According to the findings of a local national media investigation, a relatively unknown British software business has placed a data management system into Safaricom’s internal networks.
This technology provides Kenya’s security agencies with nearly unfettered real-time access to the call data of Kenyans.
Requests for information from the police and the courts are processed by a group of law enforcement officials working in the Law Enforcement Liaison Office, which is located inside the headquarters of Safaricom. One of Safaricom’s top employees is in charge of managing the team.
According to the findings of an investigation that lasted for several months, Kenya’s security agencies have had virtually unrestricted access to the sensitive call data records of mobile phone customers for years.
This access has also included location data, which has enabled them to track and apprehend individuals suspected of committing crimes. However, this access has also violated the right of innocent users to privacy.
The results raise worries about the possibility of using the mobile phone data of consumers to assist in the investigation of the widespread kidnappings and extrajudicial executions that have been reported in the nation, particularly in the aftermath of and even before the Gen Z demonstrations that took place in June.
The irregularities that have been found in call data records (CDRs) that have been presented to the court by telecoms companies in response to investigations into missing persons in which state security agents are suspected of having forcibly disappeared or extrajudicially killed suspects have also raised concerns that the companies have impeded the pursuit of justice.
Furthermore, the inquiry revealed that a relatively unknown British software business known as Neural Technologies had implanted into Safaricom’s internal systems a data management system that provides Kenya’s security agencies almost unfettered real-time access to the call data of Kenyans.
Nation Media asked Neural Technologies about their participation in building a system that assists law enforcement in tracking and capturing individuals of interest by using the data and signals from their mobile phones, but they did not reply to their enquiries for information.
In addition, the spokeswoman for the Kenya National Police Service, Resila Onyango, did not react to the local daily in-depth enquiries into the incident. Nation Media wrote her an email with our enquiries in late September, and she did not respond to their following WhatsApp messages or phone calls.
In a brief email answer, Safaricom denied violating the right to privacy of its consumers, despite the fact that proof of the violations was supplied to the company.
For as long as people can remember, Safaricom has taken the obligation to safeguard client information extremely seriously. In a response, a spokeswoman for Safaricom stated, “We are committed to honouring our customers’ confidence by safeguarding their privacy, and we place a high priority on the privacy of our consumers.”
“We protect all data in accordance with our duties and the law, and we only reveal call data records to validated law enforcement agencies when we are forced to do so by a court order.
“Despite the fact that we are unable to discuss specific incidents, we have always been straightforward and honest in the manner in which we interact with our stakeholders, and we want to continue doing so in order to preserve the confidence that we have established over the course of our existence,” the firm continues.
When someone goes missing in Kenya, businesses that deal with telecommunications are often in a position to assist in solving the mystery. Each and every call and text message that is issued or received by subscribers is recorded as a call data record (CDR), which includes essential information such as the time, caller ID, and the location of the subscriber. Every hour, millions of these recordings are the result of their creation.
The use of CDRs as evidence is widespread around the world, even in situations involving murder and enforced disappearances. In a country like Kenya, where extrajudicial executions and disappearances are once again on the increase, the massive data servers that telecommunications firms maintain are consequently a source of valuable criminal evidence.
All of the particular examples that the local daily studied included Safaricom mobile phone numbers, despite the fact that their inquiry revealed that all Kenyan telecommunications firms frequently send over CDRs to the police.
Safaricom, Kenya’s biggest telecommunications provider in terms of subscriber base and the most lucrative firm in the nation, often refuses to disclose complete customer data records (CDRs), which include essential evidence for criminal investigations and the identification of missing individuals. This is the case notwithstanding Safaricom’s denial.

On the other hand, when it comes to providing assistance to the Kenyan government, Safaricom will swiftly provide information on its users. The CDRs that Safaricom has made available have been an essential component in the process of “pinning” terrorist convictions.
Whether they are conducting an investigation or a prosecution, the Kenyan police are required by law to get a court order in order to retrieve CDRs from the systems of mobile operators.
Additionally, according to the process of the police department, a written request that has been authorised internally and cites an “occurrence book number” is required.
Interviews with civilian Safaricom personnel and police officials revealed that, in actuality, it is possible for the Kenyan police to easily access it without going through any legal procedures.
The investigations also uncovered instances in which Safaricom obstructs the pursuit of justice by, for instance, asserting that it does not have ‘ancient’ data, while in reality it does hold such data.
Lawyers and the courts are led astray by this. Furthermore, according to forensic specialists who were questioned, Safaricom has supplied documents to the court in four different legal cases that were investigated by the Nation.
These records purportedly included evidence of fabrication, and they were released in situations where the police were suspected of committing murder or enforced disappearance charges.
Requests for information from the police and the courts are processed by a group of law enforcement officials working in the Law Enforcement Liaison Office, which is located inside the headquarters of Safaricom. One of Safaricom’s top employees is in charge of managing the team.
On the other hand, when Kenyan police officers are suspected of a murder or a disappearance, it is their own colleagues who are responsible for generating the call data record evidence that may either expose them or clear them of the crime. All of this creates a significant conflict of interest.
In addition, the nation study discovered instances in which law enforcement and intelligence agencies have used consumer information and location records in more nefarious ways for the purpose of carrying out kill or capture operations.
It is possible to kidnap and murder suspects who have been found using the signals from their mobile phones without following the proper legal procedures.
The disappearance of Trevor Ndwiga and the accompanying legal actions (Diana Ndinda Mutia and Trevor Ndwiga Nyaga vs. ODPP and Safaricom Limited and 5 Others) are one example of this kind of situation.
Previously, Trevor Ndwiga Nyaga was accused of charges relating to terrorism, and he was freed on bail in July of the year 2020. However, on September 4, 2021, he vanished without a trace.
At a local police station, his mother called in a missing person report. She was becoming more frightened about the possibility that anti-terror police had kidnapped him. In order to determine Ndwiga’s location, the defence attorney for his terrorist prosecution submitted a petition for habeas corpus.
Following the submission of a request for Call Data Records (CDRs) to the Safaricom Law Enforcement Liaison Office for the mobile phone line that Ndwiga used, the requesting police officers then presented the CDRs to the court with a stamp from Safaricom dated February 3, 2022.
The court issued an order to Safaricom later on February 8, 2022, for the company to submit “the phone call data records and Base Transmitting Station (BTS) records and logs covering the time beginning at nine of the clock in the morning,” beginning on September 1st, 2021, and ending at midnight on September 30th, 2021.”
Despite the fact that both of the evidence that was both presented in court and approved by Safaricom covered the same time period and mobile phone line, there were substantial discrepancies between them.
One of the datasets has information on his whereabouts, which indicates that he is now travelling towards the Somali border. However, the second piece of information that was supplied to the court confirms that he is located in Nairobi. This dataset was created for the same phone line and dates.
Another example of Safaricom submitting information to the court that has inexplicable anomalies is the case of Samuel Dong Luk and Idri Aggrey, an investigation into their disappearance (HCCR Misc. Appl. 28/2017, Samuel Dong Luk and others vs. Republic).
Dong and Aggrey were activists from South Sudan who were vociferous in their criticism of the government of South Sudan. On account of the dangers to their lives, both of them resided in Nairobi.
Abductions of Dong and Aggrey took place on January 23 and 24, 2017, respectively, and were carried out by unknown individuals. A panel of experts from the United Nations came to the conclusion that South Sudanese intelligence would have kidnapped the two men in Nairobi, most likely with the cooperation of Kenyan intelligence, and then taken them to Juba. In that location, the experts from the United Nations concluded that they were “very probable” put to death.
Call records that are produced in court include anomalies, as stated before. Large numbers of calls and SMS messages that were sent and received around the time of Dong’s disappearance are missing crucial information, such as the base station number, which would reveal the location of the handset.
This information was obtained by the court from the CDRs that were obtained for Dong’s Safaricom line and for the main suspect in their disappearance at the time. Given this information, it is difficult to determine the whereabouts of either the victim or the suspect at the time that Dong vanished.
Furthermore, according to the findings of the Nation investigation, Safaricom has provided to the court and certified as valid data that seems to be fake.
When analysts at NMG looked at the information that Safaricom provided to the courts, they found eight call events that occurred between seven of the clock in the evening, when Dong vanished, and about ten of the clock in the morning, during which the base station’s unique ID numbers seemed to be forged.
Using two worldwide open-source base station databases, as well as an engineer with real-time access to Safaricom’s live system, the nation was able to successfully corroborate this information.
In the instance of Dong, Nation presented the CDRs from Safaricom to two independent British cell site forensic specialists who are often involved in the investigation of such legal evidence.
“You do not see records like this when you have got areas that are simply blank like that,” the first person said, after taking into consideration the many technical reasons that may be appropriate.
“Based on logic, it is not possible that this is the result of a fault in a system someplace… It gives rise to the assumption that they have been modified.”
The second expert gave the following statement: “It seems to be suspicious because there is such a large portion of them missing.”
If the nation were to get evidence of that kind, they would immediately raise serious concerns about it. The worst-case scenario is that it has been redacted.
Safaricom did not provide a response to their enquiries on the anomalies that were present in the exhibits that were shown in court.
In most cases, the records of mobile phone calls include information on the location and connections of each user.
In order to find and investigate suspects, law enforcement and intelligence organisations all over the globe employ them, but only within the confines of specific legal restrictions.
In 2012, Safaricom spoke with Neural Technologies about the possibility of developing software for law enforcement authorities in order to automate the access that Kenyan police and intelligence agencies had to the CDRs of the telecommunications operator.
In order to give free access and search results that are virtually immediate, the two firms collaborated to rewire the databases that were already in place at Safaricom.
In an interview, Jeff Cheatham, who was working as a project manager at Neural Technologies at the time, provided an explanation on the development of the surveillance system.
He said, “Safaricom’s thinking was, ‘hey, the fraud system has all the call record info anyhow… Every little piece of data is saved and processed by our system before entering the analysis phase.
“Consequently, given that all of that information is already present, they pondered the possibility of establishing a connection in such a way that law enforcement or any other individual might use it to remotely access this information automatically.”
Insiders at Safaricom claim that the project was motivated by the telecommunications company’s desire to offer a simpler and more streamlined service to law enforcement agencies that were looking to access the data of their customers.
As a result, there were not sufficient safeguards in place to guarantee that the approval of access by Safaricom employees was not merely a rubber stamping of the requests made by the security agencies.
Additionally, Neural Technologies was in the process of establishing a browser-based portal enabling officers in the field to access Safaricom CDRs. Mr. Cheatham said that this concept would “never fly” in the United States or the United Kingdom because of the privacy rules that are in place in those countries.
As a result of the field access, law enforcement authorities now have the capability to follow suspects’ mobile phones in real time and track them wherever in the nation.
The Kenyan government has 35 percent ownership in Safaricom, but the British multinational telecoms company Vodafone Group is the single largest stakeholder in the company.
Vodafone Group controls slightly under 40 percent of Safaricom’s shares. Trading takes place on the Nairobi Securities Exchange (NSE) for a free float of twenty-five percent of the shares.
The discovery that the United Kingdom’s intelligence agency, GCHQ, had direct access to the phone and internet communications of its residents caused a complaint to be filed at the European Court of Human Rights.
In the year 2020, the court announced that it had determined that the practice of intercepting communications in large quantities was illegal.
There were multiple demands for comment from Vodafone on the procedures at Safaricom and the apparent abnormalities; however, Vodafone did not react to any of these enquiries.
In 2016, Neural Technologies said that it was “considering options” to assist Kenyan law enforcement in mapping criminal networks and “closing them down.” The Kenyan police were “seeking to exploit the telecom information” to provide assistance.
The cooperation between Safaricom and Neural Technologies was so successful that in February of 2018, the British business was making preparations to take a significant step forward in order to make it easier for Kenyan law enforcement to acquire data from Safaricom.
“Find my friends” is the name that we give it,” quipped Adrian Harris, who had previously served as the head of new products at Neural Technologies.
“Find My Friends” was a prototype visualisation service that enabled law enforcement authorities to create a predictive profile of Kenyans and flag them for additional investigation based on their patterns of activity and relationships with other people.
In this scenario, a Kenyan officer has shown interest in conducting an investigation against a certain individual. By triangulating the mobile masts to which the target’s phone connects, they are able to track the target’s movements as they travel throughout Kenya.
This is accomplished by looking up the person’s phone number and utilising the map search feature of the monitoring program.
This technology also does an analysis of Safaricom’s information in order to discover additional persons who may be travelling in the same manner as the target and to whom they may be related.
It does this by mapping how the individuals use their phones, which allows it to proactively identify new “suspects.”
Interviews with a number of current and former law enforcement personnel verified that Safaricom is able to undertake live monitoring of the position of an individual mobile phone by using base station data. This service is available to security services upon request.
Another paramilitary officer who is now serving with the Recce Company said, “There is always Safaricom, where you can monitor anyone.”
“As you get closer, there is something that we refer to as a sensor that says we are near. Depending on the signal, they can detect that we are around ten meters away from the individual. It will inform you that he is within a certain radius.”
“Therefore, it is the time for the men to dismount… and physically cordon off the area.”
Tools that automate intelligence activities for law enforcement, such as ‘Find My Friends,’ have been the subject of criticism in various countries, particularly issues around racial prejudice.
There have been at least fourteen police departments in the United Kingdom that have used predictive analytics to pinpoint areas of high crime. This practice has been condemned by Liberty, a British human rights group, as “entrenching pre-existing disparities while being disguised as cost-effective innovation.”
At this time, the United Kingdom does not have any regulations in place to govern the export of machine learning and artificial intelligence solutions for telecommunications operators, even if these solutions are ultimately intended for law enforcement purposes.
Such a predictive police and profiling system presents severe problems with regard to human rights, especially when considering the fact that the Kenyan authorities have a history of mysteriously missing and killing people.
“The objective of this is to single out certain persons and identify them as terrorists,” the prosecutor said.
“Consequently, we would argue that it ought to be included (in accordance with the legislation governing export control in the United Kingdom),” says Natalia Krapiva, the tech-legal counsel at Access Now, an organisation that advocates for digital rights, in response to a description of the capabilities of the program known as “Find My Friends.”
In his explanation, Harris said, “We are not aggressively seeking for you.”
“In order to show its prototype tool to us, Neural Technologies connected to Safaricom’s database. All we are doing is we are looking at the information that we have been recording and continuing to capture as you go along,” Neural Technologies said.
An lawyer for constitutional and human rights in Kenya named Haron Ndubi makes the observation that “you cannot consider all of us as suspects.”
“It is already illegal in and of itself to have some random system where you want to check on everyone and see who they are talking to,” Haron said.
According to Khelef Khalifa, head of Muslims for Human Rights (MUHURI), it is “unconstitutional” for the police to access sensitive consumer data without first obtaining a court warrant.
“For us, this comes as a surprise since the law prohibits Safaricom or any other corporation from doing this. This is due to the fact that the law stipulates that in order to acquire access to the data of another individual, you must first seek a court order.”
In response to a request for clarification about the due diligence that Neural Technology does on end-users of its technology in order to protect against violations of human rights, the company did not provide a response.
The United Kingdom made the announcement in 2021 that it will increase its military presence in Kenya, which is the country’s primary strategic ally in East Africa.
According to the findings of a prior inquiry conducted by the United Kingdom that was declassified, the British intelligence agency known as MI6 has been instrumental in locating, monitoring, and locating targets in Kenya, as well as in making judgements about their course of action.
Note: It is not the intention to imply that Vodafone, Safaricom, or Neural Technologies are actively involved in or otherwise accountable for the alleged extrajudicial executions, state illegalities, or other human rights abuses that are presented in this piece.
Via Daily Nation