Cybersecurity or Control? Examining Kenya’s Cybercrime Framework and Journalism
The Computer Misuse and Cybercrimes Act (CMCA) of Kenya has become one of the most influential and contentious pieces of legislation in the country’s digital era. Enacted in 2018 and expanded with significant amendments in 2025, the law was officially designed to combat online fraud, identity theft, and cyber harassment. However, as enforcement has intensified, its reach has extended into the core of democratic life, directly challenging the constitutional guarantee of freedom of expression and setting the stage for a legal conflict that is redefining the modern media landscape.
At the heart of the debate is Article 33 of the Kenyan Constitution, which guarantees every person the right to freedom of expression, including the freedom to seek, receive, and impart information and ideas through any media. The CMCA, critics argue, creates a chilling effect that undermines this foundational right. As the Media Council of Kenya and the Kenya Union of Journalists (KUJ) have stated in their petitions, the law’s vague provisions serve as a legal straitjacket, criminalizing speech that should be protected in a robust democracy.
Government officials have consistently framed the CMCA as a protective shield, particularly for vulnerable groups like children and victims of online abuse. The 2025 amendments, according to parliamentary records, explicitly introduced stricter punishments for cyber harassment and new provisions against the publication of “false” and “misinformation.”
Yet, as a coalition of digital-rights groups highlighted in a joint 2025 report, the law’s vague definitions and broad enforcement powers are a primary concern. The fear is that these features allow the CMCA to be weaponized as a tool to silence journalists, critics, and activists under the guise of maintaining order.
This legal uncertainty comes at a time when Kenyan media is undergoing a massive digital transition. A 2024 report by the Reuters Institute for the Study of Journalism found that over 85% of major Kenyan newsrooms have identified digital and social media as their primary growth channel, pivoting away from traditional broadcast and print.
This shift means that the CMCA’s impact is not a peripheral issue; it strikes at the very business model and survival of modern journalism. For these digital-first newsrooms, the law creates an impossible dilemma, pursue the audience engagement and investigative reporting that drive online traffic or self-censor to avoid potentially ruinous legal battles. The “legal vetting” and “tightened digital policies” now being adopted directly impact the agility, tone and public-service value of their online content, potentially making them less relevant and engaging to their digital audience.
The enforcement of the Computer Misuse and Cybercrimes Act is operationalized through institutions such as the National Computer and Cybercrimes Coordination Committee (NC4), a multi-agency body established under the Act to coordinate the detection, prevention, investigation, and prosecution of cybercrime in Kenya. According to its mandate, NC4 brings together senior officials from security agencies, regulatory bodies, and key government ministries to oversee national cybercrime responses, develop cybersecurity standards, and coordinate incident analysis and international cooperation. While this centralized structure is presented as essential for protecting critical information infrastructure and public safety, its close alignment with security and enforcement agencies places it at the center of concerns raised by journalists and digital-rights advocates, who argue that such coordination, when paired with vague legal provisions, risks transforming cybersecurity mechanisms into instruments of surveillance and control that directly affect digital journalism, civic participation, and constitutionally protected expression.
Several high-profile cases have moved the law from the statute books into the realm of tangible risk:
1. The Rose Njeri Arrest: When Civic Tech Became a Crime: In 2025, software developer Rose Njeri was arrested, with police records stating she had interfered with parliamentary systems by creating a web tool that allowed Kenyans to email their representatives about the Finance Bill. The arrest, widely condemned by civil society and tech groups as criminalizing civic engagement, signaled that even facilitating public participation could be deemed a cybercrime.
2. Bloggers in the Crosshairs: Court filings from the same year detail cases against bloggers like Maverick Aoko and Donald Mwendwa Nzau, who were charged under the CMCA for social media and WhatsApp posts. Their prosecutions underscored how quickly routine digital expression could trigger severe criminal liability.
3. The Death of Albert Ojwang in Police Custody: A pivotal moment for public perception was the death in custody of blogger Albert Omondi Ojwang. As reported by major Kenyan media, he was arrested over an online post. His death sparked public protests and urgent calls for police accountability, raising grave questions about the extreme consequences of enforcing cybercrime laws.
Courts Step In: The Battle over Constitutionality
The 2025 amendments sparked immediate legal challenges. As documented in High Court petitions filed by civil society groups and lawmakers, the plaintiffs argue the law is unconstitutionally vague, overbroad, and was passed without adequate public participation.
Key developments include:
What Comes Next? Two Paths for Kenya’s Digital Landscape
The pending court decisions will determine the fate of digital journalism in Kenya, presenting two starkly different futures:
This would be a major victory for press freedom, reinforcing Article 33. Journalists in digital newsrooms could operate with greater legal protection, and Parliament would be pressured to rewrite the law with precise, rights-respecting definitions. This would create a safer, more open environment for the digital innovation that the media industry is betting its future on.
The current chilling effect would intensify, directly contradicting the spirit of the Constitution. Digital-first newsrooms would be forced into more conservative editorial stances, stifling the very content that drives growth. Citizen journalists and bloggers might be discouraged from speaking out, and the tools of digital activism would face heightened scrutiny, narrowing the space for public debate and hindering the media’s digital transformation.
The Computer Misuse and Cybercrimes Act began as a shield against genuine online threats. But as Kenya’s media and civic discourse become increasingly digital, the law has become a battleground for the soul of the nation’s digital future. For journalists, the stakes are not just professional but existential, pitting their constitutional mandate against a legal framework that could render their digital future uncertain. The coming court rulings will ultimately decide whether Kenyas digital landscape becomes a domain for open, democratic engagement or one of controlled uncertainty.
By Joan Nyambura, Programmes Assistant, AMWIK
