Anyone who photographs and shares a Kenya Certificate of Secondary Education (KCSE) paper can be identified, and so can the officials who let it happen. That was the message from Education Cabinet Secretary Julius Ogamba on Wednesday, 4 November 2026. He said the Kenya National Examinations Council (KNEC) now serialises scripts and embeds anonymised indicators, so a leaked image can be linked to the candidate, the examination room and the centre it came from.
Ogamba spoke while addressing the media and security officers during a monitoring tour of State House Girls Senior School in Nairobi.
What Ogamba said
Leaks can be traced almost immediately. The CS said the markings on each script make it possible to pinpoint the source, and that the responsibility reaches beyond one student.
Because of the anonymous indicators in the script, we are able to tell almost immediately that it was this student in this room in this centre. And so because somebody must have dropped the ball, it means the whole team in that room might end up facing the law. That’s why we are encouraging us not to allow any such activity to take place.
Hiding is no longer an option. He said the serialisation and anonymisation leave little room to deny where an image originated.
“It’s now not possible to say this didn’t come from this place because the script is serialised and is anonymised so even the students themselves get to be known who they are because now, we can be able to pick you almost immediately.”
A DCI team works alongside KNEC. Ogamba disclosed that the Directorate of Criminal Investigations has assigned officers to the council.
“We’ve been given our own DCI team that’s allocated to KNEC and they’re able to come and pick you almost immediately if you are involved. So, pass the message that it’s no longer the way it used to be that you can hide behind somebody or something.”
Officials must explain phones in exam rooms. He questioned how a candidate could have a phone in a room when officials are supposed to frisk everyone at the entrance.
You’ll have to explain why, for example, a student had a phone inside the classroom because when you are supposed to frisk them before they pass through, so how come that was not done? It means there’s somebody who was involved.
Ogamba said the rules apply to everyone, himself included: “Even us, we keep our phones as examinations are going on as required by KNEC.” He closed with: “We are watching, big brother is watching.”
How serialised scripts change the picture
KNEC has not published how the markers work, and for security reasons that is understandable. The practical effect, as the CS describes it, is that a photographed question paper carries more information than its questions. It points back to where that copy was issued.
The approach is not new. In October 2024, Ogamba said investigators would use serialised papers to find the source of a leak and that malpractice would be pursued individually, rather than by cancelling whole schools’ results. The 2026 warning puts much heavier emphasis on the officials in the exam room.
The 2026 KCSE context
- The main written papers opened on Monday, 2 November 2026. Practical and oral papers started earlier, on 19 October.
- The examination runs until 20 November 2026.
- A record 1,048,355 candidates registered, the first time KCSE candidature has passed one million. In 2025 it was 995,860.
- More than 10,000 centres are administering the exam.
- This is the second-last KCSE under the 8-4-4 system, with the final cohort expected in 2027.
Larger candidature and more centres mean more places where a phone can slip through, which helps explain the tone of the warning.
The Bungoma arrest
Ogamba’s remarks came as authorities stepped up efforts against leaks following the arrest of a student in Bungoma County over allegations of sharing exam papers online. Police reports identify the suspect as a 24-year-old Kibabii University student, allegedly found with 2026 KCSE papers shared on Telegram before he could pass them on to others. An arrest is not a conviction, and the case will be decided in court.
Investigators have also reported suspected malpractice incidents in Garissa and Wajir counties.
What the law says
KNEC’s notices cite Sections 27 to 40 of the KNEC Act, No. 29 of 2012. The main penalties are:
| Offence | Section | Maximum penalty |
|---|---|---|
| Possessing or revealing exam content without lawful authority | 27 | Up to 10 years’ imprisonment, a fine of up to KSh 2 million, or both |
| Unlawfully disclosing papers, altering scripts or changing marks | 28 | Up to 5 years, a fine of up to KSh 1 million, or both |
| Wilfully damaging exam material | 30 | Up to 5 years, a fine of up to KSh 5 million, or both |
| Impersonating a candidate | 31 | Up to 2 years, a fine of up to KSh 2 million, or both, plus a ban of up to 3 years from KNEC exams |
Separately from criminal charges, a candidate found guilty of malpractice can have results for the affected subject cancelled. Where irregularities are widespread, a centre’s results can be nullified.
What candidates should do
- Do not photograph papers, even to ask a friend for help or to post in a group.
- Do not buy or forward “leaked” papers. Many are fake, and scammers target anxious candidates and parents.
- Keep phones out of the room. KNEC rules prohibit personal phones for candidates and exam personnel.
- Report approaches. If someone offers you the paper, tell your head teacher or a security officer.
What teachers, supervisors and invigilators should do
The CS has placed exam personnel directly in the frame. Anyone handling scripts should:
- Frisk candidates before they enter the room, as KNEC requires.
- Lock away their own phones during sessions.
- Follow KNEC’s script handling and counting procedures exactly.
- Report any suspected breach immediately.
What happens next
The exams continue until 20 November. Expect continued monitoring of social media platforms where real and fake leaks circulate, and further updates from the Ministry of Education and KNEC on arrests and investigations. Treat unverified claims on social media with caution.
Read Also: KCSE 2026 Week 3 Rules: What KNEC Has Told Exam Centres
Frequently asked questions
Can a leaked photo be traced to one student?
Ogamba says yes, because scripts are serialised and carry anonymised indicators. KNEC has not explained the technical details.
Will a whole school be punished for one candidate’s cheating?
The CS has said since 2024 that malpractice will be handled individually. KNEC regulations still allow a centre’s results to be nullified where widespread irregularities are established.
Can teachers and parents be prosecuted?
Yes. Section 27 applies to any person, and Ogamba has said officials who facilitate malpractice will face the law.
Are the papers circulating online genuine?
Often not. Authorities have repeatedly flagged fake papers sold online. Possessing or sharing suspected exam material can still carry legal consequences.