Background: Arrest and Allegations of Surveillance

In July 2025, Kenyan authorities conducted raids on the residences and workplaces of prominent activist Boniface Mwangi, seizing his mobile devices and computer hard drives. The police accused Mwangi of involvement in “facilitation of terrorist acts,” a charge he vehemently denies. Following these events, Mwangi has expressed deep fears for his personal safety, citing evidence that his phone was covertly infected with spyware during his detention.

Citizen Lab Investigation Reveals Use of Advanced Spyware

A detailed report released on February 17, 2026, by Citizen Lab, a research institute affiliated with the University of Toronto, uncovered that an intrusive surveillance program developed by Israeli cybersecurity firm Cellebrite was installed on Mwangi’s smartphone without his knowledge or consent. Cellebrite’s tools are widely employed by law enforcement worldwide to unlock encrypted devices and extract data during criminal investigations. However, human rights organizations such as Amnesty International have repeatedly warned about the misuse of such technology to monitor journalists, activists, and political dissidents.

Scope of Data Accessed by Kenyan Police

The Citizen Lab report highlights that Kenyan police gained access to a vast array of sensitive information from Mwangi’s device, including private messages, confidential documents, financial records, passwords, and other personal data. This level of intrusion has raised alarms about privacy violations and the potential targeting of Mwangi’s associates.

Activist’s Response and Fears Amid Rising Political Tensions

Speaking to AFP on February 18, Mwangi revealed that he feels “violated” and harbors “life-threatening concerns” due to the alleged surveillance. He pointed to a disturbing pattern of enforced disappearances and extrajudicial killings by security forces following the widespread anti-government protests in 2024, which saw over 50 fatalities and numerous arrests nationwide. Mwangi fears not only for his own safety but also for that of his close contacts, as the government now reportedly has detailed knowledge of his inner circle.

Context: Post-Protest Crackdown and Government Accountability

After the 2024 demonstrations, which challenged President William Ruto’s administration, there was a surge in abductions and intimidation targeting government critics. Despite official promises to investigate these incidents, no public reports or accountability measures have been forthcoming. Mwangi, who has announced his candidacy for the 2027 presidential election, has been a vocal critic of alleged state-sponsored human rights abuses, including unlawful killings by security forces.

Increased Harassment Linked to Political Ambitions

Since declaring his intention to run for president, Mwangi reports a significant escalation in targeted harassment and surveillance activities. He suspects that members of his campaign team may also be under electronic monitoring. These developments underscore the heightened risks faced by opposition figures in Kenya’s increasingly fraught political landscape.

Legal Action and Broader Implications

A former photojournalist, Mwangi has endured multiple arrests over the years. He plans to use the findings from Citizen Lab’s investigation as evidence in his ongoing legal battle against the criminal charges linked to his 2025 arrest. Mwangi has requested the courts to prohibit the government from leaking any private content from his phone, particularly family photos, to the public domain.

Separately, Citizen Lab previously documented similar spyware deployments on the devices of four Kenyan filmmakers detained for alleged connections to a BBC documentary exposing security service abuses during the 2024 protests. These cases highlight a troubling trend of digital surveillance targeting activists and media professionals in Kenya.