Kenya has launched a new guide to help investigators and prosecutors tackle cybercrime as a nationwide assessment reveals more than 2,000 critical vulnerabilities and over 4.8 million leaked credentials.
The Rapid Reference Guide on Investigating and Prosecuting Offences under the Computer Misuse and Cybercrimes Act, Cap. 79C is intended to strengthen how cybercrime cases are investigated, digital evidence handled and prosecutions prepared.
The government says the initiative comes as criminals increasingly exploit Kenya’s growing digital economy, targeting individuals, businesses, public institutions and critical infrastructure.
What did the cyber assessment find?
The nationwide passive cyber-exposure assessment identified more than 2,000 critical vulnerabilities and over 4.8 million leaked credentials.
The findings point to growing weaknesses within Kenya’s digital environment, raising concerns over the security of personal information, online accounts, public systems and other digital infrastructure.
Interior Principal Secretary for Internal Security and National Administration Dr Raymond Omollo said the nature of crime had changed as technology became more deeply embedded in everyday life.
“The changing threat landscape demands a corresponding evolution in how we prevent, investigate and prosecute crime.”
Omollo said investigators and prosecutors must be able to understand cybercrime laws, preserve digital evidence and build cases capable of withstanding scrutiny in court.
Why has the government launched the guide?
The guide is designed to provide investigators, prosecutors and other justice-sector agencies with a common reference point when handling cybercrime cases.
It covers areas including electronic evidence, international cooperation, mutual legal assistance, unlawful online content, offensive communication and coordination between investigative and prosecutorial agencies.
According to Omollo, the guide will help standardise procedures while improving cooperation among institutions involved in criminal justice and national security.
“This reference guide is more than a publication. It is a practical tool for strengthening investigations, supporting prosecutions and helping to keep our cyberspace safe and secure,” he said.
How is cybercrime changing?
Kenya’s digital environment has changed significantly since the Computer Misuse and Cybercrimes Act was enacted in 2018.
The growth of artificial intelligence, virtual assets, cryptocurrencies and other technologies has created new opportunities for businesses and citizens, but has also provided criminals with more sophisticated ways of committing offences.
Mobile-money fraud is one example.
Omollo said stolen money can increasingly be transferred from platforms such as M-Pesa into virtual assets and moved across jurisdictions, making investigations more complicated for local authorities.
Such cases require investigators to trace digital transactions while working with institutions and authorities beyond Kenya’s borders.
Kenya seeks stronger international cooperation
The government has committed to sharing cybercrime information with 76 countries and has begun the process of acceding to the Budapest Convention on Cybercrime.
The required parliamentary and public-participation processes are currently underway.
Accession would strengthen Kenya’s ability to cooperate with other countries when investigating crimes involving foreign-based suspects, digital platforms or electronic evidence stored outside the country.
It would also provide mechanisms for obtaining electronic evidence and exchanging information with international partners.
But Omollo said international cooperation would only be effective if Kenya strengthened its own investigative and technical capacity.
“International cooperation is only as effective as our ability to handle the information and evidence that we receive.”
Why ordinary Kenyans matter in the fight
The government is also seeking to improve public understanding of cybercrime and the laws governing digital offences.
Omollo said limited knowledge of the Computer Misuse and Cybercrimes Act had contributed to misconceptions about its purpose and implementation.
He urged security agencies to explain their interventions in language ordinary citizens can understand.
“The fight against cybercrime cannot be won by Government alone. An informed and vigilant public is one of our strongest lines of defence.”
The government wants citizens to become active participants in protecting Kenya’s digital space rather than simply relying on security agencies to respond after an attack.
What happens next?
The new guide is expected to support investigators, prosecutors and other agencies as Kenya expands digital public services and confronts increasingly complex forms of cybercrime.
The government also plans to continue reviewing its cybercrime capabilities as criminal methods and technologies evolve.
Omollo said lessons from implementing the guide should inform future revisions and the development of additional tools capable of addressing emerging threats.
The government is simultaneously expanding digital services through platforms such as e-Citizen and technology-supported services within the Directorate of Criminal Investigations.
But the growing reliance on digital platforms also increases the need to protect the systems and people using them.
The launch brought together representatives from the Office of the Director of Public Prosecutions, National Police Service, Communications Authority of Kenya, National Computer and Cybercrimes Coordination Committee, investigative agencies and other institutions involved in cybersecurity and criminal justice.
With millions of credentials already exposed and thousands of critical vulnerabilities identified, the government faces the challenge of turning the new framework into stronger protection, faster investigations and more effective prosecution of cybercriminals.
