From Screens to Courtrooms: How digital evidence is changing justice in Kenya

Digital evidence illustration/AI 

In a small Nairobi courtroom, the buzz of phone alerts and the glow of laptops contrast sharply with the traditional setting of Kenya’s justice system.

But increasingly, those very devices now play a starring role in courtroom battles.

From social-media posts to WhatsApp chat logs, digital evidence is rapidly becoming central to how justice is served in Kenya. The change is not merely technological. It is juridical.

The legal system in Kenya is adapting to an era in which phones, tablets, and network logs hold key evidence in criminal and civil proceedings. The shift brings fresh opportunity and fresh risk.

The legal foundation under the Evidence Act (Cap. 80), Section 78A, explicitly recognises electronic messages and digital material as admissible evidence.

The section holds that a court “shall not deny admissibility … only on the ground that it is not in its original form.”

In addition, Kenya’s courts have held that electronic evidence may still be admitted even when obtained without a warrant—so long as the circumstances justify the intrusion.

The well-known jurisprudence that followed the 2019 DusitD2 terror attack set the tone for this approach.

In September 2024, the High Court reaffirmed that principle, finding that digital material extracted without prior judicial authorisation was admissible in a terrorism-related case due to clear exigent circumstances.

“The court proceeds and directs that the electronic evidence obtained from the forensic examination of the respondents’ mobile phones shall be admissible in the ongoing trial before the Kahawa Chief Magistrate,” the judgment stated.

The ruling reflects a broader trend: in high-risk, fast-moving investigations, Kenyan courts may prioritise public safety and evidentiary value over strict procedural formalities—provided the State demonstrates a compelling justification.

A corresponding note of caution has accompanied this shift.

While digital tools have enhanced policing and investigations, courts have repeatedly warned that law enforcement must avoid infringing rights by collecting irrelevant or excessive personal information.

The expanding power to mine digital footprints, judges have stressed, must be exercised with restraint and clear justification.

In short, the law in Kenya has evolved to a point where courts accept digital evidence — but the test has shifted from can it be admitted to how reliably it was generated and maintained, and rights were respected in the process.

What counts as digital evidence?

Although Kenyan law does not provide a rigid list of what qualifies as digital evidence, it relies on broad, technology-neutral terms that allow courts to adapt to evolving tools and platforms.

Section 78A of the Evidence Act recognises “electronic messages” and “digital material” without specifying formats, while the Computer Misuse and Cybercrimes Act refers generally to computer data, traffic data, and content data.

This flexible approach ensures the law remains future-proof, enabling judges to admit a wide range of digital material when relevant and properly authenticated.

Consequently, Kenyan courts routinely consider evidence such as WhatsApp chats, SMS messages, phone call logs, screenshots, TikTok and Facebook videos, CCTV footage, emails, digital documents, cloud-stored files, M-Pesa statements, and website or server logs.

With no closed statutory list, admissibility is determined by evidentiary value, context, and reliability rather than the platform or medium.

For example, in notable cases such as the 2019 DusitD2 terror attack proceedings, forensic analysis of mobile phones and social media activity played a crucial role in establishing timelines and suspect movements.

Similarly, in the ongoing Rex Masai inquest, concerning a protester believed to have been shot dead by a police officer during the 2024 anti-Finance Bill protests, call-data records, CCTV footage, and digital images were tendered to help reconstruct the events leading to the incident.

These instances illustrate how Kenyan courts increasingly rely on electronic evidence to reconstruct events, corroborate witness testimony, and establish accountability.

The approach reflects a pragmatic recognition that in the digital age, critical information often exists first in electronic form, and the courts must be equipped to handle it responsibly and fairly.

And yet, the line between lawful investigation and privacy intrusion is not always clear.

Growth of social-media offences and prosecution

As social media has become deeply embedded in Kenyan life, it has also taken on an increasingly central role in legal proceedings.

Under the Computer Misuse and Cybercrimes Act, 2018 (recently amended by the 2024 Act) for instance, posting false information, impersonation, online harassment, and distributing harmful digital content are criminalised.

Media groups, civil society organisations, and litigants have challenged parts of the law, arguing that in some cases it is being used to stifle dissent.

Key contested provisions include Section 27(1)(b), particularly the phrase criminalising conduct “likely to cause another person to commit suicide,” as well as clauses penalising electronic communications deemed to “detrimentally affect another person” or content considered “indecent or grossly offensive in nature.”

As a result, prosecutors and investigators now routinely rely on digital evidence from social-media platforms, network logs, or phone records to build cases, while defence lawyers increasingly scrutinise the authenticity and lawfulness of such evidence.

Challenges: authenticity, admissibility, and integrity.

Just because evidence is digital does not guarantee it will survive a challenge in court.

As outlined in a 2022 case, the complainant sought to rely on a printout of WhatsApp postings, which constitute digital evidence. To create these printouts, screenshots of the messages were taken, sent via email, downloaded onto a computer or phone, and then printed.

“Thereafter, the screenshots would be downloaded onto the hard disk of a computer and/or phone and then printed using a printer connected to the computer. The said process makes the said printouts constitute electronic records,” the judgment stated.

However, the court rejected the messages as evidence because they were not accompanied by the required certificate under Section 106B of the Evidence Act, which verifies that electronic records are authentic.

Additionally, the court noted that it was unclear which device had been used to capture the messages and that the chain of custody—the record showing how the evidence was preserved and handled—was incomplete.

Without these safeguards, the court could not be satisfied of the messages’ integrity, and therefore, they were inadmissible.

This case illustrates that digital evidence must be properly certified, authenticated, and preserved to survive legal scrutiny.

Kenyan researchers emphasise that best practices, standards, and governance are critical to ensuring digital evidence is admissible in court.

Practically, this means lawyers and investigators must demonstrate how a device captured the data, how it was stored and preserved without alteration, how the sender or author’s identity is verified, how the chain of custody was maintained, and whether privacy rights were respected, including whether a warrant or court order was used where required.

Failure to meet these standards can result in evidence being challenged or excluded entirely.

Why it matters: Digital evidence now features in many of Kenya’s cases:

Financial crime investigations, social-media defamation cases, cyberbullying or impersonation charges, and state-security prosecutions.

For example, the statutory framework empowers prosecutors to direct telecom or internet-service providers to produce subscriber details for posts or messages linked to online harassment.

In civil litigation, matrimonial disputes, and commercial litigation increasingly rely on WhatsApp chats, email threads, and screenshots.

In criminal cases, phone call logs or SIM registration data may tie a suspect to a crime scene.

One judicial decision on digital evidence, in the Dusit case, is instructive: the court accepted electronic evidence obtained without a warrant because the case involved terrorism — a recognised exception.

The ruling underscores that context can matter as much as procedure.

Why it matters for justice in Kenya

The stakes are high. If digital evidence is undermined by procedural gaps, key cases may collapse or be challenged on technical grounds.

On the other hand, when courts reliably handle digital evidence, justice becomes more accessible: mobile-phone screens become as important as physical paper files.

Moreover, given the shift to online platforms and remote transactions, digital evidence is not optional — it is becoming core.

As Kenya expands its digital economy and online public discourse, the courts’ capacity to handle digital evidence is a direct measure of the justice system’s relevance.

For victims, this means a greater chance of having online abuse, impersonation, or cyber-fraud cases backed up by evidence that holds in court.

For accused persons, it means the need for defence teams to scrutinise how digital data was gathered, handled, and used.

What needs to happen

Legal experts and civil-society observers point to several reforms and priorities:

Strengthening digital forensics capacity, training more investigators and court staff in handling, preserving, and presenting digital evidence, and developing clearer guidelines on extraction, chain-of-custody, and admissibility for digital material.

They also urge measures to ensure transparency and safeguards when digital evidence involves access to private communications or metadata — to protect privacy rights and that defence and the accused persons are aware of how digital evidence is handled and can challenge it fairly.

They call for monitoring how social-media and online-speech laws interplay with digital-evidence rules to prevent chilling of legitimate expression.

A case in point: social-media posts and defamation

Consider a hypothetical but plausible scenario: a journalist tweets allegations about a public figure official.

The official sues for defamation.

On the complainant side, the tweet, the replies, retweets, and network logs become core evidence.

Defence may challenge whether the account was hacked, whether the tweet was authentic, whether the retweets reflect original authorship, and whether the timestamp was manipulated.

The court will likely look at how the tweets were captured, how they were stored, whether metadata is intact, and whether the author can be reliably identified.

In such cases, the technicalities matter as much as the content.

Final word

As Kenya’s justice system evolves, digital evidence is no longer optional — it is central.

Whether courts, prosecutors, and defence counsel adapt successfully will determine not just the fate of individual cases, but the credibility of justice in a digital age.

For journalists, the technicalities behind mobile-phone logs, social-media snapshots, email servers, and forensic reports are worth following.

They no longer belong solely in legal-tech journals. In Kenya’s courts today, they belong front and centre in stories about justice, accountability, and rights.