All Posts By jacob

In 2012, a Chinese company completed the building of the African Union headquarters at a cost of $200m, which China had funded. This was a welcome gift to Africa, and the result was a landmark building that ended up being the tallest building in Addis Ababa, as well as a landmark signifying the Chinese-African friendship. Five years later, there was a near crisis when it was discovered that China had not only bugged the place with hidden surveillance equipment but also configured the AU servers to send data to Shanghai everyday sometime past midnight. It turned out that China was on an espionage mission, carefully wrapped in diplomatic benevolence.

This was not the only time Chinese products were being questioned. In 2017, it was confirmed that Hikvision, a popular Chinese CCTV camera brand (the biggest surveillance products manufacturer in the world) had a backdoor that allowed for anyone with limited technical knowhow to access the products and reset the login credentials. This meant that the devices had been designed with a backdoor for unknown reasons. Already, Hikvision products had been partly banned in some countries which limit their use in critical installations. Various countries like UK had already questioned the use of these Chinese made surveillance systems in critical installations. The action reinforced the belief that Chinese hardware manufacturers could be cooperating with the government in some obscure ways. With that, the company lost crucial markets.

Huawei seems to be following a similar path with their 5G network equipment being locked out of some select markets. Networks are vital for communication, and 5G networks will carry even more data than other technologies have been able to carry. It is assumed that if Huawei builds the bulk of worlds 5G networks, it will have access to too much data which it could share with the Chinese government. The US government

All this majorly stems from the Chinese legislation that says that “…any organization or citizen shall support, assist and cooperate with the state intelligence work in accordance with the law” The law also promises to protect any individual or corporation that does that. The law also requires any individual or organization to truthfully and willingly give data to state agencies that are investigating situations of espionage. With this in mind, the US government claims that if Huawei is allowed to deploy the 5G networks in the US or among its allies, it could be a backdoor for the Chinese government to monitor world’s communication. Huawei is also being blacklisted for alleged involvement in activities that are contrary to U.S. national security or foreign policy interest. It is for the same reason that Huawei’s CFO is being detained in Canada.

While there could be some legitimate concerns about Huawei, this is the classic case of the pot calling the kettle black. The US is guilty as charged when it comes to spying on foreign citizens, and also supporting and propping some world leaders who have very poor human rights records. The US has previously been accused of phone tapping world leaders, including 125 top German leaders who included the Chancellor. Besides the federal government, the US has several corporations which are primarily data companies, and Facebook Inc has been accusing of selling off user data to third parties without the users knowledge. What we are experiencing is not a trade war based on principles and values, but a global gang violence.

When M-PESA was launched in March 2007, we did not know what impact it would have on our lives and the World in general. I was just out of high school, waiting to join college, and this was a good time to experiment with anything new and promising. I heard about M-PESA, but I did not care an inch because I did not need it. I neither had a phone, nor an ID card or a passport that was needed to register, nor money to send. I lived with my parents and therefore I had no money to receive or send. Nevertheless, I had a SIM card which I could use whenever I borrowed someone’s phone and texted a few friends.

Two months later, I was sent to go to a post office ten kilometers away, where I was to send money to my sister in college. Sending money involved using the post office which had a one day delivery period with their electronic money transfer. The costs were extremely high, and the process of collecting the money would be hindered by working hours, lack of funds, or absent staff. You needed to collect the money from the exact post office that it was sent to. The services was terrible, but it was the best that was available then.

That was the day when I walked into an M-PESA kiosk and out of curiosity, asked to be registered for the service. I spent the next few days dreaming about just what M-PESA could turn to. Here was an opportunity to send money to a person wherever they were, and have them withdraw it whenever they want. We embraced the invention, and M-PESA was only used to send money. When one went to an agent asking to send KES 1000, they would ask you to give them KES 1034 (or about), which included the sending cost, the cost of withdrawing, and the amount to be sent. This is how we needed M-PESA to work, and that was exactly how we needed it.

12 years later, mobile money moves half of Kenya’s GDP, with the Safaricom’s M-PESA accounting for the bulk of those transactions. M-PESA has grown from a money transfer platform, to a pseudo-banking services which supports ecommerce, lending, bulk transactions and savings. Kenya has received accolades from across the globe for this invention, which has spread to the rest of the world with mixed results. The M-PESA narrative helped to build the notion that Kenya is the a major tech hub in the world, and many have undertaken to study why mobile money was very successful in Kenya. However, the other dark side of mobile money lies on what Kenya missed

Teething Challenges

As soon a fraudsters learnt how mobile money worked, they went into full gear to exploit the loopholes. Telcos failed to educate people on how to keep off these fraudsters, most of who could be traced to the local prisons. Some of the fraudulent methods used to con people included:

SMS Fraud

Receiving an SMS indicating that you have received money from somebody, then they call you to ask to send the money back. Some people did not know that all legit M-PESA messages out to come from the SMS sender ID M-PESA, and so the Kenyans of goodwill would send the money back, if they had an equivalent or higher amount in their M-PESA accounts.

SIM Swap Fraud

Since M-PESA came before there was a requirement for SIM card registration, some people realized that once you were able to steal someone’s M-PESA PIN, you could replace their SIM card, then withdraw all the money that is in their M-PESA account. This still happens today through SIM registration agents who conspire to replace SIM cards.

 Tuma kwa hii number (Send to this number)

With so many people using M-PESA every day, chances are high that out of a random sample of 100 people there could be one about to send money to someone. A fraudster would broadcast messages to hundreds of people, asking them to ‘Send to this number.’ This would be in the hope that one person who had been asked to send money to a contact would interpret it to mean that the specific contact wants them to send to a different M-PESA account, and thus send without asking questions. As simple as it sounds, some people have fallen victims to such pranks.

ATM withdrawal

M-PESA introduced a cardless ATM service, whereby one can go to an ATM, choose to withdraw money from M-PESA via the ATM, and all that one needed to do is go through a process on their phone, and they would be sent a one-time code which they could feed in the ATM and receive money. Since some people do not know about the existence of the service, fraudsters realized that they could trick people to go through the process and send them the authorization code. Minutes later, one would receive an SMS indicating that they have withdrawn money from an ATM hundreds of miles away.

Use of Numbers as identifiers

M-PESA relied on phone numbers as identifiers when sending money. This did not allow people to scroll through their phone books to select a phone number, but one had to write the number manually. This led to many cases where money was sent to wrong recipient due to mistyping or fat fingering. Recently, M-PESA introduced a number confirmation where one could confirm the name of recipient before the transaction was completed. Had this come earlier, there would have been less losses experienced through sending to wrong numbers.

Lack of laws governing mobile money fraud

For a long time, Kenya lacked laws that would government mobile money fraud. This was because the area was majorly unregulated and the Central Bank had taken a hands off approach, a factor that had helped growth of the mobile money industry. This meant that if you erroneously sent money to a wrong number and the person used the money, there would be no law to convict the person. This has only changed recently.

Difficulty reversing M-PESA transactions

For a long time, reversing an M-PESA transaction involved contacting the person who you had sent the money, and asking them to send it back to you. This would make the recipient withdraw the money as soon as possible, and so the preferred option was to call Safaricom customer care and asking them to reverse the transaction. This was one of the worst customer care initiative, as it would take long to reach the ever busy customer care.

In the case that wrongful recipient had already withdrew the money, Safaricom would only ask one to report the matter to the police. Of course, most people would not bother to report to the police, as one would end up losing more money while following up the lost money. This is still a problem to date. Safaricom has introduced an easy method of reversing a wrong transaction, but this works if the wrong recipient has not withdrawn the money.

Limited Documentation of User Experience

I met a Chinese professor who was trying to understand the growth of M-PESA in Kenya, and one of the things that he complained about was lack of written sources detailing customer experiences, agents challenges and the problems that were experienced in the rollout. As a global leader in mobile money, he had hoped that he would learn a lot in Kenya. However, it seemed that Kenya did not realize that it was making history by pioneering mobile money, and thus failed to keep good records for others to follow and learn.

This led to the same problems experienced here being replicated elsewhere, as the professor said. Perhaps, we need more scholars and researchers putting the Kenyan story together for the rest of the world to learn.

I stopped taking humans seriously when I learnt that a human being needs a birth certificate, as if their existence is in question, and a death certificate when they die to prove that they are dead and buried.  

When my daughter was born, I was advised to wait for two months before applying for a birth certificate at the Registrar of births and deaths office. I waited, and after two months, the office told me that I needed to wait for another one month. I waited for two more months, just in case, because I could not afford to go to and be turned back again. After application, I was told to go back after three months to pick the certificate. I went back to the office after three months, and there was no certificate. I was advised to wait for another one month. I graciously waited for two months, because I knew governments are just governments. When I went to pick the certificate, I had to sit and wait for three hours as they prepared it, only to receive one with a misspelt name. I protested, and they simply asked me to write the correct name on a piece of paper, then they went ahead to erase the wrong name, and wrote the correct name. How simple!

Such are the experiences that one gets from government offices. Be it about birth certificates, national ID, passport, KRA PIN (which is easy to register but hard to use), NSSF, NHIF, the 5:00 am queue for passport, or senior citizens queuing for hours waiting for Older Persons Cash Transfer activities. The government has lousy staff and very poor service delivery. All of a sudden, the government has had a brainwave, and now has one magic solution to all these problems; Huduma Namba.

When I first heard about Huduma Namba registration, my first question was ‘who called it a number?’ A good design would avoid using the word number because conspiracy theorists would call it the biblical mark of the beast. A number that you need to have in order to access all government services is suspicious. It did not help any better that the government started coming up with draft laws that would prevent farmers from selling milk to their neighbours, or even using animal manure. The government was saying that you cannot farm or sell your produce, and you need a number. Big blunder. The government, like many other governments out there, has decided that since it no longer makes news to shot self in the foot, it will go for a head shot.

But why would a government need a new number when there is already an existing unique identifier? The ID number is unique, and the government already has the biometric details of 19.7 million Kenyans who registered as voters. Do you know what is 19.7 million people? Kenya has a population of 49 million, with 51.3% of people being 0-19 years. This would mean that the rest of the people, who were over 18 when IEBC was doing their thing stands at 23.8 million. In short, the number of Kenyans over 19 years who are not in the IEBC register is about 4 million. Factor in the new people who got their IDs in the last two years and the total becomes 6 million. Do we need 6 billion to register 6 billion people? Of course, that is not the full story. The government intends to register even minors who are between 6 and 18 years. This approach is worrying because we know how poor the government is at securing data, and in this case it is biometric data which can never be changed in case of a bleach.

Why also register people in the diaspora? The government has all their details, including biometric data through the department of immigration. There are about 2.5 million Kenyan passports that have been issued. Have they changed their fingerprints? Have they grown horns? I do not think that plastic surgery is that prevalent. Why are we spending billions harvesting data which we already have?

My few comments:

1. It is easier to build on an existing system than to develop one from scratch.
2. No number can make service delivery efficient. A government that is unable to deliver on basic things cannot use a magical number like a magician to solve all problems.
3. I have seen politicians who acquired the IEBC register to use in order to contact potential voters. If they already sold the IEBC data to some very low bidders, what about the high bidders who really need this NIIMS data? Remember you can change your phone number if misused, but you can never change your fingerprints.
4. In connection to that, why can’t the government first of all finish up with The Data Protection Bill of 2018 in order to ensure that our data is safe? Why does the government want to take crucial data for our children without guaranteeing that the data will be kept safe?
5. Timing. When the government has admitted that it is having logistical challenges sending relief food to starving people who are very starving but none has decided to die of hunger yet, it also has 6 billion shillings to reach all the corners of the country for NIIMS

That said, the main thing I see in this Huduma Number is the 6 billion. It is their turn to eat. We need a savior.