In July this year, investigative journalist, Canary Mugume of NBS Television, was attacked on his way home from work. It was late at night when a group of men approached his car, pulled him out, and assaulted him, focusing their blows on his face. They took only his mobile phone, leaving behind his laptop and other valuables.
“It looks like that was their goal, just to take the phone because I had the laptop in the car and it wasn’t taken and they seemed to be interested in the phone and also destroying my face,” Mugume told The Independent on Aug.9. He says this was the second time he had lost his phones in such a manner. “Both times, the phones seemed to be the main target.”
Two months earlier, in May this year, Mugume tweeted a warning he received via email from his phone manufacturer of a possible hacking attempt into his iPhone.
“Apple sent this notification to me, indicating that I am being targeted by a mercenary spyware. Most of these are used by Governments to hack into the phones of journalists, high-profile figures and activists. They last sent this (report) in 2021; there’s a pattern – electoral season,” Mugume tweeted on May 5 this year, complete with a screenshot of the message from Apple.
For journalists like Mugume, phones are more than personal devices. They hold months or years of sensitive reporting work, not forgetting valuable contacts, photographs, and documents. Losing them to targeted theft, especially in the middle of a story project, can mean the loss of an entire investigation.
Targeted surveillance and spyware
The recent attacks against Mugume are part of a broader pattern documented in a new country report by Unwanted Witness, a civil society organisation that advocates for internet freedoms and digital rights, particularly the right to privacy, digital identity, digital inclusion, and freedom of expression.
The study titled: “Surveillance/Spyware: An Impediment to Civil Society, Human Rights Defenders and Journalists in East and Southern Africa,” details how surveillance in Uganda and other countries, including Rwanda, Kenya, Ethiopia, Malawi, South Africa and Zimbabwe, has evolved into a complex system combining broad monitoring with targeted spyware campaigns. This sophisticated machinery is not only affecting journalists like Mugume but also civil society actors, human rights defenders, and opposition politicians in these countries.
The report not only analysed the impact of surveillance and spyware on human rights defenders, journalists, lawyers and activists with objectivity and accuracy, but it also utilised desk research and stakeholder interviews. It further assessed the legal and policy framework of the countries under focus.
According to the report, civil society, human rights defenders, and journalists play a very critical role in highlighting government excesses in the countries under review. These particular groups targeted in this report are very vital for democracy because they advocate for the rights of the citizens in these countries, the report reads in part.
“They foster accountability, inclusive governance, and, unfortunately, while they are at it, they do face repression and restrictive laws that impact their work,” Freda Nalumansi Mugambe, the research and advocacy lead at Unwanted Witness, said during the country report launch in Kampala on Aug.4.
The report found that unchecked surveillance is not only eroding privacy but it is also curtailing free expression, promoting fear, self-censorship, disrupting advocacy, and exposing activists to harassment.
Nalumansi said surveillance is not necessarily a bad thing because “we are all concerned about our national security as a country or as countries,” but citizens are concerned when the surveillance becomes unchecked. “This unchecked surveillance has broader consequences, especially when it comes to the misuse of personal data,” she said.
“There is a massive collection of personal data by these different tools, and at the end of the day, this leads to discrimination, persecution of some people, abuses, especially against those who are marginalised.”
She added: “We’re seeing an increasing government-led surveillance with the adoption of sophisticated surveillance tools in the form of general surveillance and spyware technologies that have been used to target dissent, journalists, and human rights defenders, especially in jurisdictions where we have authoritarian regimes.” This, Nalumansi said, is different from the general surveillance that targets a huge population at any particular time and in places like roads, which is a common trend in most of the East African countries.
In Uganda, the report documents the chilling effect these measures have had on civil society. It highlights how NGOs are being closed, suspended, or forced to disclose sensitive information. It discusses how journalists like Mugume are facing harassment, arrest, or exile. Some, unfortunately, have resorted to self-censoring to avoid reprisals.
Civil society organisations, too, have reported demands from security agencies to hand over sensitive donor information or participants’ lists from trainings and meetings. Those who have shifted to having their activities carried online have also discovered that online activities, too, are monitored. Some have shifted operations online, only to find digital spaces are equally monitored, as phishing attacks and malware infections are increasingly common. Other CSOs have resorted to operating semi-clandestinely, avoiding publicity to protect staff and beneficiaries, the report notes.
Expanding surveillance apparatus
Over the past decade, the Ugandan government has invested heavily in surveillance technology, citing security concerns. For instance, the US$126 million Huawei Safe City project has seen installation of hundreds of CCTV cameras with facial recognition capabilities across Kampala Metropolitan Area – Kampala, Wakiso and Mukono districts –all linked to the Uganda Police Force’s “Command Centre.”
The government has also introduced digital number plates capable of real-time vehicle location tracking, mandated biometric SIM card registration linked to national IDs, and expanded social media monitoring to identify online critics.
Every Ugandan mobile phone user is now required to register their SIM card with a national ID, including fingerprints. Combined with social media monitoring, this database gives security agencies unprecedented power to identify, track, and target critics. These tools, experts say, can access private calls, messages, emails, and location data, often without the target’s knowledge. In other instances, some of those targeted receive hints, thanks to the sophisticated phones.
According to the Unwanted Witness report, spyware tools such as Pegasus, FinFisher, and IMSI catchers have been deployed to infiltrate specific targets’ devices, extracting private messages, emails, and location data, often without the victim’s knowledge.
The report alleges that in 2018, Huawei experts assisted in hacking opposition leader Robert Kyagulanyi’s (Bobi Wine) WhatsApp and Skype accounts, leading to his arrest and torture. During the 2021 elections, surveillance cameras were used to track Bobi Wine’s movements, while police tapped his phone and detained members of his campaign team.
A similar system was reportedly used in November, last year, to track veteran opposition figure Kizza Besigye and his aide, Obeid Lutale, who were arrested in Nairobi, Kenya, and returned to Uganda to face treason charges. The two have been in prison since awaiting court hearing of their case. Observers fear that the same playbook is likely to be deployed in the run-up to the 2026 general elections.
The laws that make it possible
According to the report, Uganda operates under a hybrid regime- a blend of democratic processes and a steadily tightening grip of authoritarianism-marked by crackdowns on dissent, protests, and online expression, often through expansive surveillance.
This surveillance is underpinned by a web of laws that, while framed as safeguarding national security, they often leave wide openings for abuse. The Anti-Terrorism Act, first enacted in 2002 and amended in 2017, authorises the monitoring of terrorism-related activities but has also been used to track civil society organisations and political activists. Another law, the Regulation of Interception of Communications Act of 2010, permits phone tapping and other interception measures with limited, opaque judicial oversight.
The Uganda Communications Act of 2013 mandates SIM card registration, creating a database that can be leveraged for state surveillance. The Computer Misuse Act criminalises vaguely defined online offences, a provision human rights lawyers say is frequently deployed against journalists and critics of the government.
The Data Protection and Privacy Act, passed in 2019, was seen as a step toward safeguarding personal information. However, the report notes, its silence on national security operations effectively shields such activities from scrutiny, leaving those targeted by surveillance without legal recourse.
Experts like Nalumansi say that although in theory these tools could bolster public safety, in practice, the country’s oversight mechanisms remain weak, and the legal definitions of “national security” are so broad that they can encompass peaceful dissent or public criticism. As such, the country’s surveillance framework not only enables state monitoring but also risks eroding civil liberties under the guise of security.
Surveillance of citizens is illegal
Dr. Solomon Asiimwe (PhD), a professor of Security and International Studies at Uganda Martyrs University, Nkozi, notes that the surveillance of citizens is, in fact, illegal. However, he says the real challenge lies in the weakness of oversight institutions, particularly Uganda’s Parliament. He says that intelligence services are not permitted to follow citizens without a warrant. “There are clear procedures for this, and any country that claims to be democratic must avoid underhand methods. Security is only one of the ideals that citizens cherish,” Dr. Asiimwe told The Independent on Aug. 8.
Citing the Regulation of Interception of Communications Act, 2010, he says that if there is suspicion a citizen is engaged in subversive activities, security agencies must obtain a warrant from a judge, with a clearly defined scope and timeframe for the surveillance. “The security services must state how long they will carry out the surveillance and the specific information they seek to gather,” he explained. “The problem,” he added, “is that our oversight institutions—across Africa, and Uganda in particular—are very weak.”
Dr. Asiimwe states that although security services often claim that navigating the legal processes can be lengthy and burdensome, potentially risking national security, it is also crucial to recognise that this should not infringe on citizens’ fundamental rights. He adds that intrusive methods of citizen surveillance are dangerous and, therefore, not everyone should have access to this technology. “Security is not for the state; it is for the people, and if it’s going to violate citizens’ rights, then the citizens would rather not have that kind of security,” Dr. Asiimwe said.
Privacy on paper, surveillance in practice
Uganda’s 1995 Constitution guarantees protection against unlawful searches and interference with correspondence. The Data Protection and Privacy Act extends these protections into the digital space, theoretically safeguarding citizens in an era of rapid technological change.
But in practice, national security exemptions, weak enforcement, and limited digital literacy leave the public exposed. To make the situation worse, few citizens have the resources to legally challenge surveillance, court cases are rare, and when abuses are uncovered, consequences for violators are minimal.
Lamex Omara Apitta of the Uganda Human Rights Commission warns that such unchecked practices come at a cost. “State surveillance often carried out without judicial oversight undermines both trust and legality,” he said during the report launch, adding that: “Without faith in the privacy of their communications, citizens become less willing to engage in activism, attend protests, or speak freely online.”
Omara says Article 27 of the 1995 Constitution also guarantees protection against unlawful search, seizure, and interference with a person’s home, personal life, and correspondence. But in recent years, he says, the right to privacy has acquired new dimensions in the digital age. “With the rapid growth of social media, mobile technology, and internet use, our private lives are increasingly vulnerable to surveillance, data breaches, and misuse of personal information.”
“Today, we live in a world where almost everything we do, what we say, where we go, and who we talk to, is being tapped in one way or another. This generation is more exposed to privacy risks than ever before, and that makes legal protection not just important, but urgent,” he says.
Omara says while the Data Protection and Privacy Act of 2019 was a major step forward, regulating how personal information is collected, stored, and used, and giving Ugandans the right to access, correct, and control their data, implementation has been weak. He says many citizens, institutions, and even some public agencies remain unaware of their roles and responsibilities under the law.
“The law is only as effective as its application,” he says. “It is our duty as human rights defenders and legal professionals not only to interpret and enforce these rights but also to advocate for stronger oversight, public education, and institutional accountability. We must strike a balance between protecting national security and upholding individual rights,” he said.
“Privacy is not a privilege; it is a right. It is foundational to freedom of expression, human dignity, and democracy. Protecting privacy is not about hiding wrongdoing, it is about respecting the dignity of the people we serve. It is our collective duty to uphold that trust through transparency, security, and accountability.”
Govt must respect international protocols
Going forward, Unwanted Witness urges the Ugandan government to reform surveillance laws to meet international human rights standards, establish independent oversight bodies, and prohibit spyware use against civil society actors.
It also calls on technology providers to reject unlawful data requests and increase transparency. The organisation warns that without urgent reforms, surveillance will continue to be weaponised for political control, undermining democracy and silencing critical voices.
“There’s a need to assess these national frameworks against the compliance with international human rights standards. We know that most of our countries have signed and ratified several key human rights instruments,” the report notes.
“And as such, we have obligations as countries, as states, to ensure that we do implement and we do comply with these international standards, especially as we make efforts to domesticate these instruments. So these national laws must be in tandem with the international standards that we’ve signed and ratified.”
Choosing to stay
For investigative journalist Canary Mugume, the idea of leaving journalism has been raised many times by friends and family, especially after facing repeated attacks. “I have thought about it so many times,” he told The Independent. “I could just go and live a private life. But I also know that people rely on me for the information they use to make decisions about their lives.”
Looking ahead to the 2026 general election campaign coverage, Mugume admits the coming months weigh heavily on his mind. “I’m not worried about now,” he says. “I’m worried about the weeks and months ahead. It’s going to become extremely intense, and that worries me a lot, and it worries my family.”
Faith, he says, helps him face the uncertainty. “I’m leaving everything to God. But at the back of my mind, I know that safety and security begin with me, so I’m doing whatever I can to remain safe. Still, I know anything can happen. I think I worry more about my family than I do about myself,”