Webinar – session 1

Experts Convene in Nairobi to Tackle Cybersecurity Challenges in Social Media

The webinar held in Nairobi brought together a diverse group of experts from across Africa to discuss the cybersecurity risks associated with social media, as well as potential remedies and solutions. The panel included law enforcement officials, regulatory authorities, and civil society representatives, who provided insights into the complex landscape of social media usage and its associated challenges.

One of the central themes of the discussion was the immense popularity of social media in Africa, driven by factors such as the availability of affordable smartphones, reduced costs of internet connectivity, and the instantaneous nature of information sharing. Social media has become a vital platform for political engagement, self-expression, and entrepreneurship, particularly among the youth.

Despite the benefits, the panel highlighted the prevalence of cybercrimes facilitated by social media, including ransomware, sextortion, cyber sex trafficking, and identity theft. Vulnerable groups, especially women and young people, are at increased risk due to economic hardship and a lack of awareness about online safety.

The issue of underreporting cybercrimes was a significant concern raised by the panel. Victims often refrain from reporting due to shame or ignorance about how to report. To address this, the importance of public education and awareness campaigns was emphasized, aiming to empower individuals to report incidents and protect themselves online. Law enforcement agencies have been working to provide resources and information to the public on reporting cybercrimes and the investigative process that follows.

The international aspect of cybercrimes was addressed by Interpol’s Jackson Cheboi, who outlined the organization’s strategies for combating transnational cybercrimes through global cooperation among law enforcement agencies. Interpol’s role includes influencing policies, building capacity, and providing expertise to member countries.

The panel also discussed the impact of social media on elections and governance, expressing concerns about the manipulation of social media to influence political outcomes and the spread of misinformation. The need for regulation and accountability of social media platforms was discussed, with calls for amendments to relevant laws to ensure responsible use of these platforms.

Emerging technologies, particularly artificial intelligence, were identified as presenting both opportunities and challenges. AI’s potential to create deepfakes and commit sophisticated frauds necessitates targeted awareness and capacity building to address these challenges. The need for more resources and technical support for law enforcement to address cases of impersonation and AI-generated fraud was highlighted by Lillian Nawoga from CIPESA.

In conclusion, the webinar reached a consensus on the need for comprehensive and targeted approaches to mitigate cybersecurity risks associated with social media. The importance of raising public awareness, enhancing digital literacy, strengthening law enforcement capabilities, and fostering international cooperation was agreed upon. The discussion also emphasized the need for a balance between cybersecurity enforcement and the protection of human rights.

Key observations included the rapid adoption of technology such as AI in Africa, with banks already experiencing AI-generated frauds. The call for a hybrid system of reporting and investigating cybercrimes to build public trust was significant. Additionally, the emphasis on the need for cyber diplomacy and the alignment of policies among states to facilitate cross-border cooperation in cybercrime investigations was a crucial takeaway from the webinar.

Mwende Njiraini:
Good afternoon and good evening to all of you who have joined us this afternoon in Nairobi. But we are from all over the world. We welcome you. I trust that you’re keeping well and that you can hear me. And that we are ready to join this discussion on cyber security risks in social media remedies and solutions. We are excited to have distinguished panelists from all over Africa. We have panelists from Uganda and Kenya as well. And we are hoping to expand this in our next webinar to expand the reach of our participants and our panelists from all over Africa. So thank you so much for registering and for joining us this afternoon. Thank you so much for giving us your time. I will now invite, I am Mwenda Njeraini, sorry, and I work with Diplo Foundation. I will now invite Jovan Kubalia, who is the Diplo Executive Director, to welcome us by giving us the opening remarks. So Jovan, please.

Jovan Kurbalija:
Thank you. Thank you, Mwenda. Dear colleagues and friends, it’s great to connect from Geneva. the UN compound and the Geneva digital ecosystem. And I would like to congratulate Mvende and Kate and colleagues from Kenya for organizing today’s webinar. And it was an interesting coincidence, first two days of this week, our team was in Addis Ababa, Kate can probably reflect more on that, delivering training for African diplomats on cyber issues. And today we have multi-stakeholder community here, people from civil society, technical community and other actors. And it’s good news that there are discussions on different levels on similar issues, because in Addis they discuss cyber diplomacy, cyber security, cyber crime and other related issues. Why is this very important and timely discussion? Obviously, social media is impacting our lives on many fronts. And definitely one is a content governance, content policy, which is a big issue worldwide, especially during this election year, where more than half of the global population is going to some sort of elections worldwide. But there is issue also on the core security aspects, which are listed in the program of today’s workshop. Therefore, apart from the content, question of misinformation, fake news, misuse of the social media, we have some core issues of protection of our accounts and our system on social media. And here we have issues of definitely encryption, end-to-end encryption, which is a big issue, which many governments are trying to to find the back doors for justified or not justified reasons. But this is an issue that has to be discussed. There is a question of security and privacy of data. And this morning, I read an interesting interview with Pavel Dura, the founder and owner of the Telegraph, where he basically, he’s an interesting person because he moved out of Russia in 2014 because of the government’s push for the surveillance. And then he wanted to set up his company in the United States. But then he realized that he was basically, his engineers were approached by FBI to find the back door into Telegram application. Therefore, he ended up in Dubai. And I suggest you to listen to his interview because it’s interesting. He ran away from one censorship, he moved to the other country, he faced another censorship, and he settled in Dubai, where he’s now based. Therefore, there are different aspects from the personal protection of security and data to the question of the end-to-end encryption, which is very often proclaimed and very often upheld by companies. But also there are back doors and there are questions how to be sure that our communication is private, protected, and secure. Therefore, there are many issues that we have to face. And it’s great to see that there is an interest and there is a dynamism on African continent on addressing these issues, which are global. But I think insights from Africa, where the social media is very, very dynamic, very busy, where you don’t have that strict regulation like in other parts of the world, could be particularly relevant not only for solving African problems. immediate problems, but also for addressing the questions of the global nature, how to get social media protection security right. And I would say, if I can list among the issues, although AI is all over the place, there is a hype, but there are two issues which I think we should prioritize as humanity. One is content governance on social media, very delicate issue, affected by local cultures, security, affected by justified reasons of governments to have some surveillance, especially in the fight against the crime and terrorism, but also governments going one step further beyond proportional and trying to have overall surveillance, therefore a very delicate issue which cannot be easily solved. But this is the first issue which is for me the priority for humanity, much higher than AI governance, because it affects people’s life directly. And second issue is the question of protection of cables. We are not aware how our Internet is vulnerable, especially nowadays when many, not only countries, but also private entities can cut the cables. And we had recently two examples in West Africa and in the Red Sea, which affected partially connections in them, including Kenya and West Africa countries. But this is the global problem, because ultimately our Internet boils down to a few cables crossing the Atlantic Ocean or going to the Red Sea or around the African continent. Those are two issues which, when people ask me what makes you awake during the night, those are two, when it comes to digital governance, those are two issues much, much more important than AI governance, which is all over the place. Therefore, once more, congratulations for putting… this topic on the agenda to Mervand and Kate, and I wish you a good discussion, and again, which is not only relevant for Africa, but also for the rest of the world. Unfortunately, I will have to leave soon, but I’m going to follow carefully later on when I finish series of meetings, the recordings, and learn more from your experience. I wish you good, fruitful, and impactful discussion.

Mwende Njiraini:
Thank you so much, Jovan, for the introduction and the welcoming remarks. Thank you for raising the issues that you have raised, and I’m sure we’ll address them and other issues that will come to face us in this webinar. So with that, I would like to welcome Dr. Catherine Gitao to take over on the next session and introduce, I guess the panelists will be introducing themselves, but introduce the next section of this webinar. Thank you. So, Dr. Gitao.

Katherine Getao:
Okay. Thank you very much, Mwende, and thank you, Jovan, if you’re still with us for that provocative welcome and introduction. If I look a little tired, I just traveled from training diplomats this morning, and many of the issues we’ll be discussing were also issues of concern to them. So we have a distinguished panel before us. There are two panelists who are still expecting, so please flag me if they’ve entered the house, but for the moment, I’ll mention those who I know are with us. So, from civil society, we have Dennis Awuah, who comes from FIDA, which is a legal NGO. that offers services to citizens, legal services. I believe you’ll explain to us whether it’s free or affordable as you do your introduction. Welcome Dennis. We also have David Ndeje from the Kenya ICT Action Network which has been extremely active, not only in participating from the civil society point of view in policy discussions, but also in educating the public on issues that are pertinent to successful use of ICTs including cybersecurity. So welcome David, we look forward to hearing from you. Then from law enforcement, this is really unique I believe and we’re really excited to have Jackson Chiboy from Interpol which is the sort of police agency that enables collaboration between police forces around the world, especially when a crime crosses borders. And we have Lawrence Agola who is from our own Directorate of Criminal Investigation here in Kenya who have increasingly been looking at this kind of crimes. So last but not least, who I know is in the house is Francis Sitati from the regulator here in Kenya. And they have not only been very active in dealing with issues of cybersecurity including social media, they have also been at the forefront of child online protection activities and education. education. So welcome, Francis, and thank you for being with us. So we’re still expecting the Honourable John Kiari, who is the Chairman of the ICT Committee in our Parliament here in Kenya. And if you’re with us, John, welcome. And Lilian Nnawoga, who comes from civil society within Uganda, but serves the Eastern Southern African region. So thank you very much for bearing with me. If any of the panellists would like to add something that I didn’t mention when I was briefly introducing you, of course, each of them are very, very distinguished people in the organisations that I mentioned. Please do go ahead as I asked the first question. Now, the reason why we came to this topic is that Africans have really taken social media to heart. And I think it is the application of ICT above any other that is bringing Africans to the digital world, and they’re heavy users of social media. But we also know that this is becoming a haven for certain types of criminals. So in the first round of questions, which I’ll ask all of you to just give your point of view, beginning with Francis Titati, and when he ends his contribution, I will mention which panellists should go next. So the question is, why do you think that social media is so popular? with Africans, young and old, and related to that I’m sure you’re all aware of the kinds of crimes that are occurring as criminals also become attracted to this area. So maybe you can just briefly give us an example of a social media crime that either you’re dealing with or that has really caught your attention recently. So let’s start with Francis from the Communications Authority, and then we’ll do the first round of questions.

Francis Sitati:
Thank you so much, Dr. Gitao, if you can hear me, I’ll just proceed. As mentioned, my name is Francis Iklati from the Communications Authority of Kenya, specifically the KE-SAT, that’s a Computer Incidents Response Team for Kenya, which is a multi-function, it’s a multi-agency function of government, whereby we have technical personnel from the authority as well as officers seconded from the various law enforcement agencies. So to jump right into the questions, yes indeed we have seen that social media has become a very popular medium for communication in the country, and this is for various reasons. We are seeing that we have improved connectivity in the country in terms of internet coverage. Based off of the last report, what we call the quarterly statistics report from the Communications Authority of Kenya, that’s as of December of 2023. In terms of the connectivity, in terms of the number of SIM cards, that is unique SIM cards, it was recorded at about 66 million, and of the 66 million SIM cards, about 33 million are smartphones, so you can see that from a population of about give or take 50 million, almost everybody has a smartphone. So the availability of affordable devices and also internet connectivity, the cost of broadband connectivity has also substantially reduced, could be attributed as two major reasons why social media has become very popular. But having said that, in terms of the platforms themselves, we see that information spreads very quickly on social media, you’re able to reach very many people within a very short time span. So in terms of communication, in terms of outreach, it’s a very good media to communicate quickly. Also, we are seeing a young generation of Kenyans who are using social media for self-expression and creativity. We are seeing the popularity of various social media influencers who are pushing brands, are using that to make money. So it’s an avenue for self-employment and entrepreneurship. So social media, for that reason, is becoming a very popular means of communication. Also, Kenyans, of course, as you may know, we like to engage in political discourse and civil engagement. So whenever anything happens in the social circles, a lot of Kenyans are discussing these issues. So as opposed to how it was done previously, where you’d have to wait for the traditional media to watch the news, now in the advent of social media, you simply log on to your favorite social media platform and you’re able to get the latest. in terms of, you know, your favorite politician. And maybe the last thing I want to talk about is, and it’s tied to the other points, is that the information is in real time. You’re able to quickly get information on the fly. You know, many of the young people are outwardly mobile, so you want to get information as it happens. So social media is obviously a very good choice for that. Thank you.

Katherine Getao:
Okay, I was having difficulties and muting. I think my status had changed. So I’m sorry about that. Okay, so thank you very much Francis you’ve given us a very good overview of why social media is so compelling. For most of us and I think everybody here right now we’re using a form of social media. And this is very popular. So perhaps. Now I’ll turn to those from the law enforcement agencies, starting with Jackson and then following on to Lawrence. What are some of the things that are happening online which are drawing your attention. What happens completely online and what happens that’s online, but comes into the physical realm. of things that not only happen here locally, but have an international component, I’d be grateful. Jackson?

Jackson Cheboi:
Thank you very much, Dr. Ketau, and thank you, Frances, for laying the foundation. Maybe picking from Frances’ explanation, I think currently it’s said that if it’s not on social media, most probably it didn’t happen, and if it did, maybe it impacted none, maybe that were only. So on that realm, maybe when it gets to the criminal perspective, especially the international crime, and what I call international crime is a transnational and trans-across-the-borders. What the social media has done is as availed an avenue where the actors can be in different locations and coordinating seamlessly to commit crimes that would otherwise be impossible to be done the conventional ways. From the Interpol’s perspective, we are seeing some crimes that basically stand out because of the component of social media and also other facilitators within the internet environment. Let me mention maybe three. Ransomware. Most of you have heard about that. Being a financial crime starts probably with the wetware, that’s the human being, processed through even the regulated or the mainstream system of the Chekas and ultimately the proceeds are cashed out in financial institution and it can happen maybe not only in Africa but across even the entire globe. That’s one of the greatest things that we are watching at Singapore at this particular moment because it has a great wave and a great impact. Other types of clouds come in between and the last one is facilitated majorly by social engineering and people especially targeting the western lead to sextortion. Those are the three main ones that are happening in continent Africa and it has a trace to other parts of the world.

Katherine Getao:
Thank you very much Lawrence for that overview. Now I’d like to turn to Lawrence because what provoked us to actually have this webinar was some incidents where some young ladies in Kenya who had been groomed online ended up losing their physical lives after meeting the criminals physically. So I believe there’s a lot of crime which is starting online and or which can even be completed online as Jackson has shown us but there are also crimes new crimes. crimes, physical crimes, which start online. Could you just give us some insight and maybe some examples into this kind of crime?

Lawrence Okoth:
Yeah, thank you very much, Dr. Gitao, for this opportunity. And I want to say and align myself with what my senior colleagues have really put forward. Internet, I want to say is not a bad thing. And it’s growing and really speeding up a lot of growth in terms of business, in terms of household economic income. And during the COVID-19, a lot of people, including children, because of the close of schools, were able to join internet so as to continue pooling even when they were at home. And after the COVID-19, they still maintained using the internet. And a lot of businesses have also come up because of the internet. So this has really attracted criminals who are hiding behind keyboards to offend against those people who are not aware of the securities or how to protect themselves online. So where I work, we focus on internet crimes against children. And some of the crimes that we deal with are trade on child pornography. And you find that people are targeting children, luring them, grooming them, and also trying to meet them offline. So you find criminals are using Internet to target those vulnerable members of the society. And offending them either sexually and even defrauding them. So with the development of even the cryptocurrency, the virtual money, this has really furthered the crimes that are happening online. Because some people who are trading on maybe, for example, child pornography, they want to pay or receive money through cryptocurrency, and they are able to buy child abuse materials. Another crime that is really coming up is also cyber sex trafficking. You find that young women are recruited online, and they are made to send their details with specifications that have been advertised online, only to realize they have been lured to a business that they are put in front of a camera, performed through coercion, they perform cyber sex, and they are paid online. So you find that this is… something that is really global and through cryptocurrency, people are really really making a lot of dirty money through this kind of illicit business. So the type and kind of crimes that are happening online are also motivated with what is happening offline. You find also young adults, the youth are also following footballs, they are able to place bets so betting is also motivating young people to be online so that they can try their luck to win. So besides the good side of the technology, the criminals are also using technology to further their crimes and offend against children, young people and even the adults. Yes.

Katherine Getao:
Okay, thank you so much for that summary of some of the crimes that are emerging in this area and I think now the word you really mentioned Lawrence is lured. So there seems to be an element of ignorance that is facilitating these kinds of crimes. So it’s my chance to turn to some of our civil society partners to tell us what they are finding in this space and also what they’re doing about it. So I’ll start with Dennis from FIDA. Are people coming to you with these kinds of crimes? for assistance? Have you prosecuted any? And basically, you can also tell us your view on the kind of things that are happening. Thanks.

Dennis Otieno:
Thank you so much, Dr. Ari. First, receive our warmest greetings from our Executive Director, Annie Reri, who was not able to be here today, but she passes her regards. So, on the question on, do we receive such cases? I’ll pick it up from what Mr. Lawrence, of course, has spoken about, and I would target on the extreme cases of vulnerability and mostly economic vulnerability. And you will find that some of the cases that come onto our desk, and these ones I’m not referring to femicide, the victims or survivors who come to our desk, they would tell us that one of the things that would push them to engage in such matters concerning cyber vulnerability is issues on economy. When you find that the economy has risen, some people are unable to cater for themselves, some people are unable to be able to address the day-to-day needs, the day-to-day financial living needs that they need. And you’ll find that most of them are usually women, most of them are young and impressionable, some are the early teens, early teenage, and the range is usually from early teenage to late 20s. That’s the potential, highest potential and highest risk age that we find that are susceptible mostly to this kind of cyber crimes. And one of the things that FIDA usually does, we take it from a two-facet perspective, we do legal and we also do to psychosocial, in that the victim and or survivor undergoes counseling, counseling that will enable to give them psychosocial support, will be able to give them strength, because one thing you should remember is when such crimes are happening, one of the things that happens is that our clients tend to lose their dignity, the women tend to lose their dignity, they tend to lose a lot of their will to live because of the kind of embarrassment that it has a push on them, and as such you’ll find that some of them suffer a lot of mental distress and mental stress, which may lead to eventual depression, so we engage in counseling and psychosocial support. The second thing that we do, legal representation, legal advice and representation, you’ll find that we watch brief in cases where they were victims, we are able to watch brief in court under the Victim Protection Act, we are able to act on their behalf so that they have a hand that is holding them aside from the prosecution of their criminal cases, they have another hand that is holding them, that is through our pro bono advocates, through us as in-house counselors as well, we are able to assist them, follow up in the matters. So, one other thing maybe that I would be able to add about one of the things that was noted greatly in terms of why there is a risk factor that is very high with women, I already cited vulnerability and economic vulnerability. Number two, you will find that the information, being informed on the risks of sharing your information online is one thing that is overlooked. Most of the time, you’ll find that even as civic education is being done, people are not being informed on what are the risks, what are the benefits. of social media, of sharing your information online, how does data protection come in to protect the data that you have shared with members of the public or you have shared with somebody who has presented themselves in a perceived manner. So you will find that conversations will be ongoing, that the DCR interpol will come to realize later that this particular person was actually being defrauded and they did not know and it is at the point of femicide when it is a bit too late that people come in to start realizing that their data that they were sharing, even instances of identity theft are becoming rampant because now their identities are being taken away without their knowledge and this becomes a risk factor that not only leaves them vulnerable to abuse or sexual abuse or gender-based violence but it leaves them in points where they are vulnerable to blackmail and this kind of blackmail is where you find they’re told if you do not do this we will release this information that you shared with us or we will release these pictures that you shared with us at a moment of vulnerability so that’s how we as FIDA come in to be able to assist them and those are some of the notable issues that we’ve been able to see over time as we represent them in court.

Katherine Getao:
Thank you very much for that very insightful contribution Dennis. Now again last but not least we turn to David from Caternet and I’d like you to focus on two things. One is the educational part which Lawrence has already talked about that many people are coming on to these platforms, not knowing what happens when you just share your information freely without a proper understanding of the consequences. The second thing I can see in the chat that people are asking about emerging technologies, particularly AI. So if you have any insight into whether it’s protecting us or whether you also have seen some new risks and issues and some new needs for education emanating from AI coming into the market and being used by ordinary people. So David, please guide us on these two issues.

David Indeje:
Thank you. Thank you, Dr. Gitau and thank you also to my panelists and to everyone who is present in this particular webinar. So my name is David Ndeje. I’m the Communications Officer for the Kenya ICT Action Network. This is KIKTANET, which is a multi-stakeholder platform for people and institutions interested in ICT policy. And largely our philosophy is that of encouraging synergies for ICT policy related activities and initiatives. And as a result, we try as much as possible to provide mechanisms and framework for continuing cooperation and collaboration in ICT matters among industry, technical community, the academia, media, development partners and government. And to be able to respond to the question that has emerged is KIKTANET, where we sit at, we realized in 2019, just after the COVID-19, we realized that there were gaps when it comes to cybersecurity. capacity building awareness, creation on cyber hygiene, and the development of cyber security courses in learning institutions as key priorities. And again, I believe in the year 2022, we called upon all stakeholders, whom I’ve just mentioned earlier, that it was necessary to develop strategies to address the emerging gaps. Because we understand in Kenya, in as much as I believe Kenya is at the forefront, we have made a lot of milestones. I can guess, not talking within the East African region, but across Africa, because we have enacted various several policies, and we also have various laws that include, top of mind, the 2022 national ICT, the Kenya National Digital Master Plan, 2022, 2023. We also have the National Cyber Security Strategy, 2022, 2027, and we also have the Kenyan Information and Communication Act, besides the Computer Misuse and Cybercrimes Act of 2018. And on the side, we can also insert the Data Protection Act. So, having realized this particular landscape that we are playing in as Kiktanet, so, we had to come back to the lowest level, to what many people here have just asked from the chat. Like, how do you first create digital literacy among the population? It is good to have devices, it’s good to have internet capability, it’s good to bring businesses, it’s good to bring organizations, and everything within the digital space, now that even the government that we are in currently, it’s embracing digital, everything is digital. But, what about the user? And that is now why we came up with… with what we call cyber hygiene. We also came up with modules around online gender-based violence, especially for the vulnerable. And in this space, we saw that largely it is women, the young, even the politicians, especially those people who are highly vulnerable to the emerging threat, emerging cyber incidents, and what did we do? We had to think of user education and awareness campus. And this has been an ongoing initiative that started with social justice organizations. We did educational awareness for small, micro, and medium enterprises, the SMEs, and we have also been able just to teach how to reach communities around the most basic, even human rights defenders. We’ve been trying to talk to them like, how do you use your mobile phone? How do you set up your passwords? How do you ensure your settings, your mobile settings are fit for the work that you do? How do you even transfer money online? How are you able to identify the simple things like fishing, how are you able to, how can you be able to mitigate simple things that can affect to you? Like the entry, what is the entry point? The entry point is your password. How is your password money? How do you get entry into your mobile phone, into your emails? That is a first. Then we go to another layer where we ask ourselves, what kind of password even do you have? Is it your name? Is it your birthday? Is it your birth month? Is it something that led to your family or not? So we try to tell them that the most simplest things that you have been doing become even some of the most vulnerable areas. that affect you when it comes to social media crimes within the ecosystem. So another thing that we’ve been trying to do is that criminals on social media actually are some of the people whom you know because of the anonymity and ease of access that attract criminals. And common crimes that have been mentioned like online harassment, scams. Dr. Ali mentioned even in my panel about romance scams. What was popularly known as femicide cases early this year in Kenya. Fake investment schemes, which are popularly known as pyramid schemes. We have so many people who have been scammed. We have identity theft. And we have even matters like hate speech that are being propagated within the social media spaces. And those are just examples on how we have been able to go to the lowest level. And another layer that we’ve been able to go to is we did a policy review around cyber hygiene. And I think even you, Dr. Ali, our moderator, you played a key role in that. Where can we begin in terms of just understanding how cyber aware are you from a user point of view, even before you go to the technical people, even before you go to the platform people? As a user, where are you? What is your awareness level? Is it at the risky level, at the moderate level, or you are 100% aware of what happens within that aspect of cyber hygiene? How cautious are you in terms of how you interact, your online interactions? How do you share your personal information? And how do you use the entry points that I mentioned? And so far… it is what software where we sit, we believe it is still work in progress and we still believe unless there is enough digital literacy among end users then the discussion around cyber crimes within the digital spaces will continue to be to be a burden for the stakeholders based on the financial aspect that are attached. And on the other question that spoke around emerging technologies, what I can say is with the emergence of artificial intelligence just as one participant or one listener just asked, it’s a good thing, it complements the work that we do. However, we also need to understand that artificial intelligence also comes with biases and it is also good from a user point of view, even from a technical point of view, to be able to understand how these biases come about. For example, we have allegory bias, these are now from the platform, the owners of the platforms, we have data bias and we also have confirmation bias which occurs during the pre-processing stages of AI development. But the big question that comes as a result of this is that, I will respond in terms of a call to action for people especially who are within the African continent, is that most people who create, who develop models for the AI models, we are the ones who are being used to do that particular work. But we have also realized that some of the content that we feed into these AI models actually are being plucked again to say that is it is not correct, a letter, an email. We believe that an email might start with DSR or Dear Mother. However, you find that some of the AI models or some models are flagging as DSR, Dear Mother, as AI-assisted kind of language, which is already biased. We believe we need to, let me not quote unquote, we need to make a lot of noise in terms of how we are also being used to feed content into these AI models. And at the same time, the same content that we are feeding, they flag when it’s being used. And this has been very evident in terms to students in learning institutions, whereby a legitimate research is being flagged as AI-assisted. And this, I think, is affecting the quality of work that is coming out from the African continent. And I don’t know for people who are outside the African continent if they are experiencing the same, but these are some of the emerging technologies here to assist us to complement. But the underlying issues that I’ve just provided an example to show that there’s still a lot of work to be done on this particular point. Back to you, Dr. Ndiaye.

Katherine Getao:
OK. Thank you very much, David, for covering my two questions and telling us some of the efforts to educate people about these new realms so that they are not as vulnerable as they are when they come in ignorance. Firstly, I’d like to welcome Lilian Alwoga, who is now with us. She’s also from the civil society realm. And we’re very, very excited to have you, Lilian. So I’m going to jump right into asking you a question. And I’m just drawing on from what David has just said. We were just looking at the issue of emerging technology and also in his submission, Lawrence from the Federation of Women Lawyers told us that some of the most vulnerable groups are women, the young, politicians. I’ll also add the elderly because I’ve had several cases of friends who are a bit older being scammed because this is a new realm for them. So just connecting those two points, now that emerging technologies enabling faking. So somebody who looks like myself can appear, looks and sounds like myself, can appear to say something or do something which they have not really done, but which then goes viral and everybody gets to see it and is associated with a person and is very difficult to deny. Have you come across this and do you have ideas of how this can be mitigated or how society can be helped to identify fake content and react to it appropriately? So Lillian, just go ahead, please.

Lillian Nawoga:
Thank you so much, Dr. Catherine and good afternoon, everyone, morning, whoever you are. Yes, apologies. I think I joined in a bit 10 minutes into the call. So I just slightly went in with a flow without making myself known that I was on call. But yes, really happy to be here and to be. part of this conversation. I listened in so well through to the past presenters and on the topic of AI and cyber crime or fake news, this is really, I think it’s the current pandemic that we are having more so in Africa. I thought, I think my introduction was made earlier on in the call. I, my name is Lilian Naroga and I work with, as a programs manager at CPSA, which is the collaboration on international ICT policy for Eastern Southern Africa. I also do, I’m a founding member of the Internet Society Uganda chapter and currently serve as an advisor there. On this particular topic, one is before I go to your correspondence to your question, doctor, is that we have seen quite a number of, you know, cyber attacks and mainly being, you know, used through AI, you know, to scam and defraud clients in businesses. I think that has been talked about. I’ll just throw some staggering because I came across some report in the course of last year, last, in the past month, there was a staggering, you know, cyber attack, you know, in the bank of, central bank of Tanzania, where there was a total of 8 billion Tanzanian shillings that was lost through, you know, cyber crowd, cyber fraud and, you know, ATM scheming. More so even here in Uganda, we’ve had issues of artificial AI generated fraud that has, you know, attacked the central bank, attacks through the central bank. So really, this is really a pandemic that we are facing with. And just like you mentioned that it is easier for someone to crown themselves, you know, right now someone can just take a screenshot of my face and go and pause that, you know, as Lillian and more so, you know, I work here and there. And then, you know, they start going on with, you know, masquerading to be me. I will also give a scenario I saw in 2020, 22 years ago, there was a case that one of the police cybercrime reports in Uganda arrested an individual who had mastered the art of using AI to pose as, you know, police, you know, taking on posts of virus, you know, police agents posing as prominent, some of the prominent, you know, individuals in Uganda. And they had started, you know, frowding, you know, stealing, you know, people, you know, data, scheming for money and all that. Good enough, these cases, you know, this person was arrested and the police was able to, you know, make this known and a call for, you know, awareness was put. But more so, back to these are cases that are coming around, our work, what I can say at CIPESA, we’ve been able to, we conduct research on topics like, you know, AI, artificial intelligence and its potential impact on either digital rights or internet freedoms, either on the general well-being, you know, of people. And mainly we’ve been able to highlight cases of AI use around election time and how this has kind of impacted or impacted negatively democratic practices in the region. And I think also that captures the aspects that David was mentioning how, you know, different actors are using AI to come in and, you know, spread fake news, the lack of awareness, you know, and what are the key stakeholders doing, you know, the unsupportive, all policy and regulatory frameworks that are non-supportive, the lack of capacity, the technical skills for the individuals who are working around these issues. I know there’s a colleague here, one of the speakers is from Interpol, but there’s a big skills gap that we’ve identified, you know, across the region that, you know, law enforcement still is not well equipped to handle certain cases when it comes to, you know, cases of AI. It may be a skills gap, but also, you know, lack of, you know, either dedicated, you know, units, the units are there, but they’re not well staffed. The policy makers, like say parliamentarians, often pass laws that kind of, you know, limit, you know, certain use of certain technology or certain use of, you know, certain use of, you know, social media in general, which is good. I’ll draw a particular case for Uganda, because this is where I’m best and I can really give quite, you know, more, you know, focused, you know, kind of contribution. You have the Computer Misuse Act, which is an act that is made to, you know, make, you know, internet or, you know, computer use generally, social media, anything internet related, be of relevance or, you know, be of, you know, good practice or for everyone. And we have seen cases where the same law in Uganda, the act itself has been used to curtail on certain rights of individuals, which at times may deter other people who are just joining the landscape to utilize social media. So there are those scenarios that I can draw to, but back to your question on the AI incidents, they are there, but what needs to be done is more awareness creation. How can we identify a deep fake? Do the citizens, the internet users, are they able to tell what is fake or not? How can we empower law enforcement to address cases of impersonation online? Social media or whichever platforms. How can we empower them to identify that? How can we give them enough resources? Because the other aspect that probably is lacking also is the issue of resources in terms of financial resources. We need to find a way of encouraging more support to law enforcement. And I think probably the gentleman from Interpol can share more cases there. There’s been collaborations with the AU, the global cybersecurity, through the AU global cybersecurity expertise forum and the likes and that. But yes, these cases are there. We’ve documented quite a number of them through our policy and research-based work, but also we need to do more engagements, awareness creation, and create resources, financial and technical, for us to be able to address that problem. So I’ll stop at that, Dr. Catherine.

Katherine Getao:
Thank you, Lillian, for a very wide ranging and even telling us about specific cases. And you can see how quickly the technology comes into Africa. I didn’t know that banks had already experienced AI generated frauds. So this is very enlightening and it really shows us that this technology moves like lightning. Now, firstly, I’d like to, now we’ve had a chance to hear from all the speakers. So please feel free to put questions into chats. There’s a very able lady called Judy Okite who’s watching the chats. Welcome, Judy. I know you’ve been there since the beginning and she will be from time to time directing us so that we can direct the discussion towards the contributions that are coming through on the chat. So please do that. Hopefully the last 10, 15 minutes, there will be a chance for a few of you to ask direct questions to our panelists, but please continue to interact on the chat so that I can try and direct the discussion towards your interests. Now, there’s something that Jovan said at the beginning where he said that content governance and protection of cables for him were what kept him awake at night. And I’d like to relate this with something that Lillian has just said about elections and the kind of things that happen around the elections. I think earlier, someone… referred to hate speech. So I’d like to go back to the regulator, Francis. And could you tell us a little bit about some of the challenges that you have around elections as people try to use the technology, especially social media, in a variety of ways? One is to influence others. And we’ve seen a lot of manipulation going on through social media, some of it personalized using big data and using technology such as AI to present compelling messages, true or false, to individuals. And we’ve also had a lot of allegations in West Africa, in Southern Africa, even here in East Africa, that people feel that election technology has been manipulated. So could you give us a little insight onto the dangers of this particular approach? And maybe if you have examples of how it has been mitigated, you can also tell us about that, Francis.

Francis Sitati:
Thank you very much, Dr. Gitao, for that question. Indeed, elections in Kenya especially tend to be a very emotive issue during the country, I mean in the country. And we see temperatures getting out of hand. And social media is actually one of the platforms that a lot of the wars are taken to. And the reason for this, I could say, is I could identify maybe three or four reasons why this could be the case. The first one, of course, is the aspect of anonymity. Because of the aspect of anonymity, you see a lot of what you call the pseudo-accounts, where people create accounts, obviously not in their real names, to try to push out different agendas and also to try to influence various trends. The aspect of anonymity obviously tends to lead to abuse. Based on the frameworks that we have at the Communications Authority, at the CAESAT, with the law enforcement agencies, we try to mitigate this through our collaborations with the DCI and also the various social media providers. Also, the aspect of coming from a regulator, obviously regulation is something that I would have to think about because of the tendency of people to think that, fine, these social media platforms are unregulated. Because of that, I can push out content, try to influence different trends without any repercussions. So, it’s one of the issues that, as the regulator, we are trying to take care of, specifically in terms of amendments to the Kenya Information and Communications Act and the attendant regulations. We’re trying to see, in terms of social media, we need to hold them to account to a certain level, either through licensing or through some other kind of registration, inasmuch as these platforms are majorly foreign-owned. But, if there are crimes being committed within our country, then these platforms need to be accounted for. to a certain extent. Also, availability of personally identifiable information, whereby you find that a lot of Kenyans are unaware, and it has been mentioned by the previous panelists, of the dangers of oversharing, if I can say, whereby your PII is out there, so it makes it easier for the cybercriminals to commit identity theft, create your digital profile and use that, perhaps with the AI technologies we have, the advent of deepfakes, to easily create a video, a deepfake video, of a certain presidential candidate or some other kind of candidate, making some allegations about some issue. So that’s a big problem, even for technical people, people who are knowledgeable in cyber security, the issue of deepfakes is an issue that really is problematic, and we’re working with various providers, social media providers, to try to address this issue in the best way possible. I think I can stop at that, with regard to that subject.

Katherine Getao:
Okay, thank you very, very much for that, Francis. And now I’ll move on to our law enforcement brothers, and this time I’ll start with Lawrence. What we’ve heard from previous panelists is that the victims of these crimes are not only individuals, we also have corporates like banks, I don’t know whether you can commit a crime against the government, but we also have governments. suffering consequences from activities that take place on social media. Now perhaps we can turn to reporting, Lawrence. Firstly, are these crimes being reported? We know there are a lot of them from the research that has been done. Are you seeing individuals, corporates, and even governments coming to you and actually reporting the crimes or not? And if not, why do you think the crimes are not being reported? And then very, very briefly, you can tell us how a crime is reported. These kinds of crimes are reported. Where do we go? And very briefly, what happens from there? If I arrive maybe at a police station and I say that I’ve been the victim of a cyber crime, what happens next? Just so that everybody gets an idea. Thank you, Lawrence. Just go on.

Lawrence Okoth:
Yeah, thank you very much once again. Yeah, on reporting, I’ll start by reporting this kind of crime. What we have observed at our unit is that some of the social media crimes or online crimes are not reported. We get a lot of underreporting when it comes to even offences against a person. So some of them are attached to maybe personality issues. Some people may feel ashamed because of the kind of crime or the kind of situation that they have found themselves in. And we’ve seen a number of… cases where someone comes up after he or she has tried to even pay the criminals so that they can stop harassing them or bullying them online. So very few people report and we have tried also to ensure that we create avenues that people use to report and we also work very closely with the tech industry whereby on social media each and every social media platform has got a mechanism of reporting. If you look at Facebook, look at Instagram or any other even app that was known as Twitter, you can report when you are being harassed or there’s something making you uncomfortable online just by going on the usually there’s a three dotted dots on the right corner of each and every post for example Facebook. If you choose on that or you click on that post you are able to report and the platform or the electronic service provider that you are on will use their internal mechanism to analyze and go through your report and preserve and even pull it down and for our cases of maybe child abuse related cases. We have partnered with an international organization besides other organizations that are working on the same space. We have the National Center for Missing and Exploited Children, whereby they receive reports from all these electronic service providers and they make the reports available for investigations to the relevant authorities. So as DCI, we connected to their database. We are able to pull those reports that are touching on the Kenyan domain and we are able to investigate. So we pull them in the form of cyber intelligence. So you find that even the victims at times, they are not aware because they have been groomed and they have been made to believe that whatever experience they are going through is normal for children. We’ve also experienced a case where you find someone using dating apps, someone who is really looking for victims or vulnerables to abuse. They are lured, they meet and they are abused. So if you find someone who is really going through that kind of harassment, at times they are not easily able to report because of the shame that is attached to it. So they try to handle these kinds of cases themselves without reporting. And when it pops up… It pops up when they are traumatized, they are not ready to even talk about it. So a lot of mechanism, other supporting service providers like the psychosocial support, the health sector are able to come in to help and try to recover these kind of victims from that experience. So we are not receiving a lot of reports, and some of them do not even know how to report. So that’s why advocacy is playing a big role. We also, at times, partner with other organizations just to ensure that we sensitize the public that if they don’t report, then internet do not forget. So it will still pop up. So it is good to come out, report, so that the relevant institutions dealing with these kind of crimes are able to assist. Because as we work very closely with the communications authority of Kenya, they are able to help cool down and also liaise with these other big tech companies to ensure that those reported files are kept as evidence to support cases where we charge perpetrators in court. And a lot of reports that we get, you realize, for children are unable to even share what they are experiencing. So we also ensure that parents are able to… keep an eye on what their children are doing online. We encourage parents to also ensure that they build close relationships, the rapport with their children so that they are the immediate confidence, the trusted adults that a child can run to and report when they are experiencing some discomfort or cyber harassment online. We also want to say so long as even in the, there are those cyber espionage that is also affecting government institutions, we, even the government can be a victim but a lot of efforts and I believe my colleague and friends will tell you that they are doing a 24-7 monitoring of being ready and prepared to respond to any cyber threats that is touching on the Kenyan space and some of them that are individual in nature are reported and they are also able to channel once they receive reports even from the members of the public, they are able to share with the investigative agencies to investigate as they also help to pull down and ensure that those attacks are controlled. Other than that, I want to say DCI has got social media platforms that people can always be sensitized. what is really going on, the emerging trends, and how people can even protect themselves. And we also participate on law reforms. We inform the encounters that we encounter when dealing with this kind of emerging crimes that are touching on social media. So with that, I want to stop at that. Thank you very much.

Katherine Getao:
Yeah, and really excellent information from the Directorate of Criminal Investigation. Lawrence, I think there’s several things you’ve said, which I didn’t know. And I think we’ll all be turning to your portals and websites to get more information. But you can see that the police is catching up. So really encouraging. Now, I know that there may be questions. And I’d really like Judy, maybe to start scanning to see who has their hand up, and to see what’s on social media so that in five or six minutes, I’ll ask so that we can at least have a few questions from the floor. But before we do that, firstly, I’ll ask Jackson, just to tell us a little bit about the international component. A lot of these crimes are transnational, meaning that the criminal is in a different country from the victim. Maybe just give us a slight insight into how they are reported and investigated. And also a slight insight into how you’re building the capacity of police forces around the world, but especially in Africa, to deal with these emerging crimes. Now, so as to make good use of time. I turn to my civil society immediately after Jackson, any of you can chip in, that is Lillian, David, or Dennis, just to tell us what you believe is the most important thing that needs to be done to ensure that citizens are able to get the best out of this technology without suffering the devastating, humiliating, I’ve heard words of depression created by the few people who are committing crimes. If you were to give one prescription, one prescription item from each of you, what would you prescribe needs to be urgently done to help the public? So I’ll start with Jackson to tell us whether these crimes which are cross borders can be caught and whether you are helping police forces to build up their capacity to deal with these crimes. Go ahead, Jackson.

Jackson Cheboi:
Thank you very much, Dr. Arie. Just to mention FASTA-S Interpol is an organization comprising of 196 member countries and each country has at least one node, that’s the NCB, National Central Bureau, which is a law enforcement entity within every country. So I have an imagination of 196 law enforcement entities nodes who try to bring any transnational crime to a stop. The approach is both proactive and reactive, and in this cyberspace, the proactive part is the participation of Interpol as a representative of law enforcement agencies globally, to influence policies, particularly by the large service providers, the globe, to have that initiative, an in-house initiative, to protect the vulnerable and bring adversaries to a stop by collaborating with Interpol and law enforcement agencies around the globe to provide evidence and to stop any form of abuse of such platforms. So the proactive voice has borne fruits because it becomes protection by default, but some will slip that net and when it happens, we bank on the local enforcement agencies, as mentioned by my colleague, Lawrence, to pick up some of those investigative issues towards arresting any situation and should there be a gap in terms of investigation, in terms of technology, in terms of human capacity, Interpol also plays a role in building that capacity in its member countries and expertise within Interpol that can be available to any member country should there be a need to progress an investigative matter. As always. Interpol is protecting people for a safer world. Thank you.

Katherine Getao:
Thank you very much, Jackson. And now I throw it to the people who care about people. Lillian, David, Dennis, you can just chip in and tell us what do we do next.

Dennis Otieno:
Thank you so much, Dr. Tari. Okay, yeah, thank you so much, Dr. Tari. So the question that we are having at hand is what is the most important thing to be done? And what would we prescribe at this particular point? One of the most important things that I would say needs to be done is just a mass civic education. If we can have a mass civic education, continuous education of members of the public, awareness of matters of artificial intelligence, matters of technology, matters of social media. If we can have continuous civic education on the same, this knowledge is what will actually help reduce the vulnerabilities that are around. So that you will find that if we even target children at the schools as well, because we are finding that children are accessing technology as early as age six, and they’re growing up with technology, they’re growing up with social media. If we can target various members of the public on what are the risk factors, what kind of things they should be able to look out for, the essence of detecting their data, the importance of also protecting their data, that kind of mass awareness, which would require a collaborative approach. even amongst civil society organizations, as well as with the government, as well as international organizations. So that when we are doing things like the community forums or Know Your Right campaigns, we are also able to incorporate some bits and pieces of how to manage digital spaces, how to manage social media and what have you. So one prescription that we would prescribe for the members of the public or for everyone in general is that let’s look at a preventive measure approach so that we are not decorating news with the fatalities of cybercrime, cyber securities or cyber security fraud, so that we are having an approach that actually helps us have preventive measures so that we reduce the number of victims from a preventive aspect rather than from reactive aspect. Thank you.

Katherine Getao:
Thank you very much, Dennis, Lillian or David, just chip in.

Lillian Nawoga:
Thanks so much, Catherine, and thanks, Dennis. Maybe just to add to what you just shared is, yes, massive awareness, but also when we say public, I think we need to be more targeted. Public can be more general. We need to go back to the traditional of doing things like mass production of awareness materials on traditional media like television, on radio. I know organizations that are working around using a similar approach, that would be the massive awareness for the public. But when we come now to much more targeted is when you look at cyber security, there are layers. And whereas… each one of us has a role to play, then we need to be more targeted. If it is law enforcement, what do we need them to understand? What kind of awareness? Is it them understanding how these cases come about, how these incidents come around? If it is the policy makers, because most of the times when we are looking at it, we are looking at the regulatory policy angle, what do the law enforcement, I mean, what do the policy makers need? If it is say civic defenders, if it is people who are working around say, creating awareness or engaging, people who are protecting the person who is at the lower ground, what particular skillset do they want? And I think this CPS has been doing this kind of work, so it’s been kicked on it and maybe also a feeder in Kenya. But also the other aspect is when we look at say, the private sector, what aspect of awareness when it comes to cybersecurity, do we need them to understand? So yes, we need to be more targeted, more purposeful, because each part of in the cybersecurity realm presents its own risk and its own issue to be tackled. So that is what I would add on to what Dennis has shared. Thank you.

Katherine Getao:
Wonderful, Lillian, thank you for the targeted approach. And David, you’re going to have the last word.

David Indeje:
Thank you, Dr. Ali and thanks to Lillian and Jackson. I have three things which I’ve just been noting. I will not belabor what my colleagues have emphasized. The entry point should be awareness of privacy rights for all users because as Jackson and the regulators were speaking about, if a parent does not know how to use the devices that they are having, then how will it be easy for the same parent to know what actions their children or child is doing on their mobile phone? So awareness of privacy rights and then every stakeholder, be it the civil society, be it government, be it the academia, whichever sector they are in, we need to reinforce that aspect of having digital literacy programs beginning at the entry level, that is learning institutions, colleges, even at our workplaces whereby we have in-built trainings to build the capacity of the people who we work with around digital literacy programs. And then the second aspect that I would recommend is that for all stakeholders, and this one is specifically for the regulators and the law enforcers, is that there is also a need to have an understanding of ensuring cyber security. Also, as we try to enforce cyber security, we also have to ensure that we are also safeguarding human rights in this aspect. And it has been a huge clarion call for KikTernet in all its work. And then lastly, when we do our mapping, every year KikTernet does an annual mapping of the cyber security needs for Kenya, and something that we have also… noticed is that there is low reporting and low enforcement or when it goes to court there is a low rate of judicial response because number one for a very long time the institutions that are also tasked with investigating and doing all these things, there are trust issues when it comes to maybe their mandate or their mandate cross cuts amongst each other. And then another thing is that internet has been calling for a hybrid kind of system rather than a closed system so that it also becomes another level of building trust among the population. It also builds trust in how cases are reported, cases are investigated, and also it builds on a case-to-case scenario on the development with the law enforcement side. But what we currently have largely from the case is that we have data around how many incidents were reported and when it comes even to the media we have only when a case escalates, maybe within the digital spaces due to civic activism from the population is when a case is normally addressed or when a case from a financial institution has a huge magnitude like what we’ve been from the two examples that we saw in Kenya this week and a few weeks back we saw a case that happened in the financial sector in Uganda is when we see it being reported but you need to have an open system. And then on another, similar to that, internet has also been a goal for cyber diplomacy aspect when it comes to cyber. How do states come up with policies or systems that are aligned to each other, so that to what our interpol colleague was speaking about, it even becomes easy for them when they are trying to do their investigations, because there is a lot of collaboration between states and some of the safeguards that are aligned, would be let’s say the East African community all the way to the African Union level. I think those four are some of the key takeaways from this particular discussion. Thank you, Dr. Ndiaye.

Katherine Getao:
Okay, thank you very much, David, for great enlightenment also. I do apologize that we have run over by about five minutes. I’ve been checking the interaction, and I don’t see any question or any hand raised, so I hope that it means that the presenters have been comprehensive. This is clearly a very broad topic, and I don’t think I need to summarize, because each presenter has been very clear. So I just want to extend my thanks to Francis, Florence, Jackson, Dennis, David, and Lillian for sharing their expertise for such clear presentation and great coverage of very important material. Please, we have a quarterly webinar from the Diplo Foundation. The next one will be in the third quarter. That is between July and September. So please look out for it, and do communicate with us what your interests are. Thank you so, so much for attending, and thank you once again to our presenters. Thank you to Arvind and Jovan. and Mwende and Judy for the work that you are doing in the background together with colleagues. Thank you very, very much and may God bless you all.