For years, journalists and bloggers in Kenya have had to worry that getting something wrong in a sensitive story could turn into a criminal case.
That concern largely centered on sections 22 and 23 of the Computer Misuse and Cybercrimes Act (CMCA), which dealt with false publications and false information.
Critics said the offenses were so broad that they could punish honest mistakes alongside deliberate attempts to mislead the public.
That picture has now changed following a new guide for investigating and prosecuting cybercrime that has been released by the National Computer and Cybercrimes Coordination Committee (NC4), the Office of the Director of Public Prosecutions, and the National Police Service.
The guide is designed to help police and prosecutors handle cybercrime cases consistently. It explains what needs to be proved for each offense, what evidence investigators should collect, and which agencies should be involved.
What matters more for journalists is how recent court rulings have changed the law.
Two Offenses Journalists No Longer Have to Worry About
In March 2026, the Court of Appeal struck down sections 22 and 23 of the CMCA.
The court found that the false-publication and false-information offenses were too broad and could catch people who made honest mistakes rather than deliberately trying to deceive others.
For journalists, that is a big deal. Publishing an inaccurate detail can still lead to a correction, a complaint, or even a civil case. However, the government can no longer rely on those two specific offenses to turn a false publication into a criminal cybercrime charge.
Journalists can still face charges under other parts of the law. It simply removes two offenses that had been a major concern for the media.
What the Government Has Lost
The courts have also pushed back against some provisions introduced through amendments to the CMCA in 2025.
One provision would have allowed authorities to make websites and apps inaccessible over certain types of unlawful content, including material involving children, terrorism, and religious extremism.
Another provision expanded the definition of cyberharassment to cover communications that could cause a person to attempt suicide. The High Court declared both provisions unconstitutional in July 2026.
For journalists and publishers, the website-blocking provision was particularly important. Had it remained in place, authorities could potentially have blocked an entire website over content posted by an individual user.
That power is now off the table.
Other Cybercrime Offenses Still Remain
The recent court rulings do not mean that journalists are immune from Kenya’s cybercrime laws. Fraud, impersonation, identity theft, and unlawful disclosure of information remain offenses under the CMCA.
For example, a journalist who deliberately misrepresents their identity to obtain information could still face legal consequences. The same applies to other forms of unlawful conduct that have nothing to do with publishing false information.
The rulings have narrowed the law in important ways, but much of it remains in force.
The Grey Areas
The law still has some grey areas. Some cyberharassment provisions still use broad terms such as “grossly offensive.” These phrases can be difficult to interpret because what one person considers offensive may be seen by another as legitimate criticism or strong reporting.
The new guide does not settle that question.
What it does is give investigators and prosecutors a clearer process for putting together cybercrime cases. That can be useful when there is a genuine offense, but it also means vague provisions can now be applied through a more organized process.
What Journalists Should Do
The guide offers some fairly practical advice for anyone working on sensitive stories.
Journalists should keep their notes, source material, drafts, and publication records rather than deleting them after a story goes live. These records can help show how a story was reported and whether reasonable steps were taken to verify the information.
When reporting allegations, clearly distinguish between what has been claimed and what you have verified. If you make a mistake, correct it openly and promptly. This can also help demonstrate that the error was made in good faith and addressed responsibly.
For stories involving organized crime, terrorism, or child protection, getting legal advice before publication can also help avoid problems later.
The Courts Are Changing the Rules
The most important lesson from the past year is that Kenya’s cybercrime rules are still evolving.
The new guide gives police and prosecutors a clearer way to investigate cybercrime, but the courts have already removed some of the provisions that posed the biggest concerns for journalists.
For reporters, that means the legal landscape is narrower than it was a year ago, but it is far from risk-free.
The best protection remains careful reporting, proper records, and knowing exactly what the law allows before publishing a sensitive story.
