Diaspora Forensic Services

Legal Terms Explained  |  Kenya  |  Updated 29 October 2026 Cyberbullying vs Cyber Harassment vs Cyberstalking vs Defamation in Kenya: What Each Term Means in Law Four terms, three legal routes. Learn which label fits what is happening to you, which law applies, who decides, how long you have to act and what evidence each route needs. By Paul Ooko, Lead Forensic Investigator, Ultimate Forensic Consultants Ltd  |  Reviewed against official and court sources on 29 October 2026 Quick answer In Kenya, cyberbullying is an everyday word, not a defined offence. Cyber harassment is a crime under section 27 of the Computer Misuse and Cybercrimes Act, 2018. Cyberstalking is generally pursued under the same provision. Defamation is a civil claim under the Defamation Act (Cap. 36) and must generally be filed within 12 months. One incident can engage several of these at once. In this guide The four terms at a glance Cyberbullying Cyber harassment (section 27) Cyberstalking Defamation Which label fits what is happening One incident, several labels How the evidence differs Where the law stands in 2026 6 steps to classify your case Mistakes that cost victims their case Frequently asked questions Victims usually describe what is happening to them as “cyberbullying”. Police officers, advocates, schools and platforms each hear that word differently, and only some of them can act on it. In court the conduct has to be translated into a legal label that actually exists: an offence the State can prosecute, or a civil wrong you can sue on. The cost of choosing the wrong label is real. You can report to the wrong office, plead the wrong claim or miss a deadline: a defamation claim in Kenya generally has to be filed within a year. This guide defines each term, shows where it sits in Kenyan law, and explains how a forensic investigator would build the evidence for each route. It reflects the court rulings of 2026. The four terms at a glance Term What it describes Where the law sits Criminal or civil Typical outcome Cyberbullying Repeated hurtful, threatening or humiliating online conduct aimed at a person No offence by this name in the 2018 Act; the conduct is charged or sued under other labels Depends on the conduct Depends on the label used Cyber harassment Wilful communication that causes fear of violence, detrimentally affects a person, or is indecent or grossly offensive Section 27, Computer Misuse and Cybercrimes Act, 2018 Criminal Prosecution after a DCI investigation; on the 2018 text, a fine up to KES 20 million, up to 10 years, or both Cyberstalking A pattern of monitoring, tracking, following or repeated unwanted contact online No stand-alone offence of that name that we are aware of; usually pursued as cyber harassment, with unauthorised access, impersonation or interception where the facts fit Criminal As for cyber harassment Defamation A false statement published to others that damages your reputation Defamation Act (Cap. 36), common law and Article 33(3) of the Constitution Civil (criminal defamation was struck down in 2017) Damages, injunction, retraction, takedown order; generally a 12-month filing limit Cyberbullying: a description, not a charge Cyberbullying means repeated hurtful, threatening or humiliating conduct directed at a person through phones, messaging apps or social platforms. It is the word parents, schools, employers and the media use. The Computer Misuse and Cybercrimes Act, 2018 does not create an offence called “cyberbullying”. The nearest offence is headed “cyber harassment”. Cyberbullying is therefore best treated as a bucket. What sits inside the bucket determines your legal options: Threats or persistent abusive messages sent to you: cyber harassment (section 27) False statements told to other people: defamation (civil) A fake profile using your name or photos: identity theft and impersonation (section 29) Intimate images shared without consent: the intimate-image offence (section 37) and claims for breach of privacy (Article 31) and dignity (Article 28) Your phone number, address or private messages circulated: a Data Protection Act, 2019 complaint to the ODPC Someone breaking into your account: unauthorised access (section 14) Cyberbullying among schoolchildren and colleagues also has a non-legal track. Schools and employers can discipline under their own rules even where no prosecution follows. See our guide for parents and guardians for the school route. Cyber harassment: the criminal offence in section 27 Cyber harassment is the offence in section 27 of the Computer Misuse and Cybercrimes Act, 2018: wilfully communicating with a person, directly or indirectly, in a way the sender knows or ought to know has one of three effects. On the 2018 text, a person commits the offence if they wilfully communicate, directly or indirectly, with another person or anyone known to that person, and they know or ought to know that their conduct: is likely to cause apprehension or fear of violence, or damage or loss to property; or detrimentally affects that person; or is indecent or grossly offensive in nature and affects the person. The 2018 text provides a penalty of a fine up to KES 20 million, imprisonment up to ten years, or both. It also provides for a court application for an order that a person charged refrain from the conduct. The 2025 amendments re-cut section 27, so confirm the current numbering and wording on Kenya Law before quoting a subsection in a filing. The offence is built around communication to the person or to people they know. It therefore fits direct messages, repeated comments, group-chat abuse and threats better than a one-off public post making a false claim. The false-claim post is usually a defamation question. Do not rely on older articles for section 27. Between October 2025 and July 2026 the courts suspended, upheld and partly struck down parts of the harassment framework. The position is summarised in the “Where the law stands in 2026” section below and in our companion article, Is Cyberbullying a Crime in Kenya? Cyberstalking: a pattern, usually charged as harassment Cyberstalking is a pattern of online conduct that tracks, monitors or pursues a person: repeated

Kenyan Law · Online Harassment · Updated October 2026 Is Cyberbullying a Crime in Kenya? What the Law Actually Says in 2026 Two courts have reshaped Kenya’s cyber harassment law in the past eight months. Here is what is still a criminal offence, what was struck down, what is under appeal, and what you can do right now. Quick answer Kenya has no offence called “cyberbullying”, but the conduct is covered by other laws. Cyber harassment remains an offence under Section 27 of the Computer Misuse and Cybercrimes Act, 2018, which the Court of Appeal upheld in March 2026. In July 2026 the High Court struck down the 2025 amendment that extended it to messages “likely to cause” suicide. Criminal defamation no longer exists, but you can sue for defamation and breach of privacy and dignity in civil court. Which route fits depends on the facts and the evidence you hold. Why the answer keeps changing Many articles still describe the October 2025 amendments as settled law. They are not. Between October 2025 and July 2026 the courts suspended, upheld and then struck down different parts of the cyber harassment framework. This page tracks the position as we understand it at the date below. 2017Criminal defamation struck downSection 194 of the Penal Code was declared unconstitutional in Jacqueline Okuta & Another v Attorney General. Defamation is now a civil matter. 2018Computer Misuse and Cybercrimes Act enactedSection 27 created the offence of cyber harassment: communication that is indecent or grossly offensive, or that detrimentally affects the recipient. 15 October 2025Amendment signed into lawThe Computer Misuse and Cybercrimes (Amendment) Act widened Section 27 and added powers to block websites. 22 October 2025High Court suspends parts of Section 27Conservatory orders paused enforcement of Section 27(1)(b), (c) and (2) pending the constitutional petitions. 6 March 2026Court of Appeal ruling on the 2018 ActThe court struck down Sections 22 and 23 (false information offences) but upheld Section 27, finding it clear enough. 2 July 2026High Court strikes down parts of the 2025 amendmentJustice Nyaundi declared Section 27(1)(b), the “likely to cause suicide” limb, and Section 6(1)(jA), the website-blocking power, unconstitutional. July 2026 onwardAppeal signalledParliament announced it would appeal the High Court decision. Check the current status before relying on this page in a live matter. What is still a criminal offence The cyber harassment offence in the original Section 27 of the 2018 Act remains in force after the Court of Appeal decision. In practical terms, repeated abusive, threatening or grossly offensive messages sent to a person, or communication that detrimentally affects them, can still be reported as a crime. Separately, the Act continues to cover related conduct such as unauthorised access to accounts, impersonation and identity-related offences, and sharing intimate images without consent. What changed is the wider net. The amendment that would have criminalised messages “likely” to cause someone to take their own life was struck down as too vague. The court’s concern was that criminal liability cannot rest on a speculative, subjective standard. Which route fits your situation Your situation Likely route Why Threats, repeated abusive messages, stalking Police and DCI report, plus evidence preservation Falls within cyber harassment and related offences. Get an Occurrence Book (OB) number. False statements damaging your reputation Civil defamation claim (Defamation Act, Cap. 36) Criminal defamation no longer exists. Courts can award damages and order takedown or retraction. Private images or personal data shared without consent Report to police; civil claim for breach of privacy and dignity; platform removal Articles 28 and 31 of the Constitution and the Data Protection Act may apply alongside the Cybercrimes Act. Fake account impersonating you Platform report, evidence capture, then criminal and civil options Identity of the operator usually needs to be established before a claim can be served. Anonymous account, identity unknown Forensic and open-source investigation, then court process You cannot sue or serve someone you cannot name. The civil route: where most victims find leverage Because criminal prosecution can be slow and the harassment law is still contested, many victims focus on the civil courts. A defamation claim does not depend on Section 27. It asks whether a false statement was published to others and damaged your reputation. Kenyan courts have awarded substantial sums in online cases, and in Nzibo v Nation Media Group [2024] the High Court awarded KES 11 million. An Eldoret court also ordered a law student to pay KES 7.5 million over a social media post about a church leader’s driver. See our guide to how much compensation you can claim for how courts approach quantum. Civil courts can also grant interim injunctions restraining further publication and mandatory takedown orders, which matter when content keeps spreading while a case is pending. An advocate should advise on which remedies to plead. What to do in the first 24 hours Do not delete anything. Even distressing content is evidence. Capture the content properly. Save URLs, usernames, profile links and timestamps, not just screenshots. Screenshots alone are easy to challenge. Secure your accounts. Change passwords and enable two-factor authentication before the harasser escalates. Report on the platform and note the report reference numbers. Make a police report where there are threats, intimate images or ongoing harassment, and keep the OB number. Get the evidence forensically preserved if you may litigate. Electronic evidence in Kenyan courts is governed by the Evidence Act (Cap. 80), sections 106A and 106B, which set conditions for admitting electronic records. Reporting to the authorities and hiring a forensic investigator are not mutually exclusive. We compare the two in DCI vs private investigator for cyberbullying. For content in messaging groups, see WhatsApp message defamation in Kenya. If a child is involved, read our guide for parents and guardians. Treat this area of law as moving. Appeals are pending or possible on the 2025 amendment, and a further case on surveillance powers in the original 2018 Act is reported to be heading to the Supreme Court. Rely on a current legal opinion for any

Digital & Cyber Forensics · Kenya The Fraud That Happens Faster Than You Can Call Your Bank. A SIM swap doesn’t announce itself. It arrives as a dead signal bar, then a silence where your OTPs used to be. By the time most victims understand what happened, the forensic window is already closing. 106AEvidence Act admissibility standard CMCA 2018Identity theft & unauthorised access <30 daysBefore telco record quality degrades In short A SIM swap is proven with three independent records, not one: the telco’s porting log and cell-site data, the victim’s device forensics, and the mobile money or bank transaction trail. None of these live on the phone the victim is holding — which is why most victims believe the evidence is gone. It usually isn’t, if an examiner is instructed quickly. Why SIM Swap Is a Forensic Problem, Not Just a Fraud Problem Most fraud leaves a fingerprint on the device it happened on. A SIM swap doesn’t. The victim’s phone is often untouched — the compromise happens upstream, at the telco, when a fraudster convinces an agent or exploits a porting process to move the victim’s number onto a SIM they control. From that moment, every OTP, every banking alert, every M-Pesa confirmation goes to the attacker instead. This is precisely why SIM swap cases are misunderstood by victims and, often, by the legal teams instructed to recover their losses. The instinct is to examine the phone. The evidence, in fact, sits in three separate custody chains — the mobile network operator, the financial institution, and whatever secondary device or account the attacker touched — and a forensic examiner’s job is to reconstruct all three into one timeline that satisfies Section 106A of the Evidence Act (Cap. 80). “The victim didn’t lose their phone. They lost control of who their phone believed they were.” Anatomy of a SIM Swap: What Actually Happens, Minute by Minute Reconstructed Attack Sequence Six Stages, Usually Under an Hour This sequence is drawn from the typology of SIM swap matters examined across Kenyan recovery and criminal proceedings. It is the reconstruction an examiner builds after the fact — not a warning about method. Stage 1 Target Profiling The attacker gathers enough personal detail — often from a prior data leak or social engineering — to pass identity verification for a line swap. Evidence: none yet Stage 2 The Porting Request A swap or replacement SIM request is filed against the victim’s line, at an agent outlet or through a channel with weaker verification. Evidence: telco porting log, agent ID, timestamp Stage 3 Signal Loss The victim’s genuine SIM goes dark. This is usually the only signal the victim experiences directly — and it is frequently dismissed as a network fault. Evidence: victim’s own device log, network deregistration event Stage 4 Account Takeover OTPs and password reset links now route to the attacker’s SIM. Banking apps, M-Pesa, and email accounts are reset in sequence. Evidence: bank/telco OTP delivery logs, login IP and device fingerprints Stage 5 Extraction Funds move — typically through mobile money to a chain of intermediary accounts or agent tills designed to fragment the trail quickly. Evidence: M-Pesa/bank transaction records, agent till mapping Stage 6 Discovery The victim regains signal — often hours later — to a phone with no missed alerts and accounts already drained. This is where most cases begin. It should be Stage 1. How a Forensic Examiner Traces It Reconstruction works backward from Stage 6 to Stage 2 — each stage confirmed by an independent, third-party record rather than the victim’s own account of events. 01 Call Detail Record (CDR) Analysis Cross-references the moment the genuine SIM deregistered against the network against the moment the replacement SIM activated — establishing the precise swap window. 02 Porting & Agent Audit Trail Examines the identification documents, agent code, and outlet used for the swap request — frequently the weakest link and the basis for a negligence claim against the telco. 03 OTP & Login Fingerprinting Maps every OTP delivery, password reset, and login event to a device and IP address — distinguishing the victim’s genuine activity from the attacker’s. 04 Mobile Money & Bank Transaction Mapping Follows the extracted funds through agent tills and intermediary accounts, producing the structured financial timeline Kenyan courts expect in recovery proceedings. 05 Victim Device Verification Confirms the victim’s own device holds no evidence of compromise — closing off a common defence argument that the victim authorised the transactions themselves. 06 Unified Evidentiary Timeline All five records are merged into one Order 18-compliant report, with each of the three Section 106A conditions addressed against every record relied upon. Where This Sits in Kenyan Law Computer Misuse & Cybercrimes Act 2018: unauthorised access and identity theft provisions form the criminal basis for prosecuting the swap itself. Evidence Act (Cap. 80), ss. 106A–106C: each of the telco, banking, and mobile money records must independently satisfy the “regular use, functioning properly, ordinary course of activity” test before a court will rely on it. Data Protection Act 2019: governs how examiners lawfully obtain and process the personal data within telco and financial records during reconstruction. Illustrative Matter · Nairobi · Recovery Litigation KES 2.3M Moved in 41 Minutes — Traced to an Agent Outlet Swap A victim’s line went silent mid-afternoon; by the time signal returned, KES 2.3 million had moved from a bank account through four mobile money agents. UFC’s CDR analysis pinpointed the exact deregistration and re-registration window, and porting-log examination identified the outlet and agent code used for the swap — evidence the telco’s own verification process had failed at that specific point. Financial timeline and porting failure documented for recovery proceedings against the telco and receiving accounts. Frequently Asked Questions Can a SIM swap be proven after the money is already gone? Yes, in most cases. The evidence does not live on the victim’s phone — it lives with the telco (porting requests, agent ID, cell-site data) and the receiving financial trail. Forensic