Score Change: The score declined from 4 to 3 to correct for a methodology error in one of the sources used to calculate internet penetration rates. This score change does not necessarily reflect a change in infrastructural limits to internet access, speed, or quality.

Internet access is somewhat limited by poor infrastructure, but penetration rates and connection speeds continue to improve.

According to the 2019 census, 22.6 percent of individuals aged 3 and above use the internet.1 In contrast, the Digital 2021 report indicates an internet penetration rate of 40 percent as of January 2021.2 The Communications Authority (CA), the national telecommunications regulator, reported that the total number of data and internet subscriptions decreased to 43 million in September 2020 from 52 million in September 2019. The regulator also reported 59.84 million mobile phone subscriptions, representing a mobile penetration rate of 125.8 percent as of September 2020, up from 112 percent the previous year.3 A penetration rate above 100 percent indicates that some users have more than one mobile subscription. The CA reports that second- and third-generation (2G and 3G) mobile networks cover 96 percent and 93 percent of the population, respectively, as of 2019.4

Average connection speeds increased to 8.2 megabits per second (Mbps) in 2020, from 7.62 Mbps in 2019 and 10.11 Mbps in 2018, according to Cable, a telecommunications company based in the United Kingdom. Kenya now ranks 4th in sub-Saharan Africa.5

Safaricom, Kenya’s leading telecommunications company, announced in December 2020 that it would indefinitely postpone plans to launch fifth-generation (5G) services, and alternatively focus on converting millions of 2G and 3G users to 4G.6 Previously, in February 2020, Safaricom had said that it would launch Kenya’s first 5G mobile services in major urban centers later in the year, using technology from the Chinese firm Huawei.7

The National Optic Fibre Backbone Infrastructure (NOFBI) project aims to increase internet connectivity across the country and improve the delivery of e-government services.8 The Kenya Vision 2030 development plan, currently in its third phase (2018–22), considers information and communication technologies (ICTs) to be a key element of national transformation.9 Focusing on devolution (decentralization) and building equity across the country, the government has prioritized the expansion of ICT capacity, with internet connectivity as a central pillar.10

Internet users in Kenya occasionally experience outages in internet services. Airtel users experienced data service outages in June11 and August 2020.12 During the previous coverage period, Safaricom experienced interruptions to data and voice services in August 2019,13 and to data services in November 2019.14 In April 2020, Safaricom suffered a network outage that affected its home fiber service, for which it later compensated customers.15 In October 2019, Airtel Kenya experienced network outages affecting voice, text, and data services.16

Outages on Safaricom networks affected M-Pesa (a mobile money service) and internet connectivity with some regularity in recent years. Reported outages occurred in December,17 November,18 and July 2018.19 The July incident, which lasted several hours and affected voice and data service, was caused by a damaged fiber link.20 These outages affected more than 31 million subscribers who rely on Safaricom’s voice, text, data, web-hosting, and mobile money services.

Since the outbreak of COVID-19, which has led many businesses and education institutions to move their operations online, internet service providers (ISPs) have taken steps to improve bandwidth and meet increased demand.21

Internet access is still prohibitively expensive for much of the population, despite significant investments meant to make connections more accessible in rural areas. In the Alliance for Affordable Internet’s 2020 Affordability Drivers Index, Kenya ranks 10th out of the 34 African countries surveyed, an improvement from its 2019 rank.22 These improvements are credited to investments in international bandwidth and the improved transparency of frequency allocations.23

As a result of the COVID-19 pandemic, Kenyans rely even more on the internet for work and learning. However, survey results indicate that just 22 percent of children can access digital learning, and public schools are often unable to support such services. The survey found poverty to be the main barrier inhibiting access.24

Following a lawsuit against Safaricom, Airtel, and Telkom for their data expiration practices,25 Safaricom rolled out nonexpiry data bundles in October 2019, and Airtel rolled out its own in December.26 However, in the instance of Safaricom, nonexpiry data plans cost the same as expiring data packages but with half as much data. Crucially, this applies to the cheaper bundles and not the more expensive ones, affecting subscribers with less disposable income for data.27

The Finance Act, which was signed by President Uhuru Kenyatta in September 2018, increased the tax on telephone and internet data from 10 percent to 15 percent.28 In response to the tax, ISPs raised prices for both mobile data bundles and fixed-line home internet connections,29 making internet access unaffordable for many poorer Kenyans.

The affordability and availability of the internet varies between urban and rural areas. A gender-based digital divide also persists, with more men than women using mobile and internet services.30 Many rural areas have not benefited from Kenya’s high-capacity bandwidth, in part due to market disparities and weaknesses in last-mile connectivity, which is expensive and requires basic infrastructure such as electricity and roads that are often poorly developed. The Universal Service Fund (USF), which was established in 2013, aims to expand mobile and internet service in a bid to close the digital divide.31

The Voice Infrastructure and Services Project, a USF initiative administered by the CA, had connected 68 rural sublocations to basic mobile telephony as of November 2019, affecting 290,000 Kenyans who were previously not able to make and receive calls.32 The CA awarded 1.57 billion Kenyan shillings ($14.1 million) in contracts to develop further infrastructure for the project in February 2021.33 The Education Broadband Connectivity Project, another USF initiative, provided 887 secondary schools with internet connections at a speed of 5 Mbps as of October 2019.34

There were no reports of the government using control over internet infrastructure to limit connectivity during the coverage period. Kenya’s decentralized internet infrastructure and nongovernmental control of the Kenya Internet Exchange Point (KIXP) make it unlikely that the government could exercise technical control over the internet.

In July 2019, the ICT Authority introduced a regulation that requires all owners of fiber-optic infrastructure to register existing networks and seek approval for any new fiber installations.35 The ICT Authority is likely to treat the registration process for existing networks as a de facto approval process that could prove cumbersome, rather than a straightforward registration mechanism, though it is unclear whether the regulation will involve the imposition of fees.36

Kenya connects to the international internet via four main undersea cables—SEACOM, the East Africa Marine System (TEAMS), the Eastern Africa Submarine Cable System (EASSY), and the Lower Indian Ocean Network (LION2); three others—Africa1, Djibouti Africa Regional Express (DARE), and Liquid Sea—land in Mombasa.37 The provision of licenses for access to the international gateway was liberalized in 2004.38

The KIXP is operated by the Telecommunication Service Providers Association of Kenya (TESPOK), a nonprofit organization representing the interests of ISPs. The KIXP keeps domestic Kenyan internet traffic within the country, lowering the cost of connectivity. A second IXP was established in Mombasa, but its failure to attract enough users led to its closure in 2015.39 With support from the African Union, a backup IXP was established in 2016 to further lower the costs of connectivity for ISPs.40

Economic obstacles restrict the diversity of service providers in Kenya. There are four mobile service providers: Safaricom (63.7 percent market share as of September 2020), Airtel (27.2 percent), Telkom (6.3 percent), and Equitel (2.8 percent).41

A proposed merger between Airtel and Telkom remains pending as of February 2021, when a court ruled the companies had sufficient regulatory approval to proceed and quashed an inquiry from an anti-corruption commission.42 The CA initially approved the merger in September 2021.43

The government owns 35 percent of Safaricom,44 as well as 40 percent of Telkom.45 Because Safaricom holds a majority of the market, there have been calls to declare it a dominant player, which could force the company to spin off its mobile money service in an effort to foster greater competition.46 A bill introduced in March 2021 may compel Safaricom, Airtel, and Telkom to split their telecommunications business from mobile money business. Under the bill’s proposed regulatory framework, telecommunications providers would be licensed to offer voice, data and SMS services, while mobile money services would be licensed as banks.47

Previously, in January 2018, the CA dropped plans to split Safaricom amid fierce resistance from the company and other powerful business interests.48 In July 2018, the Parliamentary Committee on Communication, Information, and Innovation opened an investigation into the mobile sector to identify legislative and regulatory gaps that may lead to anticompetitive behavior or restrict growth.49

The CA is the regulatory body that licenses all communications systems.50 As of April 2018, it listed three providers with submarine cable landing rights and 57 network facility providers (three of which are national providers, while the remainder are regional).51 These licensees provide, among other things, facilities for internet, voice, and mobile virtual operations. Cybercafés are licensed as business units by local governments, and there are no special regulatory or economic obstacles to their establishment.

The regulatory bodies that oversee service providers generally operate in a fair manner, but there have been some encroachments on regulators’ independence in the past. The CA has been managed by an acting director general since August 2019 amid leadership struggles within the regulator.

The CA’s management is vested in a board of directors that consists of a chairperson appointed by the president, three principal secretaries hired by the Public Service Commission, and seven persons appointed by the cabinet secretary of the ICT Ministry.52 The day-to-day operations of the regulator are managed by a director general who is appointed by the board to a four-year term, renewable only once.53 The director general is an ex officio member of the board without any voting rights.

While the authority’s independence is provided for under Section 5 of the Kenya Information and Communications Act (KICA), tensions between the ICT Ministry and the board of directors on one side, and the director general of the CA on the other, have flared up in recent years.

Mercy Wanjau has served as the CA’s acting director general since August 2019,54 as the recruitment process for the role has been marred by procedural issues. As of May 2021, the CA had relaunched its search for the role after a judge ordered the regulator to halt a previous search.55

The August 2019 exit of the previous director general, Francis Wangusi, was marred by confusion. In July 2019, ICT Cabinet Secretary Joe Mucheru announced four new board members for the CA.56 In November 2019, a court found the appointments unconstitutional and contrary to the Public Service Commission Act, 2017, which requires advertisement for positions and competitive recruitment procedures. The ruling produced some confusion regarding the appointment of a successor for outgoing director general Francis Wangusi, as it cast doubt on whether the board tasked with making the new appointment was properly constituted.57

In January 2018, the CA board had given Wangusi, whose term was set to expire in August 2019, a three-month compulsory leave of absence, ostensibly to allow for an independent audit of the regulator’s hiring process. A labor court subsequently lifted the suspension, pending a full hearing on a case filed by the director general, who claimed he was being punished for resisting interference by the ICT Ministry.58 The dispute was settled in September 2018,59 when the CA signed an agreement pledging that it would not interfere with Wangusi’s contract.

Wangusi had clashed with the board and the ICT Ministry on a variety of topics. The two sides disagreed about how to implement a report on Safaricom’s market dominance. The director general also objected to what he considered improper requests for funds from the CA, such as the permanent secretary’s demand that CA resources be used for a presidential swearing-in ceremony. In April 2018, the president ordered the transfer of 1 billion shillings ($9.6 million) from the CA-managed USF to the Directorate of Criminal Investigation (DCI) to fight cybercrime.60

Political and social content is generally not subject to blocking in Kenya. Testing by the Open Observatory of Network Interference (OONI) revealed no signs of website blocking or censorship as of February 2021.61 Social media platforms and communication applications such as Facebook, Twitter, YouTube, and LinkedIn were also fully accessible.62 Nonetheless, the government periodically polices the internet for content that is perceived to be morally objectionable (see B2).

The internet remained unrestricted during the tense period following the contested 2017 presidential election, including when the government jammed the broadcast signals of three leading television stations that were planning to air opposition leader Raila Odinga’s unofficial inauguration in January 2018.63 The networks’ websites were not blocked, enabling them to stream the event online.64

Although censorship is not systematic, the state has increasingly sought to remove online content that it deems immoral or defamatory.

In March 2021, Kenya Film Classification Board (KFCB) chairman Ezekial Mutua ordered comedian Eric Omondi to take down episodes of his YouTube show “Wife Material,” calling the videos pornographic. Omondi complied. Prior to the removal of the videos, Omondi was arrested on Mutua’s orders, alongside 15 “Wife Material” cast members (see C3). Omondi was charged with violating the Film and Stage Plays Act, which requires certification from the KFCB to exhibit or distribute films. Omondi and Mutua reached an out-of-court settlement over the charges.65

In August 2020, a website that tallied the amount of money lost to corruption during the current regime’s tenure went offline after Charles Gichuki, who ran the website, was arrested (see C3).66

In May 2020, during the previous coverage period, Mutua condemned the song “Soko” by the Gengetone group Ethic, stating that it promoted rape, prostitution, and sexual abuse of children.67 Following a KFCB complaint to Google, the “Soko” music video was removed from YouTube.68 In November 2019, the KFCB requested that Google remove the music video for “Tarimbo,” another Ethic song, from YouTube for “advocating for violence against women.”69 The video was removed shortly afterward.70

In April 2018, the KFCB had prohibited the distribution, exhibition, or broadcast of the film Rafiki, including online, on the grounds that it promoted homosexuality.71 The penal code criminalizes same-sex sexual activity, and the KFCB routinely censors LGBT+ content.72 The ban on Rafiki was lifted by the High Court in September 2018 so that the film could be considered for an Academy Award in the United States.73 Also that month, however, the KFCB banned one advertisement for containing sexual content and another for allegedly supporting abortion.

In 2017, the KFCB banned six children’s television programs for allegedly promoting homosexuality “against our Kenya’s moral values and culture.”74 The programs had aired on television and online.

The government also occasionally requests content removals for reasons other than morality. Between June and December 2019, Google received three takedown requests regarding 14 items, all relating to regulated goods and services, and removed four of those items.75 Between July and December 2018, Facebook restricted access to one post, based on a privately reported defamation claim.76

Authorities have sometimes compelled ordinary users and online journalists to delete content from their social media profiles and websites. In December 2018, a court ordered blogger Cyprian Nyakundi to remove an article on his website that allegedly defamed politician Steve Mbogo.77 In 2017, blogger Robert Alai removed photos he had posted on his Facebook page of President Kenyatta’s family in a Nairobi hospital; he was also arrested for the photos.78

Restrictions on the internet are largely transparent, but censorship of online content sometimes lacks fairness or proportionality.

In March 2021, Aden Duale, a parliamentarian with the ruling Jubilee Coalition, introduced a bill in the National Assembly to empower the National Computer and Cybercrimes Co-ordination Committee to “recommend websites to be rendered inaccessible” within Kenya.79 The Committee is a government-appointed body that lacks transparency and public oversight mechanisms (see C2).

The KFCB has justified banning advertisements that contain sexual content and promote abortion services (see B2) by invoking a law that prohibits the airing of sexual content before 10 p.m. Those found to have distributed video content without KFCB approval face fines of up to 100,000 shillings ($960) and prison terms of up to five years,80 as outlined in the Films and Stage Plays Act, 2012.81

In advance of the 2017 election, the CA implemented new guidelines to curb online abuse in partnership with the National Cohesion and Integration Commission (NCIC), a statutory body that works to reduce interethnic conflict.82 The broadly worded guidelines prohibit political messages that “contain offensive, abusive, insulting, misleading, confusing, obscene, or profane language,” and analysts have warned that they could be used to limit legitimate online expression. The guidelines also require administrators of social media pages to “moderate and control the content and discussions generated on their platform,” and give mobile service providers the power to block the transmission of political messages that do not comply with the guidelines at their discretion.83 In addition, bulk political messages require prior approval from the NCIC.

Internet intermediaries in Kenya can be held liable for illegal content, such as copyright infringements and hate speech, though they are not required to actively monitor traffic passing through their networks unless they are made aware of illegal content.84 Under the National Cohesion and Integration Act, 2008, which outlaws hate speech, a media enterprise can be fined up to one million shillings ($9,600) for publishing hate speech, which is broadly defined in the legislation.85 This provision can be invoked to block or take down online content, according to the Association of Progressive Communications.86

Arrests of online journalists and statements by media regulators have prompted concerns about self-censorship by the press. The importance of government advertising purchases for the financial survival of media outlets, including those that publish online, results in some self-censorship among journalists (see B6).

In a lawsuit challenging the March 2020 arrests of bloggers for allegedly posting false or alarming information about COVID-19, as charged under the Computer Misuse and Cybercrimes Act, 2018 (see C2), the Law Society of Kenya argued that such arrests and convictions would encourage self-censorship by online publishers.87

Separately in March 2020, the Kenya Editors Guild responded with concern to a statement by the Media Council of Kenya, a media regulator, that accused editors of breaching the code of conduct in the practice of journalism. The Editors Guild said the statement posed a threat to media freedom, and that such accusations could increase self-censorship among journalists. 88

According to the Media Council of Kenya, there were 83 violations of press freedom in 2020 and 33 as of May 2021, the end of the coverage period. This represented a sharp increase from previous years, with a total of 181 cases from 2013 to May 2020. The police and other government authorities are reportedly responsible for most of the attacks against journalists.89 Such attacks have a chilling effect on speech and can lead to self-censorship online.

Score Change: The score declined from 3 to 2 because coordinated social media networks, which include some users who are paid to participate, seek to shape political narratives on social media.

Online sources of information are not systematically controlled or manipulated by the government or other powerful actors to advance a particular political interest. Coordinated online campaigns have been observed on politically sensitive topics.

Loosely organized “bloggers for hire” use their collective clout on social media to shape public opinion and manipulate the online information landscape.90 For instance, a network of accounts amplified content that discredited Deputy President Ruto in order to support President Kenyatta and former prime minister Odinga, according to a June 2020 report. The accounts sought to position the content in the top trending topics in Kenya in May of that year.91 Commentators also alleged that the government coordinated social media users92 to discredit protesting healthcare workers in December 2020; the healthcare workers mobilized about safe working conditions after a young doctor died of COVID-19 with months of unpaid salary.93

Researchers identified at least eight disinformation campaigns aimed at Kenyan Twitter users between May and June 2021. The campaigns amplified narratives to support the constitutional review process (see C1), discredit civil society activists opposed to the review, and delegitimize judges perceived as opposed to the president. In some cases, participants in the disinformation campaigns were coordinated over WhatsApp groups and paid the equivalent of $10 to $15 a day to boost the narratives on Twitter. The researchers found that the extent of the campaigns—over 23,000 posts distributed by 3,700 accounts—chilled legitimate activism on Twitter.94

Manipulation and overt disinformation proliferated online during the 2017 election season. 95 For instance, the British political consulting firm Cambridge Analytica reportedly aided Kenyatta’s reelection bid and was linked to two websites—TheRealRaila.com and UhuruForUs.com96—that respectively spread hate speech and negative ads about Odinga, then an opposition presidential candidate, and pushed positive narratives about the incumbent.97

Previously, a group of bloggers for hire known as the “36 Bloggers” was alleged to work within the Executive Office of the President’s Directorate of Digital Communication.98 Another group was known as the “527 militia,” with 527 ostensibly signifying the amount of Kenyan shillings paid to each blogger to promote certain hashtags.99 In 2019, bloggers for hire were generally most active on Facebook, Twitter, and WhatsApp, using both human-run and automated “bot” accounts to attack opposition figures and support the government, most often through targeted advertising and disinformation.100

There are few regulatory constraints that negatively affect users’ ability to publish content online, but media outlets’ reliance on revenue from government advertisements causes economic challenges for some entities.

The economic independence of the news ecosystem has been severely hampered by the COVID-19 pandemic, including for online outlets. Three hundred journalist jobs have been eliminated.101

The Government Advertising Agency (GAA) was established in 2015 to manage government advertising purchases. In August 2018, the DCI began an investigation of the GAA for allegedly failing to pay 2.8 billion shillings ($27 million) in advertising fees owed to media outlets.102 The Kenya Media Sector Working Group claimed in May 2019 that the GAA was actively working to muzzle the media by starving outlets of needed revenue.103 In July 2019, Cabinet Secretary Mucheru assured the media that all debts owed by the government would be paid.104 As of March 2020, the ICT Ministry reportedly owed media houses up to 2.5 billion shillings ($24 million).105 The debts remained pending as of December 2020.106

The government has been known to use its advertising budget to influence media outlets’ editorial choices, resulting in financially induced self-censorship.107 Some online outlets also adjust the tone of their content to avoid upsetting other major advertisers,108 though this phenomenon has been more frequently observed among traditional media outlets. For instance, in September 2020, the council of governors suspended advertising with Nation Media Group after the media house published a story on graft.109

Powerful, politically influential media owners have affected the editorial lines and reporting of their outlets to advance their own interests.110

The online information landscape is diverse and vibrant, with outlets reporting on many issues and offering a wide range of viewpoints. Social media platforms have become an important means for journalists to gather and share news. Traditional broadcast outlets have increasingly utilized social media and digital platforms to interact with users in real time.

Misinformation about the COVID-19 pandemic is widespread in Kenya, including on social media platforms like WhatsApp.111 The problem has affected the country’s ability to effectively manage the spread of the virus, with many residents of informal settlements reportedly believing that the virus cannot be contracted by Kenyans.112 The government has threated fines and imprisonment for people who spread false COVID-19 information via online channels (see C2).113

In October 2018, Facebook announced that it would partner with Africa Check, Africa’s first independent fact-checking organization, and Agence France-Presse (AFP) to help assess the accuracy of information being disseminated on its platform.114

Online tools for civic mobilization are freely available to users, but the authorities’ suppression of some forms of digital dissent limits their effectiveness. Social media, especially Twitter, continues to be a critical platform for debate, advocacy, and mobilization on issues of public interest.

In May 2020, social media users organized around the hashtag #EndPoliceBrutalityKE, reporting and tracking police brutality in Kenya and pushing for accountability.115 This online mobilization resulted in physical protests.116 In the face of exceptionally high youth unemployment,117 Kenyans also use the hashtag #IkoKaziKE as a resource to find jobs and share hiring opportunities.

In the spring of 2019, the police in Mombasa launched an operation to arrest people for allegedly using social media to “incite” others against registering for the National Integrated Identity Management System (NIIMS), a biometric registration system.118

In 2018, the hashtag #SwitchoffKPLC was used to raise awareness of and organize protests against the Kenya Power and Light Company (KPLC), which owns and operates most of the electricity transmission and distribution systems in the country, over inflated consumer bills.119 Online activists urged customers to submit their power bills to a Nairobi lawyer, who used them as evidence to file a petition against the company in court.120 In July 2018, 20 KPLC managers were charged with economic crimes and abuse of office, partly substantiating the lawyer’s petition.121 The case was settled out of court in October 2018, which led to mixed reactions from the public, as many people argued that the settlement was too lenient. The agreement stipulated that the KPLC must establish billing query centers across the country. According to the deal, customers can have their actual meter readings weighed against the KPLC's estimates to determine the amount owed.122

In February 2018, in the wake of the High Court’s decision against decriminalizing consensual same-sex conduct, Kenyans used the hashtag #Repeal162 to air their views on Twitter.123

Score Change: The score improved from 3 to 4 because the judiciary reaffirmed its independence in several high-profile rulings, including in cases that relate to freedom of expression online.

Freedom of expression is enshrined in Article 33 of the 2010 constitution and includes the rights to seek, receive, or impart information and ideas. However, these rights are frequently violated in practice, including for online journalists and other internet users. Propaganda, hate speech, and incitement to violence are not protected by the constitution.

The judiciary is relatively independent. In May 2021, five high court judges ruled that the constitutional review process advanced by President Kenyatta was unconstitutional. Known as the Building Bridges Initiative (BBI), the proposal sought to expand the executive arm of the government and was widely understood as an attempt by Kenyatta and former prime minister Odinga to consolidate power at the expense of Deputy President Ruto. The high court panel found that the BBI lacked public participation and could open President Kenyatta to lawsuits in his personal capacity.124 In August, after the coverage period, an appellate court upheld the panel’s ruling against the BBI.125

Also in May, the high court ruled that Section 66 of the penal code, which criminalized the publication of false information, violated the constitution (see C2).

In October 2020, the high court invalidated 23 laws on the grounds that they were passed by the National Assembly, the lower house of the Parliament, without consultation from the Senate, the upper house, violating the constitution. The ruling ordered the houses to consult on the 23 laws before July 2021; the deadline was later extended to November. The laws—which include provisions that infringe on the privacy of Kenyans (see C5)—remain in effect during the consultation.126

Some high-profile rulings have failed to protect the fundamental rights of online journalists and ordinary users. The Bloggers Association of Kenya (BAKE), with support from the rights group Article 19, filed a petition that led a court to temporarily suspend 26 sections of the Computer Misuse and Cybercrimes Act, 2018, before it came into effect in May 2018.127 In February 2020, however, High Court judge James Makau dismissed this petition and lifted the suspension of the 26 sections, which prescribe hefty fines and prison sentences for a range of online activities, including for publishing false information and cyberharassment (see C2).128

Beginning in February 2020, the government imposed movement restrictions to mitigate the spread of COVID-19, including a curfew announced in March.129 Despite a government order exempting the media, police have intimidated, threatened, attacked, and arrested journalists during the curfew.130 Similar restrictions were announced in March 2021 and partially lifted a month later.131

Law enforcement officers who unlawfully kill or injure Kenyans rarely face penalties. Officers often fail to comply with a law that requires the police to report, investigate, and prosecute extrajudicial killings.132 After the curfew was declared in March 2020, police tasked with enforcing it shot and beat people without justification, in some cases before the announced restrictions had officially taken effect.133 A government accountability body reported that police had killed at least 15 people and injured at least 31 between March and June 2020.134 Police officers continued to enforce lockdown restrictions with disproportionate force during the coverage period.135

Laws on hate speech and defamation are frequently used to prosecute online critics of the government, though courts have occasionally invalidated such provisions on constitutional grounds.

In May 2021, the high court invalidated Section 66 of the penal code, which barred the publication of false information, in response to charges brought against blogger Cyprian Nyakundi over controversial social media posts in 2018. The high court found that the provision violated constitutional protections for freedom of expression. Section 66 carried a penalty of up to three years’ imprisonment, a fine of up to five million shillings ($45,000), or both.136

The Computer Misuse and Cybercrimes Act, 2018, which was adopted in May 2018 and subsequently challenged in court, threatens to further restrict freedom of expression online. According to the act, anyone who “knowingly publishes information that is false in print, broadcast, data, or over a computer system, that is calculated or results in panic, chaos, or violence among citizens of the Republic, or which is likely to discredit someone’s reputation can be sentenced to a fine of as much as 5 million shillings ($45,000) and up to 10 years in prison.137

Shortly after the law was promulgated, BAKE sued to overturn 26 problematic provisions,138 which were suspended until the court could hear the case (see C1).139 A High Court judge ultimately dismissed BAKE’s case in February 2020, ruling that the law does not violate freedom of expression and allowing the suspended provisions to take effect. Later that month, BAKE and the Law Society of Kenya appealed the High Court’s ruling to the Court of Appeal.140

In March 2021, a bill was introduced to parliament proposing to amend the Computer Misuse and Cybercrimes Act, 2018, to prohibit the sharing of pornographic materials, with a penalty of a fine to 20 million shillings ($180,000), up to 25 years in prison, or both. The bill would ban any use of a computer to publish, produce, transmit, or store pornography.141

Also in February 2020, amid rising concern over COVID-19, government spokesperson Cyrus Oguna warned that those spreading false information related to the novel coronavirus on social media were being monitored and would face arrest under the cybercrimes act.142

In 2017, the High Court struck down Section 132 of the penal code on constitutional grounds; the section criminalized “undermining the authority of public officers” and had been used to prosecute both online and offline speech.143 Section 29 of KICA was separately ruled unconstitutional in 2016.144 It had penalized bloggers and social media users for using ICTs to disseminate messages deemed “grossly offensive” or to cause “annoyance, inconvenience or needless anxiety to another person,” carrying a fine of up to 50,000 shillings ($480), three years in prison, or both.145

Hate speech is penalized under the 2008 National Cohesion and Integration Act, which was passed in response to widespread ethnic violence following the 2007 general elections.146 Individuals found guilty of spreading hate speech, broadly defined, can face a fine of up to one million shillings ($9,600), a prison term of up to three years, or both.

Numerous bloggers and social media users were arrested or summoned for questioning during the coverage period, continuing an alarming trend.

In August 2020, Charles Gichuki was arrested and released without charge for publishing a website that tallied the amount of money lost to corruption during the current regime’s tenure.147 The site has since been offline, but an archived version still exists (see B2).148

In March 2021, KFCB chairman Mutua ordered the arrest of comedian Eric Omondi and 15 cast members of Omondi’s YouTube show “Wife Material.” Omondi was charged with violating the Film and Stage Plays Act, which requires certification from the KFCB to exhibit or distribute films. Omondi and Mutua reached an out-of-court settlement over the charges. Omondi later removed the “Wife Material” videos from YouTube after Mutua demanded he do so.149

In April 2021, human rights defender Mutemi Wa Kiama was arrested and charged under the cybercrimes act. Kiama had posted on social media calling for the IMF to halt loans to the Kenyan government.150 Kiama was later released without charges.151 Kiama was previously arrested in June 2020 after his home was raided, during which his phone and laptop were seized, after he shared a controversial thread on Twitter.152

In July 2020, Janet Magoma Ayonga and Patrick Rading Ambogo, both IT security officers, were charged under the Cybercrimes Act for allegedly leaking a video of President Kenyatta and former prime minister Raila Odinga that had surfaced online.153 The case was dismissed in November.154

In the same month, blogger Edgar Obare was arrested for social media posts that alleged a prominent YouTuber joined the governor of Mombasa on an international trip. Obare was charged for disclosing the YouTuber’s personal information, and released on bail.155 Obare accused authorities of kidnapping and assaulting him while he was traveling to a hearing in the case in November 2020 (see C7).156 Obare was subsequently arrested in March 2021 on charges of publishing false information. Kenyan police claimed Obare had coached a woman to claim that she was pregnant with the child of a state governor in order to extort money from the governor, and then wrote about the pregnancy on social media.157 Proceedings in the case remain ongoing.158

In August 2020, Milton Were of the news site Kenya Today and Jack Okinyi of the news site Business Illustrated were arrested for publishing an article alleging graft at the Kenya Urban Roads Authority.159

Controversial blogger Robert Alai was subjected to a gag order in April 2021, though he was not arrested. A healthcare facility had initiated defamation proceedings against Alai after he posted on Twitter insinuating that the facility was used for the trafficking of human organs.160 Previously, in March 2020, Alai had been charged with publishing false information after he posted on social media about alleged coronavirus deaths. He was released on bail after three days and ordered not to publish any more coronavirus-related information.161

Several other individuals have been arrested for allegedly sharing false information related to COVID-19. For instance, in July 2020, bloggers Isaac Kibet and Emanuel Kimutai Kosgei were arrested for a Facebook post claiming that Fred Matiang’i, Cabinet Secretary for the Ministry of Interior, was hospitalized after contracting COVID-19.162 Kibet was detained for two days before being released on bail.163

In March 2020, during the previous coverage period, blogger Cyprian Nyakundi was arrested for allegedly publishing false information related to the pandemic under the Computer Crimes and Misuse Act.164 Though he was freed on bail shortly after his arrest, a magistrate issued a warrant for Nyakundi to be rearrested in April, claiming that he had failed to present himself before the court.165

Separately the same month, Elijah Muthui Kitonyo was arrested under Section 23 of the Computer Misuse and Cybercrimes Act for “publishing misleading and alarming information” about the coronavirus on Twitter. The post in question implied that the government was misleading the public about coronavirus-related information.166

In January 2020, activist and blogger Mildred Owiso was arrested and later released on cash bail for allegedly inciting the public to violence. She had recorded an encounter with the traffic police and posted it online, arguing that it was unlawful for a traffic officer to enter the car of someone suspected of a traffic offense.167

Robert Alai was arrested in June 2019 for posting photos of police officers who were victims of a terrorist attack in Wajir County earlier that month. A police spokesperson warned internet users that circulating such images was “unpatriotic” and supportive of Al-Shabaab, the Somalia-based militant group believed to have perpetrated the attack.168 Later that month, Patrick Safari, a prison warden based in Mandera, was arrested for posting online pictures of officers from the same incident.169

Kenyans can freely use encryption tools, but a number of regulations and monitoring systems limit anonymous communication. Several publications and technology blogs often encourage Kenyans to install encryption tools.

Anonymity is compromised by the expanding scope of mandatory SIM-card registration and efforts to track the illicit sale of mobile phones. In April 2020, the Court of Appeal reversed a High Court decision barring the government’s plan to implement the Device Management System (DMS), a mechanism for identifying counterfeit and illegal phones.170 The High Court had ruled that the system, which gives the CA access to mobile subscriber data, including call records, would infringe on subscribers’ right to privacy, among other concerns.171 The Court of Appeal ruled that the High Court lacked evidence to reach this conclusion. Service providers had previously disclosed that personal data of subscribers would be handled by third parties contracted by the CA to maintain the DMS.172 In June 2020, the Law Society of Kenya appealed the case to the Supreme Court; while the appeal is considered, the DMS will be implemented.173

In 2017, Safaricom began keeping records of anyone registering for or renewing a SIM card.174 This was in compliance with existing SIM-card registration requirements under the Kenya Information and Communications (Registration of SIM-Cards) Regulations, 2015, which prescribe penalties of up to 300,000 shillings ($2,900), imprisonment for up to six months, or both for failure to abide by the registration requirements.175 The regulations also grant the communications regulator access to service providers’ offices and records without a court order, raising concerns about the lack of judicial oversight.176

In July 2019, legislators introduced a bill to amend KICA by requiring the registration of bloggers and assigning a penalty of up to 500,000 shillings ($4,800) in fines or two years’ imprisonment for blogging without a license.177 As of September 2021, the bill had not progressed.

Article 31 of the 2010 constitution provides for the right to privacy. However, authorities engage in surveillance of internet activities under laws that enable them to search and seize data on national security grounds, directly infringing on users’ privacy rights. The Data Protection Act, 2019, passed in November of that year, leaves room for officials to continue to bypass user consent and access private data for national security reasons (see C6).

In December 2020, the president signed a law that amended the Official Secrets Act, 1968, to require “any person who owns or controls any telecommunications apparatus used for the sending or receipt of any data to or from any place outside Kenya” to provide such data to the government. Such requests may be authorized by the president’s cabinet security, rather than through the courts. Those who refuse risk a one-year prison term, a fine of one million shillings, or both.178 The law was one of the 23 invalidated in October 2020 for unconstitutional procedure; it remains in effect pending the Parliament’s consultation to correct the procedure by which it passed, which must be completed by November 2021 (see C1).

During the 2017 election, officials at the electoral commission allegedly exploited their access to voters’ data—including information such as phone numbers, identification numbers, and photos—and sold them to politicians, who then targeted the voters with campaign messages in the run-up to the polls.179

In January 2020, a High Court ruling barred the government from proceeding with the implementation of NIIMS, a biometric registration system, until it developed a comprehensive regulatory framework. The court also prohibited the collection of genetic and satellite-based location data under NIIMS, finding that such collection violates Article 31 of the constitution.180

Despite the ruling, registration activities for the biometric identification cards, better known as Huduma Namba cards, continued throughout the coverage period.181 The law authorizing NIIMS was one of the 23 invalidated in October 2020 for unconstitutional procedure; it remains in effect pending the Parliament’s consultation to correct the procedure by which it passed, which must be completed by November 2021 (see C1).

Section 48 of the Computer Misuse and Cybercrimes Act, 2018, allows the authorities to search and seize stored computer data and to collect and intercept data in real time.182

KICA prohibits many forms of monitoring and interception of communications,183 though the Prevention of Terrorism Act, 2012, allows the authorities to limit constitutional freedoms, such as the right to privacy, during investigations into terrorism.184 Amendments to the Prevention of Terrorism Act in 2014 explicitly enabled national security bodies to intercept communications “for the purposes of detecting, deterring, and disrupting terrorism,”185 though this must be authorized through an interception order from the High Court.186

Independent research in recent years has revealed various surveillance technologies that the authorities or other actors may employ to monitor citizens. A December 2020 investigation by Citizen Lab identified the Kenyan government as a likely customer of Circles, a surveillance company. Products sold by Circles allow customers to monitor calls, texts, and cell phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure.187

Evidence of unlawful or disproportionate state surveillance has emerged in recent years. According to 2018 research published by Citizen Lab, a Canadian internet watchdog, Kenya is one of 45 countries worldwide where the use of Pegasus, a surveillance software tool developed by the Israeli technology firm NSO Group, has been detected. The spyware has targeted customers of Safaricom and Simbanet, and it is known to be used by governments elsewhere to intrusively monitor journalists, human rights defenders, and political opponents.188

In 2017, research published by the Centre for Intellectual Property and Information Technology Law (CIPIT) revealed the presence of a “middlebox” on a Safaricom mobile network.189 While middleboxes have legitimate functions, such as network optimization, they can also be used to manipulate traffic and assist in surveillance, which led to concerns about potential violations of privacy. Safaricom denied using a middlebox, and subsequent tests returned negative results, prompting the researchers to conclude that the technology was no longer in use.

The United Kingdom–based nonprofit organization Privacy International (PI) separately revealed in a 2017 report that national security agencies in Kenya, especially the National Intelligence Service (NIS), have unlawful direct access to communications systems, allowing for the interception of both traffic data and content.190 Based on interviews, PI found that law enforcement and national security agents have a physical presence in the facilities of telecommunications providers. The report also indicated that intercepted information could be freely shared with other government agencies.

PI also assessed two new NIS cybersecurity projects, the Network Early Warning System and the National Intrusion Detection and Prevention System, which aim to monitor telecommunications traffic for cybersecurity threats. PI raised concerns that the two systems could monitor content as well as traffic, based on internal documents it received.191 Given the national security framework in which the systems are being implemented, transparency and oversight will be limited.

Service providers and other technology companies are not usually required to aid the government in monitoring the communications of their users, although authorities have reportedly made requests for such assistance. A data protection law passed in November 2019 offers safeguards for user data but includes broad exemptions that allow the government to sidestep the protections, endangering the right to privacy.

The Data Protection Act, 2019, regulates the collection, processing, storage, use, and disclosure of information relating to individuals.192 Processing that is “necessary for national security or public interest” is broadly exempted from the law’s protections, opening the door to government abuse. The law establishes the Office of the Data Commissioner to oversee implementation, but the new entity has not been classified as an independent office under the constitution, raising concerns about its autonomy.193

In October 2020, Immaculate Kassait, formerly an official of the Independent Electoral and Boundaries Commission, was appointed as Kenya’s first data commissioner.194 Draft regulations to implement the Data Protection Act were introduced in April 2021. The regulations, which remained under consideration by the end of the coverage period, have been criticized for inadequately protecting the rights of data subjects and not exempting data processing for journalistic purposes.195

Other laws, like the Preservation of Public Security Act, the Official Secrets Act, the National Intelligence Act, 2012, and the Prevention of Terrorism Act, limit the privacy of personal data, ostensibly to safeguard national security.196

In November 2018, the CA released a tender for the development of a regulatory strategy for over-the-top (OTT) video streaming services such as those offered by WhatsApp, Skype, and Facebook.197 The tender was extended to end in May 2019; no further information was available during the coverage period.198

PI has reported that Safaricom, the leading mobile internet provider, routinely supplies data to authorities without a warrant for intelligence purposes. Safaricom claims that it only cooperates when authorities present a court order.199

Bloggers and internet users have faced increasing intimidation and violence in retaliation for their online activities in recent years.

In November 2020, blogger Edgar Obare accused Kenyan police of kidnapping and assaulting him while Obare was traveling to a hearing; Obare faced charges of unlawfully disclosing personal information online (see C3).200

More than a quarter of Kenyan women have experienced some form of online gender-based violence, according to an August 2020 report from Pollicy, a technology consulting firm.201 In April 2020, Brenda Cherotich, one of the first Kenyans to be publicly identified as a person who recovered from COVID-19, faced extensive online harassment, including the nonconsensual sharing of her private chats and photos.202 Women in politics encountered especially harsh online harassment during the pandemic, according to a brief from the Kenya ICT Action Network (KICTANet).203

During the restive 2017 election period, authorities often destroyed the cameras and phones of journalists to suppress reporting on violence and human rights violations.204 The heightened political tensions also led to more instances of intimidation and harassment in retaliation for online activities. There was rampant online harassment of female candidates to deter their political ambitions,205 and it was often accompanied by offline sexual harassment and violence.206

Ordinary users can face retaliation for online activity that impacts their livelihoods. In February 2019, the Machakos County government suspended Dr. Alice Kasyoka from practicing medicine after she criticized county officials in a Facebook post. During her suspension, Kasyoka was paid half of her salary.207

Hacking and other forms of cyberattack are a growing problem in Kenya. The National Computer Incident Response Team detected 35.2 million cyberthreats in the period from July to September 2020, up from 25.2 million during the previous year.208

Since 2015, Kenya has been subjected to scores of cyberattacks, many of which were directed at financial institutions. For instance, in October 2021, two students were charged with allegedly stealing 24.4 million shillings ($244,000) by hacking a bank’s mobile money platform.209

Under the Computer Misuse and Cybercrimes Act, 2018, hackers face a fine of up to 5 million shillings ($48,000), up to three years in prison, or both for unauthorized access to, interference with, or interception of data on computer systems; unauthorized disclosure of passwords; and cyberespionage, among other offenses.210