In a move that significantly reshapes Kenya’s digital landscape, President William Ruto signed the Computer Misuse and Cybercrimes (Amendment) Act, 2024, into law on October 15, 2025. The signing marks a pivotal moment in the country’s effort to combat rapidly evolving digital threats, but it has simultaneously ignited a fierce debate over digital rights and government oversight.
The new legislation amends the original Computer Misuse and Cybercrimes Act of 2018, seeking to fortify the legal framework against modern cyber-offenses like SIM-swap fraud, phishing, and cyber harassment. While the government champions the Act as a necessary upgrade to protect citizens and critical infrastructure, civil society groups and legal experts have raised concerns about its potential for misuse and its impact on freedom of expression.
The Context: A Race Against Digital Crime
The need for updated legislation was driven by a surge in complex cybercrimes that the 2018 Act was not fully equipped to handle. Incidents of SIM-swap fraud, where criminals illegally acquire a victim’s phone number to access bank accounts and digital services, have become increasingly common and costly. Furthermore, the spread of malicious content, disinformation, and online harassment necessitated a stronger legal deterrent.
The Act’s legislative journey was closely watched, culminating in its passage by the National Assembly and subsequent assent by the President. It is designed to empower the National Computer and Cybercrimes Coordination Committee (NC4) with enhanced capabilities to detect, prevent, and prosecute digital offenses.
Key Provisions: A Closer Look at the Amendments
The Computer Misuse and Cybercrimes (Amendment) Act, 2024 introduces several critical changes. Here are the most noteworthy inclusions that will affect both businesses and individual citizens:
| Provision | Description | Impact |
|---|---|---|
| New Offense: SIM-Swap Fraud | Criminalizes unauthorized SIM card alterations with the intent to defraud. | Imposes severe penalties of up to 10 years imprisonment or a KSh 5 million fine, providing a strong deterrent against a prevalent financial crime. |
| Enhanced Penalties for Cyber Harassment | Significantly increases the penalties for online harassment, including the spreading of false information that causes public panic. | Penalties are raised to up to 10 years imprisonment or a KSh 5 million fine, aiming to curb digital abuse and misinformation. |
| Content Blocking Powers | Empowers the NC4 to order the blocking or removal of websites, applications, or content deemed to promote “illegal activities, terrorism, or extreme religious practices.” | Grants the government significant control over online content, a provision that has been the primary source of controversy. |
| Phishing and General Penalties | Introduces specific offenses for phishing and scams, while raising general cybercrime penalties for severe cases. | Penalties for severe cybercrimes can now reach up to KSh 10 million or 20 years imprisonment, underscoring the seriousness of these offenses. |
| Critical Information Infrastructure (CII) Regulations | Mandates data localization, annual risk assessments, and the establishment of Cybersecurity Operations Centres for entities in critical sectors like banking and energy. | Increases compliance costs for businesses but is intended to enhance the operational resilience of essential services. |
The Controversy: Balancing Security and Freedom
The most contentious aspect of the new law is the provision granting the NC4 the power to order content blocking without explicit judicial oversight. Critics, including civil society organizations, argue that this broad authority could be weaponized to suppress dissent, target journalists, and infringe upon the constitutional rights to freedom of expression and privacy (Articles 33 and 31).
The immediate aftermath of the signing saw legal challenges emerge, with the High Court temporarily suspending the operation of certain sections of the Act, pending a full hearing. This legal pushback highlights the delicate balance the country must strike between ensuring national security in the digital realm and safeguarding democratic freedoms.
Conclusion
President Ruto’s signing of the Cybercrimes Amendment Act is a clear signal of Kenya’s commitment to modernizing its defenses against cyber threats. It brings with it much-needed legal tools to prosecute financial crimes like SIM-swap fraud and curb online abuse. However, the ongoing legal and public debate surrounding the Act’s content-blocking powers underscores a fundamental challenge: how to create a secure digital environment without inadvertently stifling the very freedoms that define a vibrant democracy. The final interpretation and application of this law will ultimately determine its legacy in Kenya’s digital future.
Metropolitan 