When the Rubber Meets the Road: Cybersecurity and Kenya’s Digital Superhighway

Kenya is one of Africa’s leading digital economies. The country has undergone a digital revolution since the early aughts; steady investment in connectivity infrastructure, coupled with an enterprising populace, has seen the country’s information, communications, and technology (ICT) sector grow by an average 10.8 percent every year since 2016.¹ The National ICT Policy as reviewed in 2019 outlines ambitions of leveraging ICT “as a foundation to the creation of a more robust economy” by growing the sector’s contribution to the digital and traditional economy to 10 percent of gross domestic product by 2030.² Leaning into a continental leadership role, Kenya developed a Digital Economy Blueprint in 2019, drawing from the country’s digitalization journey to propose a framework that other African countries could adopt to invest in their own digital economies.³

Much of Kenya’s digital success is underpinned by the role of mobile technologies, as reflected prominently in policy documents. The national ICT policy prioritizes a “mobile first” strategy because most citizens access the internet via mobile phones. The National Broadband Strategy for 2018–2023 announced a proposed target of 100 percent connectivity by 2023 and Kenya’s intention to meet the 2025 UN Broadband Commission’s “one for two” affordability target—that is, one gigabyte of mobile broadband data available for 2 percent or less of gross national income per capita.⁴ As of March 2023, the number of mobile (SIM) subscriptions in the country was 66.1 million according to the Communications Authority of Kenya.⁵

A core component of Kenya’s mobile technology success has been mobile money services, notably through the M-PESA service offered by the country’s leading telco, Safaricom. With M-PESA—which marked its fifteenth anniversary in March 2022—banked and unbanked customers can send and receive money, access short-term loans and overdraft facilities, store money (savings), and pay for goods and services.⁶

Digital Ambitions, Cybersecurity, and Data Protection Realities

The Kenyan government under the incumbent president, William Ruto, has dubbed its ICT agenda the Digital Superhighway.¹² Through additional investments in fiber connectivity, satellite, and other emerging connectivity solutions, the government aims to expand high-speed internet access nationwide to transform the country, create jobs, and enable growth.¹³ Through the Ministry of Information, Communications and Digital Economy (MIC&DE), the government aims to roll out 25,000 public WiFi hotspots and over 1,000 village digital hubs by 2027.¹⁴ It is also working with the private sector toward producing affordable smartphones (envisioned to be Africa’s cheapest) and has accelerated the digitization of government services.¹⁵ The government has stated its intention to roll out unique personal identifiers to serve as lifetime registration numbers from birth to death¹⁶ and a new digital identification system to provide Kenyans with “a secure and reliable way to verify their identity for a variety of purposes” at some point in the future.¹⁷

Amid the public and private sector successes and ambitions in digitalization, cybersecurity has been noted variously as a concern or challenge. The National ICT Policy lists cyber crime and cybersecurity vulnerabilities as one of the “significant challenges to be overcome” in achieving the policy’s short-term goals.¹⁸ The Digital Economy Blueprint recognizes cybersecurity as a crucial enabler of digitalization, noting that protecting the integrity of electronic and digital systems is a “paramount concern in a digitally enabled economy.”¹⁹ The document further acknowledges data security and privacy as fundamental to consumer trust in digital services and even outlines questions specific to cybersecurity and data protection in its “country checklist for development of digital economy” (see figure 1). On the legislative front, Kenya’s Computer Misuse and Cybercrimes Act (CMCA) of 2018 outlines offenses related to computer systems within the jurisdiction and modalities for international cooperation on “computer and cybercrime matters.”²⁰ Additionally, the Data Protection Act of 2019 establishes the Office of the Data Protection Commissioner, makes provision for personal data processing regulation, and provides for the rights of data subjects and the obligations of data controllers and processors.²¹ The National Cybersecurity Strategy (2022–2027) was issued as a roadmap—aligned with the CMCA—to “address new challenges and emerging threats in the cyber domain.”²²

Kenya, then, has a suite of progressive ICT- and cybersecurity-related policies and frameworks. But their positive value will depend on effective implementation. Here, as recent events outlined below showcase, turning digital ambitions into real-life achievements is a daunting challenge.

July 2023: Kenya Faces a Massive Cyber Attack

A series of cyber incidents that occurred in Kenya in July 2023 tested the cybersecurity and resilience of the rapidly digitalizing country. These events affected government service provision and shook Kenya’s digital financial ecosystem.²³ By no means the first, they certainly were the most significant cyber attacks the country has yet faced. The government has previously dealt with defaced websites²⁴ and alleged breaches by foreign actors.²⁵ Financial systems, banks, and M-PESA alike have been subject to cyber-related threats and vulnerabilities.²⁶ Safaricom and the Communications Authority of Kenya are facing a class action lawsuit over SIM-swap frauds.²⁷

The recent cyber incidents, which were primarily distributed denial-of-service (DDoS) attacks, temporarily rendered digital public services in the country unavailable and disrupted internet and mobile payment platforms. They took place just as the government had ramped up digital public service provision. On June 30, Ruto unveiled a revamped version of the country’s eCitizen platform, which had been launched in 2014 to provide “cross-agency, citizen-centric information and services.”²⁸ It now offers over 5,000 digitized government services, with thousands more expected to be accessible on the platform by the end of 2023. Users can access eCitizen via desktop, through a phone-based application dubbed Gava Mkononi (“government in your hand”), or through an unstructured supplementary service data (USSD) code. eCitizen has also been announced as the official government digital payment platform, meaning that all payments for government services must made through a universal mobile money cash collection number, also known as a Paybill number.²⁹ 

Beginning the week of July 19, 2023, reports started streaming in that some eCitizen services were inaccessible. The University of Nairobi—the largest public university in the country—issued a notification of a possible data breach affecting its student management information system. The system was taken offline and the matter escalated to the National Computer and Cybercrimes Coordination Committee (NC4)—the national cybersecurity coordination body—and to the Office of the Data Protection Commissioner. The incident flew under the news coverage radar, as did other reported downtimes, such as reported ransomware attacks on another government entity, the Kenya Bureau of Standards.³⁰

By July 27, the attacks had affected the main national electricity transmission and distribution entity, Kenya Power, as well as Kenya Railways’ passenger services. On the same day, mobile money services through M-PESA became inaccessible. Kenya Power notified clients of a system hitch “due to a network breakdown” from its service provider, affecting the purchase of prepaid power tokens through M-PESA.³¹ Kenya Railways announced that its ticket purchasing system faced a similar glitch.³² The widely used M-PESA and Safaricom mobile apps could not facilitate mobile money transfers, and bank-to-M-PESA transfers were also affected, with some banks removing the option from their online portals altogether.

A group called Anonymous Sudan claimed responsibility for the cyber attacks.³³ The name of the group caused a stir among Kenyan information security groups and on social media; the idea that an organization of Sudanese cyber warriors had sworn to attack any entities that attempted to interfere with Sudan’s internal affairs led many to believe that Kenya’s engagements in the ongoing conflict were the cause of the attacks.³⁴ In June 2023, prior to the cyber attacks, Ruto had been set to lead a mediation process through a regional body—the Intergovernmental Authority on Development in Eastern Africa—but the process had been rejected by Sudan’s army chief.³⁵ The Kenyan government had “dismiss[ed]” this rejection, leading to a series of video exchanges between Kenyan and Sudanese officials.³⁶ In one widely circulated video, a Sudanese general had warned Kenya against sending peacekeepers;³⁷ this had drawn strong reactions from Kenyans, with a local Kenyan politician posting a video tirade on social media that skirted the diplomatic process. Another Sudanese governmental adviser had responded in turn, also on social media, with a video calling out the Kenyan politician for being out of order.

As Kenyans on social media tried to make sense of the disruptions, the cabinet secretary of the MIC&DE confirmed through a radio interview and a statement circulated via social media that cyber attack attempts had targeted both the government and private actors, but was quick to affirm that no data breaches had occurred.³⁸ The Ministry of Foreign and Diaspora Affairs—through the principal secretary’s Twitter account—issued a communiqué stating that it was facing a challenge affecting the processing of e-visas on eCitizen and would approve visas on arrival at the country’s entry points to mitigate the issue.³⁹ A day later, Safaricom alerted customers that they could instead access M-PESA and other services on their phones via USSD and SIM tool kit (a feature that allows SIM cards in phones to conduct value added services, such as mobile money payments in this case), but did not address the significant downtime experienced.

On July 30, the MIC&DE circulated yet another statement via social media broadly acknowledging “a new era of cyber threats” following the country’s digital transformation and announced a multistakeholder cybersecurity roundtable “with membership from Government and private sector, to discuss cyber threats management in this evolving landscape.”⁴⁰ The statement, issued jointly with several tech companies (predominantly U.S. multinationals) also outlined areas for public–private sector cybersecurity cooperation. The omission of civil society, academia, and local tech players has raised concerns as to the true nature of multistakeholder engagement in the ensuing process. Additionally, it remains unclear whether the roundtable is a one-off event or a new mechanism for continuous engagement on cybersecurity in Kenya. However, it offers a useful outline for this paper to offer some practical recommendations for improving cybersecurity posture and cyber resilience in light of these events and Kenya’s digital ambitions.

Improving Kenya’s Cyber Resilience: The Way Forward

Enhancing information-sharing, public awareness, and education

Cyber information-sharing between different stakeholders for situational awareness and for organizations to defend themselves is a good cybersecurity practice and one that always can be improved.⁴¹ Public-private collaborations for cybersecurity public awareness like those put forth in the press statement by the MIC&DE announcing the multistakeholder roundtable can be fine-tuned along sector-specific dimensions, such as cybersecurity and financial systems. As an immediate step, the government ought to adopt good multistakeholder practices such as courting local private sector players—especially small and medium-sized enterprises operating in and affected by developments in cyberspace—alongside the local sector leaders and tech multinationals operating in the country. Kenya also has a vibrant information security community that should be incorporated in cyber drills through professional associations. Setting up “white hat” programs, in which ethical hackers test a system’s security with the target’s consent, would also benefit the country’s cybersecurity and cyber resilience.⁴² Drills and information dissemination on common cyber threats and vulnerabilities that consumers may encounter in navigating the digital financial space could be conducted jointly by the associative bodies of fintechs, microfinance institutions, and the banking sector in collaboration with relevant regulatory bodies. Local information security communities and other tech associations should also be leveraged to advance iterative cybersecurity public education and awareness.

Additionally, affected organizations and governments bear some responsibility to inform the public they serve in the event of cyber incidents that lead to service disruption. Information-sharing, in this regard, should include an acknowledgment of disruption; its causes, if they are deemed feasible to share; measures the public can take to mitigate harm and practice cyber hygiene; and, when resolved, an update on restoration of services. The National Computer Incident Response Team (KE-CIRT/CC), which lists cyber security awareness as one of its duties,⁴³ could be better leveraged to bolster information-sharing with the public by offering authoritative situational updates in the event of ongoing attacks (as in the case of the July incident) in addition to the periodic reports on emerging threat trends that it already issues based on incident reports. Proactive communication to the public led by government bodies such as KE-CIRT/CC will help establish them as authoritative and trustworthy sources of information, which is an important step to stemming speculation and misinformation, especially in times of crisis.

Before any official communication was issued on the July cyber incidents, social media platforms were the primary avenue through which citizens gained any insight on the cyber attacks, with many submitting queries to official government social media channels such as eCitizen. The speculation attributing the incidents to Kenya’s involvement in the Sudan conflict—further fueled by Anonymous Sudan’s claims—were possible sources of misinformation and disinformation on the nature and scope of the attacks on critical public infrastructure.⁴⁴ Curiously, KE-CIRT/CC did not issue any advisories or cyber threat warnings during the cyber attacks despite having an active social media presence. Though the MIC&DE and its cabinet secretary did acknowledge the attacks, specialized entities also have a role to play in such instances. KE-CIRT/CC could have offered technical insights, progress updates, and cyber awareness tips for a concerned public to complement the messaging from the executive and regulatory authorities.

Nigeria is compelling as a comparison in this regard. On August 2, 2023, Anonymous Sudan claimed to set its sights on the nation’s digital infrastructure.⁴⁵ This was supposedly in response to Nigeria’s involvement in the proposed military response to the coup in Niger. Nigeria’s National Information Technology Development Agency—the federal agency responsible for developing and regulating information technology in the country—was quick to issue a statement acknowledging DDoS attempts on its digital infrastructure, as well as that of other government bodies, financial service providers, and telecommunications service providers.⁴⁶ The Nigeria Computer Emergency Response Team (ngCERT) issued a threat alert outlining the scope of the attack, recommendations on how to prevent such attacks, and social media blasts on avenues through which cyber attacks could be reported.⁴⁷ ngCERT followed up with a progress update a few days later.⁴⁸ This stands out as a model for information-sharing in the face of a cyber threat.

Safaricom and M-PESA, meanwhile, are yet to issue any statement accounting for the disruptions encountered. Nor did they notify customers upon full resumption of services. During this period, however, they did communicate an increase in M-PESA transaction costs caused by the enactment of Kenya’s Finance Act, 2023.⁴⁹ Not only might this selective communication have dented the company’s image, but it also provides grounds for speculation and distrust in the company and the critical service it operates, as there has been no transparency to the public who were adversely affected. It also risks setting a precedent for other service providers to ignore disclosing cyber incidents to their customers, which could undermine trust in digital service provision and in cyberspace writ large. The platform has since suffered other downtimes without any official communication acknowledging them, yet social media is awash with complaints. It is also noteworthy that neither the financial nor the telecommunications sector regulators, nor the information or finance ministries, have so far addressed the M-PESA outages.

Given how integral the digital environment is to Kenyan citizens’ daily lives and work, information-sharing with the public should also be proactive; by many accounts, markers of an ongoing cyber attack had been flagged by information security practitioners. Robust information exchange platforms and official communication of cyber incidents still being monitored could have boosted the public’s confidence and helped citizens know what measures to take. Instead, the information exchange regarding July’s events has fostered speculation as to who was conducting the attacks and impressions of government incompetence.

It should be clear that how the Kenyan government interfaces with the public on cyber incidents needs to be improved. Furthermore, digital financial sector–specific entities such as the Kenya Bankers Association (KBA) must contemplate how to address customers proactively even in the face of ongoing cyber attacks.⁵⁰ That their members’ bank-to-M-PESA services were affected across multiple banks without any clear communication, even merely acknowledging service disruptions, risks fostering the impression that the services and service providers are unreliable and untrustworthy. KBA ought to update its consumer information offerings to include matters pertaining to cybersecurity.

Implementing, revising, monitoring, and evaluating cybersecurity-related policies, frameworks, and regulations

The July 30 statement by the MIC&DE pointed out that the objective of this cooperation was “to enable effective cybersecurity measures that protect both the public and private sectors, while also ensuring compliance with legal frameworks. This will include the development and implementation of a comprehensive cybersecurity framework that covers both public and private sector entities. . . [and is] regularly updated to adapt to emerging threats.”⁵¹ Kenya’s National Cybersecurity Strategy (2022–2027) already offers a viable framework for bolstering a secure and resilient cyberspace to maximize on the benefits of a digital economy. It further outlines an implementation framework and timeline.⁵²

A multistakeholder review of what has been accomplished would be advisable to evaluate the progress that has been made on cybersecurity governance; cybersecurity policies, laws, regulations, and standards; critical information infrastructure protection; capability and capacity-building; cyber risks and cyber crimes management; and cooperation and collaboration.

Additionally, Kenya has comprehensive cyber crime legislation in the Computer Misuse and Cybercrime Act (CMCA), 2018. A task force of the National Computer and Cybercrimes Coordination Committee (NC4) is reportedly in the final stages of formulating draft regulations to operationalize the CMCA “to address gaps in the changing cyberspace.”⁵³ Coming on the heels of widespread cyber attacks, the regulations’ public participation process will present an opportunity for the government, through the NC4, to facilitate vibrant multistakeholder engagement on how the country’s cybersecurity policies, frameworks, and regulations can be better realized.

The country’s 2022–2027 National Cybersecurity Strategy emphasizes the government’s commitment to working with stakeholders at national and international levels as is necessitated by the cross-cutting and transactional nature of cyber threats. As it develops cooperation and collaboration frameworks and seeks to establish a trusted information-sharing mechanism for knowledge exchange and incident reports, Kenya has the potential to champion continental coordination on cybersecurity and data protection as enshrined in the African Union Convention on Cybersecurity and Personal Data Protection, which recently entered into force.⁵⁴ Kenya has yet to ratify the convention despite repeated commitments to do so. Working with continental partners through the modalities of the convention could also help Kenya and the other African Union member states develop and jointly promote African positions in international cybersecurity forums. Given capacity constraints in most African governments, developing sound cooperation and collaboration mechanisms could advance what Ruto, has been championing: for African countries to better leverage the African Union in representing its member states, particularly in engagements with external partners.⁵⁵ The cyber domain is one area ripe for such an intervention, as Africa lags in cyber diplomacy engagements.⁵⁶

Auditing cybersecurity skills and resource needs in the public sector

Cybersecurity is undoubtedly gaining momentum as a priority in digital development, with critical sectors such as finance facing systemic risks. In countries such as Kenya, the digitalization of the financial sector, coupled with the innovations that mobile telephony has brought forth to drive digital financial inclusion, has been celebrated widely. However, the attendant cyber threats and vulnerabilities have also proliferated, given the telecommunications and banking sectors’ parallel digitalization trajectories. The term “cyber capacity-building” tends to punctuate many calls for resourcing developing countries’ digital transformation. And as Carnegie’s FinCyber Strategy Project,⁵⁷ which put forth actionable policy proposals to protect financial systems against cyber threats, noted in its report, cybersecurity capacity-building has become a growing priority—yet the term capacity building is “amorphous . . . and requires clarification before we can progress from concept to action.”⁵⁸

 In the July 30 statement, the MIC&DE stated that “the private sector will assist Government in closing the cybersecurity skills gap by providing training and expertise to government agencies . . . [including] provision of critical expertise to aide [sic] in the cyber incidents response and recovery processes.” In its quest to seek private sector assistance to address its cybersecurity capacity, the Kenyan government has the National Cybersecurity Strategy’s implementation framework as a viable starting point.⁵⁹ It clearly outlines objectives and interventions for strengthening cybersecurity capability and capacity that include promoting in-country cybersecurity research and development, establishing a cybersecurity “Centre of Excellence,” and developing more local cybersecurity specialized experts. To achieve these goals, the government—through a body like the ICT Authority, which is tasked with rationalizing and streamlining how government ICT functions are managed⁶⁰—must undertake an audit of cybersecurity skills within government agencies that could start with those responsible for public-facing digital services such as eCitizen. Such a skills assessment could build upon a recent mapping of Kenya’s cybersecurity capacity-building needs conducted by the Kenya ICT Action Network following an in-country, multistakeholder consultative process.⁶¹

The National Cybersecurity Strategy also proposes that the government establish a cybersecurity professional certification/accreditation and career progression framework. While probably viable for the public sector, this tactic may face opposition from the private sector, civil society, the technical community, and academia. Previous attempts at regulating ICT practitioners in the country have faced pushback,⁶² as they risk creating bureaucratic processes that stifle innovation and raise barriers for professional development in an otherwise dynamic industry where even self-taught, non–academically trained practitioners can attain and have attained the requisite professional capacity.⁶³ The government, through such a roundtable, ought to engage industry associations and other relevant stakeholder groups to arrive at more appropriate and agile ways of achieving the cybersecurity capacity objective.

Relying on the private sector to provide critical expertise may assist the government in plugging cybersecurity skills gaps; however, overly relying on the private sector, be it for free services or for seconded personnel can create dependencies that undermine sustainable cyber capability. The government should establish mechanisms of resourcing for its cybersecurity skills needs, with private and development sector support supplementing this increasingly core need for the digital government Kenya prides itself on having. Arguably, ultimate success in cyber capacity-building—whether facilitated in collaboration with the private and development sectors or by the government on its own—is not only in a flurry of training initiatives or benchmarking exercises, but also in entrenching adequate and sustainable resourcing (personnel and monetary) of institutions such as the KE-CIRT/CC to deliver on their missions. In addition, critical evaluation of training programs—such as on whether they embed interdisciplinary approaches to cybersecurity—is a measure worth considering in cyber capacity-building for the nation’s cyber defense posture.⁶⁴

Conclusion

Kenya’s digital superhighway plans are laudable, but they are not without challenges and near-term risks. The July cyber attacks aside, the digitalization plans the government is pursuing come at a time when ordinary Kenyans are increasingly exposed to online threats, with confidentiality and privacy breaches topping the lists of complaints registered by the Communications Authority of Kenya.⁶⁵ Cybersecurity and resilience must thus factor into the ambitious rollout of digitalization initiatives in the public sector. The government would do well to leverage the proposed roundtable and other multistakeholder avenues to take stock of cybersecurity measures in place for its own systems, as well as those affecting critical sectors like finance, energy, and transportation; also, and just as importantly, strategies must account for how cyber threats affect individuals and smaller businesses.⁶⁶ The vast array of policies, regulations, strategies, and frameworks offers a viable starting point; measuring progress on implementing all these tools is an appropriate way to effectively identify insights on improvements and iterations to be made.

Trust in and reliability of the country’s digital financial infrastructure is also at stake. M-PESA’s critical role in facilitating payments in the country is just as significant during downtimes. That the company has not been communicative during outages, despite causing inconvenience, has drawn public ire. It also does not bode well for the government’s push for all payments for government services to be directed through one mobile money payment platform—a directive that is now being challenged in court as being unilateral, arbitrary, and not grounded in any framework subject to public participation.⁶⁷ Because of the popularity of mobile money, not only are banking systems affected when M-PESA services are down, but the country’s whole financial system is also jeopardized. This poses a systemic risk, as M-PESA’s success and ubiquity also risks a single point of failure for the country’s financial system; the service commands 96.5 percent of the mobile money market share in Kenya.⁶⁸ However, the Kenya Bankers Association has its own interbank, real-time settlement system, which it could better promote as an alternative to the bank/mobile money wallet system.⁶⁹ Responsiveness to feedback (in both the public and private sector), acknowledging receipt of complaints, and periodic reports on cyber threat trends and mitigation measures will be helpful steps toward fostering trust in the ability of public and private sector digital service providers to act on cyber incidents reported, thus creating a virtuous circle of cyber incident reporting, public awareness, and education.

The July cyber attacks can be viewed as a litmus test for Kenya. The country’s cybersecurity-related policies, legislations, proposed regulations, frameworks, and strategies read well in theory, but must pass muster in practice in an ever-shifting cyber threat landscape, and with increased digitalization of critical public and private sector services. To ensure the country’s cyber resilience, the government’s drive for digitalization must embrace a continuous multistakeholder engagement stance, while correcting for shortcomings and emerging systemic risks as exposed by the cyber attacks the country has been subjected to—and will likely continue to face in the future.

Notes

¹ “Kenya Economic Update: Accelerating Kenya’s Digital Economy,” World Bank, October 2019, https://www.worldbank.org/en/country/kenya/publication/kenya-economic-update-accelerating-kenyas-digital-economy.

² “National Information, Communications, and Technology (ICT) Policy,” Kenyan Ministry of Information, Communications, and Technology, November 2019, https://www.ict.go.ke/wp-content/uploads/2019/12/NATIONAL-ICT-POLICY-2019.pdf.

³ “Digital Economy Blueprint: Powering Kenya's Transformation,” Kenyan Ministry of Information, Communications, and Technology, 2019, https://www.ict.go.ke/wp-content/uploads/2019/05/Kenya-Digital-Economy-2019.pdf.

⁴ “National Broadband Strategy 2018-2023,” Kenyan Ministry of Information, Communications, and Technology, 2019, https://www.ict.go.ke/wp-content/uploads/2019/05/National-Broadband-Strategy-2023-FINAL.pdf.

⁵ “Mobile Subscriptions Hit 66m As at March 2023,” Communications Authority of Kenya, March 28, 2023, https://www.ca.go.ke/mobile-subscriptions-hit-66m-march-2023.

⁶ “Celebrating 10 Years of Changing Lives,” Safaricom, accessed September 7, 2023, https://www.safaricom.co.ke/mpesa_timeline/.

⁷ Bella Genga and David Herbling, “Users Say Safaricom’s $633 Million/Day Payments Platform Offline,” Bloomberg, July 27, 2023, https://www.bloomberg.com/news/articles/2023-07-27/users-say-safaricom-s-633-million-day-payments-platform-offline.

⁸ “M-Pesa Celebrates Reaching 50 Million Customers,” Vodafone, September 7, 2021, https://www.vodafone.com/news/services/m-pesa-celebrates-reaching-50-million-customers.

⁹ Njuguna N’dungu, “Evolution of M-Pesa From a Person-to-Person Platform to a Sophisticated Fintech,” East African, June 30, 2021, https://www.theeastafrican.co.ke/tea/oped/comment/evolution-of-m-pesa-to-sophisticated-fintech-3455574.

¹⁰ “VodaPay’s Official Rollout Signals ‘Telco-To-Techco’ Lunge for African Fintech,” WeeTracker, October 11, 2021, https://weetracker.com/2021/10/11/african-telcos-launch-fintech/.

¹¹ “M-Pesa – Africa’s Leading Fintech Platform – Marks 15 Years of Transforming Lives,” Vodafone, March 7, 2022, https://www.vodafone.com/news/inclusion/mpesa-marks-15-years.

¹² “Government Has Prioritised Digital Super Highway, Says President Ruto,” Office of the President of the Republic of Kenya, August 15, 2023, https://www.president.go.ke/government-has-prioritised-digital-super-highway-says-president-ruto/.

¹³ “Digital Superhighway & Creative Economy,” Ministry of Investments, Trade and Industry, accessed September 21, 2023, https://www.investmentpromotion.go.ke/digital-superhighway-creative-economy.

¹⁴ Moses Nyamori, “State to Establish 1,450 Village Digital Hubs, 25,000 WiFi Hotspots Nationwide,” Nation, February 11, 2023, https://nation.africa/kenya/news/state-to-establish-1-450-village-digital-hubs-25-000-wifi-hotspots-nationwide-4120356.

¹⁵ Brian Oruta, “Ruto: Kenya to Produce Africa’s Cheapest Smartphones in a Year,” Star, November 10, 2022, https://www.the-star.co.ke/news/2022-11-10-ruto-kenya-to-produce-africas-cheapest-smartphones-in-a-year/.

¹⁶ “Gov’t To Roll Out Unique Personal Identifiers in September,” Citizen Digital, May 23, 2023, https://www.citizen.digital/news/govt-to-roll-out-unique-personal-identifiers-in-september-n320243.

¹⁷ Chris Burt, “Kenya Signs Digital ID Support Deal With UNDP, Introduces a New Namba,” Biometric Update, August 14, 2023, https://www.biometricupdate.com/202308/kenya-signs-digital-id-support-deal-with-undp-introduces-a-new-namba; and Perpetua Etyang, “State Postpones Launch of Maisha Namba, Digital ID Ecosystem,” Star, September 29, 2023, https://www.the-star.co.ke/news/2023-09-29-state-postpones-launch-of-maisha-namba-digital-id-ecosystem/.

¹⁸ Kenyan Ministry of Information, Communications, and Technology, “National Information, Communications, and Technology (ICT) Policy.”

¹⁹ Kenyan Ministry of Information, Communications, and Technology, “Digital Economy Blueprint.”

²⁰ “The Computer Misuse and Cybercrimes Act 2018,” Kenyan National Computer and Cybercrimes Coordination Committee,” accessed September 7, 2023, https://nc4.go.ke/the-computer-misuse-and-cybercrimes-act/.

²¹ “The Data Protection Act, 2019,” Office of the Data Protection Commissioner of Kenya, accessed September 7, 2023, https://www.odpc.go.ke/dpa-act/.

²² “National Cybersecurity Strategy 2022 – 2027,” Kenyan National Computer and Cybercrimes Coordination Committee, accessed September 7, 2023, https://nc4.go.ke/national-cybersecurity-strategy-2022-2027/.

²³ Kabui Mwangi and Dominic Omondi, “Hackers Shake Kenya’s Digital Financial System,” Business Daily, July 28, 2023, https://www.businessdailyafrica.com/bd/corporate/technology/hackers-shake-kenya-s-digital-financial-system--4318466.

²⁴ Benjamin Muriuki, “NYS, JSC Among 18 Kenyan Gov’t Websites Hacked by Indonesian Group,” Citizen Digital, June 3, 2019, https://www.citizen.digital/news/nys-jsc-among-government-websites-hacked-by-indonesian-group-256068.

²⁵ “Kenyan Official Dismisses Reuters Report on Chinese Hack as ‘Propaganda,’” Reuters, May 25, 2023, https://www.reuters.com/world/kenyan-official-dismisses-reuters-report-chinese-hack-propaganda-2023-05-25/.

²⁶ Steve Biko Wafula, “Kenyan Financial Institutions Lost Over Ksh 5.6 Billion To Cybercrime, Calling For The Need For Enhanced Cybersecurity In The Country’s Banking Sector,” Soko Directory, March 24, 2023, https://sokodirectory.com/2023/03/kenyan-financial-institutions-lost-over-ksh-5-6-billion-to-cybercrime-calling-for-the-need-for-enhanced-cybersecurity-in-the-countrys-banking-sector/.

²⁷ Sam Kiplagat, “Regulator, Safaricom Face Class Action Suit Over SIM-swap Fraud,” Business Daily, October 20, 2022, https://www.businessdailyafrica.com/bd/corporate/companies/regulator-safaricom-face-class-action-suit-over-sim-swap-fraud-3991214.

²⁸ “About Us,” eCitizen, accessed September 21, 2023, https://ag.ecitizen.go.ke/index.php?id=4.

²⁹ Sharon Mwende, “E-Citizen Portal Gazetted as Government’s Official Digital Payment Platform,” Star, December 31, 2022, https://www.the-star.co.ke/news/2022-12-31-e-citizen-portal-gazetted-as-governments-official-digital-payment-platform/.

³⁰ Matthew Ndungu, “Quality Concerns as Hackers Infiltrate Kebs Systems,” People Daily, July 14, 2023, https://www.pd.co.ke/news/quality-concerns-as-hackers-infiltrate-kebs-systems-190779/.

³¹ The Kenya Power & Lighting Company Plc (@KenyaPower), “CUSTOMER ALERT [red circle emoji],” Twitter, July 27, 2023, 3.15 p.m., https://twitter.com/kenyapower/status/1684538091401363457?s=61&t=0WYt45GEGH2r0cnyC-0dnA.

³² Kenya Railways (@KenyaRailways_), “Public Notice,” Twitter, July 27, 2023, 5.21 p.m., https://twitter.com/kenyarailways_/status/1684569741602721802?s=61&t=0WYt45GEGH2r0cnyC-0dnA.

³³ Abraham Augustine, “Anonymous Sudan: The Group Behind Recent Anti-Kenya Cyberattacks,” TechCabal, July 27, 2023, https://techcabal.com/2023/07/27/pro-sudan-hackers-attack-digital-services-in-kenya/.

³⁴ Peter Mwai and Anita Nkonge, “Kenya Cyber-Attack: Why Is eCitizen Down?,” BBC News, July 28, 2023, https://www.bbc.com/news/world-africa-66337573.

³⁵ John Kamau, “President Ruto’s Rejection in Sudan: Is Kenya Losing Its Diplomatic Power?” Nation, June 28, 2023, https://nation.africa/kenya/weekly-review/president-ruto-s-rejection-in-sudan-is-kenya-losing-its-diplomatic-power--4285560.

³⁶ “Kenya Dismisses Sudan Gov’t Rejection of Ruto as Head of IGAD Mediation Team,” Citizen Digital, June 16, 2023, https://www.citizen.digital/news/kenya-dismisses-sudan-govts-rejection-of-ruto-as-head-of-igad-mediation-team-n321815.

³⁷ “Sudanese General Warns Kenya Against Sending Peacekeepers,” Reuters, July 24, 2023, https://www.reuters.com/world/africa/sudanese-general-warns-kenya-against-sending-peacekeepers-2023-07-24/.

³⁸ Ministry of Info, Comms & The Digital Economy KE (@MoICTKenya), “STATEMENT ON THE ATTACK ON THE E-CITIZEN PLATFORM The Government of Kenya would like to make the following statement regarding the e-Citizen Platform. @EluidOwalo @InteriorKE @StateHouseKenya,” Twitter, July 27, 2023, 4:09 p.m., https://twitter.com/MoICTKenya/status/1684551656850051073.

³⁹ Korir Sing’Oei (@SingoeiAKorir), “Information on outages on e-citizen platform and impact on e-visa applicants and travellers. @ImmigrationDept @ForeignOfficeKE,” Twitter, July 27, 2023, 2:49 p.m., https://twitter.com/SingoeiAKorir/status/1684531538233376768.

⁴⁰ Ministry of Info, Comms & The Digital Economy KE (@MoICTKenya), “PRESS RELEASE: MULTI-STAKEHOLDER ROUNDTABLE ON CYBERSECURITY,” Twitter, July 30, 2023, 6:35 a.m., https://twitter.com/MoICTKenya/status/1685494218284756992.

⁴¹ “Cyber Information Sharing: Building Collective Security,” World Economic Forum, October 2020, https://www3.weforum.org/docs/WEF_Cyber_Information_Sharing_2020.pdf.

⁴² “Shortage of Skilled Cybersecurity Experts Exposes ICT Sector to Huge Losses,” Computer Society of Kenya, accessed September 7, 2023, https://www.cskonline.org/about-us/kenya-ict-press/1153-shortage-of-skilled-cybersecurity-experts-exposes-ict-sector-to-huge-losses.

⁴³ “The National KE-CIRT/CC,” Communications Authority of Kenya, accessed September 7, 2023, https://ke-cirt.go.ke/.

⁴⁴ Joshua Kitili and Doreen Abiero, “Kenya’s Digital Infrastructure Under Threat? A Look at Anonymous Sudan’s Thwarted Cyberattack Attempt and its Implications for Kenya’s Digital Systems,” Strathmore University Centre for Intellectual Property and Information Technology Law, August 22, 2023, https://cipit.strathmore.edu/kenyas-digital-infrastructure-under-threat-a-look-at-anonymous-sudans-thwarted-cyberattack-attempt-and-its-implications-for-kenyas-digital-systems/.

⁴⁵ Muktar Oladunmade, “NITDA Confirms Anonymous Sudan Hacker Attack on Nigeria,” TechCabal, August 3, 2023, https://techcabal.com/2023/08/03/anonymous-sudan-nigeria/.

⁴⁶ NITDA Nigeria (@NITDANigeria), “PRESS RELEASE The National Information Technology Development Agency (NITDA), through its Computer Emergency Readiness and Response Team has detected activities of a hacktivist group targeting our vital digital infrastructure. Read on for more details [backhand index pointing down emoji]” Twitter, August 2, 2023, 7:14 p.m., https://twitter.com/NITDANigeria/status/1686772565367291904.

⁴⁷ “ALERT: NITDA Raises Alarm Over Hackers Targeting Government Digital Infrastructure, Cable, August 3, 2023, https://www.thecable.ng/alert-nitda-raises-alarm-over-hackers-targeting-government-digital-infrastructure; and “[Threat Alert] Planned Attacks on Nigeria’s Critical Information Infrastructures by ‘Anonymous Sudan’ Hacking Group,” Nigeria Computer Emergency Response Team, August 2, 2023, https://cert.gov.ng/advisories/threat-alert-planned-attacks-on-nations-critical-information-infrastructures-by-anonymous-sudan-hacking-group-against-nigeria.

⁴⁸ ngCERT (@ngCERTofficial), “[CYBER THREAT UPDATE] Planned attacks on Nigeria's Critical Information Infrastructures #Cybersecurity #threats #Nigeria,” Twitter, August 5, 2023, 9:25 p.m., https://twitter.com/ngCERTofficial/status/1687892578656534529.

⁴⁹ “Finance Act 2023: Safaricom Increases M-Pesa Charges, Cuts Call, SMS Rates,” Nation, July 29, 2023, https://nation.africa/kenya/business/finance-act-2023-safaricom-increase-m-pesa-charges-4319740.

⁵⁰ “Welcome to Kenya Bankers Association,” Kenya Bankers Association, accessed September 7, 2023, https://www.kba.co.ke/.

⁵¹ Ministry of Info, Comms & The Digital Economy KE (@MoICTKenya), “PRESS RELEASE: MULTI-STAKEHOLDER ROUNDTABLE ON CYBERSECURITY,” Twitter, July 30, 2023, 6:35 a.m., https://twitter.com/MoICTKenya/status/1685494218284756992.

⁵² Kenyan National Computer and Cybercrimes Coordination Committee, “National Cybersecurity Strategy 2022 – 2027.”

⁵³ Roselyne Kavoo, “Drafting of Cybercrime and Computer Misuse Regulations Nears Conclusion,” Kenya News Agency, August 4, 2023, https://www.kenyanews.go.ke/drafting-of-cybercrime-and-computer-misuse-regulations-nears-conclusion; and ElvyLewis Ndungu, “Government to Amend the Cybercrimes Act of 2018,” Techweez, August 3, 2023, https://techweez.com/2023/08/03/government-amend-cybercrimes-act-2018/.

⁵⁴ “Continental Cyber Security Policymaking: Implications of the Entry Into Force of the Malabo Convention for Digital Financial Systems in Africa,” Carnegie Endowment for International Peace, July 10, 2023, https://carnegieendowment.org/2023/07/10/continental-cyber-security-policymaking-implications-of-entry-into-force-of-malabo-convention-for-digital-financial-systems-in-africa-event-8146.

⁵⁵ “Remarks by His Excellency President William Samoei Ruto, CGH, PhD, At the Official Opening of the Pan African Parliament,” Office of the President of the Republic of Kenya, May 17, 2023, https://www.president.go.ke/wp-content/uploads/AT-THE-OFFICIAL-OPENING-OF-THE-PAN-AFRICAN-PARLIAMENT.pdf.

⁵⁶ Karen Allen, “Africa Must Get Up to Speed on Cyber Diplomacy,” ISS Africa, January 3, 2022, https://issafrica.org/iss-today/africa-must-get-up-to-speed-on-cyber-diplomacy.

⁵⁷ “Cybersecurity and the Financial System,” Carnegie Endowment for International Peace, accessed September 7, 2023, https://carnegieendowment.org/specialprojects/fincyber/.

⁵⁸ Tim Maurer and Arthur Nelson, “International Strategy to Better Protect the Financial System Against Cyber Threats,” Carnegie Endowment for International Peace, November 18, 2020, https://carnegieendowment.org/2020/11/18/international-strategy-to-better-protect-financial-system-against-cyber-threats-pub-83105.

⁵⁹ Kenyan National Computer and Cybercrimes Coordination Committee, “National Cybersecurity Strategy 2022 – 2027.”

⁶⁰ “Who We Are,” Information, Communications, and Technology Authority of Kenya, accessed September 7, 2023, https://www.icta.go.ke/page?q=6&type=about_ict_authority.

⁶¹ David Indeje, “Policy Brief: Kenya’s Cybersecurity Capacity Building Needs Outlined,” KICTANet, August 2, 2023, https://www.kictanet.or.ke/policy-brief-kenyas-cybersecurity-capacity-building-needs-outlined/.

⁶² Kenn Abuya, “Parliament Has Passed the Controversial ICT Practitioners Bill,” Techweez, June 9, 2022, https://techweez.com/2022/06/09/parliament-has-passed-the-controversial-ict-practitioners-bill/.

⁶³ Kenn Abuya, “President Kenyatta Rejects Highly Disputed ICT Practitioners Bill,” Techweez, June 21, 2022, https://techweez.com/2022/06/21/ict-practitioners-bill-rejected/.

⁶⁴ Nanjira Sambuli and Aditi Bawa, “Cyber Capacity Building for Secure Digital Financial Inclusion: A Critical Analysis of Prevailing Approaches,” Carnegie Endowment for International Peace, June 26, 2023, https://carnegieendowment.org/2023/06/26/cyber-capacity-building-for-secure-digital-financial-inclusion-critical-analysis-of-prevailing-approaches-pub-90027.

⁶⁵ Allan Odhiambo, “Privacy Breaches Overtake Phone Service Complaints to CA,” Nation, August 7, 2023, https://nation.africa/kenya/business/privacy-breaches-overtake-phone-service-complaints-to-ca-4328288.

⁶⁶ Aubra Anthony, “Cyber Resilience Must Focus on Marginalized Individuals, Not Just Institutions,” Carnegie Endowment for International Peace, March 13, 2023,https://carnegieendowment.org/2023/03/13/cyber-resilience-must-focus-on-marginalized-individuals-not-just-institutions-pub-89254.

⁶⁷ Richard Munguti, “Ruto’s Directive on Single Pay Point for All Govt Services Challenged,” Nation, August 22, 2023, https://nation.africa/kenya/news/ruto-s-directive-on-single-pay-point-for-all-govt-services-challenged-4342376.

⁶⁸ Kenn Abuya, “Once Again, M-PESA Has Cannibalised the Competition in Kenya,” TechCabal, June 26, 2023, https://techcabal.com/2023/06/26/kenya-mobile-money-rivals-are-no-match-for-m-pesa/ .

⁶⁹ “How to Use PesaLink,” Integrated Payment Services, accessed September 7, 2023, https://www.ipsl.co.ke/pesalink/how-to-use-pesalink.