<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'>Mblayo<div>Noted and forwarded to ICTA.</div><div><br></div><div>Rgds</div><div>Grace</div><div><br><div><hr id="stopSpelling">Date: Fri, 28 Mar 2014 15:05:29 +0300<br>Subject: Re: [kictanet] Proposed Kictanet's input into Kenya's Draft Cyber Security Strategy<br>From: blongwe@gmail.com<br>To: ggithaiga@hotmail.com<br>CC: kictanet@lists.kictanet.or.ke<br><br><div dir="ltr"><div><div><div><div><div><div><div><div>Dear all,<br><br></div>I've looked through the draft and to be completely honest I do not think that this document is ready to be considered for adoption. Among others:<br>
<br></div>It is very scarce on <b>specific actions</b> that relate to implementation of strategy.<br><br></div>It does not <b>adequately identify</b> the key stakeholders and outline their roles, contributions towards the overall objectives/vision.<br>
<br></div>It does not set out how <b>resources are to be mobilized</b> towards achievement of specified goals/objectives.<br><br><br></div>Please take a look through cyber security strategies that have been developed by other countries (India and Hungary are good examples) at the following link:<br>
<a href="https://www.enisa.europa.eu/activities/Resilience-and-CIIP/national-cyber-security-strategies-ncsss/national-cyber-security-strategies-in-the-world" target="_blank">https://www.enisa.europa.eu/activities/Resilience-and-CIIP/national-cyber-security-strategies-ncsss/national-cyber-security-strategies-in-the-world</a><br>
<br></div><div>Even a simple benchmarking exercise from the above link would have led to a better initial draft. Let us not make ourselves look incompetent by passing this current document.<br></div><div><br></div>We are far from what can be considered a solid strategy paper. More work is needed on this. I propose that the timelines related to completion of this document be extended to allow more thorough work. The team that has come up with this needs to be modified/expanded to include others who can bring in better strategic input.<br>
<br></div>my two cents,<br><br></div>Mblayo<br><div><div><div><br></div></div></div></div><div class="ecxgmail_extra"><br><br><div class="ecxgmail_quote">On Wed, Mar 26, 2014 at 8:09 AM, Grace Githaiga <span dir="ltr"><<a href="mailto:ggithaiga@hotmail.com" target="_blank">ggithaiga@hotmail.com</a>></span> wrote:<br>
<blockquote class="ecxgmail_quote" style="border-left:1px #ccc solid;padding-left:1ex;">
<div><div dir="ltr">Thanks Ali. Noted.<br><div class="ecxhm ecxHOEnZb"><br></div><div><div class="ecxhm ecxHOEnZb"><hr>CC: <a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a><br>From: <a href="mailto:ali@hussein.me.ke" target="_blank">ali@hussein.me.ke</a><br>
Subject: Re: [kictanet] Proposed Kictanet’s input into Kenya’s Draft Cyber Security Strategy<br>Date: Wed, 26 Mar 2014 03:32:15 +0300<br>To: <a href="mailto:ggithaiga@hotmail.com" target="_blank">ggithaiga@hotmail.com</a></div>
<div><div class="h5"><br><br><div>Grace, Victor</div><div><br></div><div>Thanks for your input. The one thing that I would add is the mitigation of mass surveillance against the backdrop of international terrorism. Whilst this is an issue of personal freedom vis a vis the issue of national security we must have in place a mechanism to ensure that personal freedoms are not trampled on in the interest of individuals who clock the violations as necessary in the interest of national security. <br>
<br><div><span><b>Ali Hussein</b></span></div><div><br></div><div style="font-family:Helvetica;font-size:medium;"><a target="_blank">+254 0770 906375</a> / 0713 601113</div>
<div style="font-family:Helvetica;font-size:medium;"><br></div><div><span style="background-color:rgba(255,255,255,0);">Twitter: @AliHKassim</span><BR><span style="background-color:rgba(255,255,255,0);"></span><span style="background-color:rgba(255,255,255,0);">Skype: abu-jomo</span><BR>
<span style="background-color:rgba(255,255,255,0);">LinkedIn: <a href="http://ke.linkedin.com/in/alihkassim" target="_blank">http://ke.linkedin.com/in/alihkassim</a><a href="http://ke.linkedin.com/in/alihkassim" target="_blank"><span style="text-decoration:none;"></span></a></span><BR>
<span style="background-color:rgba(255,255,255,0);"></span><BR><span style="background-color:rgba(255,255,255,0);">Blog: <a href="http://www.alyhussein.com/" target="_blank">www.alyhussein.com</a></span><br></div><div><span><br>
</span></div><div>"I fear the day technology will surpass human interaction. The world will have a generation of idiots". ~ Albert Einstein</div><div><span><br></span></div>Sent from my iPad</div><div><br>On Mar 25, 2014, at 10:09 PM, Grace Githaiga <<a href="mailto:ggithaiga@hotmail.com" target="_blank">ggithaiga@hotmail.com</a>> wrote:<br>
<br></div><blockquote><div>
<div dir="ltr"><div dir="ltr"><h2 style="line-height:22.5pt;"><span style="font-size:12pt;">Dear Listers</span></h2>
On March 14, the GOK through the ICT Authority
released a 13 page draft Cyber Security Strategy (<span><a href="http://www.scribd.com/doc/212456939/GOK-National-Cybersecurity-Strategy" target="_blank"><span style="color:windowtext;">http://www.scribd.com/doc/212456939/GOK-National-Cybersecurity-Strategy</span></a></span><span>).</span><BR>
<span> </span><BR>
<span>We had considered
conducting an online discussion on the draft as is usually the tradition, but this
has not been possible. I therefore requested Victor Kapiyo to give us some
initial thoughts that can we can build on, and which will form part of our
submission. </span><BR>
<span> </span><BR>
<span>The deadline for
submission is this coming Friday, March 28.
We propose to send the comments by Thursday March 27, 2013.</span><BR>
<span> </span><BR>
<span>I wish to kindly request
you to add/ subtract/amend by Thursday 1.00 pm (March 27, 2013). </span><BR>
<span> </span><BR>
<b>General
Comments</b><BR>
<b> </b><BR>
<span>The strategy appears to be generic. It
lacks specifics and glosses over several key issues:</span><br>
<br>
<b></b><BR>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>It lacks a detailed discussion of the
current context - current statistics of internet usage, threats to the
internet, key bodies, resolutions, policies, directives, key public concerns,
challenges facing the country, current legal and policy framework for ICT etc.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Lacks clear justification for the
strategy.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Fails to identify the key players/stakeholders/institutions
in governmet, private sector, civil society – and their roles and
responsibilities in addressing CS issues, how they will be involved and their
coordination mechanisms.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Does not provide reasons or demonstrate
how and why the prioritized goals were arrived at/chosen.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>The actions under the goals are few and
not SMART.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>It fails to discuss the current legal
and policy framework to address CS on which it should be anchored.</p>
<p style="line-height:15.95pt;"> </p>
<p style="line-height:15.95pt;"><b>Proposals/ Recommendations</b></p>
<p style="line-height:15.95pt;">The
strategy should clearly articulate what the government intends to do, viz:</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Enhance protection and promotion of
fundamental rights and freedoms in the Bill of Rights in particular on
expression, media, participation, personal data and privacy,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Promote the national values under article.
10 of the constitution – rule of law, democracy, participation, good governance
etc.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve preparedness, rapid response
and capabilities to respond - CERTs</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve cooperation with, clarify
obligations, and manage roles and responsibilities of operators of critical
infrastructure and key providers of on-line services, such as e-commerce
platforms, Internet payment gateways, social networks, search engines, cloud
computing services, app stores.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve transparency and accountability
in the management of the net and CS</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Address public concerns over censorship
/ mass surveillance in a post-snowden era</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve information sharing and
cooperation - how should the info flow, which routes?</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve the reporting and publicity of
cyber-security incidents to the relevant authorities</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Promote openness of the internet, GoK
commitments under open government.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Regulate - who is currently covered/who
is responsible?</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve international cooperation and
engagement with international instruments - EAC treaties, Budapest convention.</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Set standards and common minimum
requirements for government bodies and market,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Maintain the reliability and
interoperability of the Internet,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Promote research, innovation and
development in CS,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve governance of the internet,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Promote access to the internet,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Promote CS through strategic
procurement,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve the policy and legal framework
on CS,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Mainstream CS into national security
agenda,</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Improve coordination of CS initiatives,
and</p>
<p style="line-height:15.95pt;"><span style="font-size:10.0pt;font-family:Symbol;">·<span style="font-size:7pt;line-height:normal;font-family:'Times New Roman';">
</span></span>Facilitate training of law enforcement,
judicial and technical personnel to address cyber threats.</p>
<BR>
</div> </div>
</div></blockquote><blockquote><div><span>_______________________________________________</span><br><span>kictanet mailing list</span><br><span><a href="mailto:kictanet@lists.kictanet.or.ke" target="_blank">kictanet@lists.kictanet.or.ke</a></span><br>
<span><a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a></span><br><span></span><br><span>Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/info%40alyhussein.com</a></span><br>
<span></span><br><span>The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.</span><br>
<span></span><br><span>KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.</span></div>
</blockquote></div></div></div> </div></div>
<br>_______________________________________________<br>
kictanet mailing list<br>
<a href="mailto:kictanet@lists.kictanet.or.ke">kictanet@lists.kictanet.or.ke</a><br>
<a href="https://lists.kictanet.or.ke/mailman/listinfo/kictanet" target="_blank">https://lists.kictanet.or.ke/mailman/listinfo/kictanet</a><br>
<br>
Unsubscribe or change your options at <a href="https://lists.kictanet.or.ke/mailman/options/kictanet/blongwe%40gmail.com" target="_blank">https://lists.kictanet.or.ke/mailman/options/kictanet/blongwe%40gmail.com</a><br>
<br>
The Kenya ICT Action Network (KICTANet) is a multi-stakeholder platform for people and institutions interested and involved in ICT policy and regulation. The network aims to act as a catalyst for reform in the ICT sector in support of the national aim of ICT enabled growth and development.<br>
<br>
KICTANetiquette : Adhere to the same standards of acceptable behaviors online that you follow in real life: respect people's times and bandwidth, share knowledge, don't flame or abuse or personalize, respect privacy, do not spam, do not market your wares or qualifications.<br>
</blockquote></div><br></div></div></div> </div></body>
</html>