BY KAKWENZA RUKIRABASHAIJA
African governments break the law against their own citizens and file the paperwork under the guise of national security. They are rarely troubled for it. The public does not completely know how its privacy has been dismantled, and it does not know that the instruments of dismantling arrive from or are sponsored by the global north in crates, with licence agreements, warranty terms, and a week or so of training for the operators.
Nothing in the apparatus is homegrown. The forensic suites are built in Israel, in Canada, in Germany, and sold to ministries that have never met a warrant they could not manufacture overnight. In the countries of manufacture the same software answers to a court of law, answers to disclosure rules, to inspectorates, to oversight committees, to a strong and an independent press that litigates/investigates. When the same is exported to the global south, it lands stripped of every restraint that made it tolerable at home. The code is identical, but the supervision is not.
I believe that that is the transaction, and the transaction is the offence. I also believe that ignorance is not our difficulty because some of us know our rights but recitation is worthless against an extraction performed on a phone or computer you were beaten into unlocking, and that gadget had been surrendering your privacy for years before the first blow landed. It reads your messages, your movements, your purchases, your photographs, your contacts, and the conversations you believe are private among friends. The industry harvests all of it and sells it to data companies or governments without asking. The poor African states like Uganda arrive afterwards with gloves and a lab number and collect what the capitalists have already gathered.
I received the prosecution disclosure bundle several months after I had been released on bail and had fled into exile. My lawyer, Eron Kizza, placed it before me, and at first glance that is exactly what it was. Witness statements. Forensic reports. Subscriber records. Court orders. Screenshots of my tweets. Police forms and laboratory reports from the Cyber Crime Unit of the Uganda Police Force (UPF). Every page had a stamp of RESTRICTED. Every document bore a reference number, a signature or a date. Nothing announced that I held one of the clearest records of political persecution I had ever seen.
The prosecution believed it was disclosing the evidence on which it would convict me. I read it differently because the file disclosed far more about the state than it disclosed about me. We lawyers often develop strange habits. We rarely begin with conclusions. We begin with dates, because a witness may forget what he said yesterday, but a document cannot change the day it was signed. So I ignored the prosecution summary and read the bundle from its earliest page. Very quickly I saw that this investigation had walked a path no honest one walks.
Laundering brutality into procedure
The investigators were not trying to establish whether an offence had been committed. They had answered that question long before they opened the file. Their task was narrower, and more sinister. They set out to prove that the X (then Twitter) account @KakwenzaRukira was mine, that I had authored the tweets accurately describing despot Museveni and his son General Muhoozi Kainerugaba, and, above all, to discover who was bankrolling me to do it.
That last object is the master key to the whole file, and the state wrote it down in its own handwriting. The court order authorising the search of my phone, sworn before a magistrate at Nansana, lists the investigators’ requirements. Requirement (a), to establish that the device tweeted the offending content. Then requirement (b), and I quote the state’s own words, “To establish from the twitter or facebook inbox messages who sponsors or motivates the suspect.”
The Ugandan security establishment could not conceive that criticism and description of the ruling family might arise from a free mind. Someone had to be behind it. Someone had to be paying Kakwenza. The premise of the whole operation was that dissent is a purchased commodity, and the mission was to find the receipt. They did not find it, because it did not exist. The forensic examiner performed an advanced logical extraction of my phone and, more sweepingly, a cloud acquisition of my entire Twitter, WhatsApp, email and Facebook accounts.
The report tallies the yield. Fifty thousand two hundred and thirty-eight results from the account. One thousand six hundred and sixty-nine call logs. Eighteen hundred contacts. Four thousand six hundred images. My messages, my documents, my browsing, my location history, the whole sediment of a modern life, dredged and parsed by two of the most powerful forensic engines on earth. And after all of it, the report’s findings run to three sterile paragraphs establishing one fact only, that the account was mine and I posted the tweets. There is not one syllable about a sponsor.
The state deployed its whole technical arsenal to prove a conspiracy, and its own laboratory disproved it. The examiner, without meaning to, authored the most authoritative acquittal in the file. He looked for the paymaster and found a novelist with a Tecno phone. There is a bitter comedy in the state’s own exhibits at this point. The report faithfully reproduces my Twitter profile, which described me as a novelist and winner of the PEN Pinter Prize for International Writer of Courage. The prosecution thus certified, in its own evidence, that the author it was straining to prove a criminal was an internationally honoured writer, decorated precisely for the courage of his words. They annexed the award as proof of guilt. Rarely has a state so thoroughly documented that the thing it prosecuted was literature.
Consider next what the bundle so carefully omits, because the omission is the crime. The report opens at the laboratory door. It describes the phone arriving for examination already accessible, and it proceeds with immaculate professionalism from there. Software versions recorded to the decimal. Hash values computed to guarantee the copy’s integrity. The chain of custody logged, signature by signature, from one officer to the next. Reading those pages, you could almost believe you were examining the work of a constitutional democracy. And then you remember the one question the file never answers—how was the phone unlocked?
The password was not volunteered, it was taken out of me in the Special Forces Command dungeon, between beatings, with pliers and wire as the instruments of discovery. The forensic report begins the story at the exact moment the violence ends. It records everything that happened to my phone and nothing that happened to my body. This is not sloppiness but a design. The paperwork was designed to begin after the torture, so that the torture would leave no trace in the record, so that a clean scientific document could be laid over a filthy criminal act like fresh paint over a bloodstain.
The fruit of a poisoned tree
The bundle is a masterclass in how bureaucracy launders brutality into procedure. The law has a settled answer to this, and it is not a soft one. The prohibition on torture in Article 24 of Uganda’s Constitution is made absolute and non-derogable by Article 44. Uganda enacted the Prevention and Prohibition of Torture Act in 2012. It ratified the Convention against Torture, whose Article 15 commands every state to ensure that any statement established to have been made under torture shall not be invoked as evidence in any proceedings.
The principle is ancient and it is structural. A court that feeds on the fruit of torture ceases to be a court and becomes a continuation of the torture chamber by other means. The House of Lords put it with finality in A v Secretary of State for the Home Department (No. 2), holding torture evidence inadmissible because its admission would degrade the integrity of the administration of justice. The European Court of Human Rights reached parallel conclusions in Jalloh v Germany and in Gäfgen v Germany.
My unlocked phone, and every byte the examiner drew from it, is fruit of the poisoned tree. The elegant report is not evidence of my guilt but evidence of theirs. And the contamination is not confined to the password. The privilege against self-incrimination, guaranteed by Article 28 of Uganda’s Constitution, exists to stop the state compelling a person to become the instrument of his own prosecution. My tortured body surrendered the key that opened every door the examiner then walked through. In law, the poison travels with the fruit. A search made possible only by torture does not become lawful because it was done tidily, any more than a house burgled with a stolen key becomes lawfully entered because the burglar wiped his feet.
Now I want to raise the question this file forced upon me, the one that reaches far beyond my own prosecution, and I will pose it as a professor of law would pose it to a seminar. The soldiers supplied the violence, the telephone company supplied my private life, but the instruments that turned my seized phone into a searchable exhibit were built, sold and licensed by two private corporations, an ocean away, in countries that call themselves democracies. The extraction was performed with Cellebrite UFED Touch 2 and Physical Analyzer, products of an Israeli firm. The cloud acquisition used Magnet AXIOM, a product of a Canadian firm. Their logos, in effect, are stamped on the machinery of my persecution. What is their responsibility for what was done with their tools in a Ugandan dungeon’s aftermath?
The reflexive answer is that a toolmaker is not liable for the misuse of the tool, that a company selling a lawful product to a lawful police force cannot answer for every abuse downstream. That answer is a century out of date. The law of business and human rights has moved decisively beyond it. The United Nations Guiding Principles on Business and Human Rights, endorsed unanimously by the Human Rights Council in 2011, establish that every enterprise bears an independent responsibility to respect human rights, a responsibility over and above the duty to obey local law. That responsibility expressly includes the duty to avoid causing or contributing to abuses, and, crucially, to prevent harms directly linked to the company’s products by its business relationships, even where the company itself does nothing wrong in the ordinary sense.
Human rights due diligence
The mechanism is human rights due diligence. Before a firm puts a device-cracking tool in the hands of a security agency, it must ask what that agency does, whom it targets, and whether the country’s courts convict on confessions squeezed from prisoners. Uganda’s record on all three was not obscure. It was published annually, in the State Department’s own human rights report, in Amnesty briefings, in the very newspapers that carried the photographs of my ruined back.
This is not merely aspirational soft law drifting free of consequence. It is hardening into binding domestic obligations across the democratic world. France’s Duty of Vigilance Law of 2017 imposes an enforceable duty on large companies to identify and prevent human rights harms throughout their operations and relationships, and French courts have entertained suits against corporate giants under it. The European Union has adopted its Corporate Sustainability Due Diligence Directive, extending mandatory diligence across the single market.
The courts, too, have cracked open the old immunity of distance. In Nevsun Resources v Araya, the Supreme Court of Canada, a Canadian court, ruled in 2020 that Eritrean workers could pursue a Canadian company in Canadian courts for complicity in forced labour committed abroad, holding that customary international law can ground a civil claim. Even the United States Supreme Court, while narrowing the Alien Tort Statute in Kiobel v Royal Dutch Petroleum, affirmed the underlying premise that corporations do not stand wholly outside the reach of accountability for grave abuses overseas. The direction of travel is unmistakable. The corporate veil is no longer thick enough to hide a company from what its products do to a dissident’s body.
And here the argument ceases to be theoretical, because one of these very companies has already conceded the principle with its own conduct. In February 2025, after Amnesty International documented that Serbian authorities had used its extraction tools to unlock the phones of a journalist and an activist and then implant spyware, Cellebrite publicly announced that it had stopped the use of its products by the offending customer. The company said, in its own statement, that it assesses the countries it does business with and reviews indices of democratisation, human rights and the rule of law. Read that admission against my file.
If misuse against a journalist and an activist in Serbia warranted suspension, then use against a novelist tortured into surrendering his password in Uganda cannot fall below the threshold of concern. The company has told the world it has both the capacity to know how its tools are used and the power to withdraw them. Once a duty is conceded in Belgrade, it cannot be disowned in Kampala. The only question left is whether these firms will apply their stated standard consistently, or reserve their conscience for the cases that make headlines in Europe.
The doctrine of complicity
I do not argue that Cellebrite or Magnet held the pliers, no, they did not, and the distinction matters. But the doctrine of complicity has never required that the accomplice strike the blow. It asks whether the party knowingly contributed to the wrong, whether it provided means it had reason to know would be turned to abuse, and whether it exercised the diligence its knowledge demanded. A firm that arms a repressive security service with the power to turn every seized phone inside out, in a country whose torture of critics is a matter of public record, and does so without the safeguards its own industry now professes, does not escape moral and increasingly legal responsibility by pleading that the abuse happened at one remove.
Vicarious and contributory responsibility exist precisely to reach the party who profits from harm while keeping his hands clean. In the political economy of modern repression, the torturer and the toolmaker are partners, and the law is slowly learning to name them both. The chain of hands that reached into my life is longer than any charge sheet admits. A soldier held the pliers, a telecom clerk released my registration data, a foreign engineer wrote the extraction software, a magistrate signed the order—not one of them appears as an accused, yet the investigation could not have functioned without every link. That is the defining feature of contemporary repression. It is a supply chain, its cruelty distributed so widely that each participant persuades himself his portion was too small to matter.
By the time I reached the final page of the bundle, I had stopped feeling like a defendant. I felt like a reader who had stumbled on the internal correspondence of an authoritarian government, the memoranda it never meant an outsider to see. The file showed, step by fastidious step, how a state converts a man’s opinions into a criminal exhibit. Torture unlocks the phone. The record begins after the torture, foreign software renders the private life legible, a telecommunications company hands over the identity, a magistrate signs the order and a prosecutor prepares the charge. Each institution performs its small, deniable function, and the sum of their innocence is a man in a dungeon. The brutality that set the machine in motion vanishes from every page, leaving only clean forms and confident findings.
The prosecution meant this bundle to bury me but it exhumed the state. The documents establish, beyond any argument, that the investigation targeted speech protected by Article 29 of Uganda’s Constitution and by every human rights instrument Uganda has signed. They establish that the state searched exhaustively for a sponsor and found a lone writer. They establish that the whole apparatus was deployed to enforce a provision of the Computer Misuse Act that the Constitutional Court would later strike down as unconstitutional, which means every stamp and signature in that file served a law that, in the eyes of the Constitution, never lawfully existed. And they establish the durable weakness of every authoritarian bureaucracy. It believes paper can conceal injustice. In truth, paper preserves it.
I closed the file with strange composure. The men who tortured me were certain they had erased their work. They had in fact signed it, dated it, stamped it RESTRICTED, and handed a certified copy to my lawyer. One day a tribunal that answers to the law rather than the ruler will read that file exactly as I read it, and the state’s own evidence will change sides.