1.1 The Uganda Police Force
and Electronic Crime Countermeasure Unit…………………………………………………… 4
(i) Composition………………………………………………………………………………………….. 6
(ii) Summary……………………………………………………………………………………………….. 6
2.0 Areas of concern explored…………………………………………………………………………….. 7
(a) Privacy issues………………………………………………………………………………………….. 7
(b) Cases of concern…………………………………………………………………………………….. 9
2.1 Conclusion…………………………………………………………………………………………………………11
2.2 Recommendation…………………………………………………………………………………………………11
Acronyms
CID Criminal Investigations Department
HURINET-U Human Rights Network Uganda
HRNJ Human Rights Network for Journalists
ICT Information Communication Technology
ISACA Information Systems Audit and Control Association
UPF Uganda Police Force
1.0 Introduction
Policing in Uganda is increasingly undergoing various shifts and dynamics to catch up with the changes in technology. The continued manifestation of new forms of crime instigated by the emergence of new technologies has tasked the institution of police to modernize policing activities by acquiring new skills and capabilities to counteract these new developments. In this regard, the Uganda Police Force has sought to improve the ambit of its crime investigations by forming new structures and specialized units to undertake the task of investigating and curbing crimes that are detrimental to the security of Ugandans whether originating from domestic or international circles.
One such development is the creation of the Electronic Crime Counter Measure Unit of the Uganda Police Force. This report explores the mandate of the Unit as well as its role in policing.
1.1 The Uganda Police Force and Electronic Crime Counter Measure Unit mandate of Uganda Police Force.
The Uganda Police Force (UPF) is a state institution established under Article 211 of the 1995 Constitution of the Republic of Uganda;[1] there shall be a police force known as Uganda Police Force and such other police forces as parliament may by law prescribe.[2] Article 212 of the Constitution grants the UPF specific mandate of protecting life and property and protecting law and order as well as detecting and preventing crime.
In addition to the above mandate, [3]the UPF has a wide range of powers as prescribed under the Police Act; Powers to investigate, search, arrest, and detain and powers to use lethal force.[4]In the execution of their mandate, however, Article 211 of the constitution mandates UPF to be professional, disciplined, and competent and to exercise restraint in carrying out their duties.
The Electronic Crime Counter Measure Unit (the Unit) is a component of the Economic Crimes Department of the Criminal Investigation Directorate of the UPF.
According to sources within the Unit, the functions of the Unit fall under the general mandate of the UPF but with a specialized function of detecting and investigating computer/ electronically generated crimes.
Under the UPF’s constitutional mandate of “protecting law and order, detecting and preventing crime,” UPF established the Unit in 2011 after Parliament passed the Computer Misuse Act, 2011 but without public awareness. The Unit investigates crimes purportedly committed using electronic gadgets such as computers, smartphones and online platforms including, Facebook, WhatsApp, Instagram and Twitter.
As far as we are aware there is no publicly available information on the Unit’s mandate and functions. This raises concerns that the Unit has been allowed to operate in a complete regulatory and legal void.
The lack of publicly available information, raises questions as to the legal basis for the Unit’s operations. During our visit to the Unit’s office we saw charts hanging on the walls, outlining the Unit’s mandate which include; handling computer misuse offences such as the unauthorized modification of computer material, unauthorized access, and access with intent to commit or facilitate commission of offence.
The hand-written charts further show that the Unit oversees the implementation of the Computer Misuse Act 2011. They reveal that the Unit undertakes most of its operations in liaison with other departments of the UPF and the Media Monitoring Centre under the Uganda Communications Commission (UCC).
(i) Composition of the Unit
During our research, we were informed that the Electronic Crime Counter Measure Unit is made up of personnel drawn from various Directorates of the Uganda Police Force. These include computer experts from the Police’s Directorate of Information Communication Technology (ICT), detectives from the Directorate of Criminal Investigations (CID) as well as forensic experts from the Department of Forensics. The question however is, to what extent does the Unit adhere to the established standards of democratic policing most especially the doctrine of respect for human rights and the rule of law?
(ii) Summary
We understand that the Unit handles offenses as provided for in the Computer Misuse Act 2011.[5] These offenses are largely grouped into three categories:
The computer being the “object” of a crime in which the perpetrator targets the computer itself by unlawfully accessing it. The crime consists of attacks on a computer or a system, destruction or damage of computerized services.
The computer forming the “subject” of a crime, either as the physical site of the offense or as the source of some form of loss or damage. This category includes launching of viruses and related attacks with a purpose of damaging or jamming websites and computers of institutions and organizations.
The computer serving as the “instrument” used to commit traditional crimes in cyberspace. This encompasses offenses like cyber-fraud, online harassment, and child pornography.
2.0 Areas of Concern explored
(i) Privacy issues
Privacy is a qualified fundamental human right enshrined in numerous international human rights instruments. [6]It is protected under the 1995 Constitution of the Republic of Uganda.
Article 27 stipulates that:
(1) No person shall be subjected to;
(a) Unlawful search of the person, home or other property of that person; or
(b) Unlawful entry by others of the premises of that person.
(2) No person shall be subjected to the interference with the privacy of that person’s home, correspondence, communication or other property.
Following from the above, the right to privacy is central to the protection of human dignity and forms the basis of any democratic society. It also supports and reinforces other rights, such as freedom of expression, information and association.
Privacy and Data Protection Sections 79 and 80 of the Communications Commission Act, 2013 criminalize infringing privacy and provide for the punishment of unlawful interception and disclosure of communication. Section 8 of the Computer Misuse Act, 2011 also upholds individuals’ right to privacy of communications.[7] It provides for the safety and security of electronic transactions and information systems, and criminalizes unauthorized access to computer systems and data.
The Uganda Police Force is required as it undertakes its function of upholding the Constitution to respect the right to privacy of Ugandans, and any interference with this right must be provided for by law, necessary and proportionate to the pursued.
The key question raised by this report is what are the legal and regulatory obligations that the Electronic Crime Counter Measures Unit established within the UPF is subject to and what measures are taken to ensure that it operates with respect for the rights provided for in the Constitution of Uganda.
This is particularly important given the emergence of information technologies which have significantly enabled expansive forms of collecting, storing and sharing of personal data.
This report raises concerns that despite efforts such as capacity building of personnel, establishing of internal checks and balances to professionalize and democratize policing practices to meet emerging and modern policing standards, there are still a number of challenges. The police force continues to be seen as involved in infringing the rights and freedoms of citizens; [8] there are concerns that the UPF through its structures such as the Electronic Crime Counter Measure Unit, Special Investigations Unit (SIU) and Media Crimes Unit may be unlawfully interfering with the right to privacy of citizens.
Interviews conducted with activists in Kampala revealed that some feared that they were being subjected to unlawful surveillance which had a chilling effect. One interviewee said:
“For the last two years I have been under police surveillance, my phones are tapped, I usually receive anonymous calls…………am scared for my life. I have been continuously warned against attending radio talk shows or even sharing views of political nature online”[9]
(ii) Cases of concern
Some incidents can lead to questioning if the UPF’s actions are consistent with the established national and international human rights norms and standards; the following are some of the instances which illustrate some of these concerns:
On 9th December 2016 Swaibu Nsamba the FDC Chairperson Katikamu South Constituency Luweero District was arrested and detained by operatives from UPF and UCC over allegations of defamation to the head of the state. After 1week in detention at Luzira prison, Nsamba was produced before Grade 1 Magistrate court with a representative from the Electronic Crime Countermeasures Unit as state witnesses. The Unit had Nsamba’s Facebook communication as evidence before court. He is still battling a court case to date.[10]
On 8 March 2016; presidential candidate Amama Mbabazi’s lawyer’s office was broken into and their computers, laptops and valuable documents stolen. This followed the filing of a court petition protesting outcomes of 2016 presidential elections, in which incumbent President Yoweri Museveni was re-elected. However, the petitioner’s lawyer Fred Muwema was quoted by the media linking the break-in to state security operatives.[11]
In 2013 two media houses, The Red Pepper and Monitor Publications, were raided and forced to close by the police for thirteen days over a story that had been published.[12]In disregard of the law, during the process, the two premises were declared a crime scene and police gained access to computers without consent from the management of the two media houses even after a court had cancelled the search warrant.
On 26 February 2015, the police arrested and charged Robert Shaka, a popular social media commentator, for using electronic devices to spread offensive communication against the President, his wife, the police chief and others in contravention of the law. According to media reports, Shaka was arrested for his critical social media comments of the Uganda government[13].
On 18 February 2016, shortly before the presidential elections, the Uganda Communication Commission (UCC) working with the police and telecommunication service providers shutdown access to social networking sites such as Facebook, Twitter and instant messaging service WhatsApp, citing unspecified security concerns and directives.[14]
The other concern is that the Electronic Crime Counter Measure Unit is established to implement the Computer Misuse Act, 2011. This law contains provisions whose legality has been contested as the Act grants Police unlimited powers to access data stored or processed by the computer for purposes of criminal investigations or prosecution of an offence.[15] The Unit has also been reported by the media for having arrested and detained persons on allegations of cyber harassment and offensive language[16]. Among the victims of this legislation is Dr. Stella Nyanzi, who currently under prosecution for her social media posts about the state of governance in the country.
Individuals interviewed for this report reported having been interrogated at the Unit’s office in Criminal Investigation Directorate (CID) headquarters, Kibuli. This has raised questions as to whether it was the Unit which was leading those investigations.[17]
Whilst there are concerns with online criminality in Uganda[18] and the government has been taking various measures to investigate these, the fact that the functions of the Unit are not regulated by law, that there is no transparency of their mandate and activities, nor have they been subject to effective oversight, is concerning.
2.1 Conclusion
The establishment of the Electronic Crime Counter Measure Unit appear to be a new development under the UPF in order to combat cybercrime. However, the concerns outlined in this report highlight that the Unit has been operating in what seems to be a legal and regulatory void, and it remains unclear what its mandate is and what its functions are. This void is further concerning in light of the lack of transparency and accountability of the link between the Unit and the UPF.
As outlined by the recommendation below, it is urgent for the UPF to clarify the mandate, functions and role of the Unit in policing activities in Uganda in order to shed light on what its obligation are and to provide a better understanding and context of the reported cases of alleged violation present in this report.
2.2 Recommendations
The UPF should adopt a human rights approach to policing. This should involve developing policing policies and implementing policing practices that meet established human rights standards in accordance with Uganda’s national and international human right obligations;
The Unit should be implemented in a transparent and accountable manner with publicly available documentation presenting its mandate and functions.
The UPF and all of its subsidiary Units and Directorates operating within it must be subject to independent oversight and should any violations be reported to have occurred, necessary measures must be taken to investigate these and appropriate responses must be taken on the basis of the findings.
All national legislations should be brought in line with Uganda’s national and international human rights obligations which clearly outline and limit circumstances in which the right to privacy can be interfered with.
The state should take necessary measures to harmonize the operationalization and implementation of legislation and policies which uphold, protects and promotes fundamental human rights.
The Uganda Human Rights Commission should investigate the alleged violations by the Unit as indicated by the alleged victims.The police management should work toward building the capacity of its personnel most especially those working on criminal investigations. This will enable officers to understand established legal standards they must abide by when undertaking investigations
[1] Art. 211 (1)
[2] The Constitution of the Republic of Uganda 1995
[3]The Police Act Section 24-33
[4] The 1995 Constitution of the Republic of Uganda Art. 211(3)
[5] https://www.unwantedwitness.org/cyberpolicy/computer-misuse-act-2011-act-no-2-2011/
[6] The Universal Declaration of Human Rights Article 12, United Nations Convention on Migrant Workers Article 14, UN Convention of the Protection of the Child Article 16, International Covenant on Civil and Political Rights, International Covenant on Civil and Political Rights Article 17; regional conventions including Article 10 of the African Charter on the Rights and Welfare of the Child, Article 11 of the American Convention on Human Rights, Article 4 of the African Union Principles on Freedom of Expression, Article 5 of the American Declaration of the Rights and Duties of Man, Article 21 of the Arab Charter on Human Rights, and Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms; Johannesburg Principles on National Security, Free Expression and Access to Information, Camden Principles on Freedom of Expression and Equality.
[7] Section 18 of the Computer Misuse Act, 2011
[8]Human Rights Network Uganda. The Police Watch Magazine 2014. Vol.2
[9]Interview with a victim of UPF surveillance held on 11th September 2017, Kampala
[10] https://www.unwantedwitness.org/?p=3730
[11] Daily monitor: Burglars break into Mbabazi’s lawyers office, published on 9th March 2016
[12] The Observer: Monitor, Red Pepper reopened, published May 31st, 2013
[13] https://www.voanews.com/a/social-media-critic-arrested-in-uganda-/2820626.html
[14] https://ooni.torproject.org/post/uganda-social-media-blocked/
[15]HRNJ Analysis of the Computer Misuse Act 2011
[16] Daily Monitor. Dr Nyanzi arrested over offensive communication, Saturday April 8 2017
[17]An interview with an Opposition Political Party Official held December 2017 in Kampala
[18]An ISACA survey carried out in 2015 indicated that 85 per cent of organizations expected a cyber-attack while 77 per cent showed that cyber-attacks had increased in the previous years.