Internet access is somewhat limited by poor infrastructure, but penetration rates and connection speeds continue to improve.

According to DataReportal’s Digital 2022 report, Kenya’s internet penetration rate was 42 percent as of January 2022.1 The CA, the national telecommunications regulator, reported that the total number of data and internet subscriptions increased to 44.88 million in September 2021 from 43 million in September 2020. The regulator also reported 64.89 million mobile phone subscriptions, representing a mobile penetration rate of 133.3 percent as of September 2020, up from 125.8 percent the previous year.2 A penetration rate above 100 percent indicates that some users have more than one mobile subscription. The CA further reports that third- and fourth-generation (3G and 4G) mobile network subscriptions respectively stand at 26.63 percent and 28.61 percent of Kenya’s population of 48.7 million.

Average connection speeds increased to 11.27 megabits per second (Mbps) in 2021, from 8.2 Mbps in 2019, according to Cable, a UK-based telecommunications company.3

In March 2021, Safaricom, Kenya’s leading telecommunications company, activated 5G services in four major urban centers and planned to expand service to 150 additional sites over the next 12 months.4 However, in May 2022, Safaricom’s chief executive officer announced it would slow the expansion of 5G mobile services due to high mobile phone costs and would instead focus on delivering 5G services to residences and offices covered by fiber-optic infrastructure.5

The National Optic Fibre Backbone Infrastructure project aims to increase internet connectivity across the country and improve the delivery of e-government services.6 Under the Kenya Vision 2030 development plan, currently in its third phase (2018–22), the government has prioritized the expansion of information and communication technology (ICT) capacity, with internet connectivity as a central pillar.7

Internet users in Kenya occasionally experience outages in internet services. In January 2022, Telkom users experienced a nationwide disruption, which lasted a few hours.8 Airtel users experienced data service outages in June9 and August 2020.10 Safaricom users experienced interruptions to data and voice services in August 201911 and to data services in November 2019.12

Since the outbreak of COVID-19, which has led many businesses and educational institutions to move their operations online, internet service providers (ISPs) have taken steps to improve bandwidth and meet increased demand.13

Internet access remains prohibitively expensive for much of the population, despite significant investments meant to improve rural connectivity.

In the Alliance for Affordable Internet’s 2021 Affordability Drivers Index, Kenya ranks 12th out of the 34 African countries surveyed, which was a drop from its ranking in 2020.14

As a result of the COVID-19 pandemic, Kenyans rely even more on the internet for work and learning. However, the results of a survey released in May 2020 indicate that just 22 percent of children can access digital learning, and public schools are often unable to support such services. The survey found poverty to be the main barrier inhibiting access.15

Following a lawsuit against Safaricom, Airtel, and Telkom for their data-expiration practices,16 Safaricom rolled out nonexpiry data bundles in October 2019, and Airtel rolled out its own in December.17 However, in the instance of Safaricom, nonexpiry data plans cost the same as expiring data packages but with half as much data. Crucially, this applies to the cheaper bundles and not the more expensive ones, affecting subscribers with less disposable income for data.18

The Finance Act, which was signed by Kenyatta in September 2018, increased the tax on telephone and internet data from 10 percent to 15 percent.19 In response to the tax, ISPs raised prices for both mobile data bundles and fixed-line home internet connections,20 making internet access unaffordable for many poorer Kenyans.

The affordability and availability of internet services vary between urban and rural areas. A gender-based digital divide also persists, with more men than women using mobile and internet services.21 Many rural areas have not benefited from Kenya’s high-capacity bandwidth, in part due to market disparities and weaknesses in last-mile connectivity, which is expensive and requires basic infrastructure such as electricity and roads that are often poorly developed. The Universal Service Fund (USF), which was established in 2013, aims to expand mobile and internet service in a bid to close the digital divide.22

The Voice Infrastructure and Services Project, a USF initiative administered by the CA, had connected 68 rural sublocations to basic mobile telephony as of November 2019, affecting 290,000 Kenyans who were previously unable to make and receive calls.23 The CA awarded 1.57 billion Kenyan shillings ($13.8 million) in contracts to develop further infrastructure for the project in February 2021.24 The Education Broadband Connectivity Project, another USF initiative, provided 887 secondary schools with 5 Mbps internet connections as of October 2019.25

There were no reports of the government using control over internet infrastructure to limit connectivity during the coverage period. In June 2021, Interior Minister Fred Matiang’i said the government would not disrupt connectivity during the August 2022 elections.26 Even after the government gave Facebook seven days to tackle hate speech on its platform in August 2022, days ahead of the August 9 polls (see B7), ministers reiterated the government would not disrupt connectivity.27 Kenya’s decentralized internet infrastructure and nongovernmental control of the Kenya Internet Exchange Point (KIXP) make it unlikely that the government could exercise technical control over the internet.

In July 2019, the ICT Authority introduced a regulation that requires all owners of fiber-optic infrastructure to register existing networks and seek approval for any new installations.28 The ICT Authority is likely to treat the registration process for existing networks as a de facto approval process that could prove cumbersome, rather than a straightforward registration mechanism, though it is unclear whether the regulation will involve the imposition of fees.29

Kenya connects to the international internet via four main undersea cables—SEACOM, the East Africa Marine System (TEAMS), the Eastern Africa Submarine Cable System (EASSY), and the Lower Indian Ocean Network (LION2); three others—Africa1, Djibouti Africa Regional Express (DARE), and Liquid Sea—land in Mombasa.30 The provision of licenses for access to the international gateway was liberalized in 2004.31

The KIXP is operated by the Telecommunication Service Providers Association of Kenya (TESPOK), a nonprofit organization representing the interests of ISPs. The KIXP keeps domestic Kenyan internet traffic within the country, lowering the cost of connectivity. A second IXP was established in Mombasa, but its failure to attract enough users led to its closure in 2015.32 With support from the African Union, a backup IXP was established in 2016 to further lower the costs of connectivity for ISPs.33

Economic obstacles restrict the diversity of service providers in Kenya. There are five mobile service providers: Safaricom (which holds a 64.6 percent market share as of September 2021), Airtel (26.4 percent), Telkom (6.4 percent), Equitel (2.3 percent), and Jamii Telecommunication (0.3 percent).34

In March 2022, Airtel and Telkom were fined 26.3 million shillings ($231,900) and 11.4 million shillings ($100,500) respectively because they did not provide sufficiently high-quality service as stipulated by the CA.35

In December 2021, a proposed merger between Airtel and Telkom collapse; the National Treasury had previously been warned by Parliament not to approve the deal.36 A court had ruled the companies had sufficient regulatory approval to proceed and quashed an inquiry from an anticorruption commission in February 2021.37 The CA initially approved the merger in September 2019.38

The government owns 35 percent of Safaricom39 and 40 percent of Telkom.40 Because Safaricom holds a majority of the market, there have been calls to declare it a dominant player, which could force the company to spin off its mobile money service in an effort to foster greater competition.41 A bill introduced in March 2021 could have compelled Safaricom, Airtel, and Telkom to split their telecommunications businesses from their mobile money holdings.42 However, as of August 2021, the bill garnered no interest and was subsequently tabled by the government.43

Previously, in January 2018, the CA dropped plans to split Safaricom amid fierce resistance from the company and other powerful business interests.44 In July 2018, the Parliamentary Committee on Communication, Information, and Innovation opened an investigation into the mobile sector to identify legislative and regulatory gaps that may lead to anticompetitive behavior or restrict growth.45

The CA is the regulatory body that licenses all communications systems.46 As of April 2018, it listed 3 providers with submarine-cable landing rights and 57 network facility providers (3 of which are national providers, while the remainder are regional).47 These licensees provide, among other things, facilities for internet, voice, and mobile virtual operations. Cybercafés are licensed as business units by local governments, and there are no special regulatory or economic obstacles to their establishment.

The regulatory bodies that oversee service providers generally operate in a fair manner, but there have been some encroachments on regulators’ independence in the past. The CA was managed by an acting director general between August 2019 and October 2021, amid leadership struggles within the regulator.

The CA’s management is vested in a board of directors that consists of a chairperson appointed by the president, three principal secretaries hired by the Public Service Commission, and seven persons appointed by the cabinet secretary of the ICT Ministry.48 The day-to-day operations of the regulator are managed by a director general who is appointed by the board to a four-year term, renewable only once.49 The director general is an ex officio member of the board without any voting rights.

While the authority’s independence is provided for under Section 5 of the Kenya Information and Communications Act (KICA), tensions between the ICT Ministry and the board of directors on one side, and the director general of the CA on the other, have flared up in recent years.

In October 2021, former Independent and Electoral Boundaries Commission (IEBC) chief executive Ezra Chiloba was appointed CA director general.50 During his tenure at the IEBC, Chiloba oversaw a controversial election marred by technical disruptions.

The August 2019 exit of the previous director general, Francis Wangusi, was marred by confusion. In July 2019, ICT Cabinet Secretary Joe Mucheru announced four new board members for the CA.51 In November 2019, a court found the appointments unconstitutional and contrary to the Public Service Commission Act, 2017, which requires advertisement for positions and competitive recruitment procedures. The ruling produced some confusion regarding the appointment of a successor for Wangusi, as it cast doubt on whether the board tasked with making the new appointment was properly constituted.52

Wangusi had clashed with the board and the ICT Ministry on a variety of topics. For instance, the two sides disagreed about how to implement a report on Safaricom’s market dominance.53

Political and social content is generally not subject to blocking in Kenya. Testing by the Open Observatory of Network Interference (OONI) revealed no signs of website blocking or censorship as of May 2022.54 Social media platforms and communication applications such as Facebook, Twitter, YouTube, and LinkedIn were also fully accessible.55

In July 2022, the National Cohesion and Integration Commission (NCIC), Kenya’s ethnic watchdog, threatened to suspend Facebook operations if the platform did not take steps to eliminate hate speech (see B7). In August 2022, the ICT minister clarified that the ministry would not block social media platforms during the election and stated it was not clear what legal framework would be used to suspend Facebook.56 Later that month, Access Now reported that it received no reports of disruption during the polls.57

The internet remained unrestricted during the tense period following the contested 2017 presidential election, including when the government jammed the broadcast signals of three leading television stations that were planning to air then opposition leader Raila Odinga’s unofficial inauguration in January 2018.58 The networks’ websites were not blocked, enabling them to stream the event online.59

Although censorship is not systematic, the state has increasingly sought to remove online content that it deems immoral or defamatory.

The Kenya Film Classification Board (KFCB) prohibited online and offline distribution, exhibition, and broadcast of the films Baadhai Do in February 202260 and I Am Samuel in September 2021.61 The KFCB claimed the films were inappropriate for Kenyan audiences because they attempted to normalize same-sex relationships. The penal code criminalizes same-sex sexual activity, and the KFCB routinely censors LGBT+ content.62

In March 2021, then KFCB chairman Ezekiel Mutua ordered comedian Eric Omondi to take down episodes of his YouTube show Wife Material, calling the videos pornographic. Omondi complied. Prior to the removal of the videos, Omondi was arrested on Mutua’s orders, alongside 15 Wife Material cast members (see C3). Omondi was charged with violating the Film and Stage Plays Act, which requires certification from the KFCB to exhibit or distribute films. Omondi and Mutua reached an out-of-court settlement over the charges.63

In August 2020, during the previous coverage period, a website that tallied the amount of money lost to corruption during the Kenyatta administration went offline after Charles Gichuki, who ran the website, was arrested (see C3).64

The government also occasionally requests content removals for reasons other than morality. Between July and December 2021, Google received 6 takedown requests from Kenyan authorities; 2 were due to defamation, 2 were over obscenity issues, 1 was for privacy reasons, and 2 were requested for "other" reasons. During the same period, Meta reported no content restrictions specifically imposed in Kenya.65

Authorities have sometimes compelled ordinary users and online journalists to delete content from their social media profiles and websites. In December 2018, a court ordered blogger Cyprian Nyakundi to remove an article on his website that allegedly defamed politician Steve Mbogo.66

Restrictions on the internet are largely transparent, but censorship of online content sometimes lacks fairness or proportionality.

In March 2021, Aden Duale, a parliamentarian with the ruling Jubilee Coalition, introduced a bill in the National Assembly to empower the National Computer and Cybercrimes Coordination Committee (NCCCC) to “recommend websites to be rendered inaccessible” within Kenya if they are pornographic in nature, or otherwise promote terrorism or cult or religious activities deemed extreme.67 The NCCCC is a government-appointed body that lacks transparency and public oversight mechanisms (see C2). The bill was still being considered during the coverage period.68

The KFCB has justified banning advertisements that contain sexual content and promote abortion services (see B2) by invoking a law that prohibits the airing of sexual content before 10 p.m. Those found to have distributed video content without KFCB approval face fines of up to 100,000 shillings ($880) and prison terms of up to five years,69 as outlined in the Films and Stage Plays Act, 2012.70

In advance of the 2017 election, the CA implemented new guidelines to curb online abuse in partnership with the NCIC, a statutory body that works to reduce interethnic conflict.71 The broadly worded guidelines prohibit political messages that “contain offensive, abusive, insulting, misleading, confusing, obscene, or profane language,” and analysts warned that they could be used to limit legitimate online expression. The guidelines also require administrators of social media pages to “moderate and control the content and discussions generated on their platform” and give mobile service providers the power to block the transmission of political messages that do not comply with the guidelines at their discretion.72 In addition, bulk political messages require prior approval from the NCIC.

Internet intermediaries in Kenya can be held liable for illegal content, such as copyright infringements and hate speech, though they are not required to actively monitor traffic passing through their networks unless they are made aware of illegal content.73 Under the National Cohesion and Integration Act, 2008 (NCIA) which outlaws hate speech, a media enterprise can be fined up to one million shillings ($8,800) for publishing hate speech, which is broadly defined in the legislation.74 This provision can be invoked to block or take down online content, according to the Association of Progressive Communications.75

Arrests of online journalists and statements by media regulators have prompted concerns about self-censorship by the press. The importance of government advertising purchases for the financial survival of media outlets, including those that publish online, results in some self-censorship among journalists (see B6).

In a lawsuit challenging the arrests of bloggers for allegedly posting false or alarming information about COVID-19 (see C3), the Law Society of Kenya argued that such arrests and convictions would encourage self-censorship by online publishers.76

Separately in March 2020, the Kenya Editors’ Guild voiced concern that a statement by the Media Council of Kenya (MCK), a media regulator, could increase self-censorship among journalists. The regulator had accused editors of breaching the code of conduct in the practice of journalism. 77

According to the MCK, there were 10 violations of press freedom as of February 2022, 70 in 2021, and 93 in 2020. The police and other government authorities are reportedly responsible for most of the attacks against journalists.78 Such attacks have a chilling effect on speech and can lead to self-censorship online.

Online sources of information are not systematically controlled or manipulated by the government or other powerful actors to advance a particular political interest. Coordinated online campaigns have been observed on politically sensitive topics.

In February 2022, researchers from the Mozilla Foundation revealed that CitizenGO, a right-wing group based in Spain, used disinformation and inflammatory language to influence Twitter conversations about Kenyan reproductive health policy. Twitter subsequently suspended 240 accounts connected to this group. According to the report, CitizenGO likely coordinated 11 Twitter campaigns by sending instructions, money, and content to Kenyan users, who would spread messaging via Twitter and WhatsApp.79

Another Mozilla Foundation report, released in June 2022 and after the coverage period, revealed that TikTok was being used to spread hate speech, incitement against communities, and manipulated content ahead of the August 2022 elections. Researchers identified several videos that were widely viewed and contained manipulated content, including a falsified Kenya Television Network bulletin discussing a false opinion poll, a video of an inauthentic tweet from US president Joe Biden, and videos displaying fake newspaper covers.80

Loosely organized “bloggers for hire” use their collective social media clout to shape public opinion and manipulate the online information landscape.81 For instance, a network of accounts amplified content that discredited then deputy president William Ruto in order to support Kenyatta and former prime minister Odinga, according to a June 2020 report. The accounts sought to position the content in the top trending topics in Kenya that May.82 Commentators also alleged that the government coordinated social media users83 to discredit protesting health-care workers in December 2020; the workers mobilized over working conditions after a young doctor, whose salary had gone unpaid for months, died of COVID-19.84

Researchers identified at least eight disinformation campaigns aimed at Kenyan Twitter users between May and June 2021. The campaigns amplified narratives to support the constitutional review process (see C1), discredit civil society activists opposed to the review, and delegitimize judges perceived as opponents of Kenyatta. In some cases, participants in the disinformation campaigns were coordinated over WhatsApp groups and paid the equivalent of $10 to $15 a day to boost the narratives on Twitter. The researchers found that the extent of the campaigns—over 23,000 posts distributed by 3,700 accounts—impacted legitimate activism on Twitter.85

Manipulation and overt disinformation proliferated online during the 2017 election season. 86 For instance, the British political consulting firm Cambridge Analytica reportedly aided Kenyatta’s reelection bid and was linked to two websites—TheRealRaila.com and UhuruForUs.com87 —that respectively spread hate speech and negative ads about Odinga, then an opposition presidential candidate, and pushed positive narratives about the incumbent.88

Previously, a group of bloggers for hire known as the “36 Bloggers” was alleged to work within the Executive Office of the President’s Directorate of Digital Communication.89 Another group was known as the “527 militia,” with 527 ostensibly signifying the amount of shillings paid to each blogger to promote certain hashtags.90 In 2019, bloggers for hire were generally most active on Facebook, Twitter, and WhatsApp, using both human-run and automated bot accounts to attack opposition figures and support the government, most often through targeted advertising and disinformation.91

There are few regulatory constraints that negatively affect users’ ability to publish content online, but media outlets’ reliance on revenue from government advertisements causes economic challenges for some entities.

The economic independence of the news ecosystem has been severely hampered by the COVID-19 pandemic, including for online outlets. In November 2020, Kenya Union of Journalists president Eric Oduor reported that 300 journalist jobs had been lost.92

The Government Advertising Agency (GAA) was established in 2015 to manage government advertising purchases. In August 2018, the Directorate of Criminal Investigation began an investigation of the GAA for allegedly failing to pay 2.8 billion shillings ($27 million) in advertising fees owed to media outlets.93 The Kenya Media Sector Working Group claimed in May 2019 that the GAA was actively working to muzzle the media by starving outlets of needed revenue.94 In July 2019, Cabinet Secretary Mucheru assured the media that all debts owed by the government would be paid.95 As of March 2020, the ICT Ministry reportedly owed media houses up to 2.5 billion shillings ($24 million).96 The debts remained pending as of July 2022.97

The government has been known to use its advertising budget to influence media outlets’ editorial choices, resulting in financially induced self-censorship (see B4).98 Some online outlets also adjust the tone of their content to avoid upsetting other major advertisers,99 though this phenomenon has been more frequently observed among traditional media outlets. For instance, in September 2020, the Council of Governors suspended advertising with Nation Media Group after the media house published a story on graft.100

Powerful, politically influential media owners have affected the editorial lines and reporting of their outlets to advance their own interests.101

The online information landscape is diverse and vibrant, with outlets reporting on many issues and offering a wide range of viewpoints. Social media platforms have become an important means for journalists to gather and share news. Traditional broadcast outlets have increasingly utilized social media and digital platforms to interact with users in real time. However, recent reports published during and after the coverage period have revealed that social media and digital platforms are being used to share misinformation that stokes ethnic rivalries (see B5).

In July 2022, after the coverage period, the NCIC threatened to suspend Facebook operations in the country if the platform could not address hate speech and inciteful language being disseminated during the run-up to the August 2022 elections, after it was revealed that Facebook approved 20 political advertisements containing hate speech.102

COVID-19-related misinformation is widely spread in Kenya, including on social media platforms like WhatsApp.103 The problem has affected the country’s ability to effectively manage the spread of the virus, with many residents of informal settlements reportedly believing that the virus cannot be contracted by Kenyans.104

In October 2018, Facebook announced that it would partner with Africa Check, Africa’s first independent fact-checking organization, and Agence France-Presse (AFP) to help assess the accuracy of information being disseminated on its platform.105

Online tools for civic mobilization are freely available to users, but the authorities’ suppression of some forms of digital dissent limits their effectiveness. Social media, especially Twitter, continues to be a critical platform for debate, advocacy, and mobilization on issues of public interest.

In May 2022, Twitter suspended 22 accounts of activists who had participated in the #njaaRevolution campaign, an online campaign protesting increasing food and commodity prices. Several suspended accounts were permanently suspended with no clear explanation on Twitter’s part. Civil society organizations voiced concerns that these suspensions constituted censorship during the critical preelectoral period.106

Kenyan users have also engaged in other hashtag campaigns, such as the #ProtectQueerKenyans and #JusticeForSheila campaigns which started after a member of the LGBT+ community was murdered in their home in April 2022.107

In May 2020, social media users organized around the hashtag #EndPoliceBrutalityKE, reporting and tracking police brutality in Kenya and pushing for accountability.108 This online mobilization resulted in physical protests.109 In the face of exceptionally high youth unemployment,110 Kenyans also use the hashtag #IkoKaziKE as a resource to find jobs and share hiring opportunities.

In early 2019, police in Mombasa launched an operation to arrest people for allegedly using social media to “incite” others against registering for the National Integrated Identity Management System (NIIMS), a biometric registration system.111

Freedom of expression is enshrined in Article 33 of the 2010 constitution and includes the rights to seek, receive, or impart information and ideas. However, these rights are frequently violated in practice, including for online journalists and other internet users.

The judiciary is relatively independent. In April 2022, the Supreme Court ruled that the constitutional review process advanced by President Kenyatta was unconstitutional. 112 Known as the Building Bridges Initiative (BBI), the proposal sought to expand the executive arm of the government and was widely understood as an attempt by Kenyatta and former prime minister Odinga to consolidate power at William Ruto’s expense. A High Court panel previously found that the BBI lacked public participation and could open Kenyatta to lawsuits in his personal capacity,113 though this decision was contested several times.114

In May 2021, during the previous coverage period, the High Court ruled that Section 66 of the penal code, which criminalized the publication of false information, violated the constitution (see C2).

In October 2020, the High Court invalidated 23 laws on the grounds that they were passed by the National Assembly, the lower house of the Parliament, without consultation from the Senate, the upper house, violating the constitution. The ruling ordered both chambers to consult on the 23 laws before July 2021; the deadline was later extended to November. The laws—which include provisions that infringe on the privacy of Kenyans (see C5)—remained in effect during the coverage period.115

Some high-profile rulings have failed to protect the fundamental rights of online journalists and ordinary users. The Bloggers Association of Kenya (BAKE), supported by rights group Article 19, filed a petition that led a court to temporarily suspend 26 sections of the Computer Misuse and Cybercrimes Act, 2018 (CMCA), before it came into effect in May 2018.116 In February 2020, however, High Court judge James Makau dismissed this petition and lifted the suspension of the sections, which prescribe hefty fines and prison sentences for a range of online activities including publishing false information and cyberharassment (see C2).117

Laws on hate speech and defamation are frequently used to prosecute online critics of the government, though courts have occasionally invalidated such provisions on constitutional grounds.

In May 2021, the High Court invalidated Section 66 of the penal code, which barred the publication of false information, in response to charges brought against blogger Cyprian Nyakundi over controversial social media posts in 2018. The court found that the provision violated constitutional free-expression protections. Section 66 carried a penalty of up to three years’ imprisonment, a fine of up to 5 million shillings ($44,000), or both.118

The CMCA, which was adopted in May 2018 and subsequently challenged in court, threatens to further restrict freedom of expression online. According to the act, anyone who “knowingly publishes information that is false in print, broadcast, data, or over a computer system, that is calculated or results in panic, chaos, or violence among citizens of the Republic,” or which is likely to discredit someone’s reputation can be sentenced to a fine of as much as 5 million shillings ($44,000) and up to 10 years in prison.119

Shortly after the law was promulgated, BAKE sued to overturn 26 problematic provisions,120 which were suspended until the court could hear the case (see C1).121 A High Court judge ultimately dismissed BAKE’s case in February 2020, ruling that the law does not violate freedom of expression and allowing the suspended provisions to take effect. Later that month, BAKE and the Law Society of Kenya appealed the High Court’s ruling to the Court of Appeal.122 This case has not yet been heard at the end of the coverage period.

In March 2021, a bill was introduced to Parliament proposing to amend the CMCA to prohibit the sharing of pornographic materials, with a penalty of a fine to 20 million shillings ($176,000), up to 25 years in prison, or both. The bill would ban any use of a computer to publish, produce, transmit, or store pornography.123

In February 2020, amid rising concern over COVID-19, government spokesperson Cyrus Oguna warned that those spreading false information related to the novel coronavirus on social media were being monitored and would face arrest under the cybercrimes act.124

In 2017, the High Court struck Section 132 of the penal code on constitutional grounds; the section criminalized “undermining the authority of public officers” and had been used to prosecute both online and offline speech.125 Section 29 of KICA was separately ruled unconstitutional in 2016.126 It had penalized bloggers and social media users for using ICTs to disseminate messages deemed “grossly offensive” or to cause “annoyance, inconvenience or needless anxiety to another person,” carrying a fine of up to 50,000 shillings ($440), three years in prison, or both.127

Hate speech is penalized under the NCIA, which was passed in response to widespread ethnic violence following the 2007 general elections.128 Individuals found guilty of spreading hate speech, broadly defined, can face a fine of up to 1 million shillings ($8,800), a prison term of up to three years, or both.

Score Change: This score improved from 3 to 4 because there were fewer reported arrests and prosecutions of individuals in retaliation for their online posts during the coverage period.

During the coverage period, individuals were arrested for publishing false information online. Arrests and prosecutions occurred less frequently compared to previous coverage periods.

In January 2022, a teacher was arrested and charged with cyberharassment and publishing false information after posting on Facebook that the head of the Teacher Service Commission was dead. 129 The status of his case was unknown at the end of the coverage period.

In August 2021, a businessman and his son were charged under the CMCA for saying that the brother of Mombasa’s governor hired individuals to carry out an attack in a social media post. Authorities alleged that the two knowingly published false information and that the information damaged the governor’s reputation.130

In August 2020, Charles Gichuki was arrested and released without charge for publishing a website that tallied the amount of money lost to corruption during the current regime’s tenure.131 The site has since gone offline, but an archived version still exists (see B2).132

In March 2021, then KFCB chairman Mutua ordered the arrest of comedian Eric Omondi and 15 cast members of Omondi’s YouTube show Wife Material. Omondi was charged with violating the Film and Stage Plays Act, which requires certification from the KFCB to exhibit or distribute films. Omondi and Mutua reached an out-of-court settlement over the charges. Omondi later removed the Wife Material videos from YouTube after Mutua demanded he do so (see B2).133

Controversial blogger Robert Alai was subjected to a gag order in April 2021, though he was not arrested. A health-care facility had initiated defamation proceedings against Alai after he posted on Twitter insinuating that the facility was used for organ trafficking.134 Previously, in March 2020, Alai had been charged with publishing false information after he posted on social media about alleged coronavirus deaths. He was released on bail after three days and ordered not to publish any more coronavirus-related information.135

Kenyans can freely use encryption tools, but a number of regulations and monitoring systems limit anonymous communication. Several publications and technology blogs often encourage Kenyans to install encryption tools.

Anonymity is compromised by the expanding scope of mandatory SIM-card registration and efforts to track the illicit sale of mobile phones. In March 2022, the CA announced that all unregistered SIM cards would be deactivated by April 2022, and urged individuals with SIM cards more than 10 years old to reregister. 136 During the reregistration process, authorities have been collecting pictures of identification documents,137 even though this is not required under the Registration of SIM Cards Regulation, 2015.138 In addition, individuals under the age of 18 are required to present a copy of their birth certificate to register their SIM cards.139 The government stated that those in possession of unregistered SIM cards would face fines of up to 300,000 shillings ($2,650), a six month prison sentence, or both.140 The deadline for registration was later pushed to October 2022.141

In April 2020, the Court of Appeal permitted the government to implement the Device Management System (DMS), a mechanism for identifying counterfeit and illegal phones.142 In June 2020, the Law Society of Kenya appealed the case to the Supreme Court, over concerns that the DMS, which gives the CA access to mobile subscriber data including call records, would infringe on subscribers’ right to privacy.143

In 2017, Safaricom began keeping records of anyone registering for or renewing a SIM card.144 This was in compliance with existing SIM-card registration requirement.145 The regulations also grant the communications regulator access to service providers’ offices and records without a court order, raising concerns about the lack of judicial oversight.146

Article 31 of the 2010 constitution provides for the right to privacy. However, authorities surveil of internet activities under laws that enable them to search and seize data on national security grounds, directly infringing users’ privacy rights. The Data Protection Act, 2019 (DPA), passed that November, leaves room for officials to continue to bypass user consent and access private data for national security reasons (see C6).

In December 2020, the president signed a law that amended the Official Secrets Act, 1968 (OSA) to require “any person who owns or controls any telecommunications apparatus used for the sending or receipt of any data to or from any place outside Kenya” to provide such data to the government. Such requests may be authorized by the president’s cabinet security, rather than through the courts. Those who refuse risk a one-year prison term, a fine of 1 million shillings ($8,800), or both.147 The law was one of the 23 invalidated in October 2020 for unconstitutional procedure; it remains in effect pending Parliament’s consultation to correct the procedure by which it passed, which continued during the coverage period (see C1).

During the 2017 election, officials at the electoral commission allegedly exploited their access to voters’ data—including information such as phone numbers, identification numbers, and photos—and sold them to politicians, who then targeted the voters with campaign messages in the run-up to the polls.148

In January 2020, a High Court ruling barred the government from proceeding with the implementation of NIIMS, a biometric registration system, until it developed a comprehensive regulatory framework. The court also prohibited the collection of genetic and satellite-based location data under NIIMS, finding that such collection violates Article 31 of the constitution.149

Despite the ruling, registration activities for the biometric identification cards, better known as Huduma Namba cards, continued throughout the coverage period.150 The law authorizing NIIMS was one of the 23 invalidated in October 2020 for unconstitutional procedure; it remains in effect pending Parliament’s consultation to correct the procedural defect (see C1).

Section 48 of the CMCA allows the authorities to search and seize stored computer data and to collect and intercept data in real time.151

KICA prohibits many forms of monitoring and interception of communications,152 though the Prevention of Terrorism Act, 2012 (PTA) allows the authorities to limit constitutional freedoms, such as the right to privacy, during investigations into terrorism.153 Amendments to the PTA in 2014 explicitly enabled national security bodies to intercept communications “for the purposes of detecting, deterring, and disrupting terrorism,”154 though this must be authorized through an interception order from the High Court.155

Independent research in recent years has revealed various surveillance technologies that authorities or other actors may employ to monitor citizens. A December 2020 investigation by Citizen Lab identified the Kenyan government as a likely customer of Circles, a surveillance company. Circles products allow customers to monitor calls, texts, and cell phone geolocation by exploiting weaknesses in mobile telecommunications infrastructure.156

Evidence of unlawful or disproportionate state surveillance has emerged in recent years. According to 2018 research published by Citizen Lab, Kenya is one of 45 countries worldwide where the use of Pegasus, a surveillance software tool developed by the Israeli technology firm NSO Group, has been detected. The spyware has targeted customers of Safaricom and Simbanet, and it is known to be used by governments elsewhere to intrusively monitor journalists, HRDs, and political opponents.157

In 2017, research published by the Centre for Intellectual Property and Information Technology Law (CIPIT) revealed the presence of a “middlebox” on a Safaricom mobile network.158 While middleboxes have legitimate functions, such as network optimization, they can also be used to manipulate traffic and assist in surveillance, which led to concerns about potential privacy violations. Safaricom denied using a middlebox, and subsequent tests returned negative results, prompting the researchers to conclude that the technology was no longer in use.

The UK-based nonprofit organization Privacy International (PI) separately revealed in a 2017 report that Kenyan national security agencies, especially the National Intelligence Service (NIS), have unlawful direct access to communications systems, allowing for the interception of both traffic data and content.159 Based on interviews, PI found that law enforcement and national security agents have a physical presence in the facilities of telecommunications providers. The report also indicated that intercepted information could be freely shared with other government agencies.

PI also assessed two NIS cybersecurity projects, the Network Early Warning System and the National Intrusion Detection and Prevention System, which aim to monitor telecommunications traffic for cybersecurity threats. PI raised concerns that the two systems could monitor content as well as traffic, based on internal documents it received.160 Given the national security framework in which the systems are being implemented, transparency and oversight will be limited.

Service providers and other technology companies are not usually required to aid the government in monitoring the communications of their users, although authorities have reportedly made requests for such assistance. A data protection law passed in November 2019 offers safeguards for user data but includes broad exemptions that allow the government to sidestep the protections, endangering the right to privacy.

The DPA regulates the collection, processing, storage, use, and disclosure of information relating to individuals.161 Processing that is “necessary for national security or public interest” is broadly exempted from the law’s protections, opening the door to government abuse. The law establishes the Office of the Data Commissioner to oversee implementation, but the entity has not been classified as an independent office under the constitution, raising concerns about its autonomy.162

The Data Protection (General) Regulations, 2021, passed in February 2022, operationalize the DPA and set out procedural guidelines for data controllers and data processors. Under the regulations, data controllers and data processors are required to ensure users give consent for their personal data to be used and to process personal data through servers located in Kenya.163 Draft regulations to implement the DPA, including the Data Protection (General) Regulations, 2021, were previously criticized for inadequately protecting the rights of data subjects and not exempting data processing for journalistic purposes.164

In October 2020, Immaculate Kassait, a former IEBC commissioner, was made Kenya’s first data commissioner.165

Other laws, like the Preservation of Public Security Act; the OSA; the National Intelligence Act, 2012; and the PTA limit the privacy of personal data, ostensibly to safeguard national security.166

PI has reported that Safaricom routinely supplies data to authorities without a warrant for intelligence purposes. Safaricom claims that it only cooperates when authorities present a court order.167

In May 2022, the Kenya Review Authority announced that it planned to purchase a software that could scan through data in emails, computers, smartphones, and social media accounts to combat tax and financial fraud.168 Kenyans have protested, saying that the KRA’s monitoring would be intrusive and unconstitutional.

Bloggers and internet users have faced increasing intimidation and violence in retaliation for their online activities in recent years.

In October 2021, Boniface Mwangi accused Machakos governor Alfred Mutua of ordering the bombing of his under-construction house. Mwangi alleged he was targeted in retaliation for his social media posts about Governor Mutua’s personal separation from Lillian Ng’ang’a. Mutua subsequently threatened to sue Mwangi for defamation.169

In November 2020, blogger Edgar Obare accused Kenyan police of kidnapping and assaulting him while he was traveling to a hearing; Obare faced charges of unlawfully disclosing personal information online (see C3).170

More than a quarter of Kenyan women have experienced some form of online gender-based violence, according to an August 2020 report from Pollicy, a technology consulting firm.171 In April 2020, Brenda Cherotich, one of the first Kenyans to be publicly identified as a person who recovered from COVID-19, faced extensive online harassment, including the nonconsensual sharing of her private chats and photos.172 Women in politics encountered especially harsh online harassment during the pandemic, according to a brief from the Kenya ICT Action Network (KICTANet).173

During the restive 2017 election period, authorities often destroyed the cameras and phones of journalists to suppress reporting on violence and human rights violations.174 The heightened political tensions also led to more instances of intimidation and harassment in retaliation for online activities. Female candidates faced rampant online harassment ment to deter their political ambitions,175 which was often accompanied by offline sexual harassment and violence.176

Ordinary users can face retaliation for online activity that impacts their livelihoods. In February 2019, the Machakos county government suspended Alice Kasyoka from practicing medicine after she criticized county officials in a Facebook post. During her suspension, Kasyoka was paid half of her salary.177

Score Change: This score improved from 2 to 3 because there were no reported technical attacks against government or media organizations during the coverage period.

Hacking and other forms of cyberattack are a growing problem in Kenya. The National Computer Incident Response Team detected 143 million cyberthreats between July and September 2021, up from 35.2 million during the previous year.178 However, no technical attacks were reported against government or media bodies during this report’s coverage period.

In June 2022, after the coverage period, Kaspersky Lab reported on SessionManager, a backdoor that was used to target nongovernmental organizations, government entities, medical firms, and transportation companies. Kaspersky experts found that the backdoor had been used in Kenya, though its targets were not identified.179

Since 2015, Kenya has been subjected to scores of cyberattacks, many of which were directed at financial institutions. For instance, in October 2020, two students were charged with allegedly stealing 24.4 million shillings ($244,000) by hacking a bank’s mobile money platform.180

Under the CMCA, hackers face a fine of up to 5 million shillings ($44,000), up to three years in prison, or both for: unauthorized access to, interference with, or interception of data on computer systems; unauthorized disclosure of passwords; and cyberespionage, among other offenses.181