By Wahome Ngatia

When President William Ruto assented to the Computer Misuse and Cybercrimes (Amendment) Act, 2024 two weeks ago, he reignited a complex national debate that cuts to the heart of Kenya’s digital future: how far should the state go to protect citizens online without silencing them?

For a country that prides itself as Africa’s Silicon Savannah—home to M-Pesa, Ushahidi, and a generation of digital entrepreneurs—this question is not merely academic. It is existential. The new cybercrime law is both a technological necessity and a democratic test.

A Necessary Evolution from 2018

The 2024 amendment is not Kenya’s first dance with cyber legislation. Its predecessor, the Computer Misuse and Cybercrimes Act, 2018, signed by then-President Uhuru Kenyatta, was born out of similar anxieties: rising cyber fraud, digital espionage, identity theft, and online harassment.

Back then, the law sought to modernize Kenya’s outdated penal code to address crimes committed through computers and networks. It was an important, if imperfect, step into a world where a tweet could topple markets, a phishing email could empty accounts, and fake news could sway elections.

Seven years later, the amendment seeks to catch up with a digital landscape that has grown exponentially complex. From cryptocurrency scams to AI-generated misinformation, Kenya’s cyberspace is now a theater of new risks. The 2024 law broadens definitions to include virtual assets, digital property, and electronic identifiers. It also criminalizes sophisticated acts like phishing, SIM-swap fraud, and identity impersonation using another’s ID, SIM card, or digital credentials.

In this regard, the law deserves credit. It reflects an earnest attempt to modernize Kenya’s legal arsenal for a digital era where crime no longer requires a gun—it only needs a good Wi-Fi connection.

The Law’s Protective Promise

Supporters of the amendment argue it is indispensable for national and individual security. Kenya’s economy loses an estimated KSh 15 billion annually to cybercrime. The country has seen a surge in digital financial fraud, ransomware, and online extortion.

The law’s new clauses empower the state to act swiftly against perpetrators who exploit technology for criminal ends. For instance, under Section 46A, authorities can now seek court orders to block or remove websites promoting child exploitation, terrorism, or fraudulent schemes. This is a power that, if responsibly used, could save lives, prevent radicalization, and protect minors from online predators.

The Act also strengthens coordination among enforcement agencies through the National Computer and Cybercrimes Coordination Committee (NC4), ensuring that cyber incidents are handled efficiently rather than being lost in bureaucratic silos.

Furthermore, the expanded definition of assets to include digital property allows regulators and investigators to trace and seize illicit funds—even when hidden in cryptocurrencies or virtual wallets abroad. This closes a loophole that cybercriminals have exploited for years.

In essence, the law promises to give Kenyans a digital shield—one that guards their financial integrity, privacy, and digital identity in an increasingly predatory online world.

The Other Side of the Screen

Yet, where the law shines with intent, it also casts long shadows of overreach.

Civil society organizations like the Kenya Human Rights Commission (KHRC), digital rights advocates, the Law Society of Kenya (LSK), and individual petitioners such as gospel artist and activist Reuben Kigame, have raised the alarm. Their contention is not with cybersecurity itself—but with how this law defines and enforces it.

The core of the controversy lies in Section 27, the newly expanded provision on cyber harassment.

Subsections 27(1)(b) and 27(1)(c) criminalize electronic communication that “detrimentally affects” another person or is “indecent or grossly offensive in nature.” The penalty under Section 27(2) is severe—up to 10 years in prison or a fine of KSh 20 million, or both.

On October 22, 2025, the High Court in Nairobi, presided over by Justice Lawrence Mugambi, temporarily suspended these three subsections, citing potential violations of the constitutional right to free expression and due process. The court found the language too broad and subjective, warning that such provisions could be “weaponized to criminalize criticism, satire, and dissent.”

KHRC and the petitioners argued—and the Court tentatively agreed—that the phrases “detrimentally affects” and “grossly offensive” lack clear legal boundaries. What offends one person may simply be political commentary to another.

The Danger of Vagueness

Vague laws are the quietest tools of authoritarianism. They allow the state to decide, case by case, who deserves protection and who deserves punishment.

This is not an idle fear. Kenya’s history bears scars from past laws used to muzzle dissent under the pretext of maintaining order. The Security Laws (Amendment) Act of 2014 and sections of the Public Order Act have been wielded to silence journalists and activists in the past.

Globally, Kenya is not alone in this balancing act.

In Tanzania, the 2018 Cybercrimes Act—which contains similar “grossly offensive” wording—has been used to arrest citizens for criticizing government officials online. In Nigeria, the Cybercrimes Act of 2015 has repeatedly been invoked to prosecute journalists and bloggers under ambiguous defamation clauses. Conversely, countries like Estonia and Singapore have shown that strong cyber laws can coexist with digital freedom—so long as they are clearly defined, transparently enforced, and overseen by independent courts.

Kenya’s law could follow either path.

If applied with restraint, it can protect citizens from harassment and fraud. But if abused, it could become a modern-day gag law—silencing the same digital voices that keep democracy vibrant.

The Courts as the New Frontier

By suspending parts of Section 27, the High Court has effectively become the referee in Kenya’s struggle between security and liberty. Justice Mugambi’s ruling was not a rejection of the entire law—it was a plea for precision, for laws that punish criminals without ensnaring critics.

This judicial intervention reflects Kenya’s maturing constitutional culture, where courts increasingly assert their role as guardians of the 2010 Constitution’s Bill of Rights. It also sets a precedent for legislative drafting in the digital age: that clarity is not optional, it is constitutional.

Are Kenyans’ Concerns Valid?

Yes—and necessarily so.

Their concerns are not the paranoia of a cynical populace but the vigilance of a democracy that remembers how easily power can be abused. In a country where social media is a lifeline for accountability, any law touching online speech must be treated with both reverence and suspicion.

That does not mean rejecting the law wholesale. Kenya undeniably needs robust cybercrime legislation to keep pace with the digital underworld. But those laws must be written and enforced in a way that targets crime, not criticism.

The Road Ahead

Kenya’s cyber future hinges not merely on the letter of the law, but on its interpretation and implementation. Parliament must revisit the suspended clauses with input from technologists, lawyers, and civil society. Definitions must be narrowed, oversight mechanisms strengthened, and penalties calibrated to ensure proportionality.

Ultimately, technology will keep evolving—and so must our laws. But democracy, too, must evolve to protect citizens not just from hackers, but from the heavy hand of unchecked authority.

Lastly…

The Computer Misuse and Cybercrimes (Amendment) Act, 2024 is both a shield and a sword. It can defend Kenya’s digital realm from real threats—or it can cut down the very freedoms that make that realm worth defending.

For now, the courts have paused the blade mid-air. What happens next will determine whether Kenya’s digital age becomes a story of empowerment—or control.