Internet access is somewhat limited by poor infrastructure, but penetration rates and connection speeds continue to improve.

According to data published by the Communications Authority (CA), the broadband penetration rate increased to 48.5 percent in September 2019, compared with 44.9 percent a year earlier.1 The regulator also reported 53.2 million mobile phone subscriptions, representing a mobile (SIM) penetration rate of 112 percent as of September 2019, up from 100.1 percent the previous year.2 A penetration rate above 100 percent indicates that some users have more than one mobile subscription. The CA reports that second- and third-generation (2G and 3G) mobile networks cover 96 percent and 93 percent of the population, respectively.3

Average connection speeds seem to have declined, to 7.62 Mbps in 2018-19 from 10.11 Mbps in 2017-18, according to Cable, a telecommunications company based in the United Kingdom. Kenya now ranks third in Africa, after Madagascar and South Africa.4

Safaricom, Kenya’s leading telecommunications company, said in February 2020 that it would launch Kenya’s first fifth-generation (5G) mobile services in major urban centers later in the year, using technology from the Chinese firm Huawei. The new infrastructure may have a delayed impact, as many users will need to purchase new devices that are compatible with 5G.5

The National Optic Fibre Backbone Infrastructure (NOFBI) project aims to increase internet connectivity across the country and improve the delivery of e-government services.6 The Kenya Vision 2030 development plan, currently in its third phase (2018–22), considers information and communication technologies (ICTs) to be a key element of national transformation.7 Focusing on devolution (decentralization) and building equity across the country, the government has prioritized the expansion of ICT capacity, with internet connectivity as a central pillar.8

Safaricom experienced interruptions to data and voice services in August 2019,9 and to data services in November 2019.10 In April 2020, Safaricom suffered a network outage that affected its home fiber service, for which it later compensated customers.11 In October 2019, Airtel Kenya experienced network outages affecting voice, text, and data services.12

Outages on Safaricom networks affected M-Pesa (a mobile money service) and internet connectivity with some regularity during the previous coverage period. Reported outages occurred in December, 13 November,14 and July 2018.15 The July incident, which lasted several hours and affected voice and data service, was caused by a damaged fiber link.16 These outages affected more than 31 million subscribers who rely on Safaricom’s voice, text, data, web-hosting, and mobile money services.

Since the outbreak of COVID-19, which has led many businesses and education institutions to move their operations online, internet service providers (ISPs) have taken steps to improve bandwidth and meet increased demand.17

Internet access is still prohibitively expensive for much of the population, despite significant investments meant to make connections more accessible in rural areas. In the Alliance for Affordable Internet’s 2019 Affordability Drivers Index, Kenya ranks 15th out of the 29 African countries surveyed, a drop of six spots from the 2018 index,18 with marginal improvements in access and infrastructure.19

As a result of the COVID-19 pandemic, Kenyans rely even more on the internet for work and learning. However, survey results indicate that just 22 percent of children can access digital learning, and public schools are often unable to support such services. The survey found poverty to be the main barrier inhibiting access.20

Following a lawsuit against Safaricom, Airtel, and Telkom for their data expiration practices,21 Safaricom rolled out nonexpiry data bundles in October 2019, and Airtel rolled out its own in December.22 However, in the instance of Safaricom, nonexpiry data plans cost the same as expiring data packages but with half as much data. Crucially, this applies to the cheaper bundles and not the more expensive ones, affecting subscribers with less disposable income for data.23

The Finance Act, which was signed by President Uhuru Kenyatta in September 2018, increased the tax on telephone and internet data from 10 percent to 15 percent.24 In response to the tax, ISPs raised prices for both mobile data bundles and fixed-line home internet connections,25 making internet access unaffordable for many poorer Kenyans.

The affordability and availability of the internet varies between urban and rural areas. A gender-based digital divide also persists, with more men than women using mobile and internet services.26 Many rural areas have not benefited from Kenya’s high-capacity bandwidth, in part due to market disparities and weaknesses in last-mile connectivity, which is expensive and requires basic infrastructure such as electricity and roads that are often poorly developed. The Universal Service Fund (USF), which was established in 2013, aims to expand mobile and internet service in a bid to close the digital divide.27

The Voice Infrastructure Project, a USF initiative administered by the CA, had connected 68 rural sublocations to basic mobile telephony as of November 2019, affecting 290,000 Kenyans who were previously not able to make and receive calls.28 The Education Broadband Connectivity Project, another USF initiative, provided 887 secondary schools with internet connections at a speed of 5 Mbps as of October 2019.29

There were no reports of the government using control over internet infrastructure to limit connectivity during the coverage period. Kenya’s decentralized internet infrastructure and nongovernmental control of the Kenya Internet Exchange Point (KIXP) make it unlikely that the government could exercise technical control over the internet.

In July 2019, the ICT Authority introduced a regulation that requires all owners of fiber-optic infrastructure to register existing networks and seek approval for any new fiber installations.30 The ICT Authority is likely to treat the registration process for existing networks as a de facto approval process that could prove cumbersome, rather than a straightforward registration mechanism, though it is unclear whether the regulation will involve the imposition of fees.31

Kenya connects to the international internet via four main undersea cables—SEACOM, the East Africa Marine System (TEAMS), the Eastern Africa Submarine Cable System (EASSY), and the Lower Indian Ocean Network (LION2); three others—Africa1, Djibouti Africa Regional Express (DARE), and Liquid Sea—land in Mombasa.32 The provision of licenses for access to the international gateway was liberalized in 2004.33

The KIXP is operated by the Telecommunication Service Providers Association of Kenya (TESPOK), a nonprofit organization representing the interests of ISPs. The KIXP keeps domestic Kenyan internet traffic within the country, lowering the cost of connectivity. A second IXP was established in Mombasa, but its failure to attract enough users led to its closure in 2015.34 With support from the African Union, a backup IXP was established in 2016 to further lower the costs of connectivity for ISPs.35

A number of economic obstacles restrict the diversity of service providers. There are five mobile service providers: Safaricom, Airtel, Telkom, Mobile Pay Limited, and Equitel.36 In December 2019, the CA approved the merger of Airtel and Telkom.37 Based on industry statistics from September 2019, the merger would result in 64.9 percent and 31.3 percent mobile-subscription market shares for Safaricom and Airtel-Telkom, respectively.38

The government owns 35 percent of Safaricom,39 as well as 40 percent of Telkom.40 Because Safaricom holds a majority of the market, there have been calls to declare it a dominant player, which could force the company to spin off its mobile money service in an effort to foster greater competition.41 However, amid fierce resistance from Safaricom and other powerful business interests, in January 2018 the regulator dropped plans to split the company.42 In July 2018, the Parliamentary Committee on Communication, Information, and Innovation opened an investigation into the mobile sector to identify legislative and regulatory gaps that may lead to anticompetitive behavior or restrict growth.43

The CA is the regulatory body that licenses all communications systems.44 As of April 2018, it listed three providers with submarine cable landing rights and 57 network facility providers (three of which are national providers, while the remainder are regional).45 These licensees provide, among other things, facilities for internet, voice, and mobile virtual operations. Cybercafés are licensed as business units by local governments, and there are no special regulatory or economic obstacles to their establishment.

The regulatory bodies that oversee service providers generally operate in a fair manner, but there have been some encroachments on regulators’ independence in the past. The CA was roiled by leadership struggles during the coverage period.

The CA’s management is vested in a board of directors that consists of a chairperson appointed by the president, three principal secretaries hired by the Public Service Commission, and seven persons appointed by the cabinet secretary of the ICT Ministry.46 The day-to-day operations of the regulator are managed by a director general who is appointed by the board to a four-year term, renewable only once.47 The director general is an ex officio member of the board without any voting rights.

While the authority’s independence is provided for under Section 5 of the Kenya Information and Communications Act (KICA), tensions between the ICT Ministry and the board of directors on one side, and the director general of the CA on the other, have flared up in recent years.

In July 2019, ICT Cabinet Secretary Joe Mucheru announced four new board members for the CA.48 In November, a court found the appointments unconstitutional and contrary to the Public Service Commission Act, 2017, which requires advertisement for positions and competitive recruitment procedures. The ruling produced some confusion regarding the appointment of a successor for outgoing director general Francis Wangusi, as it cast doubt on whether the board tasked with making the new appointment was properly constituted. The CA closed the application process for the position in June 2020,49 with Mercy Wanjau serving temporarily as acting director general.50

In January 2018, the CA board had given Wangusi, whose term was set to expire in August 2019, a three-month compulsory leave of absence, ostensibly to allow for an independent audit of the regulator’s hiring process. A labor court subsequently lifted the suspension, pending a full hearing on a case filed by the director general, who claimed he was being punished for resisting interference by the ICT Ministry.51 The dispute was settled in September 2018,52 when the CA signed an agreement pledging that it would not interfere with Wangusi’s contract.

Wangusi had clashed with the board and the ICT Ministry on a variety of topics. The two sides disagreed about how to implement a report on Safaricom’s market dominance. The director general also objected to what he considered improper requests for funds from the CA, such as the permanent secretary’s demand that CA resources be used for a presidential swearing-in ceremony. In April 2018, the president ordered the transfer of 1 billion Kenyan shillings ($9.6 million) from the CA-managed USF to the Directorate of Criminal Investigation (DCI) to fight cybercrime.53

Political and social content is generally not subject to blocking in Kenya. Testing by the Open Observatory of Network Interference (OONI) conducted in May 2020 revealed no signs of website blocking or censorship.54 Social media platforms and communication applications such as Facebook, Twitter, YouTube, and LinkedIn were also fully accessible.55 Nonetheless, the government periodically polices the internet for content that is perceived to be morally objectionable (see B2).

The internet remained unrestricted during the tense period following the contested 2017 presidential election, including when the government jammed the broadcast signals of three leading television stations that were planning to air opposition leader Raila Odinga’s unofficial inauguration in January 2018.56 The networks’ websites were not blocked, enabling them to stream the event online.57

Although censorship is not systematic, the state has increasingly sought to remove online content that it deems immoral or defamatory.

In May 2020, Kenyan Film Classification Board (KFCB) chairman Ezekiel Mutua condemned the song “Soko” by the Gengetone group Ethic, stating that it promoted rape, prostitution, and sexual abuse of children.58 Following a KFCB complaint to Google, the “Soko” music video was removed from YouTube.59 In November 2019, the KFCB requested that Google remove the music video for “Tarimbo,” another Epic song, from YouTube for “advocating for violence against women.”60 The video was removed shortly afterward.61

In April 2018, the KFCB had prohibited the distribution, exhibition, or broadcast of the film Rafiki, including online, on the grounds that it promoted homosexuality.62 The penal code criminalizes same-sex sexual activity, and the KFCB routinely censors LGBT+ content.63 The ban on Rafiki was lifted by the High Court in September 2018 so that the film could be considered for an Academy Award in the United States.64 Also that month, however, the KFCB banned one advertisement for containing sexual content and another for allegedly supporting abortion.

In 2017, the KFCB banned six children’s television programs for allegedly promoting homosexuality “against our Kenya’s moral values and culture.”65 The programs had aired on television and online.

The government also occasionally requests content removals for reasons other than morality. Between June and December 2019, Google received three takedown requests regarding 14 items, all relating to regulated goods and services, and removed four of those items.66 Between July and December 2018, Facebook restricted access to one post, based on a privately reported defamation claim.67

Authorities have sometimes compelled ordinary users and online journalists to delete content from their social media profiles and websites. In December 2018, a court ordered blogger Cyprian Nyakundi to remove an article on his website that allegedly defamed politician Steve Mbogo.68 In 2017, blogger Robert Alai removed photos he had posted on his Facebook page of President Kenyatta’s family in a Nairobi hospital; he was also arrested for the photos.69

Restrictions on the internet are largely transparent, but censorship of online content sometimes lacks fairness or proportionality.

The KFCB has justified banning advertisements that contain sexual content and promote abortion services (see B2) by invoking a law that prohibits the airing of sexual content before 10 p.m. Those found to have distributed video content without KFCB approval face fines of up to 100,000 shillings ($960) and prison terms of up to five years,70 as outlined in the Films and Stage Plays Act, 2012.71

In advance of the 2017 election, the CA implemented new guidelines to curb online abuse in partnership with the National Cohesion and Integration Commission (NCIC), a statutory body that works to reduce interethnic conflict.72 The broadly worded guidelines prohibit political messages that “contain offensive, abusive, insulting, misleading, confusing, obscene, or profane language,” and analysts have warned that they could be used to limit legitimate online expression. The guidelines also require administrators of social media pages to “moderate and control the content and discussions generated on their platform,” and give mobile service providers the power to block the transmission of political messages that do not comply with the guidelines at their discretion.73 In addition, bulk political messages require prior approval from the NCIC.

Internet intermediaries in Kenya can be held liable for illegal content, such as copyright infringements and hate speech, though they are not required to actively monitor traffic passing through their networks unless they are made aware of illegal content.74 Under the National Cohesion and Integration Act, 2008, which outlaws hate speech, a media enterprise can be fined up to 1 million shillings ($9,600) for publishing hate speech, which is broadly defined in the legislation.75 This provision can be invoked to block or take down online content, according to the Association of Progressive Communications.76

Arrests of online journalists and statements by media regulators have prompted concerns about self-censorship by the press. The importance of government advertising purchases for the financial survival of media outlets, including those that publish online, results in some self-censorship among journalists (see B6).

In a lawsuit challenging the March 2020 arrests of bloggers for allegedly posting false or alarming information about COVID-19, as charged under the Computer Misuse and Cybercrimes Act, 2018 (see C2), the Law Society of Kenya argued that such arrests and convictions would encourage self-censorship by online publishers.77

Separately in March 2020, the Kenya Editors Guild responded with concern to a statement by the Media Council of Kenya, a media regulator, that accused editors of breaching the code of conduct in the practice of journalism. The Editors Guild said the statement posed a threat to media freedom, and that such accusations could increase self-censorship among journalists. 78

According to the Media Council of Kenya, there were 54 violations of press freedom in 2019 and 44 as of May 2020. This represented a sharp increase from previous years, with a total of 181 cases from 2013 to May 2020. The police and other government authorities are reportedly responsible for most of the attacks against journalists.79 Such attacks have a chilling effect on speech and can lead to self-censorship online.

Online sources of information are not systematically controlled or manipulated by the government or other powerful actors to advance a particular political interest. However, coordinated online campaigns have been observed in the past, notably in the run-up to the 2017 election.

Misinformation about the COVID-19 pandemic is widespread in Kenya, including on social media platforms like WhatsApp. 80 The problem has affected the country’s ability to effectively manage the spread of the virus, with many residents of informal settlements reportedly believing that the virus cannot be contracted by Kenyans.81 The government has threated fines and imprisonment for people who spread false COVID-19 information via online channels (see C2).82

Loosely organized “bloggers for hire” use their collective clout on social media to shape public opinion and manipulate the online information landscape.83 One such group, known as the “36 Bloggers,” allegedly works within the Executive Office of the President’s Directorate of Digital Communication.84 Another group is known as the “527 militia,” with 527 ostensibly signifying the amount of Kenyan shillings paid to each blogger to promote certain hashtags.85 In 2019, bloggers for hire were generally most active on Facebook, Twitter, and WhatsApp, using both human-run and automated “bot” accounts to attack opposition figures and support the government, most often through targeted advertising and disinformation.86

In October 2018, Facebook announced that it would partner with Africa Check, Africa’s first independent fact-checking organization, and Agence France-Presse (AFP) to help assess the accuracy of information being disseminated on its platform.87

During the 2017 election season, online manipulation and overt disinformation proliferated on social media. A number of websites were registered with legitimate-sounding names, such as CNN Channel 1,88 to disseminate false news, undermining the quality of information available online. Propaganda, hate speech, and attacks on candidates were common, spread in part through Google ads and sponsored posts on Facebook.89 According to the communications consultancy Portland’s How Africa Tweets 2018 report, bot armies worked to “undermine the influence of media outlets, independent bloggers, government entities, and even messages from politicians and campaigners themselves.”90 The British political consulting firm Cambridge Analytica reportedly aided Kenyatta’s reelection bid and was linked to two websites—TheRealRaila.com and UhuruForUs.com91—that respectively spread hate speech and negative ads about opposition presidential candidate Raila Odinga and pushed positive narratives about the incumbent.92

There are few regulatory constraints that negatively affect users’ ability to publish content online, but media outlets’ reliance on revenue from government advertisements causes economic challenges for some entities.

The Government Advertising Agency (GAA) was established in 2015 to manage government advertising purchases. In August 2018, the DCI began an investigation of the GAA for allegedly failing to pay 2.8 billion shillings ($27 million) in advertising fees owed to media outlets.93 The Kenya Media Sector Working Group claimed in May 2019 that the GAA was actively working to muzzle the media by starving outlets of needed revenue.94 In July 2019, Cabinet Secretary Mucheru assured the media that all debts owed by the government would be paid.95 As of March 2020, the ICT Ministry reportedly owed media houses up to 2.5 billion shillings ($24 million).96

The government has been known to use its advertising budget to influence media outlets’ editorial choices, resulting in financially induced self-censorship.97 Some online outlets also adjust the tone of their content to avoid upsetting other major advertisers,98 though this phenomenon has been more frequently observed among traditional media outlets.

Powerful, politically influential media owners have affected the editorial lines and reporting of their outlets to advance their own interests.99

The online information landscape is diverse and vibrant, with outlets reporting on many issues and offering a wide range of viewpoints. Social media platforms have become an important means for journalists to gather and share news. Traditional broadcast outlets have increasingly utilized social media and digital platforms to interact with users in real time.

Bloggers and social media personalities have gained influence in recent years. Fast and affordable internet connections in major cities and towns have enabled a growing class of digitally skilled citizens to create content and provide alternative sources of news and information.

Online tools for civic mobilization are freely available to users, but the authorities’ suppression of some forms of digital dissent limits their effectiveness. Social media, especially Twitter, continue to be a critical platform for debate, advocacy, and mobilization on issues of public interest.

In May 2020, social media users organized around the hashtag #EndPoliceBrutalityKE, reporting and tracking police brutality in Kenya and pushing for accountability.100 This online mobilization resulted in physical protests.101 In the face of exceptionally high youth unemployment,102 Kenyans also use the hashtag #IkoKaziKE as a resource to find jobs and share hiring opportunities.

In the spring of 2019, the police in Mombasa launched an operation to arrest people for allegedly using social media to “incite” others against registering for the National Integrated Identity Management System (NIIMS), a biometric registration system.103

The hashtag #SwitchoffKPLC was used to raise awareness of and organize protests against the Kenya Power and Light Company (KPLC), which owns and operates most of the electricity transmission and distribution systems in the country, over inflated consumer bills.104 Online activists urged customers to submit their power bills to a Nairobi lawyer, who used them as evidence to file a petition against the company in court.105 In July 2018, 20 KPLC managers were charged with economic crimes and abuse of office, partly substantiating the lawyer’s petition.106 The case was settled out of court in October 2018, which led to mixed reactions from the public, as many people argued that the settlement was too lenient. The agreement stipulated that the KPLC must establish billing query centers across the country. According to the deal, customers can have their actual meter readings weighed against the KPLC's estimates to determine the amount owed.107

In February 2018, in the wake of the High Court’s decision against decriminalizing consensual same-sex conduct, Kenyans used the hashtag #Repeal162 to air their views on Twitter.108

Score Change: The score declined from 4 to 3 because the High Court ruled that a law criminalizing various forms of online speech does not violate freedom of expression, and due to the impunity enjoyed by law enforcement officers who commit crimes against journalists.

Freedom of expression is enshrined in Article 33 of the 2010 constitution and includes the rights to seek, receive, or impart information and ideas. However, these rights are frequently violated in practice, including for online journalists and other internet users. Propaganda, hate speech, and incitement to violence are not protected by the constitution.

The judiciary is relatively independent, though recent high-profile rulings have failed to protect the fundamental rights of online journalists and ordinary users. The Bloggers Association of Kenya (BAKE), with support from the rights group Article 19, filed a petition that led a court to temporarily suspend 26 sections of the Computer Misuse and Cybercrimes Act, 2018, before it came into effect in May 2018.109 In February 2020, however, High Court judge James Makau dismissed this petition and lifted the suspension of the 26 sections, which prescribe hefty fines and prison sentences for a range of online activities, including publishing false information and cyberharassment (see C2).110

Beginning in February 2020, the government imposed movement restrictions to mitigate the spread of COVID-19, including a curfew announced in March.111 Despite a government order exempting the media, police have intimidated, threatened, attacked, and arrested journalists during the curfew.112

Law enforcement officers who unlawfully kill or injure Kenyans rarely face penalties. Officers often fail to comply with a law that requires the police to report, investigate, and prosecute extrajudicial killings.113 After the curfew was declared in March 2020, police tasked with enforcing it shot and beat people without justification, in some cases before the announced restrictions had officially taken effect.114 As of June 2020, a government accountability body reported that police had killed at least 15 people and injured at least 31 since the curfew began.115

Laws on hate speech and defamation are frequently used to prosecute online critics of the government.

The Computer Misuse and Cybercrimes Act, 2018, which was adopted in May 2018 and subsequently challenged in court, threatens to further restrict freedom of expression online. According to the act, anyone who “knowingly publishes information that is false in print, broadcast, data or over a computer system, that is calculated or results in panic, chaos, or violence among citizens of the Republic, or which is likely to discredit the reputation of a person” can be sentenced to a fine of as much as 5 million shillings ($48,000) and up to 10 years in prison.116

Shortly after the law was promulgated, BAKE sued to overturn 26 problematic provisions,117 which were suspended until the court could hear the case.118 A High Court judge ultimately dismissed BAKE’s case in February 2020, ruling that the law does not violate freedom of expression and allowing the suspended provisions to take effect. Later that month, BAKE and the Law Society of Kenya appealed the High Court’s ruling to the Court of Appeal.119

Also in February 2020, amid rising concern over COVID-19, government spokesperson Cyrus Oguna warned that those spreading false information related to the novel coronavirus on social media were being monitored and would face arrest under the cybercrimes act.120

In 2017, the High Court struck down Section 132 of the penal code on constitutional grounds; the section criminalized “undermining the authority of public officers” and had been used to prosecute both online and offline speech.121 Section 29 of KICA was separately ruled unconstitutional in 2016.122 It had penalized bloggers and social media users for using ICTs to disseminate messages deemed “grossly offensive” or to cause “annoyance, inconvenience or needless anxiety to another person,” carrying a fine of up to 50,000 shillings ($480), three years in prison, or both.123

Hate speech is penalized under the 2008 National Cohesion and Integration Act, which was passed in response to widespread ethnic violence following the 2007 general elections.124 Individuals found guilty of spreading hate speech, broadly defined, can face a fine of up to 1 million shillings ($9,600), a prison term of up to three years, or both.

Numerous bloggers and social media users were arrested or summoned for questioning during the coverage period, continuing an alarming trend.

Several individuals were arrested for allegedly sharing false information related to COVID-19:

• In March 2020, blogger Cyprian Nyakundi was arrested for allegedly publishing false information related to the pandemic.125 Though he was freed on bail shortly after his arrest, a magistrate issued a warrant for Nyakundi to be rearrested in April, claiming that he had failed to present himself before the court.126
• Also in March, prominent blogger Robert Alai was charged with publishing false information after he posted on social media about alleged coronavirus deaths. He was released on bail after three days and ordered not to publish any more coronavirus-related information.127
• Separately the same month, Elijah Muthui Kitonyo was arrested under Section 23 of the Computer Misuse and Cybercrimes Act for “publishing misleading and alarming information” about the coronavirus on Twitter. The post in question implied that the government was misleading the public about coronavirus-related information.128

In January 2020, activist and blogger Mildred Owiso was arrested and later released on cash bail for allegedly inciting the public to violence. She had recorded an encounter with the traffic police and posted it online, arguing that it was unlawful for a traffic officer to enter the car of someone suspected of a traffic offense.129

Robert Alai was arrested in June 2019 for posting photos of police officers who were victims of a terrorist attack in Wajir County earlier that month. A police spokesperson warned internet users that circulating such images was “unpatriotic” and supportive of Al-Shabaab, the Somalia-based militant group believed to have perpetrated the attack.130 Later that month, Patrick Safari, a prison warden based in Mandera, was arrested for posting online pictures of officers from the same incident.131

In the spring of 2019, the police in Mombasa launched an operation to arrest people for using social media to “incite” others against registering for NIIMS (see B8).132

A number of arrests and prosecutions for online activity, particularly for alleged hate speech, occurred around the 2017 election. Among those arrested was blogger Paul Odhiambo, who was detained for spreading alleged hate speech on Facebook and WhatsApp.133 Robert Alai was arrested for information he posted about the health of a family member of President Kenyatta.134 Alai has been arrested numerous times for his online activities.

Kenyans can freely use encryption tools, but a number of regulations and monitoring systems limit anonymous communication. Several publications and technology blogs often encourage Kenyans to install encryption tools.

Anonymity is compromised by the expanding scope of mandatory SIM-card registration and efforts to track the illicit sale of mobile phones. In April 2020, the Court of Appeal reversed a High Court decision barring the government’s plan to implement the Device Management System (DMS), a mechanism for identifying counterfeit and illegal phones.135 The High Court had ruled that the system, which gives the CA access to mobile subscriber data, including call records, would infringe on subscribers’ right to privacy, among other concerns.136 The Court of Appeal ruled that the High Court lacked evidence to reach this conclusion. Service providers had previously disclosed that personal data of subscribers would be handled by third parties contracted by the CA to maintain the DMS.137 In June 2020, after the coverage period, the Law Society of Kenya appealed the case to the Supreme Court; while the appeal is considered, the DMS will be implemented.138

In 2017, Safaricom began keeping records of anyone registering for or renewing a SIM card.139 This was in compliance with existing SIM-card registration requirements under the Kenya Information and Communications (Registration of SIM-Cards) Regulations, 2015, which prescribe penalties of up to 300,000 shillings ($2,900), imprisonment for up to six months, or both for failure to abide by the registration requirements.140 The regulations also grant the communications regulator access to service providers’ offices and records without a court order, raising concerns about the lack of judicial oversight.141

In July 2019, legislators introduced a bill to amend KICA by requiring the registration of bloggers and assigning a penalty of up to 500,000 shillings ($4,800) in fines or two years’ imprisonment for blogging without a license.142 As of June 2020, the bill had not progressed.

Article 31 of the 2010 constitution provides for the right to privacy. However, authorities engage in surveillance of internet activities under laws that enable them to search and seize data on national security grounds, directly infringing on users’ privacy rights. The Data Protection Act, 2019, passed in November of that year, leaves room for officials to continue to bypass user consent and access private data for national security reasons (see C6).

Evidence of unlawful or disproportionate state surveillance has emerged in recent years. According to 2018 research published by Citizen Lab, a Canadian internet watchdog, Kenya is one of 45 countries worldwide where the use of Pegasus, a surveillance software tool developed by the Israeli technology firm NSO Group, has been detected. The spyware has targeted customers of Safaricom and Simbanet, and it is known to be used by governments elsewhere to intrusively monitor journalists, human rights defenders, and political opponents.143

During the 2017 election, officials at the electoral commission allegedly exploited their access to voters’ data—including information such as phone numbers, identification numbers, and photos—and sold them to politicians, who then targeted the voters with campaign messages in the run-up to the polls.144

In January 2020, a High Court ruling barred the government from proceeding with the implementation of NIIMS, a biometric registration system, until it developed a comprehensive regulatory framework. The court also prohibited the collection of genetic and satellite-based location data under NIIMS, finding that such collection violates Article 31 of the constitution.145 Despite the ruling, the government has indicated that it intends to begin implementing NIIMS.146

Section 48 of the Computer Misuse and Cybercrimes Act, 2018, allows the authorities to search and seize stored computer data and to collect and intercept data in real time.147

KICA prohibits many forms of monitoring and interception of communications,148 though the Prevention of Terrorism Act, 2012, allows the authorities to limit constitutional freedoms, such as the right to privacy, during investigations into terrorism.149 Amendments to the Prevention of Terrorism Act in 2014 explicitly enabled national security bodies to intercept communications “for the purposes of detecting, deterring, and disrupting terrorism,”150 though this must be authorized through an interception order from the High Court.151

Independent research in recent years has revealed various surveillance technologies that the authorities or other actors may employ to monitor citizens. In 2017, research published by the Centre for Intellectual Property and Information Technology Law (CIPIT) revealed the presence of a “middlebox” on a Safaricom mobile network.152 While middleboxes have legitimate functions, such as network optimization, they can also be used to manipulate traffic and assist in surveillance, which led to concerns about potential violations of privacy. Safaricom denied using a middlebox, and subsequent tests returned negative results, prompting the researchers to conclude that the technology was no longer in use.

The United Kingdom–based nonprofit organization Privacy International (PI) separately revealed in a 2017 report that national security agencies in Kenya, especially the National Intelligence Service (NIS), have unlawful direct access to communications systems, allowing for the interception of both traffic data and content.153 Based on interviews, PI found that law enforcement and national security agents have a physical presence in the facilities of telecommunications providers. The report also indicated that intercepted information could be freely shared with other government agencies.

PI also assessed two new NIS cybersecurity projects, the Network Early Warning System and the National Intrusion Detection and Prevention System, which aim to monitor telecommunications traffic for cybersecurity threats. PI raised concerns that the two systems could monitor content as well as traffic, based on internal documents it received.154 Given the national security framework in which the systems are being implemented, transparency and oversight will be limited.

Service providers and other technology companies are not usually required to aid the government in monitoring the communications of their users, although authorities have reportedly made requests for such assistance. A data protection law passed in November 2019 offers safeguards for user data but includes broad exemptions that allow the government to sidestep the protections, endangering the right to privacy.

The Data Protection Act, 2019, regulates the collection, processing, storage, use, and disclosure of information relating to individuals.155 Processing that is “necessary for national security or public interest” is broadly exempted from the law’s protections, opening the door to government abuse. The law establishes the Office of the Data Commissioner to oversee implementation, but the new entity has not been classified as an independent office under the constitution, raising concerns about its autonomy.156 A data commissioner had yet to be appointed at the end of the coverage period, and the recruitment procedure remained in dispute.157

Other laws, like the Preservation of Public Security Act, the Official Secrets Act, the National Intelligence Act, 2012, and the Prevention of Terrorism Act, limit the privacy of personal data, ostensibly to safeguard national security.158

In November 2018, the CA released a tender for the development of a regulatory strategy for over-the-top (OTT) video streaming services such as those offered by WhatsApp, Skype, and Facebook.159 The tender was extended to end in May 2019; no further information was available during the coverage period.160

PI has reported that Safaricom, the leading mobile internet provider, routinely supplies data to authorities without a warrant for intelligence purposes. Safaricom claims that it only cooperates when authorities present a court order.161

Bloggers and internet users have faced increasing intimidation and violence in retaliation for their online activities in recent years, particularly during the run-up to the 2017 election.

More than a quarter of Kenyan women have experienced some form of online gender-based violence, according to an August 2020 report from Pollicy, a technology consulting firm.162 In April 2020, Brenda Cherotich, one of the first Kenyans to be publicly identified as a person who recovered from COVID-19, faced extensive online harassment, including the nonconsensual sharing of her private chats and photos.163 Women in politics encountered especially harsh online harassment during the pandemic, according to a brief from the Kenya ICT Action Network (KICTANet).164

During the restive 2017 election period, authorities often destroyed the cameras and phones of journalists to suppress reporting on violence and human rights violations.165 The heightened political tensions also led to more instances of intimidation and harassment in retaliation for online activities. There was rampant online harassment of female candidates to deter their political ambitions,166 and it was often accompanied by offline sexual harassment and violence.167

Ordinary users can face retaliation for online activity that impacts their livelihoods. In February 2019, the Machakos County government suspended Dr. Alice Kasyoka from practicing medicine after she criticized county officials in a Facebook post. During her suspension, Kasyoka was paid half of her salary.168

Hacking and other forms of cyberattack are a growing problem in Kenya. The National Computer Incident Response Team detected 25.2 million cyberthreats in the period from July to September 2019, down from 26.6 million during the previous quarter.169

Since 2015, Kenya has been subjected to scores of cyberattacks, many of which were directed at financial institutions. In 2017, Kenya lost an estimated 21 billion shillings ($202 million) to cybercrime, up from 17 billion shillings ($163 million) in 2016.170 In January 2018, hackers stole 29 million shillings ($280,000) from the National Bank of Kenya.171

According to media reports, among the hackers targeting local banks is a home-grown group known as SilentCards who work with unscrupulous bank officers and take advantage of naive customers.172 As part of a crackdown on cybercrime, police in February 2019 arrested a man suspected of being the leader of a group of hackers that stole customers’ deposits from banks.173 Under the Computer Misuse and Cybercrimes Act, 2018, hackers face a fine of up to 5 million shillings ($48,000), up to three years in prison, or both for unauthorized access to, interference with, or interception of data on computer systems; unauthorized disclosure of passwords; and cyberespionage, among other offenses.174

During the 2017 election period, hackers repeatedly attempted to access the Independent Electoral and Boundaries Commission’s website. The commission asserted that the attempts were unsuccessful,175 but the opposition claimed otherwise, alleging that the results of the election were manipulated, leading to Odinga’s loss.176 Neither side’s assertions about the hacking were substantiated.