Francis Awino v Craft Silicon Limited

[1] The petitioner described himself as a human rights crusader and the president of Bunge La Mwananchi, a national social movement. He filed the Petition dated 20th June 2024 contending that he had noted overwhelming illegalities, irregularities and circumvention of the law by Craft Silicon Limited, the respondent. He explained that the respondent had been illegally awarded a tender to install a revenue collection and management system by the County Government of Homa Bay, the interested party; and that the system engendered massive loss of tax payers’ monies at the hands of the interested party. [2] The petitioner listed a number of irregular activities in the system installed by the respondent and averred, at paragraph 27 of the Petition, that the respondent failed to provide the interested party with a system that has robust accounting features to ensure accountability and integrity of the system. He asserted that there is an urgent need for the interested party to appoint different IT personnel to strengthen controls and implement audits to detect and prevent malpractices in the future. [3] The petitioner also complained that, despite numerous requests to be provided with information held by the respondent in respect of the financial records of the interested party, the respondent had declined, neglected or refused to do so, in contravention of the Access to Information Act. [4] Accordingly, the petitioner prayed for the following reliefs: 2|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 2 of 19

[a] An order that the respondent ceases or stops collecting and/or providing a system for the collection of Single Business Permit and any other revenues within the County of Homa Bay. [b] An order commanding the respondent to reimburse the interested party the cost of acquiring and installing the said revenue collection system as determined in the Valuation Report. [c] An order that the respondent herein forthwith grants access to the books of accounts and all other accounting systems in place with effect from 25 th March 2024 to 19th April 2024 or such other date as may be fixed by the Court together with all payments received by the respondent from the County Government of Homa Bay. [d] Any other or further orders of the Court as the Court may deem just and expedient in the circumstances. [5] The Petition was supported by the petitioner’s own affidavit sworn on the 20th June 2024 in which he essentially reiterated the averments set out in the Petition. [6] The respondent filed a Response to the Petition dated 14 th April 2025 and denied the allegations of illegality, irregularities, or any circumvention of the law in relation to its dealings with the interested party. It averred that it is a duly registered Kenyan software company engaged in the development and provision of technology solutions for the banking, microfinance, and electronic payment sectors. The respondent further averred that, at all 3|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 3 of 19

material times, it conducted its operations lawfully, transparently, and in accordance with all applicable laws and regulations. It put the petitioner to strict proof of the allegations made by him in his Petition. [7] The respondent further averred that it was engaged through a lawful, transparent, and competitive process in full compliance with the relevant procurement laws and regulations. It added that, at all material times, it acted within the confines of the law and was not involved in the procurement decision-making process of the interested party. In terms of implementation, the respondent deposed that the system was developed and implemented in accordance with the highest industry standards and was subjected to appropriate testing, validation, and acceptance procedures prior to deployment. It therefore asserted that any allegations of financial loss are baseless, speculative, and not attributable to it. [8] In response to paragraph 4 of the Petition, the respondent averred that it is not a public body within the meaning of the Access to Information Act, and as such, any requests for information must comply with the prescribed legal procedures and justifications. It added that it does not hold or control financial records of the interested party in the manner alleged; and that any data proprietary, or information in its possession and protected under is confidential, contractual and legal obligations. 4|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 4 of 19

[9] The respondent conceded that certain concerns of misuse were brought to its attention by the interested party; and that it conducted forensic investigation into the Revenue Collection and Management System (RCMS), culminating in a report dated 4 th May 2024. It further stated that the findings of that report confirmed that certain County Government users, including a pseudo account named “System Admin,” engaged in unauthorized transaction corrections. However, it categorically denied any role in the creation, authorization, or facilitation of those transactions. The respondent denied any collaboration or fraudulent activity involving itself or its personnel. It asserted that it provided system architecture and audit reports that confirmed the County Government's own internal users conducted these transactions using access privileges they had been assigned internally. [10] In response to paragraph 20 of the Petition, the respondent conceded that the insight extracted was obtained directly from the system’s secure server logs. In its view, this demonstrates the robustness and reliability of the RCMS in maintaining and preserving transactional data, which enabled the forensic team to trace and report misuse accurately. It averred that the effectiveness of the system was evident in the investigation, which successfully relied on Device ID data to trace system access and activity. It therefore contended that the allegations in paragraphs 22 to 27 of the 5|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 5 of 19

Petition, are unfounded, misleading, and mischaracterize the capabilities and performance of the RCMS. [11] In conclusion, the respondent acknowledged the serious implications of the findings made in their investigation report and the need for urgent corrective measures. It added that it is dedicated to restoring integrity and accountability within the system through immediate action, including the deactivation of unauthorized accounts, and the implementation of enhanced security protocols. It therefore prayed for the dismissal of the Petition with costs. [12] The Petition was canvassed by way of written submissions, pursuant to the directions given herein on 24th March 2025. The petitioner relied on his written submissions dated 5 th May 2025. He proposed for determination the following issues: [a] Whether the respondent as the developer and technical support provider of the Revenue Collection and Management System bears the legal or constitutional responsibility for the creation, use, and abuse of the pseudo “System Admin” account and the resulting financial irregularities. [b] Whether the respondent’s actions or omissions in the design, deployment, access control and post-deployment support of the RCMS violated the principles of transparency, accountability and prudent use of public resources under Articles 10, 201 and 232 of the Constitution. [c] Whether the respondent, by denying access to system data and audit information, violated the right to access to 6|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 6 of 19

information under Article 35 of the Constitution and the Access to Information Act, 2016. [d] Whether the forensic audit report prepared by the respondent establishes facts that justify a finding of shared responsibility between the respondents and the officers of the County Government of Homa Bay. [e] Whether the petitioner has demonstrated sufficient constitutional and factual grounds to warrant the grant of the reliefs sought. [13] In respect of the first issue, the petitioner submitted that, since the respondent designed and developed the RCMS, it bears the responsibility for the irregularities that ensued. He submitted that the respondent owed a duty of care to the interested party to ensure the security, reliability and integrity of the system. The petitioner argued that the responsibility is akin to the duty of care outlined in Donoghue v Stevenson [1932] AC 562. He also relied on Nairobi City Council v Thabiti Enterprises [2015] eKLR and National Bank of Kenya Ltd v KCB [1998] eKLR in which the court emphasized the duty of service providers to ensure proper control of access and accountability in systems they manage, particularly where the systems involve the collection of public funds. [14] On whether the respondent’s actions or omissions in the design, deployment, access control and post-deployment support of the RCMS violated the principles of transparency, accountability and prudent use of public resources under Articles 10, 201 and 7|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 7 of 19

232 of the Constitution, the petitioner submitted that public resources must be used efficiently, effectively and for the benefit of the public. He reiterated the provisions of Articles 10, 201 and 232 of the Constitution and urged the Court to find that the respondent’s failure to ensure the security of the RCMS renders it accountable. [15] The petitioner also submitted on his right to information as enshrined in Article 35 of the Constitution. He submitted that the right to access information is not limited to public bodies, but extends to contractors engaged by public institutions to undertake public projects. He also relied on Section 6 of the Access to Information Act, and the cases of Trusted Society for Human Rights Alliance v Attorney General [2011] eKLR and Republic v Public Procurement Administrative Review Board & 3 others [2013] eKLR in urging the Court to find that failure by the respondent to supply him with the information he asked for amounts to a violation of his right under Article 35 of the Constitution. [16] On whether the respondent is equally liable as the officers of the interested party implicated in the respondent’s audit report, the petitioner submitted that, while the forensic audit points to officers of the County Government for misusing the system access, it remains responsible for the weaknesses in the system’s design and controls. He reiterated his assertion that the ultimate responsibility lies with both the government and its contractors to ensure operational integrity. He relied on Kenyatta v Kenya 8|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 8 of 19

Revenue Authority [2014] eKLR and Minister for State for Provincial Administration and Internal Security & another v The Law Society of Kenya [2010] eKLR to underscore his assertion that the respondent bears shared responsibility for failing to implement sufficient safeguards, training or oversight during and after deployment. Hence, the petitioner submitted that it had established solid grounds, both constitutional and factual, to support the reliefs sought. [17] The respondent relied on its written submissions dated 13 th June 2025. It reiterated the assertions made in its Response to the Petition and stated that its role in the provision of a revenue collection system for the interested party, was limited to the development, deployment, and initial support of the Revenue Collection and Management System (RCMS). The respondent contended that, once deployed, matters to do with system administration and user management were entirely under the control of the interested party. [18] In response to the petitioner’s submission that it owed a duty of care to the interested party akin to the duty of care discussed in Donoghue v Stevenson (supra), the respondent submitted that the petitioner needed to go further and demonstrate the three elements necesssary for establishing the duty of care. It relied on the case of Caparo Industries v Dickman [1990] UKHL to buttress its submission that the petitioner needed to prove: 9|Page HCCHRPET NO. E005 OF 2024 JUDGMENT

page 9 of 19

[a] foreseeability of harm, [b] proximity, and [c] the fairness of imposing liability. [19] On foreseeability, the respondent submitted that the RCMS was designed to prevent external intrusion and not misuse from internal users who were entrusted with system control as was revealed by its forensic audit. According to the respondent, there was no reasonable basis to foresee that County officials would themselves misuse their access privileges deliberately. [20] On proximity, the respondent submitted that there was no direct operational link between the respondent and the loss. It reiterated that the actions were taken by County officers using credentials they assigned to themselves, and the respondent had no ongoing administrative role or visibility into internal staff conduct post-handover. [21] On reasonableness, the respondent relied on Blyth v Birmingham Waterworks Co. [1856], Yewens v Noakes [1880] 6 QBD 530 as followed in Everret Aviation Ltd v Kenya Revenue Authority [2013] eKLR and Sendy Ltd v Commissioner of Domestic Taxes (Appeal E167 of 2023) [2024] KETAT 617 (KLR),in support of its submission that it is not reasonable to expect a system developer to account for deliberate misuse by administrative users who were assigned secure credentials by the system owner. Accordingly, the respondent submitted that no actionable duty of care existed in the circumstances of this Petition. 10 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 10 of 19

[22] Further to the foregoing, the respondent submitted, on the authority of National Bank of Kenya Ltd v Pipeplastic Samkolit (K) Ltd & another [2001] KECA 362 (KLR), that contracting parties are bound by the terms of their agreement, and where a party has fulfilled its contractual obligations, it cannot be held responsible for losses caused by the actions of third parties thereafter. [23] On the right of access to information, the respondent submitted that there is no constitutional or statutory basis for holding it liable since Article 35 of the Constitution does not impose obligations on private entities. It relied on the case of Nelson Havi v Law Society of Kenya Petition No. 355 of 2015, for the proposition that the right to information is not absolute. Additionally, the respondent submitted that Article 24 of the Constitution and Section 6(1)(d)(e) of the Access to Information Act, protect confidential, commercial data, including system architecture, code, and internal records, where this is justified by legitimate commercial or public interests, such as privacy and protection of proprietary technology. [24] The respondent conceded that Articles 10, 201, and 232 of the Constitution of Kenya are central to Kenya’s governance framework; and that they place obligations on public entities and those performing public functions to uphold integrity, transparency, accountability, and efficient use of resources. It however contended that the extent to which these duties bind private contractors depends on the nature of their engagement 11 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 11 of 19

and the level of control they retain over public functions. In this instance, the respondent submitted that: [a] The RCMS was delivered and tested in consultation with the Interested Party; [b] The system was built with full audit trail capability, detailed transaction logs, and Device ID tracking to ensure traceability of all user activities; [c] When concerns were raised by the interested party, it conducted a forensic audit and prepared a report dated 4th May 2024 at no additional cost, identifying the misuse and naming the individuals involved; and [d] It did not conceal or delete any data and instead provided comprehensive reports that enabled the County Government of Homa Bay to hold internal users accountable. [25] Hence, the respondent submitted that, far from failing to uphold transparency, it facilitated it through a technically sound system and a candid audit process. It further stated that the RCMS functioned as intended and was built with security safeguards, including layered user access controls and audit logging; and reiterated its stance that the misuse of Super Admin privileges was an internal governance failure by the interested party, whose ICT team had exclusive control of all system administration functions post-deployment. It therefore denied the allegations of shared responsibility as alleged by the petitioner and contended that: 12 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 12 of 19

[a] It supplied user manuals and provided training during the onboarding and acceptance testing phase of the system. [b] The RCMS featured device tracking, access logs, reconciliation tools, and account-based access permissions. [c] Its oversight was limited to technical support on request and not administrative governance or user conduct. [26] In the light of their submissions as above, the respondent urged the Court to find that the petitioner has failed to demonstrate sufficient constitutional and factual grounds to warrant the grant of the reliefs sought. It further submitted that the Petition does not meet the threshold for constitutional petitions as was enunciated in the case of Anarita Karimi Njeru v Republic [1979] 1 KLR 154 and therefore should be dismissed with costs. [27] I have given careful consideration to the Petition, the Supporting Affidavit and the documents annexed thereto as well as the Response filed by the respondent. I have similarly considered the submissions made herein by the parties. The starting point is the technical issue raised as to whether the Petition was pleaded with the requisite degree of specificity for purposes of the principle laid down in the case of Anarita Karimi Njeru v Republic (supra) in which it was held that: “…if a person is seeking redress from the High Court on a matter which involves a reference to the Constitution, it is important (if only to ensure that justice is done to his case) that he should set out with a reasonable degree of precision that of which he complains, the provisions said to be infringed, and the manner in which they are alleged to be infringed.” 13 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 13 of 19

[28] The principle was reiterated by the Court of Appeal in the case of Mumo Matemu v Trusted Society of Human Rights Alliance & 5 others [2013] eKLR as follows: “…the principle in Anarita Karimi Njeru (supra) underscores the importance of defining the dispute to be decided by the court. In our view, it is a misconception to claim as it has been in recent times with increased frequency that compliance with rules of procedure is antithetical to Article 159 of the Constitution and the overriding objective principle under section 1A and 1B of the Civil Procedure Act (Cap 21) and section 3A and 3B of the Appellate Jurisdiction Act (Cap 9). Procedure is also a handmaiden of just determination of cases. Cases cannot be dealt with justly unless the parties and the court know the issues in controversy. Pleadings assist in that regard and are a tenet of substantive justice, as they give fair notice to the other party. The principle in Anarita Karimi Njeru (supra) that established the rule that requires reasonable precision in framing of issues in constitutional petitions is an extension of this principle. What Jessel, M.R said in 1876 in the case of Thorp v Holdsworth (1876) 3 Ch. D. 637 at 639 holds true today: “The whole object of pleadings is to bring the parties to an issue, and the meaning of the rules…was to prevent the issue being enlarged, which would prevent either party from knowing when the cause came on for trial, what the real point to be discussed and decided was. In fact, the whole meaning of the system is to narrow the parties to define issues, and thereby diminish expense and delay, especially as regards the amount of testimony required on either side at the hearing.” [29] And, in Communications Commission of Kenya & 5 others v Royal Media Services Limited & 5 others [2014] eKLR, the Supreme Court restated the position as follows: “[34]…Although Article 22(1) of the Constitution gives every person the right to initiate proceedings claiming that a fundamental right or freedom has been denied, violated or infringed or threatened, a party invoking this Article has to show the rights said to be infringed, as well as the basis of his or her grievance. This principle emerges clearly from the High Court decision in Anarita Karimi Njeru v. Republic, (1979) KLR 154: the necessity of a link between the aggrieved party, the provisions of the Constitution alleged to have been contravened, and the manifestation of contravention or infringement. Such a principle plays a positive role, as a foundation of conviction and good faith, in engaging the constitutional process of dispute settlement…” 14 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 14 of 19

[30] Therefore, it is now trite that a person who alleges a violation of any constitutional right or freedom must plead such alleged violation with a reasonable degree of specificity. A look at the Petition dated 20th June 2024 shows that the petitioner not only set out the provisions of the Constitution alleged to have been violated by the respondent, but also supplied background information and the allegations of violation. The Petition has sufficient details and I am therefore satisfied that it was drawn with sufficient specificity for purposes of Anarita Karimi Njeru v Republic (supra). [31] The parties are in agreement that the respondent was contracted by the interested party to develop and install a Revenue Collection and Management System (RCMS); and that the respondent proceeded to design the system in accordance with the agreed specifications. It is also not in dispute that the system was deployed following successful testing and handover. [32] It is common ground that in the course of time, misuse was detected by the interested party and the concerns brought to the attention of the respondent. As a result, the respondent conducted a forensic audit and ascertained that the misuse was not as a result of system failure or weakness, but was deliberately orchestrated by the very persons entrusted with access credentials within the ranks of the employees of the interested party. [33] In the light of the foregoing, the petitioner addressed the Court at length on the duty of care, citing such cases as 15 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 15 of 19

Donoghue v Stevenson (supra) among others. In the same vein, the respondent pitched arguments that largely related to its contractual relationship with the interested party and the limits thereof. Hence, the petitioner is on record as seeking the following main reliefs: [a] An order that the respondent ceases or stops collecting and/or providing a system for the collection of Single Business Permit and any other revenues within the County of Homa Bay. [b] An order commanding the respondent to reimburse the interested party the cost of acquiring and installing the said revenue collection system as determined in the Valuation Report. [34] The question to pose in the circumstances is whether this is a dispute that could have been resolved by way of an ordinary civil suit. This question arises because it is now trite that the Court will not determine, as a constitutional issue, a matter that may be determined on another basis. In the case of K K B v S C M & 5 others (Constitutional Petition 014 of 2020) [2022] KEHC 289 (KLR) (22 April 2022) (Ruling), Hon. Mativo, J. (as he then was) expressed himself on the doctrine of constitutional avoidance as hereunder: “In summation, the doctrines of ripeness and constitutional avoidance shun to deal with a constitutional issue where there exists another legal course which can give the litigant the relief he seeks. In other words, a constitutional issue is not ripe for determination until the determination of the constitutional issue is the only course that can give the litigant the remedy he seeks. Both constitutional avoidance and ripeness avert the determination of the constitutional issues until it becomes very necessary 16 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 16 of 19

to the extent that it is the only course available to assist the litigant’s cause…” [35] Similarly, in the case of Faraj & 3 others v Police & 2 others (Constitutional Petition 165 of 2020) [2022] KEHC 287 (KLR) (27 April 2022) (Judgment) the court held: “27. The doctrine of avoidance is primarily viewed by courts from the position that although a court could take up a matter and hear it, it would still decline to do so if there is another mechanism through which the dispute could be resolved. In that regard, the Supreme Court stated in Communication Commission of Kenya & 5 Others v Royal Media Services Ltd & 5 others (at para 256) that the principle of avoidance means that a Court will not determine a constitutional issue when a matter may properly be decided on another basis.” … 29.The doctrine of ripeness and constitutional avoidance gives credence to the concept that the Constitution does not operate in a vacuum or isolation. It has to be interpreted and applied in conjunction with applicable legislation together with other available legal remedies. Where there are alternative remedies the preferred route is to apply such remedies before resorting to the Constitution. The possibility of the elevation of any dispute to a constitutional issue is what is sought to be averted by the doctrines of ripeness and constitutional avoidance. It is borne out of a realisation that all legislative or common-law remedies are part of the legal system…” [36] The Supreme Court also had occasion to express itself on the doctrine in Petition 14, 14A, 14B & 14C of 2014 (Consolidated) Communications Commission of Kenya & 5 others v Royal Media Services Limited & 5 others [2014] eKLR (29th September 2014) (Judgment). It held that: “[256] …The principle of avoidance entails that a Court will not determine a constitutional issue, when a matter may properly be decided on another basis. In South Africa, in S v. Mhlungu, 1995 (3) SA 867 (CC) the Constitutional Court Kentridge AJ, articulated the principle of avoidance in his minority Judgment as follows [at paragraph 59]: “I would lay it down as a general principle that where it is possible to decide any case, civil or criminal, without reaching a constitutional issue, that is the course which should be followed.” [257] Similarly the U.S.Supreme Court has held that it would not decide a constitutional question which was properly before it, if there was also some other basis upon which the case could have been disposed of (Ashwander v. Tennessee Valley Authority, 297 U.S. 288, 347 (1936)). 17 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 17 of 19

[37] As for the right of access to information, Article 35 of the Constitution states: (1) Every citizen has the right of access to— (a) information held by the State; and (b) information held by another person and required for the exercise or protection of any right or fundamental freedom. (2) Every person has the right to the correction or deletion of untrue or misleading information that affects the person. (3) The State shall publish and publicise any important information affecting the nation. [38] Under Section 4 of the Access to Information Act, every person has the right to access information unless such a right has been limited under Section 6 of the Act. Section 4 provides: (1) Subject to this Act and any other written law, every citizen has the right of access to information held by— (a)the State; and (b)another person and where that information is required for the exercise or protection of any right or fundamental freedom. (2) Subject to this Act, every citizen's right to access information is not affected by— (a) any reason the person gives for seeking access; or (b) the public entity's belief as to what are the person's reasons for seeking access. (3) Access to information held by a public entity or a private body shall be provided expeditiously at a reasonable cost. (4) This Act shall be interpreted and applied on the basis of a duty to disclose and non-disclosure shall be permitted only in circumstances exempted under section 6. (5) Nothing in this Act shall limit the requirement imposed under this Act or any other written law on a public entity or a private body to disclose information. [39] The use of the conjunctive “and” in Section 4(1)(b) above presupposes that a party approached the Court under that subsection must prove that the information is held by the person sued and that it is required for the exercise or protection of any right or fundamental freedom. In this instance, there was no demonstration by the petitioner that the information sought from the respondent, which is a private body, is required for the 18 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 18 of 19

exercise or protection of any right or fundamental freedom; such that information ought not to be sought for the sake of it. [40] In the premises, it is my finding that the Petition was totally unwarranted and therefore is incompetent on account of the doctrine of avoidance. The same is hereby struck out with no order as to costs. It is so ordered. DATED, SIGNED AND DELIVERED VIRTUALLY THIS 29TH DAY OF MAY 2026 ………………………….………. HON. OLGA SEWE JUDGE 19 | P a g e HCCHRPET NO. E005 OF 2024 JUDGMENT

page 19 of 19