Why the Guidebook Was Developed
Cyber threat actors are increasingly targeting Kenya’s human rights defenders through account hacking, phishing, state surveillance, and device seizure. KICTANet and the Tatua Digital Resilience Centre developed The HRD’s Forensic Guidebook to help defenders identify attacks, preserve evidence, and report incidents within Kenya’s legal deadlines.
KICTANet CEO Dr Grace Githaiga noted that threats to defenders have evolved, with physical and digital risks now closely linked. She emphasized the need for immediate action ahead of Kenya’s 2027 general election, as past elections have often led to reduced civic space.
The Statistics Behind the Guidebook
Tatua based the guidebook on a Cybersecurity and Forensic Needs Assessment conducted from February to April 2026. The assessment surveyed 119 human rights defenders and social justice organisations, and included focus groups and expert interviews. Key findings include:
- 49.2% of respondents experienced between two and five digital security breaches in the past year.
- 46.2% reported account hacking, 44.5% reported phishing, 41% reported targeted state surveillance, and 31% reported device seizure.
- 51% of defenders had no access to legal counsel.
- 82% relied on WhatsApp to report incidents.
- 21% of organisations had a written incident management policy.
- All respondents said they depend on personal mobile devices for their work.
What the Guidebook Covers
The guidebook equips defenders with:
- A five-step process for classifying incidents within the first 30 minutes.
- Device checks for Android and iOS.
- Guidance on reading email headers.
- A chain-of-custody framework aligned with Section 106B of the Kenya Evidence Act.
- Reporting obligations under the Data Protection Act, which requires organisations to notify the Office of the Data Protection Commissioner within 72 hours.
- Reporting requirements under the Computer Misuse and Cybercrimes Act, which directs incidents to KE-CIRT and the DCI Cybercrime Unit.
- Incident response playbooks.
- A disability inclusion framework.
- A directory of support organisations, including Defenders Coalition, Access Now, Citizen Lab, and Amnesty Tech.
Part of a Larger Track Record
The guidebook builds on KICTANet’s ongoing work through Tatua, its digital resilience hub. Under the EU-funded KenSafeSpace project, KICTANet and four partners trained 133 human rights defenders in digital security, reached 18,000 people directly and 9.4 million through digital campaigns, and contributed to the removal of unconstitutional sections of the Computer Misuse and Cybercrimes Act. The project has since transitioned to HerSpace, which addresses technology-facilitated gender-based violence and trains law enforcement and judicial officials in handling digital evidence.
KICTANet CEO Dr.Grace Githaiga has also addressed this issue internationally, stating at the United Nations Global Mechanism on ICT Security in New York that cybersecurity for civil society is “a matter of human safety, fundamental rights and democratic survival.”
How to Access the Guidebook
- Access the guidebook at tatua.digital/hrd-guidebook/
- Help now (24-hour helpdesk): helpdesk.tatua.digital
