The government has rolled out a reference guide for investigating and prosecuting cybercrime, moving to close gaps exposed by a scan that found more than 2,000 vulnerabilities and 4.8 million leaked credentials across Kenyan systems.
The Rapid Reference Guide on Investigating and Prosecuting Offences under the Computer Misuse and Cybercrimes Act gives police and prosecutors a shared playbook for handling digital crime, from mobile money fraud to attacks on government networks. Its release follows a period in which Kenya’s digital footprint has expanded faster than the institutions meant to police it.
A Scan That Exposed the Scale of the Problem
The guide follows a passive cyber-exposure assessment, a scan of public-facing systems that does not require direct access to a network to find weaknesses. It turned up thousands of unpatched flaws and millions of compromised login credentials sitting exposed online, a total officials say shows how much of the country’s digital infrastructure remains open to attack.
Speaking at the launch, Interior Principal Secretary Raymond Omollo said Kenya’s security threats have moved beyond the physical world, and that cybercrime has grown alongside the country’s digital expansion.
“This reference guide is more than a publication. It is a practical tool for strengthening investigations, supporting prosecutions and helping to keep our cyberspace safe and secure,” Omollo said.
He added that investigators and prosecutors need a grasp of the law, discipline in handling digital evidence and the ability to build cases that hold up in court.
Mobile Money Fraud a Growing Concern
Officials pointed to mobile money fraud as one of the fastest-moving threats, with criminals moving stolen funds into virtual assets almost as soon as they take it. This speed makes tracing and recovering funds harder, and it is one of the gaps the guide is meant to address.
The Computer Misuse and Cybercrimes Act, enacted in 2018, has drawn scrutiny from press freedom groups over provisions on “false publications” and online communication. In March 2026, Kenya’s Court of Appeal struck down sections of the law that criminalised the spread of false news, following a challenge from the Bloggers Association of Kenya, though it left other contested provisions in place. Article 19 has previously warned that sections of the Act could be used against journalists, bloggers and activists rather than against the cybercrime the law targets.
The document, developed jointly by the National Computer and Cybercrimes Coordination Committee (NC4), the Office of the Director of Public Prosecutions and the National Police Service, sets out the legal and evidentiary elements needed to sustain a cybercrime charge under the Computer Misuse and Cybercrimes Act, Cap 79C. Its foreword commits the country to “a secure cyberspace for peace, justice and strong institutions.”
What the Guide Covers
| Focus area | What it addresses |
|---|---|
| Electronic evidence | Collecting, preserving and presenting digital evidence in court |
| Mutual legal assistance | Cross-border cooperation on cybercrime cases |
| Offensive communication | Handling cases involving online harassment and abuse |
| Unlawful online content | Procedures for removing illegal material from the internet |
| Institutional coordination | Aligning police, prosecutors and regulators on shared processes |
| Investigative standards | Standardising how cybercrime cases are built nationwide |
Kenya Widens Its International Reach
Kenya has agreed to share cybercrime information with 76 countries and has started the process of joining the Budapest Convention on Cybercrime, the binding international treaty on the subject. Parliament has invited public submissions on the accession through September 11, 2026.
Omollo said reach abroad has to be matched by strength at home. “The fight against cybercrime cannot be won by government alone. An informed and vigilant public is one of our strongest lines of defence. Wananchi must not be mere recipients of security but active partners in protecting our digital space,” he said.
He added that feedback gathered as the guide is put to use will feed into future revisions, so the document evolves alongside the threats it is meant to counter.
Digital Services Expansion Raises the Stakes
Omollo pointed to platforms such as e-Citizen as proof of the government’s push to move public services online. “The Administration recognises the important role of technology in improving efficiency and access to public services. We are already benefiting from these innovations, but we must ensure that the systems and the people using them are protected,” he said.
That expansion sits inside a wider plan. The launch supports the Kenya Kwanza Administration’s digitisation agenda under the Bottom-Up Economic Transformation Agenda and the Beyond 2030 Vision, both aimed at turning Kenya into a high-income, technology-driven economy. Whether Kenya gets there safely may depend on how well guides like this one turn law into practice on the ground.
