The transnational security and surveillance doctrine adopted by authoritarian states in the East African bloc has gutted civil liberties, the rule of law and democracy in the region. These cross-border cloak-and-dagger missions led to the abduction of Uganda’s opposition doyen Kizza Besigye on November 16, 2024, in Nairobi, who was later renditioned to Kampala; South Sudan’s human rights lawyer Dong Samuel Luak & opposition leader Aggrey Idri, who were abducted in Nairobi on January 23 and 24, 2017, and despite their legal refugee status in Kenya, they were forcibly returned to Juba.
United Nations investigations and human rights watchdogs concluded that both men were executed three days later at an Internal Security Bureau training facility in Luri, Central Equatorial Province, in South Sudan.
Athorbey Al-Gaddhaffy-Dit Gue, who had spoken on corruption cartels in his country, was abducted in Nairobi in June 2026 and renditioned to South Sudan; Tanzanian activist Maria Sarungi Tsehai, a critic of her country’s President Samia Suluhu, was abducted by three armed men on January 12, 2025, and released four hours later as the Kenyan capital continues to gain notoriety as the abduction capital in the region. These individuals were surveilled both physically and digitally before their arrests, highly placed sources told Vox Populi.
Under the guise of national security, the bloc is sharing tactics and relying on a constellation of surveillance tools to target opposition politicians, human rights activists, and journalists, as well as anticipatory policing to nip potential youth-led protests in the bud.
In May 2025, Uganda’s Agather Atuhaire and Kenya’s Boniface Mwangi were abducted from a hotel in Dar es Salaam, Tanzania, held incommunicado, tortured and sexually abused. Atuhaire, who had travelled to attend the trial of Tanzania’s opposition leader, Tundu Lissu, a prisoner of conscience facing treason charges, told Vox Populi that what could have led to their arrests was a “tweet on the X platform from Boniface [Mwangi] about the deportation of Martha Karua [Kenya’s former justice minister and human rights lawyer]. He said that the murderous regime of Tanzania has deported Martha Karua on his social media account, X. He [Mwangi] recorded a video when they came to pick him up; the night before they took us, the security agents were at his door, and he said that the government of Tanzania kills people and makes people disappear, and this was played on [the Kenyan-based] Citizen TV. They first took him for interrogation.”
Atuhaire later attended court [in Dar es Salaam] and later provided updates on the court proceedings. This alerted their captors. “They returned with Boniface [Mwangi] looking for me at 2 pm; they checked CCTV cameras of the hotel and saw I was with Mwangi and claimed that I had Boniface’s gadgets. I think our governments may not have been part of this particular surveillance and abduction, but they were happy about our arrest. The government owes a duty of care to its citizens. Our governments should have demanded that we be taken through a lawful process [in Tanzania], and we should have been extradited.”
There is an existing commercial deal between global companies and security agencies in East Africa that have supplied these governments with similar malware and spyware equipment. The latest shipments to the region were delivered in 2025, and the trade data cited by Vox Populi was sourced from various third-party commercial data platforms. These platforms draw their aggregated data from official documentation such as customs records, bills of lading and shipping manifests, which they purchase from customs authorities.
Based on this dataset, four countries in the East African bloc, including Uganda, Kenya, Tanzania, Rwanda and their neighbour, Malawi, purchased similar malware.
Sayari, Circles Bulgaria Ltd, a subsidiary of NSO Group, which has a history of supplying spyware to the Kampala government, delivered two shipments to State House, Uganda, in 2025. In 2021, NSO Group supplied the Pegasus spyware to the Ugandan government, which was used to hack 11 iPhones belonging to US embassy staff based in Kampala. The hack elicited a backlash from the US government, which blacklisted the firm for acting contrary to U.S. national security and foreign policy interests, effectively barring American companies from exporting software or services to NSO Group without special permission.
On 27 August 2025, Circles delivered one shipment described as “portable automatic data processing machines” manufactured in and sent from Bulgaria, valued at Shs 4,163,620, the equivalent of $1,106.
A second shipment delivered by Circles on September 3rd, 2025, was described as “telephone sets including phones, four cellular networks, or four wireless networks”, manufactured in Vietnam and sent from Denmark, and valued at Shs 11,004,548, which is $2,923.
These procurements were delivered barely four months before the January 2026 presidential elections, which the opposition claims were a sham election, tainted by rigging and violence.
The Citizen Lab, a watchdog organisation, has indicated that Uganda has deployed telecom exploitation tools similar to those developed and sold by Circles to geolocate mobile phones on Utel Uganda, a government-owned phone company.
According to Sayari, on 6 January 2025, the Uganda Communications Commission (UCC) received a shipment from an Israeli firm, Cocnyte Technologies, described as “automatic data processing machine storage units. Given the shipment description and the UCC’s role as Uganda’s telecommunications industry regulator, this shipment suggests that it has likely procured (or at least sought to procure) products from the Israel-headquartered surveillance technology provider, Cognyte. Open-access data available on Trademo corroborates this shipment from Cognyte to the UCC.
According to Sayari, a US-based search engine, on 6 January 2025, ‘Q Cyber Technologies’ delivered a shipment to ‘Wickham Bros Ltd’, described as ‘Cisco Catalyst routers and other electric appliances’ for the Kenyan government. NSO Group has reportedly incorporated Cisco routers into their spyware deployment infrastructure. Furthermore, according to The Citizen Lab, both Pegasus and the Circles surveillance system appear to have been deployed in Kenya. It appears likely, therefore, that Kenyan authorities have continued to procure NSO Group products until at least early 2025, using Wickham Bros Ltd – a shipping firm – as an intermediary.
Sources in Nairobi who spoke to Vox Populi on condition of anonymity revealed that Kenyan security agencies often use International Mobile Subscriber Identity (IMSI) catchers, commonly known as stingrays, to intercept mobile communications and track locations, relying on telecom firms that provide metadata. Stingrays are buttressed by an extensive network of AI-enabled CCTV facial recognition cameras provided by Israel, which link directly to national civil registries. These tools, which imitate cell towers to trick mobile phones into joining the network, were critical in conducting abductions and enforced disappearances during and in the aftermath of the bread protests in June 2024. Barely a year before Kenya goes to the polls, there are fears that the surveillance dragnet will be used to target the opposition.
According to open-access data available on Tendata, Circles Bulgaria Ltd (‘Circles’) and Q Cyber Technologies Ltd (‘Q Cyber’) – both companies within the NSO Group corporate structure – delivered shipments to ‘an individual in Rwanda’ in December 2024. We could not confirm the specific identity of the recipient of these shipments; however, given that NSO Group claims only to sell to government agencies, and the Rwandan government has reportedly been one of the company’s customers, the recipient is likely to be an individual acting as an intermediary for the sale of NSO Group products to Rwandan authorities.
According to open-access data on Tendata, a third company, ‘Whitehats’, also delivered shipments to the same individual who is based in Kigali. Whitehats is identified by the search engine Tendata as a ‘competitor’ of Circles because it delivers products under the same HS Code as Circles and is also based in Bulgaria.
According to Sayari, on 17 December 2024, an entity called ‘Circles’ sent twelve shipments from Bulgaria to ‘Magiltech Company Limited’ in Tanzania. The shipments are all described as “storage and network devices”, categorised under HS Codes associated with data processing machines. Given the nature of the products being shipped from Bulgaria and the fact that Magilatech Company Limited (Magilatech) is a prominent local cybersecurity provider that recently won a tender with the Tanzanian Police Force, these shipments indicate that Tanzanian authorities may have procured or at least sought to procure surveillance technology from Circles Bulgaria Ltd in December 2024, with Magilatech acting as an intermediary.
Based on data gathered on the US-based search engine, on 6 November 2025, Oxygen Forensics Inc. delivered a shipment described as a ‘USB dongle’ to the ‘president’s office’ in Tanzania. Oxygen Forensics Inc. (‘Oxygen’) is a US-based company that develops and sells digital forensic tools, predominantly for law enforcement and government agency customers – similar to companies like Cellebrite, Magnet Forensics or MSAB, which can be used to crack phone passwords.
This shipment indicates that Tanzanian authorities – in particular, the President’s Office – may have procured or sought to procure Oxygen’s digital forensic tools in November 2025 to deal with the deadly protests after its October elections that resulted in the death of hundreds of protesters.
Between June 2023 and June 2025, Cognyte Technologies Israel Ltd delivered eleven shipments to Tanzania, ten of which were received by the ‘Tanzania Communications Regulatory Authority’ and one of which was received by the President’s Office & Cabinet Secretariat and was valued at $106,340. This consistent reported delivery of surveillance-related hardware over two years indicates a sustained commercial relationship between Cognyte and the Tanzanian Communications Regulatory Authority (‘TCRA’) until at least mid-2025. In addition, it appears likely that the President’s Office & Cabinet Secretariat in Tanzania procured or at least sought to procure technology from Cognyte in February 2024.
Between January and December 2025, ‘Cognyte Technologies Israel Limited’ delivered seven shipments to the ‘National Intelligence Service’ in Malawi. The shipments are collectively valued at $192,384.
This delivery of surveillance-related hardware throughout 2025 indicates a sustained commercial relationship between Cognyte and Malawi’s National Intelligence Service (‘NIS’).