Questions are now being raised over the role of the Communications Authority of Kenya after reports that its cybersecurity arm, KE-CIRT, contacted hosting providers over articles published by activist and blogger Cyprian Nyakundi concerning Coca-Cola Coastal Bottlers.
The reported communication has raised concerns because the issue appears to go beyond cybersecurity and into the area of controlling published content.
According to the claims, pressure was placed on hosting companies to have articles taken down after they raised questions about the conduct of senior officials at Coca-Cola Coastal Bottlers.
The reports touched on allegations of nepotism, workplace intimidation, unfair treatment of employees and questions surrounding the work permit status of some senior executives.
Nyakundi has faced pressure to remove or take down the material, according to the claims surrounding the matter. The central question, however, is not simply whether a particular article should remain online. It is whether a government cybersecurity agency should be involved in pressuring infrastructure providers over journalism and commentary that does not appear, on the face of it, to involve hacking, malware or an attack on a computer system.
Kenya has established institutions for dealing with disputes involving published information. If an individual or company believes that a report is defamatory, there are legal avenues available to challenge it.
Privacy complaints can also be handled through the relevant regulatory mechanisms, while criminal matters are dealt with through the police, prosecutors and courts.
That makes the reported involvement of a cybersecurity unit particularly important. A cybersecurity body has a clear public responsibility to protect government systems, businesses and citizens from digital threats. Its role should not easily extend into deciding which published stories should remain available to the public.
The concern becomes greater when a hosting company receives communication from a state agency. Even where no direct order is issued, such communication can create pressure.
A hosting provider may decide that removing content is safer than challenging a government institution. The publisher is then left dealing with the consequences, even though the dispute may concern the accuracy or legality of the content rather than any genuine cyber threat.
In this case, the articles reportedly focused on matters involving a major company and its senior management. Questions about how employees are treated, how companies operate and whether senior executives meet legal requirements can be matters of legitimate public interest.
Such questions should normally be answered with facts, documents and clear explanations.
If the allegations published by Nyakundi are inaccurate, the affected individuals and company have several ways to respond. They can issue a detailed rebuttal, provide evidence to correct the record or pursue legal action where they believe the law has been broken.
Asking for the material to be removed through pressure on a hosting provider creates a different impression and leaves the public with more questions.
There is also a need for transparency over how such takedown requests are handled. Who receives a complaint? Who decides that KE-CIRT should become involved?
What legal provisions are relied upon? Who authorises communication with hosting companies?
Are records kept of every request? And does the person or organisation seeking removal have any connection to officials making the request?
These are reasonable questions that should be answered openly.
The matter also deserves attention because government powers can easily become broader once they are accepted as normal.
A mechanism initially used in one case can later be applied to other cases involving politicians, businesses, public officials or other influential individuals.
That is why clear boundaries are important.
The Communications Authority has an important role in Kenya’s digital environment, and cybersecurity is a serious national concern.
But protecting digital infrastructure is different from managing criticism or deciding whether uncomfortable journalism should disappear from the internet.
For Nyakundi and other publishers, the bigger issue is therefore not only the individual articles under dispute. It is whether journalists, bloggers and online publishers can investigate powerful institutions without facing pressure through government-linked infrastructure channels.
The claims surrounding the Coca-Cola Coastal Bottlers reports should be tested through evidence and the appropriate legal processes. If the reporting is wrong, those responsible should be held accountable through lawful procedures. If the reporting raises genuine concerns, those concerns deserve answers.
What should not happen is for questions about corporate conduct to be quietly transformed into a cybersecurity matter simply because someone wants the reporting removed.
The reported pressure on Nyakundi should therefore prompt a wider conversation about the limits of regulatory power in Kenya’s digital space.
Cybersecurity agencies should remain focused on cyber threats, while disputes over journalism should be handled through transparent and legally recognised channels.
Kenyans have a right to know how such takedown requests are made and who stands behind them. More importantly, they have a right to expect that public institutions will protect the digital space rather than become tools for making uncomfortable reporting disappear.
Add Comment