Kenya’s Computer Misuse and Cybercrimes Act

1. Overview

In today’s ever-more virtual environment, reality and fiction can easily blur, and with advanced AI technologies such as deepfakes on the rise, it may be hard to tell what’s real and what’s not. Kenya saw this new challenge coming early, incorporating protections against deepfake-based crimes into its Computer Misuse and Cybercrimes Act of 2018. This historic legislation is a digital shield that seeks to avert illegal alteration of information, prevent the dissemination of false information, and eventually stop digital fraud in all its manifestations.

2. Scope of the Law

This act is a holistic measure in protecting the cyberworld. Its provisions cover a variety of unhealthy cyberspace activities such as the manufacture and spread of “false publications,” the noxious practice of identity theft, the distress and injury inflicted through cyberbullying, and the deceptiveness inherent in fake deepfakes. The scope of the Act is not just the dissemination of toxic synthetic media but even its creation and possession, demonstrating a robust position against the spread of digital lies. Significantly, the Act recognizes the subtleties of internet expression, exempting acts under legitimate authority, for the purposes of authentic research, and for purposes of satire – so long as these acts are free from any ill will or deceitful intent.

3. Key Provisions

In the strong architecture of the Act, certain provisions are directed at behaviors vulnerable to misuse by deepfake technology. 

• Section 23 specifically targets the kind of “false publications” through express prohibition on making and distributing content with the purpose to “alarm, distress, or fear,” a provision that could presumably be used for willfully malicious deepfakes. 
• Section 16 also addresses the very serious problem of unauthorized manipulation of data, a general provision that necessarily covers manipulation of digital content typical of deepfake production. 
• Although the legal framework of Kenya currently does not include specific rules directly addressing consent in the case of deepfakes, the general principles of data privacy embedded within the Data Protection Act and other general privacy legislation can be applied in instances of non-consensual creation of an individual’s likeness in synthetic media.
•  Empowered by the understanding of the vital place played by internet service providers (ISPs) in the cyber world, the Act requires these parties to keep records of probable cybercrime evidence and immediately report any possible illegalities they find to Kenya’s Communications Authority (CA).

4. Penalties & Enforcement

This act does not hesitate to deploy serious sanctions for cybercrimes. Those convicted of producing or sharing “false publications,” a category applicable to dangerous deepfakes, may receive significant penalties. These may be significant fines, up to KSh 5 million, or severe prison terms, up to 10 years, depending on the offense. 

The onus of scrutinizing these cybercrimes and facilitating enforcement of the Act lies on two main organizations: Kenya Communications Authority (CA), which has a regulatory function in the communications industry, and the Directorate of Criminal Investigations (DCI), the main criminal investigation force in Kenya. This multi-agency framework reflects the level of gravity with which Kenya is contemplating the issues of cybercrime.

5. Significant Cases or Precedents

Though individual cases targeting the use of the word “deepfake” under the 2018 Act will yet emerge, the legal system of Kenya has already proved itself capable of addressing AI-generated content. In a remarkable case of 2020, a Kenyan social media user was charged with offenses under Section 23 of the Act for sharing political content which had been unmistakably manipulated with artificial intelligence. This case precedent, while not specifically regarding deepfakes as we know them today, demonstrates the Act’s potential for application to AI abuse in altering digital information, setting the stage for future interpretations that target deepfake technology specifically.

6. Practical Implications

To entities and individuals working in Kenya’s digital space, the Computer Misuse and Cybercrimes Act has practical implications. In the case of victims who become the subject of abuse of deepfake technology, they have an obvious line of recourse: reporting the same to the DCI’s specialized Cybercrime Unit. This unit is a focal point for victims who seek justice in the event of digital deception. On the other hand, producers of digital content should exercise restraint and avoid creating or sharing artificial media that would be considered deceptive or dangerous, for they can land themselves in serious legal trouble under the Act. Internet sites based in Kenya are also supposed to be responsible. 

7. Future Outlook:

With further advancements in artificial intelligence technology unfolding at breakneck speeds, so should the laws that seek to regulate its deployment. Kenya sees this dynamic and, in accordance with its progressive National AI Strategy, is seriously contemplating possible changes to the Computer Misuse and Cybercrimes Act.