What can we learn from Zimbabwe’s 2013-election DDOS attack ahead of the 2018 Poll?

In the weeks leading up to and following Zimbabwe’s disputed 2013 election, Zimbabweans were hit by significant Internet-based attacks. Because the incident was not widely reported, it did not gain traction at all in the Internet Freedom Community. Yet the incident was one of a kind to be documented during an African election. It adversely affected Zimbabweans’ rights to stay informed including by accessing first-hand information on the elections to inform civic action and response to the election irregularities. This also had repercussions on the transparency and outcome of the election since those who were monitoring them on online platforms were deprived of necessary information to base their reports on. As part of the project Sub Saharan Africa Cyber Threat Modelling, I propose that as Zimbabwe prepares for the 2018 elections, civil society actors in Zimbabwe and those who support their digital security and integrity projects should use the 2013 incident to undertake a proper threat model that takes account of DDOS attacks. This will coincide with the Zimbabwe CSOs’ launch of the2018 Election Situation Room on 27 June 2018 – an initiative that seeks to coordinate their activities & enhance citizen monitoring & participation in electoral processes. Unlike other attack vectors that only affect information confidentiality and integrity, a DDOS goes after the availability of a system or a network. The nature of its attack is like having your home flooded – without warning; attackers can upend the availability of information during an election. When it hits a network, a long time can pass before detection and mitigation. In an ever-expanding field of adversaries and other attack vectors, DDOS is still often difficult to attribute as it can often be orchestrated remotely.

Around July 30, 2013, while working for the Zimbabwe Human Rights Forum, I woke up to realise that most of the real-time content of the website I managed had been compromised through deliberate defacement and selective data erasure. As I tried to locate the content, the site went offline. I fiddled with the network until a U.S. Congress Researcher, who had been following our blogs, alerted me to the DDOS attack directed at our web host Greennet and web hosts of other critical websites such as Electionride.com and Nehanda Radio.

The incident included two massive distributed denial of service (DDoS) on Greennet to disrupt the Forum’s activities, which in turn caused collateral damage to other sites like that of Privacy International. Despite the difficulty of the attack source attribution, experts believed that either a government entity or a private organisation was responsible for the attack given both its nature and magnitude: 100Gbps attack that used DNS reflection rather than an unsophisticated botnet to attempt to overwhelm its servers.

What is a DDOS attack?

Confidentiality, integrity, and availability are the fundamentals of information assurance. Organisations often rely on the so-called CIA (Confidentiality, Integrity, and Availability) triad to benchmark and evaluate their information security. For instance, the data defacement and erasure on the web pages of the Zimbabwe Human Rights Forum affected the integrity of the data and therefore its reliability. However, a DDoS does not go after the confidentiality or integrity of the CIA model. It’s meant to go after the ‘A’, the availability of a system or a network.

A Distributed Denial of Service (DDoS) attack is an attempt made to take a website or online service offline. Attackers use a variety of ways to do this, but they all are designed to overwhelm the site with traffic from multiple sources.

In a DDoS attack, the traffic flooding the site can come from hundreds or thousands of sources, which makes it near-impossible to stop the attack simply by blocking a single IP address. They can be distributed by infected computers via botnets or coordinated. Sites also struggle to differentiate between a legitimate user and attack traffic.

A DDoS attack differs from a Denial of Service (DoS) attack, which typically uses a single computer and connection to flood a system or site.

Zimbabwe experienced a Domain Name System (DNS) reflection attack. This kind of attack spoofs the target’s IP address in DNS requests, causing DNS servers to amplify the volume of data focused on the data centre under attack.

Unlike a malware in the class of worms, a DDOS could generally be classified in the virus category in its mode of attack. Like a DDOS, a virus generally refers to a malicious program that self-replicates but requires some user interaction to be initiated. In this case, the virus/bot has a malicious payload (instruction) that it is meant to execute.

Here is an example by my friend Jonathan Weismann at Rochester Institute of Technology:

If Harry the hacker sends ten, one hundred or even one thousand pictures to an important web server, nothing will happen.

However, if Harry the hacker puts a program on ten thousand user machines and they each are instructed to place programs on thousands of other machines, when the time comes, Harry the hacker will give the kill signal and all machines known as zombies in this botnet, robot network, will be sending traffic to a poor victim’s server that will come to a grinding halt.

Attribution challenge and Recurrence

Cyber-attacks similar to the Zimbabwean one are difficult to attribute to any particular adversary unless such adversaries leave forensic footprints. We cannot predict recurrence during the 2018 election or in future with any degree of certainty because information controls are often applied in highly dynamic ways often responding to events on the ground displaying wide-ranging motives.

There has been an accelerated, dynamic and complex pace of events in Zimbabwe since the November 2017 power transfer. The country’s diversified international business partners potentially open up and diversify the vendors in the market for computer espionage and surveillance in addition to the so-called Huawei problem. Whereas China, also a major investor in Zimbabwe, continues to top the charts with its nation-sponsored surveillance activity, aspects of lesser-known nation-states and benign entities give cause for concern as they can hide in the darker parts of the internet. A good example was the hacking into the Zimbabwe Government websites. The attack vectors are expanding to include the use of social media to influence the opinions and actions of large populations.


The Zimbabwe case study and other recent attacks such as on the DNS Company Dyn shed a few lessons.

DDOS attacks happen very fast and are hard to detect, yet their consequence can be devastating. There can be a long time lapse between an attack, detection and mitigation. One needs a faster, more immediate means of threat detection to prevent severe damage. There’s little an organisation can do to prevent threats which may be the result of larger geopolitical forces but one can substantially reduce the likelihood of the adversaries’ chances to succeed by reducing their own vulnerability, and in turn, their own risk. This may include taking technical measures but also a holistic approach. For example, albeit on a different subject, Citizen Lab Research on targeted malware attacks reveal that the technical sophistication of [attacks] may be fairly low, with more effort placed on social engineering.

In our case the following non-prescriptive steps could have helped mitigate the impact of the DDOS attack:

  • Web content back up, including hosting a blog hosted on a separate platform where we could re-direct our readers.
  • Improving our firewall and password combinations as it appears the adversary gained entry onto our website dashboard to wipe out content.
  • Closely paying attention to the tell-tale signs such as the increase in the number of partisan subscribers.
  • Establishing a good relationship with the web-host and sharing concerns during key political events to enable their technical team to be prepared.
  • Draft an organisational DDOS attack playbook. This document sets out the systematic procedure to be followed in case of a DDOS attack. It helps ensure that organisational staff responds to the attack in an organised manner.

Why We Need Lawyers / Arbitrators In The Blockchain Space

*An article by Akram Mathu first published on medium.

Cryptocurrencies have really changed the way people transact. In this new age and time, one no longer needs a defined financial intermediary to send money. People have been given the power to transact at a peer to peer level. With new ways of transacting, comes challenges. This post will focus on arbitration using smart contracts.

An arbitrator is a person officially appointed to solve a dispute.

Currently, if Jane has some project work she’d like to outsource, she would post it on a freelancing website. Once the website helps Jane to look for a contractor, she eventually is able to find John.

Jane tells John that she will pay him using bitcoin instead of local currency. Jane negotiates that she will only pay once the job is done well. They both end up agreeing that Jane would send half the fee immediately and remaining half once the task is completed and reviewed for satisfaction. Their ownership of ether is associated with digital addresses.

Digital addresses are long strings of numbers that have two components; a public key that functions as an address and a private key that gives the owner exclusive access to any coins associated with that address.

Back to Jane and John. John then decides after getting half the payment, that he will not do the job. Jane becomes helpless because she can’t do anything to John because of her inability to detect John’s whereabouts. Jane, therefore, wouldn’t be able to go to court for a breach of contract. Even if John had a profile on the freelance website, he can still refuse or disappear from the platform.

In order to be able to transact using contracts, you need to be able to trust a dispute resolution mechanism or a trusted third party. Lately, multi-signature has been created in order to counter such incidences.

Multi-signature or ‘multi-sig’ is a form of technology that adds more than one layer of security for cryptocurrency transactions. This means that private keys are not one, they are two or more.

Multi-signature technology allows every contract to have private keys shared with both the peers and the arbitrator in case of any dispute or conflict arising.

Private key 1 – To help all parties (the two peers and arbitrator) see that the bitcoin to be sent to the other peer is first deposited in the escrow account/multi-signature address. But the bitcoin can’t be moved or withdrawn.

Private Key 2 – Is only accessible to the arbitrator and this key allows him/her to send the bitcoin to the party they think rightfully deserves the money if there’s a dispute or not.

When Jane wants to pay John, she sends her funds to a multi-signature address. This will require two signatures/ private keys from the group; Jane, John and the Arbitrator to redeem the money.

If Jane and John disagree on who should get the money meaning Jane wants a refund, while Bob believes he fulfilled his obligations and demands the payment, they can appeal to the arbitrator. 

The Arbitrator will grant his second private key/signature to Alice or Bob based on their previously agreed terms and therefore one of them will end up redeeming the funds fairly based on the arbitrator’s judging. For the service provided, the arbitrator will charge a service fee.

In order to contract regularly, one needs to have a certain level of trust that the system will enforce your rights under the deal. If you can’t trust the other party, you can trust the arbitrator also known as the dispute resolution mechanism or trusted third party.

Arbitration will really help during the use of smart contracts.

The bitcoin network have firms such as Hedgy that use multi-signature technology.

The Ethereum Blockchain has an arbitration firm known as Kleros.

Kleros involves the use of smart contracts to lock funds and those funds are only distributed right after the end of the initially agreed contract between the two peers.
Finally, the newly launched EOS.IO Blockchain will also have an arbitration process. The exact process is yet to be clearly stated.

Overall, arbitration is an opportunity for existing lawyers to tap into by learning how to apply their existing legal skills in the Blockchain protocol.

Tobacco Regulations, 2014: Balancing the Protection of Trade Secrets and the Right to Privacy.

By Mercy King’ori**

The Tobacco Regulations of 2014, which were created to protect the health of smokers and “second hand smokers”, have been criticized for a lack of regard for the right to privacy for manufacturers’ trade secrets consequently stifling the rights of corporations engaging in otherwise legal business. This regulations came under scrutiny in the case of British American Tobacco Ltd v Cabinet Secretary for the Ministry of Health & 5 others [2017] eKLR where the appellants called for their annulment arguing that regulations 12-14, which require disclosure of key product information, violated their constitutional right to privacy and and may infringe on their intellectual property rights.

Part III of the regulations provides that the tobacco industry must provide the following information about their products:

  1. List of ingredients in tobacco products and tobacco product components;
  2. Reasons for including the ingredients;
  • All the toxicological data available to the manufacturer about the ingredients of the tobacco products and their effects on health and information on the characteristics of the leaves i.e. their type, percentage, percentage when expanded and changes made about tobacco product ingredients.

These requirements are a replica 2009 US law that granted the Food and Drug Administration (FDA) powers to direct tobacco companies to disclose ingredients in new products and changes to existing products. They also adhere to article 9 and 10 of the WHO Framework Convention on Tobacco Control (FCTC).

Whether the information that tobacco companies want to protect qualifies to be trade secrets is disputable. The law of confidence which is rooted in equity and legislated under article 39 of the Agreement on Trade- Related Aspects of Intellectual Property Rights (TRIPS) to which Kenya is a signatory to protects trade secrets. Article 39 of the Agreement stipulates that the following requirements must be met for information to be regarded as trade secrets: secrecy, commercial value and reasonable efforts to maintain secrecy.

The information held must be of a secretive nature though not absolutely secret. Employees, business partners and other persons can know the particulars, provided they keep them secret. Besides, ordinary and mundane information can be the subject of confidence so long as the information is private to the compiler. This was illustrated in Coco v AN Clark (Engineers) Ltd [1969] where the Court found that information that is common knowledge to a group of persons (in this case tobacco manufacturers) is part of the public domain and is not confidential. Therefore information regarding ingredients must be confidential to qualify as a trade secret.

Secondly, the information must have commercial value i.e. there must be some utility obtained from the information being secret. The manufacturer must be able to use it to acquire a business advantage over other manufacturer(s) in the same industry. Therefore, the information must only be known to the manufacturer to have commercial value. Disputably, players in the tobacco industry could argue that the information they guard has commercial value to them as it is what gives one company an edge over a competitor that uses different ingredients and manufacturing processes

Lastly, the owners of the secrets must carry out steps to ensure that the information is well secured. According to WIPO, some of the reasonable steps that can be taken to secure trade secrets include: non-disclosure agreements, training and capacity building with employees, instituting an information protection team, having a trade secret SWAT team, establishing due diligence and continuous third-party management procedures among others.

Kenya, as a signatory to TRIPS, is obligated to protect trade secrets. These regulations do not however protect trade secrets and business ‘know-how’ once it is revealed; meaning once revealed it loses its secrecy. This leaves trade secrets and business ‘know-how’, such as the list of ingredients and percentage of leaves expanded, vulnerable to appropriation.

In taking the role of devil’s advocate, it is worth considering whether the information that the tobacco industry is required to reveal under Part III really falls within the scope of trade secrets. Let us go back in history to understand the situation as it was that caused the emergence of such requirements. In 1998, 35 million pages of what was considered confidential information were revealed as a result of the Minnesota’s Tobacco Trial in the US. This information was on the harmful ingredients that tobacco companies used in the products. In what was considered the Master Settlement Agreement, the U.S. agreed not to sue the corporations in exchange of the corporations revealing all documents considered to be confidential to the public. It is important to note that one of the companies involved in the Supreme Court application to throw out the regulations was implicated in this law suit for failing to reveal to consumers harmful ingredients contained in their tobacco products.

Moreover, research carried out between 1937 and 2001 of tobacco companies, some of which operate in Kenya, revealed that tobacco ingredients are not secret rather the companies simply reverse engineer their competitor’s brands to create their own. This report argues that since the reverse engineering process is done routinely, it does not meet the threshold of secrecy for information to be a trade secret. The report implicates some multinationals that operate in Kenya. If this is anything to go by, then it negates the fact that the information in question has commercial value and is secret.

It is thus important to strike a balance between consumer protection measures and the protection of corporations’ intellectual property. Overzealous consumer protection regulations result in laws that infringe on corporations right to privacy and violate their intellectual property rights, to the detriment of their revenue and the country’s economy as a whole. Since the appeal was dismissed at the Supreme Court, it will be interesting to see whether the companies shall abide by the regulations.

** Mercy King’ori is a 3rd Year Bachelor of Laws student at the Strathmore University.


By Christopher Rosana**

Strange! That a man who has wit enough to write a satire should have folly enough to publish it.” These words by Benjamin Franklin ring in my head every moment I have to analyse defamation claims and the nuances of media in the digital age. The requirements for libel have not fundamentally changed for centuries; its principles have happily held sway. Those whose reputations have suffered walk away with their assigned damages – a solatium to their injured reputation. Principles may have remained unchanged, modified to new situations even, but there are corresponding misapprehensions on the meaning of ‘publication’ that have crept into the public mind.

For a successful defamation claim the following conditions must be present (1) the statement must be made to a third party – published; and (2) the statement must lower the claimant in the estimation of right-thinking members of society. In the second condition, it may be sufficient if the statement exposes the claimant to hatred, ridicule, contempt, or to be shunned.
What amounts to a ‘publication’? On this question rests all the blame for the massive amounts of damages that defendants have to pay. The rise of alternative forms of disseminating information, for instance Twitter, Facebook and their ilk, seems to have altered the understanding of what qualifies as a ‘publication’. In our minds we still picture an old dingy printing press churning away pieces of propaganda but never do we feel convinced that our tweets, blog posts, screenshots are actually ‘publications’.

As a legal term of art, ‘to publish’ is simply to make something known to a third party. To publish is not limited to paper and ink. Whatever form a person utilizes to communicate libelous information would not absolve them in a defamation claim. The libelous information must refer to a living client as you cannot defame the deceased.
The misapprehension leads to defences in the line of ‘It is not us saying it, we are just quoting x’. In Nicholas Biwott v Clays Limited & 5 Others, Bookpoint was held to be responsible for defaming the plaintiff even though they were merely selling a book which it did not author. Therefore, meaning of publication implicates the person even when they are not, technically speaking, the person ‘saying’ what is libelous in the circumstances. In the eyes of the law, if statements are libelous and one disseminates them to another, one must prove the truth of those statements. In the spread of libelous information, the question before the court is not whether the words were actually said but whether the words said are provable as true. When one spreads defamatory information, they are taken to have adopted and endorsed those words as their own.

Thus, sharing a defamatory tweet is publication in the selfsame way a printed newspaper would be. It is curious how we easily describe an online article as ‘published’ but we do not extend this to tweets, and Facebook posts. A common pitfall is when a newspaper publishes the revelations of an anonymous user that are ‘juicy’ but also happen to be defamatory to the person in reference. The defamed claimant would sue the newspaper since those words are taken as its own and since the original source has anonymised their online account, the newspaper will be at pains to prove the claims. In a similar instance with the same facts, you may share the defamatory claims on your Twitter or Facebook thinking that it is not a ‘publication’. There is no safety in numbers as the aggrieved party can choose to sue any one of the defaming defendants as shown in Nicholas Biwott v Clays Limited.

Christopher Rosana is a Legal Assistant at Nation Media Group (Legal Department)

What have we learnt from studying 5 years of Internet Disruptions in Africa?


, ,

On 5 October 2016, the Ethiopian railway corporation launched a 750 KM rail-line connecting the landlocked country from its capital, Addis Ababa, to Djibouti, its strategic economic link to global commerce. A few hours later, the communication ministry completely shut down all Internet connectivity across the country, with the stated aim of quelling protests in parts of the country. Spending millions of dollars to connect a country to the world through a railway, while intentionally shutting down the country’s Internet connectivity on the same day is a quite a paradox. To consider a whole city, or even a country, intentionally disconnected off the Internet for days by their government, may sound quite abstract, but more than fifty incidences like these were recorded globally in 2017, of which for every two of these, one was happening in Africa.

The effects of these intentional Internet disruptions have ranged from increased citizenry backlash, economic losses, and eroded international reputation. What is interesting though, as seen from the Ethiopian vignette above, is how disrupting the Internet contradicts the very economic plans of such countries. On the one side, countries are investing heavily on communication and transport infrastructure for economic connectivity yet easily reversing the marginal gains made by their intentional Internet disconnections.

Today we are releasing findings from our continuing research on Internet disruptions, together with the associated data-sets. .

Some of our findings include:

  1. Ten countries in Africa account for 60% of all Internet disruptions experienced in the last five years.
  2. All countries that have had an Internet disruption have had the current ruling party being in power for 18.9 years on average.
  3. Countries with less than 20% Internet Penetration rates are more likely to disrupt the Internet during protests than those with higher rates.
  4. Liberal countries are less prone to Internet disruptions, especially where sufficient oversight exists over the executive arm of Government.
  5. Detection and attribution of Internet disruptions is improving but regional disruptions remain a daunting task. 

We were also interested in estimating economic impact of intentional disruptions in African countries. The report shows that by incorporating ‘shadow economy’ in assessing impact of Internet disruptions, there is an average of as high as 30% jump in economic costs from previous estimate models. The ‘shadow economy’ is understood here as economic activities and the income derived that circumvents or otherwise avoids government regulation, taxation or observation (Schneider 2013). This includes what we are calling the ‘WhatsApp Economy‘, that involves individuals or small businesses using messengers (especially WhatsApp and Telegram) and social media platforms (especially Facebook, Instagram, and Twitter) to market their wares or services, aided by mobile money and boda boda (motorbike couriers) to complete transactions without any registered business or additional tax responsibilities.

The first section conducts an audit of how Internet disruptions have been defined, detected, attributed, costed and responded to. Section two looks into how to quantify effects of Internet disruptions in Africa. Section three presents the findings from the quantification exercise and section four discusses some cases from the findings and section five presents research and policy recommendations.

Download the report here.

New Report: Biometric Technology, Elections, And Privacy in Kenya


, , ,

The use of biometric technology in political processes, i.e. the use of peoples’ physical and behavioural characteristics to authenticate claimed identity, has swept across the African region, with other 75% of African countries adopting one form or other of biometric technology in their electoral processes. This has been necessitated in part due to the low trust majority of citizens have had with electoral management bodies and the assumptions that adopting such technologies will increase confidence and efficiency in the elections. This comes at a high cost to countries already struggling with expensive elections. Despite such costs, the adoption of biometrics has not restored the public’s trust in the electoral process, as illustrated by post-election violence and legal challenges to the results of the 2017 Kenyan elections. An unexplored implication of this techno-optimism of biometric technology in elections is the privacy aspect.

The Centre for Intellectual Property and Information Technology, a research centre at the Strathmore Law School is releasing the results of an ongoing investigation on the privacy implications of using biometric technology during the electoral process in Kenya. The project focuses on two main questions: what are the motivations for the adoption of biometric technology in Kenyan elections, and how is privacy and security of personal data in Kenya impacted by the adoption of biometrics in the electoral system? We conducted primary and secondary research from our location in Nairobi, Kenya before, during, and after the 2017 General Elections.

The key takeaway is that Kenya’s legal landscape lacks the protections needed to safeguard the privacy of its citizens and protect their data. Transparency, trust, and security are key when deploying biometrics technologies. When such technologies are adopted in the absence of a strong legal framework and strict safeguards, they pose significant threats to privacy and personal security, as their application can be broadened to facilitate discrimination, social sorting and mass surveillance. The varying accuracy of the technology can lead to misidentification, fraud and civic exclusion. As such, it is crucial that as Kenya reviews its election and referenda processes, the use of biometric technologies be understood from a privacy and security perspective.

Find the report here.

Celebrating Trailblazing Kenyan Women in Innovation and Creativity: World Intellectual Property Day 2018

The theme for this year’s World Intellectual Property (WIP) Day on 26 April is ‘Powering change: Women in innovation and creativity’. According to the World Intellectual Property Organization (WIPO), this year’s WIP Day campaign ‘celebrates the brilliance, ingenuity, curiosity and courage of the women who are driving change in our world and shaping our common future.’ The UN specialised agency in charge of intellectual property (IP) urges its member states ‘to reflect on ways to ensure that increasing numbers of women and girls across the globe engage in innovation and creativity, and why this is so important.’ In Kenya, many observers note that women remain significantly underrepresented in Science, Technology, Engineering and Mathematics (STEM) despite the country’s significant progress in achieving gender parity in education.

Continue reading

Open AIR Researcher Presents at University of Cambridge Seminar Series on Open Intellectual Property Models

On 28 February 2018, the Centre for Research in Art, Humanities and Social Sciences at the University of Cambridge continued its seminar series on ‘Open Intellectual Property (IP) Models of Emerging Technologies and Implications for the Equitable Society’. The topic of the seminar was ‘Open IP in emerging and developing economies’ where the goal was to examine whether emerging and developing economies have an opportunity to take a radical approach to intellectual property (and also collaborative innovation practices) when it comes to areas like manufacturing, green tech, biotech and computing/artificial intelligence. If so, what could that look like and what would it mean for equitable and sustainable development? The speakers during this seminar included: Elisabeth Eppinger (Freie Universität Berlin); Kenneth Huang (National University of Singapore) and Valeria Arza (CENIT). The presentation made on behalf of Open African Innovation Research (Open AIR) was on our on-going work on open and collaborative innovation in and around high-tech hubs in Africa, particularly if/how they are using IP to facilitate openness.

Continue reading

Are Computers Legal Persons? – A Student’s Perspective

By Emmanuel M. Nzaku**

In 1892, when Mr. Aron Salomon was making leather boots and shoes in his White Chapel High Street establishment, he had no idea that his enterprise would shape the nature and operation of modern trade. Since his sons wanted to become business partners, he turned the business into a limited liability company. The company purchased Salomon’s business at an excessive price for its value with his wife and five elder children becoming subscribers and the two elder sons directors but as nominee for Salomon, making it a one-man business. Not only didn’t Mr. Salomon take 20,001 of the company’s 20,007 shares, the company also gave Mr. Salomon £10,000 in debentures. When the company’s business failed and it went into liquidation, Salomon’s right of recovery against the debentures stood prior to the claims of unsecured creditors, who would, thus, have recovered nothing from the liquidation proceeds.

Continue reading

Solid Intellectual Property Strategy Key to a Successful Events Planning Business

By Jade Makory**

There is a noticeable boom in Kenya’s entertainment scene. People want to meet up with friends and family, eat and drink while listening to good music or enjoying art or cultural performances. This has led to fierce competition among event planners, who feel the need to set themselves apart from other event planners. To do so, they would need to have distinctive and original features to set their events apart. These unique features may manifest themselves as intellectual creations that would require protection and management as intellectual property (IP). These features may be: branding elements such as logos, slogans and names falling under trademark law in accordance with the Trademark Act; ornamental or aesthetic features of their products falling under industrial design law in accordance with the Industrial Property Act; and original works falling under copyright law in accordance with the Copyright Act.

Continue reading