By KCSFA Working Group on Regulations, Policy and Cyber Diplomacy (WGRP_CD)
It’s now almost two years since we last held our general elections. It was by far the most technical & litigious vote ever held in our country to date. As accredited observers in the Repeat Presidential Elections and citizens of this great Republic, we believe that we have a duty to keep the conversation going on our experiences as far as elections and technology use is concerned both within and without our nation.
A great deal about the past elections can be learnt from the Presidential Election petitions of 2017, pre-election rulings and proceedings before PPARB (Public Procurement Administrative Review Board). We aver that there was most likely a little more sanity in these proceedings away from the politicking that characterized majority of the discourse at that time. We cannot afford to repeat the mistakes of the past or the mistakes of our neighbors. The human cost is too much; one life hurt or lost is too high a price.
REVIEW OF LITIGATION RELATED TO TECHNOLOGY-USE AND THE KENYAN ELECTIONS
Following the post-election violence after the disputed election result of 2008, among the significant recommendations the Kriegler Commission made related to the use of technology in the electoral process. It recommended that:
“… without delay [the Electoral Commission of Kenya]ECK starts … [developing] an integrated and secure tallying and data transmission system, which would allow computerized data entry and tallying at constituencies, secure simultaneous transmission (of individual polling station level data) to the national tallying center, and the integration of this results-handling system in a progressive election result announcement system.”
Moreover, in 2016 the Joint Parliamentary Select Committee on elections and the IEBC was formed. It discussed the use of technology in elections and made recommendations which led to amendments to the Elections Act which provided for use of technology and also technology dedicated regulations, the Elections (Technology) Regulations 2017.
Section 44(1) of the Elections Act pronounces the establishment of what is to be known as the Kenya Integrated Electoral Management System(KIEMS) by stating, “Subject to this section, there is established an integrated electronic electoral system that enables biometric voter registration, electronic voter identification and electronic transmission of results.”
PROCUREMENT RELATED REVIEWS
In the run up to the 2017 election, quite a number of petitions were presented before court and the Public Procurement Administrative Review Board (PPARB) regarding a variety of issues on the election process; from the tendering process, to the validity and pronouncement of results at the polling station level among others. These two main bodies played a major role in the dispute resolution during this period.
With the election then less than one year away, it may have been perceived that the number of petitions and reviews were quite high and it was plausible to infer that should this contestation continue to drag on, delivery and implementation timelines would not be met.
Some of the complaints to the PPARB as to the Kenya Integrated Electoral Management System (KIEMS) procurement can be traced back to 29th December 2016 when the tendering process for the KIEMS was halted 2 weeks after the tender notice was issued by the IEBC. The back and forth at the PPARB between the electoral commission and other parties among them companies dissatisfied with the tendering process would continue until the 9th of March 2017. On the 22nd of March, the IEBC cancelled the 3.8b tender and opted for direct procurement. The tender was then awarded to Safran Identity and Security. Safran had in the year 2013 through a government to government procurement also supplied the BVR (Biometric Voter Registration) kits.
It should be noted that election petitions are civil proceedings albeit ‘more serious civil cases’ therefore the burden of proof is substantially lower than that in criminal proceedings but higher than that in civil cases. It is therefore necessary to note that even though the burden of proof lies with the petitioner, the standard of proof is that between a balance of probabilities and beyond reasonable doubt.
Presidential Petition 1 of 2017 brought to the fore the issue of technology and its role in elections in a way never seen before in the country. Both the public and legal teams had to contend with an issue that appeared foreign to them; from the alleged server logs released by one of the country’s political formations to the ICT report prepared for the court by designated ICT officers. Among the information sought from the IEBC can be found in the application for scrutiny and audit of the system and technology used by the IEBC ruling dated 28th August 2017. This ruling can be found here.As per the ruling, the electoral commission failed to grant access to two critical areas of their servers and their logs, which would have proved or disproved the petitioners’ claim of hacking, and its servers that contained Forms 34A and 34B. The full list of items not disclosed to the petitioners and the court can be found in paragraph 278 of the majority decision found here.
The judges also rejected the explanation on failure of technology in the transmission of the presidential results and argued that this failure was, in their view, “…a clear violation of the law. (Elections Act).” The Elections Act was amended to add Section 39(1C) which provided for simultaneous electronic transmission of results from the polling stations to the Constituency Tallying Centre (CTC) and the National Tallying Centre (NTC) immediately after the counting process at the polling station.
IEBC’s disobedience of the court’s order left the majority judges with no option but to accept the 1st Petitioner’s (Mr. Raila Odinga) claims that either the commission’s IT system was infiltrated or compromised and data doctored or IEBC’s officials themselves either accidentally or intentionally interfered with the data.
In paragraph 284 of the majority decision, the judges stated, “We have already addressed the importance of the refusal to obey a Court Order and we further note that the whole exercise of limited access to the 1st respondent‘s IT system was meant to conform and verify both the efficiency of the technology and also verify the authenticity of the transmissions allegedly made to the CTC and NTC. Non-compliance and failure, refusal or denial by IEBC to do as ordered, must be held against it.”
There was also the assertion made by the Electoral commission justifying why scanned Forms 34A were not submitted from a number of polling stations across the country. The commission contended that some of these regions were not covered by 3G and 4G networks. The majority ruling disagreed with this assertion and stated, “Failure to access or catch 3G and/or 4G network, in our humble view, is not a failure of technology. Surely IEBC‘s ICT officials must have known that there are some areas where network is weak or totally lacking and should have made provision for alternative transmission. It cannot have dawned on IEBC‘s ICT officials, two days to the elections, that it could not access network in some areas.”
The Elections (Technology) Regulations in Part VIII amongst other requirements, required the IEBC to engage the various network service providers and publish network coverage across the country at least 45 days before the elections. A number of areas were mentioned as lacking in 3G and 4G coverage. It was determined that despite this, some of the areas mentioned had good infrastructure and the movement by presiding officers to areas with better coverage was not an impossibility.
Moreover, the Constitution of Kenya, 2010: Article 86 states that “any system of voting has to reflect simplicity, accuracy, verifiability, security, accountability and transparency.” Based on these highlighted issues, the August 8th presidential election was annulled.
DEMOCRATIC REPUBLIC OF CONGO
The December 2018 Election in the DRC would see the country adopt technology use for the first time. The technology however has been castigated as insecure and highly vulnerable despite the push by the DRC electoral body CENI( Commission Electorale Nationale Indépendante ) disapproving the claims. However a strong case has been made by technical experts about its vulnerabilities. Without a technical report from CENI and no rebuttals on the allegations, questions still remain. Among the issues raised is the security of the machines USB and SD card ports which it was alleged were not secured to prevent unauthorized access. The machines were also alleged to use the outdated Android 5.0.2 which hasn’t been patched yet.
In addition to the firm supplying the voting machines to the DRC losing its bid to supply the Argentinians with similar voting machines due to an Argentinian senate vote that pushed for a continued use of manual voting in national elections, the reliability of their technology has been questioned widely. Though there are definitely changes effected in their batch to the DRC especially on the use of RFID technology that was discredited in Argentina and the adoption of QR codes instead, trust in the whole system is still at a low. A number of countries with electronic systems that have well documented vulnerabilities have managed to conduct peaceful elections in part due to the level of trust citizens have in their institutions, something lacking in the DRC.
Unfortunately, the socio-political environment has led to an erosion of trust in the system; the disputed results of the general elections, the barring of some cities from voting until March 2019(due to Ebola, armed conflict), internet disruptions across the country, the blockage of Radio France Internationale’s(RFI) signal among others. It is highly likely that faith in the electoral system won’t get restored anytime soon among the people of the DRC unless the systemic issues are adequately addressed.
And so does Kenya. If we should fail to address our past failures, we are bound to repeat them. Irrespective of how good our technology may be, the entire electoral lifecycle must be and must be seen to be fair and impartial. It is time for all institutions to whom Kenyans have delegated their sovereign power to act and be seen to act.