A court submission revealing that Kenyan police officers spied on filmmaker Nicholas Wambugu has reignited concerns about state’s disregard for privacy and data protection laws.
Wambugu’s lawyer, Ian Mutiso, told a Nairobi court that a forensic report by the Citizen Lab showed spyware called FlexiSPY was secretly installed on Wambugu’s device on May 21, 2025. At the time, the Directorate of Criminal Investigations (DCI) had seized his phone while investigating his alleged role in the BBC’s Blood Parliament documentary. Police accused Wambugu, along with three others, of producing the film, though the BBC publicly stated the filmmakers were not involved.
According to Citizen Lab, the spyware remained on Wambugu’s phone until July 10, 2025, after the device was returned. FlexiSPY can record calls, access media, delete or alter files, and track a device’s location.
In a related case, the High Court ordered the government to pay Ksh. 500,000 to Michael Ndichu after ruling that his phone was illegally searched without a court order.
How Is Surveillance Being Used Against Critics?
Wambugu’s case is part of a broader pattern where technology has been deployed against dissenting voices. In 2024, a wave of abductions targeted vocal critics on social media. Many were taken in broad daylight, yet security agencies denied involvement. “For clarity, the Constitutional mandate of the National Police Service is not to abduct, but arrest criminal offenders,” Police Inspector General Douglas Kanja said at the time.
This trend has continued into 2025. Software engineer Rose Njeri was arrested in June after developing tools to help Kenyans reject the Finance Bill 2025. She was detained on cybercrime charges before the case was later dismissed. Police have also been accused of trying to obtain private data without legal authorization, including cases involving student activist David Mokaya and slain teacher Albert Ojwang.
Kenya’s 2019 Data Protection Act prohibits unregulated surveillance and requires prior notification before personal data is collected. It allows surveillance only when necessary for legitimate public interests. However, watchdogs such as the Kenya Institute of Public Policy Research and Analysis (KIPPRA) have pointed out that the Office of the Data Protection Commissioner lacks independence to enforce these safeguards.
Civil society organizations have also raised alarm over initiatives like the Communications Authority’s directive requiring Kenyans to register their IMEI numbers with the Kenya Revenue Authority. In July 2025, the High Court quashed the directive after the Katiba Institute argued it violated privacy rights.
Reports by advocacy groups like Unwanted Witness show that surveillance concerns extend beyond Kenya. Across East Africa, spyware and monitoring tools are increasingly used against journalists, civil society organizations, and activists. Governments often justify surveillance under the guise of combating terrorism or maintaining “safe cities,” but rights groups warn these measures are eroding free expression and weakening democracy.
By Lucky Anyanje
