NAIROBI, Kenya — A new report by the University of Toronto’s Citizen Lab has found evidence suggesting Kenyan police used Israeli-made forensic technology to access activist Boniface Mwangi’s phone after his controversial arrest in July 2025.
Mwangi, a prominent government critic who has declared his intention to run for president in 2027, was arrested on July 19, 2025, by officers from the Directorate of Criminal Investigations (DCI). Officers raided his home and office, seizing several electronic devices.
At the time, the arrest followed nationwide protests against alleged extrajudicial killings and came a year after deadly demonstrations over the 2024 Finance Bill.
Authorities initially indicated they would pursue terrorism and money laundering charges linked to anti-government protests in June 2025, during which 19 demonstrators were killed.
Those charges were later dropped after widespread international condemnation, and Mwangi was released on bail. His firearms-related case remains active.
Phone Returned — But Altered
When authorities returned Mwangi’s devices on September 4, 2025, he immediately noticed something troubling: his Samsung Android phone no longer required a password to unlock.
Mwangi said he had never shared the password with investigators.
Researchers at Citizen Lab later conducted a forensic review of artefacts from the devices.
According to the report, the Samsung phone “shows signs that Cellebrite was used on the phone on or around July 20, 2025 and July 21, 2025,” a period when the device was in police custody.
Citizen Lab identified traces of an application named com.client.appA, which it associates “with high confidence” to Cellebrite, an Israeli company known globally for its phone unlocking and forensic extraction technology.
“The use of Cellebrite could have enabled the full extraction of all materials from Mwangi’s device,” the report states, including “messages, private materials, personal files, financial information, passwords, and other sensitive information.”
The lab said analysis of additional seized devices remains ongoing.
A Pattern of Surveillance Concerns
The findings come amid mounting scrutiny over Kenya’s use of surveillance tools against activists and journalists.
Citizen Lab noted that the use of forensic extraction technology in the context of what it described as an arbitrary arrest “likely violates both regional and international human rights law,” including protections under the International Covenant on Civil and Political Rights (ICCPR) and Kenya’s Constitution.
The report argues that extracting data from devices seized during politically sensitive arrests “cannot meet the requirements of international human rights law and thus cannot be justified.”
Human rights groups have previously accused Kenyan authorities of systematically targeting protestors and civil society actors.
In January 2026, Amnesty International warned of “growing concerns around state surveillance,” alleging security agencies have monitored social media and tracked online communications of dissenting voices.
Earlier in 2025, Citizen Lab also reported that commercial spyware Flexispy had been found on devices belonging to two Kenyan filmmakers while in police custody.
Investigations by Privacy International previously alleged that Kenya’s National Intelligence Service (NIS) conducted warrantless wiretapping before involving the DCI in formal investigations.
Questions for Cellebrite
The report also raises questions about Cellebrite’s human rights due diligence.
Under the UN Guiding Principles on Business and Human Rights, companies are expected to ensure their technologies are not used to facilitate abuses.
Citizen Lab noted that while Cellebrite has publicly stated it vets customers against internal human rights standards, the company has provided limited detail about how such vetting occurs.
“There are legitimate use cases for Cellebrite’s forensic technologies,” the report states. “But the context matters enormously.”
