THE RECEIPTS

When I started writing “IT’S A TRAP“, the Data Sharing Agreement had not yet been disclosed. I analysed The Framework in isolation, and reported the issues I found. These included jurisdictional limits in relying solely on the laws of Kenya, ethical issues around training AI models on sovereign data, the potential of permanent data retention, and the lack of enforcement clauses in The Framework. I hoped that the data-sharing terms would include some protections to alleviate my fears.

Well, the Data Sharing Agreement, signed the same day as The Framework on December 4, 2025, has been released. This essay examines what both documents say when examined together. Here are the receipts.

1. EXTRACTION AT AN INDUSTRIAL SCALE

My first essay documented The Framework’s comprehensive surveillance architecture. The Data Sharing Agreement reveals that the scope extends even further than we suspected.

1.1. THE EXTRACTION WINDOW

The Framework speaks of building systems from 2026 through 2030, with Kenya taking operational control in 2030. This five-year timeline appeared consistently throughout The Framework’s provisions.

However, Article 2(b) of the Data Sharing Agreement specifies that: "The Government of Kenya shall provide the U.S. Government relevant data derived from health programs under the Covered Data Systems and this shall remain in effect for a duration of seven years with effect from the signing of this agreement." Seven years. Not five. Article 5(a) confirms that: "This Agreement shall enter into force on the date of signature by both Parties and shall remain in force for seven years as per Article 2(b) of this Agreement." This means two additional years of comprehensive surveillance.

1.2. THE MOTHER LODE

In both the Cooperation Framework and the Data Sharing Agreement, the US will have access to the following:

• clinical data: every diagnosis, every prescription, every treatment outcome, and every clinical decision point across all patient encounters from 8,000 facilities at 90% digitisation;
• laboratory data: all test results integrated with clinical records under Framework 2.5.8.8, including pathogen sequences specified in Framework 2.6.2.1.3.2, and a national biobanking system for sample storage per Framework 2.6.2.1.2.4;
• commodity data: supply chain tracking referenced in Framework 2.5.8.14, with AI-powered forecasting per Framework 2.5.8.15; and
• healthcare worker data and their performance metrics as outlined in Framework 2.4.
  Every layer of the Kenyan health system, integrated, analysed, archived, and flowing through US platforms. For seven years.

1.3. PERSONALLY IDENTIFIABLE INFORMATION

Article 2(a) of the Data Sharing Agreement states: "To the maximum extent practical, Kenya shall not provide individual level data or personally identifiable information (PII) to the U.S. Government." Interesting. So, who determines what is practical? The Data Sharing Agreement provides no definition of what “practical” means. There is no independent oversight to adjudicate disputes about what is practical, no process for Kenya to object when the US claims personally identifiable information is necessary, and no threshold beyond which personally identifiable information is categorically never shared. In both documents, there is simply no enforceable barrier to PII collection.

1.3. RESTRICTIONS

Article 3(a) contains this restriction: "The U.S. Government shall use the data provided under this Agreement solely for purposes consistent with metrics or activities referenced in Paragraphs 1, 2, 4 and 5 of the Cooperation Framework." The word “solely” appears restrictive. However, the restriction is only as limiting as the referenced paragraphs allow. So, what do these paragraphs actually allow?

Paragraphs 1, 2, 4, and 5 of the Framework span twenty-one pages of provisions. Paragraph 1.1 establishes the deal’s objective: to "eliminate HIV, malaria, TB and other emerging infectious diseases, strengthen the Kenyan health system so that it can become more self-reliant,and promote U.S. interests abroad." Interesting. U.S. interests abroad are not limited to disease elimination and strengthening foreign governments. They encompass the entire architecture of American technological, military, and economic hegemony in the twenty-first century. It is no accident that the phrase “promote U.S. interests abroad“, which is unlimited in scope, has been inserted.

Paragraph 2.5.8.8 authorises comprehensive laboratory integration: a "laboratory information management system...which can integrate with the health facility HMIS, process samples, integrate with test analysers, store samples, and release results." This potentially permits test result integration with patient data, and the creation of complete diagnostic profiles.

Paragraph 2.5.8.3 commits Kenya to "support innovative digital health infrastructure...including...data banks, creation of data lake for advanced analytics, and AI-functionalities for surveillance and clinical care.” This explicitly authorises the processing of Kenyan health data for clinical applications, population surveillance, advanced analytics, and the training of AI models which may be used in US healthcare systems.

Consider how Article 3(a) operates in practice. Kenya discovers that the US is training commercial AI models using Kenyan data. The US responds that is permitted under Paragraph 2.5.8.3, which authorises AI-functionalities. Kenya objects that the US is filing patents without benefit-sharing. The US response: developing pharmaceutical innovations promotes U.S. interests per Paragraph 1.1. When permitted purposes encompass everything, restrictions restrict nothing.

1.4 SMOKE AND MIRRORS OF DATA DELETION

Without access to the Data Sharing Agreement, I warned that once biological data is shared, it cannot be un-shared. I warned that walking away from The Framework would not delete sequences from databases in Boston or extract genetic data from trained AI models.

The Data Sharing Agreement confirms my fears. Article 3(a) states that data provided "shall be archived, stored, or disposed of in accordance with applicable laws and regulations of the Republic of Kenya and U.S. federal records requirements." We must read that clause carefully. It does not say data provided “shall be deleted after the Agreement ends.” It does not say data provided “shall be disposed of.” The clause simply presents three options: archived, stored, or disposed of. Options from which the US may choose at their discretion. Disposal is optional, not mandatory.

More critically, the clause requires compliance with both Kenya’s Data Protection Act and "U.S. federal records requirements." Under 44 U.S.C. § 3303a, US federal records with continuing value, including scientific and research value, must be preserved unless the Archivist determines otherwise. Kenyan health data has substantial research value. There’s no question about it. This is precisely the kind of data that US federal law mandates preserving.

Consider the contradiction. Kenya’s Data Protection Act demands deletion when purpose is fulfilled. US federal records law mandates retention for scientific value. Article 3(a) requires compliance with both. What resolution mechanism exists when these requirements conflict? None. The Data Sharing Agreement provides no legal mechanism to resolve this contradiction.

2. WHAT’S IN IT FOR US?

2.1 BENEFIT-SHARING

The Data Sharing Agreement’s Article 3(f) reveals a troubling benefit-sharing architecture: "All benefits obtained based on insights derived from data provided shall require entering into other subsidiary agreements." The language is conditional and in future tense. Kenya provides data immediately, beginning in 2026 and continuing through 2032. But compensation comes later, maybe, possibly, because benefits “shall require” negotiating “other subsidiary agreements.“

Worse still, there’s no timeline for negotiation, no baseline benefit-sharing formula, no minimum royalty requirements. If the US simply never allows Kenya to gain from the data they provided, there are no consequences. There is no binding arbitration for disputes over benefit-sharing, and no default terms if negotiations fail.

As signed, The Agreement is a promissory note with no maturity date, no legal obligation, and no enforcement mechanism. By 2037, when Kenya discovers a US patent derived from Kenyan pathogens, Article 3(f) provides the only remedy: “let Kenya schedule diplomatic discussions about possibly negotiating a subsidiary agreement with the US that the US are not required to negotiate“.

2.2. LEGAL PROTECTIONS

My first essay described the Havasupai precedent: samples provided in 1990, misuse discovered in 2003, lawsuit settled for $700,000 in 2010, but academic papers, articles, dissertations and data were still circulating in 2025. I feared Kenya would face similar woes, but my fears were greatly underestimated. The Data Sharing Agreement confirms that my fears were restrained.

When Kenya discovers violations such as unauthorised patents, patient data in AI models, and commercial products derived from Kenyan data, what remedy does the Agreement provide? Article 5(h) answers: "The Parties shall resolve any differences between them arising from or in connection with the interpretation or performance of this Agreement solely through consultations and negotiations through diplomatic channels." That word “solely” does considerable work. The remedy is consultations. Period. If consultations fail, too bad. Article 5(g) compounds the problem: "This Agreement does not constitute an international agreement and the legal obligations under this Agreement do not arise under international law." Translation: no invoking international law, no international tribunals, no binding treaty obligations.

Let us see how this might unfold. It is 2037. Kenya discovers that a pharmaceutical company in Boston has patented a drug derived from a pathogen sequence that originated in Kenya. The patent was filed in 2030, three years into the data-sharing period. Kenya files a complaint under Article 5(h). The US response: let us schedule diplomatic consultations. Consultations occur. The US position: the research complied with Framework purposes as outlined in Paragraph 1.1, which authorises activities that “promote U.S. interests abroad.” Kenya’s position: but we received no benefits per Article 3(f). US response: you never formally requested subsidiary agreement negotiations. The patent remains US property. Consultations continue indefinitely. The drug keeps selling. Kenya gets nothing.

In fact, the Data Sharing Agreement confirms that Kenya faces a demonstrably worse situation than the Havasupai. The Havasupai provided samples only in 1990. Kenya will provide health data for seven years straight. The Havasupai could sue in US domestic courts which had jurisdiction, even though it took six years to settle. Kenya can only resort to diplomatic consultations with which have no timeline, no enforcement mechanisms, and no judicial recourse. In the Havasupai’s case, the violation was clear: unauthorised research. Kenya’s situation is murky, because Framework Paragraph 1.1 authorises nearly anything that “promotes U.S. interests.”

2.3 YOU’LL OWN NOTHING AND BE HAPPY

The Data Sharing Agreement mentions in Article 3(d) that: "The U.S. Government acknowledges that the Government of Kenya retains sole ownership of the data and all intellectual property rights in Covered Data Systems. No license or conveyance of any such rights in the data is granted or implied under this Agreement."

So, let us get this straight. Under Article 3(d), Kenya owns the original clinical records. Article 3(a) also permits the US to archive these records indefinitely. Interesting. Under Article 3(d), Kenya also owns intellectual property rights “in Covered Data Systems”. But what about intellectual property rights in the data stored within those systems?

Consider this. Kenyan patient data flows into data lakes, as authorised by Framework Paragraph 2.5.8.3. These data lakes feed AI model training. These models are then deployed in US healthcare systems, generating ongoing commercial value. Kenya owns the original patient records, but the US owns the trained AI models. Why? Article 3(d) covers only the original clinical records in the Covered Data Systems. Nothing else.

The same applies to research findings. Scientific discoveries and publications derived from the data constitute separate intellectual properties. Drug compounds identified using the data can be patented separately. Diagnostic methods developed from the data become separate patents. Kenya owns the data inputs. The US owns the knowledge outputs.

So, translating these clauses directly, the US is saying this: “Kenya, you own the data that we will be using. We are not claiming ownership. We may retain it indefinitely, train AI models with it, derive patents from it, and generate commercial products from it, but you own the data. All we have is have access, access without the obligations that ownership might entail. Deal?” And Ruto’s government responds, “Deal!”

2.4 YOUR RISK, MY REWARD

This vulnerability emerged only as I examined The Framework alongside the Data Sharing Agreement.
Paragraph 6.1.2 of The Framework commits Kenya to increasing domestic health expenditures during the deal: ten billion Kenyan shillings in 2026, fifty billion by 2029. These are substantial numbers for a country already facing fiscal constraints. Paragraph 6.1.1 specifies that: "In the event that the Government of Kenya does not fulfill the co-investment commitments...within the specified calendar year, the U.S. Government may within a period of nine months give notice to reduce or cease providing funding."

Basically, if Kenya fails to meet co-investment targets, the US can withdraw Framework funding. Meanwhile, the Data Sharing Agreement remains active. Article 2(b) establishes a seven-year term that continues independent of Framework funding. There is no reciprocal right allowing Kenya to suspend data sharing if the US withdraws funding. There’s no grace period giving Kenya time to restore co-investment before penalties apply, no force majeure clause exempting Kenya from penalties during economic crises beyond its control.

Consider this. It is March 2027. The world is going through another economic recession. Ruto’s nimetenga economics has exacerbated the issues. Government revenue collapses. Kenya achieves only twelve billion shillings in health expenditure increases, sixty percent of the twenty billion target. August 2027: Ruto fails to secure reelection for a second term. September 2027: a new government is in office. December 2027: The US invokes Framework 6.1.1 anyway. May 2028: the US ceases commodity funding under Framework 2.3.3. July 2028: a massive health crisis has been triggered: antiretroviral stock outs, health worker layoffs, system disruptions.

Amidst the turmoil, Framework 2.5.8 systems are still collecting ninety percent of clinical encounters. Data still flows to the US. Article 2 of the Data Sharing Agreement still requires Kenya to provide data despite funding withdrawal. This asymmetric obligation is the core of the con. US funding is conditional on Kenya’s co-investment. Kenya’s data provision is unconditional regardless of funding levels. The US can walk away from their financial obligations while retaining and receiving years of Kenyan data. Kenya cannot walk away without risking health system collapse. Kenya bears all economic risk, the US bears none.

3. HOW TO SPOT A GOOD DEAL

In my essay, I outlined what Kenya should have demanded in The Framework. The Data Sharing Agreement confirms that almost all recommendations I had outlined were vital, as they are missing from the document. Reading both documents together, here are my recommendations.

The Data Sharing Agreement should have included a mandatory deletion clause reading: “Within ninety days of this Agreement’s expiration, the U.S. Government shall permanently delete all Kenyan data from U.S. Government systems and provide certified verification of deletion to the Government of Kenya.” Instead, according to Article 3(a), disposal is kept optional.

Both agreements should have included a clear benefit-sharing formula, such as: “Any commercial product derived from data provided under this Agreement shall trigger three automatic requirements: mandatory technology transfer including source code and manufacturing processes, twenty percent of gross revenues as royalty payments to the Government of Kenya, and preferential pricing providing Kenya a fifty percent discount on all products derived from Kenyan data.” Instead, Article 3(f) defers benefit-sharing to optional and undetermined agreements in the future.

Both agreements should have included binding arbitration: “Any dispute arising out of or relating to this Agreement shall, if not settled amicably by the Parties within ninety (90) days of written notice of the dispute, be finally settled by arbitration under the Convention on the Settlement of Investment Disputes between States and Nationals of Other States (ICSID Convention) and in accordance with the ICSID Rules of Procedure for Arbitration Proceedings. The award rendered shall be final and binding on the Parties and enforceable in accordance with the ICSID Convention.” Instead, Article 5(h) provides only consultations through diplomatic channels.

Both agreements should have included AI model transparency and access: “The U.S. Government shall disclose all AI models trained using Kenyan data within seven days of training completion. The U.S. Government shall grant Kenya a perpetual, royalty-free license to use all such models. Upon Agreement expiration, the U.S. Government shall destroy all models trained on Kenyan data and provide certified verification of destruction.” Instead, Framework 2.5.8.3 permits AI-functionalities with no transparency requirements, no Kenya access rights, no disclosure obligations, and no destruction mandates.

What Kenya receives from these documents so far are partial, empty and impotent procedural protections. They create the appearance of protection while lacking substantive provisions to enable comprehensive protection. We should have negotiated better.

4. SILENCE SPEAKS

We have uncovered that these documents contain notable silences that enable exploitation. We have found no benefit-sharing formula, no technology transfer requirement, no AI model rights, no data deletion timeline, no binding dispute resolution, no enforcement penalties, and no defined protections to personally identifiable information.

As Kenya provides the US with seven years of comprehensive national health data, we must remember what Kenya gets in return: the promise of future benefit-sharing negotiations. Kenya’s remedy for violations of these agreements is diplomatic consultations with no binding outcome. The US remedy for Kenya’s violations is immediate withdrawal of funding while data extraction continues. This is theft.

CONCLUSION

Every concern I raised in my first essay has either been confirmed or worsened by the release of the Data Sharing Agreement. I have provided the specific articles, the exact paragraphs, and the precise legal language that Ruto’s government has already committed to on behalf of 55 million Kenyans. These are the receipts. So, will Kenya spot the trap while there is still time to evade it?