YOU ARE BEING TRACKED: Understanding Surveillance Oppression in Kenya (Part 1)

Colonial era

Political dissent monitoring via spying operations and subsequent repression via government-sanctioned violence and extrajudicial killings have a tragically rich history in Kenya. It started in the 19th century when the British recruited missionaries and mercenaries as porters and guides as they colonised our territory. As they crept into villages and communes, they planted their allies in critical positions such as chiefs, slowly displacing traditional leaders to have moles who could provide valuable intel.

Over time, their spying operations grew more sophisticated. In 1892, they established the British East African Police, with one of its main mandates being to gather intelligence at scale for the support of the British East Africa Protectorate’s colonial affairs. Quickly, the Police became the most sophisticated intelligence agency on the East African territory, and by World War I, their intelligence-gathering operations had expanded into neighbouring territories for wartime enemy reconnaissance.

A few decades later, in 1926, the Criminal Investigations Division (CID) was created. This division also included a “Special Branch”.  This Special Branch was staffed mostly by the colonists, and its mandate was to not only collect intelligence on criminal activities but also to spy on locals. The Special Branch was secretly tasked with crippling the Kenya African Study Union, the Kenya Land and Freedom Army and the trade union movement, which were challenging British rule by agitating for democratic and human rights. However, it was not until 1952, at the start of the Mau Mau uprising, that this Special Branch became constituted as a formal intelligence unit.

Post-colonial era

When Kenya won her independence, Johnstone Kamau (alias Jomo Kenyatta) – the Black British comrade who became Kenya’s first President, co-opted the Special Branch instead of dismantling it. He ensured that intelligence-gathering powers in post-independence Kenya remained concentrated around the presidency – himself – and the Special Branch: the institution that enabled the British to run one of the most brutal repressions of independence movements worldwide. To ensure the Special Branch was firmly under his control, he made it independent from the police and granted it a new charter in 1969. The Police and Special Branch effectively became individualised, and politicised, and were subsequently deployed regularly in spying, targeting and assassinating prominent government critics. This remained the case under Daniel Moi, who also used these institutions to systematically track, capture, torture and kill political dissidents to protect his 24-year-long regime. It was also under Moi’s reign that the Special Branch was renamed the Directorate of Security Intelligence (DSI) through a Presidential charter in 1986. This was a superficial makeover of the brutal institution, a pretence at reform, as the Special Branch’s organisational structure and mode of operations were never abandoned by the DSI.

In 1998, the enactment of the National Security Intelligence Service Act (1998) midwifed another cosmetic attempt at reforms through its establishment of a Service to be known as the National Security Intelligence Service (NSIS). Although this transition included the purging of almost 200 former officers, the removal of arrest authority from the NSIS, and the formal separation of the NSIS from the police, the mode of operations displayed by the NSIS subsequently proved that nothing critical had changed. Today, the NSIS is known as the National Intelligence Service (NIS) following the enactment of the National Intelligence Service Act (2012). On paper, the NIS was supposed to be dedicated to protecting the national security interests of Kenya and safeguarding its citizens, but in practice, it has been the most feared institution by the people was to protect.

Post-Moi era

As Kenya transitioned into a new millennium under the new political dispensation led by President Mwai Kibaki, political dissent monitoring via spying operations ventured strongly into its digital age. When sectarian violence tore through Kenya after the 2007 election, the government created the National Cohesion and Integration Commission (NCIC), to team up with the then Communications Commission of Kenya (CCK) renamed the Communications Authority of Kenya (CA) in  2014, and the National Security Intelligence Service (NSIS). The CCK suspended live television broadcasts and radio transmissions, and with the assistance of other institutions, routinely scrutinised SMS and call communications to flag them for ethnic hate speech keywords. During that period, the National Steering Committee on Media Monitoring of the Ministry of ICT reported the blocking of hundreds of thousands of SMS messages daily: a testament to the government’s growing powers.

By 2012, the National Intelligence Service Act and the Prevention of Terrorism Act had codified the government’s interception capacities. This operationalized dictates of the Constitution of Kenya (2010), which established the National Intelligence Service and dictated its mandate. The National Intelligence Service Act (2012) granted the Director General of the NIS the power to order the interception of any communication, information or data associated with any person, place, thing, or premises, even before an application for an interception warrant. Although this power was meant to be exercised judiciously, in the ‘interests of national security’ and with respect for legal processes and oversight, ‘the theory often differed from the practice’.

In addition, the Prevention of Terrorism Act (2012) granted some Police Officers the power to request the interception of communications. It also granted some security officers the power to enter telecommunications operators’ premises to install monitoring devices to capture data that may be used to track not just an individual, but potentially a group of individuals as well. While the Act emphasised the need for a warrant issued by a court before intercepting communications, the potential for abuse remained.

Two years later, the Omnibus Security Laws (Amendment) Act 2014 was hastily passed, introducing a new amendment to the Prevention of Terrorism Act. This amendment tasked the Cabinet Secretary with making new regulations to govern communications interception by the “national security organs”. The “national security organs”, which are defined widely in Article 239 of the Constitution, are the Kenya Defence Forces (KDF), NIS and the Kenya Police Service. This Security Laws (Amendment) Act slipped through during Christmas and received limited public consultation. It introduced a key section called “Special Operations”. This section allowed covert operations to be initiated by the orders of the Director General of the NIS, effectively mandating any member of the intelligence service to covertly conduct communications interception. Although constitutional challenges were successfully made against certain provisions of this Act, the new communication interception powers emerged largely untouched.

The Act also established oversight bodies such as the Intelligence Service Complaints Board to oversee the conduct of the national security organs. Still, the standards with which this oversight would be conducted remained unclear. Soon after, reports emerged that the CCK, with the help of the International Telecommunications Union (ITU), was building national internet surveillance tools. Although the press and legal professions forewarned that this Network Early Warning System (NEWS), which intercepts internet traffic entering and leaving Kenya directly through Internet Service Providers’ networks, could potentially violate Kenyans’ constitutional rights, the project was not halted.

Two years later, the government’s counterterrorism operations in response to Al Shabaab terror attacks within the country, code-named Usalama Watch, led to one of the most ruthless and disproportionate violations of human rights, especially against Somalis who have been used as scapegoats in Kenya’s counter-terror crackdown. During this Police operation, over 4,000 majority ethnic Somalis were tracked and arrested. Many of them were subsequently killed or ‘disappeared’ while in the custody of the police. Many studies, such as those published by the Kenya National Human Rights Commission, Human Rights Watch, and the Kenyan Independent Medico-Legal Unit, also reported hundreds of cases of extrajudicial killings and thousands of cases of police brutality. They also raised alarm that civil society groups were targeted by this counterterrorism program, with several lawyers and media professionals disappearing under suspicious circumstances. This indicated that the enhanced powers for interception and monitoring were being abused and that oversight and accountability mechanisms were falling short.

Modern-day Kenya

Today, The Communications Authority of Kenya (CA) remains Kenya’s telecommunications industry regulator: inspecting equipment used in the country’s telecommunications infrastructure, overseeing the management of this telecommunications infrastructure, awarding operating licenses, and monitoring regulatory compliance. The CA is also a leading institution in Kenya’s Cybersecurity Policy framework, alongside the NIS, the KDF (Kenya Defense Forces) and others, and sitting in Kenya’s National Cybersecurity Steering Committee.

The CA is one of the main bodies that feeds data both directly and indirectly to security forces. Telecommunications operators are routinely required to provide the CA access to their systems, premises, facilities, files, records and other data, as dictated by the law. Operators are also expected to comply with other government agencies’ requests to hand over customer data, as outlines by other laws. In addition, as reported by whistleblowers interviewed by Privacy International, this compliance may even be enforced through threats that the licenses of operators would be revoked if they refused to comply.

Government agents also staff strategic offices within telecommunications operators’ facilities, both formally with providers’ knowledge, and informally as undercover agents. At least one law enforcement liaison, a police officer of the Directorate of Criminal Investigations (CID) is always present on secondment. As for Kenya’s largest telecommunications operators, dozens of officers are usually present in their premises, aided by additional civilian investigators, collectively feeding intel to all police branches. They routinely query telecommunications databases which contain critical information. These include but are not limited to call records, the type and duration of communication, SIM registration details, mobile money transactions, phone numbers of interacting devices, and even the location of the base transceiver stations (BTS) pinged by devices, which are a proxy of users general locations. With this BTS data, surveillance teams can subsequently be deployed to the user’s approximate location, and signal interception devices deployed to pinpoint the exact location of their target device.

The NIS also has direct access to Kenya’s telecommunications networks. They can intercept the communication content and data of every citizen without showing an interception authorization to the communications service provider or anyone else, and without obtaining a warrant. When doing so through providers as previously described, they can liaise with system engineers to acquire extra information. NIS agents routinely listen to live calls and analyse them, and their targets have no way of knowing that their communications are under surveillance. This is unlike police agencies who usually must obtain warrants to prepare criminal cases. However, warrants are often not sought when cases will not be prepared, and thus surveillance is also conducted without clear oversight.

Kenya – unlike many African countries like South Africa and Nigeria – does not have a specific surveillance law. Instead, a set of overlapping laws as described above regulate surveillance, and it is not always clear which law applies under which circumstance. For the purposes intended by the spirit of Kenya’s laws, communications surveillance technologies should be deployed by the government’s security agencies to enhance national security, such as for the investigation of terrorism. However, these agencies have repeatedly deployed these tools against political actors, civil society groups, journalists, human rights lawyers, activists, youth leaders and the citizens at large. The NIS has previously attempted to procure surveillance products and malware such as the infamous FinFisher hacking suite to take down websites critical of the Kenyan government. WikiLeaks also exposed that the NIS may have acquired additional spying tools from an Italian offensive security company to infect computers and smartphones.

Much recently, security forces have used social media monitoring techniques to track and abduct dozens of Kenyans in the wake of the #RejectFinanceBill2024 protests. These abductions have included doctors, activists, jurists, and other Kenyan citizens who have been particularly critical on social media over the punitive Finance Bill 2024, or supportive of the demonstrations against the bill. Despite assurances from the government that its agencies would protect, defend and facilitate the right to freedom of expression and peaceful assembly, human rights violations have become rampant, and many people have been murdered in cold blood by the Police. Thousands of protestors have also been exposed to tear gas (which is considered a banned chemical warfare agent under the 1925 Geneva Convention). Other protestors have been brutalised by baton-wielding police on horseback and in uniform, and many have also been shot at point-blank range, ending up maimed or dead. Institutions such as Amnesty International Kenya, the Kenya Medical Association, the Law Society of Kenya, and the Police Reforms Working Group Kenya have reported these human rights violations, but now that the KDF has also been marshalled into the streets by President William Ruto, it is clear that the government will not refrain from using violence and murder against its people.

In addition, just as it has been throughout Kenya’s history, the government’s defence, intelligence and communications surveillance budget, which is huge and growing, is being pointed menacingly at the common Mwananchi. These abuses of power by government agencies are a tactical strategy for social control, to protect a corrupt and intolerable regime by using fear and violent repression against people who are pining for reforms. Kenyans have now lost trust in those responsible for protecting them. These human rights abuses have tarnished the legitimacy of Ruto’s Kenya Kwanza government entirely, and protests have erupted across every region in the country, including within the traditional stronghold of the President himself.

Not only in Kenya but also across the African continent, privacy is enshrined in the constitutions of many countries. It is also guaranteed in international conventions such as the Universal Declaration of Human Rights (UN 1948), the International Covenant on Civil and Political Rights (UN 1966) and the Declaration of Principles of Freedom of Expression and Access to Information in Africa (2019), all which confer on all persons the right to privacy and to private correspondence and communication, and all which Kenya has signed and ratified. However, despite this, the government remains unwilling to respect these rights. This denies individuals the ability to communicate and correspond freely, participate in public discourse, and strengthen democratic processes by allowing for criticism, advocacy, and the exposure of malfeasance. These freedoms, which are the bedrock of democratic governance, are essential to any society’s progress, and are indispensable within a democracy. They must be respected or reclaimed if our democracy is to survive.

The government’s bloodlust has, therefore, created the need for every citizen to become intimately aware of what government agencies are capable of and can get away with. Amid these growing concerns about extensive surveillance and misuse of power by government agencies, citizens need to adopt a culture of defensive security. With no one to defend them, the people must now learn how to protect their privacy.

Carry on to Countering Surveillance Oppression in Kenya (Part 2), to learn how to respond to threats against your right to privacy using defensive security techniques and state-of-the-art technologies.