New York, September 10, 2025—The Committee to Protect Journalists is gravely alarmed by the installation of spyware on two Kenyan filmmakers’ phones while the devices were in police custody, and calls on authorities to drop a case against them and two other filmmakers and ensure that journalists are not further targeted for surveillance.
Forensic analysis by internet watchdog Citizen Lab at the University of Toronto found that commercially available FlexiSPY spyware was installed on the two phones on or around May 21, while the devices were in police custody, Citizen Lab senior researcher John Scott-Railton told CPJ.
The phones were seized on May 2, when police arrested documentarians MarkDenver Karubiu and Bryan Adagala, cinematographer Nicholas Wambugu, and graphic designer Christopher Wamae at a studio in the capital, Nairobi, on allegations of publishing false information, their lawyer, Ian Mutiso, told CPJ.
On May 3, the four were released without charge but four phones, a tablet, computers, and storage devices confiscated during the arrest were not returned until July 10, Mutiso said.
“The spyware would give the operators silent, secret access to all sorts of private business and information about their journalism,” Scott-Railton told CPJ, adding that their analysis was ongoing.
“The installation of spyware on Kenyan filmmakers’ devices while in police custody is outrageous and must be explained by authorities without delay,” said CPJ Program Director Angela Quintal. “Citizen Lab’s forensic analysis shows that journalists’ devices are not safe in the hands of Kenyan law enforcement agencies, which is alarming and further stains the country’s once-lauded reputation for press freedom.”
Police accused the filmmakers of involvement in the production of “Blood Parliament,” a BBC documentary that implicated Kenyan security personnel in the June 2024 killings of protesters.
The BBC said in May that the four “were not involved in any way in the making” of the documentary, a position echoed by Mutiso.
Mutiso told CPJ that the four filmmakers had appeared in court multiple times, without being charged, as authorities sought more time for investigations. A hearing due to take place on September 10 was adjourned until September 15, Mutiso said, adding that he had nevertheless submitted Citizen Lab’s findings to the court.
FlexiSPY markets itself for parents and employers to “know everything that happens” on a computer or phone, including monitoring messages, emails, and social media; recording calls; tracking device locations, website visits, and passwords; downloading photos and videos; and listening through a device’s microphone.
CPJ’s requests for comment via email to the police and interior ministry and via messaging app to interior minister Kipchumba Murkomen and police spokesperson Muchiri Nyaga did not receive an immediate response. CPJ’s email to an address listed on Flexispy’s website received what appeared to be an automated response that said the contact was an “unmanned inbox.”