One week after Kenya’s President William Ruto signed the Computer Misuse and Cybercrimes (Amendment) Act, 2024, into law, the High Court in Nairobi suspended key sections that critics say threaten online freedoms.
The halted provisions—Section 27(1)(b), (c), and (2)—criminalise intentional communication that harms another person’s reputation, privacy, or mental well-being, including actions “likely to cause them to commit suicide.” They also cover similar electronic transmissions and prescribe penalties of up to KES 20 million ($155,000) or a ten-year prison term.
The suspension reopens the debate over how far Kenya can go in policing digital expression without undermining free speech, signaling growing judicial scrutiny of the government’s expanding control over the country’s online spaces.
The ruling followed a petition by Reuben Kigame and the Kenya Human Rights Commission (KHRC), setting up a new constitutional battle over how far the state can go in regulating online expression.
The cybercrime law was introduced as a critical update to Kenya’s cybersecurity regime to address digital crimes, including SIM-swap fraud, phishing, and cyber harassment. But civil society groups warned that parts of it were broadly written so they could be used to criminalise dissent and curb legitimate speech.
A law with wider reach
The signed law modifies the original 2018 statute, which already criminalised unauthorised access, false information, and cyber harassment. The new version expands definitions, toughens penalties, and creates new offences.
Key additions include the criminalisation of SIM-swap fraud—unauthorised manipulation of SIM cards for financial gain—with penalties of up to ten years in prison or a fine of up to KES 5 million ($39,000).
The law also mandates that owners of critical information infrastructure in sectors such as banking, telecommunications, and fintech must report security incidents within 24 hours and store sensitive data locally.
It also grants the National Computer and Cybercrimes Coordination Committee (NC4), which advises the government on cyber policy issues, sweeping authority to order the blocking or removal of websites, apps, or online content deemed to promote illegal activities, including terrorism or child exploitation.
Critics, including the KHRC, which advocates for policy and legal reforms in Kenya, warn that the clause lacks judicial oversight and could give the government unchecked power to silence platforms.
The clauses under suspension
Justice Lawrence Mugambi suspended the enforcement of Section 27(1)(b), (c), and (2), which criminalise the publication of “false, misleading, or fictitious” information likely to cause public panic or damage reputations.
The petitioners argued that the sections are vague and risk being applied selectively against journalists, activists, and online critics. The court’s temporary orders mean no prosecutions can proceed under those specific clauses until the case is heard.
For digital rights advocates, this is a small but significant pause, as it shields users from potential abuse while the court weighs whether the amendments violate the constitution’s guarantees of free expression and privacy.
The petition follows a familiar pattern. In 2021, parts of the original 2018 Act were also frozen by the courts on similar grounds, after complaints from civil society groups like the Bloggers Association of Kenya (BAKE) and ARTICLE 19. Those cases raised questions about the state’s growing appetite for online control, and many of those same concerns have resurfaced.
A test for Kenya’s digital governance
Fintech and telecom firms will be required to establish incident response systems, conduct annual risk audits, and maintain sensitive data within Kenya’s borders. The requirements may enhance security, but they also increase costs and slow digital operations in a market that relies on speed.
For users, the suspended clauses are more closely tied to daily life. They touch what people post, share, or comment on, where a casual remark could have triggered criminal liability.
The pause spares Kenyans that risk, at least for now, but the uncertainty over what counts as “false” or “misleading” speech will be determined during the next hearing of the case on November 11.
