(Bloomberg) -- Nick Opiyo had just ordered lunch in a Kampala restaurant on the last working day before Christmas when armed, uniformed security forces swarmed his table, handcuffed him, covered his head with a sack he says smelled of blood, and bundled him into an unmarked van. His laptop, phone, documents and car keys were confiscated and he was interrogated for several days, accused of money laundering, not paying taxes or filing returns — allegations he denies. The 43-year-old spent his holiday behind bars, and the government dropped the charges nine months later. 

Opiyo, one of Uganda’s top human rights lawyers, believes that there was an ulterior motive for his December 2020 detention: he and his team at the legal nonprofit Chapter Four had been gathering evidence linking state security forces to extrajudicial killings in the run-up to the 2021 general election. The government had officially acknowledged 54 deaths connected to protests, which erupted after the arrest of an opposition leader. But Opiyo says he collected post-mortem reports, photos and family testimony indicating that the number of people killed was almost three times greater.

Months earlier, an incident occurred that Opiyo now sees as a warning. Laptops, phones and external hard drives were stolen from his home in the middle of the night. When Opiyo awoke in the morning, drowsy from what he says was some kind of sedative, he used a geolocation tool to see where they were. The software showed that the devices were at an address in Kampala’s Chwa II Road: the headquarters of Uganda’s military intelligence agency.

As he and his colleagues were dragged from their table that afternoon in December, Opiyo tried to make light of the situation, telling officers he assumed they were there to pick up a terrorist, not a lawyer.

“I outwardly joked about it,” Opiyo reflected to Bloomberg. “But deep down I was afraid. These kinds of arrests never end well.”

In the course of his work, Opiyo sometimes encountered people who had been tortured and maimed by forces reporting to 79-year-old President Yoweri Museveni. Many had been detained under similar circumstances, and subject to intense physical and digital surveillance. These campaigns were often enabled by Uganda’s pervasive national identification system.  

Uganda has spent hundreds of millions of dollars in the past decade on biometric tools that document a person’s unique physical characteristics, such as their face, fingerprints and irises, to form the basis of a comprehensive identification system. While the system is central to many of the state’s everyday functions, as Museveni has grown increasingly authoritarian over nearly four decades in power, it has also become a powerful mechanism for surveilling politicians, journalists, human rights advocates and ordinary citizens, according to dozens of interviews and hundreds of pages of documents obtained and analyzed by Bloomberg and nonprofit investigative newsroom Lighthouse Reports. 

It’s a cautionary tale for any country considering establishing a biometric identity system without rigorous checks and balances and input from civil society. Dozens of global south countries have adopted this approach as part of an effort to meet sustainable development goals from the UN, which considers having a legal identity to be a fundamental human right. But, despite billions of dollars of investment, with backing from organizations including the World Bank, those identity systems haven’t always lived up to expectations. In many cases, the key problem is the failure to register large swathes of the population, leading to exclusion from public services. But in other places, like Uganda, inclusion in the system has been weaponized for surveillance purposes. 

A year-long investigation by Bloomberg and Lighthouse Reports sheds new light on the ways in which Museveni’s regime has built and deployed this system to target opponents and consolidate power. It shows how the underlying software and data sets are easily accessed by individuals at all levels of law enforcement, despite official claims to the contrary. It also highlights, in some cases for the first time, how senior government and law enforcement officials have used these tools to target individuals deemed to pose a political threat. 

For Opiyo and others, the impact has been clear.

“There is almost no confidentiality in my work anymore,” Opiyo said. “There’s pervasive fear and self-censorship.”

Registering a population can take many forms, including drafting paperwork for every birth and death. But when there is no system to do this — either because of a lack of infrastructure, mass illiteracy, or simply because of the challenges associated with reaching rural populations — biometric technology can provide a neat proxy. Since Uganda established its National Identification and Registration Authority, or NIRA, nearly a decade ago, an estimated 60% of citizens have enrolled. A NIRA-issued ID card is now required to get a mobile SIM, transact in a bank, register to vote and get medical treatment.

“There are enormous advantages to having an ID system, including financial inclusion,” said Opiyo, who speaks quietly, occasionally nudging his frameless glasses up the bridge of his nose. “The only problem is it’s a perfect system in the hands of an imperfect and brutal regime that applies the system to suppress opponents, target critics and settle personal scores.” 

Chapter Four’s headquarters are on a quiet street in Kampala’s upscale Kololo district. Employees use their thumbprints to access the low-profile white building, surrounded by a lush garden that's dotted with avocado and eucalyptus trees. Opiyo’s office is at the end of a corridor, his large desk surrounded by stacks of files.

Tall and meticulously groomed, Opiyo is best known for representing opposition leader Robert Kyagulanyi Ssentamu, known as Bobi Wine, a former rapper-turned-presidential candidate who went up against Museveni in the 2021 general election and captured the imagination of young Ugandans with his vision of change. Though Wine mounted a serious challenge and won more seats than any other opposition party, it wasn’t enough to defeat the president. 

During Museveni’s 38 years in power, Uganda has expanded its economy, improved literacy, reduced HIV rates, and witnessed the end of a brutal civil war. But human rights conditions have also deteriorated significantly as Museveni has violently repressed critics and militarized the police force. International NGOs including Amnesty International, Human Rights Watch and Freedom House have sounded the alarm about worsening human rights conditions and election credibility, but the crackdown has continued.

In August, the Ugandan government shut down the United Nations’ human rights office after the international body called for an investigation into state security forces accused of torture. The same month, the World Bank announced that it was stopping new loans to the country over its draconian anti-LGBTQ laws, which Opiyo spent years challenging in court. Under those laws, some homosexual acts are punishable by death.

Such crackdowns have accelerated since 2014, the year Uganda rolled out its biometric ID system.  The country had been struggling with a spate of high-profile murders and violent robberies, and Museveni declared that the biometric registration of Ugandans  would enable authorities “to identify criminals accurately and promptly.”

The problem, Opiyo said, is that the definition of crime has expanded alongside the biometric system. Now a “criminal act” can describe joining a small political protest or sending nasty tweets to a politician. Privacy rights are rarely enforced, and broad laws around “misuse of social media” and sharing “malicious information” give authorities additional power to silence critics.  

Agather Atuhaire, a journalist, human rights activist and mother of two, is one of the many Ugandans who have been caught in the state’s surveillance net. In 2022, Atuhaire broke the news that Uganda’s Parliament spent about $737,000 in taxpayer money to procure two Mercedes Benz S-Class vehicles for the parliamentary speaker Anita Among and one of her staff members.

The report, which included photos of the speaker’s personalized license plate, triggered public outcry about wasteful government spending in a country where 30% to 40% of people live on less than $2.15 a day.

The speaker directed the country’s criminal investigations unit to look into Atuhaire, resulting in a 50-page report that was leaked to journalists and seen by Bloomberg. The document shows that the government tracked her movements, phone records and social media accounts, despite not having a court order or a legal basis to do so. Atuhaire’s landlord evicted her, and she says she now lives in a state of hyper-vigilance, checking her rearview mirror to see if she’s being followed, asking friends to escort her home, and having cybersecurity groups screen her devices.

In May, the US sanctioned Among, “due to involvement in significant corruption tied to her leadership” of Uganda’s national assembly, the State Department said. The decision came a month after the UK sanctioned Among, also citing corruption. Among  said she was the victim of a political witch-hunt for her stance against homosexuality. 

Anita Among and representatives from her office did not respond to requests for comment about the surveillance of Atuhaire. A spokesperson for Parliament said at the time that the cars belonged to Parliament, not Among.

Cases like Atuhaire’s are not exceptional, according to Opiyo. If anyone in government or law enforcement wants to look someone up in the NIRA database or find out who they have been talking to or where their family members live, they can — “with absolutely no due process.”

In November, Bloomberg requested an interview with the head of information and communication technologies at Uganda’s police force. After calling, emailing and visiting the Kampala headquarters multiple times — and submitting a hand-written list of questions for the Inspector General to review — Bloomberg was told to wait to find out whether an interview would be granted. After this, the spokesperson stopped responding.

During this time, Bloomberg attended Uganda’s National Science Week. The event, held in an enormous air-conditioned tent on the grounds of Kampala’s Independence Park, featured companies, researchers and government agencies demonstrating their technical prowess.

At a police stand next to a drone display, a group of mostly young, male uniformed officers showcased Uganda’s smart CCTV capabilities to a crowd of mesmerized students, demonstrating how the $126 million Huawei system could capture faces and license-plate details from passing cars.

One of the officers, who asked to remain anonymous for fear of disciplinary action, showed Bloomberg the system’s user interface, including how to access artificial intelligence-powered personal identification features. Two officers told Bloomberg that if they wanted to track someone who wasn’t already in the police mugshot database, they could get their photo from NIRA, enter it into the CCTV system, and receive a notification if that person was captured by one of the network’s cameras.

A third police officer, who asked not to be identified for fear of reprisal, later told Bloomberg that he had direct access via his computer to a database containing NIRA data, including photos, fingerprints and biographical details. He said he had run custom queries, unrelated to potential criminal activity, for friends and associates without court orders. 

Spokespeople for the Uganda Police Force and Uganda People’s Defence Forces did not respond to requests for comment. 

Such allegations reflect the findings of a 2022 report by the country’s Auditor General, which revealed that 67 private companies and state-run organizations have “irregular” and “ad hoc” access to citizens’ information in the NIRA databases. Of these, 41 have not signed any agreements stipulating how, when and for what purposes they are able to access or use the data. 

NIRA Executive Director Rosemary Kisembo denied that law enforcement could easily access the database. A court order was always required, she said in a phone interview. Kisembo added that the system facilitates tracking by keeping a digital record of who looks up which records at what times. 

“In my 25-year career, I have never seen a better audited system,” she said.

As the government has collected more information about citizens, it has disclosed less to the public about its biometric contracts. Uganda signed its first deal for biometric IDs in 2010, with the German technology company Mühlbauer, after Museveni met with that country’s ambassador. A parliamentary investigation later determined that the $80 million deal bypassed government procurement rules because the bidding process wasn't competitive, according to official documents seen by Bloomberg.

Mühlbauer’s Matthias Köhler, vice president and head of sales, said the acquisition process spanned several months, “meticulously adhering to Ugandan as well as German laws and regulations.” The Ugandan government did not respond to a request for comment from Bloomberg News, but the parliamentary investigation included letters from the Ministry of Internal Affairs that defended Mühlbauer’s selection without a competitive tender on security grounds. 

That was the beginning of a series of measures connecting people’s identities to their digital footprints. Two years later, Museveni’s government introduced a law mandating the biometric registration of SIM cards, and that mobile phone user data be stored in a centralized database.

In 2018, Museveni was instrumental in purchasing the Huawei CCTV system that was on display at National Science Week — the contract for which has never been made public. The system allows police officers to set up alerts based on a person’s facial features. Should an individual pass by one of the security cameras, which are concentrated along roads near the homes of key opposition figures, a notification will be triggered.

Kampala’s CCTV system is the result of one of several deals that Huawei has struck with the Ugandan government. The Shenzen-based company developed the country’s fiber optic network, which Museveni has called a “digital backbone,” and Huawei technicians also helped the government hack Bobi Wine’s phone accounts, according to a 2019 Wall Street Journal report. A Huawei spokesman told the newspaper at the time that the company had never been engaged in hacking activities. Uganda’s government declined to comment on the hacking allegations, but confirmed that Huawei technicians have supported its intelligence agencies. While official figures do not appear to show that Huawei technologies have reduced crime, they have served other purposes. Police credited the company’s CCTV system with helping them identify protesters who fought with security forces ahead of the 2021 presidential election. The human rights abuses that followed these clashes were what Opiyo and his colleagues had been documenting before they were detained.

Most recently, Museveni’s office  ordered a ministry to sign a 10-year contract for a system designed to allow the government to track the real-time location of all vehicles in the country through cellular network-connected tracking devices in license plates — data that is again tied to people’s national IDs. The $250 million deal, struck with a Russian defense company,  expands on the capabilities of the existing CCTV network and received significant pushback from several government agencies, according to official documents seen by Bloomberg.

The president’s office did not respond to requests for comment about the procurement process.

Even the Minister for Internal Affairs, retired general Kahinda Otafiire, said he was blindsided by the project and raised his concerns to the president, he told a parliamentary committee in August. Human Rights Watch said the system, launched in November, will allow for “unchecked mass surveillance.”  

Uganda’s state surveillance isn’t confined within the country’s borders.

Author Kakwenza Rukirabashaija was taken from his home in Kisaasi, a Kampala suburb, by military police in December 2021 a day after tweeting that the president’s son was “obese” and an “inebriated curmudgeon.” He spent about a month behind bars, during which time he says he was tortured. His back is criss-crossed with scars and he has a stress fracture in his left leg. His thighs are still healing from what he described as having chunks of flesh removed with pliers.

After being released on bail in early 2022, Rukirabashaija fled, crossing the border into Rwanda on foot. The United Nations Refugee Agency facilitated his onward journey to Germany, where he now lives in exile with his wife and three young children.

Rukirabashaija says he was closely monitored for years in Uganda, and that this has not stopped since he left. He has received screenshots from anonymous social media accounts indicating that Ugandan authorities are tracking the precise locations of his family members’ phones and tablets. After using social media to criticize Uganda’s parliamentary speaker, he received messages on X informing him that his daughter’s movements were being tracked. “We will slaughter her and send you pictures,” read one of the messages from an unknown sender, which was reviewed by Bloomberg.

International outcry about the increasingly repressive Ugandan government does not appear to have changed Museveni’s course.  US President Joe Biden expelled Uganda from the US-Africa trade pact Agoa in October, citing “gross violations of internationally recognized human rights.” In December, the US State Department restricted visas to Ugandan officials believed to be responsible for, or complicit in, undermining the democratic process or repressing members of vulnerable populations. Uganda’s government denounced the move, accusing the US of “pushing  the LGBT agenda” in Africa.

In April, Opiyo’s attempt to overturn the harsh anti-LGBTQ legislation was rejected by a constitutional court.  US Secretary of State Anthony Blinken criticized the verdict, posting on X that it “undermines human rights and public health for all.”

“Uganda’s international reputation and ability to increase foreign investment depend on equality under the law,” he added. On a Friday in November, hundreds of people sat in yellow bleachers overlooking Kampala’s Kololo Airstrip, a stretch of land in the city center used for military parades, and waited to provide their biometric data. At the top of the stands, government officials flanked by gun-toting soldiers scanned fingerprints and photographed applicants. 

Ten years after the launch of its first biometric ID, Uganda is preparing to roll out a new national ID card. While it’s not yet clear which company NIRA will work with on the new system, or how many other government agencies and private companies will be allowed to access its data, it is known that the system will ingest even more biometric data than previous ones. Iris scans are now being captured, in addition to faces and fingerprints. 

As Museveni courts a potential seventh term, the national ID system is key to his strategy. Mass enrollment is scheduled to start in June and will run until January 2025, creating the voter registration rolls for the 2026 presidential election.

Opiyo, who has been living in a safe house in recent weeks after receiving death threats, said he’s already seeing “consistent and early preparation by the regime to line up their ducks ahead of the next election.” In an apparent effort to curry favor among younger voters partial to Wine, the government has created a program to distribute money to musicians and artists, and to run beauty pageants. This March, Museveni also appointed his son, Muhoozi Kainerugaba, as the army’s top commander, giving him powers over all elements of the Uganda People’s Defense Forces. This, Opiyo says, gives him “firm control of the instruments of coercion ahead of the next election.”

Chapter Four is exploring counter-measures to keep the election “free and fair,” including filing cases against the people it says are responsible for violence in the last one, but still, Opiyo is bracing for more rough years under President Museveni, with surveillance becoming “more sophisticated and high-tech.”

Sign up for Next Africa, a twice-weekly newsletter on where the continent stands now — and where it’s headed.

—With assistance from Nalinee Maleeyakul of Lighthouse Reports and Fred Ojambo. 

©2024 Bloomberg L.P.