Surveillance State: Are you safe? Are you next?

On Friday, May 30th 2025, I was illegally arrested at the onset of a long weekend.

Efforts to secure police bail or bond were frustrated, with the police claiming they did not have my file and were simply providing accommodation to me on behalf of the Directorate of Criminal Investigations (DCI). The DCI was unreachable throughout the whole weekend.

I was illegally detained for 4 nights with no charge sheet and no access to the police Occurrence Book (OB) details.

I was arrested for creating a public participation website that allowed Kenyans to send in their memoranda regarding the 2025 Finance Bill. The charge sheet that was presented in court claimed I disrupted the system by sending mass emails.

However, the emails are user-generated and tied to individual email addresses and IPs, not mass-generated.

The many emails were from actual Kenyans. Such a system was built last year as well. I remember sending my memorandum of objection using that emailer.

While the DCI officers were recording my statement, they told me “we weren’t sure you’d go for the event. We heard your calls to your friends and you sounded unsure.” The penny dropped. I was being surveilled.

I asked them if they saw me crossing the expressway on foot and they said yep, they were right behind me. They even knew where I lived with my sons and had been waiting for me to leave for them to arrest me.

I reflected on my sim card’s behaviour. Months before my arrest, before I’d even made the civic email website, I suspected I was being tracked. Whenever I’d put that sim card in my smartphone, it’d send messages on its own. I’d see “message sent”. I would also get phantom notifications with sounds not native to my phone. I delegated that sim card to my feature phone.

I’d then get some calls from random numbers, where the caller would speak in strange languages including Arabic, and I’d tell them “wrong number” then forget about it. In the week after I made the emailing platform and before my arrest, around Monday or Tuesday, the caller called my work line and personal line concurrently. I called back and asked, “who are you really, and what have you planned for me?”

The calls stopped, but now I’d get a text message from Tala asking me to pay my loan. The messages were from random numbers, not Tala’s short code. I’d simply delete and ignore. In hindsight, I see that whoever was tracking me was triangulating my location using these calls and texts.

Kenya’s Data Protection Act provides a strong legal foundation for data privacy, limiting how public and private entities collect, process, and transfer personal data. However, it explicitly exempts national security and intelligence operations, which may use surveillance with less oversight, provided there’s court-ordered authorisation. I am yet to see such a court order issued in my case.

In practice, law enforcement collaborations with telcos have led to significant metadata tracking, sometimes operating in grey zones. Enforcement by the Data Commissioner addresses private-sector misuses, but government surveillance remains shielded by separate security legislation.

Under Kenya’s Computer Misuse and Cybercrimes Act (2018), law enforcement officers or authorised individuals with reasonable grounds to believe that computer data is relevant for a criminal investigation must apply for a court‑issued warrant before entering premises to access, search, or seize such data.

The warrant must clearly identify the officer, specify the data to be seized, and authorise searching of the designated premises or persons.

Upon executing the warrant, they must present a copy to those affected and prepare an itemised list of seized or inaccessible data along with the time and date, copies of which must be provided to the individual in control of the computer.

The DCI officers who illegally arrested me also illegally took my computer, hard drives, flash discs and smart phone without such a warrant. They did write an itemised list but it did not contain everything they took from my house, and I do not have a copy of the list.

I am yet to receive my items or take plea.

To put it simply, I was taken by plainclothes officers, bundled into a Subaru, had my house ransacked, and was illegally detained for three days, and four nights without charge. What does that look like to you, because to me this whole operation looks like an illegality?

In light of Albert Ojwang’s death immediately following an arrest similar to mine, we must ask the hard questions. Are you safe? Are you next? Will your face be on the cover of newspapers for highlighting corruption or performing your civic duties?

Who is behind all this?

And what can we do about this surveillance?

For now, I will continue living my life as close to normal as possible. I am unable to boycott that particular phone provider because I run a business that relies on calls and mobile money that is widely used in this country. I am a law abiding citizen. I work to feed, clothe and shelter my little ones. I constantly talk to my parents over the phone. And they most likely will continue to monitor my calls and movements.

This kind of intimidation and repression will surely come to pass and the people behind it all will one day answer for their actions. But for now, we must admit and accept this: we are living in a state of surveillance. All of us.
 

Twitter: @rtunguru