A Sh4.7 million charge being imposed on public institutions for government domain and email security has come under scrutiny, with Saboti MP and People’s Renaissance Movement leader Caleb Amisi questioning how the cost was arrived at and who stands to benefit from the programme.
Amisi claims the charge could raise more than Sh1.89 billion if applied across government institutions, and has called for an explanation of the services covered, their market value and the process used to select the service provider.
The legislator said his concern was not with efforts to improve the security of government digital systems, but with the cost attached to the Whole-of-Government Domain and Email Security initiative.
“Today, I inform members of the public of a major scandal within government, overseen by the highest office in the land. It regards a scandal worth over Sh1.89 billion on cyber security maintenance,” Amisi posted on his X account on Tuesday.
He alleged that government institutions had been directed to pay Sh4.7 million each for the maintenance and protection of government domains and email systems.
“The government has since issued a directive to government institutions to each pay Sh4.7 million, totalling over Sh1.89 billion, ostensibly for maintenance of the government’s domain and email security. This is blatant theft of public money,” he added.
Amisi is now seeking details on how the Sh4.7 million figure was calculated, what institutions will receive for the money and whether the procurement process followed the law.
The issue comes as the government continues to push for stronger protection of official digital infrastructure. The Communications Authority of Kenya is responsible for cybersecurity as part of its mandate to develop and manage the country’s national cybersecurity framework.
The Authority also provides online services under the Whole of Government Domain and Email Security programme.
Government institutions have previously been encouraged to use .go.ke domains and official government email addresses as part of efforts to improve the security and management of official online systems.
In 2024, the ICT Authority and Kenya Network Information Centre entered into a three-year agreement that included efforts to promote the use of .go.ke domains and email addresses across government.
The government has also directed critical information infrastructure to use .ke domains and take steps to protect the security and reliability of their domain systems.
Amisi’s concerns have emerged weeks after a cyberattack on President William Ruto’s official website, an incident that brought fresh attention to the security of government digital platforms.
The website, president.go.ke, was compromised on July 18, with attackers replacing its homepage with unauthorised messages and demanding five bitcoins as ransom.
The government confirmed the breach and temporarily restricted access to the website as cybersecurity teams moved to contain the incident and carry out forensic analysis.
The site was later restored. Government officials said there was no evidence that sensitive data had been accessed, although the attack raised concerns about the protection of official government digital systems.
Amisi has alleged that the incident was being used to support the new cybersecurity expenditure, although he acknowledged that he had not provided evidence for the claim.
“I have reliable information to believe that the story about the State House website being hacked into in July was a hoax meant to pave way for this scandal,” the legislator maintained.
The MP wants institutions to be given a detailed breakdown of what the Sh4.7 million payment covers and whether the cost reflects the actual value of the services being offered.
“The public deserves to know what services are covered by this charge, what their actual market value is, who determined the cost, whether alternative providers were considered, and whether the procurement process fully complied with the law.”
He also questioned how the money collected from the institutions would be shared, alleging that the Communications Authority would retain only 15 per cent while the remainder would go to a private entity.
“Most importantly, who stands to benefit from these extraordinary costs? I am reliably informed that although the Communications Authority is the recipient of these fees, they are only retaining 15% while the rest is being transferred to a private entity. The question is was this private entity chosen after a competitive bid?”
Amisi said the alleged cost would be particularly difficult for public universities and other institutions already struggling with financial pressures.
“They are struggling to pay staff, settle suppliers, maintain facilities and provide quality education to thousands of Kenyan students. Against this background, we must ask: Is this really a priority at this particular moment?”
He has called on the Head of Public Service, the Communications Authority, relevant government agencies and Parliament to provide answers on how the Sh4.7 million charge was determined.
Amisi said there was a need to protect government systems from cyber threats, but argued that such efforts should be backed by clear costs and proper accountability.
“Kenya needs stronger cybersecurity, but cybersecurity cannot become a justification for unexplained or excessive expenditure. At a time when Kenyans are being asked to tighten their belts, every shilling of public money must be accounted for.”
The ICT Authority already provides government domain registration and email-hosting services, including secure email under .go.ke domains. Its shared government email platform has also historically supported several government agencies.
The questions raised by Amisi therefore focus on whether the new security requirements are for additional services, stronger protection of existing systems or a change in how government digital services are managed.
They also raise questions about whether the Sh4.7 million cost can be supported by a clear assessment of the services being provided, transparent procurement and value for money.