At the height of the protests, a secret squad led by the DCI used IT experts to track down individuals believed to be fuelling the anti-government demonstrations.
When the makers of the documentary, “Blood Parliament”, got their phones from the Directorate of Criminal Investigations (DCI) on July 10, 2025, they expected more than just missed calls and text messages.
Their lawyer, Ian Mutiso, has represented several individuals accused of publishing false information, contrary to the Computer Misuse and Cybercrimes Act.
He cautioned his clients against using their devices.
The mobile phones had been seized on May 2, 2025, when DCI officers arrested Mr MarkDenver Karubiu, Mr Bryan Adagala (documentarians), Mr Nicholas Wambugu (cinematographer) and graphic designer Christopher Wamae.
From left: Filmmakers linked to BBC Blood Parliament documentary Nicholas Wambugu Gichuki, Chris Wamae, Brian Adagala and MarkDenver Karubiu at Muthaiga Police Station in Nairobi after being released from custody on May 3, 2025.
When their devices were released, the four gave them to Citizen Lab, a Canadian internet watchdog based at the University of Toronto, for a forensic investigation.
Two months later, a report by Citizen Lab revealed that FlexiSpy – a commercially available spyware – was installed in their gadgets.
“We know the spyware that was installed in the devices. The full report will disclose all findings once we get leave. We also intend to issue summons to the forensic lab and the DCI to understand exactly what the chain of custody is,” Mr Mutiso said.
Through Mr Mutiso, the four accuse the DCI of installing the British-made spyware in their phones without their consent.
They have furnished the DCI and the Judiciary with copies of the Citizen Lab report as they await a final decision from the Director of Public Prosecutions (DPP) on whether they will be charged with any offence.
During the mention of the case on Thursday, the Office of the DPP did not give a clear indication on whether it would pursue charges against the four men.
FlexiSPY
According to the forensic analysis, the spyware was installed on Mr Adagala’s iPhone on May 21, 2025. FlexiSPY, a surveillance tool, can record phone calls, intercept messages, capture audio, track locations and delete or modify data.
“This memorandum is prepared for Mr Bryan Adagala at his request and with his consent. It confirms that our forensic analysis of digital artifacts on Mr Adagala’s device indicates with high confidence that FlexiSPY was placed on it,” the report reads.
The report detailS that the spyware was installed on the device on May 21 at 5:17pm, while it was still with police. The phone was returned to him on July 10.
FlexiSpy was developed to help people keep track of activities of their loved ones like children. However, some governments and private institutions have turned it into spyware. It is capable of running in the background of devices it is installed without notifying the user.
Inspector-General of Police Douglas Kanja and DCI head Mohamed Amin did not respond to calls and text messages sent to their known mobile phone numbers.
Inspector-General of Police Service Douglas Kanja (left) and Directorate of Criminal Investigations boss Mohamed Ibrahim Amin before the National Assembly’s National Administration and Internal Security committee on June 12, 2025.
"We cannot disclose specific details about the allegations at this time, since they are now a matter of ongoing court proceedings," said the DCI in a statement following publication of the Daily Nation story.
"We want to assure the members of the public that the DCI operates strictly within the confines of the law," stated the DCI.
Police Spokesperson Michael Muchiri said he had not seen the documents served on the police and Judiciary by Mr Mutiso and could not comment on the issue.
The case of the four is one of many incidents that have fuelled reports of Kenya inching closer to being a surveillance and police state.
Multiple reports, court cases and Parliamentary hearings have given indication to something citizens and the civil society have warned about – Big brother watching.
Canada-based software developer Mary Wacuka Maina has filed a case in court seeking more than Sh290 million in compensation.
She says the government botched a contract with her company for the development of a surveillance system targeting opposition leaders and government critics.
Seven months after the case was filed, Mr Kanja appeared in the Senate to explain the circumstances surrounding the death of 31-year-old teacher Albert Ojwang.
The police boss told the lawmakers that the Communications Authority of Kenya (CA) aided police in tracking down Mr Kelvin Moinde, who was thought to be behind social media posts that reportedly defamed Deputy Inspector-General of Police Eliud Lagat.
Mr Kanja added that Mr Moinde led police to Mr Ojwang, who died hours after his arrest on June 7.
The CA later denied playing any role in the arrest, insisting that it had no real-time access to the location data of mobile phone subscribers and that it was only a regulator.
Court admission
Barely three months later, DCI officer Bosco Kisau admitted to city magistrate Benmark Ekhubi that his department – the Serious Crimes Unit – obtained private data of blogger David Mokaya from Safaricom without a court order.
Mr Mokaya is accused of publishing false information, a charge the DPP has often used in cases involving social media posts critical of President William Ruto and the Kenya Kwanza administration.
The Appellate Court will on Wednesday hear a case filed by the Bloggers Association of Kenya, challenging the Computer Misuse and Cybercrimes Act.
The bloggers have appealed a February 2020 judgment by Justice James Makau, which dismissed their petition to declare 26 clauses of the Act unconstitutional.
Ms Mercy Mutemi, a lawyer with experience on Constitutional law and the digital age, told the Daily Nation that the Act has been abused by state security agencies to curtail freedom of speech.
In June, Treasury Cabinet Secretary John Mbadi made a Sh120 million provision for the DCI to acquire a surveillance system, a move seemingly aimed at rubberstamping government spying, whose full force was witnessed during the Gen-Z protests in 2024 and this year.
Sources confirm that the system has already been acquired.
At the height of the protests, a secret squad led by the DCI used IT experts to track down individuals believed to be fuelling the anti-government demonstrations.
The team, based at the DCI headquarters, would monitor social media activity of individuals and, through geolocation – the use of phone data to track down the exact place of a device – find those believed to be threats.
Officers used hired vehicles to abduct those it tracked.
More than 80 people have been abducted since mid-2024, when the youth protests began.
In December 2024, the Civicus Monitor, a research consortium monitoring freedom globally, ranked Kenya’s civic space as obstructed – the second worst score in its marking scheme.
That followed repressed freedom, fuelled by violent responses to unarmed, peaceful protesters and the arrest and abduction of individuals critical of the government.
A year earlier, the US said Kenyan state security agencies had unfettered access to the country’s telecommunication networks – even those operated by private firms.
While the US Department of State reported that the government had taken steps to identify and punish officials who may have committed human rights abuses, it noted that “impunity was a problem at all levels of government”.
“Furthermore, Privacy International alleged police had electronic surveillance powers and Freedom House reported authorities used various types of surveillance technologies to monitor citizens,” the US government report stated in 2023.
“In April 2023, the Supreme Court allowed the Communications Authority to use a device that gave it access to personal customer data from service providers.”
The findings on mass surveillance were also made by the Paradigm Initiative, a civil society group, whose May 2024 report was compiled with the support of Open Society.
“It (report) asserts that surveillance technology is occasionally used by Kenya, Uganda, Tanzania and Rwanda to target specific people for abuse, incarceration and torture because they have expressed divergent opinions. This goes against the policies of the technology companies as well as statutory provisions, international human rights law and constitutional safeguards,” the report said.
In May this year, Aldai MP Marianne Kitany proposed the amendment of the Kenya Information Communications Act to introduce a metred billing system which would give state agencies real-time access to online activities of individuals.
Internet service providers will be compelled to share the data if the proposed amendment is passed into law.
“This isn’t about fair billing. It’s about building a surveillance infrastructure, one that allows the state to map, monitor and potentially control how, when and why Kenyans access the internet,” the Kenyan chapter of the International Commission of Jurists said.
The government has defended measures to control abuse of cyberspace.
“The ability of the citizens to mobilise online for negative purposes poses a threat to national security, as demonstrated by the Gen-Z protests.
"This brings to the fore the need for sharper focus into the cyber domain as an area to be closely monitored, and the required investments being made,” says the annual state of national security report for the period between September 1, 2023 and August 31, 2024, which was submitted to Parliament.
Additional reporting by Brian Wasuna
