Kenyan Filmmakers Targeted with FlexiSPY Spyware Tracking Messages and Social Media

The investigation reveals that commercially available FlexiSPY spyware was clandestinely installed on devices belonging to Kenyan filmmakers while they were in police custody, prompting renewed concerns over press freedom and government overreach. Forensic analysis by the Citizen Lab at the University of Toronto confirmed two phones were infected on or around 21 May, months after authorities seized the devices during an arrest on 2 May.

The filmmakers—documentarian MarkDenver Karubiu, Bryan Adagala, cinematographer Nicholas Wambugu, and graphic designer Christopher Wamae—were arrested at their Nairobi studio over alleged false reporting linked to a BBC documentary, though they were released without charge on 3 May and the authorities retained several devices until they were returned on 10 July, according to the filmmakers’ lawyer.

The spyware, marketed for parental and employer surveillance, can monitor messages, emails and social media, record calls, track locations, capture passwords, download media and even eavesdrop via microphones, a capability that Citizen Lab says could give operators silent access to private journalism.

Angela Quintal of the Committee to Protect Journalists described the findings as outrageous and highlighted the risks to journalistic confidentiality, with the case prompting calls for accountability amid concerns about state surveillance and press freedom. As hearings resumed with a date set for 15 September, civil society groups urged a full inquiry into how and why state actors deployed commercial spyware against uncharged filmmakers.