Section 53 of Computer Misuse and Cybercrime Act No 5 of 2018: Interception of content data

(1) Where a police officer or an authorised person has reasonable grounds to believe that the content of any specifically identified electronic communications is required for the purposes of a specific investigation in respect of an offence, the police officer or authorised person may apply to the court for an order to—
(a) permit the police officer or authorised person to collect or record through the application of technical means;
(b) compel a service provider, within its existing technical capability —
(i) to collect or record through the application of technical means; or
(ii) to co-operate and assist the competent authorities in the collection or recording of, content data, in real-time, of specified communications within the jurisdiction transmitted by means of a computer system.
(2) In making an application under subsection (1), the police officer or an authorised person shall —
(a) state the reasons he believes the content data being sought is in possession of the person in control of the computer system;
(b) identify and state the type of content data suspected to be found on such computer system;
(c) identify and state the offence in respect of which the warrant is sought;
(d) state if they have authority to seek real-time collection or recording on more than one occasion is needed, and shall specify the additional number of disclosures needed to achieve the purpose for which the warrant is to be issued;
(e) explain measures to be taken to prepare and ensure that the real-time collection or recording is carried out—
(i) while maintaining the privacy of other users, customers and third parties; and
(ii) without the disclosure of information and data of any party not part of the investigation;
(f) state how the investigation may be frustrated or seriously prejudiced unless the real time collection or recording is permitted; and
(g) state the manner in which they shall achieve the objective of the warrant, real time collection or recording by the person in control of the computer system where necessary.
(3) Where the court is satisfied with the grounds provided under subsection (2),the court shall issue the order applied for under subsection (1).
(4) For purposes of subsection (1), the real-time collection or recording of content data shall not be ordered for a period that exceeds the period that is necessary for the collection thereof and in any event not for more than a period of nine months.
(5) The period of real-time collection or recording of content data may be extended for such period as the court may consider necessary where the court is satisfied that —
(a) such extension of real-time collection or recording of content data is required for the purposes of an investigation or prosecution;
(b) the extent of real-time collection or recording of content data is proportionate and necessary for the purposes of investigation or prosecution;
(c) despite prior authorisation for real-time collection or recording of content data, further real-time collection or recording of content data is necessary to achieve the purpose for which the warrant is to be issued;
(d) measures shall be taken to prepare and ensure that the real-time collection or recording of content data is carried out while maintaining the privacy of other users, customers and third parties and without the disclosure of information and data of any party not part of the investigation;
(e) the investigation may be frustrated or seriously prejudiced unless the real-time collection or recording of content data is permitted; and
(f) the cost of such real-time recording and collection is not overly burdensome upon the person in control of the computer system.
(6) The court may also require the service provider to keep confidential the order and execution of any power provided for under this section.
(7) A service provider who fails to comply with an order under this section commits an offence and is liable, on conviction —
(a) where the service provider is a corporation, to a fine not exceeding ten million shillings;
(b) in case of an officer of the service provider, to a fine not exceeding five million shillings or to imprisonment for a term not exceeding three years, or to both.