"Not Safe for Politics: Cellebrite Used on Kenyan Activist and Politician Boniface Mwangi" 17 February 2026

Boniface Mwangi is a prominent dissenting voice, activist, and politician in Kenya who has announced his intention to run for president in Kenya’s 2027 elections.  

On July 19, 2025, Mwangi was arrested at his home by officers of the Kenyan Directorate of Criminal Investigations (DCI), which is part of the Kenyan National Police Service. He was subsequently taken by the authorities to his office, a co-working and activist space in Nairobi. DCI officers raided both Mwangi’s home and office, seizing several of his devices...

...The Kenyan authorities returned the devices seized during the July 19, 2025 raid to Mwangi on September 4, 2025. Mwangi immediately observed that the Samsung phone had its password protection removed and could now be opened without a password. He states that he never provided the device’s password to the authorities.

Researchers at the Citizen Lab analyzed artefacts collected from Mwangi’s devices shortly after they were returned to Mwangi and performed an analysis for evidence of compromise. 

Our analysis of the Samsung Android phone confiscated by the Kenyan police belonging to Mwangi shows signs that Cellebrite was used on the phone on or around July 20, 2025 and July 21, 2025. The device was in the custody of the Kenyan police during this timeframe.

The findings detailed in this research note add to the growing body of evidence that Cellebrite’s technology is being abused by its government clients, and the company is failing to prevent those abuses from happening...

...Mwangi’s arbitrary arrest and the use of Cellebrite’s forensic technology in the context of this arrest and without consent likely violates both regional and international human rights law and the Kenyan constitution, which protects fundamental rights and freedoms, including the right to privacy, freedom of expression, freedom of association, assembly, demonstration, picketing, and petition. The actions of the Kenyan government against Mwangi have been widely criticized by human rights organizations...

...Cellebrite has publicly stated that it “vets potential customers against internal human rights parameters, leading [the company] to historically cease business in jurisdictions where risks were deemed incompatible with [the company’s] corporate values.” 
Yet, a quick online search would have revealed that the Kenyan authorities have engaged in widespread human rights violations. These numerous public reports should have raised alarm bells to Cellebrite’s officials that its highly invasive technology was at risk of abuse by police and security agencies in Kenya, and raises questions regarding the company’s due diligence procedures...

...We sent Cellebrite questions about our past investigation of Cellebrite abuses in Jordan. Cellebrite’s answers to that report, provided through public relations firm Centropy PR, included only vague descriptions of internal protocols about its commitments. Cellebrite did not specify the processes it may have in place to determine whether security practices in a particular country comply with international human rights or domestic law or provide details on Cellebrite’s own ethical criteria for vetting customers...

...We have sent additional questions to Cellebrite about this investigation and will publish any responses we receive from them...

In a statement to the Guardian, Cellebrite said it maintained a “rigorous process for reviewing allegations of technology misuse” and that it took “decisive action”, including licence termination, when credible and substantiated evidence is presented to the company.

“We do not respond to speculation and encourage any organisation with specific, evidence-based concerns to share them with us directly so we can act on them,” the company said.