circumstances” where a police officer can take possession of a computer system without a court warrant. It also gives the police special powers over telecommunication service providers.

“We have agreed that to boost the DCI to deal with cybercrime, the CA, which has the Universal Service Fund, through which they collect money and we do not know how they spend it, Sh1 billion from the fund will be moved to the DCI,” President Kenyatta said on February 2.

ICT SERVICES

The CA Fund is primarily financed by mandatory contributions from licensed telecommunications operators.

The role of the Fund is to support widespread access to ICT services, and promote capacity building and innovation in ICT services in the country.

There are fears that the diversion of this money, coupled with passing of the Cyber Crimes Bill, which is in the public participation stage, will aid the police in invading people’s privacy.

Previous attempts to impose control on social media users were met with accusations that the government was out to limit free speech.

In March last year, a report by UK-based firm Privacy International (PI) showed that Kenyan security agencies intimidate mobile service providers to spy on civilians’ communication.

The report revealed that security forces violate citizen’s privacy in the name of fighting terrorism.

It named the National Intelligence Service, the Anti-Terrorism Police Unit and other police formations as the major perpetrators.

SERVICE PROVIDERS

The report claimed that in Kenya, law enforcement agents are physically present within telecommunications operators’ facilities, formally, with the service providers’ knowledge.

Technology Service Providers of Kenya (Tespok) says section 27 of the  Bill which gives police authority to access any data in any computer, can be abused.

“The government has good intentions but it seems to misunderstand how the industry works. The Bill as formulated seems to punish content providers for the crimes of their customers,” said Fiona Asonga, CEO of Tespok.

The section provides that when a police officer or authorised person has reasons to believe that there is something worth investigating in a computer communication set-up, they can order the individual in charge of the system to produce it.

This applies to cases where the officer believes that “any specified traffic data [information about communication through computers] … is required for purposes of a criminal investigation” the Bill states.

“The powers of the police officer or an authorised person shall apply whether there is one or more service providers involved in the transmission of communication,” it further reads.

Tespok is opposed to the search and seizure of computers without specifications, which is provided for in the Bill.

CYBER BULLIES

The Computer and Cybercrimes Bill 2017 targets cyber bullies, stalkers, hackers, peddlers of fake news and paedophiles who use popular social media sites such as Facebook, Twitter, Instagram and WhatsApp. But there are fears that the authorities can expand the mandate at whim.

Previous attempts to impose control on social media users were met with accusations that the government was out to limit free speech.

Just before the August 8 General Election, the CA and the National Cohesion and Integration Commission (NCIC) published regulations governing social media and text message use during the campaigns.

They included giving social media users 24 hours to deactivate accounts of anyone who posts content that is disputed.

Some of the crimes captured in the Bill include unauthorised access, access with intent to commit or facilitate further offence, unauthorised interference, unauthorised interception and illegal devices codes.

FINANCIAL LOSS

Hackers and their enablers are particularly targeted. If the hacking results in significant financial loss to any person, threatens national security, causes physical injury or death to an individual, or threatens public health, the culprit is liable, on conviction, to a fine not exceeding Sh20 million or imprisonment for a term not exceeding 10 years, or to both.

Disclosing passwords, access codes or other means of gaining access to a computer system will be criminalised if the Bill becomes law. Those found guilty will pay a fine not exceeding Sh5 million or a prison term not exceeding three years.

If the access results in wrongful gain, or is used for unlawful purpose, or occasions any loss, the culprit will be liable to a fine of Sh10 million or get a prison term not exceeding five years.

Purveyors of fake news, a phenomenon that has been exponential in the Internet age, will also face the full force of the law.