Questions have emerged over the role of Kenya’s cybersecurity agencies after blogger Cyprian Nyakundi raised concerns about attempts to have some of his articles removed from the internet.
A few days ago, Nyakundi said the Communications Authority of Kenya and its cybersecurity unit, KE-CIRT, had contacted some of his hosting providers, including Cloudflare and DigitalOcean. According to the blogger, the companies were asked to take down articles that had been flagged over issues such as cyber harassment and privacy concerns.
Nyakundi questioned whether such requests fall within the proper role of a cybersecurity unit. He argued that KE-CIRT should mainly deal with genuine cyber threats, including hacking, malware and attacks on computer systems, rather than become involved in disputes over published content.
The blogger further argued that anyone who believes his articles are false or harmful should challenge them through the courts. In his view, using administrative channels to have content removed can deny the parties involved an opportunity to present their evidence before an independent court.
The issue also raises questions about how Kenya handles disputes involving defamation, privacy and online content. Defamation claims are generally dealt with through the courts, where both parties can make their arguments and evidence can be examined before a decision is made.
Privacy complaints have their own legal framework and can be handled through the Office of the Data Protection Commissioner. At the same time, police and prosecutors have powers to investigate and prosecute genuine cyber offences under the Computer Misuse and Cybercrimes Act.
The concern raised by Nyakundi is that involving a cybersecurity agency in a content dispute could create pressure on hosting companies to remove material before a court has determined whether it is unlawful. International companies receiving official requests from a government agency may choose to comply rather than become involved in a legal dispute.
For journalists, bloggers and other online publishers, such a situation could have wider implications.
Content could potentially disappear not because a court has ruled against its publication, but because a hosting company received an official request and decided to act on it.
The distinction between cybersecurity and freedom of expression therefore remains important. Cybersecurity focuses on protecting systems, networks and users from digital attacks, while disputes over reporting involve questions of accuracy, reputation, privacy and public interest.
If published material is found to be unlawful, the legal system provides avenues for seeking redress. Taking such disputes before a court allows both sides to be heard and ensures that any restrictions on content are based on a proper legal process.
The concerns raised by Nyakundi therefore put a spotlight on the need for clear boundaries between cybersecurity enforcement and disputes over online reporting, particularly where freedom of expression is involved.
