In a 1789 letter to Jean-Baptiste Le Roy, one of the Founding Fathers of the United States of America, Benjamin Franklin, wrote of the new Constitution as, “now established, and has an appearance that promises permanency; but in this world nothing can be said to be certain, except death and taxes.” The iteration on the inevitability of death and taxes had been made earlier by Daniel Defoe in, The Political History of the Devil (1726) and Christopher Bullock (1716) in, The Cobbler of Preston who penned these words, “You lye, you are not sure; for I say, Woman, ’tis impossible to be sure of anything but Death and Taxes.”
In the modern state today, around the globe, one can safely add state surveillance (read the deployment of spyware) to the list of things one can be certain of as a citizen. That states do intelligence gathering using a combination of human intelligence and technology is a reality of life for as long as the state, as we understand it today, and indeed the older forms of ordering, organising and management of human society that preceded the modern state, have existed. As technology advances, so has the capability of the modern state advanced in the realm of intelligence gathering tactics.
Finding the right balance
At the heart of this technology-driven advancement is the use of spyware, described by the International Justice Clinic (IJC) at UC Irvine School of Law as, “a type of malicious software that enables attackers to secretly infect a targeted individual’s device. It can then access information on the device, or even take full control of the device without authorization.”
Additionally, phone-tapping which a few years ago was considerably costly for smaller economies like Uganda and was probably reserved for persons high up on the state’s list of persons-of-interest, is now a walk in the park for governments intent on listening to telephonic conversations of interception targets.
This presents a number of challenges and concerns from the human rights perspective, among which is the attack on the right to privacy, dignity of the citizen and sometimes, safety. To address these concerns, the international benchmark is for states to put in place due process mechanisms to avert abuse of surveillance and guarantee the freedoms, rights and safety of citizens. So important is due process that interception of communication is not only regulated but also, a price is tagged for any transgressions by both state and non-state actors
.
Under international law, state surveillance is governed by safeguards that protect the right to privacy with Article 12 of the Universal Declaration of Human Rights (UDHR) and Article 17 of the International Covenant on Civil and Political Rights (ICCPR), putting in place the irreducible bare-minimum that any interference ought to be lawful, necessary, and proportional. This helps to balance security with human rights as the guiding principles such as transparency and independent oversight thwart, at least in the ideal situation, potential excesses and abuse of power. There is, of course, a necessity to realign these international human rights instruments with the realities of the fast-paced and fundamentally changing digital age. But, be that as it may, they are still a rock-solid foundation as a compass for safeguarding human rights and freedoms in the age of surveillance.
The rigour of due process
The conduct of the Ugandan state goes a long way to demonstrate why due process is important and must be jealously protected in the use of spyware in particular and surveillance in general.
The US-based Ugandan scholar and the East African Centre for Investigative Reporting (EACIR) board chairperson, Dr. Moses Khisa, wrote in a June 14, 2025 op-ed piece that “world over, state authorities engage in intelligence gathering. Often, this entails mobile and digital communications surveillance. To do digital surveillance or wiretap a private citizen, there has to be probable cause and sufficient suspicion of possible wrongdoing.”
Even then, he rightly argued that “there has to be a legal and administrative process that includes a stamp of a judicial officer in sanctioning the tapping, intercepting and recording of private communications. Quite obviously, there is scarcely any due process and proper procedure in Uganda when it comes to surveillance and intelligence gathering.”
Several reports such as the 2015 report by Privacy International, For God and my President: State Surveillance in Uganda, which revealed how officials of the Chieftaincy of Military Intelligence (CMI) and Uganda Police Force (UPF), “acting on presidential orders, used an intrusion malware, short for malicious software, to infect the communications devices of key opposition leaders, media and establishment insiders. The secret operation was codenamed Fungua Macho (‘open your eyes’ in Swahili)”. There is no evidence to show that such operations were subjected to the rigour of due process as stipulated in the law as the judiciary, the ideal moderating force in the exercise of state power and citizens’ enjoyment of rights and freedoms, is often ignored.
Dr. Khisa’s most recent observation was informed by conduct of actors in the Ugandan security apparatus deliberately leaking telephone conversations of some lawyers, journalists, human rights activists as well as political leaders through social media platforms like X (formerly Twitter). The obvious interpretation of these actions is that the state had not only undertaken surveillance without due process but also demonstrated wanton impunity in showing the extent to which due process did and does not matter. By making these conversations public, the rule of law was flung off the window. One such conversation, published online in 2025 through social media users whose accounts are linked to the state’s propaganda machinery, was a telephone conversation between presidential candidate Robert Kyagulanyi and the German ambassador to Uganda. Another involved calls between journalists and activists and their female ‘friends’, clearly to scandalise them and put their marriages in jeopardy as well as calls between lawyers and their
By dumping on a public platform phone conversation recordings, Dr. Khisa wrote, “ostensibly meant to be intelligence material, it appears the goal is to sow fear and anxiety, to demoralize citizens from engaging in normal and healthy civic discourse by freely interacting electronically
Additionally, the state’s actions showed that any pretence about due process was now all lost as rogue elements within the system can access intelligence-gathered information and play with it on social media to achieve whatever motive.
What the law states
Uganda’s Regulation of Interception of Communications Act, 2010 was passed by parliament to ensure that interception, by means of a telecommunication system or radio communication system of interception targets (meaning the person whose communications are to be or are being intercepted), was done within the limits and controls of due process.
Under Section 4 of the Act, an application for the lawful interception of any communication may be made by the following persons— (a) the Chief of Defence Forces or his or her nominee; (b) the Director General of the External Security Organisation or his or her nominee; (c) the Director General of the Internal Security Organisation or his or her nominee; or (d) the Inspector General of Police or his or her nominee. Such an application can only be made by an authorised person to a designated judge to issue a warrant for the interception of any communication.
The law requires that the applicant appraises the court of such details as; the person or customer, if known, whose communication is required to be intercepted, the service provider to whom the direction to intercept the communication must be addressed, if applicable, the nature and location of the facilities from which, or the place at which, the communication is to be intercepted, if known, full particulars of all the facts and circumstances alleged by the applicant in support of his or her application, the period for which the warrant is required to be issued and any other information which may be required by a designated judge to make an appropriate decision.
A warrant is then issued by a designated judge to an authorised person if there are reasonable grounds for a designated judge to believe that an offence which may result in loss of life or threat to life has been or is being or will probably be committed, an offence of drug trafficking or human trafficking has been or is being or will probably be committed, the gathering of information concerning an actual threat to national security or to any national economic interest is necessary, the gathering of information concerning a potential threat to public safety, national security or any national economic interest is necessary or there is a threat to the national interest involving the State’s international relations or obligations.
More safeguards
So deliberate was the legislature in the bid to ensure that citizens’ rights are protected in the process of surveillance that the law provided for due process even in the case of urgency or existence of exceptional circumstances. A designated judge may permit an oral application by an authorised person if the designated judge is of the opinion that it is not reasonably practicable to make a written application, but in such a case a formal application shall be lodged within 48 hours with the designated judge.
Furthermore, under the Uganda Communications Act, 2013, which regulates telecommunication services, any operator of a communications service or system, or employee of an operator of a communications service or system who unlawfully intercepts any communication between other persons sent by means of that service or system commits an offence and is liable on conviction to a fine or imprisonment not exceeding five years or both. In fact, under that Act, any person who without lawful excuse, intercepts, makes use of or divulges any communication except where permitted by the originator of the communication, commits an offence and is liable on conviction to a fine or imprisonment not exceeding five years or both.
Again, this is a bold statement by the legislature that is in accord with international human rights instruments and best practices—surveillance and the use of spyware must be amenable to, actually subjected to rigorous due process and violators of these due process procedures and requirements pay a price as per law established.
The decline in the rule of law in states where democratic consolidation is yet to be achieved, therefore, has the net effect of endangering not only the freedoms and rights of citizens but also their safety in the age of surveillance where use of spyware is a new normal. Democratic space can only shrink as state surveillance is done outside the law. Lawlessness and surveillance, especially when done by people with immense power, is a recipe for anarchy and the only fair, logical and lawful thing that ought to be done is to follow due process for it is the right thing to do and the requirement under international law, of actors in civilised nations.