The Protection of Critical Infrastructure Bill, 2024

Background

With the growth of Kenya's physical and virtual networks, there is an increasing need to safeguard facilities essential to the state's security, economic interests, and public safety. The Protection of Critical Infrastructure Bill, 2024, establishes a dedicated institutional framework to manage, coordinate, and protect these essential assets against threats such as terrorism, sabotage, cybercrime, and vandalism.

Key Provisions

• Critical Infrastructure Protection Committee: Established under Clause 5, this body consists of several Principal Secretaries (including Finance, Energy, Transport, and ICT), the Chief of the Kenya Defence Forces, the Inspector-General of Police, and representatives from the private sector and county governments. It is tasked with policy formulation and designating critical infrastructure.
• Critical Infrastructure Protection Secretariat: Established under Clause 16, this body serves as the technical arm of the Committee, headed by a Director. It is responsible for maintaining an integrated database of all critical infrastructure assets and managing registration (Clauses 20 and 21).
• Integrated Master Plan: Requires the Committee to consolidate governmental and private plans into an Integrated National Critical Infrastructure Master Plan to systematically guide and supervise infrastructure deployment across the country (Clause 27).

New Obligations

• Mandatory Insurance: Owners of critical infrastructure must obtain and maintain adequate insurance cover for their assets at their own cost (Clause 30).
• Service Continuity Plans: Owners must develop and demonstrate service continuity plans to the Committee to guarantee public services are maintained if the infrastructure is damaged or degraded (Clause 29).
• Cooperation and Reporting: Asset owners must collaborate on security measures, share planning updates, and immediately report any security breaches or potential threats to the Committee (Clause 33).
• Duty to Restore: Anyone who interferes with or disrupts critical infrastructure without authorization must immediately desist and restore the asset to its original standard of quality and functionality at their own expense (Clause 34).

Penalties

• Vandalism and Damage: Wilful, negligent, or unauthorized interference, vandalism, theft, or impairment of critical infrastructure carries a fine of up to KSh 10 million, imprisonment for up to 10 years, or both. The offender must also pay for the repair of the damaged asset (Clause 35).
• Incitement and Abetting: Attempting, threatening, conspiring, or inciting others to vandalize or interfere with critical infrastructure carries the same penalty of up to KSh 10 million, 10 years' imprisonment, or both (Clause 36).
• Obstructing Entry: Hindering or obstructing an authorized infrastructure owner from entering land to inspect, repair, or connect assets is punishable by a fine of up to KSh 100,000 for each day the obstruction continues (Clause 37).
• General Penalty: Any offence under the Act for which no specific penalty is provided is subject to a fine of up to KSh 10 million, imprisonment for up to 15 years, or both (Clause 39).