DCI Used Safaricom Data to Nail Tuju — Without a Court Order, Say Critics

The most explosive question to emerge from the dramatic arrest of former Cabinet Secretary Raphael Tuju on Monday was not whether he staged his own disappearance — it was how the Directorate of Criminal Investigations knew, to the precise minute, exactly where his mobile phone was when it went dark.

DCI Director Mohammed Amin stood before cameras at his headquarters and announced, without apparent hesitation, that forensic analysis had placed Tuju inside his Mwitu Drive residence in Karen at 18:18 hours on the evening of Saturday, March 21 — the very moment his phone was switched off.

The conclusion, Amin declared, was that no abduction had taken place and that the entire episode was a carefully orchestrated deception. Tuju was arrested hours later, forcefully bundled into a vehicle by officers outside Karen Police Station in scenes that left him requiring medical attention and triggered a furious political backlash.

Within minutes of Amin’s briefing being broadcast on Citizen TV, the question of how investigators had obtained that pinpoint location data without any public mention of a court order swept across social media like a brushfire.

‘DCI-SAFARICOM AXIS OF EVIL’

On X, Kenyans did not mince their words. One post that ricocheted across timelines read: “DCI chief confirming that Safaricom gave them all access to track, trace, dox and geolocate Tuju’s phone number, including the exact time it was switched off. DCI didn’t get a court order. DCI-Safaricom axis of evil.” Another, attracting thousands of reposts, said: “What the DCI is conveying is that Safaricom, without authorisation from Tuju, provided Tuju’s private information to the DCI to track his whereabouts. Safaricom is a government entity that is putting vulnerable Kenyan citizens at risk.”

Screenshot

Screenshot

Screenshot

Legal observers pointed out that even time-stamped location triangulation obtained within hours of a missing person report being filed would, under Kenya’s Data Protection Act and Article 31 of the Constitution, ordinarily require a court order before a telecommunications company could disclose it to law enforcement. No such order was mentioned by Amin. Neither Safaricom nor Tuju’s lawyers had issued any statement on the data-access question by Monday evening.

Safaricom, which has faced identical accusations repeatedly, has consistently maintained in public statements that it only releases subscriber data when required by a valid court order.

That position has become increasingly difficult to sustain in the courts, however, following a parade of cases in which the company’s own employees have said otherwise under oath.

THE MOKAYA PRECEDENT

The Tuju furore arrives at the worst possible moment for Safaricom from a legal standpoint. In February 2026, Moi University student David Ooga Mokaya was acquitted by Magistrate Caroline Nyaguthi after the court found that investigators had mishandled digital evidence and failed to establish a clear link between him and a disputed social media post.

The bombshell came from a Safaricom employee, Daniel Hamisi, who told the court that a senior DCI officer, Michael K. Sang, had written a simple letter requesting Mokaya’s subscriber details, call records and location data in November 2024 — and that Safaricom handed it all over.

No court order existed. When defence lawyer Ian Mutiso asked the DCI officer directly whether he was aware that subscriber details could only be released with a court order, the officer admitted he did not know.

Mokaya is now suing Safaricom for Sh200 million in damages. The High Court has issued orders restraining the telco from sharing his data further without judicial authorisation, with the matter set for mention on March 30.

Legal practitioners have warned that a judgment in Mokaya’s favour would crystallise a cause of action replicable by tens of thousands of Kenyans who believe their data was handed to the DCI without authority.

The Law Society of Kenya moved last week to escalate matters still further, filing a landmark constitutional petition in the Milimani Constitutional and Human Rights Division.

The LSK alleges a systemic conspiracy between Safaricom and state security agencies to illegally surveil, track, and prosecute Kenyan citizens.

Screenshot

The petition, which names the Inspector General of Police, the DCI, the DPP, the National Forensic Lab and Kenya Power alongside Safaricom, seeks a court-supervised audit of all data requests made by the DCI to Safaricom from June 2024 to December 2025, a formal public apology from both institutions, and the establishment of a Victims Compensation Fund.

It also calls for the expungement of charges and destruction of digital evidence against any protester arrested on the basis of illegally obtained data.

The LSK’s petition draws a direct line from the Mokaya case to the 2024 Gen-Z protests, during which human rights organisations alleged that Safaricom provided real-time location data and call detail records to security agencies used in tracking demonstrators.

The Kenya Human Rights Commission and Muslims for Human Rights had previously alleged that Safaricom had given security agents virtually unfettered access to customer data for years, a practice they linked directly to enforced disappearances and extrajudicial killings.

A MAN UNDER SIEGE

The Safaricom controversy threatened to overshadow a week of extraordinary drama that had already seen Tuju evicted from his own property by armed officers, arrested in the dead of night, filmed weeping at his gate at 3am, and now bundled into a police vehicle while reportedly crying out in pain.

The background is a debt dispute of operatic proportions.

In April 2015, Tuju’s company Dari Limited borrowed USD 9.1 million from the East African Development Bank to fund property development in Karen.

The loan went into default the following year. EADB obtained a judgment from the High Court of Justice in England in June 2019 for USD 15.1 million, covering principal, accumulated interest and penalties.

The Kenyan High Court recognised that judgment in February 2020, the Court of Appeal upheld it in April 2023, and the Supreme Court has declined to intervene. On October 1, 2024, Dari Business Park and Tamarind Karen were auctioned.

The buyer was Ultra Eureka Limited, a company controlled by Jackson Kiplimo Chebett — the chairman of petroleum trader Stabex International — which paid Sh450 million at the public auction for the 6.8-acre Karen estate that Tuju has valued at Sh3.5 billion.

Tuju has spent the weeks since the auction fighting on every legal front available. He wrote to Chief Justice Martha Koome complaining about judicial conduct.

He appealed to the Court of Appeal. On March 9, Justice J.W.W. Mong’are struck out his amended plaint on grounds of res judicata and lifted all remaining interim orders that had blocked the auction, clearing the way for Ultra Eureka to enforce ownership.

On March 14, over a hundred people arrived in the early hours at Dari Business Park, some on motorbikes, and evicted everyone from the premises. Tuju broadcast the scene live from outside his own gate, accusing the officers accompanying them of covering their faces and carrying no visible court orders.

It was against that backdrop — armed eviction, judicial defeat, a pending Court of Appeal hearing, and claims of sustained surveillance — that Tuju reported to Karen Police Station on Saturday, March 21, that he had been followed on the previous day by a white Toyota Land Cruiser 70 Series bearing no number plates.

The report was booked under OB 21/21/03/2026. That evening, he failed to appear for a scheduled interview on Ramogi FM. His aide, Steve Mwanga, also went missing.

By Sunday morning, Mano Tuju was receiving a call from the OCS at Karen Police Station while in church, telling him his father’s car had been found abandoned on Miotoni Lane with hazard lights on.

‘I KNEW I WAS BEING FOLLOWED’

Tuju resurfaced on Monday morning at his Karen home and gave journalists a meticulous account of his movements. Near Karen Roundabout on Saturday evening, he said, an unmarked vehicle had closed in on him.

He made a sudden turn onto Nandi Road, banking on the fact that the pursuer would be unable to follow without mounting a dangerous U-turn against oncoming traffic.

He then abandoned his vehicle on Miotoni Lane and spent the night with a family near the Nairobi-Kiambu border. “I want to thank a family in Kiambu who gave me shelter,” he told reporters.

“They did not care about my tribe; they simply saw me as a human being.” He said he could not seek refuge at a police station because he feared his pursuers were security officers.

The DCI’s response was swift and unequivocal. Amin said investigators had deployed experienced plainclothes detectives, sought and obtained a search warrant after the family denied access to Tuju’s residence, and used forensic analysis to establish conclusively that Tuju had never left his Karen home during the period in question.

“When confronted with the reality that police were closing in on the truth, Tuju chose to resurface,” Amin said, “thereby confirming the investigators’ earlier well-founded suspicion that this was a carefully staged disappearance.”

Opposition leaders who had gathered at Tuju’s Karen home were not persuaded. Wiper Patriotic Front leader Kalonzo Musyoka told reporters: “I have absolutely no reason to doubt Tuju’s word, and the opposition side will remain firm in fighting abductions in the country.”

Former Attorney General Justin Muturi, DAP-K leader Eugene Wamalwa and constitutional scholar PLO Lumumba were also present. When officers moved in and bundled Tuju into a Subaru, those gathered attempted to resist.

Lawyer Ndegwa Njiru told journalists that the former CS had been forced into the vehicle so violently that a pre-existing back injury was aggravated.

“As we speak, Honourable Tuju is not well. We have invited doctors to come and advise us,” Njiru said, adding that an ambulance had been called as a precaution. The lawyers said no formal reason for the arrest had been communicated to them and that officers had attempted to move Tuju before a single entry was made in the Occurrence Book.

The DCI boss’s confidence about the timeline of Tuju’s movements — detailed to the minute — raises questions that go well beyond one man’s disputed weekend.

Kenya’s Data Protection Act of 2019 requires that personal data, including location information and call detail records held by telecommunications companies, may only be disclosed to third parties on the basis of a lawful justification.

A court order or equivalent judicial authorisation is the recognised standard for disclosure to law enforcement. The Constitution’s Article 31 guarantees every person the right not to have the privacy of their communications infringed.

If the DCI obtained real-time triangulation data from Safaricom on the basis of nothing more than an investigative request — the same mechanism exposed in the Mokaya case — then the legal exposure facing the country’s dominant telco has just widened dramatically.

Safaricom on Monday was in the middle of rolling out a data privacy initiative that would partially mask phone numbers in M-Pesa peer-to-peer transactions beginning March 24 in what the company described as a commitment to data minimisation.

The announcement, coming against the backdrop of the Tuju furore, struck many Kenyans on social media as spectacularly ill-timed.

Senators had already proposed amendments to the Data Protection Act to align Kenya’s framework more closely with GDPR, with calls to make the Office of the Data Protection Commissioner independent and adequately staffed with technology professionals.

The ODPC had shown a new readiness to act, having ordered both Safaricom and BD East Africa to pay Sh250,000 each for unlawfully processing a former employee’s personal data in an unrelated matter.

The Tuju case has, in the space of 48 hours, transformed a contested property dispute into one of the starkest tests yet of whether Kenya’s data protection regime exists as a genuine safeguard for ordinary citizens or merely as language on paper that bends whenever law enforcement requires it to.

As Monday evening fell, Tuju remained at Karen Police Station. Kalonzo and his delegation refused to leave.

The lawyers were still demanding to know what charge, if any, their client faced.

And on X, the question that had been asked about the Gen-Z protesters, about David Mokaya, about a long line of Kenyans who had found their private movements suddenly legible to the state, was being asked again: who authorised Safaricom to share this man’s location data — and when?