Kenya has rejected sections of the Budapest Convention on Cybercrime, the first international treaty on internet and computer crime.
Kenya wants the National Assembly to approve reservations to the convention that would limit attempts to try Kenyan citizens for cyber offences committed outside the country.
Under the proposed reservation, Kenya would not apply provisions allowing extra-territorial jurisdiction over a Kenyan national for an offence committed outside Kenya, except in cases provided for under Kenyan law.
The Budapest Convention was adopted by the Committee of Ministers of the Council of Europe at its 109th Session on November 8, 2001. It was opened for signature in Budapest, Hungary, on November 23, 2001, and entered into force on July 1, 2004.
There are 76 state parties to the convention, 12 of them from Africa.
“Kenya supports the objectives and cooperative spirit of the Budapest Convention. However, to ensure that obligations under the Budapest Convention are fully harmonised with domestic laws and constitutional safeguards, it is prudent and consistent with international treaty practice for Kenya to enter specific reservations and interpretative declarations at the time of accession,” Foreign and Diaspora Affairs Cabinet Secretary Musalia Mudavadi said.
“This will preserve the integrity of Kenya's legal framework, clarify the scope of Kenya's obligations and ensure that the Budapest Convention is implemented in a manner that preserves its national interests.”
Mr Mudavadi said Kenya intends to enter a reservation under Article 42 of the convention on the extension of extra-territorial jurisdiction over Kenyan citizens.
“The Republic of Kenya reserves the right not to apply Article 22(1)(d) to the extent that the offence is committed outside Kenya by a Kenyan national, except in cases provided for by Kenyan laws,” he said.
Mr Mudavadi said implementation of Article 22(2) would be through Kenya’s mutual legal assistance and extradition framework.
Prime Cabinet Secretary Musalia Mudavadi.
Photo credit: Dennis Onsongo | Nation Media Group
The Budapest Convention provides for offences including illegal access to computer systems, computer system interference, computer-related fraud and child sexual abuse, among others.
Mr Mudavadi said the convention seeks to harmonise national laws relating to cybercrime, improve investigative techniques and increase international cooperation.
The move comes amid increased use of information and communication technologies, government digitisation and the exponential growth of cyber threats and attacks.
In October 2024, the Council of Europe invited Kenya to accede to the convention.
Upon accession, the convention will apply to Kenya three months after the country deposits its instrument of accession with the Secretary General of the Council of Europe.
“Cybercrime and cyber-attacks continue to evolve at unprecedented scale, volume and speed. The possibility of large-scale cyber-attacks is real.
Such attacks may occur simultaneously across states and continents, hence the need for international collaboration and cooperation,” Mr Mudavadi said.
Kenya has already enacted the Computer Misuse and Cybercrimes Act, Cap. 76C, and the Data Protection Act, Cap. 411C, which address substantive and procedural elements required under the Budapest Convention.
“Accession, therefore, will reinforce and harmonise Kenya's existing legal framework with international standards without necessitating extensive legislative overhaul,” Mr Mudavadi said.
He said Kenya has a robust mutual legal assistance and extradition framework to facilitate international cooperation.
Accession to the Budapest Convention will enhance cooperation with other countries in combating cybercrime and enable Kenya to participate in the existing 24/7 network, he said.
“This cooperation is critical for accessing electronic evidence stored in other jurisdictions and investigating transnational cybercrime effectively,” Mr Mudavadi said in a memorandum to MPs.
Membership of the Budapest Convention will also give Kenya access to the Council of Europe Cybercrime Programme Office, capacity-building initiatives and technical assistance.
“This is particularly important for Kenya to strengthen institutional capacity, judicial and law enforcement training and inter-agency cooperation in combating cybercrime,” he said.
Mr Mudavadi said that while the newly adopted United Nations Convention against Cybercrime aims for broader participation, the Budapest
Convention remains, until the UN treaty enters into force, the most operational and widely implemented international instrument on cybercrime.
He said accession to the Budapest Convention would not preclude Kenya's future engagement with the United Nations Convention against Cybercrime, but would position the country to benefit from an established network of states and best practices.
Accession to the Budapest Convention aligns with Kenya's digitisation agenda and its commitment to the Bottom-Up Economic Transformation Agenda (BETA), he said.
“The Budapest Convention will reinforce the existing legal framework and create an enabling environment for a safe and secure cyberspace. This will spur innovation and economic growth as well as enhance service delivery to citizens,” Mr Mudavadi said.
Under the convention, Kenya would be bound by obligations including enforcement of provisions under Part III of the Computer Misuse and Cybercrimes Act, Cap. 76C, covering illegal access to computer systems, illegal interception of data, data interference, system interference and content-related offences such as child sexual abuse material.
Kenya would also be required to ensure international cooperation, including mutual legal assistance and extradition, and establish a full-time point of contact for urgent requests.
The government would also be obligated to safeguard human rights, including the right to privacy and fair trial, implement measures to enhance the security of computer systems and networks, and cooperate with other countries and international organisations.
Kenya stands to benefit from collaboration with other states in global efforts to combat cybercrime and contribute to building a secure cyberspace for socio-economic prosperity.
The country would also benefit from international cooperation in the investigation and prosecution of cybercrimes, helping overcome challenges associated with diverse national legal frameworks.
Other benefits include the exchange of information and experiences with other state parties on emerging cybercrime trends, as well as financial and technical support to strengthen the country's capacity to combat cybercrime.
