Automate electoral system before 2027 polls
A clerk captures the biometrics of a youth during the Independent Electoral and Boundaries Commission's mass voter registration exercise at Eldoret National Polytechnic in Eldoret City, Uasin Gishu County on March 30, 2026.
What you need to know:
- Kenya uses biometric registration and KIEMS kits to identify voters and transmit images of polling station result forms (Form 34A).
- However, ballots are counted manually, while constituency and county tallies are compiled on Forms 34B and 34C.
As Kenya marks Cyber Security Awareness Month, the countdown to the August 10, 2027 General Election highlights an increasingly complex threat landscape.
The Independent Electoral and Boundaries Commission (IEBC), in its Election Operations Plan 2025–27, identifies cyber security, artificial intelligence (AI) driven disinformation and deepfakes among the biggest threats to electoral credibility.
The Communications Authority’s national incident response centre, KE-CIRT/CC, detected 3.37 billion cyber threat events between January and March 2026. Meanwhile, the Sh6.5 billion tender for Kenya Integrated Elections Management System (KIEMS) kits has faced procurement delays and a court challenge.
Kenya uses biometric registration and KIEMS kits to identify voters and transmit images of polling station result forms (Form 34A). However, ballots are counted manually, while constituency and county tallies are compiled on Forms 34B and 34C.
This hybrid system combines digital vulnerabilities with opportunities for human error, alteration and delays. The 2017 and 2022 presidential petitions raised questions about result transmission, server access and tally discrepancies. The Supreme Court annulled the 2017 presidential election over irregularities, while rejecting challenges to the 2022 result.
Free and fair elections
Delayed tallying can deepen mistrust. Following the disputed 2007 election, which preceded violence that killed more than 1,100 people, the Kriegler Commission recommended an integrated electronic system.
Political tensions often intensify between the close of polls and the declaration of results. Automated counting at polling stations, digitally signed results and real time publication could reduce uncertainty and make manipulation easier to detect.
Article 86 of the Constitution requires elections to be simple, accurate, verifiable, secure, accountable and transparent. It also requires votes to be counted, tabulated and announced promptly at polling stations. Article 81 establishes principles of free and fair elections.
The Elections Act requires electoral technology to be tested and verified at least 60 days before a general election. The Data Protection Act safeguards voters’ personal information, while the Computer Misuse and Cybercrimes Act criminalises interference with computer systems.
AI could generate fake videos of candidates or IEBC officials announcing results, clone voices in local languages, create fabricated result forms and amplify false claims through automated accounts. Convincing phishing messages could also target election officials.
However, AI can help detect suspicious results, identify inconsistencies between transmitted forms and scanned images, monitor network intrusions and flag manipulated content.
Election outcomes
The principle must be that AI flags anomalies while humans make decisions. Voter eligibility and election outcomes must never be determined solely by algorithms. Measures against deepfakes must also respect constitutional protections for freedom of expression.
The IEBC’s Electoral Risk Management Tool, launched on September 7, 2026, provides a framework for monitoring political tension, disinformation, violence, logistics and technology threats.
Cyber security requires a dedicated risk register identifying threats, responsible officers, warning signs and tested responses. Priority threats include attacks that disable results portals, ransomware targeting voter data, fake announcements of results, KIEMS failures and insider manipulation.
Defences should include mirrored hosting, encrypted offline backups, spare kits, tested manual alternatives, digitally signed results and comprehensive audit trails.
All 47 counties should develop AI and cyber risk registers covering threats such as deepfakes in local languages, phishing targeting constituency staff and unreliable connectivity.
Kenya has digitised its voters. It must now secure the integrity of their verdict. An election that is transparent, verifiable and auditable is not merely a technological aspiration; it is a constitutional obligation and an essential foundation for public trust in August 2027.
The writer, a technology and governance expert, is CEO of Sewe International
