Data privacy: Is your phone listening to you?

When Albert Ojwang’ was traced to his father’s home in Homabay, one of the recurring questions was how DCI were able to pinpoint his location with such accuracy. Was Albert being watched? Are you and I being watched?

Imagine walking through downtown Nairobi or posting a comment online, not knowing that somewhere, someone is watching, listening, and possibly recording. This is not just a paranoid thought. With increased use of social media, access to the internet and use of mobile phone communications technology, it is increasingly the reality.

Secondly, government and non-government operatives have access to powerful surveillance technologies that may be used to monitor individuals often quietly, lawfully and sometimes unlawfully.

Lawful surveillance occurs when security officers have a valid reason to secretly observe an individual. An example could be when investigating a crime and in line with set out legal procedures, they seek a warrant from a court of law. The warrant would ideally identify the individual to be subject to surveillance, the reason for the surveillance, and the duration within which the surveillance is to be conducted. The evidence collected through this process would easily be presented in court for scrutiny.

But then there are many instances where surveillance by security officers is undertaken without compliance with set out legal procedures. In the past, government surveillance was mostly physical undercover agents, wiretaps, or police observation. But in today’s digital age, surveillance has gone high-tech and invisible. The government has access to advanced tools that can track phone calls, read text messages, monitor internet activity, and even spy on encrypted apps like WhatsApp. These tools are often purchased from private companies abroad and deployed with little to no public knowledge as they fall within the ‘national security’ framework.

One of the most powerful tools used globally by governments is Pegasus spyware, developed by NSO Group. Researchers and human rights investigators have in the past made claims that Pegasus is in use in by the Kenyan government. The government has never publicly confirmed whether the spyware is in use locally. The thing about Pegasus is that it can be installed on a smartphone without the user ever knowing. It can then be used to access texts, emails, social media accounts, passwords, photos, camera, microphone, and even encrypted chats.

In the event security officers get hold of your mobile device, they may use digital forensics tools for data extraction, analysis, and recovery. Simply, even your deleted texts, photos, and videos could be recovered using the digital forensic tools.

Because a lot of our information is publicly available on social media pages, websites, and mobile applications, leaked databases, and forums, Open-Source Intelligence (OSINT) tools may be used to collect and analyse information from these sources. OSINT tools are increasingly used by governments, private investigators, and law enforcement officers to monitor individuals, track activities, and map social networks often without needing access to private communications. They can collect and visualise massive amounts of personal data, raising serious concerns about privacy and surveillance. While they serve legitimate investigative purposes, their use must be balanced with strong safeguards to prevent misuse and protect citizens’ rights.

Telecommunications companies are also a source of critical data that may be used by security officers. The firms generate Call Data Records (CDRs) that log who called whom, when, how long, and from where. Your mobile money transactions are also included in the records which are routinely used by law enforcement for investigations where a valid court order is provided to the telco to hand over the call data records.

Social media platforms are another source of data that may be used to track an individual. From transparency reports by social media platforms (Facebook, Instagram, Tiktok, X, and whatsapp) the Kenyan government has often made formal requests to them for user data. Typical data requests include requests for user data including basic subscriber information (such as names, registered phone numbers and email addresses, service start dates), IP logs and login/logout timestamps, and account activity records (such as message headers, public posts, comments, likes, and device usage history). Ideally the requests for such data ought to be carried out through a court mandated warrant.

In addition to the above, in cities such as Nairobi and Mombasa, surveillance cameras have been installed at major roads and intersections. It is publicly claimed that some of the cameras are AI-powered and can recognise and track people using facial features.

All the above paint the simple picture that all security officers need is a combination of data sources to track you down to your exact location and to know with whom you communicate with regularly, without any need for help from mobile operators. Even where you do not use your official name in your social media handle, requests can be made to social media platforms to unmask you or OSINT tools deployed to map out your online footprint.

You may perhaps be asking, can you evade all the above surveillance tools? The answer is no. It is nearly impossible to fully evade all modern surveillance tools especially if the government is determined to track you.

If you are subject to investigations and suspect that you have been subject to some of the above surveillance tools, seek legal representation that will help you assess whether the surveillance carried out on you was undertaken within constitutional and legal boundaries. 

The writer is an advocate of the high court and a data protection and compliance specialist. Mugambi@laibuta.com