Diaspora Forensic Services

Computer Misuse and Cybercrimes Amendment Act 2025

Computer Misuse and Cybercrimes Amendment Act 2025: What Changed and What It Means for Victims In October 2025, Kenya’s cyber harassment laws changed dramatically — and then, a week later, partly changed back. If you are dealing with online harassment, cyberbullying, or defamation in Kenya, the current legal situation is genuinely confusing, even to lawyers. This guide explains exactly what the Computer Misuse and Cybercrimes (Amendment) Act 2025 says, what the High Court has suspended, what remains in force, and — most importantly — what this means practically if you are a victim trying to get justice. Quick answer: The Computer Misuse and Cybercrimes (Amendment) Act, 2025 was signed into law by President William Ruto on 15 October 2025, expanding the offence of cyber harassment under Section 27 to cover content that “detrimentally affects” a person, is “indecent or grossly offensive,” or is likely to cause someone to attempt suicide — with penalties of up to KES 20 million or 10 years imprisonment. Seven days later, on 22 October 2025, the High Court suspended Sections 27(1)(b), (c) and (2) pending a constitutional challenge brought by the Kenya Human Rights Commission and activist Reuben Kigame. Those provisions remain unenforceable. Critically, none of this affects your right to bring a civil defamation claim — the civil route under the Defamation Act (Cap. 36), covered in our step-by-step guide to suing for online defamation in Kenya, operates independently of the criminal cybercrime framework and is unaffected by this dispute. Background: Why the Law Changed The Computer Misuse and Cybercrimes Act was originally enacted in 2018 to address cyber fraud, identity theft, data breaches, and unauthorised access to computer systems. Section 27 of the original Act already criminalised “cyber harassment” — but as cyberbullying, online abuse, and coordinated harassment campaigns grew more sophisticated across Facebook, X (Twitter), TikTok, and WhatsApp, lawmakers argued the existing provisions were too narrow to address the scale of the problem. A draft amendment bill was published by Parliament in August 2024. After an extended period of public participation and committee review, the Computer Misuse and Cybercrimes (Amendment) Act was passed by Parliament and assented to by President Ruto on 15 October 2025. What the 2025 Amendment Changed The amendment introduced several changes across the Act, but three are most relevant to anyone dealing with online harassment. 1. Section 27 — Cyber Harassment, Expanded The amended Section 27 broadened the definition of cyber harassment to cover electronic communication that: The penalty for cyber harassment under Section 27 remains severe: a fine of up to KES 20 million, imprisonment for up to 10 years, or both. 2. Expanded Powers Over Websites and Applications The amendment broadened the mandate of the National Computer and Cybercrimes Coordination Committee, giving it authority to issue directives making websites or applications inaccessible where they are found to promote unlawful activity — including content involving the sexual exploitation of minors, or content advocating terrorism, religious extremism, or cultism. This power is subject to a requirement of proof before a directive can be issued. 3. Broader Evidence-Gathering Powers for Law Enforcement The amendment expanded the investigative powers available to law enforcement to access and preserve electronic evidence — relevant to how cybercrime investigations (including those touching on harassment) are conducted going forward. Why the Law Was Immediately Challenged The expanded Section 27 provisions — particularly the “detrimentally affects” and “indecent or grossly offensive” language — drew immediate and sustained criticism from civil society organisations, including the Law Society of Kenya, the Kenya Human Rights Commission (KHRC), and digital rights groups such as ARTICLE 19 and KICTANet. The core objection was about vagueness. Critics argued that phrases like “detrimentally affects a person” are so broad and subjective that almost any critical, satirical, or unflattering online statement about a public figure could be characterised as cyber harassment — creating a tool that could be used to silence legitimate criticism, journalism, and political commentary rather than to protect genuine victims of harassment. Former Chief Justice David Maraga publicly criticised the amended Act, describing the new provisions as risking abuse, censorship, and political manipulation, and arguing that granting such broad executive power was less about protecting Kenyans from cyberbullying and more about controlling information and silencing dissent. President Ruto, for his part, defended the amendments as necessary to protect Kenyans from cyberbullying and other online criminal activity. The High Court Suspension: What Actually Happened On 22 October 2025 — exactly one week after the President assented to the Act — Justice Lawrence Mugambi of the Milimani Law Courts issued conservatory orders in response to an urgent application filed by gospel musician and activist Reuben Kigame, the Law Society of Kenya, and the Kenya Human Rights Commission. The court suspended the enforcement, implementation, and operation of: This suspension is a conservatory order — a temporary measure that holds these specific provisions in legal limbo while the substantive constitutional petition is heard and determined. The petitioners argue that these provisions are unconstitutional because they introduce vague and overbroad language that criminalises legitimate online expression, and because they weaken the protections established under the Data Protection Act 2019. As of mid-2026, the constitutional petition challenging these provisions has not yet been finally determined — meaning the suspended sections remain unenforceable, and the underlying constitutional question remains open. What This Means in Practice If you are dealing with online harassment, cyberbullying, or defamation in Kenya right now, here is what the current legal landscape actually means for you. The suspended provisions cannot currently be used to prosecute someone If the harassment you are experiencing would only fall under the suspended language — content that is merely “indecent,” “grossly offensive,” or “detrimentally affects” you, without more — a criminal prosecution under those specific clauses is not currently available, because the provisions are under conservatory suspension. Other parts of Section 27, and other sections of the Act, remain in force The suspension is narrow — it applies only to Section 27(1)(b), (c) and (2). Other cyber offences

Computer Misuse and Cybercrimes Amendment Act 2025 Read More »

How to Audit a Construction Project Budget in Kenya From Abroad

How to Audit a Construction Project Budget in Kenya From Abroad: Ghost Workers, Inflated Receipts, and the Forensic Escrow Model The budget looked reasonable. KES 8.2 million for a four-bedroom maisonette in Athi River. The contractor sent itemised invoices every month — labour, materials, equipment hire, site clearance. Twelve months in, the project was stalled at lintel level, KES 6.1 million had been transferred, and when we were finally engaged to investigate, our forensic audit found that approximately 38% of all expenditure either could not be verified, was demonstrably inflated, or had been billed twice under different line-item descriptions. The client was a nurse in Manchester. She had never visited the site. Her contractor was not a stranger. It was her brother. That detail matters — not to embarrass her, but because it is the most common detail in the construction fraud cases we handle for diaspora clients. The betrayal is almost never by an unknown party. It is almost always by someone the client believed they could trust: a relative, a childhood friend, a family friend who “knows about construction.” The closeness of that relationship is not protection. In many cases, it is the very mechanism that delayed the client from asking hard questions until the damage was already severe. This guide is for every Kenyan in the diaspora who is building back home, whether your project has not yet started, is currently underway, or has stalled in a way you cannot fully explain. It covers the three primary mechanisms of construction budget fraud — ghost workers, inflated material receipts, and fake milestone claims — the forensic methods that detect each one, and the escrow validation model that eliminates the conditions under which these frauds occur in the first place. Why Budget Fraud Thrives in Diaspora-Funded Construction The structural advantage for a fraudulent contractor is simple: time zone separation creates a verification gap that is almost impossible to close through goodwill alone. A contractor working with a physically present client can be asked to produce a delivery note immediately, walk the site, or account for labour in real time. A contractor managing a client in Toronto cannot be held to the same instant accountability. By the time a discrepancy is noticed — usually when the client asks why the project is behind despite the funds released — weeks of invoices have accumulated, materials are either incorporated into the structure or long gone, and workers cannot be traced. There is also a psychological dynamic that compounds the financial one. Many diaspora investors are not just building a house. They are building proof — proof of success, proof of contribution, proof of a future return. That emotional investment creates a reluctance to look too hard at what is happening, because looking too hard means confronting the possibility that someone you love, or someone your family vouched for, has been stealing from you for months. Fraudulent contractors — including those inside family circles — understand this dynamic intuitively. They count on the social cost of accusation being higher than the financial cost of the fraud. They are usually right, until a forensic investigator is involved and the evidence removes the need for accusation to be personal. The forensic answer to both problems is the same: independent, documented budget auditing that removes the reliance on personal trust entirely and places verification in the hands of professionals who have no social relationship with anyone on site. Red Flags Already In Progress: Are You Reading This Mid-Build? Before going into the mechanics of fraud, let us address the reader who is already worried. If any of the following are true of your current project, you are likely experiencing active budget fraud and should commission a forensic audit before releasing any further funds: Your project is more than 20% behind schedule relative to funds released. If you have disbursed 60% of the total budget and the structure is at 30% completion, the gap is not explained by material cost increases alone. Your contractor’s explanations for delays keep changing. Weather, labour disputes, supplier delays, county permit issues — a rotating list of reasons for the same stalled progress is a pattern, not bad luck. You are being asked for additional funds before a milestone is physically complete. Variation orders and “extra costs” that arrive before the agreed stage is done are among the clearest signals of budget manipulation. Your invoices are not accompanied by delivery notes, supplier details, or KRA-compliant receipts. A contractor who cannot produce a proper paper trail for materials they claim to have purchased is either not purchasing what they say or has something to hide. The person overseeing the project on your behalf has stopped giving you independent information. When your local representative starts echoing the contractor’s explanations rather than providing independent observation, the oversight layer has been compromised — whether through social pressure, a financial arrangement with the contractor, or simple conflict avoidance. If three or more of these describe your project right now, stop releasing funds and contact a forensic investigator before your next payment. The cost of a forensic audit is a fraction of the cost of the funds you will lose in the next disbursement cycle. The Three Primary Budget Fraud Mechanisms 1. Ghost Workers: Billing for Labour That Never Existed Ghost worker fraud is the systematic billing of a client for labourers who are either entirely fictitious, were on site for far fewer days than claimed, or were working on a different project entirely while being billed to yours at full rate. In a typical residential build, a contractor presents a weekly or monthly labour schedule showing headcount, daily rates, and total payroll. For a client in the diaspora, this document is effectively unverifiable without a ground representative. The contractor exploits this in several ways. Fully fictitious names. The labour schedule includes workers who do not exist. Their wages are collected by the foreman, the contractor, or distributed among actual workers as a kickback for silence. We

How to Audit a Construction Project Budget in Kenya From Abroad Read More »

Preventing Construction Scams in Kenya

Preventing Construction Scams in Kenya: A Forensic Investigator’s Guide to Material Swapping, Photo Fraud, and Physical Site Audits You wired the money. You watched the WhatsApp updates. You saw the photos of concrete being poured, steel being laid, walls going up. Three months later, you flew back to Nairobi, drove to the site in Ruaka or Kitengela or Syokimau — and something felt wrong. The walls looked thin. The floor slab flexed when you walked on it. The contractor had a dozen explanations. I am a licensed forensic investigator with over a decade of experience documenting construction fraud across Kenya. In that time, I have processed more than fifty cases where diaspora investors lost between KES 800,000 and KES 40 million to the single most common — and most invisible — form of construction fraud in this country: material swapping. This article will explain precisely how material swapping works, how contractors disguise it in photographic progress reports, and how a professional physical site audit catches what your eyes and your phone screen never will. What Is Material Swapping in Kenyan Construction? Material swapping is the deliberate substitution of specified, quality-grade construction materials with cheaper, substandard alternatives — while billing the client for the original specification. It is not careless error. It is systematic theft, executed across a project’s lifecycle, hidden behind the familiarity of distance and trust. For diaspora investors managing a build from London, Toronto, Houston, or Melbourne, material swapping is the single greatest threat to your investment. You are not present to receive deliveries. You cannot physically handle a bag of cement or measure a steel rod. You depend entirely on the contractor’s integrity and on whatever photographic evidence they choose to send you. That dependency is the precise vulnerability that fraudulent contractors exploit. The Four Core Material Swapping Techniques 1. Counterfeit and Substandard Cement Kenya’s construction market has a well-documented counterfeit cement problem. Legitimate cement brands — Bamburi, East African Portland, Savannah — are frequently forged or diluted. A contractor may purchase genuine branded bags for the delivery photograph, then substitute loose filler cement or repackaged low-grade material for the actual mix. More commonly, genuine cement is mixed at dangerously low ratios. The Kenya Bureau of Standards (KEBS) specifies a minimum cement-to-aggregate ratio for structural concrete. A fraudulent contractor may halve the cement content and replace it with excess sand and aggregate. The concrete appears identical to the eye. It will not perform identically under load. The forensic consequence: carbonation depth testing on completed structures has repeatedly shown us concrete that passed visual inspection but failed compressive strength testing by margins of 30 to 60 percent. 2. Undersized or Substandard Reinforcement Steel Structural steel in Kenya is sold by diameter and grade. Y12, Y16, Y25 — these refer to the deformed bar diameter in millimetres, and the specifications are critical for load-bearing capacity. A dishonest contractor will substitute Y10 where Y16 was specified, or source steel from unverified local fabricators whose bars do not meet tensile strength requirements. We have documented cases where steel presented in foundation photographs was legitimate, but the steel actually cast into the slab was sourced from a different, cheaper supplier entirely. The contractor will pour concrete quickly, knowing that once it sets, you cannot inspect what is inside. 3. Hollow Core and Substandard Blocks Wall blocks in Kenya range from hollow cement blocks to dense solid blocks. The specification matters enormously for structural walls, insulation, and sound attenuation. Fraudulent substitution involves using the cheapest available hollow blocks where solid or reinforced blocks were specified, using locally made blocks that have not been cured properly, or mixing block grades so that lower floors — which bear the greatest load — receive the weakest material. 4. Roofing Material Substitution Iron sheets, timber purlins, and roofing tiles are all subject to substitution. Gauge 28 iron sheets are swapped for thinner Gauge 30. Treated timber purlins are replaced with untreated wood. In some cases, second-hand roofing materials are cleaned and reused, sold to the client as new. How Contractors Hide Material Swapping in Progress Photos This is the intelligence that every diaspora investor needs to understand before they commission a build. Staged delivery photos. A contractor will photograph legitimate material at the point of delivery — a truck offloading branded cement bags, a bundle of correctly sized rebar at the gate — then use that material on another project or sell it on. The substitution happens after the photograph is taken. By the time the concrete is poured or the slab is cast, the compliant material is long gone. Angle and framing manipulation. A photograph of a concrete column can be framed to show the top section — where genuine reinforcement was placed — while omitting the lower section where undersized steel was used. Overhead shots of slab reinforcement can make a Y10 grid appear as Y12 simply because there is no reference object in frame. Without a tape measure or vernier calliper held against the bar, the photograph tells you nothing about diameter. Timing manipulation. Contractors learn that diaspora clients want to see progress at predictable intervals. They schedule photographic updates immediately after a compliant delivery arrives on site, before the actual work begins. You see the material. You do not see what happens to it. Night pours. Concrete is sometimes poured at night specifically to avoid client-arranged observation. By morning, the slab is setting and the material composition is sealed inside. Digital reuse. In the most brazen cases we have investigated, photographs from an entirely different project are sent to a client as their own progress updates. This is especially effective when the diaspora client has never visited the site in person. Metadata analysis of photographs — examining GPS coordinates, timestamps, and camera identifiers — is a standard part of our forensic review. How a Professional Physical Site Audit Catches What Photos Cannot A physical site audit conducted by a licensed forensic investigator or structural engineer is the only reliable countermeasure to material

Preventing Construction Scams in Kenya Read More »