<html>
<head>
<style><!--
.hmmessage P
{
margin:0px;
padding:0px
}
body.hmmessage
{
font-size: 12pt;
font-family:Calibri
}
--></style></head>
<body class='hmmessage'><div dir='ltr'><pre style="line-height: 21px; white-space: normal; color: rgb(68, 68, 68); font-size: 15px;"><span style="color: black; font-size: 12pt; line-height: normal; font-family: Calibri, sans-serif;">Dear Suresh</span></pre><pre style="line-height: 21px; white-space: normal; color: rgb(68, 68, 68); font-size: 15px;"><span style="color: black; font-size: 12pt; line-height: normal; font-family: Calibri, sans-serif;">The points you raise are very useful and I will put them in our
reporting matrix. </span></pre><pre style="line-height: 21px; white-space: normal; color: rgb(68, 68, 68); font-size: 15px;">
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;">Further, I copy a message here on the difference between the
Budapest and AU Convention as outlined by one SM. It was a response to Jean
Paul but it never came onto the list. </span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="font-size:12.0pt;mso-ascii-font-family:Calibri;mso-fareast-font-family:
"Times New Roman";mso-hansi-font-family:Calibri;mso-bidi-font-family:"Times New Roman";
color:black"> </span></p><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;">Lets keep this debate live. </span></p>
<p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;"><br></span></p><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;">Rgds</span></p><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;">Grace</span></p><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;"><br></span></p><p class="MsoNormal" style="margin-bottom:0in;margin-bottom:.0001pt;line-height:
normal"><span style="color: black; font-size: 12pt; font-family: Calibri, sans-serif;"><br></span></p>
<p class="MsoNormal" style="line-height: 16.5pt; background-position: initial initial; background-repeat: initial initial;">From: SM<span class="unsafesenderemail"><span style="font-size: 10.5pt; font-family: 'Segoe UI', sans-serif; background-position: initial initial; background-repeat: initial initial;"> (<a href="mailto:sm@resistor.net">sm@resistor.net</a>)<o:p></o:p></span></span></p>
<p class="MsoNormal" style="line-height: 16.5pt; background-position: initial initial; background-repeat: initial initial;"><span style="font-size: 9pt; font-family: 'Segoe UI', sans-serif; color: rgb(102, 102, 102); background-position: initial initial; background-repeat: initial initial;">To: Jean Paul NKURUNZIZA, Grace Githaiga</span><o:p></o:p></p>
<p class="MsoNormal" style="margin-bottom: 0.0001pt; line-height: 12.75pt; background-position: initial initial; background-repeat: initial initial;"><span style="font-size:9.0pt;font-family:"Segoe UI","sans-serif";
mso-fareast-font-family:"Times New Roman";color:#666666">Cc:
internetgovtech@iab.org<o:p></o:p></span></p>
<p class="MsoNormal" style="line-height: 16.5pt; background-position: initial initial; background-repeat: initial initial;"><span style="color:black"> </span></p></pre><pre style="line-height: 21px; white-space: normal; color: rgb(68, 68, 68); font-size: 15px;">Hi Jean Paul,<br>At 21:54 24-11-2013, Jean Paul NKURUNZIZA wrote:<br>>Thank you Grace for sharing those updates about the African Union <br>>Convention on Cyber Security(AUCC)<br>>Just last week ( 21 and 22 November 2013) , the National <br>>Telecommunication Regulatory Authority of Burundi ( I am burundian <br>>based in Burundi) has conducted a sensitisation workshop about the <br>>issue of cybersecurity.<br><br>The (European) Convention on Cybercrime is different from the <br>(African Union) draft convention on the confidence and security in <br>cyberspace. The former is somewhat about computer-related offences, <br>content-related offences and offences related to infringements of <br>copyright and related rights. As a quick note, it seems that the <br>draft convention tries to cover consumer protection, intellectual <br>property rights, personal data and information systems. It is a bit <br>odd to mix all that with legislation to tackle activities which are <br>legislated as criminal activities.<br><br>The differences between the convention and this draft convention are <br>that the latter:<br><br>- tries to solve the spam problem<br><br>- includes electronic transaction<br><br>- includes a legal framework for personal data protection<br><br>The scope of the draft convention is broad. The draft convention <br>does not have any text about lawful interception. That can be used <br>to address the problems the draft convention attempts to solve. The <br>drawback is that it might entail less personal data protection.<br><br>Regards,<br>-sm </pre><br><div><hr id="stopSpelling">To: ggithaiga@hotmail.com; governance@lists.igcaucus.org<br>From: suresh@hserus.net<br>Date: Mon, 25 Nov 2013 06:58:01 +0530<br>Subject: Re: [governance] Kenya/Uganda online debate on the African Union Convention on Cyber Security(AUCC)<br><br>
<div style="font-size:12pt;font-family:Calibri,sans-serif;"><div>Hi Grace </div><div><br></div><div>About I8 to I10 as I have worked extensively on spam at a technical and policy level since the late 90s </div><div><br></div><div>I8 : This is a convention and not an international law. It provides a criterion that nations in the American will commit to harmonize their current (or more likely proposed, in large parts of Africa) to be uniform on this and other provisions. In this case, it advocates transparency in direct marketing offers which is a best practice </div><div><br></div><div>I9 : this is an optin law, which is respectful of user privacy and doesn't allow the sending of unsolicited bulk email, which is the canonical definition of spam. This should not restrict itself to marketing but cover other sorts of bulk mail sent by other organizations or individuals. The law should be content neutral and cover all forms of unsolicited bulk email rather than just marketing mail. </div><div><br></div><div>I10 : this is a standard prior business relationship exception to make compliance simpler </div><div><br></div><div>The articles also need to additionally cover criminal forms of spam as the 419 scam, phishing etc. </div><div><br></div><div>They additionally need to specify penalties both for the organization that commissioned the spam and the marketing agency they contracted with to actually send the spam. </div><div><br></div><div>Specific language that would be appropriate is in the Australian spam act of 2003 and in the proposed Canadian antispam law, both of which were drafted after open, consultative and multistakeholder processes in the respective countries, including inputs from respected privacy groups. </div><div><br></div><div>Before that, data protection and net anonymity have to be carefully balanced to log data but retain it under strict controls and regulation of how it can be used (in accordance with privacy regulations). If you legislate blanket anonymity then scam artists and cybercriminals will extensively abuse it to remain undetected. </div><div><br></div><div>These are a first set of thoughts </div><div><br></div><div>--srs (htc one x) </div><br><div id="ecxhtc_header">----- Reply message -----<br>From: "Grace Githaiga" <ggithaiga@hotmail.com><br>To: "governance@lists.igcaucus.org" <governance@lists.igcaucus.org>, "bestbits@lists.bestbits.net" <bestbits@lists.bestbits.net><br>Subject: [governance] Kenya/Uganda online debate on the African Union Convention on Cyber Security(AUCC)<br>Date: Mon, Nov 25, 2013 3:30 AM</div></div><br><pre style="word-wrap:break-word;white-space:pre-wrap;">IGC and Bestbits Listers
I write to you to seek your views on the African Union Convention on Cyber Security(AUCC)<a href="http://pages.au.int/sites/default/files/AU%20Cybersecurity%20Convention%20ENGLISH_0.pdf" target="_blank">http://pages.au.int/sites/default/files/AU%20Cybersecurity%20Convention%20ENGLISH_0.pdf</a>
KICTANet has been in discussion with AUC and the drafters have accepted to receive our input despite having gone through this process two years ago with African governments. The Convention will be signed in January 2014.
In light of this, Kenya and Uganda stakeholders will conduct an online debate on multiple lists of KICTANet and
ISOC-KE, and on I-Network list moderated by the Collaboration on International ICT
Policy in East and Southern Africa (CIPESA)
and ISOC -Uganda, starting Today Monday 25th to Friday 29th November 2013. Please feel free to send us your contribution. RgdsGrace
Below is the announcement made on the multiple lists.
1. Background to the African Union
Convention on Cyber Security (AUCC)
African Union (AU) convention (52 page document) seeks to
intensify the fight against cybercrime across Africa in light of increase in
cybercrime, and a lack of mastery of security risks by African countries.
Further, that one challenge for African countries is lack of technological
security adequate enough to prevent and effectively control technological
and informational risks. As such “African States are in dire need of innovative
criminal policy strategies that embody States, societal and technical responses
to create a credible legal climate for cyber security”.
The Convention establishes a framework for cybersecurity in
Africa “through organisation of electronic transactions, protection of personal
data, promotion of cyber security, e-governance and combating cybercrime”
(Conceptual framework).
2. Division of the Convention
Part 1
Electronic transactions
Section I:
Definition
of terms
Section II:
Electronic
Commerce (Fields of application of electronic commerce, Contractual
responsibility of the electronic provider of goods and services).
Section III:
Publicity by electronic
means.
Section IV:
Obligations in electronic form
(Electronic contracts, Written matter in electronic form, Ensuring the security
of electronic transactions).
Part II PERSONAL DATA PROTECTION
Section I:
Definition
Section II:
Legal framework
for personal data protection (Objectives of this Convention with respect to
personal data, Scope of application of the Convention, Preliminary formalities
for personal data processing).
Section III:
Institutional framework
for protection of personal data (Status, composition or organization, Functions
of the protection authority).
Section IV:
Obligations relating to the
conditions governing the processing of personal data (basic principles
governing the processing of personal data, Specific principles governing the
processing of sensitive data, Interconnection of
personal data files).
Section V:
The rights of the
person whose personal data are to be processed (Right to information, Right of
access, Right of opposition, Right of correction or suppression).
Section VI:
Obligations of the personal
data processing official (Confidentiality obligations, Security obligations,
Conservation obligations, Sustainability obligations).
PART III – PROMOTING CYBERSECURITY AND COMBATING CYBERCRIME
Section 1:
Terminology,
National cyber security framework, Legislative measures, National cyber
security system, National cyber security monitoring structures).
Section II:
Material penal law
(Offenses specific to Information and Communication Technologies [Attack on,
computerized data, Content related offenses], Adapting certain information and
communication technologies offenses).
Section II:
Criminal liability
for corporate persons (Adapting certain sanctions to the Information and
Communication Technologies, Other penal sanctions, Procedural law, Offenses specific to
Information and Communication Technologies).
PART IV: COMMON AND FINAL PROVISIONS
Section I:
Monitoring
mechanism
Section II:
Final responses
The Proposed Discussion
We have picked on articles that need clarity, and would
request listers to kindly discuss them and provide recommendations where
necessary. Also, where
necessary, listers are encouraged to identify and share other articles that
need clarifications that we may have left out.
Day 1 Monday 25/ 11/2013
We begin with Part 1 on Electronic transactions and pick on
four articles which we will discuss on Monday (25/11) and Tuesday (26/11).
Section III: Publicity by electronic means
Article I – 7:
Without prejudice to Article I-4 any advertising
action, irrespective of its form, accessible through online communication service,
shall be clearly identified as such. It shall clearly identify the individual
or corporate body on behalf of whom it is undertaken.
Question: Should net
anonymity be legislated? If
so, what measures need to be or not be considered?
Question: Should
individuals or companies be obliged to reveal their identities and what are the
implications?
Article I – 8:
The conditions governing the possibility of promotional
offers as well as the conditions for participating in promotional
competitions or games where such offers, competitions or games are
electronically disseminated, shall be clearly spelt out and easily accessible.
Question: Should an international (or should we
call it regional) law legislate on promotional offers and competitions
offered locally?
Day 2 Tuesday 26/11/13
Article I – 9:
Direct marketing through any form of
indirect communication including messages forwarded with automatic message
sender, facsimile or electronic mails in whatsoever form, using the particulars
of an individual who has not given prior consent to receiving the said direct
marketing through the means indicated, shall be prohibited by the member states
of the African Union.
Article I – 10:
The provisions of Article I – 9 above
notwithstanding, direct marketing prospection by electronic mails shall be
permissible where:
1) The particulars of the addressee have been obtained
directly from him/her,
2) The recipient has given consent to be contacted by the
prospector partners
3) The direct prospection concerns similar products or
services provided by the same individual or corporate body.
Question: Is this a realistic way of dealing with spam?
Article I – 27
Where the legislative provisions of Member States have not
laid down other provisions, and where there is no valid agreement between the
parties, the judge shall resolve proof related conflicts by determining by all
possible means the most plausible claim regardless of the message base
employed.
Question: What is the
meaning of this article and is it necessary? Some
clarity needed!
Day 3 Wednesday 27 /11/13
Today, we move onto PART II: PERSONAL DATA PROTECTION and
will deal with three questions.
Objectives of this Convention with respect to personal data
Article II – 2:
Each Member State of the African Union shall put in place a
legal framework with a view to establishing a mechanism to combat breaches of
private life likely to arise from the gathering, processing, transmission,
storage and use of personal data.
The mechanism so established shall ensure that any data
processing, in whatsoever form, respects the freedoms and fundamental rights of
physical persons while recognizing the prerogatives of the State, the rights of
local communities and the target for which the businesses were established.
Question: What is the
relevance of this article? What
are these state prerogatives? And given the increased interest of state surveillance,
how can states balance respect of FOE while recognising state prerogatives?
Article II-6, II-7, 11-8, II-11, II-12, II-13 refer to a Protection
Authority which is meant to establish standards for data protection.
Article II – 14 provides
for each Member State of the African Union to establish an authority with
responsibility to protect personal data. It shall be an independent administrative
authority with the task of ensuring that the processing of personal data is
conducted in accordance with domestic legislations.
In article II-17 states that ‘Sworn agents may be invited to
participate in audit missions in accordance with extant provisions in Member
States of the African Union’.
Question: Considering
that this article seems to be tied to the Protection Authority, what is its
relevance? And who is a ‘sworn agent?’ What
should this authority look like in terms of its composition?
Article II – 20:
…Members of the protection authority shall not receive
instructions from any authority in the exercise of their functions.
Article II – 21:
Member States are engaged to provide the national
protection authority human, technical and financial resources necessary to
accomplish their mission.
Question: It appears that this Data Protection Authority is envisaged
to be fully government supported. Therefore, should we be talking of its
independence? In what way should this article be framed so that it ensures
independence of the Authority?
Article II – 28 to II-34 outlines
six principles governing the processing of personal data namely:
Consent and of legitimacy,
Honesty,
Objective, relevance and conservation of processed personal
data,
Accuracy,
Transparency and
Confidentiality and security of personal data.
Under each of the specific principles, detailed explanation
of how each should be undertaken is offered.
Question: Is this
explanation and detailing of how to undertake each necessary in an international (regional) law
necessary or needed? Is this
legislation overkill?
Day 4 Thursdsay 28/11/2013
Part III
Day 4 will focus on PROMOTING CYBERSECURITY AND COMBATING
CYBERCRIME
Article III – 14: Harmonization
1) Member States have to undertake necessary measures to
ensure that the legislative measures and / or regulations adopted to fight
against cybercrime enhance the possibility of regional harmonization of these
measures and respect the principle of double criminality.
Question: What is the
principle of double criminality here?
Section II: Other penal sanctions
Article III – 48
Each Member State of the African Union have to take
necessary legislative measures to ensure that, in the case of conviction for an
offense committed by means of digital communication facility, the competent
jurisdiction or the judge handling the case gives a ruling imposing additional
punishment.
Question: What is the interpretation of additional punishment?
Is this not granting of absolute powers to judges?
Day Five 29/11/2013
This will be dedicated to any other issue(s)that listers
may want to raise in regard to the Convention. Further, listers can go back to
issues of any other day and discuss them here.
Are there other articles that you would like to share that
need clarification?
What other issue(s) would you like to raise?
References
DRAFT AFRICAN UNION CONVENTION ON THE CONFIDENCE AND
SECURITY IN CYBERSPACE<a href="http://pages.au.int/sites/default/files/AU%20Cybersecurity%20Convention%20ENGLISH_0.pdf" target="_blank">http://pages.au.int/sites/default/files/AU%20Cybersecurity%20Convention%20ENGLISH_0.pdf</a>
<a href="http://daucc.wordpress.com/" target="_blank">http://daucc.wordpress.com/</a>
<a href="http://www.thepetitionsite.com/takeaction/262/148/817/" target="_blank">http://www.thepetitionsite.com/takeaction/262/148/817/</a>
<a href="http://daucc.wordpress.com/2013/10/29/paper-review-basic-drawbacks-of-the-draft-african-union-convention-on-the-confidence-and-security-in-cyberspace/" target="_blank">http://daucc.wordpress.com/2013/10/29/paper-review-basic-drawbacks-of-the-draft-african-union-convention-on-the-confidence-and-security-in-cyberspace/</a>
<a href="http://michaelmurungi.blogspot.com/2012/08/comments-on-draft-african-union.html" target="_blank">http://michaelmurungi.blogspot.com/2012/08/comments-on-draft-african-union.html</a>
</pre></div> </div></body>
</html>