The East African bloc is in the throes of a surveillance panopticon, which is antithetical to democratic values and imposes a curtain of restrictions on freedoms, including the right to privacy and other civil liberties.
Studies have indicated a correlation between countries with less freedom and declining democracy and a high prevalence of surveillance. Freedom House recently released its flagship Freedom in the World 2026 report, entitled The Growing Shadow of Autocracy, in March 2026. The report is instructive when it comes to understanding the state of affairs in the East region, where some countries are hybrid authoritarian states, and others are gravitating towards totalitarianism.
In the region, Tanzania scored a significant deterioration in rights and liberties in 2025, losing seven points and sinking further into the Not Free category, according to the Freedom House report, which ranked it at 28 out of 100. Kenya, which is the highest ranked in the region, declined from an overall score of 51 to 49 out of 100; Uganda remained stagnant at 33 out of 100; Rwanda remained unchanged at 21 out of 100. Others included the Democratic Republic of the Congo (DRC) at 18 out of 100; Burundi ranked 13 out of 100; and Somalia scored 8 out of 100. South Sudan brought up the rear with a score of zero.
Many of the aforementioned poorly ranked East African states rely heavily on surveillance to control the masses. They pull this off by creating a climate of fear to sustain power through the cloak of surveillance systems, which are ubiquitous and buttressed with other integrated data systems in the form of anticipatory policing.
Spyware is perhaps the most intrusive and insidious form of surveillance. Uganda has been one of the most eager states to embrace some of the most potent forms of spyware, including Pegasus from the Israeli spyware firm, NSO. But the procurement and acquisition of intrusive surveillance technologies such as Pegasus remains outside the ambit of the law.
In 2010, the Uganda Parliament passed the Regulation of the Interception of Communications Bill three days after the deadliest twin bombings carried out by Al-Shabaab insurgents in Kampala that left 76 people dead, and the president assented to the law on August 5, 2010. Whereas lawful interception meets the threshold or is within the ambit of the Interception of Communications Act, modern spyware, which grants arbitrary intrusion, does not conform to what was anticipated in the law.
Sweeping mandate
Apart from the Interception of Communications Act and the Anti-Terrorism Act, amended in 2022, the government has not drafted a new bill to cater for the capabilities of sophisticated spyware in Uganda. The two Acts were intended to intercept highly sensitive communications in the course of their transmission through telecommunications, radio or postal systems. The timing of the laws was meant to deal with terrorism, deemed then the greatest global threat to security in the post-Cold War era.
Earlier, Uganda had passed the Anti-Terrorism Act in 2002, which gave the internal affairs minister powers to designate members of the Uganda Peoples’ Defence Forces (UPDF), the Uganda Police Force (UPF), or internal security organisations to conduct surveillance. These personnel had a broad mandate to intercept letters, telephone calls, faxes, emails and postal packages, conduct electronic surveillance and access bank accounts.
Eight years after enacting the Anti-Terrorism Act, Parliament proposed the more specific surveillance law, the Interception of Communications Act. Its purpose is to provide for the lawful interception and monitoring of certain communications in the course of their transmission through telecommunication, postal, or any other related service or system in Uganda.
RICA under the spotlight
The text of the Interception of Communications Act is clear and specific to communications intercepted in the course of their transmission. This piece of legislation did not anticipate next-generation spyware tools.
Modern spyware is quite versatile and intrusive. It could grant a hacker access to information already stored on a phone, including photographs, documents, contacts, location information, microphones, cameras, or communications before they are transmitted, and this is beyond the Regulation of Interception of Communications Act.
The Regulation of Interception of Communications Act also provides for broad national-security provisions. Could these provisions be interpreted to authorise technologies such as spyware whose capabilities go substantially beyond the interception of communications contemplated when the law was enacted?
There are fears that the breadth of these provisions could lead to an assault on civil liberties and freedoms beyond what is demonstrably acceptable and demonstrably justifiable in a free and democratic society. Section 5 of the Regulation of the Interception of Communications Act permits interception where gathering information concerning an actual or potential threat to public safety, national security or a national economic interest is necessary.
Terrorism broad brush
Section 9 (1) (b) of the Anti-Terrorism Act introduces a dangerous provision, which could be applied arbitrarily to punish journalists, activists and politicians. It reads, “Any person who establishes, runs or supports any institution for publishing and disseminating news or materials that promote terrorism commits an offence and shall be liable on conviction to suffer death.”
Section 9 (2) of the Act establishes another category of potential violators. It reads, “Any person who, without establishing or running an institution for the purpose, trains any person for carrying out terrorism or publishes or disseminates materials that promote terrorism commits an offence and shall be liable on conviction to suffer death.”
Kizza Besigye, Uganda’s opposition doyen who remains incarcerated in Luzira Maximum Prison on treason charges after he was abducted in Nairobi, Kenya’s capital, in November 2024 and renditioned to Uganda, has previously been charged on terrorism charges, which allows security personnel to conduct surveillance on him.
However, in 2005, a High Court judge, John-Bosco Katutsi, dismissed rape charges against Besigye in a judgement that has often been cited regarding the extent to which a state may frame those it perceives as political adversaries.
“The evidence before this court is inadequate even to prove a debt; impotent to deprive of a civil right; ridiculous for convicting of the pettiest offence; scandalous if brought forward to support a charge of any grave character; and monstrous if to ruin the honour of a man who offered himself as a candidate for the highest office of this country,” Justice Katutsi opined in his judgement while dismissing the charges against Besigye.
Justice Mulenga ruling
One of the most misinterpreted articles of Uganda’s constitution is article 43, which limits fundamental and other human rights such as the right to privacy provided in article 26 and other freedoms. What this means is that security personnel can conduct a raid on your home if they have established probable cause that you are hiding explosives in your house. If the explosives are found, it therefore means that Article 26 of the Constitution, which provides for the right to privacy of a person, home, and other property, was not violated.
However, Article 43 (2) stipulates that public interest under this article shall not permit political persecution or detention without trial, and Article 43 (2) (c) goes further and prescribes that any limitation of the enjoyment of the rights and freedoms must be beyond what is acceptable and demonstrably justifiable in a free and democratic society or what is provided in this Constitution.
Article 43(2)(c) of the Constitution was interrogated in the 2004 landmark decision at Uganda’s highest appellate court in the case of Charles Onyango Obbo & Anor v Uganda. The decision struck down the criminalisation of the publication of false news under section 50 of the Penal Code Act. But beyond annulling this draconian provision, it went further to determine what acts constitute what is demonstrably acceptable and demonstrably justifiable in a free and democratic society.
The Supreme Court decision of 2004, whose lead judgement was authored by Justice Joseph Mulenga, is instructive in determining what may pass the litmus test for what is deemed demonstrably acceptable and justifiable in a free and democratic society.
Justice Mulenga postulated that whereas the provision in Article 43 of Uganda’s Constitution, clause (1), is couched as a prohibition of expressions that “prejudice” rights and freedoms of others and public interest, the constitutional protection of one’s enjoyment of rights and freedoms does not extend to two scenarios, namely, where the exercise of one’s right or freedom “prejudices” the human right of another person and where such exercise “prejudices” the public interest.
Justice Mulenga proffered that, in the wording of article 43 (2), the framers of the Constitution were concerned about a probable danger of misuse or abuse of the provision in article 43 (1) under the guise of defence of public interest.
In addition, they provided in that clause a yardstick by which to gauge any limitation imposed on the rights in defence of public interest, which, in Justice Mulenga’s lexicon, is described as “a limitation upon the limitation”.
In essence, this Supreme Court decision denounced the arbitrary application of laws such as the Interception of Communications Act and the Anti-Terrorism Act under the guise of defence of public interest.
Falls foul of litmus test
For instance, the surveillance of a government critic under the pretext of the suspect posing a potential threat to public safety, national security or a national economic interest under section 5 of the Regulation of the Interception of Communications Act, may not pass the litmus test the Supreme Court set for what is deemed as ‘demonstrably acceptable and demonstrably justifiable in a free and democratic society’.
The legal crisis and limited jurisprudence on surveillance laws extend across sub-Saharan Africa, where statutes were drafted around concepts such as interception of telephone calls, SMS messages, internet communications and traffic data.
By the time Uganda’s surveillance laws were enacted, applications such as WhatsApp, Telegram and Signal had not yet gained traction among mobile phone users. Uganda, which practises common law, accepts persuasive authorities from other common law countries and finds them useful in adjudicating cases, though they are not binding.
According to the Columbia University watchdog, Global Freedom of Expression, in 2024, the United States Northern District of California court, in the case of WhatsApp Inc. v NSO Group Technologies Ltd, held that Israel’s NSO Group could not claim sovereign immunity as a private company and found that its Pegasus spyware exploited vulnerabilities in WhatsApp to monitor over 1,400 individuals. WhatsApp accused the NSO Group of using the spyware to hack into its platform and monitor targets without their consent.
The district court reasoned that sovereign immunity did not apply to a private entity like the NSO Group, even if its actions were on behalf of a foreign government. It further determined that the NSO Group’s use of the spyware violated U.S. laws—particularly the Computer Fraud and Abuse Act (CFAA) and the California Comprehensive Computer Data Access and Fraud Act (CDAFA)—and was a breach of contract.
The Court granted summary judgement on the CFAA and CDAFA claims—finding unauthorised access to WhatsApp’s California-based servers—and on the breach of contract claim due to the NSO Group’s reverse engineering of WhatsApp software—in violation of its terms of service.
The NSO Group’s defence on personal jurisdiction and evidence sufficiency was rejected, and the court imposed evidentiary sanctions for discovery noncompliance. The applicability of the WhatsApp Inc and NSO Group case as a persuasive authority could definitely enrich Uganda’s jurisprudence in the area of surveillance.
Dearth of adequate safeguards
The African Commission has called for restrictions on privacy and other fundamental freedoms to be necessary and proportionate and consistent with international human rights law.
In the 2021 South African case of AmaBhungane Centre for Investigative Journalism NPC and Another v Minister of Justice and Correctional Services and Others; Minister of Police v AmaBhungane Centre for Investigative Journalism NPC and Others, the Constitutional Court held that South Africa’s Regulation of General Interception of Communications and Provision of Communication-Related Information Act, 2002, was unconstitutional in important respects because it lacked adequate safeguards for the right to privacy. The case arose after journalist Stephen Patrick Sole’s communications were intercepted.
The court identified deficiencies, including lack of adequate safeguards in the ex parte interception process; inadequate protection of information obtained through surveillance; inadequate safeguards concerning post-surveillance notification; insufficient protection for legally privileged communications; and the absence of an adequate legal basis for bulk surveillance.
Several provisions in Uganda’s Regulation of Interception of Communications Act and Anti-Terrorism Act lack adequate safeguards and may not pass the constitutionality test set in Article 2 of the Constitution. The article establishes the Constitution’s supremacy and provides that any law or custom that is not consistent shall, to the extent of the inconsistency, be void. These provisions need to be challenged in the Constitutional Court, which, under Article 137 of the Constitution, has original jurisdiction to determine such suits through public interest litigation.