Digital Forensics

Reporting Cyberbullying to the DCI vs Hiring a Private Forensic Investigator in Kenya: Which Is Faster? If you are being cyberbullied, harassed, or defamed online in Kenya, you have two broad routes available: report to the police or the DCI Cybercrime Unit, or engage a private forensic investigator to build your case. Most victims assume these are mutually exclusive — pick one or the other. They are not. But they move at very different speeds, serve different goals, and require different things from you. This guide compares both routes honestly, so you can decide how to spend your time in the critical first 48 hours. Quick answer: Reporting to the DCI Cybercrime Unit is free and creates an official record (an OB number), but the process is investigation-led by the state, can take weeks to months before any action is visible, and results in criminal penalties for the offender — not compensation for you. A private forensic investigator, by contrast, can begin preserving evidence within 24–48 hours, often identifies anonymous perpetrators through OSINT within days, and builds the evidence package that supports a civil defamation claim — where Kenyan courts have awarded individual claimants damages ranging from KES 500,000 to over KES 11 million. The fastest and strongest outcome for most victims combines both: file the police report for the official record, while a forensic investigator preserves evidence and builds the civil case in parallel. Why This Isn’t an Either/Or Decision Before comparing speed and outcomes, it’s worth being clear about what each route is actually for. The police and DCI Cybercrime Unit exist to investigate and prosecute crimes. Their outcome, if successful, is that the state charges the perpetrator under the Computer Misuse and Cybercrimes Act — potentially resulting in a fine of up to KES 20 million or up to 10 years imprisonment under Section 27. You are a witness and a complainant in this process, not a party who receives compensation. A private forensic investigator exists to build an evidence package — for you, on your timeline, with your priorities. The outcome is a forensic report that supports a civil defamation claim, where you are the plaintiff and the remedy is financial compensation paid to you, plus potential injunctions to remove content. These are not competing services. They are complementary — and in many of the strongest cases, both run in parallel. Route 1: Reporting to the Police or DCI Cybercrime Unit How the process works If you are experiencing cyberbullying in Kenya, the standard advice is to visit your nearest police station or the DCI Cybercrime Unit and file an official report. When filing, you provide your details, a description of the incident, and any evidence you have gathered — screenshots, account names, dates, and descriptions of the harassment. The police will register your complaint and open an Occurrence Book (OB) entry, giving you an OB number. This number is important — it serves as your proof that you reported the matter, and you may need it later regardless of which route your case ultimately takes. Depending on the nature of the case, the police may refer your matter to the National Computer and Cybercrimes Coordination Committee (NCC4) for specialised investigation, or you may be directed to report separately to the Communications Authority of Kenya (CA), which operates its own cybercrime reporting portal and is involved in the National KE-CIRT/CC — a multi-agency body that coordinates responses to cybersecurity incidents. In serious cases — non-consensual image sharing, direct threats, blackmail, or violent harassment — a lawyer can use your police report as the basis for applying to court for a preservation order, requiring the platform hosting the content to retain it rather than allow it to be deleted while the investigation proceeds. What to expect on timing Filing the initial report is fast — typically same-day. You can walk into a police station or DCI office, or in some cases use the DCI’s online reporting portal, and have an OB number within hours. What happens after that is where timing becomes unpredictable. Once your report is registered, the matter moves into the queue of an under-resourced investigative system handling a high volume of cases across the entire country. There is no guaranteed timeline for when — or whether — an investigator will be assigned, when they will begin work, or when (if ever) the matter will progress to identifying a suspect, referring the file to the Office of the Director of Public Prosecutions (ODPP), and reaching a court hearing. High-profile cases can move with visible urgency — public statements, wanted notices, and arrest warrants have been issued in cases involving prominent individuals or significant public interest. But for the average individual experiencing online harassment, the realistic expectation is that the police report establishes a record and may, over an extended period — often many months — lead to further action, but it is not a mechanism that produces a fast result. What the police route gives you What the police route does not give you Route 2: Hiring a Private Forensic Investigator How the process works A PSRA-licensed forensic investigator engaged for a cyberbullying or online harassment matter begins with a confidential case assessment — usually conducted within hours of first contact. From there, the investigation typically proceeds through emergency evidence preservation, OSINT-based perpetrator identification, metadata analysis, and the compilation of a structured forensic report. Unlike a police investigation, this process is driven by your instructions and your timeline. You decide the scope, the urgency, and the objective — whether that is identifying an anonymous harasser, documenting the reach of a defamatory post for a civil claim, or preparing evidence to support an urgent injunction application. What to expect on timing This is where the contrast with the police route is starkest. Emergency evidence preservation — forensically capturing screenshots with hash verification, archiving web pages, and extracting metadata — can begin within hours of instruction and is typically completed within 24–48 hours. This matters because

Computer Misuse and Cybercrimes Amendment Act 2025: What Changed and What It Means for Victims In October 2025, Kenya’s cyber harassment laws changed dramatically — and then, a week later, partly changed back. If you are dealing with online harassment, cyberbullying, or defamation in Kenya, the current legal situation is genuinely confusing, even to lawyers. This guide explains exactly what the Computer Misuse and Cybercrimes (Amendment) Act 2025 says, what the High Court has suspended, what remains in force, and — most importantly — what this means practically if you are a victim trying to get justice. Quick answer: The Computer Misuse and Cybercrimes (Amendment) Act, 2025 was signed into law by President William Ruto on 15 October 2025, expanding the offence of cyber harassment under Section 27 to cover content that “detrimentally affects” a person, is “indecent or grossly offensive,” or is likely to cause someone to attempt suicide — with penalties of up to KES 20 million or 10 years imprisonment. Seven days later, on 22 October 2025, the High Court suspended Sections 27(1)(b), (c) and (2) pending a constitutional challenge brought by the Kenya Human Rights Commission and activist Reuben Kigame. Those provisions remain unenforceable. Critically, none of this affects your right to bring a civil defamation claim — the civil route under the Defamation Act (Cap. 36), covered in our step-by-step guide to suing for online defamation in Kenya, operates independently of the criminal cybercrime framework and is unaffected by this dispute. Background: Why the Law Changed The Computer Misuse and Cybercrimes Act was originally enacted in 2018 to address cyber fraud, identity theft, data breaches, and unauthorised access to computer systems. Section 27 of the original Act already criminalised “cyber harassment” — but as cyberbullying, online abuse, and coordinated harassment campaigns grew more sophisticated across Facebook, X (Twitter), TikTok, and WhatsApp, lawmakers argued the existing provisions were too narrow to address the scale of the problem. A draft amendment bill was published by Parliament in August 2024. After an extended period of public participation and committee review, the Computer Misuse and Cybercrimes (Amendment) Act was passed by Parliament and assented to by President Ruto on 15 October 2025. What the 2025 Amendment Changed The amendment introduced several changes across the Act, but three are most relevant to anyone dealing with online harassment. 1. Section 27 — Cyber Harassment, Expanded The amended Section 27 broadened the definition of cyber harassment to cover electronic communication that: The penalty for cyber harassment under Section 27 remains severe: a fine of up to KES 20 million, imprisonment for up to 10 years, or both. 2. Expanded Powers Over Websites and Applications The amendment broadened the mandate of the National Computer and Cybercrimes Coordination Committee, giving it authority to issue directives making websites or applications inaccessible where they are found to promote unlawful activity — including content involving the sexual exploitation of minors, or content advocating terrorism, religious extremism, or cultism. This power is subject to a requirement of proof before a directive can be issued. 3. Broader Evidence-Gathering Powers for Law Enforcement The amendment expanded the investigative powers available to law enforcement to access and preserve electronic evidence — relevant to how cybercrime investigations (including those touching on harassment) are conducted going forward. Why the Law Was Immediately Challenged The expanded Section 27 provisions — particularly the “detrimentally affects” and “indecent or grossly offensive” language — drew immediate and sustained criticism from civil society organisations, including the Law Society of Kenya, the Kenya Human Rights Commission (KHRC), and digital rights groups such as ARTICLE 19 and KICTANet. The core objection was about vagueness. Critics argued that phrases like “detrimentally affects a person” are so broad and subjective that almost any critical, satirical, or unflattering online statement about a public figure could be characterised as cyber harassment — creating a tool that could be used to silence legitimate criticism, journalism, and political commentary rather than to protect genuine victims of harassment. Former Chief Justice David Maraga publicly criticised the amended Act, describing the new provisions as risking abuse, censorship, and political manipulation, and arguing that granting such broad executive power was less about protecting Kenyans from cyberbullying and more about controlling information and silencing dissent. President Ruto, for his part, defended the amendments as necessary to protect Kenyans from cyberbullying and other online criminal activity. The High Court Suspension: What Actually Happened On 22 October 2025 — exactly one week after the President assented to the Act — Justice Lawrence Mugambi of the Milimani Law Courts issued conservatory orders in response to an urgent application filed by gospel musician and activist Reuben Kigame, the Law Society of Kenya, and the Kenya Human Rights Commission. The court suspended the enforcement, implementation, and operation of: This suspension is a conservatory order — a temporary measure that holds these specific provisions in legal limbo while the substantive constitutional petition is heard and determined. The petitioners argue that these provisions are unconstitutional because they introduce vague and overbroad language that criminalises legitimate online expression, and because they weaken the protections established under the Data Protection Act 2019. As of mid-2026, the constitutional petition challenging these provisions has not yet been finally determined — meaning the suspended sections remain unenforceable, and the underlying constitutional question remains open. What This Means in Practice If you are dealing with online harassment, cyberbullying, or defamation in Kenya right now, here is what the current legal landscape actually means for you. The suspended provisions cannot currently be used to prosecute someone If the harassment you are experiencing would only fall under the suspended language — content that is merely “indecent,” “grossly offensive,” or “detrimentally affects” you, without more — a criminal prosecution under those specific clauses is not currently available, because the provisions are under conservatory suspension. Other parts of Section 27, and other sections of the Act, remain in force The suspension is narrow — it applies only to Section 27(1)(b), (c) and (2). Other cyber offences