The social appropriation of spyware in Uganda is best framed through the lens of mobile communications. This, perhaps, explains why, between 2023 and 2024, the Uganda Communications Commission (UCC), which runs point on the communications sector in the East African nation, “received 13 shipments from entities within the corporate group of Rohde & Schwarz (‘R&S’), [an] Israel-headquartered surveillance technology provider.”
A firm [name redacted] that provides almost real-time intelligence on the pervasive and unregulated trade in surveillance technologies, in a file note that Vox Populi has seen, disclosed that the equipment meant to extract and exploit data through backdoors included a portable receiver (HS Code 8517.71). Other products were: a multi-channel power probe (HS Code 9031.49), a radio communications tester (HS Code 9030.40), an EMI test receiver (HS Code 9030.84) as well as a signal and spectrum analyser (HS Code 9030.40).
This was, by no means, the last brush with a spyware industry known to ruthlessly target change agents like investigative journalists, opposition movements, and rights activists that unsettle, if not threaten, powerful incumbents in banana republics. In the second half of 2025, months before Ugandans went to the polls, Circles Bulgaria Ltd, a subsidiary of the Israeli cyber-intelligence firm NSO Group, reportedly made two deliveries to Nakasero State Lodge, one of the abodes of Yoweri Museveni, Uganda’s octogenarian president.
“On 27 August 2025, Circles delivered one shipment described as ‘portable automatic data processing machines’ (HS Code 8471.30), manufactured in and sent from Bulgaria […] One 3 September 2025, Circles delivered a second shipment described as ‘telephone sets incl.phones [sic] 4 cellular networker 4 wireless netwoks [sic]’ (HS Code 8517.13) manufactured in Vietnam and sent from Denmark,” the file note reads.
“[Uganda] has not previously been reported to have procured or deployed Circles surveillance technologies—however, [Uganda] is suspected of having used NSO Group’s Pegasus spyware as recently as 2021, and recent reporting by The Citizen Lad indicates that [Uganda] has deployed telecom exploitation tools (like those developed and sold by Circles) to geolocate Utel Uganda users,” the file note adds.
Partner in crime?
Utel operates as a full-spectrum National Telecom Operator, having replaced the defunct and heavily indebted Uganda Telecom Limited (UTL) in February of 2022. But, as Gawaya Tegulle revealed in a 4 May 2025 op-ed piece, it is not the only telco which the Government of Uganda (GoU) retains a dark grip on.
“Now that the military has made everything public, let’s talk about it. On March 7, a very senior lawyer in Kampala sent me a message: ‘Buddy, are you okay?’ He also sent me the tweet on X by the now acting Defence spokesperson, Col Chris Magezi. The tweet had a recorded telephone conversation between me and my close friend and home boy, Dr Patrick Wakida […],” Tegulle wrote in the Monitor Publications Limited’s now defunct Sunday title.
“I listened to the nearly five-minute audio, It was genuine. And harmless too. Patrick did call me on November 11, 2024. It was not a WhatsApp call. No sir. It was a regular call on my MTN line[, a private telco]. We talked about a recent event in Kibuku, Bugwere, where, in the presence of President Museveni, he’d been formally presented to the people as an NRM member.
I said I was happy for him and that I’d been to his home to bid goodbye to his little boy before departing for the United States. A very basic, banal conversation; but Col Magezi, who’s actually a nice fellow, seemed determined to make a mountain out of a mole hill,” he further wrote.
Evidently, this whole surveillance apparatus is not about to come shuddering to a stop in a pretty spectacular and ominous way. Not any time soon, anyway. To understand how the mobile phone—smartphone to be precise—came to be installed with so much relevance in surveillance tasks, Tegulle’s other lived experiences are quite instructive.
A lost innocence
In many respects, it feels like a lost innocence. The smartphone and its extraordinarily powerful computing power was not carried in the pockets of a quintessential journalist back then. A lot more stock was put in doing the legwork. Journalism looked like and certainly felt like a long and exhausting process. Still, it is a period that some look back on with a sentimental fondness. Writing in his Weekend Monitor column during May of 2026, Tegulle tersely described pulling off an assignment that required him to offer readers a blow-by-blow account of “the survivors of the October 17, 1988, Uganda Airlines crash in Rome.”
“The air crash survivors were 19 (out of 52),” he wrote of the ill-fated flight, adding of the premium place on interpersonal skills, “It was a tough job, alright, given that we didn’t have mobile phones at that time (only a handful of well-to-do folks could afford mobile telephony in 1997). There was no social media, since even the concept of internet was only filtering through to Uganda like a rumour. One had to move from person to person and place to place to get information.”
It is not like the legwork stopped. Entirely. It will forever be indispensable to the trade. Hopefully, at worst, and arguably, at worst. This is why amongst the hundreds of people that squeezed into Kyadondo Rugby Football Club to watch the FIFA World Cup final in July of 2010 were, you’ve guessed right, journalists. A great deal of them, actually. Phillip Corry, one of the bunch of nosy hacks that were watching the final, remembers that they ended up being shoehorned into the rear space on the club’s well-manicured pitch.
“That’s how most of us ended up surviving the bomb blasts,” he further recalls.
Uganda’s 9/11
Bomb blasts because there were two of them. Most because Stephen Tinka, who worked the graveyard shift at a local radio station (Vision Voice that has since rebranded to XFM), was mortally wounded by shrapnel from one of the improvised explosive devices (IEDs). Seventy-five other lives would end up being lost. When Tinka took his last feeble breath at the country’s largest public hospital in the Kampala suburb of Mulago, his fellow journalists had long descended on Kyadondo. Photographers’ cameras flashed. Looking back at some of their work, one senses in their images both the passage of time and the piercing stillness of a catastrophe that remains with us. One image captures rows of white plastic garden chairs, some in which corpses lay. Another shows the substantial damage that shrapnel inflicted on one of the rugby club’s water reservoir tanks. It flew everywhere. Far and wide.
The aforesaid images, most of which were shot by Norman Katende, formed a haunting subtext in the Government of Uganda’s uncompromisingly robust push to have provisions on lawful interception or wiretapping added to the country’s law books. This came against the backdrop of a lucky break that law enforcement had in the process of human intelligence gathering post the bomb blasts. A fugue of car horns rang out from the dusty roads of the southern outskirts of Kampala. At one of the lodgings in Makindye that serve as sites of passing assembly and repositories of gossip and news, a female minder had called in a suspicious handset that had been left abandoned.
The handset would go on to play a pivotal role in the investigative effort. A joint operation involving security agents and a privately owned telco soon installed three suspects—Idris Magondu, Hussein Hassan Agad, and Muhammed Aden Addow—as surveillance targets. This came after the phone’s serial number acted as a gateway to the surreptitious activities involving the trio. The partnership with the telco provided state actors with unprecedented capacity for panoptic real-time surveillance of the three suspects, all Kenyan nationals.
While Uganda’s Anti-Terrorism Act (ATA) would prove to be of great utility, there were—per government functionaries—many ambiguities that illustrated the limits within which law enforcement had to work during crime-fighting episodes. Another legislation was needed, the government functionaries added, to blunt the pushback on police surveillance by state and non-state actors. It was against that background that the Regulation of Interception of Communications Bill received a new lease of life in July of 2010. Amama Mbabazi, Uganda’s Security minister at the time, made it abundantly clear that the absence of a wiretapping law handicapped law enforcement’s efforts.
Enter the RICA law
Three days before the IEDs were detonated on 11 July 2010 at the Ethiopian Village Restaurant in Kabalagala at around 10.45 p.m. and at Kyadondo Rugby Football Club at around 11.30 p.m., the Regulation of Interception of Communications Bill was read for a second time in the House.
Three years earlier, in 2007, the Bill hit an unexpected speed bump when it faced severe pushback over rights abuses. As well as the Bill’s vague grounds for interception, the danger posed by its ambiguousness was matched, if not eclipsed, by a dearth of independent oversight. This was typified by the Security minister being vested with wide-ranging discretionary powers.
In the build-up to the second reading of the Bill on 8 July 2010, Mbabazi went to punishing lengths to show that fears over the Executive being vested with unchecked surveillance powers had been decisively addressed. A premium was placed on the time-honoured requirement of independent judicial warrants. Speaking on the floor of parliament during a 13 July 2010 plenary session, the first since the twin bombings, Mbabazi made clear that it was not a time “for scoring political points” but rather “a time to unite.”
Earlier, Prof. Morris Ogenga-Latigo, then the Leader of the Opposition in Parliament (LoP), had—in a move that belied his genteel upbringing—taken the gloves off. Key functionaries in the top echelons of law enforcement became the punching bag for Ogenga-Latigo as he yearned for both answers and retribution.
“We also totally reject and condemn the callous attempt by the Inspector General of Police, Maj. Gen. Kale Kayihura, to shift the blame for the bombings on the management of the two places bombed, and by Hon. Amama Mbabazi, Minister for Security, on the delay in passing the Interception of Communication Bill,” the LoP submitted, adding, “We hold these two people fully responsible for the security lapses and demand that they do the only honourable thing and resign their positions.”
There would be no resignations. Instead the ruling National Resistance Movement (NRM) party used its overwhelming majority in the House to defuse what was, at any rate, a painfully uncomfortable situation. The State used just the right mix of contrition and charm to gradually get back on the rails. Firstly, Matia Kasaija, the junior Interior minister at the time, thanked “the people of Makindye for their vigilance and co-operation that enabled the Police last evening to recover a potentially dangerous explosive device suspected to be of the same type as those that went off last Sunday night.” Had the IED gone off, he added, “it would have caused similar or more catastrophic damage.”
SIM card registration
Then, hinting at the things to come, Stephen Mukitale, an NRM lawmaker, submitted thus: “I also want to pray that immediately, the telecom companies customise all SIM [Subscriber Identity Module] cards. All SIM cards, which cannot be identified by their owners, should be deactivated and from now on, only those who produce their identities should be given SIM cards. When we go elsewhere, what happens if you want a SIM card? You have to present a photocopy of your passport. Why do we make it a laissez-faire issue? People are using SIM cards to con others and they drop them immediately after buying them. That control is required.”
In years to come, the mobile phone—or, more accurately, mobile communications—would become the centrepiece of the Regulation of Interception of Communications Act (RICA). This was after the legislation was passed by the House on 14 July 2010 and assented to by President Yoweri Museveni on 5 August 2010. While, before its passing, state actors insisted that the legislation would make surveillance a crime-fighting rather than a political practice, the democratic closures RICA has willed into existence say otherwise. The law has helped state actors ramp up their surveillance capabilities to limit citizen agency.
With Uganda’s reputation as a net importer of surveillance technologies intact, the prying eyes of surveillers have become an inescapable part of Ugandans’ social existence. The mobile phone has become the main avenue through which the government is able to carry out anything from dataveillance to liquid surveillance. Telcos, which hold vast amounts of sensitive data on people in Uganda, and giant tech companies, like Huawei and ZTE, which dangle surveillance technologies to autocrats, have ended up being caught in the crosshairs of the public domain of surveillance overreach.
Surveillance overreach
The first telltale signs of surveillance overreach arrived in March of 2012 when mandatory SIM card registration threatened to link a person’s offline identity to their mobile activities. The elimination of anonymity that Mukitale vociferously pined for days after the twin bombings in July of 2010 found renewed purpose in RICA. Section 9 of the legislation made telcos duty-bound to ensure that subscribers registered their SIM cards. They would do so by disclosing comprehensive personal data. A monitoring centre that Section 3 of RICA established would find its conceptual weight in telcos whose intercepted communications the former relied on for sustenance.
In 2025, state actors had the temerity to leak some of the intercepted communications. It was not just Tegulle that found himself sucked into a morass. Fellow journalists Timothy Kalyegira and Solomon Serwanjja had their intercepted communications leaked. Ditto Robert Kyagulanyi Ssentamu, alias Bobi Wine, Uganda’s opposition leader, and Jimmy Spire Ssentongo, a philosophy lecturer at Makerere University. The purchases that the state had made from Circles Bulgaria Ltd that year immediately paid off ahead of the 2026 poll that President Museveni would go on to win. The chilling effect on dissenting voices in the East African nation was palpable. And continues to be to this day. At the cost of democracy.