According to him, it is no longer enough for African countries to simply create digital systems — they need to invest in more robust protection mechanisms against increasingly complex threats. The expansion of the digitalization of the economy and public services creates more opportunities for cybercriminals to exploit vulnerabilities. As an example, he cited a recent attack on a bank in neighboring Rwanda, after which the stolen money was transferred to Uganda and cashed out. He did not disclose the name of the bank or the amount withdrawn in Uganda. He also did not specify whether the suspects were detained or the funds were recovered.
According to him, this case shows how easily cybercrime crosses borders, forcing investigators in one country to rely on the assistance of authorities in other states to track the money, identify the suspects, and investigate the attacks. Mubiru warned that vulnerabilities in one country can create risks for its neighbors as well. «If your neighbor decides that this attack is equivalent to a kinetic impact, you will be in trouble», he said. He explained this risk using the example of two neighbors, noting that weaknesses in one country can spread to another, much like snakes from overgrown bushes can penetrate a neighboring plot. «Thus, a cybersecurity vulnerability can effectively turn into a threat to national security», Mubiru emphasized.
His warning came against the backdrop of Uganda’s rapid growth in the digital economy. The Governor of the Bank of Uganda, Michael Atingi‑Ego, reported that about 22 million Ugandans — that is, nearly half of the population — are now using the internet, which is contributing to the development of trade, expanding financial inclusion, and improving education and public services. Atingi‑Ego noted that technology can accelerate transformations in the country, and the financial system can turn these changes into investment, production, and new opportunities. At the same time, he added that trust is necessary for businesses and institutions to participate confidently in the digital economy.
Cybersecurity can no longer be viewed solely as an information technology issue — it is also a matter of economic and financial stability. A national assessment conducted by the National Information Technology Authority of Uganda (NITA‑U) showed that approximately four out of ten small and medium‑sized enterprises in the country have experienced some form of cyberattack. Mubiru, in turn, presented data on cases that came to his agency, stating that the number of registered cases had grown to 833, compared to 129 in 2019. Banks remain the main targets. Mubiru emphasized that the financial sector remains one of the main targets due to its significant cash flows. At the same time, he warned that the danger comes not only from external attackers. «Compromise also occurs from within. The insider threat is real. Therefore, for me, the insider threat is a major problem, even if we are talking about AI and many other things», Mubiru noted. He added that the risks also extend to critical government infrastructure. «As oil refineries are built and public services are digitalized, we are likely to expose our public sector to even greater threats», he said.
Mubiru also called the compromise of business email one of the main sources of financial losses, especially for companies working with foreign partners. According to him, attackers who gain access to email accounts can interfere with financial transactions and redirect funds, which leads to serious losses for businesses.
Mubiru also stated that the rapid development of artificial intelligence and other technologies creates new risks for digital identity. According to him, criminals can use people’s identity, voice, and other personal characteristics to imitate and commit fraud. «These days, people can even steal your identity and manipulate it. They can manipulate your voice. They can manipulate everything that concerns you. In other words, our digital identity is under threat», he said. This problem is becoming particularly relevant as Uganda is increasingly using digital identification systems in public services and financial transactions. Mubiru also expressed concern about cyberstalking and cyberbullying against children, calling for an increase in public awareness and the provision of accessible channels for reporting such incidents.
Despite the growing threats, Mubiru stated that Uganda’s ability to respond effectively to incidents is declining due to untimely notification and fragmented actions by various institutions. He noted that the police only become aware of many cyber incidents after the victims have already suffered significant damage. «People don’t report incidents. No one reports them. In fact, we only receive information about incidents from the banking sector when the situation is already out of control», he said. Mubiru explained that some organizations send messages to the Uganda Communications Commission, others to NITA‑U, and some institutions engage private cybersecurity specialists. According to him, such a fragmented approach may create gaps in the national response system. «We need to harmonize actions across all areas. I would like to see a coordinated approach to some of these cybersecurity threats we are observing. Different sectors approach the problem in different ways», he said. He called for closer cooperation between Uganda and other countries, emphasizing that the cross‑border nature of cybercrime requires joint investigations. The transfer of money from Rwanda to Uganda, he said, clearly illustrates this problem. Investigators may need the support of Ugandan authorities to obtain transactional data, establish accounts, track suspects, and recover assets.
Mubiru reported that Uganda has signed the UN Convention on Cybercrime, adopted in Hanoi in 2025, but the process of ratifying it at the national level has not yet been completed. He also noted the need to implement the African Union Convention on Cybersecurity and the Protection of Personal Data, known as the Malabo Convention. According to Mubiru, for law enforcement agencies, the ratification and implementation of these documents will strengthen cooperation with international partners and improve access to modern tools of digital and computer forensics.
Comments (0)