Expanding Freedom and Democracy
Freedom on the Net 2019

Kenya

Partly Free
68
100
A Obstacles to Access 17 25
B Limits on Content 28 35
C Violations of User Rights 23 40
Last Year's Score & Status
68 100 Partly Free
Scores are based on a scale of 0 (least free) to 100 (most free). See the research methodology and report acknowledgements.

header1 Overview

The state of internet freedom remained relatively robust in Kenya, despite persistent concerns about the speed and quality of service and the political influence of advertisers on media coverage. The manipulation of the online information landscape was less prevalent than during the period surrounding the disputed 2017 presidential election.

Kenya is a multiparty democracy that holds regular elections, but political rights and civil liberties are seriously undermined by pervasive corruption and brutality by security forces.

header2 Key Developments, June 1, 2018 – May 31, 2019

  • The Finance Act was signed by President Uhuru Kenyatta in September 2018, increasing the tax on telephone and internet data from 10 percent to 15 percent, which raised concerns about the affordability of internet service (see A2).
  • The mobile service provider Safaricom suffered numerous outages during the coverage period, interrupting customers’ access to a range of services including data, voice, and mobile money (see A1).
  • In October 2018, a High Court judge ruled that many provisions of the Computer Misuse and Cybercrimes Act, 2018, which was passed in May and penalizes the publication of false information with up to 10 years in prison, would remain suspended until at least November. The provisions were still suspended as of the end of the coverage period (see C2).
  • The hashtag #SwitchoffKPLC was used to raise awareness and mobilize citizens to protest the Kenya Power and Lighting Company (KPLC), which owns and operates most of the electricity transmission and distribution systems in the country, over inflated customer bills. Online activists urged customers to submit their power bills to a Nairobi lawyer, who used them as evidence to file a petition against the company in court (see B8).
  • A 2018 report by Citizen Lab identified Kenya as one of 45 countries worldwide using Pegasus, a surveillance software developed by the Israeli technology firm NSO (see C5).

A Obstacles to Access

Access to the internet continued to improve, particularly on mobile devices, but inadequate infrastructure development has limited the speed and quality of service. Numerous Safaricom outages occurred during the coverage period, interrupting users’ access to a range of services including data, voice, and mobile money. Affordability remains a concern.

A1 1.00-6.00 pts0-6 pts
Do infrastructural limitations restrict access to the internet or the speed and quality of internet connections? 4.004 6.006

Internet access is somewhat limited by poor infrastructure, but penetration rates and speeds continue to improve.

According to government data published by the Communications Authority (CA), the broadband penetration rate increased to 44.9 percent in September 2018, up from 43.9 percent in June 2018.1 The regulator also reported nearly 45.5 million mobile phone subscriptions for a penetration rate of 100.1 percent as of September 2018, up from 90.4 percent the previous year.2 However, subscription statistics may not reflect actual usage. Many Kenyans have more than one mobile subscription, and the numbers reported by the CA include corporate registrations. The CA’s data also contrasts sharply with the latest figures from the International Telecommunication Union (ITU), which estimated Kenya’s internet penetration rate at 26 percent in 2016.3

Internet speeds have also improved in recent years. According to a report by Cable, a UK-based telecommunications company, Kenya had the second fastest internet speeds in Africa in 2018, behind only Madagascar, and ranked 64 in the world, with average download speeds of 10.1 Mbps.4

The National Optic Fibre Backbone Infrastructure (NOFBI) project aims to increase internet connectivity across the country and improve the delivery of e-government services.5

The Kenya Vision 2030 Medium Term Plan (2013-2017), the second phase in the implementation of the country’s development plan, considers information and communication technologies (ICT) a key element of national transformation.6 Focusing on devolution (decentralization) and building equity across the country, the government has prioritized the expansion of ICT capacity, with internet connectivity as a key pillar.7

Outages in Safaricom networks affected MPESA (a mobile money service) and internet connectivity with some regularity during the reporting period. The last reported outage occurred in December 2018, 8 and others occurred in November9 and July 2018.10 The July outage, which lasted several hours and affected voice and data service, was caused by a damaged fiber link.11 These outages affected over 31 million subscribers who rely on Safaricom’s voice, SMS, data, web hosting, and mobile money services.

A2 1.00-3.00 pts0-3 pts
Is access to the internet prohibitively expensive or beyond the reach of certain segments of the population for geographical, social, or other reasons? 1.001 3.003

Internet access has become prohibitively expensive for much of the population. In the Alliance for Affordable Internet’s Affordability Driver Index, Kenya dropped six spots in 2018, ranking 15 out of 29 countries surveyed.1

The Finance Act, which was signed by President Kenyatta in September 2018, increased the tax on telephone and internet data from 10 percent to 15 percent.2 In response to the tax, internet service providers (ISPs) raised prices for both data bundles and fixed home internet,3 making internet access unaffordable for many poorer Kenyans.

The affordability and availability of the internet varies between urban and rural areas. A gender-based digital divide persists, with more male mobile and internet users than women.4 Many rural areas have not benefited from Kenya’s high-capacity bandwidth, in part due to market disparities and weaknesses in last mile connectivity, which is expensive and requires basic infrastructure such as electricity and roads that are often poorly developed. The Universal Service Fund (USF), which was established in 2013, aims to expand mobile and internet service in a bid to close the digital divide.5

A3 1.00-6.00 pts0-6 pts
Does the government exercise technical or legal control over internet infrastructure for the purposes of restricting connectivity? 6.006 6.006

During the coverage period, there were no reports of the government using control over internet infrastructure to limit connectivity. Kenya’s decentralized internet infrastructure and nongovernmental control of the Kenya Internet Exchange Point (KIXP) make it unlikely that the government could exercise technical control over the internet.

Kenya connects to the international internet via four main undersea cables—SEACOM, the East Africa Marine System (TEAMS), the Eastern Africa Submarine Cable System (EASSY), and the Lower Indian Ocean Network (LION2); three others—Africa1, the Djibouti Africa Regional Express (DARE), and Liquid Sea—land in Mombasa.1 License provision for access to the international gateway was liberalized in 2004.2

The KIXP is operated by the Telecommunication Service Providers Association of Kenya (TESPOK), a nonprofit organization representing the interests of ISPs. The KIXP keeps Kenyan internet traffic within the country, lowering the cost of connectivity. A second IXP was established in Mombasa, but its failure to attract enough users led to its closure in 2015.3 With support from the African Union, a backup IXP was established in 2016 to further lower the costs of connectivity for ISPs.4

A4 1.00-6.00 pts0-6 pts
Are there legal, regulatory, or economic obstacles that restrict the diversity of service providers? 4.004 6.006

A number of economic obstacles restrict the diversity of service providers.

There are five mobile service providers: Safaricom, Airtel, Telkom, Mobile Pay Limited, and Finserve Africa.1 The government has partial ownership of Safaricom (35 percent) and Telkom (40 percent).2 Safaricom dominates the market, with 63.3 percent of all mobile subscriptions and 69.5 percent of internet subscriptions. As such, there have been calls to declare Safaricom a dominant player, which would possibly force the company to separate its mobile money service in an effort to foster greater competition.3 However, amid fierce resistance from Safaricom and other powerful business interests, in January 2018 the regulator dropped plans to split the company.4 In July 2018, the Parliamentary Committee on Communication, Information, and Innovation opened an investigation into the mobile sector to identify legislative and regulatory gaps that may lead to anticompetitive behavior or restrict growth within the sector.5

The CA is the regulatory body that licenses all communications systems.6 As of April 2018, the regulator listed three providers with submarine cable landing rights and 57 network facilities providers (3 of which are national providers, while the remaining 54 are regional).7 These licensees provide, among other things, facilities for internet, voice, and mobile virtual operations. Cybercafés are licensed as business units by local governments, and there are no special regulatory or economic obstacles to their establishment.

A5 1.00-4.00 pts0-4 pts
Do national regulatory bodies that oversee service providers and digital technology fail to operate in a free, fair, and independent manner? 2.002 4.004

The regulatory bodies that oversee service providers generally operate in a fair manner, but there have been some encroachments on the regulator’s independence in the past. By resolving its internal leadership tensions during the coverage period,1 the CA exhibited greater independence than in past years.

In January 2018, the CA board gave its director general, Francis Wangusi, a three-month compulsory leave of absence, ostensibly to allow for an independent audit of the regulator’s hiring process. A labor court subsequently lifted the suspension, pending a full hearing on a case filed by the director general, who claimed he was being punished for resisting interference by the ICT Ministry.2 3 The dispute was settled in September 2018.4 The CA signed an agreement that it would not interfere with Wangusi’s contract. With the settlement, Wangusi withdrew a contempt of court application against the authority for barring his return to work in defiance of the labor court’s order.

The CA’s management is vested in a board of directors that consists of a chairperson appointed by the president, three principal secretaries hired by the Public Service Commission, and seven persons appointed by the cabinet secretary of the ICT Ministry.5 The day-to-day operations of the regulator are managed by a director general who is appointed by the board to a four-year term, renewable only once.6 The director general is an ex officio member of the board without any voting rights.

While the authority’s independence is provided for under section 5 of the Kenya Information and Communications Act (KICA), tensions between the ICT Ministry and the board of directors on one side, and the director general of the CA on the other, have flared up in recent years. The two sides disagreed about how to implement a report on Safaricom’s market dominance. Requests were also made for funds from the CA that the director general said were improper, such as the permanent secretary’s demand that CA funds be used for the presidential swearing-in ceremony. Additionally, in April 2018, the president ordered the transfer of 1 billion Kenyan shillings ($10 million) from the Universal Service Fund (USF) managed by the CA to the Directorate of Criminal Investigation (DCI) to fight cybercrime.7

B Limits on Content

Content is periodically restricted for violating social mores, though censorship is not systematic. The reliance of media outlets, including those that publish online, on government advertisements for revenue contributes to self-censorship, and the government’s failure to pay fees for advertisements has threatened outlets’ ability to publish online. Digital activism remained vibrant.

B1 1.00-6.00 pts0-6 pts
Does the state block or filter, or compel service providers to block or filter, internet content? 6.006 6.006

Political and social content is not generally subject to blocking in Kenya. Testing by the Open Observatory of Network Interference (OONI) conducted in March 2019 revealed no signs of website blocking or censorship.1 Social media platforms and communication apps such as Facebook, Twitter, YouTube, and LinkedIn were also fully accessible.2 Nonetheless, the government periodically polices the internet for content that is perceived to be morally objectionable (see B2).

The internet remained unrestricted during the tense period following the contested 2017 presidential election, including when the government jammed the signals of three leading television stations planning to air opposition leader Raila Odinga’s unofficial inauguration in January 2018.3 The networks’ websites were not blocked, enabling them to stream the event online.4

B2 1.00-4.00 pts0-4 pts
Do state or nonstate actors employ legal, administrative, or other means to force publishers, content hosts, or digital platforms to delete content? 2.002 4.004

Although censorship is not systematic, the state has increasingly sought to remove online content considered immoral or defamatory.

In April 2018, the Kenya Film Classification Board (KFCB) restricted the distribution, exhibition, or broadcast of the film Rafiki, including online, on the grounds that it promoted homosexuality.1 The ban was lifted by the High Court in September 2018 so that the film could be considered for an Academy Award.2 However, in September 2018 the KFCB banned one advertisement for containing sexual content and another for supporting abortion.

In 2017, the KFCB also banned six children’s television programs for allegedly promoting homosexuality “against our Kenya’s moral values and culture.”3 The programs had aired on television and online. The penal code criminalizes same sex relationships, and the KFCB routinely censors LGBT+ content.4

The government also occasionally requests content removals from popular online platforms, such as Facebook and Google. Between July and December 2018, Facebook restricted access to one post, based on a privately reported defamation claim.5 In June 2018, Google reported receiving one takedown request from the judicial branch that was reportedly related to defamation, though the company did not comply with the request.6

Authorities have compelled ordinary users and online journalists to delete content from their social media profiles and websites. In December 2018, a court ordered blogger Cyprian Nyakundi to remove an article that allegedly defamed politician Steve Mbogo from his website.7 In 2017, blogger Robert Alai removed photos he posted on his Facebook page of President Kenyatta’s family in a Nairobi hospital; he was also arrested for the photos.8

B3 1.00-4.00 pts0-4 pts
Do restrictions on the internet and digital content lack transparency, proportionality to the stated aims, or an independent appeals process? 3.003 4.004

Restrictions on the internet are largely transparent, but censorship of online content sometimes lacks fairness or proportionality.

The KFCB has justified banning advertisements that contain sexual content and promote abortion services (see B2) through a law that prohibits the airing of sexual content before 10 PM. Those found in violation of the law face a fine of up to 100,000 shillings ($990) and/or five years in prison,1 as outlined in the Films and Stage Plays Act 2012.2

In advance of the 2017 election, the CA implemented new guidelines to curb online abuse in partnership with the National Cohesion and Integration Commission (NCIC), a statutory body that works to reduce interethnic conflict.3 The broadly worded guidelines prohibit political messages that “contain offensive, abusive, insulting, misleading, confusing, obscene, or profane language,” which analysts fear could be used to limit legitimate online expression. The guidelines also require administrators of social media pages to “moderate and control the content and discussions generated on their platform,” and give mobile service providers the power to block the transmission of political messages that do not comply with the guidelines at their discretion.4 In addition, bulk political messages require prior approval from the NCIC.

Internet intermediaries in Kenya can be held liable for illegal content, such as copyright infringements and hate speech, though they are not required to actively monitor traffic passing through their networks unless they are made aware of illegal content.5 Under the National Cohesion and Integration Act of 2008, which outlaws hate speech, a media enterprise can be fined up to 1 million shillings ($11,000) for publishing hate speech, which is broadly defined in the legislation.6 This provision can be invoked to block or take down online content, according to the Association of Progressive Communications.7

B4 1.00-4.00 pts0-4 pts
Do online journalists, commentators, and ordinary users practice self-censorship? 3.003 4.004

The importance of government advertising money for the survival of media outlets, including those that publish online, results in some self-censorship among journalists (see B6).

According to the Media Council of Kenya, there were 20 violations of press freedom in both 2016 and 2017, and 18 in 2018. The police and other government authorities are reportedly responsible for most of the attacks against journalists.1 Such attacks have a chilling effect on speech and can lead to self-censorship online.

B5 1.00-4.00 pts0-4 pts
Are online sources of information controlled or manipulated by the government or other powerful actors to advance a particular political interest? 3.003 4.004

Online sources of information are not systematically controlled or manipulated by the government or other powerful actors to advance a particular political interest. However, coordinated online campaigns have been observed in the past, notably in the run-up to the 2017 election. In October 2018, Facebook announced that it would partner with Africa Check, Africa’s first independent fact-checking organization, as well as AFP, to help assess the accuracy of information being disseminated on its platform.1

Loosely organized “bloggers for hire” use their collective clout on Twitter and Facebook to shape public opinion and manipulate the online information landscape.2 One such group, known as the “36 Bloggers,” allegedly works within the Executive Office of the President’s Directorate of Digital Communication.3 Another group is known as the “527 militia,” with 527 ostensibly signifying the amount of Kenyan shillings paid to each blogger to tweet certain hashtags. M-PESA, the supposed channel used to pay the bloggers, charges 27 shillings as a transaction fee, so it is believed that the bloggers receive 500 shillings (approximately US $5) for their work and paid 527 shillings to cover the transaction fee.4

During the 2017 election season, opinion influencers proliferated on social media, which led to online manipulation and overt disinformation. A number of websites were registered with legitimate-sounding names to disseminate false news, such as CNN Channel 1,5 which undermined the quality of information available online.

Propaganda, hate speech, and social media campaigns targeting political opponents were common during the campaign, including via paid Google ads and Facebook sponsored posts.6 In an investigative report that aired in March 2018, the UK’s Channel 4 News recorded Cambridge Analytica staff discussing their role in supporting Kenyatta’s campaign in 2017, which included divisive propaganda.7 The company was linked to two websites that were used extensively during the campaign—therealraila.com and uhuruforus.com.8 The former site spread hate speech and negative ads attacking the main opposition candidate, Raila Odinga, while the latter pushed positive narratives favoring the incumbent.9

Political bots were highly influential in shaping the online political discourse during the 2017 campaign. According to the communications consultancy Portland’s How Africa Tweets 2018 report, bot armies worked to “undermine the influence of media outlets, independent bloggers, government entities, and even messages from politicians and campaigners themselves.”10

B6 1.00-3.00 pts0-3 pts
Are there economic or regulatory constraints that negatively affect users’ ability to publish content online? 2.002 3.003

There are few regulatory constraints that negatively affect users’ ability to publish content online, but media outlets’ reliance on government advertisements causes economic challenges for some entities. The Government Advertising Agency (GAA) was established in 2015 to manage government advertising and ensure effective financial administration. In August 2018, the Directorate of Criminal Investigations began an investigation of the GAA for allegedly failing to pay 2.8 billion shillings ($27.1 million)1 in advertising fees owed to media outlets. At a World Press Freedom Day event in Naivasha in May 2019, the Kenya Media Sector Working Group claimed the GAA had not pursued its stated objective of cost-saving, but was actively working to muzzle the media by starving outlets of needed revenue.2

The government has been known to use its advertising budget to influence media outlets’ editorial choices, resulting in financially induced self-censorship.3 Media outlets also adjust the tone of their content to avoid upsetting other primary advertisers,4 though this phenomenon has been more frequently observed among traditional media outlets.

The media is reeling from a new form of censorship that stems from commercial interests. Some outlets have moved away from objective reporting as a result of prioritizing advertising revenues, thus reflecting advertisers’ interests in their coverage of key issues. Powerful, politically influential owners have also affected the editorial lines and reporting of media outlets to advance their interests.5

B7 1.00-4.00 pts0-4 pts
Does the online information landscape lack diversity? 3.003 4.004

The online information landscape is diverse and vibrant, with outlets reporting on many issues and representing a wide range of viewpoints. Social media has become an influential platform for journalists to source and share news. Traditional broadcast media outlets have increasingly utilized social media and digital platforms to interact with users in real time on Twitter and Facebook.

Bloggers and social media personalities have become increasingly influential in recent years. Fast and affordable internet connections in major cities and towns have enabled a growing class of digitally skilled citizens to create content and disseminate alternative sources of news and information.

B8 1.00-6.00 pts0-6 pts
Do conditions impede users’ ability to mobilize, form communities, and campaign, particularly on political and social issues? 6.006 6.006

Mobilization tools are freely available to users, but the authorities’ suppression of some forms of digital dissent limits their effectiveness. Social media, especially Twitter, continues to be a critical platform for debate, advocacy, and mobilization around key issues.

In the spring of 2019, the police in Mombasa launched a manhunt to arrest people using social media to “incite” others against registering for the National Integrated Identity Management System (NIIMS), a biometric registration system.1

The hashtag #SwitchoffKPLC was used to raise awareness and mobilize citizens to protest the KPLC, which owns and operates most of the electricity transmission and distribution systems in the country, over inflated consumer bills.2 Online activists urged customers to submit their power bills to a Nairobi lawyer, who used them as evidence to file a petition against the company in court.3 In July 2018, 20 KPLC managers were charged with economic crimes and abuse of office, partly substantiating the city lawyer’s petition.4 The case was settled out of court in October 2018, which led to mixed reactions from the public, as many people felt the settlement was too lenient. The agreement stipulated that the KPLC establish billing query centers across the country. According to the deal, customers can have their actual meter readings weighed against KPLC's estimates to determine the amount owed to the electricity supplier.5

In February 2018, in the wake of the High Court’s decision against decriminalizing consensual same-sex conduct, Kenyans used the hashtag #Repeal1626 to air their views on Twitter.

C Violations of User Rights

Many provisions of the Computer Misuse and Cybercrimes Act, 2018, which was passed in May 2018 and penalizes the publication of false information with up to 10 years in prison, were suspended. A number of citizens were arrested for alleged hate speech, defamation, or spreading false information.

C1 1.00-6.00 pts0-6 pts
Do the constitution or other laws fail to protect rights such as freedom of expression, access to information, and press freedom, including on the internet, and are they enforced by a judiciary that lacks independence? 4.004 6.006

Freedom of expression is enshrined in Article 33 of the 2010 constitution and includes the rights to seek, receive, or impart information and ideas. However, these rights are frequently violated in practice, including against online journalists and users. Propaganda, hate speech, and incitement to violence are not protected by the constitution.

The judiciary is relatively independent and has made several rulings that protect the fundamental rights of online journalists and ordinary users in recent years. The Bloggers Association of Kenya (BAKE), with support from the rights group Article 19, successfully filed a petition that led a court to suspend 26 sections of the Computer Misuse and Cybercrimes Act, 2018 before it came into effect in May 2018 (see C2).1

C2 1.00-4.00 pts0-4 pts
Are there laws that assign criminal penalties or civil liability for online activities? 2.002 4.004

Laws on hate speech and defamation are frequently used to prosecute online critics of the government.

The Computer Misuse and Cybercrimes Act, 2018, which was passed by the government in May 2018, threatens to further restrict freedom of expression online. The law imposes penalties of up to 10 years in prison for the publication of “false” or “fictitious” information that results in “panic” or is “likely to discredit the reputation of a person.”1 In May 2018, BAKE successfully appealed 26 problematic provisions of the law,2 which were suspended until the court could hear the case.3 A High Court judge ruled in October 2018 that the provisions would remain suspended until November,4 despite the government’s efforts to seek a judicial review of the ruling, arguing that that the judiciary erred in its suspension. The provisions were still suspended as of the end of the coverage period.

In 2017, the High Court ruled Section 132 of the Penal Code, which had penalized “undermining the authority of public officers” and had been used to prosecute both online and offline speech, unconstitutional.5 Section 29 of KICA was separately ruled unconstitutional in 2016.6 Section 29 had penalized bloggers and social media users for using ICTs to disseminate messages deemed “grossly offensive” or to cause “annoyance, inconvenience or needless anxiety to another person,” with a fine of up to 50,000 shillings ($485), three years in prison, or both.7

Hate speech is penalized under the 2008 National Cohesion and Integration Act, which was passed in response to widespread ethnic violence following the 2007 general election.8 Individuals found guilty of spreading hate speech, broadly defined, can be fined up to 1 million shillings (US$11,000), sentenced to up to three years in prison, or both.

C3 1.00-6.00 pts0-6 pts
Are individuals penalized for online activities? 3.003 6.006

Numerous bloggers and social media users were arrested or summoned for questioning during the coverage period, continuing an alarming trend. In the spring of 2019, the police in Mombasa launched a manhunt to arrest people using social media to “incite” others against registering for NIIMS (see B8).1

In December 2018, blogger Cyprian Nyakundi was sued by politician Steve Mbogo and his wife, Sabrina Jamal, for defamation. They claim that Nyakundi published defamatory articsles pertaining to the couple’s marriage on Facebook.2

In November 2018, activist Alenga Torosterdt was arrested and subsequently charged with 12 counts of publishing false information about members of the Vihiga County government, in violation of section 66 of the Penal Code. Furthermore, he was charged with computer fraud under Section 26 of the Computer Misuse and Cybercrimes Act, 2018.3

A number of arrests and prosecutions in retaliation for online activities, particularly for alleged hate speech, occurred around the 2017 election. Among those arrested was blogger Paul Odhiambo, who was detained for spreading alleged hate speech on Facebook and WhatsApp.4 Robert Alai, a popular blogger and social media influencer, was arrested for information he posted about the health of a family member of President Kenyatta.5 Alai has been arrested numerous times for his online activities.

C4 1.00-4.00 pts0-4 pts
Does the government place restrictions on anonymous communication or encryption? 3.003 4.004

Kenyans can freely use encryption tools, but a number of regulations limit anonymous communication. Several publications and tech blogs often encourage Kenyans to install encryption tools.

Anonymity is compromised by the expanding scope of mandatory SIM card registration. In 2017, Safaricom began keeping records of anyone registering for or renewing a SIM card.1 This was an extension of the existing SIM card registration requirements under the Kenya Information and Communications (Registration of SIM-Cards) Regulations, 2015, which prescribes penalties of up to 300,000 shillings ($3,500), imprisonment for up to six months, or both, for failure to abide by the registration requirements.2 The regulations also grant the communications regulator access to service providers’ offices and records without a court order, raising concerns about the lack of judicial oversight.3

C5 1.00-6.00 pts0-6 pts
Does state surveillance of internet activities infringe on users’ right to privacy? 2.002 6.006

Through laws enabling authorities to search and seize data on national security grounds, state surveillance of internet activities directly infringes on users’ right to privacy. The failure to pass a comprehensive data protection bill leaves Kenyans’ privacy rights inadequately protected.

Section 48 of the Computer Misuse and Cybercrimes Act, 2018, which is currently suspended (see C2), would allow the authorities to search and seize stored computer data and to collect and intercept data in real time.1

According to 2018 research published by Citizen Lab, a Canadian internet watchdog, Kenya is one of 45 countries worldwide using Pegasus, a targeted spyware software developed by the Israeli technology firm NSO. The software has targeted customers of Safaricom and Simbanet. Pegasus is known to be used by governments to spy on journalists, human rights defenders, and political opponents.2

Article 31 of the 2010 constitution provides for the right to privacy. The Data Protection Bill 2013, though still in draft form and in need of critical revisions as of mid-2017, aims to regulate the collection, processing, storage, use, and disclosure of information relating to individuals processed through automated or manual means.3 However, the absence of a strong data protection law threatens citizens’ privacy rights, while the government’s unlawful and disproportionate surveillance capabilities have become more evident in recent years, particularly as the country prepared for the national election in 2017. For example, voters’ data, including identifying information such as phone numbers, identification numbers, and photos, were sold to politicians who then targeted them with campaign messages in the run-up to the polls. The data was reportedly sold by exploiting a loophole in the regulations.4

KICA prohibits many forms of monitoring and intercepting communications,5 though the Prevention of Terrorism Act 2012 allows the authorities to limit constitutional freedoms, such as the right to privacy, during investigations into terrorism.6 Amendments to the Prevention of Terrorism Act in 2014 explicitly enable national security bodies to intercept communications “for the purposes of detecting, deterring, and disrupting terrorism,”7 which must be authorized through an interception order granted by the High Court.8

Independent research in recent years has revealed various surveillance technologies that the authorities or other actors may employ to monitor citizens. In 2017, research published by the Centre for Intellectual Property and Information Technology Law (CIPIT) revealed the presence of a “middlebox” on a Safaricom cellular network.9 While middleboxes have legitimate functions such as network optimization, they can also be used to manipulate traffic and assist in surveillance, which led to concerns about potential violations of privacy. Safaricom denied using a middlebox, and subsequent tests returned negative results, leading the researchers to conclude that it was no longer in use.

The UK-based nonprofit organization Privacy International (PI) separately revealed in a 2017 report that national security agencies in Kenya, especially the National Intelligence Service (NIS), have unlawful direct access to communications systems, allowing for the interception of both data and content.10 Based on interviews, PI found that law enforcement and national security agents have a physical presence in the facilities of telecommunications providers. The report also indicated that intercepted information could be freely shared with other government agencies.

PI also assessed two new NIS cybersecurity projects—the Network Early Warning System and the National Intrusion Detection and Prevention System—which aim to monitor telecommunications traffic for cybersecurity threats. PI raised concerns that the two systems could monitor content as well as traffic, based on internal documents it received.11 Given the national security framework in which the systems are being implemented, transparency and oversight will be limited.

C6 1.00-6.00 pts0-6 pts
Are service providers and other technology companies required to aid the government in monitoring the communications of their users? 4.004 6.006

Service providers and other technology companies are not usually required to aid the government in monitoring the communications of their users, although authorities have reportedly made requests for such assistance. Both private entities and government agencies that collect and store sensitive user data do so without any legal oversight.1

In a positive development, in April 2018, the High Court ruled the CA’s plan to implement a device management system unconstitutional. The plan, which was introduced in 2017, would have given the CA access to mobile subscriber data, including call records. In the face of opposition from telecommunications companies,2 the government argued that the system was needed to identify illegal devices, but the court ruled that it would infringe on subscribers’ right to privacy.3

Soon after the High Court rejected the plan, the CA released a tender in November 2018 for the development of a regulatory strategy for over-the-top (OTT) services such as WhatsApp, Skype, and Facebook.4

PI has reported that Safaricom, the leading mobile internet provider, routinely provides data to authorities without a warrant for intelligence purposes. Safaricom claims that it only cooperates when authorities supply a court order.5

C7 1.00-5.00 pts0-5 pts
Are individuals subject to extralegal intimidation or physical violence by state authorities or any other actor in retribution for their online activities? 3.003 5.005

Bloggers and internet users have faced increasing intimidation and violence in retaliation for their online activities in recent years, particularly during the run-up to the 2017 election.

During the election period, authorities often destroyed the cameras and phones of journalists to suppress reporting on violence and human rights violations.1 The heightened tensions during this period led to more instances of intimidation and harassment in retaliation for online activities. The online harassment of female candidates, deployed as a tool to deter their political ambitions, was rampant during this period.2 The online threats to female candidates were accompanied by offline sexual harassment and violence, revealing a link between cyberbullying and real-world violence.3

Users can also face retaliation for online activity that impacts their livelihoods. In February 2019, the Machakos County government suspended Dr. Alice Kasyoka from practicing medicine after she criticized county officials in a Facebook post. During her suspension, Kasyoka is paid half of her salary.4

C8 1.00-3.00 pts0-3 pts
Are websites, governmental and private entities, service providers, or individual users subject to widespread hacking and other forms of cyberattack? 2.002 3.003

Hacking and other forms of cyberattack are a growing problem in Kenya. The National Cybersecurity Centre detected over 10.2 million cyberthreats between October and December 2018, up from 3.8 million the previous quarter. 1

Since 2015, Kenya has been subjected to scores of cyberattacks, many of which were perpetrated against financial institutions. In 2017, Kenya lost an estimated 21 billion shillings ($210 million) to cybercrime, up from 17 billion shillings ($170 million) in 2016.2 In January 2018, hackers stole 29 million shillings ($280,000) from the National Bank of Kenya.3

According to media reports, among the hackers targeting local banks is a home-grown group known as “SilentCards” who work with unscrupulous bank officers and take advantage of naive customers.4 As part of a crackdown on cybercrime, a man suspected of being the leader of a group of hackers that stole customers’ deposits from banks was arrested in February 2019.5 According to Section 14 of the Computer Misuse and Cybercrimes Act, 2018, hackers face a fine of up to 5 million shillings ($50,000), up to three years in prison, or both for unauthorized access, interference, interception, and disclosure of passwords and cyberespionage.6

During the 2017 election period, hackers repeatedly attempted to access the Independent Electoral and Boundaries Commission’s website, but the commission asserted that the attempts were unsuccessful.7 However, the opposition claimed the hacking attempts were successful and the results of the election were manipulated, leading to Odinga’s loss.8 None of the hacking claims were substantiated.

On Kenya

See all data, scores & information on this country or territory.

See More

Country Facts

  • Global Freedom Score

    52 100 partly free

  • Internet Freedom Score

    66 100 partly free

  • Freedom in the World Status

    Partly Free

  • Networks Restricted

    No

  • Websites Blocked

    No

  • Pro-government Commentators

    Yes

  • Users Arrested

    Yes