Kenyans face new privacy threats as State expands surveillance powers

The right to privacy is on the frontline of a struggle that has seen a number of other constitutionally protected rights threatened during the last few bloody months of Kenya's ongoing security crisis.

After at least 64 people were killed in two attacks by Al Shabaab militants in late 2014, members of the ruling Jubilee Coalition swiftly moved to introduce an omnibus bill,  the Security Laws (Amendment) Bill 2014. The bill, which was hastily enacted into law despite street protests and skirmishes inside Parliament, curtails a spate of constitutionally-protected rights while consolidating law enforcement agencies' powers to enhance Kenya's "ability to detect, monitor and eliminate security threats," in President Uhuru Kenyatta's words. Specifically, it weakens the legal safeguards pertaining to the interception of communications by police, increases the purposes for which surveillance may be undertaken, and provides for broad powers for the otherwise undefined "National Security Organs" to intercept communications.

The High Court struck down eight of its clauses, including language punishing the publication of contentious material, a decision that the government is now appealing.

This latest legislation aligns with the Kenyan state's attempts to enhance its crime-fighting capacity in recent years.

A tender for a National Surveillance, Communication Command and Control System, to coordinate emergency responses, was awarded this past summer to Safaricom Ltd, which largely runs on Chinese telecommunications company Huawei's infrastructure and is 60 per cent government-owned. While the system, set to be completed in 2016, is billed as a secure way for law enforcement to communicate, it will include additional, and potentially worrying, surveillance capabilities such as video surveillance technology that allows for face recognition and a centralised database to perform analytics and cross-referencing on the images captured.

Expanded surveillance powers, eviscerated legal safeguards, and sophisticated technologies have created a combustible situation in Kenya, and the right to privacy and other human and legal rights have been severely threatened as a result.

Troubled from the start

The command and control centre has, from the start, been a source for controversy.

In February 2012, the Ministry of Internal Security and Provincial Administration issued a tender to which six Chinese firms responded. When it emerged that only telecommunications equipment and systems company ZTE Corporation had passed the technical evaluation, the procurement turned into a bitter legal battle which saw ZTE's rival Huawei Technologies accuse it of bribing senior officials in a formal complaint before Kenya's public procurement authority. The latter promptly dismissed the complaint; Huawei appealed to the High Court and the Head of Civil Service called for the tender to be cancelled in February 2013, the project 'unbundled and cost rationalized' and the tender reissued. In July 2014, the government confirmed that telecommunications company Safaricom Ltd, had been awarded the contract. Inking the deal this past November, Safaricom CEO Bob Collymore promised to "build an intelligent solution that harnesses the power of technology to enable law enforcement officers effectively coordinate and deploy their resources."

While the command and control centre is not a communications interception project per se, it is highly problematic from a privacy perspective.

According to the project specifications, the system is a way for police officers to securely communicate and process their responses to incidents, with various technical barriers to prevent the interception of law enforcement's communications. The system will run on an independent 4G network, separate from the normal Safaricom network with 80 Base stations (60 in Nairobi, 20 in Mombasa). According to Safaricom, "it will be a stand alone independent IP network... that will deliver high speed video, voice and data [to] a wide ranging number of secure device[s]." The surveillance network will consist of various types of cameras that will be networked to a central point from which analytics and other functions can be carried out by the National Police Service. Additional capabilities include geolocation through GPS of personnel in the field, an Automatic Vehicle Location System and "IP- based video surveillance system on a proposed network for aiding visual surveillance" for law and order, crime control and "special events like public gatherings, processions etc."

Police would be able to pick out criminals from the crowd "with a simple camera image grab." Without strong safeguards, picking out criminals can quickly turn to politically-motivated profiling. Face recognition facilitates religious or ethnic profiling and has in some cases led to the false identification of innocent persons. The temptation to place entire communities and neighbourhoods under potentially disproportionate surveillance subtly reverses the presumption of innocence. In light of episodic roundups of Somali Kenyans other Muslim communities it is not a remote possibility that even this seemingly benign surveillance technology will be exploited beyond its legal mandate.

Face recognition technology can be used in conjunction with communications surveillance tools such as IMSI catchers that allow for the identification of device users within a certain area, effectively adding people to a database of suspected criminals and collating faces with names and numbers, facilitating further communications surveillance.

And there is already a whole lot of communications surveillance occurring in Kenya. Communications data lifted directly from Kenya's networks features in the confidential NIS state briefings revealed by Al Jazeera in their highly controversial documentary on extrajudicial killings by state forces, reportedly with UK and Israeli support. The documentary caused such an uproar that an additional clause was added to the Security Laws (Amendment) bill to criminalize the publication of information 'likely to...disturb public peace'.

Telecommunications operators already comply with interception requests from law enforcement. Furthermore, the US National Security Agency (NSA) hoovers up metadata about all calls in Kenya through the MYSTIC program. And let us not forget the mysterious arrest in December of 77 Chinese citizens believed by Kenyan authorities to be "preparing to raid the country's communication systems."

And now more surveillance powers

While technology can play a role in documenting and potentially disrupting terrorist acts, the context in which this technology is being deployed in increasingly repressive.

Kenyans' right to privacy -- of home, person and property and communications -- is enshrined in Article 31 of the Constitution. The right to privacy in Kenya may be limited by statute under certain circumstances, but currently, the communications of persons under investigation can only be covertly intercepted through application of a warrant.

Yet the space for the expressions of political dissent that are essential to a functioning democracy is being eroded even more. The Securities Laws (Amendment) Act 2014, removes the requirement to obtain a warrant prior to intercepting a digital communication. Section 65 of the Act would remove the requirement for the intelligence service to obtain a warrant to authorize interception and, by extension, any independent judicial review of the interceptions process. It would be entirely up to the intelligence services to determine how surveillance is carried out and on whose communications.

The Act also extends the category of people who can have their Constitutional privacy rights violated to anyone "who is subject to investigation by the Service" without detailing any safeguards that would make selection more rigorous being at the discretion of the Service agent. Even more worrying still, Section 66 of the Act introduces a whole new covert operations section that gives any member of the Service broad powers to enter any physical place and extract, modify, search, remove, record and perform other actions on any material found, requiring only the authorization of the Director General of the Service. The Act (Section 80) also would give new powers of interception to other agencies including Kenya Defence Forces that are not prescribed by law, but rather by the Cabinet Secretary who establishes procedures at his discretion. Rarely has there been such a proposal to consolidate so many different powers in so few (intelligence) hands.

Mix these expanded surveillance powers with an adaptable technology like the command and control centre while removing preexisting checks against potential abuse of power, and you get a dynamic where even the most well-intentioned technology can be used for illegitimate ends.