A responsible conversation about surveillance must begin with one basic truth: every modern state has a duty to keep its people safe. That duty does not disappear because technology is involved. Terror threats, organised crime, child trafficking, cybercrime, money laundering, financial fraud and violent extremism all exploit digital systems. A government that refuses to build lawful intelligence capacity would be abandoning its citizens to danger.

But the second truth is equally important: security power must never become a blank cheque. It must operate under law, judicial restraint, parliamentary scrutiny, institutional accountability and respect for the rights of citizens. The real test, therefore, is not whether a country has surveillance capability. The test is whether the capability is lawful, necessary, proportionate, targeted, auditable and subject to independent oversight.

That is where the recent international framing of Kenya’s surveillance debate becomes problematic. It appears to place suspicion before evidence and insinuation before institutional context. Kenya is not a perfect democracy, but it is also not a helpless dictatorship without courts, Parliament, media, civil society or constitutional safeguards. The country has a noisy public square, active litigation culture, independent media voices, fearless citizens and institutions that can be challenged in court. Any serious foreign report must acknowledge that complexity.

Kenya is imperfect, but it is not voiceless

Kenya elects its leaders. Kenyans criticise their leaders daily. Courts suspend government actions. Parliament debates security, budgets and policy. Citizens protest, sue, expose, organise and vote. That does not make Kenya perfect; it makes Kenya a democracy still under construction. The imperfections are real, but so are the checks and balances.

It is, therefore, unfair to tell Kenya’s story as though the state operates in a vacuum and citizens have no remedies. A fair report would ask hard questions about surveillance, but it would also explain the legal pathways available for challenge, the role of the Judiciary, the role of Parliament, the Data Commissioner, the Communications Authority, civil society litigation and media scrutiny. Without that context, the story risks looking less like accountability and more like selective indictment.

Foreign media houses have every right to investigate Kenya. Kenyans should not fear scrutiny. But scrutiny must be rigorous enough to distinguish between lawful cooperation with security agencies, technical capability, alleged abuse, proven misconduct and political speculation. These are not the same things. Treating them as one creates heat, not light.

Safaricom sits at the centre of daily life; that is why suspicion travels fast

Safaricom is not an ordinary company in Kenya’s public imagination. It carries voice, data, payments, commerce, savings, credit, emergency communication, business records and millions of daily personal interactions. Because of M-PESA and its telecommunications backbone, Safaricom is woven into the nervous system of the economy. When a company occupies such a central position, it becomes easy for fear to attach itself to the brand.

That centrality, however, should not be turned into automatic guilt. A power company is not responsible for every crime committed under electric light. A bank is not guilty merely because criminals use bank accounts. A road agency is not responsible for every getaway vehicle that moves on a highway. In the same way, a telecommunications provider should not be condemned simply because lawful security agencies may request information through legally recognised channels.

The burden of proof must remain high. A company as systemically important as Safaricom should be questioned firmly, but also fairly. Accusations that touch data privacy, national security and human rights require documents, lawful thresholds, timelines, responsible parties and verifiable evidence. They cannot rest on atmosphere alone.

What Safaricom’s public privacy position says

Safaricom’s publicly available privacy materials state that disclosure of personal information is to be done in accordance with applicable laws and regulations. Its privacy statement also says the company assesses and reviews applications for information and may decline requests that do not meet the required threshold. That is an important position because it indicates that Safaricom does not publicly present itself as a passive tap for any person who asks for customer data.

This matters. In a lawful system, a telecom operator is expected to balance three duties at once: protect customer privacy, comply with valid legal obligations, and assist legitimate investigations when the law requires it. That is a difficult position. If the company refuses every request, it may frustrate investigations into serious crimes. If it grants every request, it may violate rights. The right standard is neither obstruction nor surrender. The right standard is lawful, documented, proportionate compliance.

Safaricom should therefore be judged by that standard: what request was made, by whom, under what legal authority, for what purpose, covering which data, d