Safaricom Handed DCI Tuju’s Real-Time Location Data Without a Court Order Say Critics — Then He Was Arrested, Beaten and Denied Hospital as His Condition Deteriorates

The most dangerous revelation to emerge from the arrest of former Cabinet Secretary Raphael Tuju on Monday was not that the DCI believes he faked his own disappearance.

It was the casual, almost incidental manner in which DCI Director Mohammed Amin disclosed that investigators had obtained precise, timestamped phone location data on a sitting Kenyan citizen — within hours of a missing person report — without producing a single piece of paper showing a court had authorised it.

That disclosure, buried inside a press briefing designed to humiliate Tuju, has detonated a far larger conversation about Safaricom’s role as what critics are now openly calling the intelligence arm of the Kenyan state — a company that tracks, traces and hands over subscriber data to security agencies on demand, constitution and data protection law notwithstanding.

By Monday evening, the debate had acquired a human face: Tuju, a man who underwent spinal surgery in 2020 with metal plates inserted into his vertebrae, was sitting on a plastic chair inside Karen Police Station in visible agony.

Doctors from Karen Hospital were crouched around him. His lawyers said officers had been given strict orders from above not to allow him to be transferred to a proper medical facility.

Tuju getting medical attention from the police station as his condition deteriorated.

Outside the gate, Wiper Patriotic Front leader Kalonzo Musyoka, former Attorney General Justin Muturi, DAP-K leader Eugene Wamalwa, Senator Dan Maanzo and constitutional scholar PLO Lumumba had planted themselves and were not moving.

WHAT THE DCI REVEALED — AND WHAT HE DID NOT

Amin’s press briefing was intended to be a moment of institutional triumph. Instead it handed Tuju’s lawyers, the Law Society of Kenya, and privacy campaigners the single most incriminating public statement yet made by a Kenyan security chief about the telco-state surveillance pipeline.

Standing before cameras at DCI headquarters, Amin announced that forensic analysis had established, without an iota of doubt, that Tuju had never left his Mwitu Drive Karen residence during the entire period of his reported disappearance. Investigators knew, the DCI boss said, that Tuju’s phone was switched off at exactly 18:18 hours on Saturday, March 21 — and that at the moment it went dark, the device was inside his compound.

That is not information a police officer deduces from observation. That is telecommunications data: call detail records and cell tower triangulation, held exclusively by Safaricom as the network operator, tied to Tuju’s registered SIM. Obtaining it in real time, within hours of a missing person report being filed, requires — under Section 31 of Kenya’s Data Protection Act and Article 31 of the Constitution — a court order or equivalent judicial authorisation. Amin mentioned no such order. None has been produced. None has been shown to Tuju’s legal team. None has been cited in any subsequent police document.

Safaricom did not issue a statement. It has not been asked by any official body to explain the basis on which it released the data. The Office of the Data Protection Commissioner, which has jurisdiction over exactly this type of alleged breach, had also not commented as of Monday evening.

‘DCI-SAFARICOM AXIS OF EVIL’

On X, hundreds of posts made the connection within minutes of Amin’s briefing airing on Citizen TV. One widely shared post stated: “DCI chief confirming that Safaricom gave them all access to track, trace, dox and geolocate Tuju’s phone number, including the exact time it was switched off. DCI didn’t get a court order. DCI-Safaricom axis of evil.” Another, rephrasing the legal concern in starker terms, read: “What the DCI is conveying is that Safaricom, without authorisation from Tuju, provided Tuju’s private information to the DCI to track his whereabouts. Safaricom is a government entity that is putting vulnerable Kenyan citizens at risk.”

Screenshot

Screenshot

Screenshot

Screenshot

Legal observers pointed out a detail that sharpened the concern considerably: Amin stated that investigators had simultaneously sought a court-sanctioned search warrant to enter Tuju’s compound after the family denied them access. That warrant application confirms investigators knew they needed judicial authority to enter a building. They appear to have formed no equivalent view about obtaining the telecommunications data that told them what was inside it.

THE COURTS HAVE ALREADY HEARD THIS STORY

The Tuju case has arrived at the worst possible moment for Safaricom’s public position. Its long-standing assurance that subscriber data is only released on receipt of a valid court order has been contradicted, in open court, by one of its own employees.

In February 2026, Moi University student David Ooga Mokaya was acquitted by Nairobi magistrate Caroline Nyaguthi after a Safaricom employee, Daniel Hamisi, testified that a senior DCI officer, Michael K. Sang, had obtained Mokaya’s subscriber details, call records and precise location data in November 2024 by writing a letter. No court order.

When defence counsel Ian Mutiso asked the DCI officer whether he knew judicial authorisation was required, the officer admitted he did not know. Mokaya, whose life was effectively derailed by a prosecution built on unlawfully obtained data, is now suing Safaricom for Sh200 million in damages. A High Court restraining order bars the telco from sharing his data further, with the matter set for mention on March 30.

The Law Society of Kenya last week moved to scale that individual case into a systemic constitutional reckoning. Its petition, filed in the Milimani Constitutional and Human Rights Division, names Safaricom, the DCI, the Inspector General of Police, the DPP, the National Forensic Lab and Kenya Power as respondents.

The LSK alleges an organised conspiracy to illegally surveil Kenyan citizens, drawing a direct line from Mokaya’s case to the mass surveillance of Gen-Z protesters during the 2024 demonstrations. The petition demands a court-supervised audit of every data request the DCI made to Safaricom between June 2024 and December 2025, a formal apology published in national newspapers for fourteen consecutive days, the expungement of charges against anyone prosecuted on illegally obtained data, and the establishment of a Victims Compensation Fund.

Earlier investigations by human rights organisations had alleged that Safaricom maintained a near-real-time backend access arrangement with security agencies, and that this pipeline had been linked directly to enforced disappearances and extrajudicial killings.

Safaricom has never publicly addressed those specific allegations. On Monday, March 24 — the same day Tuju was arrested on the basis of data its network provided — the company quietly announced a new privacy initiative to partially mask phone numbers in M-Pesa transactions as a gesture toward data minimisation. The timing struck most Kenyans following the story as staggering.

THEN THEY BEAT HIM

Tuju had agreed to present himself at Karen Police Station voluntarily, with Kalonzo driving him there personally. What unfolded after his arrival is contested in its characterisation but documented in its consequences.

Lawyer Ndegwa Njiru told journalists that officers moved to force Tuju into a waiting Subaru before a single entry had been made in the Occurrence Book and before any charge had been communicated to the defence. “Even before he started going into the OB, they started pushing him into a Subaru,” Njiru said. “That was not an arrest. Were it not for our presence, we would have been talking about something else. That was serious violence.”

Tuju being whisked away by police officers from his Karen home accompanied by his lawyer Njiru.

The violence struck directly at a catastrophic pre-existing injury. Tuju underwent spinal surgery in 2020 following a near-fatal road accident; metal plates were inserted into his vertebrae during the procedure. A doctor at the scene told officers that three discs had been affected by the way he was handled during the arrest and that moving him without a full medical assessment risked gravely worsening his condition. He required a stretcher. He was instead kept on a plastic chair inside the station. His blood sugar levels, sources said by Monday evening, were fluctuating. His overall condition was described as deteriorating.

Kalonzo did not mince words. “I personally drove him to Karen Police Station to record a statement in good faith, in the spirit of due process. What followed was unacceptable. Tuju was carried away in a manner that no Kenyan, indeed no human being, should ever experience,” he said. When asked why a man with documented spinal injuries and worsening vital signs could not be transferred to hospital, a senior police officer at the station delivered the answer that has since been shared across social media thousands of times: “This is a matter under orders from above. We are following instructions and cannot release him at this time.”

SECTION 129: THE CHARGE BEING READIED

If prosecutors proceed, the charge will be brought under Section 129 of the Penal Code, which makes it a misdemeanour — punishable by up to three years in prison — to give a public officer information one knows or believes to be false. To secure a conviction, the state must prove that the information Tuju provided was false, that he knew or believed it to be false when he gave it, and that it caused officers to act on it. The DCI has already established the third limb: plainclothes detectives were deployed, forensic teams were mobilised, and a court-sanctioned search warrant was sought — all triggered by the family’s missing person report.

Tuju’s defence dismantles the first two. He reported a genuine threat to his safety at Karen Police Station on Friday, March 20, the day before his disappearance, logging it under OB 21/21/03/2026.

He told reporters the same unregistered white Toyota Land Cruiser 70 Series he had reported on Friday reappeared behind him on Saturday evening as he was heading to record a Ramogi FM interview. He turned onto Nandi Road, lost the tail, abandoned his vehicle on Miotoni Lane, and sought shelter with a family near the Karen-Kiambu border. “I want to thank a family in Kiambu who gave me shelter,” he told journalists.

“They did not care about my tribe. They simply saw me as a human being.” If that account is supported by the family who sheltered him, by CCTV footage from Karen’s roads, or by any corroboration of the vehicle he described, the false-information charge does not survive.

Amin posed a question intended to undermine Tuju’s account: “Why would a mother whose husband has disappeared for the last couple of hours fail to cooperate with the police and share whatever information she had with the investigating officers?” It is a question that cuts both ways. If the family knew Tuju was safe inside the house throughout, their refusal to admit police is inexplicable. If they genuinely did not know where he was, their caution about admitting armed officers in the middle of the night into a home that had already been forcibly entered by over a hundred people ten days earlier is rather easier to understand.

THE PROPERTY SIEGE THAT PRECEDED EVERYTHING

Tuju after being thrown out of his Dari property.

Understanding the full weight of what happened on Monday requires understanding what happened on March 14. On that morning, more than a hundred people arrived before dawn at Dari Business Park in Karen — the property at the centre of Tuju’s decade-long debt dispute with the East African Development Bank.

Some came on motorbikes. The officers who accompanied them covered their faces and, according to Tuju, carried no visible court documentation. Everyone on the premises was evicted. Tuju broadcast the scene live from outside his own gate.

That eviction was the enforcement of an October 2024 auction that sold Dari Business Park and Tamarind Karen to Ultra Eureka Limited, a company controlled by Stabex International chairman Jackson Kiplimo Chebett, for Sh450 million. Tuju has valued the 6.8-acre estate at Sh3.5 billion. The sale resolved a debt that began as a USD 9.1 million loan in 2015, grew to USD 15.1 million by an English High Court judgment in 2019, and has been upheld by every Kenyan court since. On March 9, Justice J.W.W. Mong’are struck out Tuju’s final amended plaint as res judicata, lifted all remaining interim orders, and cleared the way for Ultra Eureka to enforce its title. He filed his police report about being followed five days later. He disappeared ten days after the eviction.

The DCI says the chronology is suspicious. Tuju’s lawyers say it is explanatory.

THE QUESTIONS THAT WILL OUTLAST THIS CASE

Whether Tuju is charged, acquitted, or released without prosecution, Monday has left three questions embedded in Kenya’s public life that will not be dislodged by any single court outcome. The first and most consequential is whether Safaricom is functioning as a real-time intelligence asset for the Kenyan state, releasing location data to the DCI on the basis of written requests alone, in systematic violation of the Data Protection Act, the Constitution, and the rights of every subscriber on its network.

The second is whether the Office of the Data Protection Commissioner — an institution that has shown a new willingness to act in minor commercial cases — has the independence, the resources, and the political protection to pursue that question against the country’s most powerful private company. The third is whether a citizen who presents himself voluntarily to record a statement can be kept in a police station, denied hospital access, denied a formal charge, and held under pain on instructions from unnamed officials above, without any of the legal safeguards the Constitution guarantees.

As this edition went to press, Tuju was still at Karen Police Station. Kalonzo was still at the gate. The doctors were still inside. No charge had been read. No court order authorising the telecommunications data had been produced.

And on X, the same question was being asked — about Tuju, about Mokaya, about the Gen-Z protesters, about everyone whose movements have been mapped and monetised by a system that the Data Protection Act was written to restrain: who gave Safaricom permission to hand over this man’s life, and when?

Safaricom House along Waiyaki Way Nairobi pictured on March 4, 2025. Wilfred Nyangaresi | Nation