Bloggers, journalists, and digital rights activists have secured a major victory after the Court of Appeal in Nairobi struck down key sections of Kenya’s Computer Misuse and Cybercrimes Act, 2018, that criminalized the publication of false information online.

In a judgment delivered on Friday, a three-judge bench comprising Justices Asike-Makhandia Kiage, Aggrey Muchelule, and Weldon Korir partially allowed an appeal filed by the Bloggers Association of Kenya (BAKE), Article 19 Eastern Africa, and other petitioners who had challenged the constitutionality of several provisions of the law.

The court declared Section 22 (False Publications) and Section 23 (Publication of False Information) unconstitutional, ruling that the provisions were overly broad and posed a threat to freedom of expression guaranteed under the Constitution.

The sections had criminalized the intentional publication of false or misleading information online, including content that could cause panic, chaos or damage to a person’s reputation. Violations carried stiff penalties, including heavy fines and potential jail terms.

In their ruling, the judges warned that the provisions were drafted so widely that they could easily be abused to target ordinary internet users who unknowingly share inaccurate information.

The court described the sections as “unguided missiles” capable of capturing innocent individuals who may forward messages without knowledge that the information is false.

The bench also cautioned that criminalizing the publication of false information could create a chilling effect on public discourse, journalism, and online expression.

“What may appear false today could turn out to be true tomorrow,” the judges noted, pointing out that history has shown that ideas initially dismissed as false — such as scientific discoveries — later proved accurate.

The court further observed that Kenya already has alternative legal frameworks capable of addressing reputational harm and misinformation without resorting to criminal sanctions.

These include civil defamation laws and statutes such as the National Cohesion and Integration Act, which deal with hate speech and incitement.

Despite striking down the two controversial provisions, the Court of Appeal upheld several other parts of the Cybercrimes Act that had also been challenged by the petitioners.

The court affirmed the legality of the law’s investigative powers, including provisions allowing authorities to apply for search and seizure warrants, production orders for subscriber information from service providers, and real-time collection of traffic data for up to six months.

However, the judges emphasized that these powers are not absolute and must be exercised under strict judicial oversight.

According to the ruling, law enforcement agencies must obtain authorization from a court before accessing such data, placing judges in the role of “gatekeepers” responsible for preventing abuse of surveillance powers.

The court also dismissed arguments that the law lacked clarity regarding criminal intent, ruling that terms such as “knowingly,” “intentionally,” and “without authorization” sufficiently establish the requirement of a guilty mind (mens rea) in criminal prosecutions.

In addition, the judges upheld Section 24, which criminalizes child pornography, noting that the provision serves a legitimate objective of protecting children from exploitation.

They also maintained Section 28 on cybersquatting, which makes it an offence to register domain names using another person’s trademark or name in bad faith.

The judges stated that while the internet offers vast freedoms, it cannot operate as a “Wild West” where intellectual property and personal rights are ignored.

The ruling marks a significant development in Kenya’s digital rights landscape, particularly for bloggers, journalists, and online content creators who had long argued that the “false publication” provisions were vulnerable to misuse.

With the court striking down the sections, individuals can no longer face criminal prosecution under the Cybercrimes Act solely for publishing information later deemed false.