African Civil Society Urged to Take Active Role in ICANN

By Marilyn Vernon |
Civil Society Organisations (CSOs) are a key player in the multi-stakeholder model of internet governance. However, civil society has been absent from discussions on the technical coordination of the internet domain name system (DNS) mechanisms.
Accordingly, on January 8, 2016, the Internet Corporation for Assigned Names and Numbers (ICANN) organised a workshop in Nairobi, Kenya to encourage more African civil society participation in the organisation’s work.
At the workshop which was attended by over 50 participants from private sector, academia, civil society, and the technical community, Adam Peake, ICANN’s Civil Society Engagement Manager, noted that at the core of ICANN’s functions was the bottom-up community based consensus which promotes inclusive engagement from the global community to keep the internet open, secure and inter-operable. This gives rise to many critical issues relating to human rights online, including privacy, access to information, freedom of expression, transparency and accountability, areas in which CSOs have extensive expertise.
Peake called for more meaningful CSO participation in ICANN processes and for their increased contribution to internet governance discussions and the development of solutions to align technical processes to government accountability and public interest.
Some of the critical issues for civil society engagement in ICANN came to the forefront during ICANN’s 50th meeting held in London in June 2014. At the meeting, the Council of Europe raised concerns about ICANN’s policies and procedures regarding global public interest and the protection of human rights. The Council cited states’ awareness of their responsibility to protect the human rights of their citizens including the right to freedom of expression; states’ attention to vulnerable groups; and the need to strike a balance between economic interests and other objectives of common interest, such as pluralism, cultural and linguistic diversity. As a result, recommendations were made for developing an ICANN human rights review process and reporting.
Since then, the Cross Community Working Party (CCWP) on ICANN’s Corporate and Social Responsibility to Respect Human Rights has been created. The party aims to address several concerns, including the inclusion of a reference to human rights in ICANN’s Bylaws; defining public interest objectives; and developing a mechanism to safeguard human rights.
While recognising that CSO participation in ICANN processes is critical, participants at the Nairobi workshop highlighted various challenges. For Africa in particular, there is limited knowledge of the operations of the domain name industry. There is also limited awareness of the role and responsibilities of governments in the ICANN policy development process that cuts across national policy areas such as internet security, development, and freedom expression.
Dr. Bitange Ndemo, the former Permanent Secretary in the Kenya ICT Ministry, said the exclusion of African CSOs from internet governance policy making process limits regional and international cooperation, decreases dialogue at the national and regional levels, and discourages strategic stakeholder partnerships. As a result, an environment in which stakeholders suffer from a lack of understanding and mistrust is created, which undermines citizen-centred socio-economic public policy development.
African civil Society engagement in public policy frameworks to support the evolution of the internet takes place in various platforms. These include the African Network Information Centre (AFRINIC), the Internet Governance Forum (IGF), and the Internet Society (ISOC). Other platforms that enable civil society contributions to Internet Governance include regional Internet Governance forums like the East African IGF which, Kenya, Burundi and Uganda have hosted in the past.
In order to transform the DNS and internet industry in Africa and provide regional support, ICANN launched the Africa Strategic Plan (2016-2020). Participation in ICANN is facilitated through advisory committees, supporting organisations and working groups such as the At-Large Advisory Committee (ALAC), which is structured by region and serves the African region through the African Regional At-Large Organisation (AFRALO), Non-Commercials Users Constituency (NCUC), Non Commercial Stakeholders Group (NCSG), and the Not for Profit Operational Concerns Constituency (NPOC).
Currently, there are 41 African civil society groups participating in the AFRALO, 80 members in the NCUC, two members in the NCSG executive committee, and additional African representation in the various supporting organisations and advisory committees of ICANN.
To learn more about ICANN engagement and its community-based policy making process, you can visit the ICANN resources page and the Beginner’s Guides to ICANN processes.

What Should be on the 2016 Agenda for Internet Freedom in Africa?

By Juliet Nanfuka |
Towards the end of 2015, the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) under the OpenNet Africa initiative convened some of Africa’s leading thought leaders to discuss the various facets of internet freedom in Africa.
The Forum on Internet Freedom in East Africa is one of very few gatherings that assemble an African audience within the continent to discuss matters related to upholding internet freedom. The Forum brought together 200 participants from 18 countries – triple the number of those who attended the inaugural 2014 forum, which hosted 85 participants from six countries. The event drew up a set of actionable recommendations that will inform onward engagements on advancing internet freedom in Africa by CIPESA and its partners, and hopefully for other actors in this space.
Over the course of two days, several issues were discussed, including how to address online violence against women (VAW), whose magnitude and manifestation is not clearly known, as most cases in Africa go unreported.
Another key highlight was the increase in freedom of expression violations for critical media and bloggers especially during periods of electioneering. One way to address this could be through the use of counter speech and transparency in combating hate speech, misinformation and false claims. The media’s role in advancing internet freedom in Africa – both as a vulnerable group but also as infomediaries –  was highlighted.
Africa has registered a rise in abuses and attacks on internet freedom, including a proliferation of laws, legal and extralegal affronts, as well as limited judicial oversight over surveillance and interception of communications. Discussions on the balance between national security and its perpetual clash with freedom of expression, access to information and the right to privacy reflected the need to address gaps in existing laws that do not adequately protect citizens from mass surveillance and privacy infringements.
Meanwhile, the appreciation of digital safety tools and practices remains paramount, for citizens, the media, human rights defenders and activists. Thus, the continued need for capacity building and awareness raising efforts on internet freedom was stressed by Forum participants. Closely related to this is the need for localisation exercises between tools developers and end users, given the diverse contexts of African internet users.
Internet freedom could also be supported by the budding community of artists and creatives on the continent, who are currently not adequately involved in discussions around freedom of expression and privacy online.
Read the full Forum Report, which also explores the relationship between internet freedom and online economics, press freedom, online creative expression, access to information, cybercrime and digital safety, from the perspectives of law enforcement, regulators, intermediaries, artists, the media and human rights defenders. On each of these themes, the report discusses the challenges and opportunities and suggests actions to take in order to advance internet freedom in Africa.

CIPESA Convenes Journalists to Discuss Uganda’s Data Protection Bill

By Esther Nakkazi |
Ugandan citizens’ personal data may be at risk of misuse if the Uganda Data protection and Privacy Bill (2014) to be tabled before parliament is passed in current form. Currently, large entities like telecommunications service providers, insurers, hospitals and even schools retain the information of millions of citizens who remain unaware of how secure their information is, especially as more of it becomes digitised.
While Uganda called for comments to the Bill in late 2014, little progress was made on it over the course of 2015. According to Gloria Katuuku from the Ministry of ICT, the comments received have been incorporated into a revision of the bill. “We brought this Bill before the public so that we get conclusive remarks. The bill has been gazetted and will be tabled in parliament, meaning at this time we shall just compile the concerns,” said Katuuku. She was speaking at a workshop convened by the Collaboration on International ICT Policy for East and Southern Africa (CIPESA) where Ugandan parliamentary journalists discussed data protection and privacy with reference to the bill.

CIPESA Policy Officer being interviewed by journalists
CIPESA Policy Officer being interviewed by journalists

The workshop was organised in conjunction
with the Uganda Parliamentary Press Association (UPPA) and aimed to create awareness among parliament journalists about clauses in the proposed law that contravene citizens’ rights, including to privacy. Few journalists were aware that government had drafted the law and called for robust media engagement with Members of Parliament so as to generate debate on data protection and privacy issues.
The former Chairman of parliament’s ICT Committee, Edward Baliddawa, said the data protection law should have been the basis for other cyber laws in Uganda. He added that as the country edges towards e-commerce, such as business process outsourcing, there is a need to regulate data controllers.
“This Bill is good for our safety and privacy as individuals and to become an e-commerce country,” he said. However,he also called for continuous engagement with all stakeholders across the lifespan of the bill – drafting, tabling to parliament and any eventual amendments.
Although existing laws such the Electronic Signatures Act, 2011, the Computer Misuse Act, 2011, the Regulation of Interception of Communications Act 2010 and the Communications Commission Act 2013 cover aspects of data protection and privacy, they contain contradictions and potentially expose users’ information to unwarranted access and misuse by authorities. Lillian Nalwoga, CIPESA’s Policy Officer, said of the laws: “These laws have broad terminologies that should be amended to repeal contradictory provisions and this can be done within the Data protection and Privacy Bill, 2014 in the contexts of data users and collectors, and to prevent abuse.”

See this Overview of How ICT Policies Infringe on Online Privacy and Data Protection in Uganda

But the proposed data protection and privacy law that is meant to address privacy of citizens’ communications and data still has ambiguous terminologies, unclear definitions and arbitration issues that will negate its purpose.
According to CIPESA officials, the drafting phrase should further engage with and seek consultations with different stakeholders including civil society, private sector, the media and academia for an extended period prior to tabling it before parliament. This would  ensure that the law passed “is inclusive, accommodative and addresses the concerns raised by all the stockholders,” said Wakabi Wairagala, the head of CIPESA.
At the workshop, CIPESA officials referred journalists to various areas of concern in the draft bill including some of its ambiguous terminologies, such as Section 4 (2) which  states that personal data may be collected or processed where necessary for ’national security’ or for the  ‘proper performance’ of a public duty’ by a public body. However, these words can be misinterpreted and leave room for the access to and abuse of citizens’ information.
Meanwhile, Section 7 (2) says data can be collected from another person, source or public body in certain circumstances without the consent of the owner. The length of time that the collected personal data can be retained is also not indicated. Section 14 (1) states that the data cannot be held for a period longer than is necessary and says it will be retained for national security purposes.
Overall, the bill does not explicitly state what constitutes a ‘privacy infringement’, thereby leaving users’ data open to abuse by data collectors and processors. It also does not state the procedures for citizens to access their data.

See CIPESA’s review of the Bill: Reflections on the Draft Data Protection and Privacy Bill