Hatupangwingwi: The story how Kenyans fought back against intrusive digital identity systems

Hatupangwingwi: The story how Kenyans fought back against intrusive digital identity systems

Speakers: Mustafa Mahmoud Yousif

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=u9r_tGEXt9s

Overview

Mustafa Mahmoud Yousif's talk, "Hatupangwingwi: The story how Kenyans fought back against intrusive digital identity systems," delivered at 39C3, chronicles a decade-long struggle by Kenyan civil society and communities against successive government attempts to implement centralized digital identity systems. The presentation details the evolution from a colonial-era identity card (kipande) to the controversial Huduma Number and its successor, Maisha Namba, highlighting the profound implications of digital identity on human rights, privacy, and social inclusion.

Yousif, a member of Kenya's Nubian minority, frames the discussion within the historical context of identity as a tool of oppression and exclusion, particularly for marginalized communities. The talk serves as a powerful testament to the efficacy of public-centered litigation, community mobilization, and strategic civil society engagement in challenging governmental overreach in the digital domain. It underscores the critical importance of robust legal frameworks, data protection, and genuine public participation in the design and implementation of national digital infrastructure.

This article delves into the historical roots, technical specifics, legal battles, and community-led resistance that shaped Kenya's journey with digital identity. It provides essential insights for anyone concerned with the intersection of technology, governance, human rights, and the enduring legacy of colonialism in the context of rapidly advancing digital public infrastructure initiatives across the globe.

Background

▶ Watch: Introduction: Identity, national security, and minority discrimination (0:00)

The concept of identity in Kenya is deeply intertwined with its colonial past. The foundation of Kenya's identity laws dates back to the Registration of Persons Act of 1947, enacted during British colonial rule. This legislation mandated the infamous kipande, a metal-backed paper document that black Kenyans were required to carry at all times, detailing their identity, residence, and even movement restrictions. This historical context established identity documents not as a right, but as a mechanism for control and surveillance, a legacy that continues to shape public perception and government approaches to identity management.

Following Kenya's independence, the system evolved, but fundamental issues of discrimination persisted. The 1998 US embassy bombing in Nairobi marked a turning point, leading to increased profiling of communities based on religion and name, making the process of obtaining identity documents significantly more arduous and often discriminatory. Minority and "trans-border" communities, such as the Nubians, have historically faced rigorous vetting processes, sometimes deemed illegal, to prove their Kenyan citizenship, tribe, and even residency. These systemic injustices resulted in digitalization of exclusion, where one in five Kenyans struggled with discriminatory procedures and burdensome documentation, often at the discretion of officials.

In 2019, driven by the belief that data was the "new oil" and a desire to participate in the "fourth industrial revolution," the Kenyan government initiated a shift towards a national digital identity system. This system, officially named the National Integrated Identity Management System (NIMS) but popularly known as the Huduma Number, aimed to centralize all citizen data into a single register. This move came despite years of advocacy by digital rights movements for a comprehensive Data Protection Act, which had stalled for five years due to a lack of political interest. The government introduced Huduma Number through an omnibus bill, a legislative maneuver that amended several laws, notably expanding the definition of biometrics to include GPS data and DNA data, and legalizing the digitalization of identity data without adequate public debate or safeguards. This initiative was presented as a solution to issues like corruption and multiple identity registrations, but civil society quickly identified it as a potential tool for further exclusion and state surveillance.

Key Findings

▶ Watch: Post-1998 profiling and ID denial for marginalized communities (4:00)

The implementation of the Huduma Number revealed several critical flaws and raised significant human rights concerns, leading to its eventual legal challenge and halting.

Firstly, the system was designed for data maximization, contradicting best practices of data minimalization. The registration form collected an exorbitant amount of personal data, far beyond what was necessary for identification. This included details about spouses (names, ID numbers), land ownership (size, use), number of animals, level of education, and income. Most controversously, the government sought to collect GPS data and DNA data, which civil society groups strongly opposed, fearing their use for profiling and state surveillance. The form also contained a disclaimer stating that collected information, including biometrics, could be provided to "authorized government agencies or agencies," implicitly allowing broad data sharing, including with corporates.

Secondly, the Huduma Number system risked digitalizing exclusion. It required a pre-existing document for registration, effectively disenfranchising stateless communities or those who already struggled to obtain traditional IDs. Furthermore, an inherent bias in the system's algorithm was discovered during litigation: it was easier to register children under mothers than fathers, leading to the default assignment of children born to Kenyan fathers and refugee mothers as "aliens." This design flaw risked creating a new generation of stateless individuals, particularly affecting Muslim refugee children.

Thirdly, the government employed coercion tactics, threatening citizens that failure to register within six months would jeopardize their nationality. This approach sparked widespread public resistance, epitomized by the "Hatupangwingwi" slogan, which translates to "you can't tell us what to do" or "we cannot be arranged." This public outcry, combined with strategic legal action, highlighted the government's disregard for voluntary participation and the fundamental right to nationality. The court later ruled that registration could not be compulsory and that nationality could not be revoked based on digital ID enrollment.

Finally, the civil society's strategic use of public-centered litigation proved instrumental. Rather than traditional public interest litigation, the approach involved communities directly in the legal process, with paralegals briefing them at every stage. This grassroots engagement, coupled with extensive media campaigns (including on platforms like TikTok) and leveraging internal government divisions, built significant public pressure. A key victory was the passage of the Data Protection Act, which had been stalled for years, in response to the legal challenge. The courts subsequently declared the Huduma Number system illegal for failing to conduct a Data Protection Impact Assessment (DPIA) prior to its rollout, a mandatory requirement under the new Act. This ruling effectively halted the system and underscored the necessity of robust legal and ethical frameworks for digital identity initiatives.

Technical Deep Dive

▶ Watch: Systemic injustices: "Vetting" and tribal discrimination for Kenyans (5:00)

The technical architecture and data collection mechanisms proposed for Kenya's digital identity systems, particularly NIMS/Huduma Number, were central to the controversies and legal challenges.

The initial government initiative, the National Integrated Identity Management System (NIMS), aimed to create a single source of truth for citizen identity. This was to be achieved by integrating data from various existing registers, including civil registration (births, deaths, marriages), the National Registration Bureau (NRB) for ID registration, immigration records (passports), and alien registration (refugees). These disparate databases were to be channeled into one consolidated Integrated Population Register. While an already digitalized Integrated Population Register existed and facilitated corporate EKYC (Electronic Know Your Customer) processes, the government argued for a mass re-registration to address perceived issues like multiple registrations and document fraud.

The Huduma Number was introduced through an omnibus bill that sought to amend several existing laws. Crucially, this bill expanded the definition of biometrics to include GPS data and DNA data, a significant point of contention due to the privacy implications. The legal framework was also criticized for its inadequacy, as the amended laws primarily regulated the registration of adults over 18, yet the system was intended to register children as well.

The Huduma Number registration process itself was an exercise in data maximization. The physical registration form was designed to collect an extensive array of personal information, far beyond basic identification. This included:

• ID Number: A prerequisite for registration, paradoxically excluding those without existing documents.
• Spousal Information: Up to five spouses, requiring their names and ID numbers, raising questions about relevance to individual identity.
• Economic Data: Land size and use, number of animals owned, level of education, and income level.
• Biometrics: Beyond fingerprints and facial scans, the proposed collection of GPS coordinates and DNA data was particularly alarming.

The government's justification for collecting this extensive data was framed around national security and improving service delivery, but civil society argued it was primarily for profiling and data mining, potentially for commercial use by corporates. A disclaimer on the form explicitly stated that information, including biometrics, "may be provided to an authorized government agency or agencies," indicating a broad sharing policy that could include the transport authority or other entities that pay for government data.

The legal challenge against Huduma Number highlighted the lack of a Data Protection Act and the failure to conduct a Data Protection Impact Assessment (DPIA). A DPIA is a systematic process for identifying, assessing, and mitigating privacy risks of data processing operations. Its absence meant the government proceeded without understanding or addressing the potential harms, including algorithmic biases. For instance, the system's bias in registering children under mothers rather than fathers led to children of Kenyan fathers and refugee mothers being automatically classified as aliens, increasing their risk of statelessness.

After the Huduma Number was halted, the subsequent government introduced the Maisha Namba system. While presented as a new approach, the underlying legal framework anchoring Maisha Namba was largely the same as that of Huduma Number, raising concerns about its legal robustness. Maisha Namba proposed a five-tier system:

1. Unique Personal Identifier (UPI) at birth: Intended to be a lifelong number.
2. Maisha Number at 18: The functional digital ID for adults.
3. Maisha Number at death.
4. Digital ID: A digital representation on a system.
5. Maisha Integrated Population Register: The central database.

A significant, and problematic, feature of Maisha Namba is the automatic assignment of a tax number at birth or at age 18. This means citizens would be liable for tax obligations or filing returns by default, potentially incurring penalties without their knowledge or active enrollment.

Crucially, the fate of the vast amount of data collected under Huduma Number remains unclear. While the Huduma Number card is no longer functional, the data is still held by the same government, and the Huduma Number secretariat continues to operate. This raises questions about potential future processing or integration of this sensitive, previously collected information. The Maisha Namba system, while claiming to move away from prerequisite documents for registration and having clearer custodianship (Civil Registration and NRB), still faces challenges regarding its legal anchor for registering children and the potential for continued data maximization.

The speaker also critically noted the influence of international bodies and funders like the World Bank and the Melinda Gates Foundation who advocate for Digital Public Infrastructure (DPI), promoting digitalization as a panacea for corruption and exclusion. However, the Kenyan experience exposed significant practical challenges, such as the digital divide (30% of the country lacking electricity, limited 4G/3G penetration) and low digital literacy among government staff and the general population. A pilot of Maisha Namba in the capital achieved only a 40% success rate, highlighting the risks of "copy-pasting" digital solutions from countries like Estonia without considering local contexts.

Demo / Proof of Concept

▶ Watch: Huduma number introduced via omnibus bill, expanding biometrics (8:00)

This talk did not feature a technical demonstration or a proof of concept in the traditional sense of showcasing a tool or exploit. Instead, Mustafa Mahmoud Yousif's presentation served as a powerful narrative of community resistance, strategic litigation, and public mobilization against intrusive digital identity systems in Kenya. The "proof of concept" was the successful halting of the Huduma Number through legal and social pressure, demonstrating that organized civil society and an engaged populace can effectively challenge governmental digital overreach.

Defensive Implications

▶ Watch: Consolidation of diverse identity registers into one system (9:00)

The Kenyan experience with Huduma Number and Maisha Namba offers crucial lessons for defenders, policymakers, and civil society worldwide regarding the design and implementation of digital identity systems.

Firstly, prioritize comprehensive legal frameworks and Data Protection Impact Assessments (DPIAs). The successful legal challenge against Huduma Number was largely due to the absence of a Data Protection Act and the government's failure to conduct a DPIA. Defenders must advocate for robust data protection laws that are not merely "copy-pasted" but adapted to local contexts, and ensure that DPIAs are mandatory and thoroughly executed before any system rollout. These assessments should identify potential biases, exclusion risks, and privacy threats.

Secondly, resist data maximization and centralization. The Huduma Number's attempt to collect excessive and irrelevant personal data (spouses, land, animals, income, GPS, DNA) is a red flag. Governments should adhere to principles of data minimalization, collecting only the data strictly necessary for the stated purpose. Centralized databases are attractive targets for breaches and facilitate state surveillance; alternative decentralized or federated identity models should be explored.

Thirdly, address historical and systemic injustices before digitalization. The Kenyan case vividly illustrates how digitalizing a flawed, discriminatory analog system can perpetuate and even amplify exclusion. Digital identity initiatives must be preceded by comprehensive legal reviews to address statelessness, discriminatory vetting processes, and other historical barriers to identity for marginalized communities. The goal should be inclusion, not the digitalization of exclusion.

Fourthly, empower civil society and foster public-centered litigation. The "Hatupangwingwi" movement's success stemmed from community mobilization, public education campaigns (including innovative use of social media like TikTok), and strategic legal action where affected communities were at the forefront. Defenders should invest in legal aid, paralegal networks, and media engagement to build broad-based resistance against problematic digital ID schemes.

Fifthly, be wary of external pressures and "copy-paste" solutions. International organizations and philanthropic foundations (e.g., World Bank, Gates Foundation) often push for Digital Public Infrastructure (DPI), but these models may not be suitable for all contexts. Countries like Kenya, with significant digital divides and low digital literacy among both citizens and government staff, face unique challenges. Solutions must be context-specific and developed with genuine local input, not simply imported from technologically advanced nations like Estonia.

Finally, monitor the fate of previously collected data. Even after a problematic system is halted, the data collected under it may persist within government systems. Defenders must advocate for the secure expungement or clear, legally defined limitations on the use of such data, as seen with the unresolved status of Huduma Number data.

Key Takeaways

• Community-Led Resistance is Powerful: The "Hatupangwingwi" movement demonstrated that public-centered litigation and widespread community mobilization, even utilizing platforms like TikTok, can successfully challenge and halt intrusive government digital identity schemes.
• Comprehensive Legal Frameworks are Essential: The lack of a robust Data Protection Act and the failure to conduct a Data Protection Impact Assessment (DPIA) were critical vulnerabilities that led to the Huduma Number's legal downfall. Strong data protection laws must precede digital ID rollouts.
• Data Minimization, Not Maximization: Governments should adhere to principles of data minimalization, collecting only essential information. The Huduma Number's attempt to gather excessive data (spouses, land, income, GPS, DNA) was a major privacy concern and a design flaw.
• Digitalization Must Not Exclude: Requiring pre-existing documents and algorithmic biases can perpetuate historical injustices, leading to the "digitalization of exclusion" for stateless and marginalized communities. Digital ID systems must be designed for universal inclusion.
• Beware of External Influence and Context-Blind Solutions: International funders and "copy-pasting" models from other countries without considering local digital divides, literacy levels, and unique historical contexts can lead to significant implementation failures and social harm.
• Colonial Legacy Persists: Kenya's experience highlights how historical identity systems, rooted in colonial control and surveillance, can influence and complicate modern digital identity initiatives, making public trust and acceptance challenging.

About the Speaker(s)

Mustafa Mahmoud Yousif is a dedicated civil society advocate and a member of Kenya's Nubian minority community. He has been actively involved in the struggle against intrusive digital identity systems in Kenya for over 13 years, working tirelessly to champion human rights, data protection, and social inclusion. His work, often conducted through organizations like Namati, focuses on empowering marginalized communities and leveraging public-centered litigation to challenge governmental overreach. Yousif's deep understanding of the historical context of identity in Kenya, coupled with his commitment to community engagement, has made him a leading voice in the digital rights movement in Africa.