Safaricom Gave Out Student’s Data Without Court Order, Officer Tells Court in Ruto Coffin Story

NAIROBI – A Safaricom security officer has told a Nairobi court that the telecommunications giant provided call data records and subscriber information for a university student without obtaining a court order, raising fresh questions about data privacy violations in Kenya’s most closely watched cybercrime case.

Daniel Khamisi, an investigator from Safaricom’s security department, testified at the Milimani Law Courts that his company received a request from the Directorate of Criminal Investigations on November 14, 2024, seeking call data records for four mobile numbers as part of the investigation into David Oaga Mokaya, the Moi University student accused of posting a fabricated social media message about President William Ruto’s death.

The testimony has opened a new front in the controversial case that has already seen prosecution witnesses struggle to establish concrete links between the accused and the viral X post that depicted what appeared to be a presidential funeral procession.

Khamisi revealed that Safaricom complied with the DCI’s request and submitted a comprehensive report on November 28, 2024, covering communications between October 15 and November 13, 2024.

The data included details of two specific transactions on November 13 – an incoming SMS at 4:24 p.m. and a phone call lasting 270 seconds.

Both activities were traced to the Eldoret Annex area, with the device identified by IMEI number 359995534449550.

However, what emerged as particularly concerning was the apparent absence of judicial oversight in the data request process.

Chief Inspector Bosco Kisau, the lead DCI officer in the case, had earlier admitted under cross-examination that a detention warrant for Mokaya’s electronic devices was only obtained after his arrest took place, suggesting a pattern of procedural irregularities in the investigation.

The revelation comes at a time when Safaricom faces mounting criticism from human rights groups, with the Kenya Human Rights Commission alleging that the company “allowed security agencies routine access to consumer data (including but not limited to CDRs and other location data) without a court order, assisting in the tracking and capturing suspects.”

Defense lawyers Danstan Omari and Shadrach Wambui have seized on these procedural lapses to challenge the prosecution’s case.

During Thursday’s hearing, Omari pressed Kisau on whether the contested post actually featured President Ruto’s image, to which the officer acknowledged it did not.

Instead, the post showed a casket covered in the Kenyan flag with an accompanying caption mentioning the President’s name.

The defense team’s strategy appears focused on dismantling the digital evidence chain, particularly challenging whether the social media account in question can be definitively linked to their client.

Ezra Koech, a police officer seconded to the Communications Authority of Kenya, admitted during cross-examination that his seven-page analysis report did not establish any connection between the X account @bosskabi landlord and Mokaya, nor did it authenticate the origin of the contested images.

Safaricom has previously maintained that it “respects customers’ privacy and strictly adheres to Kenya’s data protection laws” and only shares “customer data when required by a court order.”

However, the testimony suggests a more complex reality where requests from law enforcement agencies may be processed without the judicial scrutiny typically required for such invasive investigative measures.

The case has broader implications for digital rights in Kenya, where concerns about surveillance overreach have intensified.

Civil society groups have raised concerns about a “data management system embedded within Safaricom’s internal systems by a British software company, Neural Technologies” that allegedly “allows real-time access to call data, ostensibly for tracking suspects.”

For Mokaya, who has been free on bond since his November 2024 arrest, the case represents a significant disruption to his academic pursuits.

The fourth-year student has previously told the court that the ongoing proceedings are affecting his studies, leading to several adjournments to accommodate his academic commitments.

The prosecution alleges that Mokaya violated the Computer Misuse and Cybercrimes Act by publishing false information intended to cause public alarm.

However, Inspector Kisau’s admission that he could not confirm whether any member of the public was actually distressed by the post has further weakened the state’s case.

As the trial continues, the case is being closely watched as a test of Kenya’s cybercrime laws and their application to social media content.

The defense has indicated it may call President Ruto himself as a witness, arguing that as the alleged victim, his testimony is crucial to establishing whether the post caused the harm claimed by prosecutors.

The proceedings resume with the cross-examination of remaining prosecution witnesses, as the court grapples with questions about digital evidence authenticity, data privacy rights, and the boundaries of free expression in Kenya’s digital age.