As the nation mourned one of its most significant political figures, a piece of legislation tabled just three days after Gen Z protesters stormed Parliament quietly became law. The timing meant a bill with far-reaching implications received little public scrutiny during national grief.
What makes this law troubling isn't just its content but how it got here. Public participation, constitutionally required for all legislation, was inadequate. Those who submitted recommendations found them ignored.
Legal firm Oraro and Company warned that Section 27's vague language and lack of judicial oversight could lead to arbitrary enforcement and criminalisation of legitimate public discourse. They recommended clear thresholds, due process, and constitutional protections. None of this made it into the final law.
Parts of this law indeed address real problems. SIM swap fraud has become a pandemic, with Safaricom customers losing millions as fraudsters hijack phone numbers to access mobile money. The law criminalises this with fines of Sh200,000 or two years imprisonment. It tackles phishing with penalties of Sh300,000 or three years. These provisions target genuine threats.
But then the penalty structure goes sideways. Hack someone's M-Pesa and steal their savings? The maximum fine is Sh200,000. Phish someone's bank details and drain their account? You pay Sh300,000 or three years in jail. Post a meme that hurts a politician's feelings? Sh20 million or ten years in prison is your punishment. Stealing money gets you two to three years. Hurting feelings gets you 10 years and fines 67 times higher.
Section 27 criminalises speech that "detrimentally affects" someone, is of "indecent or grossly offensive nature," or is "likely to cause apprehension or fear." Who decides what's grossly offensive? If a corruption exposé detrimentally affects an official's reputation, is that criminal? The law doesn't say. In the UK, online harassment maxes out at six months while fraud gets ten years. South Africa sets cyber harassment at three years, fraud at 15. Kenya has flipped this completely.
A 2022 study by the Africa Centre for Strategic Studies examined restrictive cyber laws across the continent and found a consistent pattern. Tanzania's 2015 Cybercrimes Act, ostensibly passed to fight digital crime, instead became a tool to silence opposition.
The law's broad definitions and disproportionate penalties enabled the unjustified detention, arrest, and intimidation of opposition figures, independent journalists, and activists. The study found these laws fail to reduce online harassment but succeed spectacularly at stifling dissent and political debate. Similar patterns emerged in Uganda, Zambia, and Benin, where vague cyber harassment provisions were weaponised against critics while actual cybercriminals continued operating.
Think about the incentive structure this creates. A young person now faces lighter consequences for running a phishing scheme that steals actual money than for posting a critical meme.
Here's what makes people angry to post the memes in the first place: an educated young Kenyan can't find work, then logs into TikTok to see politicians’ money-worshipping and wealth flaunting.
That disconnect breeds frustration. This law doesn't address the frustration, it just criminalises expressing it, while treating actual theft more leniently.
The provision letting the National Computer and Cybercrimes Coordination Committee declare websites inaccessible without court approval is concerning. One appointed committee can silence entire platforms. Without a process. Just an executive decision. They could wake up and shut down X for being a threat to “national security”.
Sharing sensitive documents
For ordinary Kenyans, the implications are stark. That tweet criticising county services? Potentially criminal. That Facebook post questioning a governor's project? Could be harassment. Activists risk prosecution for causing officials apprehension. Satirists operate under threat of bankruptcy in long court battles or prison.
Then there's the provision criminalising sharing sensitive documents: five years in prison. This directly targets whistleblowers who leak evidence of corrupt deals, inflated tenders, and misused public funds. The civil servant exposing fraudulent procurement, the insider documenting kickbacks, and the employee providing proof of embezzlement all face five years. That's double the sentence for phishing, two and a half times the sentence for SIM swap fraud. The message is clear: exposing financial wrongdoing carries harsher consequences than committing it.
VPNs will proliferate. Anonymous accounts will multiply. Satire will get subtler. The law won't stop criticism, just drive it underground, where distinguishing legitimate speech from actual harassment becomes harder.
Constitutional petitions challenging the law have been filed in court and received conservatory orders. These cases will test whether courts will allow this law to stand or strike down its most egregious provisions.
Changes needed: replace subjective terms with measurable standards, rebalance penalties so fraud isn't lighter than speech, require judicial approval for website blocking, explicitly protect online civic space, journalism and whistle-blowing.
When those who expose corruption face harsher punishment than those who commit fraud, then something is fundamentally wrong. More citizens can join or file additional petitions. Democracy isn't just what Parliament passes, it's what citizens defend. Right now, that defense matters more than ever.
Follow our WhatsApp channel for breaking news updates and more stories like this. https://whatsapp.com/channel/0029Va5EF2859PwPPI4u8747
Mr Amenya is a whistleblower, strategy consultant and start-up mentor. www.nelsonamenya.com
