Snapshot of the judgement

Issue	Finding of the court
That the two-thirds gender rule would not be met in the National Computer and Cybercrimes Co-ordination Committee created under the Act	The challenge was premature as the Committee is yet to be constituted.
Offences of false publication, child pornography, cyber harassment, cybersquatting and wrongful distribution of obscene or intimate images were a limitation of freedom of expression	Freedom of expression may be validly limited in the public interest, to preserve rights/reputations of others and in accordance with the Constitution. In this case it was and also validly limited in creating the offences (of cyber harassment, squatting and wrongful distribution of intimate images).
Section 24 criminalises child pornography but omits the word ‘child’. The provision also used subjective terms such as ‘erotic’, ‘lewd’, or ‘designed to arouse sexual interest’ that had not been defined	The court took the contextual view that pornography as defined is focused on criminalisation of child pornography as stated in the marginal notes. The definition of pornography as such, needed not be definite as the matter is subjective.
Absence of mens rea in some of the offences e.g unauthorised interference was contrary to the Constitution as it could result in prosecution of innocent conduct	The nature of the offences were computer integrity crimes and the mens rea could be gleaned from the wording of the provisions. Use of the words ‘intentional’, ‘unlawful’, ‘willful’ all connote mens rea.
Granting of powers to obtain search warrants, make preservation orders and intercept information to the police were an improper limitation of the Right to Privacy	The powers were not unchecked and contained safeguards. Further, nature of cyber offences justified expanding the tools available to officers.
Amendment of the Bill during the Committee of the Whole (after it had already been subjected to public participation) denied members of the public opportunity to give input on the new issues	The Petitioner read the Standing Order selectively and failed to identify any amendments after the fact that expanded the scope of the Bill. The cou-rt deferred to Parliament to regulate its own internal affairs citing the principle of separation of powers.

Introduction

On 16^th May 2018, the President of Kenya assented to the Computer Misuse and Cybercrimes Act (‘the Act’). Its objective is to provide for offences relating to computer systems, enabling among other things, prompt detection and prosecution of computer and cybercrimes. The Act among other things criminalises fake news as well as publication of false information. Shortly after its enactment, the Bloggers Association of Kenya (BAKE), challenged its constitutionality before the High Court of Kenya, resulting in the suspension of 26 sections pending the hearing and determination of the suit. The grounds of the petition was the limitation of various fundamental freedoms by provisions of the Act. On 20^th February 2020, Justice Makau gave the final judgment that upheld, in entirety, the constitutionality of the Act. In this blog post, we discuss the highlights of this judgement.

The court addressed five substantive issues:

1. Whether section 5 of the Act, on the composition of the National Computer and Cybercrimes Co-ordination Committee, violated Article 27 of the Constitution on equality and freedom from discrimination;
2. Whether sections 22, 23, 24, 27, 28 and 37 of the Act limit Articles 32, 33 and 34 of the Constitution in a manner inconsistent with the limitation of rights as envisioned in Article 24 of the Constitution;
3. Whether sections 16, 17, 31, 34, 35, 36, 38, 39 and 41 are inconsistent with the Constitution for failing to prescribe a mens rea for the offences;
4. Whether sections 48, 50, 51, 52, and 53 limit the right to privacy under Article 31 of the Constitution in a manner inconsistent with Article 24;
5. Whether the National Assembly Standing Order 133 Contravenes Article 118 of the Constitution;

1. Section 5 and the Right to Equality

The Act, in section 4, establishes a National Computer and Cybercrimes Co-ordination Committee. In section 5, it provides the composition of said Committee to include various holders of State Offices (or their representatives). The Petitioner (BAKE), complained that the provision did not put in place adequate safeguards to ensure that two-thirds gender rule mandated by Article 27(8) of the Constitution, would be upheld. Their argument was that, the Act failed to contemplate an instance where all the holders of said offices, or their chosen representatives would be of one gender. It is on this basis that the Petitioner sought to have the section declared unconstitutional.

The court found that the Petitioner had failed to prove that the Committee was constituted, and such constitution violated Article 27. Makau J found the challenge to be premature; there was no basis for anticipating a potential violation. section 5 was thus upheld.

2. Limitation of the freedoms under Article 32, 33 and 34 of the Constitution by the Act

Articles 32-34 of the Constitution of Kenya guarantee the following freedoms (among others):  conscience, religion, belief and opinion; expression and the media (in relation to journalists).  The Petitioners contended that sections 22, 23, 24, 27, 28 and 37 of the Act, amount to a limitation of these freedoms in a manner inconsistent with Article 24. Article 24 of the Constitution which requires that limitations ought to be prescribed by the law, in pursuit of a justifiable aim in an open and democratic society and proportionate to the aims sought – a common standard in international human rights law. The sections considered by the court under this issue are summarised here: false publications, publication of false information, child pornography, cyber harassment, cyber-squatting and wrongful distribution of obscene or intimate messages.

a) “Fake news”, publication of false information and the infamous criminal defamation

Sections 22 and 23 of the Act criminalise false publication and publication of false information. The Petitioner’s core contention was that truth was not a condition of free speech and that any law purporting to regulate the truth in a manner so vague as to use sweeping terms such as ‘false, misleading or fictitious’ would countenance a violation of the freedom of expression. They argued that the protection of speech extends to even that which is false.

Further, the Petitioner contended that Section 23 of the Act reintroduced criminal defamation, effectively reversing the decision of Justice Mumbi Ngugi in Geoffrey Andere v AG & 2 others where she declared unconstitutional section 29 of the Kenya Information and Communication Act (KICA). See our blog post on that case here.

The court noted that in relation to the freedom of expression, states have two duties (positive and negative): protection of free speech and restraining from intruding upon the life and liberty of its citizens. On the other end of the spectrum, states also have a duty to protect persons from harmful speech. It is on this basis that the court found that the State has a legitimate aim to pursue in limiting speech that may be harmful (suggesting that sections 22 and 23 had this objective).

In considering the proportionality of the limitation in section 22, the court considered the impact (on the freedom of expression) not only from the point of view of a private citizen but also from the view of the larger public i.e., the sharing of information via the internet generally. In weighing the limitation vis a vis the right protected, Makau J found that the petitioner had failed to demonstrate the excessive nature of the limitation. This was in light of the court’s perception that the objective of the section was to prevent sharing of (potentially harmful) false information. The court was unable to find any other (less restrictive) means of achieving this objective, and the Petitioner also failed to adduce examples. The court even noted that section 22(c) of the Act adopts the list of permissible limitations listed under Article 24, thereby validating its limitation. The court relied on the  social contract theory and the government’s role of maintaining social order, to uphold the limitation prescribed by section 22, noting that recent trends in fake news  may induce panic or unrest.

As for section 23, the court differed with the Petitioner’s contention of similarity with (the repealed) section 29 of KICA on several bases: section 23 of the Act targets publication of false information over a computer as opposed to general false publication; section 29 of KICA was specific to individuals licensed under that Act while section 23 of the Act is applicable to all persons; and section 29 contained a variety of ambiguous terms that contributed to its invalidation, none of which the court found in the Act.

In response to the charge that the use of the term ‘false’ was vague, the court adopted a contextual interpretation to find that it was sufficiently narrow and a mirror of Article 33 (3) of the Constitution which places a limit on speech in a bid to protect the rights and reputations of others. Makau J argued that libel, whether criminal or civil is unprotected speech (see paragraphs 53-55). Relying on a South African Court of Appeal decision, the court appears to contend that criminal defamation is constitutionally valid contrary to the same court’s judgment in the Geoffrey Andare case. On the basis of this reasoning, the Judge bifurcated cyber libel from traditional libel to hold that the nature of the internet (enabling anonymity and wide reach), justifies the criminalisation of cyber libel.

In addressing the Petitioner’s contention that the freedom of expression extends to all speech including that which is false, the court citied Articles 33(2) and (3) of the Constitution, and Article 29(2) of the International Convention on Civil and Political Rights (ICCPR), to find that the freedom of expression is qualified – in this case, that harmful speech provides sufficient basis for limitation. In relation to media freedom and generally, freedom of expression, the court considered the Petitioner’s submissions that section 23 was loaded and vague, and that in enforcement, both sections would result in a chilling effect on media freedom. The court found that the mens rea provided for in both sections were in line with Article 24(1)(d) of the Constitution and thus, a valid limitation. It distinguished the use of the words ‘publish’ and ‘publication’ (impugned as vague) from the use of those words in section 194 of the Penal Code (which was voided by Jackqueline Okula & another v AG & 2 others) and section 29 of KICA. This distinction was that section 23 sought to protect the public interest as opposed to individual interests – an objective in line with Article 33. Consequently, the court upheld both sections as constitutionally valid.

b) Child pornography and Freedom of Expression

Section 24 of the Act makes it an offence to deal in (publish, distribute etc.) child pornography. The issue raised in relation to this section, related to two primary aspects, the first, raised by the Petitioner and the second, by one of the interested parties. The first issue related to section 24(1)(c) which, in listing one of the offences relating to child pornography, omits the word ‘child’. The second issue related to the definition of pornography as including ‘sexually explicit conduct’ – a phrase contended to be casting the net widely in a manner potentially hampering the freedom of expression.

In advancing the first issue, the Petitioner alleged that the omission of the word ‘child’ was intentional on the part of the legislature so as to make illegal adult pornography. This was alleged to be even more problematic as the definition of pornography in the Act included sweeping terms such as ‘erotic’, ‘lewd’, or ‘designed to arouse sexual interest’. Recounting its submissions on the wide nature of the freedom of expression, the Petitioner averred that even pornography is protected speech and limitations thereof must adhere to the procedure prescribed by the Constitution.  Makau J found no fault in the definition, citing the use of the word ‘includes’ as a mechanism to ensure one sufficiently captures the dynamism of the subject matter (in this case, pornography). The court found that there cannot be a singular definition of the subject matter and use of characteristics was sufficient – the absence of definitions of these characteristics do not serve to render the section ambiguous. To supplement this view, Makau J adopted – once again – a contextual interpretation of the statue, finding the objective as criminalising child pornography, guided by the marginal note to the section which read ‘child pornography’. This  approach also appears to have served to address the omission of ‘child’ from section 24(1)(c) though not explicitly stated. Section 24 was upheld.

c) Cyber harassment and Freedom of Expression

Section 27 of the Act sets out the particulars of the offence ‘cyber harassment’. The Petitioner contended that this section was similar to section 29 of KICA. The main contention with this limitation (in Article 27) was the absence of proximity to the grounds for limitation provided in Article 33(2) of the Constitution. Once again, Makau J noted the differences in the two laws, therefore comparison was not helpful. Further, the court found that the Petitioner failed to demonstrate that the creation of such an offence was not necessary; there are no other existing laws in Kenya that could deal with the problem adequately, therefore it was necessary and justified. The objective of the law was clear to the Court: to punish socially harmful conduct. Having previously established that free speech protection does not extend to harmful speech, the court found that this was a valid limitation to the freedom of expression. Section 27 was upheld.

d) Cyber-squatting and freedom of expression

Cyber-squatting refers to acquiring a domain name over the internet in bad faith to profit, mislead, destroy reputation or deprive another from registering a domain on the basis of similarity. Section 28 criminalises this and the Petitioner contends that it would result in the preclusion of the use of certain words over the internet – a limitation to the freedom of expression and the right to property. The Petitioner proffered that there are less restrictive means to achieve the objective sought (protection of intellectual property (IP)) such as the Trade Marks Act and the Copyright Act. The court found that the government has the constitutional mandate to safeguard property rights (including IP rights). The enactment of section 28 was a pursuit of this mandate and a creation of a framework to achieve it, within the cyber space (which is noted as different from traditional IP squatting). The Petitioner was found to have failed to demonstrate how any fundamental freedom would be violated. Section 28 was thus upheld.

e) Wrongful Distribution of Obscene/Intimate Images and Freedom of Expression

Section 27 of the Act criminalises the wrongful distribution, publication or dissemination of ‘intimate or obscene’ images. The Petitioner contends that this limitation to speech surpasses the limits envisioned in Article 33(2). Further, the operative terms, intimate and obscene, are undefined and thus fail to meet the clarity test in Article 24. The court held that the Petitioner was required to demonstrate the manner in which the section limits the freedom of expression as opposed to merely asserting that the operative terms are vague – the Petitioner had failed to do this according to the Court. The court further recalled that the offence is not novel; section 181 of the Penal Code prohibits similar conduct. The difference herein lies with the fact that the Act focuses on conduct perpetrated in the cyberspace. The court upheld section 27 as well.

3. Absence of Mens Rea in Cybercrime Offences

The Petitioner contended that the offences in sections 16, 17, 31, 32, 34, 35, 36, 38(1), 38(2), 39 and 41 lack the element of mens rea . They fail to provide for the state of mind or intent of the perpetrator of offences. This, according to the Petitioner is contrary to the basic principle that wrongdoing must be conscious to be criminal; only those offences that are public welfare or are regulatory do not require mens rea. The upshot of this, to the Petitioner, is the inadvertent criminalisation of apparently innocent conduct.

Briefly, the impugned set out the following offences : unauthorised interference, unauthorized interception, cyberharassment,interception of electronic messages or money transfers, wilful misdirection of electronic messages, inducement to deliver electronic message, intentionally withholding message delivered erroneously, unlawful destruction of electronic messages, fraudulent use of electronic data, issuance of false e-instructions and employee responsibility to relinquish access codes.

According to the Petitioners, these offences all carry hefty sentences and as such cannot be said to be regulatory so as to obviate mens rea. Further, unless the legislature explicitly states that mens rea is not a requirement, the court cannot imply public welfare as a rationale.

The court found that different offences have different elements of mens rea. In this Petition, the sections referred to contain elements of mens rea relating to cyber space. The court delineated that these are clearly computer integrity-crimes. The essential ingredient of mens rea in such a case is determining that the offender must have been aware that at the time of compromising the integrity of a computer, the action is unlawful and/or unauthorized. The court cited the use of words such as ‘intentionally’, ‘willfully’ and ‘unlawfully’ to highlight the mens rea element. In the end, the court found that the Petitioner had failed to prove the infringing nature of these sections and thus, they were upheld.

4. Right to Privacy and Investigation of Cybercrimes

The Act vests in the police, certain search and seizure powers. The manner in which these searches and seizures are provided for in the Act were in issue in this Petition. The Petitioner alleged that section 48, 50, 51, 51 and 53 limit the right to privacy (Article 31) in a manner inconsistent with Article 24. The sections provide for : search and seizure of stored computer data, production order, expedited preservation and partial disclosure of traffic data, real-time collection of traffic data and interception of content data.

The search and seizure and production order provisions allow an officer to apply for a warrant on the basis of a belief based on reasonable grounds. This, according to the Petitioner amounted to a disproportionate limitation to the right to privacy as it places courts in a position where they are obliged to issue the warrant, particularly due to the use of the word ‘shall’. The aforementioned provisions, according to the Petitioner, failed to meet the reasonableness test.

Further, the expedited preservation provision enables an officer to simply issue a notice requiring preservation, also on the basis of a belief based on reasonable grounds. It is the Petitioner’s contention that this by-passes judicial oversight.  Lastly, the Petitioner contended that the partial disclosure of traffic data and the real-time collection of traffic data fails to distinguish between sensitive and non-sensitive data, and as a result, fails to prescribe a higher level of protection to sensitive data in accordance with the right to privacy

The court reasoned that cybercrimes differ in nature from ordinary crimes, and  investigative procedures ought to take note of this and adapt. Consequently, the provisions in question serve to ensure investigators have adequate powers, commensurate to the nature of cyberspace. The court found that sections 48 and 50 both provide judicial determination and do not bind a court to issue a warrant; the police first have to establish reasonable grounds. Further, the court found that the remainder of the sections did not bypass judicial authority and in fact, the sections contain adequate safeguards limiting the scope of preservation orders and capability of interception. On the whole, all the sections were found to limit the right to privacy in a manner consistent with the Constitution and adequately balancing private rights with public interest.

5. Public Participation and the Legislative Process

The National Assembly is bound by national values when enacting law. Such values include public participation, transparency, accountability. Article 118 of the Constitution requires Parliament to facilitate public participation. The Petitioner argued that National Assembly Standing Order 133 provides for committee of whole procedure. After public participation takes place (carried out by the parliamentary committee after the first reading), individual members are allowed to add new clauses during Committee of the Whole, effectively removing further public participation. Therefore, raft of provisions are not subject to public participation. They claimed that standing order 133 was thus unconstitutional.

The court found that the Petitioner read the standing order selectively and did not identify the proposed amendments which unreasonably expand the Bill. In this instance, there was notice by one of the MPs to propose changes during committee stage, and the Speaker demonstrated that the Act was passed in accordance with Constitution. The court found that to hold that every amendment must undergo process of public participation, would mean an undermining of the legislative process. Further, separation of powers means allowing Parliament to regulate its internal affairs.  The passage of the Act was thus found to be Constitutional, as was the standing order.

Final Orders

The court held that the need to protect the wider public from dangers in the cyberspace outweighs the granting of the petition. They found that the provisions of the Act effectively protect public interest and that public interest needs to be held in the highest esteem.

The Act was held to be valid and not in violation of fundamental rights and freedoms. All the impugned sections were upheld, the Petition dismissed, and each party directed to bear its own costs.

 

Image by freepik