ICT experts, activists warn new Bill is a plot to snoop on Kenyans online

A proposed law disguised as a consumer protection initiative is raising alarm among digital rights experts and human rights defenders who warn it could usher in one of the most invasive State surveillance regimes in the country’s history.

The Kenya Information and Communications (Amendment) Bill, 2025 brought before parliament by Aldai MP Maryanne Kitany seeks to “safeguard economic interests” of internet users.

In her justification, Kitany says the Bill seeks to develop and deploy quality metered billing system capable of monitoring customer usage, convert data into readable details and create invoices based on user’s consumption.

But an analysis by digital rights experts point out a chilling plan for mass data collection, real-time monitoring of citizens and erosion of human rights by the State under the guise of regulating internet billing by internet service providers.

The amendment proposes a metered internet billing system, whereby each user would be assigned a trackable Unique Metre Number linked to their internet usage.

If the bill is passed, Internet Service Providers (ISPs) would also be required to monitor customer usage, convert that data into “readable details”, and submit it to the Communications Authority of Kenya (CA) at least once every financial year.

Victor Ndede, the Technology and Human Rights Manager at Amnesty International, says the bill will potentially curtail fundamental rights and freedoms.

Beyond billing

Ndede termed the proposed law an “invasive and extensive data collection and surveillance of citizens”.

“It is not clear what sort of customer usage is being monitored. The bill says you convert that customer usage to readable details without clarity on what exact customer usage is being monitored and what will be then shared with the communications authority,” Ndede posed.

“If at all this was about billing, whatever (data) they’re proposing to collect, is way beyond billing. It is in no way related to billing. These metre numbers being assigned to each individual is a clear case of surveillance,” he added. “When you have a unique and identifiable metre number for each individual, then ideally you create a trail for this person. And if at all it was just metering and saying this person used 10 gigabytes of data, the other details on their usage are not necessary for billing,” Ndede argued.

But Kitanya argues that the bill does not limit fundamental human rights, but according to the expert on digital rights, the bill infringes Kenya’s Data Protection Act and Article 31 of the Constitution which guarantee citizens the right to privacy, including the right not to have their personal communications monitored.

“This then means that the Communications Authority would have vast amounts of data on virtually everyone in the country and what they do on the internet,” he said.

“If you say at least once a year, nothing stops the Communications Authority from making a request or demanding for any individual’s billing information at any point they want to use. And so this is a massive concern,” Ndede added.

Data collection

Experts also say the bill could create a cybersecurity nightmare whereby internet service providers and government agencies, holding such vast amounts of sensitive personal data, could become prime targets for hackers, rogue insiders and authoritarian misuse.

“There are no safeguards in the bill about how the CAK will store, protect, or use the data it receives. These are just overly broad powers with very limited oversight provided. Customer usage is also left undefined,” Ndede pointed out terming it as massive and unchecked data collection.

He likened the data on unique identifying number and customer usage for billing to the electricity token metre number for prepaid metres.

“It’s like saying Kenya Power should now determine whether it is the fridge that used the power the most or it’s a cooker or it’s a TV or it’s a washing machine. It’s making a similar proposal, which is absolute madness.”

The bill also restricts registration and issuance of the annual licenses of internet service providers to the compliance with the law.

Digital rights experts also raised issues with the vague language of the bill stating that it creates legal grey areas the government can exploit, while also instilling fear in citizens.

“Everything you browse, everything you share, would be collected by internet service providers. It’s a violation of Article 33 on freedom of expression.”

There are also fears that if passed, the law would undermine the privacy and safety of journalists, whistleblowers, human rights defenders, government critics, and ordinary citizens who use the internet to express themselves.

“The moment you assign someone with a unique identifier number, anonymity goes out of the window. Pseudonymous online engagement will be very difficult, which, of course, is crucial to the work of particular group of people,” said Ndede.

Demas Kiprono, Deputy Executive Director, at the International Commission of Jurists (ICJ) also termed the bill an attempt to freeze freedom of expression. He said the proposed law fails a three-part test in its attempt to limit right to privacy, freedom of expression.

“It must be clear and concise, must pursue a legitimate aim, and must be necessary and proportionate. This aim of consumer protection, as they are claiming could be novel. There are other ways to ensure that service providers provide good quality internet and charge appropriately for the data that people use,” said Kiprono.

Kiprono described the unique metre number as a “file” that should be opened for everyone and should be made available to the state whenever demanded.

Malwares

He added that the government can use that information to clamp down on dissenters. “It’s just creating a whole infrastructure to be able to pin down someone based on their internet activity.”

Kamau Ngugi, executive director of Defenders Coalition termed the proposed law a “dangerous surveillance route”.

“As human rights defenders we are concerned with the intrusion on Kenyans and state attempts to closely monitor government critics for possible surveillance and abductions as was seen during the Gen-Z protests,” Ngugi stated.

 “In other countries where governments use Telecommunication or electricity details to map their opponents, governments send malwares or people to attack or threaten people but should not be allowed in a country that have a constitution guaranteeing freedom of expression and right to privacy,” he added.

Also raising red flags is the Kitany’s proposal on the use of an Advanced Electronic Signature, a digital ID uniquely tied to each internet user, capable of revealing their identity, and generated through methods exclusively controlled by the user.

Ndede argued that the provision could be exploited to mandate internet users to use their national identity cards to browse.

“The single most unique identifier for many Kenyans would be the national ID. And so it looks like you’d have to have your ID to get a metre number. Because Kenya has a mandatory SIM registration. And of course, you then have a mandatory use of ID for internet registration,” he states.

If enacted, the law would put Kenya in violation of multiple international human rights agreements to which it is a signatory.

It would also contradict Kenya’s stated digital transformation agenda by eroding trust in digital systems and discouraging internet use.

“This bill is grossly unconstitutional and it’s a travesty to justice and rule of law to imagine that such a proposal would be made despite the gains that we’ve made in Kenya’s digital transformation journey,” Ndede stated.

Calls for regulation

The proposed Information and Communications (Amendment) Bill, 2025 comes at time when senior government officials are calling for stricter regulation of the internet.

National Intelligence Service (NIS) Director General Noordin Haji has highlighted the misuse of social media and artificial intelligence as significant security threats, emphasizing the need for robust policies to address cyberspace vulnerabilities.

“While access to information remains a cornerstone of democratic governance, social economic stability and inter-state relations, propagation of misinformation and disinformation continue to threaten these ideals,” said Haji at a symposium by the National Intelligence research University early this month.

Interior PS Raymond Omollo also announced plans to set up a centralized hub for reporting and sharing information on cyber threats and fraudulent activities citing ‘irresponsible ‘ use of social media.

“Sustained public sensitization on responsible internet use will be prioritized by various stakeholders to promote a safer online environment for all,” he said.

Early this year, Interior Cabinet Secretary Kipchumba Murkomen also voiced concerns over the misuse of social media, warning that individuals engaging in cybercrime and online harassment will face legal consequences.

“We will not tolerate this any longer. The country must operate under law and order,” he said.

Central Organization of Trade Unions (COTU) Secretary General Francis Atwoli has also called for government intervention to regulate social media.