Computer Misuse And Cybercrime Act No 5 Of 2018 in Kenya

This Act may be cited as the Computer Misuse and Cybercrimes Act, 2018.

In this Act, unless the context otherwise requires — "access" means gaining entry into or intent to gain entry by a person to a program or data stored in a computer system and the person either— (a) alters, modifies or erases a program or data or any aspect related to the program or data in the...

The objects of this Act are to — (a) protect the confidentiality, integrity and availability of computer systems, programs and data; (b) prevent the unlawful use of computer systems; (c) facilitate the prevention, detection, investigation, prosecution and punishment of cybercrimes; (d) protect...

There is established the National Computer and Cybercrimes Co-ordination Committee.

(1) The Committee shall comprise of— (a) the Principal Secretary responsible for matters relating to internal security or a representative designated and who shall be the chairperson; (b) the Principal Secretary responsible for matters relating to information, communication and technology or a...

(1) The Committee shall — (a) advise the Government on security related aspects touching on matters relating to blockchain technology, critical infrastructure, mobile money and trust accounts; (b) advise the National Security Council on computer and cybercrimes; (c) co-ordinate national security...

(1) There shall be a Secretariat which shall comprise of the Director and such number of public officers that, subject to the approval of the Committee, the Cabinet Secretary responsible for matters relating to internal security in consultation with the Cabinet Secretary responsible for matters...

The Committee shall submit quarterly reports to the National Security Council.

(1) The Director shall, by notice in the Gazette, designate certain systems as critical infrastructure. (2) The Director shall designate a system as a critical infrastructure if a disruption of the system would result in — the interruption of a life sustaining service including the supply of...

(1) The Committee shall within reasonable time and in consultation with the owner or a person in control of an identified critical information infrastructure, submit to the National Security Council its recommendations of entities to be gazetted as critical information infrastructures. (2) The...

(1) The owner or operator of a system designated as critical infrastructure shall report to the Committee any incidents likely to constitute a threat in the nature of an attack that amounts to a computer and cybercrime and the action the owner or operator intends to take to prevent the...

(1) A private entity may enter into an information sharing agreement with a public entity on critical information infrastructure. (2) An agreement under subsection (1) shall only be entered into for the following purposes and in line with a critical infrastructure framework— (a) to ensure cyber...

(1) The owner or person in control of a critical information infrastructure shall annually submit a compliance report on the critical information infrastructure to the Committee in line with a critical infrastructure framework in order to evaluate compliance. (2) The Director, shall within a...

(1) A person who causes, whether temporarily or permanently, a computer system to perform a function, by infringing security measures, with intent to gain access, and knowing such access is unauthorised, commits an offence and is liable on conviction, to a fine not exceeding five million shillings...

(1) A person who commits an offence under section 14 with intent to commit afurther offence under any law, or to facilitate the commission of a further offence by that person or any other person, commits an offence and is liable, on conviction, to a fine not exceeding ten million shillings or to...

(1) A person who intentionally and without authorisation does any act which causes an unauthorised interference, to a computer system, program or data, commits an offence and is liable on conviction, to a fine not exceeding ten million shillings or to imprisonment for a term not exceeding five...

(1) A person who intentionally and without authorisation does any act which intercepts or causes to be intercepted, directly or indirectly and causes the transmission of data to or from a computer system over a telecommunication system commits an offence and is liable, on conviction, to a fine not...

(1) A person who knowingly manufactures, adapts, sells, procures for use, imports, offers to supply, distributes or otherwise makes available a device, program, computer password, access code or similar data designed or adapted primarily for the purpose of committing any offence under this Part,...

(1) A person who knowingly and without authority discloses any password,access code or other means of gaining access to any program or data held in any computer system commits an offence and is liable, on conviction, to a fine not exceeding five million shillings or to imprisonment for a term not...

(1) Where a person commits any of the offences specified under sections 14,15, 16 and 17 on a protected computer system, that person shall be liable, on conviction, to a fine not exceeding twenty five million shillings or imprisonment for a term not exceeding twenty years or both. (2) For purposes...

(1) A person who unlawfully and intentionally performs or authorizes or allows another person to perform a prohibited act envisaged in this Act, in order to — (a) gain access, as provided under section 14, to critical data, a critical database or a national critical information infrastructure;...

(1) A person who intentionally publishes false, misleading or fictitious data or misinforms with intent that the data shall be considered or acted upon as authentic, with or without any financial gain, commits an offence and shall, on conviction, be liable to a fine not exceeding five million...

A person who knowingly publishes information that is false in print, broadcast, data or over a computer system, that is calculated or results in panic, chaos, or violence among citizens of the Republic, or which is likely to discredit the reputation of a person commits an offence and shall on...

(1) A person who, intentionally — (a) publishes child pornography through a computer system; (b) produces child pornography for the purpose of its publication through a computer system; (c) downloads, distributes, transmits, disseminates, circulates, delivers, exhibits, lends for gain, exchanges,...

(1) A person who intentionally inputs, alters, deletes, or suppresses computer data, resulting in inauthentic data with the intent that it be considered or acted upon for legal purposes as if it were authentic, regardless of whether or not the data is directly readable and intelligible commits an...

(1) A person who, with fraudulent or dishonest intent— (a) unlawfully gains; (b) occasions unlawful loss to another person; or (c) obtains an economic benefit for oneself or for another person, through any of the means described in subsection (2), commits an offence and is liable, on conviction,...

(1) A person who, individually or with other persons, wilfully communicates, either directly or indirectly, with another person or anyone known to that person, commits an offence, if they know or ought to know that their conduct — (a) is likely to cause those persons apprehension or fear of...

A person who, intentionally takes or makes use of a name, business name, trademark, domain name or other word or phrase registered, owned or in use by another person on the internet or any other computer network, without authority or right, commits an offence and is liable on conviction to a fine...

A person who fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of any other person commits an offence and is liable, on conviction, to a fine not exceeding two hundred thousand shillings or to imprisonment for a term not exceeding...

A person who creates or operates a website or sends a message through a computer system with the intention to induce the user of a website or the recipient of the message to disclose personal information for an unlawful purpose or to gain unauthorized access to a computer system, commits an offence...