Chapter 1: Demonstrate understanding of cyber security laws

Cyber security professionals in Kenya operate within a complex environment shaped by diverse laws, policies, and regulations that govern the protection of information systems and data. Understanding the legal framework is crucial for effective compliance, risk management, and enforcement of cyber security measures. This chapter explores the foundational legal concepts relevant to cyber security, highlighting the global legal system and the specific types of laws that apply nationally and internationally. The aim is to equip professionals with knowledge to navigate Kenya’s evolving cyber legal landscape confidently.

1.1 Meaning of terms

Cyber security law is read, argued and applied inside a legal system. A technician who preserves logs, handles customer data or writes an incident report therefore needs to know what the main legal systems are and how each one treats a dispute. A legal system is the set of sources of law, courts and rules of procedure by which a country decides what is lawful and settles disagreements. The same intrusion can be handled very differently by a court that follows earlier decisions, a court that follows a written code and a court that draws on religious texts. This topic defines the main legal traditions of the world and then the working terms used when cyber security laws are discussed.

1.1.1 World legal system

The world legal system is not one book of law. It is a collection of separate national legal systems that belong to a few traditions: common law, civil law, religious law and customary law, and many countries mix more than one. Each tradition decides where law comes from, how judges reason and how evidence is treated. This matters in cyber security because the attacker, the stored data and the victim are often in different countries.

Consider a small internet service provider (ISP) in Kenya whose business customer, a freight-forwarding office, finds its accounting files encrypted by ransomware. The logs suggest that the attacking server is hosted abroad. The ISP's technician must keep the logs intact for a Kenyan investigation, yet any request for help from the foreign host will be handled under a different legal tradition. The sections below use this one case to show how each tradition would approach it.

1.1.1.1 Common law

Common law is a legal tradition that grew from the decisions of the royal courts of England. Its distinguishing feature is judicial precedent: when judges decide a case, their reasoning becomes a rule that courts must follow in later cases with similar facts. Kenya applies common law principles together with the Constitution and written statutes, and the Judicature Act sets out the sources of law that Kenyan courts use. Other countries that follow this tradition include the United Kingdom, India, Nigeria and Australia.

In the ransomware case, a Kenyan court hearing a claim would look first at the statutes that apply, then at earlier decisions on the same questions. The main features of common law are:

• Precedent: A decision of a higher court binds the courts below it, and decisions of the Supreme Court of Kenya bind all other courts. Technicians and managers can therefore predict how a court is likely to treat a repeated situation.
• Statutes before case law: When an Act of Parliament and an earlier case disagree, the Act prevails. The Computer Misuse and Cybercrimes Act, 2018 and the Data Protection Act, 2019 are the first documents to read, and decided cases show how courts interpret their wording.
• Adversarial trial: Each side presents its own evidence and the judge acts as a neutral decision maker. The ISP technician may be called as a witness and be questioned on exactly how the logs were collected and stored.
• Rules of evidence: Courts test whether a record is authentic and reliable before they accept it. The Evidence Act makes provision for electronic records, but a computer record is admitted only when the Act's conditions are met, including a certificate signed by a person responsible for the device or system that produced it, so a log file can be used only if its origin and integrity can be shown.
• Reasoning by analogy: Judges apply older ideas such as fraud or breach of confidence to new digital conduct, so a new technology does not leave a gap while Parliament catches up.

1.1.1.2 Religious law

Religious law is law that takes its authority from religious texts, teachings and scholarly interpretation. Islamic law, Hindu law and Jewish law (halakha) are examples. Some states give religious law a very wide role, including in criminal law. Others, such as Kenya, limit it to personal matters: Kenya has no state religion, and the Constitution provides for Kadhi's courts that decide questions of Muslim personal law, such as marriage, divorce and inheritance, when all the parties are Muslims and agree to the court's jurisdiction.

Religious law seldom decides a cyber security dispute inside Kenya. It becomes relevant when work crosses borders. If the owner of the foreign server in the ransomware case were prosecuted in a country whose criminal law draws on religious texts, the definition of the offence, the proof required and the penalty would differ from the Kenyan ones. A technician preparing evidence for such a request should expect the receiving authority to apply its own rules, not Kenyan ones.

1.1.1.3 Hindu law

Hindu law is the traditional legal system of the Hindu community. It developed from ancient texts such as the Vedas and the Dharmashastras, from later commentaries and from custom. In modern India it was codified in the 1950s, in Acts such as the Hindu Marriage Act, 1955 and the Hindu Succession Act, 1956, which apply to Hindus, Buddhists, Jains and Sikhs in family matters including marriage, succession and adoption.

Hindu law governs personal and family relationships. It does not define computer offences or the handling of electronic records. Those are covered by India's ordinary statutes, and the Information Technology Act, 2000 is India's principal law on computer offences and electronic records. A Kenyan ISP that deals with an Indian hosting company would therefore meet that statute and India's courts, not Hindu personal law, when it asks for logs or a takedown.

1.1.1.4 Islamic law

Islamic law, often called Sharia, is the body of rules derived from the Quran, the Sunna (the recorded practice and sayings of the Prophet Muhammad), ijma (the consensus of scholars) and qiyas (reasoning by analogy from the texts). Scholars interpret these sources, and several schools of jurisprudence give different readings on detailed questions. In Kenya, Islamic law applies through the Kadhi's courts in the personal matters described above. In some other countries it shapes commercial and criminal law as well.

For cyber security, Islamic law matters mainly when a case or a customer is based in a country that applies it widely. Rules on contracts, fraud and false statements may then follow religious principles alongside the state's statutes, and a cybercrime charge may be framed in those terms. In the ransomware case, if the foreign host were in such a country, the technician's request would go to a court that weighs the evidence under its own rules, so a request that is precise about the dates, the addresses and the data affected is more likely to be understood.

Civil law and customary law

Two further traditions help in comparing systems. Civil law systems rest on comprehensive written codes, such as the French Code civil of 1804 and the German civil code of 1900, and judges apply the code rather than treat earlier decisions as binding. Their trials are often inquisitorial: the judge takes an active part in investigating the facts. Customary law consists of the long-standing rules of a community. Kenyan law recognises customary law in some personal matters, provided it is consistent with the Constitution and written law.

Key terms used in cyber security law

These terms appear throughout the study of cyber security laws, and each has a precise legal sense.

• Statute: A written law passed by a legislature, such as the Computer Misuse and Cybercrimes Act, 2018, which has been amended since it was first enacted. A statute is a primary source of law: a court reads the Constitution and the relevant Act before it turns to earlier decisions.
• Precedent: An earlier court decision that guides or binds later decisions on similar facts. It is the central idea of common law.
• Jurisdiction: The authority of a court or state to hear a matter. It may depend on where the offence happened, where the offender or the victim is, or where the affected computer is located. In the ransomware case, the victim is in Kenya and the attacking server is abroad, so more than one state may claim jurisdiction.
• Mutual legal assistance: A formal request from the authorities of one state to those of another for help in obtaining evidence, such as server logs or account records. It follows treaties or agreed procedures, and the request is made by the authorities, not by the ISP.
• Cybercrime: An offence committed by using a computer or network, or against one. The Computer Misuse and Cybercrimes Act, 2018 creates offences such as unauthorised access to a computer system and unauthorised interference with data.
• Data protection: The legal rules for processing personal data. The Data Protection Act, 2019 gives rights to data subjects and places duties on data controllers and data processors, and the Office of the Data Protection Commissioner oversees them.
• Information security: The protection of the confidentiality, integrity and availability of information. Laws often describe the controls organisations must keep in terms of these three properties.
• Digital evidence: Information stored or transmitted in digital form that is used in legal proceedings. Its value depends on showing that it has not been altered, which is why technicians record hash values and keep a written chain of custody for each copy.
• Compliance: Conforming to the laws, regulations and policies that apply to an organisation. An ISP that keeps logs, protects customer data and reports incidents as the law requires is showing compliance.

Chapter Summary

This chapter explored the foundational concepts of cyber security laws by first defining key legal systems including common law, religious law, Hindu law, and Islamic law, highlighting their influence on global legal frameworks. It then examined the different types of cyber security laws at both national and international levels, emphasizing their roles in regulating digital conduct. Various forms of cyber crimes were discussed alongside the difficulties encountered in prosecuting these offenses due to jurisdictional and technological challenges. The chapter reviewed local and international cybercrime legislation, outlining how these laws are designed to combat cyber threats effectively. It further explained the practical application of cyber security laws in protecting information systems and ensuring safe online environments. Compliance with these laws was addressed as a critical factor for organizations to maintain legal and ethical standards. Finally, the chapter considered the impacts of cyber crime, recognizing both its detrimental effects and the unintended positive outcomes such as increased awareness and improved security measures.