Computer Misuse and Cybercrimes

This Act may be cited as the Computer Misuse and Cybercrimes Act.

Defines: "alters, modifies or erases a program or data or any aspect related to the program or data in the computer system."

Protects the confidentiality, integrity and availability of computer systems, programs and data.

The Committee must consult owners and submit recommendations to the National Security Council identifying entities to be gazetted as critical information infrastructures; it also lists assessments and recommendations the Committee carries out regarding threats, harms, preparedness, risk factors and security methods.

Owners or operators of designated critical infrastructure must report incidents likely to be computer and cybercrime attacks and the actions they will take to the Committee; the National Security Council must provide technical assistance on receipt of such reports; the Director may investigate and may secure infrastructure and must submit periodic reports to the National Security Council.

Private entities may enter into information-sharing agreements with public entities on critical information infrastructure; parties to such agreements must review and remove unrelated personal details before sharing; persons must not share others' health status without prior written consent.

The owner or person in control of a critical information infrastructure must annually submit a compliance report to the Committee in line with a critical infrastructure framework; the Director must monitor, evaluate and report on audits and has power to request additional information within a specified period.

Establishes the National Computer and Cybercrimes Co-ordination Committee.

Lists the members of the National Computer and Cybercrimes Co-ordination Committee, names the Director as secretary (non-voting), and requires the Committee to report to the Cabinet Secretary responsible for internal security.

The Committee has multiple functions including advising Government and the National Security Council on cyber matters, coordinating security organs, receiving and acting on reports, developing frameworks and standards for critical information infrastructure, cooperating with response teams, managing PKI and training frameworks, and regulating its own procedure.

Establishes a Secretariat that comprises a Director and public officers; the Cabinet Secretary responsible for internal security (in consultation with the ICT Cabinet Secretary) may deploy public officers to the Secretariat subject to the Committee's approval. The Director is the head of the Secretariat, is responsible to the Committee for day-to-day administration and implementing Committee decisions, and has duties including administration, staff management, financial record-keeping, budget preparation and other duties assigned by the Committee. The Director is appointed for a single four-year term and is not eligible for reappointment.

The Committee must submit quarterly reports to the National Security Council.

The Director must designate systems as critical infrastructure by Gazette notice and must inform owners/operators of the reasons within a reasonable time; owners/persons in control must comply with directives within the specified period.

Causing a computer system to perform a function by infringing security measures with intent to gain unauthorised access is an offence punishable by a fine up to five million shillings, imprisonment up to three years, or both.

It is an offence for a person who commits an offence under section 14 to do so with intent to commit or facilitate a further offence; on conviction they may be fined up to ten million shillings, imprisoned up to ten years, or both.

It is an offence for a person to intentionally and without authorisation cause an unauthorised interference with a computer system, program or data; conviction may lead to a fine not exceeding ten million shillings, imprisonment not exceeding five years, or both.

Unauthorised interception of data transmitted to or from a computer system over a telecommunication system is an offence punishable by fines or imprisonment; aggravated cases attract higher maximum penalties.

It is an offence for a person to knowingly make available or possess programs, passwords, access codes or similar data intended primarily to commit offences under this Part; penalties include fines or imprisonment.

A person who knowingly and without authority discloses any password, access code or other means of gaining access to computer data commits an offence and is liable on conviction to a fine not exceeding five million shillings or to imprisonment for up to three years, or both.

If a person commits any of the offences in sections 14–17 on a protected computer system, they are liable on conviction to a fine up to twenty five million shillings or imprisonment up to twenty years, or both.

Section 21 criminalises gaining access to or intercepting data in critical databases or national critical information infrastructure to benefit a foreign state, and sets imprisonment and fine penalties including up to life imprisonment where the offence causes death.

Publishing false, misleading or fictitious data (with intent that it be acted on as authentic) is an offence punishable on conviction by a fine not exceeding five million shillings, or by imprisonment for a term not exceeding two years, or both.

It is an offence for a person to knowingly publish false information in print, broadcast, data or over a computer system that causes panic, chaos, violence, or is likely to discredit someone; on conviction the person may be fined up to five million shillings or imprisoned up to ten years, or both.

Section 24 prohibits publishing, producing, downloading, distributing, transmitting, circulating, delivering, exhibiting, selling, letting on hire, offering, making available, or possessing child pornography via computer systems or computer data storage; it also lists defences and categories of images covered.

It is an offence for a person to intentionally input, alter, delete or suppress computer data so it becomes inauthentic with intent it be treated as authentic; on conviction the person may be fined up to ten million shillings or imprisoned for up to five years, or both.

Makes computer fraud an offence by unlawfully gaining, causing loss, or obtaining an economic benefit through specified acts involving computer systems, programs or data.

Section criminalizes cyber harassment (causing fear, detriment, or indecent/offensive communications), creates offences with fines and imprisonment, allows interim orders and compels subscriber information, permits intermediary and persons to apply for orders, and provides hearing and timeliness rules.

It is an offence for a person to intentionally take or make use of another person's name, business name, trademark, domain name or similar on the internet or any computer network without authority or right; on conviction the person may be fined up to two hundred thousand shillings or imprisoned for a term not exceeding two years, or both.

It is an offence for a person to fraudulently or dishonestly use another person's electronic signature, password or other unique identification feature.

It is an offence for a person to create or operate a website or to send a message via a computer system with the intention of inducing disclosure of personal information or to gain unauthorised access; on conviction the person may be fined up to three hundred thousand shillings or imprisoned for up to three years, or both.

A person who unlawfully destroys or aborts electronic mail or processes conveying money or information commits an offence and faces a fine up to 200,000 shillings or imprisonment up to seven years or both.

A person who willfully misdirects electronic messages commits an offence and may be fined up to one hundred thousand shillings or imprisoned for up to two years, or both.

It is an offence for a person to access (or cause access to) a computer, computer system or network to carry out a terrorist act; on conviction the person may face a fine not exceeding five million shillings, or imprisonment for a term not exceeding ten years, or both.

It is an offence for a person to induce someone in charge of electronic devices to deliver electronic messages not meant for that person; on conviction the offender may be fined up to two hundred thousand shillings or imprisoned up to two years or both.

A person who intentionally hides or detains electronic mail, messages, electronic payments or cards found or delivered in error that should go to another person commits an offence and on conviction faces a fine up to 200,000 shillings or imprisonment up to two years or both.

A person who unlawfully destroys or aborts electronic mail or related processes that convey money or information commits an offence and faces a fine up to two hundred thousand shillings, imprisonment up to two years, or both.

It is an offence for a person to transfer, publish, or disseminate the intimate or obscene image of another person; on conviction the person may be fined up to two hundred thousand shillings or imprisoned for up to two years, or both.

Makes knowingly and unauthorised alteration, erasure, inputting or suppression of computer data, materially misleading electronic messages, fraudulent handling of electronic messages/instructions, and manipulation of payment devices to short‑pay or overpay criminal offences punishable by a fine up to 200,000 shillings or imprisonment up to two years, or both; subsection (5) requires forfeiture of proprietary interest for convictions under subsection (4).

Anyone authorized to use electronic devices for financial transactions who issues false electronic instructions commits an offence and is liable on conviction to a fine not exceeding two hundred thousand shillings or imprisonment for a term not exceeding two years, or both.

Operators of computer systems or networks must immediately inform the Committee of attacks, intrusions or other disruptions to another system or network within twenty four hours; failure is an offence punishable by a fine not exceeding two hundred thousand shillings or imprisonment for up to two years, or both.

Employees must relinquish all codes and access rights to their employer's computer network or system immediately upon termination of employment, subject to any contractual agreement.

It is an offence for a person to knowingly and willfully aid or abet another to commit an offence, and it is also an offence to knowingly and willfully attempt or take preparatory acts toward committing an offence; on conviction the person is liable to a fine not exceeding seven million shillings or imprisonment not exceeding four years, or both.

A body corporate is liable on conviction to a fine up to fifty million shillings; principal officers (or those acting similarly) are also deemed to have committed the offence unless they prove lack of consent or knowledge and that they exercised due diligence, and are liable on conviction to a fine up to five million shillings or imprisonment up to three years, or both.

A court may order confiscation or forfeiture of assets obtained with proceeds from an offence; the court may also, on conviction, order restitution of assets in accordance with the Proceeds of Crime and Anti-Money Laundering Act (Cap. 59A).

The court may order a person convicted of an offence (including those committed through use of a computer system) to pay a sum as compensation for resultant loss.

A person who commits an offence under any other law through the use of a computer system commits an offence and is liable on conviction to a penalty similar to that under the other law.

Evidence that was generated, transmitted, seized from, or identified in a search of a computer system may be presented, relied upon or admitted in proceedings; such fact alone does not by itself prevent admission.

Police officers or authorised persons may apply for a warrant to access, search and seize stored computer data for criminal investigations; they must present a copy of the warrant to the person against whom it is issued.

Requires making a list of seized or rendered inaccessible items with the date and time of seizure, providing a copy of that list to the occupier or person in control of the computer system, and addresses custody, rights to seized data, acting on another's behalf, offences, and who may access or obtain copies of computer data.

A police officer or an authorised person may apply to a court for a production order where specified data or subscriber information in their possession or control is necessary or desirable for an investigation.

Allows police officers or authorised persons to apply the powers in subsection (1) regardless of how many service providers were involved in transmitting the communication, and requires preservation and limited disclosure of traffic data for investigations with time and confidentiality limits.

Allows police officers or authorised persons to collect or record traffic data in real-time, sets court authorisation and limits, and prescribes confidentiality and penalties for service providers and their officers.

Section 53 sets rules for real-time interception of content data: courts may order real-time collection or recording of specified communications by persons in control of computer systems if grounds are shown; courts must issue the order when satisfied with the grounds; orders cannot exceed nine months; courts may require confidentiality; fines and imprisonment may apply to service providers and their officers.

Obstructing or misusing powers under this Part is prohibited and attracts a fine up to five million shillings or imprisonment up to three years, or both.

Any person aggrieved by a decision or order of the Court under this Part may appeal to the High Court or Court of Appeal within thirty days from the date of the decision or order.

Service providers are not liable civilly or criminally unless they had actual notice/knowledge or willful malicious intent facilitating misuse; they are not liable for providing services or for disclosures required by law or powers under this Part.

A requesting State may request mutual legal assistance from the Central Authority in any criminal matter for the purposes listed in subsection (2).

The Central Authority may, without prior request and subject to law, forward information from its investigations to a foreign State if it considers the information may assist that State; the Central Authority may request confidentiality before providing information; a foreign State that cannot meet conditions must notify the Central Authority, which may then decide whether to provide the information; if the foreign State accepts the conditions it is bound by them.

A requesting State may ask the Central Authority to obtain expedited preservation of computer-stored data located in Kenya; upon receiving such a request the Central Authority must take appropriate measures to preserve the specified data.

If an investigating agency, while executing a request under section 57 about a specified communication, finds that a service provider in another State was involved in transmission, the Central Authority must promptly disclose enough traffic data to identify that provider and the transmission path to the requesting State.

A requesting State may ask Kenya's Central Authority to search, seize or disclose computer-stored data within Kenya; the request must contain specified information; the Central Authority must obtain authorisation and provide results and seized evidence to the requesting State.

Allows trans-border access to stored computer data with consent or where the data is publicly available.

A requesting State may ask the Central Authority to assist with real-time collection of traffic data for specified communications in Kenya.

A requesting State may ask the Central Authority to assist with real-time collection or recording of specified communications' content data in Kenya; the Central Authority must obtain required authorisation and, once authorised, may seek the requesting State's support and must provide the results and collected data to the requesting State, subject to section 57.

Establishes a designated point of contact that must provide technical advice, preserve data, collect evidence and perform related tasks within expeditious timelines; it must be resourced and have capacity to communicate securely and efficiently with counterparts and is empowered to coordinate international mutual assistance.

Courts of competent jurisdiction must try offences under this Act when the act or omission constituting the offence is committed in Kenya.

A court that convicts a person may order forfeiture of any apparatus, device or thing used in or constituting the subject matter of the offence, to the Authority.

If there is a conflict between this Act and any other law about cybercrimes, the provisions of this Act supersede the other law.

The provision text is exactly the word "Spent" following the section heading.

The Cabinet Secretary may make regulations to give effect to the Act, including on specified areas of critical information infrastructure and subject to stated purposes, limits and principles.