Effectiveness in Preventing and Prosecuting Cybercrime

·        Partially – The CMCA shows that the country has taken a step to put in place laws that criminalize cybercrime and allow prosecution of the same. It is dismally effective as a deterrent and as far as prosecution is concerned, I have yet to see effectiveness as it has mostly focused on social media-related issues on harassment and fake news, for other crimes the cases seem to be stuck in court for years which hardly makes it effective as a deterrent.

Provisions Hindering Effective Prosecution:

·        Law enforcement at various stations in the country also need to be effectively trained on how to handle cybercrime-related incidents when individuals show up at police stations to either report or seek advice from the officers.

Public Awareness:

·        Public Awareness is poorly done regarding the CMCA, a clear indication of this is on social media platforms where users have been subject to bullying, and others have called for the hacking of platforms all of which are crimes in the CMCA. The people don’t know what protections the CMCA offers

 

Section 2:

Impact on Privacy Rights:

• The CMCA grants law enforcement broad powers to monitor and intercept communications, which could infringe on citizens' privacy rights. It states that “Where a police officer or an authorised person has reasonable grounds to believe that the content of any specifically identified electronic communications is required for the purposes of a specific investigation in respect of an offence, the police officer or authorised person may apply to the court for an order” and in another section “ Where a police officer or an authorised person has reasonable grounds to believe that there may be in a specified computer system or part of it, computer data storage medium, program, data, that— (a) is reasonably required for the purpose of a criminal investigation or criminal proceedings which may be material as evidence; or (b) has been acquired by a person as a result of the commission of an offence, the police officer or the authorised person may apply to the court for issue of a warrant to enter any premises to access, search and similarly seize such data.” the ‘may’ in these section implies that it is optional for the officers to seek a court order or warrant.
• During the recent “Gen Z” protests, some of the arrested people had their devices confiscated for ‘further analysis’ despite being released unconditionally. In my understanding, police should be required to provide a clear and specific explanation for the arrest and the reasons for seizing a person’s device. This explanation should be given in writing and should include the alleged crime and the connection of the device to the investigation if not a court order for the seizure.

Restriction of Freedom of Expression:

• Section 22 focuses on false publication in terms of “false”, “misleading” or “fictitious” information, this should not be abused to deter people from expressing themselves by publishing information in the form of opinions or satire. The broad definition of "false publications" under the CMCA has seemingly been used by the government and politicians to silence bloggers, journalists and social media users on various platforms.

 

Section 5:

Impact on Businesses and Individuals:

·        Impact on Businesses in Terms of Cybersecurity Practices and Investments- The CMCA’s requirements for critical information infrastructure are extensive such as the protection of, the storing of and archiving of data held by the critical information infrastructure; (c) cyber security incident management by the critical information infrastructure; (d) disaster contingency and recovery measures, which must be put in place by the critical information infrastructure; (e) minimum physical and technical security measures that must be implemented in order to protect the critical information infrastructure;

Such requirements although necessary can be deemed as unfair since there are significant costs for compliance, such as hiring skilled personnel, training, purchasing equipment, storage, and securing licenses among others. The Act mandates stringent measures, but without providing financial or technical support, this places a disproportionate burden on organizations, especially smaller ones.

 

Section 6:

Analysis of the Effectiveness of the CMCA in Embracing Emerging Technologies and the Associated Cyberthreats

Conduciveness to Technological Advancement:

Some sections of the CMCA might inadvertently stifle innovation by imposing regulations that are difficult for innovators or small organizations to navigate. The potential for arbitrary enforcement also creates uncertainty for innovators.

·        The act does not mention anything on responsible disclosure that innovators and researchers may lean on when identifying potential issues that can be responsibly disclosed and as a result strengthen the security systems and infrastructure that may be exposed.

·        The CMCA allows the government to declare certain infrastructure as critical, with heavy regulatory requirements for cybersecurity, data protection, and incident management. While necessary, the lack of financial or technical support makes it difficult for smaller outfits to comply. High compliance costs and stringent requirements could deter new entrants or smaller firms from innovating in certain sectors or causing disruption in others lest they are deemed as critical infrastructure, potentially leading to reduced competition and innovation.

Addressing Emerging Technologies (AI, Blockchain, IoT, Quantum Computing, Cryptocurrency):

• The CMCA does not specifically address newer technologies like AI, blockchain, IoT, quantum computing, or cryptocurrency, leaving regulatory grey areas that could be exploited.

 

Section 7: General Questions

Legal Uncertainties or Ambiguities in the Act:

• The word "may" implies that obtaining a court order or warrant is optional rather than mandatory. This leaves room for interpretation, which could lead to inconsistent enforcement. Some officers might proceed without a court order, while others might seek one, creating uncertainty for individuals and organizations about their rights and protections.

Capacity-Building Needs of Law Enforcement and Judiciary:

• Establish comprehensive training programs on digital forensics, cybercrime investigation, and evidence preservation. This could include mandatory courses for officers, specialized cybercrime units, and collaboration with cybersecurity experts.
• Increase recruitment and training of officers specifically for those handling cybercrime-related cases. Allocate resources to ensure that these units are adequately staffed and equipped to handle the growing number of cases.
• Consider the creation of a specialized cybercrime court to handle all cyber-related cases. Provide continuous training for judges and legal practitioners in this court to keep up with evolving technologies and cyber threats.

Robustness of Kenya’s Cybersecurity Infrastructure:

• Granted there have been significant improvements in Kenya’s cybersecurity posture, but the current state of Government and parastatal technology, resilience and infrastructure is significantly under-equipped and unable to address the challenges posed by rapidly advancing technologies and techniques in play by malicious actors.