Interview with Linda Bonyo and Catherine Muya

About the Speakers: Linda Bonyo is the CEO & Founder of Lawyers Hub, a Kenya-based organisation working at the intersection of law and technology through work on privacy and data protection, intellectual property and digital identity across the continent. Connect with Linda on LinkedIn or on Twitter at @bonyolinda

Catherine Muya is a lawyer with a specialisation in digital rights and policy.

Listen to the audio:

You can also find this interview on YouTube, PeerTube and Vimeo

Please note that this interview has been edited for clarity and brevity.

Transcript

Varoon:

How did you find yourself working on these issues?

Catherine:

When I was in campus, I was fascinated about big tech companies, but I was not fascinated about them in the capacity that I am now. I was fascinated that people could just come up with things that could change the world. But when I grew older and I went to law school, I started to think about how my career as a lawyer would probably fit in the tech upper system. And so I started with the field of IP [Intellectual Property]. But when I had to write a dissertation, I gravitated more towards civic engagement.

And so, I picked research on identity in Kenya, which then led me to work on issues of digital ID in Kenya. And I think that's where my journey began more or less, and grew more into understanding different ways in which tech affects human rights and probably democracy in that regard. So, more from that to misinformation and disinformation.

Linda:

In 2010, when Kenya was working towards a new constitution, I was tasked with teaching communities about their rights under the new law. For me, that was s a moment in my generation where you have this new constitution and a new canvas in which we could all operate in. Through that process, just seeing the provisions on privacy in the new constitution, the provisions on public participation, really bothered me to start engaging. And that's how I set up the Lawyers Hub. And through our work where we simply just thought that we could work on legal innovation and see how we could ease the lawyers' work. We didn't realize the broader question that we can't exist in a vacuum. We need to engage with society, how society works, the way they protect it, the way they vote. And I think that has brought us to this point where we work on a myriad of issues around tech policy. So, that's the long and short of it.

Varoon:

After law tech festival in the promo clip that was playing, Linda, there's a voiceover of you saying, “The Lawyers Hub was founded on the principle that the law needs to interact more with technology, and that greatly affects tech policy and access to justice.”

I find it very interesting that part of this festival is a hackathon. People everywhere complain about how out of touch lawmakers and lawyers seem to be with understanding technology and the way this lack of digital literacy limits their ability to craft or to enforce laws related to technology. What lessons have you learned from observing lawyers participate in these hackathons that the Lawyers Hub organizes?

Linda:

Let me just talk about the link between law and technology, and myon what's happening around the world versus what's happening in Africa. So, in some countries it's pretty clear the link between law and technology; In Africa, it isn't that clear. Because I think the law has been in this vacuum and lawyers have been on this pedestal where they understood everything in society, but now they don't understand the law. In our context, and maybe in the US, a lot of the lawyers are actually members of Congress or Senate. In Kenya, for instance, that's the truth. And so, we realize that in impacting the lawyers to understand technology, we actually are contributing to the national conversations around democracy, around access and inclusion, and topics like that.

I agree that lawyers are sometimes really out of touch with technology. And for a long time technologists have not seen the link between their work and their product, society and the law. And what you have is people building and then once they build, they realize, "Oh my God, we didn't build for privacy. But now there's a privacy law. What do we need to do?"

As the Lawyers Hub, what we have learned is that in bringing in these two demographics – the technologists and the innovators – together with the lawyers, you have the lawyers learning about technology, how it works, and then you have the technologists learning about the law and their rights, how they build, sometimes how they fundraise if they’re startups in that sense. And then also how do they build for societal problems that relate to policy, like public participation.

Now we're in a digital world. How do we get our country to exercise the democratic rights on those platforms? If you're building for elections, for instance, how do we assert those democratic rights on those platforms? For us, the multi stakeholder approach has really helped us to better the law, really better participate, and also build the capacity of organizations within the space who don't know what to do. Traditional civil society organizations do not have the capacity to engage on tech policy, especially. And so, what we are trying to do is to really train them and equip them with skills so they're able to look out for individual rights violations in the work that they do.

And hopefully we can move up to have a really critical threshold of people who understand these issues, especially policy makers. And then we translate it to the general public. I think my colleague, Cate, could add in something on that.

Catherine:

Yeah. So, as a young lawyer, really learning and working with Linda, I'll say that I was recently in school. And if you look at the African system of legal education across maybe different jurisdictions – I'll give Kenya as an example: So, the legal institutions or the legal education is not really structured to include the aspects of law and technology within the curriculum. So you have to learn about some of these issues after you've completed your legal education training, which ideally should not be the case.

That's why I think maybe institutions like the African Digital Policy Institute are extremely important. Because then Africans start to engage with these issues early, as opposed to waiting until maybe you are in a work environment, or in graduate school, to start engaging with some of these issues, then maybe we could have a dynamic kind of lawyers coming up within the market.

Varoon:

I was reading that the Registration of Persons Act requires a series of demographic and biometric information that are contained in an electronic card, which is like the de facto ID card that's used in everyday life. From what I had read this seems to have roots in Kenya's colonial times, also when these measures were expanded for census taking, which demarcated tribes and clans and sub-clans to geographic areas. Can you explain what significance these distinctions play today – the demarcations that exist on these ID cards, and also the ways in which they seem to be politicized around election time?

Catherine:

If you look at the history of the evolution of the Kenyan ID, it really did start from a colonial period... So, it was called a Kipande system, and it was something really large that you could wear over your neck, more or less. And it was some form of controlling Africans within the native areas. But as it grows and as it evolves, within our Kenya ID now, we do have to collect tribe information. I'm not sure what purpose the tribe serves. But I know that if you come from border communities, for example, you have to go through a process called vetting. And especially if you have maybe a community that cuts across borders. So, for example, if you live across the Western border of Kenya, you have to be vetted, and it's easy for you to ascertain your origin and to actually ascertain that you are of Kenyan citizenship and trace your roots, before actually giving you that identity document.

Coming to what you asked me about the identity and the inclusion of tribe data. The inclusion of tribe data, in my opinion, is not really necessary. Because an identity card in Kenya is just supposed to show your citizenship and give you an identity number. The difficult thing about it is, in Kenya, we have this thing called name-calling. So for example, my middle name is associated with my tribe. So, regardless of whether I would put my tribe there, somebody would still be able to delineate my tribe from my name.

We recently discovered that we as Kenyans have been registered for political parties. And so, I'll give an example with myself. The ruling party right now, or what is seemingly going to be or had been over the last years, was Jubilee Party . But because it's affiliated to having a strong, ethnic grounding within the Kikuyu community, which I come from, which is a majority tribe in Kenya. So, what happened is, when I checked the political database to see if I was actually registered, I was registered as a member of a political party, but I was registered as a member of the Jubilee Party, regardless of the fact that the only thing I did was initially just to vote. I was really surprised to find out that I am a member of the party. And again, I strongly think that I was a member of the party because of my name and probably my tribe.

And because ethnic voting is something really strong within Kenya, they obviously don't think that you would question that you are a member of this political party, and it's true. But then the political party might then be using this data to say, "We have this number of members," and it's not actually true. I didn't even know up until recently. So, I think that's one of the issues that we have with having an ID card, and tribe within your ID card.

Varoon:

For these communities that are subject to these enhanced vetting techniques, how do you think they negotiate their relationships with digital technologies on the one hand, perhaps kind of a victim of them in a sense, on the other hand, perhaps access to digital resources are a way of leveling the playing field as well?

Catherine:

So, you've given two angles of which there are victims of digital technologies. I think that's largely true. Because first in Kenya, for example, registering for a SIM card requires your ID.

So, you have to go through vetting when you get to 18, for example. Because you ideally need an identity document. But until you're vetted, you have no proof of ID. So, my registration for an ID was really easy, because all I had to do was just go and register, and they give me something called a waiting card, which is not really an ID, but it's just showing that you're waiting in line for the government to give you an identity document. And it really didn't take long. It took like a month. But for these people, vetting might take years.

That means within that time frame, you don't have anything else to prove that you are over 18 years old. What I've seen people do to be able to go around some of these restrictions, is to have someone register their phone for you. But then that would also mean somebody else registers, let's say mobile money, like Mpesa for you. But when you want to withdraw from an Mpesa agent for example, within the Nairobi CBD you have to or anywhere really where you have an Mpesa agent, you have to present your ID card when you're withdrawing the money.

So, it's easier maybe if you are in your own local area to go around those restrictions, because you're personally known to the agent, and they can allow you to withdraw money, even if it's not allowed, but they probably might allow you to withdraw money with a different name. But if you go outside your region of location, then it's not going to be that easy to circumvent some of those rules or circumvent some of those restrictions. So, then that means you'll probably have limited access.

I did interact with some people who are stateless. And they needed to have medical care or medical operations, but they still needed to identify themselves within the hospital. And that became really difficult, because then now you want to get treated or you need an operation or surgery without identity documents.

In terms of accessing digital resources that don't really require formal identification. So, for example, you can run an online business, maybe on social media or something like this, or advertise, or ideally just register with some other... You can have a Twitter account. You can have a social media account. You can have many of these things, because they don't really require formal proof of identification for you to have them.

Linda:

I was going to just make a comment on the last point that Catherine made on online platforms. And I think initially maybe big tech companies building these products from the US, they don't necessarily think about what identity means to access their platforms. Initially, you could simply just verify using, let's say a Facebook account or Twitter account by use of your email address. But now, that primary email address, let's say a Gmail address, now you're required to have a phone number to verify that that's you. And so, they need to text you on a particular number, a code, and then you can verify your email address.

But that's a problem, because then somebody who's stateless doesn't have identification, cannot then have this code. And so what do they do? Like Catherine says, they would go to their neighbor or a friend, and ask them to get that code on their behalf. But what the net effect of this is, where there's abuse, you don't generally have control over your own online accounts because that belongs to someone else who helps you verify that process.

And then two, there's a challenge that I learned recently. There are a few South Sudanese nationals who are in Kenya. They don't have any identity. And so, even at death, they prefer to bury their loved ones in the house because you actually can't access a cemetery without identity. That is really, really annoying that even in death, you must have specific identity.

I think the problem of identity and now taking those problems offline and bringing them now into a digital identity framework without fixing those historical issues, especially in a country like Kenya, pushes us to exclusion. Some communities will never come online, they will never run online businesses, they cannot study because even in studying, you need an identity to access the formal school system.

Compared these two systems, like in the US where even as an immigrant who has no status, you're still able to access certain services. And so, we need to separate the functionalities of identity, where the services you can access, like Catherine mentioned. There are buildings in Kenya that you can't access without an identity card.

I think the digital identity question is going to rear its ugly head a lot across Africa. Because rather than see it from a trade enhancing perspective, we also need to see it as an inclusion and exclusion problem that must be fixed. Especially around elections also, because if I can't assert my rights at election time, then it means I don't have any other opportunity to make my voice heard.

Varoon:

I'm curious to hear more of your thoughts on foreign companies, what you feel like they get right or what they don't get right, what they misunderstand or what they seem to understand well about the Kenyan context.

Linda:

My view, first on foreign technology, Africa is mostly consumers of technology. Fintechs [financial technology companies] now are really coming up and having really great products across the continent, especially Nigeria. But we are consumers of American platforms. But then also, we are consumers of European policy. Tech policy coming out of Europe really determines what's happening in Africa. If you look at GDPR on privacy and data protection, that's what everybody's borrowing. And our ideal is, how do we get, like Mauritius just did, this agreement with Europe, and ensure that our people can trade with Europe because we are not compliant with GDPR?

But then when we think about our products, we are constantly looking to consume American products or have our companies set up in Delaware, or get VC [venture capital] funding from Silicon valley. So, that's how I think the continent looks at this.

But now in terms of the law, the law is highly lobbied, I think everywhere. It's just that in Africa it's really not clear that people are lobbying. We don't have enough transparency laws to simply indicate that this draft legislation is funded by this tech company, because this is their interest in Africa. And so, I think that's really a problem because then you have civil society groups, and then you have the citizens on one hand trying to get what the best flow is for them, but they're fighting against the big money from big tech companies.

Our members of parliament or the Senate here, do not have the muscle to hold big tech companies to account, for instance, on the harms of their technologies. I'll give you an example: A lot of our election technology is from France. And our biometrics as well. So, in our last election in 2017, you have the opposition saying, "Open the servers, we want to know how people voted on those servers." But then the election chairman would say, "No, the servers are in France. They're asleep now. And so, we can't have them." So you see the role that French companies would play and how that impacts the laws around immigration in Kenya. They're really powerful around that.

These vested interests affect us even on the day of the elections. Just this week, the elections chairman said that now the Kenyan election servers will be based in Kenya. And so, we have a new law. And this law, it's a regulation under the Data Protection Act that talks about civil registrations. So, any data around people and their registration for government like public sector, must be held within servers based in the country. So, that data localization approach now means that Kenya is going to store its own election data in the country. Is it safe? Is it reliable? We have no idea. But we know what it meant when it was held by a French company.

Maybe what needs to happen is just more transparency and more access to information, strengthening access to information laws, to ensure that when we want to know who's funding this program, who's funding members of parliament go on a retreat to discuss a law we don't need, transparency is really important for us to get to have really public interest laws that are being passed in the country, especially around elections.

Varoon:

What do you make of the digital and political influences in Kenya from abroad? I'm curious to hear what challenges and opportunities they pose. I can imagine how, on the one hand, it feels like more of these international connections might help members of the African Union develop sounder trade agreements with more GDPR-like legislation. It might help civil society organizations argue to have a seat at the table when negotiating or providing input to legislation. On the other hand, it might also risk exposing countries across the African Union to more of these kinds of big money interests that you were just talking about, Linda, especially from foreign entities that have big business opportunities across the African continent. I'm curious to hear your thoughts on these digital political influences from abroad.

Linda:

I would talk about Kenya, and say that I think the influence is immense. I would want to maybe start with the opportunity. Our realization at the Lawyers Hub is that this conversation for Africa to move forward, especially on really inclusive digital policy, it can't come from the government. It has to come from an informed citizenry that understands the issues. And so, everything that we try to do at the Lawyers Hub is geared towards how do we mainstream these conversations.

Even now the conversations we are having around elections and what's coming up in Kenya, in Zambia, the ordinary citizen hasn't seen the connection between how that internet shutdown that's looming in Zambia is going to affect your access to your democracy, or your economic interest. You won't be able to trade. Shutting down the internet in Nigeria is going to ensure that you don't have a voice. You can't talk against government. You can't ask questions. You can't know what's happening in the other country.

When citizens understand this connection, then they will be able to start engaging and saying, "You know what? I think this is how we can counter internet shutdowns. I think this is how we can observe elections on electronic platforms." If they're in a village and there's a biometric kit, then they're able to ask, "What are you inputing there? Is it the thing on the paper, the same as the thing on the device?"

We believe that opportunity exists. But organizations such as ours and other civil society organizations need technical support. Because if you look at the US and 100 years of democracy, for instance, we can't boast of such years of democracy. There needs to be some support that is not geared towards political parties, but really honest support: technical support to lawyers, to technologists, to journalists, people in society that can actually have a voice in the seat at the table. Then when we have this knowledge, they're able to take it back.

But what has been happening in Africa is that all the support goes to poor communities. And so people then say, “We are working in Africa, we are doing this.” But when they go to the villages, they just take pictures. They do bare minimum. They don't look at the professional, the one who is invited to these meetings, the one that can impact members of parliament and tell them that, "Have you considered this economic model? Have you considered what Europe is doing? Have you considered what Madagascar is doing?" I think that's what we need.

I like this idea even around data protection. I believe that the US focuses on companies when it comes to its data protection laws. Privacy is geared towards companies and how they treat consumers. When you come to Europe, it really focuses on the user.

But now when we come to Africa, we simply just pick the law and say, "You know what? We don't know what to pick." But you know what? China has really focused on, how do you protect the government. So, the cybersecurity in Kenya is picked from China. Because then the government really wants to be the ultimate that controls your data and your freedom of speech.

But we need to come to the table and say, no one aspect is good in itself. And then we consider as Africans and say, how do we protect ourselves from the election infrastructure that may be provided by China, but it's not great for privacy? And how do we protect ourselves from GDPR that may be great for a single user, but is not great for business environment? So, then we balance all these interests and come up with something that works for Africa, rather than something that was given to us, because some money was given by this donor organization or that donor organization from the west or from the east.

The final comment that maybe I would make on, especially the election, like what Huawei is doing in Africa and providing infrastructure and even the roads, and the 5G network and the conversations that are happening in Kenya. The leading telco company just launched their 5G network and it's supported by Huawei. And so, you look at these conversations and say, this is not a conversation the Lawyers Hub can have on its own.

And it's only later on that we realize there's no single move we will make at the Lawyers Hub without having an engaged and learned community who understand these issues. If you do that in a country like ours, you're going to lose your job, you'll lose your family, because you don't have a critical threshold of people who understand these issues.

Varoon:

I just thought I would take the opportunity to get caught up on what's happening with the 2019 Data Protection Act in Kenya. I read that Kenya has already a right to privacy in its constitution. I saw it was Articles 31, C and D. But obviously this was furthered by this draft legislation that was packaged into the 2019 Data Protection Act. What are your thoughts on what it does well, where it can be improved? And also what's the latest, where is it now in the process of becoming fully fledged law?

Catherine:

Before 2019, there were attempts to have different versions of the bill passed into law. But then in 2019, we finally had a Data Protection Act. But then it took a whole year for us. So, the Act heavily relies on having the office of the Data Protection Commissioner to implement things like legislating data processors and data controllers or event enforcement preventions. So, in 2020, towards November, they appointed the Data Protection Commissioner.

However, one of the things that we've noticed in our engagement with industry is how some of these regulations are going to affect small and middle income business with regards to registration. There's a lot of concern about the cost of registration and the cost of compliance with the regulations. So, I think that that's an aspect that needs revisiting. Because yes, there's an aspect of wanting to be compliant, but then there's an aspect of how it impacts business, which is really important.

Linda:

I think with the data localization conversation, a lot of our initial laws were borrowed from the UK as well as India. But we have concerns on, do you have the enabling infrastructure to have businesses simply rest their data in the country? That has been a conversation that is still ongoing with the Communications Authority to simply look at having a better framework and a better cloud ecosystem within the country.

But then also, we have challenges with the Africa Free Trade Agreement. And then also the laws, the regional treaties that Kenya has assigned to like the Malabo Convention. So, the regulation indicates that Kenya will be able to accredit countries that have African countries, so that we can have this data transfer. Is it easier data transfer between the countries that have already assented to the Malabo Convention. But that's just less than 10 African countries. And so, the regulations are a little bit problematic in this sense. But the Senate has considered them. And they say that in another few weeks, they'll be able to publish the regulations. I think the moment the regulations are published, then there's going to be a really great change. There'll be an accelerated way of taking up data protection in the country.

The challenge that we face in Africa, especially, is the enforcement part of it is not nice. They arrest people. They give you time in jail. It's not the GDPR approach where you're fined, and then it's okay. So, our context is a lot of poverty. People can't even afford that fine that you're giving to them, at the consumer level. So I think that that will be a challenge.

Varoon:

I'm curious to hear if you have bigger picture thoughts about the way in which digitization amidst all of these problems could be used as a source for good.

Linda:

2017 in Kenya, as we went into that election, there was such hope about us going digital, that then you could have this accurate, verifiable election. But in the process we had an ICT officer, Chris Msando , who was in charge of the codes, get killed.

When you hear the informal conversation he had with friends, he was like, "This election cannot be stolen. This time here, this is the very... " Like he would show his thumb and show how, it's only his biometrics that could be used to access these systems, for instance. And so, a lot of people believed that and said, "You know what? This is different." And I remember the opposition leader then saying that, "We are monitoring elections even in the cloud, even in space." He made certain declarations, and it felt like this was going to be a really good election. So, the nullification of the first election and presenting all this evidence in court was a really great step in Kenya's election. Because then there was an indication that there is a way that we can verify elections – there's a paper trail, there are gadgets there, devices that we can actually confirm these elections. But once that election was done and you went to a second election, there were concerns in court that were still raised about the second election. But then our courts have been criticized for the decision they came to. But maybe they made decisions on the public interest. Will a country going through a third election actually change in the long run? I think that really killed a lot of the hopes of people in seeing that any election is actually just an election. It doesn't matter whether you have it on a digital platform, they would still interfere with it.

But this is a thing that I see from everyday Kenyan use of e-government. If you need to register your company in Kenya, you do it on E-citizen. It's the online government platform. Now, they have allowed us to even register land. If you want to transfer a piece of land, you do it on online platforms. Sometimes they have to call you to verify, do you want to sell this company. So, it's working a bit. But there’s still a human element, that it takes you maybe two weeks to get something done. But then if you know someone within that office, then they will approve it online in two hours.

So, that human element, even in digitization, really ensures that there is no difference in digitization. The human hand is still left to control whatever election or whatever digital process, really still keeps us to this point where elections are not verifiable, they are actually not accurate in that particular sense. So, I think for me, that's the problem.

And finally, what you asked. Whoever controls the data controls the elections. What is not being said about Kenya trying to do the huduma namba and collecting data afresh of its own citizens is that they need primary data. A lot of the data that the government had was in silos. So, the tax regime, the Kenya Revenue Authority, had its own access to data for the taxpayers. If you go to Lands, they had separate data. So, the government wanted to put all this data together. But then they also wanted to centralize it to be able to control it, and not be happy here on all the silos.

I see the same thing happening Nigeria, because of the hullabaloo in Nigeria around we want everyone to register. Your SIM card needs to be registered in this manner. You must register by these dates. So, they're simply just collecting fresh data. Because every political regime wants to have its own control of its own data. So, when they go into elections, then they know one, how can they steal elections, by what percentage? And if you look at the threshold in Kenya, it's 50 plus one. So, even if they have 50%, because the margins are really sitting, they need to find out, where do we get this 1%? And I think Catherine mentioned this earlier around, simply just knowing that Catherine comes from this tribe, and so then we can simply put Catherine on this database and say she voted this way because her tribe votes that way, and also for my tribe as well.

So, I think this digitization without the underlying element – and we talk about artificial intelligence and bias – it's the same principle that applies. If the human element is biased, then whatever code you build, any algorithm will carry the biases of its creator. think the same thing is in Africa. Until we get to that point where we have some national ethos on, are we honest? Are there repercussions for not being honest around elections? Then we'll start to build technologies and even get a digitization process that truly respects these national values.

Please note that this interview has been edited for clarity and brevity.

The influence industry is led since 2016 by Tactical Tech’s Data and Politics team addressing the pervasive data-driven technologies used by political groups within elections and political campaigns.

This interview was edited by Cassiane Cladis.