Executive Summary

One year after Tanzania’s October 2025 election massacres, victims’ families continue to seek answers while the government retains control over the official inquiry process. Approximately 10,000 people were killed. The government-appointed Chande Commission reported at least 518 deaths, but its full report remains unpublished.

The anniversary coincided with renewed scrutiny of the use of terrorism charges against political opponents. At least 64 people among a group of 130 arrested in July were charged under the non-bailable Prevention of Terrorism Act. The cases raise questions about how security agencies collect and interpret information on political activity and how that information is used in prosecutions.

This edition’s subscriber assessment examines an apparent campaign against Vice-President Deogratius Ndejembi on X. It investigates the shift by some accounts from promoting Tanzania-related government activities to circulating hostile claims about him. The assessment considers Samia’s political circle as the principal line of inquiry and business interests potentially affected by Ndejembi’s decisions as a second possibility. Neither has been established as the sponsor.

In Kenya, the High Court ordered officials to produce missing Tanzanian activist Twaha Mwaipaya or account for his alleged detention. The case is a test of whether regional institutions can establish the fate of a political dissident reportedly taken across the border.

Elsewhere, Uganda appointed a new military intelligence chief amid discussions about political succession and engagement with detained opposition figure Kizza Besigye. In Sudan, the RSF-aligned TASIS alliance reportedly appointed an intelligence chief as it builds parallel institutions. Washington also sanctioned Rwanda’s Ministry of Defence and a financial institution over alleged support linked to the Rwanda Defence Force and M23 in eastern Democratic Republic of Congo.

An alleged intrusion at an African Union residence, suspected surveillance of Starlink users and Russian-linked information activity around unrest in France illustrate different forms of intelligence risk. They also demonstrate the need to distinguish evidence of access or amplification from proof of a successful operation.

Key Judgements

• Tanzania’s government retains control over the official reckoning with the 2025 massacres, but not over their public memory. The full Chande report remains unavailable, while families, religious leaders and rights organisations continue to demand answers.

• A campaign targeting Vice-President Ndejembi shows signs of organised amplification. Some accounts reportedly shifted from promoting Tanzania-related government activities to circulating hostile allegations about him. The sponsor and political purpose remain unconfirmed.

• Non-bailable terrorism charges can remove political actors from public life before a court determines their guilt. The cases warrant closer examination of how security information is collected, tested and presented.

• Mwaipaya’s disappearance exposes a regional protection gap. The Kenyan court order demands answers but does not establish which actor was responsible or whether he is being held by a state agency.

• Uganda’s military intelligence appointment matters in a period of succession uncertainty. There is no evidence that the appointment was made specifically to secure Muhoozi Kainerugaba’s political succession.

• Sudan’s reported parallel intelligence service would extend the RSF-aligned alliance’s institutional reach. Its actual capabilities and control over personnel and territory remain unclear.

• Foreign intelligence and surveillance activities exposed vulnerabilities across Africa and Europe. An alleged intrusion at an African Union residence, suspected targeting of Starlink users and Russian-linked messaging around the French protests show how physical access and digital platforms can be used for intelligence collection and influence.

READ ALSO

🇹🇿 Tanzania: One Year After the Massacres

The struggle over remembrance and the official account

On 29 October, Tanzanians marked one year since the disputed 2025 election and the massacres that followed it.

The Tanzania Episcopal Conference called on parishes, prayer centres and Church institutions to hold special Masses for those killed and affected. Catholic churches subsequently held memorial services across the country.

Abubakari Mngodo, deputy secretary-general of Tanzania’s Council of Imams, spoke of the importance of remembrance and called on the government to be truthful about what happened. The British High Commission and US Embassy publicly remembered the victims and acknowledged the families affected.

CHADEMA announced a period of mourning. Widely publicised protests planned for the anniversary did not take place after police banned processions.

The number killed remains contested. Approximately 10,000 people were estimated to have been killed. The government-appointed Chande Commission reported at least 518 deaths. The higher estimate has not been independently verified. The commission’s full report remains unpublished, preventing independent scrutiny of its evidence and methods.

On the anniversary, independent UN human rights experts called for publication of the full report and for independent investigations. They said withholding the findings undermined victims’ rights to truth and justice.

Ujasusi assessment: The government retains control over the official inquiry process, but the anniversary showed that it does not control the public meaning of the killings. The Catholic Church’s nationwide services provided an institutional platform for remembrance, while families and rights organisations continued to challenge the absence of a full public account.

The unreleased Chande report is also an intelligence and security governance issue. Without access to its evidence, the public cannot adequately examine how the commission assessed the role of security institutions, operational orders, responsibility for lethal force or the fate of missing people.

What to watch: Whether the Lila Commission examines the role of security-force leadership, whether families can participate meaningfully, and whether its full findings are published.

Terrorism charges as a tool against political opposition

A human rights investigation published during the anniversary week accused Tanzanian authorities of using counterterrorism laws to restrict civic space.

Police had reported the arrest of 130 people in July over alleged activity intended to destabilise the country. At least 64 of those arrested were subsequently charged under the Prevention of Terrorism Act, an offence for which bail is unavailable.

The investigation said it had verified terrorism charge sheets from different parts of Tanzania. In one case, it documented allegations that detained CHADEMA student members were beaten during interrogation and forced to record confessions and name party leaders as financiers. These remain allegations.

The arrests and charges occurred before this reporting period. The available evidence does not establish that the Tanzania Intelligence and Security Service directed every case.

Ujasusi assessment: Non-bailable terrorism charges can have a political effect before a case reaches trial: accused organisers are removed from public activity, legal defence becomes more difficult and other potential participants may reconsider their involvement.

The intelligence question is how authorities collect and interpret information about political organising, communications and alleged financing—and whether that information is independently tested before serious charges are brought. The available evidence does not establish the complete chain of command behind the cases.

What to watch: The evidence disclosed in court, the treatment of detainees and lawyers, and whether prosecutions identify specific acts supporting the terrorism allegations.

🇰🇪 Kenya–Tanzania: The Mwaipaya Case and the Regional Protection Gap

Kenya’s High Court on 30 October ordered security officials to produce missing Tanzanian activist Twaha Mwaipaya before the Milimani High Court on 2 November, with any detention warrant and an explanation of why he should not be released.

The order followed an urgent application by human rights organisation Vocal Africa. Mwaipaya was reportedly taken in the Kamulu area on 25 October.

The order does not establish that Kenyan police, Tanzanian officials or another respondent seized or detained Mwaipaya. His location, condition and the identities of those responsible for his reported abduction remained unresolved.

Ujasusi assessment: The case exposes the difficulty of protecting political dissidents when an alleged seizure occurs across a national border. It also creates a test for Kenyan institutions: whether police records, detention information and other evidence can establish Mwaipaya’s fate.

The intelligence significance lies in the questions the case raises about monitoring, identification and movement across jurisdictions. Those questions cannot yet be answered by attributing the reported abduction to a particular service.

What to watch: The 2 November court proceedings; any detention warrant or official denial; and whether investigators preserve relevant communications, vehicle and surveillance records.

🇺🇬 Uganda: Military Intelligence, Succession and Political Accommodation

A new defence intelligence chief

The Uganda People’s Defence Forces confirmed that Chief of Defence Forces General Muhoozi Kainerugaba promoted Brigadier Oscar Munanura to acting major general and appointed him Chief of Defence Intelligence and Security.

Munanura had been deputy to the outgoing chief, Major General Richard Otto, who was moved for redeployment.

Military intelligence is central to assessing threats to the armed forces and providing security information to military leadership. A change at its head therefore matters during a period of uncertainty about the future distribution of political and security power.

Muhoozi is both defence chief and President Yoweri Museveni’s son. That relationship gives the appointment wider political relevance, but the available evidence does not establish that it was made specifically to secure a succession.

The reported succession discussion

A discussion paper reportedly circulated within the ruling National Resistance Movement addressed leadership beyond 2031 and calls for Muhoozi to succeed Museveni.

The document reportedly opened a discussion about succession but stopped short of an explicit retirement pledge. Ujasusi has not independently reviewed the paper.

Ujasusi assessment: The reported paper and the military intelligence appointment should be monitored together because both concern institutions that could matter during a future transition. They should not, however, be treated as evidence of a single coordinated succession plan.

What to watch: Further appointments in the military and intelligence services, formal NRM decisions and any public clarification by Museveni or Muhoozi.

Saleh and Besigye: A comparison for Tanzania

Retired General Salim Saleh, Museveni’s brother, has discussed political accommodation and reported contact with detained opposition figure Kizza Besigye. There have also been efforts by government figures to explore a political solution concerning Besigye. The scope and outcome of those discussions remain uncertain.

For Tanzania, the development raises a question: could political engagement eventually offer a route out of the confrontation over detained CHADEMA leader Tundu Lissu?

Ujasusi assessment: A negotiated outcome would require an opening acceptable to both the government and Lissu, as well as a way to address the legal case and wider political dispute. The Ugandan experience is useful as a comparison, but it is not evidence that an equivalent negotiation is under way in Tanzania.

What to watch: Besigye’s legal status, direct statements by the parties and the scheduled 6 November judgment in Lissu’s treason case.

🇷🇼 Rwanda–DRC: Sanctions Reach the Security Establishment

On 28 October, the United States sanctioned Rwanda’s Ministry of Defence and Zigama Credit and Savings Society over alleged support linked to the Rwanda Defence Force and the M23 armed group in eastern Democratic Republic of Congo.

Washington said Zigama operated on behalf of Rwanda’s security services and alleged that the institution facilitated transactions linked to the Rwanda Defence Force, M23 and the Congo River Alliance. The Front for the Refoundation of the Nation had been announced on 12 October as the successor to the Congo River Alliance.

The designations block relevant property under US jurisdiction and generally prohibit transactions involving designated entities by US persons or within US jurisdiction, subject to applicable exemptions and licences.

Ujasusi assessment: The measures reach beyond individual commanders into the institutional and financial infrastructure supporting Rwanda’s security establishment. Their effect will depend on how far the designated entities rely on transactions exposed to US jurisdiction and on how other financial partners respond.

The sanctions also create an intelligence requirement for regional and international actors: to assess whether support networks change their financing arrangements, logistics or partnerships in response. Such adaptation should not be assumed without evidence.

What to watch: Kigali’s response, implementation and exemptions, changes in financial or logistical arrangements, and evidence of any change in support to M23.

🇸🇩 Sudan: RSF-Aligned Alliance Builds a Parallel Intelligence Structure

The Sudanese Founding Alliance, known as TASIS, has reportedly appointed Idris Madallal to head a newly established security and intelligence service.

Madallal is described as a senior Rapid Support Forces figure. The alliance has reportedly established the service’s structure and appointed officers to departments.

Some appointees reportedly served in Sudan’s General Intelligence Service, while others came from the RSF intelligence apparatus. Ujasusi has not independently confirmed the appointments or the organisation’s structure.

Ujasusi assessment: A parallel intelligence service could help the alliance gather information, monitor perceived threats and extend security control in territory under its influence. It may also institutionalise a division between competing authorities claiming the functions of the Sudanese state.

The existence of a reported organisational structure does not establish effective operational capacity. Personnel, funding, command relationships and territorial reach remain unclear.

What to watch: Public confirmation, further appointments, evidence of activity in RSF-held areas and the relationship between the new service and existing RSF intelligence structures.

🇪🇹 African Union–Russia: Alleged Intrusion at an AU Residence

An investigation published on 23 October, followed by further coverage on 26 October, alleged that a Russian military intelligence officer entered an African Union residence in Addis Ababa on 28 April 2025 while AU Commission chair Mahamoud Ali Youssouf was staying there.

The property was described as the official residence of deputy Commission chair Selma Haddadi, but was reportedly being used by Youssouf and his family at the time. The alleged intruder was identified using CCTV images and facial recognition. Ujasusi has not independently authenticated the footage or identification.

Youssouf reportedly denied the account and described it as an attempted manipulation. His full comments have not been independently reviewed by Ujasusi.

Ujasusi assessment: Unauthorised access to a senior official’s accommodation would create a potential opportunity to examine documents or devices, observe the premises or install surveillance equipment. Those are possible collection opportunities, not established actions in this case.

The central unresolved questions are whether the reported intrusion occurred as described, whether the person was correctly identified, and what—if anything—was done inside the residence.

What to watch: An AU response addressing the specific allegation, independent authentication of the images and any verifiable explanation from Ethiopian or Russian authorities.

🌍 Surveillance: Starlink Users and the Intelligence Value of Advertising Data

An Israeli advertising technology company, Discover-Tech, has been linked to suspected efforts to target Starlink users through online advertising.

The underlying technical research used the name Shadow-Earth-79 without publicly naming the company. The connection between that name and Discover-Tech was attributed to people familiar with the research.

The actor was described as a leading buyer of advertisements in countries including Libya and South Sudan, and was said to have won an unusually large share of bids in countries including Egypt.

Advertising systems can disclose data that, when combined with other information, may help identify, locate or profile users. The available evidence does not establish that every user exposed to an advertisement was successfully tracked, or identify a government customer for the specific activity.

Ujasusi assessment: Starlink can offer connectivity where conventional networks are disrupted or restricted, but the satellite link does not remove the data trails generated by devices, applications and advertising systems. For journalists, activists and organisations working in sensitive environments, the intelligence risk extends beyond who controls the connection itself.

What to watch: Further technical evidence, identifiable customers, Discover-Tech’s response and evidence distinguishing advertising bids from successful surveillance.

🇬🇦 United States–Gabon: CIA Fraud and an Alleged Surveillance Connection

Former US federal employee David Rush pleaded guilty on 6 October to a fraud scheme that caused an approximately $194 million loss to the US government. The CIA said it referred the matter to the FBI following an internal investigation.

A separate investigation published on 26 October described an alleged Gabonese surveillance connection involving a former CIA technical officer and a former French intelligence official. Subsequent Gabonese coverage identified Rush and attributed further details to that investigation.

The US guilty plea is confirmed. The US Justice Department’s announcement does not establish the alleged Gabon operation, and the subsequent Gabonese account relies on the same investigation.

Ujasusi assessment: The confirmed fraud case illustrates the insider-threat problem created when access, secrecy and restricted oversight can be abused for personal gain. The alleged Gabon connection raises additional questions about surveillance and control of collected data, but those operational claims require further verification before they can support a fuller assessment.

🇸🇴 Somalia: Airstrikes and the Intelligence Attribution Problem

An investigation published on 26 October reported allegations that repeated airstrikes around Jilib had made it difficult for civilians to escape conflict and flooding.

Residents’ accounts described frequent attacks, while US Africa Command had publicly acknowledged a smaller number of strikes in the area. AFRICOM denied targeting civilians, using operations to displace them or using weather and flooding as a method of warfare. It said it publicised all airstrikes conducted under its authority in Somalia.

The discrepancy raises an accountability question, but it does not establish that every reported attack was conducted by the United States or that flooding was deliberately weaponised. Other actors also operate aircraft in Somalia.

Ujasusi assessment: The case illustrates the difficulty of attributing air operations in a conflict where several actors possess strike capabilities and public reporting is incomplete. A credible assessment requires matching witness accounts with the date and location of an incident, available imagery, weapons evidence and the operational records of possible operators.

Without that incident-level work, a pattern of civilian testimony may identify a serious problem while leaving responsibility for individual strikes unresolved.

🇮🇶 Iraq: Prime Minister Takes Direct Control of Intelligence Service

Iraqi Prime Minister Ali al-Zaidi removed Hamid al-Shatri as head of the Iraqi National Intelligence Service on 26 October. The termination of his assignment was publicly announced that day.

Days later, al-Zaidi assumed the duties of intelligence chief. The government referred to current security challenges and a wider effort to strengthen state sovereignty. Authorities did not publicly explain al-Shatri’s dismissal.

Ujasusi assessment: Direct prime-ministerial control may give the head of government greater immediate authority over intelligence priorities and coordination. It also concentrates decision-making, making the duration of the arrangement and the effectiveness of oversight especially important.

The dismissal alone does not establish whether the change reflects operational dissatisfaction, political competition or a broader restructuring.

What to watch: Whether a permanent intelligence chief is appointed, changes to the service’s leadership and any further restructuring of security decision-making.

🇫🇷 France: Warning Failure and Russian-Linked Information Activity

Violence around protests in France has raised three separate intelligence questions:

1. Did authorities adequately anticipate the scale and character of the unrest?

2. Did foreign actors amplify or manipulate information about it?

3. Is there evidence that foreign actors organised the protests or directed the violence?

The adequacy of intelligence assessment and police deployment has come under scrutiny. Misleading material also circulated around the protests, including old footage presented as current events.

An investigation into online activity found no evidence that a foreign actor caused the protests. It nevertheless attributed a network circulating coordinated messages around French grievances to Russia’s Doppelganger operation.

The activity was assessed to have preceded and followed the protests and sought to amplify divisions. Ujasusi has not independently verified the network’s state direction.

Ujasusi assessment: A failure to anticipate unrest, exploitation of the unrest by foreign information networks, and foreign orchestration of violence are distinct propositions. Evidence supporting one does not automatically prove the others.

Russian-linked networks may seek to intensify distrust by attaching their messages to genuine grievances. An external influence explanation must not displace examination of the domestic causes of protest or any shortcomings in the French security response.

What to watch: Findings from French investigations, evidence linking specific operations to Russian state direction, and any official review of intelligence warnings and police preparations.

The anti- Ndejembi Campaign on X: Who Is Behind the Attack on Tanzania’s Vice-President?

Period examined: 27–31 October 2026, with an earlier activity baseline
Assessment date: 1 November 2026
Scope: Public-source analysis

Executive Summary

A group of accounts on X repeatedly circulated hostile allegations about Tanzania’s Vice-President, Deogratius Ndejembi, between 27 and 31 October 2026.

The accounts used overlapping hashtags, similar wording, images and short posting intervals. Some also reposted one another’s material. Several had previously published positive or promotional posts about Tanzania earlier in October, including material concerning the Inter-Parliamentary Union Assembly and the Tanzania–United Kingdom partnership.

The activity is consistent with organised amplification of a prepared message set. The most significant feature is the reported shift by some accounts from promoting government-related activities to attacking the vice-president. That shift raises the possibility that the campaign serves a political or commercial interest with a specific grievance against Ndejembi.

The principal line of inquiry is whether the activity originated from President Samia Suluhu Hassan’s political circle or actors seeking to protect her interests. A second possibility is that it was commissioned by business interests affected by Ndejembi’s decisions, particularly during his previous tenure in the energy portfolio.

Neither hypothesis has been established. The available evidence does not identify who initiated the activity, whether participants were paid, whether automated tools were used or whether any political, commercial or state actor commissioned it.

The sampled posts generally recorded modest engagement. The available material does not establish that the campaign formally trended in Kenya or Tanzania, nor does it establish the geographic distribution of its audience or a measurable effect on public opinion.

Key Judgements

Read more

Ujasusi East Africa Monitoring Team | 29 October 2026 | 0015 GMT

One year after Tanzania’s October 29 massacres, President Samia Suluhu Hassan and CCM remain in power while victims’ families await justice. Intelwatch has estimated approximately 10,000 deaths; the government-appointed Chande Commission recorded 518. Its full report remains unpublished. The first of three approaching tests comes within days, as Commonwealth leaders gather in Antigua and Barbuda.

Executive Summary

The killings followed an election in which the main opposition party had been excluded and its leader faced a treason charge. Security forces used lethal force against protesters and bystanders during days of unrest and an internet shutdown.

The Chande Commission presented its findings in April 2026, but the government has not released its full report. A second commission began work in August. Meanwhile, opposition figures remain under pressure, and relatives of the dead and missing continue to seek answers.

Protest calls during the past year did not produce sustained nationwide mobilisation. International lobbying has kept Tanzania on the diplomatic agenda, while Samia’s government has continued to engage with foreign partners and host major international meetings.

READ ALSO

The killings and the two figures

The election of 29 October 2025 took place after months of political repression. CHADEMA, the main opposition party, had been excluded from the election after refusing to sign the electoral code of conduct, citing concerns about the integrity of the process. Its leader, Tundu Lissu, had been charged with treason.

Protests began on election day and continued in the days that followed. Security personnel used live ammunition and unlawful force against protesters and other people who posed no imminent threat of death or serious injury. A nationwide internet shutdown made it harder for families to communicate and for journalists and human rights monitors to document events.

Intelwatch’s executive director estimated approximately 10,000 deaths. The estimate has not been independently verified.

The Chande Commission’s figure was presented to President Samia in April 2026. The commission acknowledged that its count might not be conclusive. The full report remains unpublished, preventing public examination of its evidence, methods and treatment of missing-person cases.

The commission also presented police records of missing persons: of 758 cases recorded between 2023 and 2025, 245 people had not been found. Those figures cover a wider period and cannot be treated as a count of people missing specifically because of the October massacres.

Protest calls and the state response

Activists called for demonstrations on 9 and 25 December 2025, and 1 January, 7 July and 8 August 2026. None developed into sustained nationwide mobilisation capable of fundamentally challenging Samia’s government.

Ahead of 9 December, police arrested alleged organisers, banned demonstrations and monitored online calls. Police and soldiers deployed in force. Ahead of 7 July, the authorities again deployed security personnel after suspending political rallies and mass gatherings.

On 9 July, police announced that 130 people had been arrested over alleged incitement of criminal acts. On 26 July, police said 36 of those arrested had been arraigned on charges linked to terrorism and the promotion of unrest. Police said defence and security agencies had monitored the suspects’ activity, including on social media. The charges were allegations to be determined by the courts.

Lobbying and the government’s response

Tanzanian activists, lawyers, rights organisations and diaspora campaigners have pressed foreign governments and international institutions to address the killings. Their efforts have included protests, lobbying, documentation of abuses and submissions seeking international legal scrutiny.

The European Parliament called for an inquiry and consideration of sanctions. In the United States, the Reassessing the United States–Tanzania Bilateral Relationship Act advanced through the Senate Foreign Relations Committee and was placed on the Senate legislative calendar on 27 July 2026. It has not become law.

The Commonwealth Ministerial Action Group, or CMAG, set time-bound expectations for Tanzania covering political dialogue, civic freedoms and the treatment of detainees. At its September meeting, CMAG continued to monitor the situation. Its next ordinary meeting is scheduled in Antigua and Barbuda alongside the Commonwealth Heads of Government Meeting in St John’s, 1–4 November.

Tanzania has also continued to engage internationally. In October, Arusha hosted the 153rd Inter-Parliamentary Union Assembly, bringing together parliamentarians from more than 130 countries. The gathering marked the end of Tanzanian parliamentarian Tulia Ackson’s term as IPU president.

In August, Samia established a second commission chaired by retired Court of Appeal Judge Shaban Ally Lila. Its mandate includes investigating those who planned or coordinated the violence, alleged excessive force and the whereabouts of missing people. The commission was initially given five months to complete its work.

Key Judgements

• Samia and CCM are likely to retain the political initiative in the near term. The government controls the security apparatus, while its opponents remain fragmented and exposed to repression.

• Repeated protest calls could widen the gap between online activists and ordinary workers. The risk is greatest when threatened unrest costs traders and casual workers income without producing a visible political result.

• CCM is likely to remain aligned with Samia. The suppression of political competition benefits the ruling party and helps preserve its dominance.

• The first international test is days away. The Commonwealth meeting begins on 1 November; the US bill and the Lila Commission extend the pressure window into early 2027.

• Selective investigation is a major accountability risk. A process focused on alleged organisers and funders, while leaving security-force conduct and command responsibility unresolved, would reinforce impunity.

Why the streets remained quiet

Fear is a central reason the post-massacre protest calls failed to produce sustained mobilisation. The October killings showed what participation could cost; arrests and security deployments made that warning visible again before later demonstrations.

The movement’s fragmentation also matters. Opposition parties, domestic activists, diaspora campaigners and online personalities face different risks and do not always share trusted leadership or a common strategy. A protest call can circulate widely without creating the local organisation needed to sustain action.

A previous Ujasusi assessment of declining mobilisation identified repression, organisational fragmentation, the loss of online mobilisation channels and intelligence infiltration as factors. The extent of infiltration remains difficult to establish, but suspicion itself can damage the trust required for collective action.

Low turnout should not be interpreted as approval of Samia or indifference to the dead. It shows how difficult and dangerous public resistance has become.

Online activism and daily bread

For many street vendors, motorcycle taxi riders, market traders, casual labourers and other hustlers, the immediate priority is earning enough to feed their families. A day without work can mean a day without income.

When a protest is threatened, businesses may close or customers may stay away in anticipation of unrest. Those losses can occur even if the demonstration never materialises. The impact varies by place and date, but the political risk is clear: repeated calls that carry economic costs without visible results could cause working people to distance themselves from online campaigners.

That would benefit the government. It would allow the authorities to portray activists as detached from the citizens whose support they seek.

The movement needs to connect justice for the massacres with livelihoods, the cost of living and the ability to work without fear. A Tanzanian who cannot afford to lose a day’s earnings is not necessarily a government supporter.

The intelligence and security dimension

The state response combined lethal force, monitoring of protest calls, arrests, digital restrictions and security deployments. Killings have been attributed to police and people in plain clothes. Authorities also detained alleged organisers ahead of later protests.

The July arrests show how surveillance and counterterrorism powers entered the response. Police said defence and security agencies had monitored the suspects’ activities before announcing the arrests; some were subsequently charged with terrorism-related offences.

Assessment: moderate confidence. The pattern is consistent with intelligence-led monitoring and disruption of political mobilisation. Pre-emptive arrests and surveillance of online calls indicate collection and targeting before protesters reach the streets. The available evidence does not establish which institution directed each operation or whether the plainclothes personnel involved in killings belonged to TISS.

The question is how intelligence was collected and used: whether agencies identified genuine threats of violence, treated peaceful political activity as a security threat, or did both. Deployment orders, operational communications and command records are necessary to establish responsibility.

CCM and religious backing

CCM is not reluctantly standing beside Samia. The ruling party benefits when opponents are excluded, critics are intimidated and political competition is restricted.

Its leadership endorsed the Chande Commission’s findings, providing political cover for the government’s response. The likely outlook is continued alignment: the system that protects Samia also protects CCM’s dominance.

Influential religious institutions have strengthened the president’s position. After the violence, Muslim institutions including BAKWATA supported Samia’s inquiry and reconciliation initiative. Pentecostal figures, including Mwamposa, have also been part of the religious support around her. Their public reach gives the government access to audiences and moral authority that political institutions alone cannot provide.

Calls for peace matter. But reconciliation cannot require families to abandon questions about who killed their relatives or what happened to the missing.

Three tests in the coming months

Commonwealth: within days. CMAG’s next meeting is scheduled alongside the St John’s gathering beginning on 1 November. It is likely to keep Tanzania under scrutiny and continue diplomatic engagement. Suspension is unlikely in the near term, given the group’s response so far. The test is whether outstanding demands produce consequences beyond another appeal for progress.

US Senate bill: before 3 January 2027. The bill remains a source of pressure, but its place on the calendar does not guarantee a vote. With limited legislative time remaining, it is likely to lapse at the end of the current Congress unless it advances or its provisions are included in another measure.

Lila Commission: early 2027. The inquiry could establish a fuller record, but it is likely that the government will continue to emphasise alleged organisers and funders. Whether the commission gives comparable scrutiny to security-force conduct remains uncertain. Its treatment of commanders, operational records, witnesses and missing persons will be the clearest indicators of whether it is pursuing accountability.

Victims’ families and their lawyers should have a safe opportunity to submit documented incidents and missing-person cases to the commission. Those submissions and the commission’s responses can also inform scrutiny by Tanzanian civil society, Commonwealth representatives and foreign legislators.

Outlook

The most likely near-term outcome is continued political control without meaningful accountability. Samia retains the support of CCM’s leadership and the security apparatus. The opposition remains divided, and international pressure has not yet compelled the government to publish the Chande report or deliver justice.

A more consequential challenge would require trusted coordination among opposition parties, domestic activists, diaspora campaigners and victims’ families, combined with a strategy that recognises the economic realities of ordinary Tanzanians. International partners would need to match deadlines and statements with measurable consequences.

The greatest danger is that the massacres become normalised: remembered by families and activists, acknowledged in diplomatic statements, but never subjected to an investigation capable of establishing responsibility.

The dead cannot be normalised away

The Chande report should be published. The Lila Commission should investigate security-force conduct and command responsibility, protect witnesses and release its findings. Families should be able to report deaths and disappearances without fear. Evidence of crimes should reach independent prosecutors.

The dispute between Intelwatch’s estimate and the commission’s figure must not obscure the people behind it: Tanzanians who were killed, families who buried loved ones, and relatives who still do not know what happened.

A year has passed. Samia’s government has survived. The dead have not received justice.

Assessment cut-off time: 26 October 2026 at 0100 GMT

Tanzania approaches the first anniversary of the 29 October 2025 election massacres amid three developments involving its main opposition party, CHADEMA (Party for Democracy and Progress):

• Party chairman Tundu Lissu has announced a hunger strike from 26 October.

• Senior party official John Pambalu was charged with treason on 21 October.

• Twaha Mwaipaya, a mobilisation coordinator with the party’s youth wing, BAVICHA, was abducted near Nairobi, Kenya, on 25 October.

Lissu’s treason verdict falls on 6 November.

READ ALSO

🔎 Pambalu, Lissu and Mwaipaya Cases Converge in Five Days Before Tanzania’s Anniversary

Within five days, two treason cases against CHADEMA leaders converged with a cross-border abduction and the Catholic Church’s nationwide commemoration plans. The sequence below covers confirmed events and scheduled dates within the assessment window.

⚖️ Tundu Lissu Announces Hunger Strike Over Alleged Defiance of High Court Order at Ukonga Prison

CHADEMA announced that Lissu will begin a hunger strike from Monday to force prison authorities to allow private meetings with his lawyers. The High Court had ruled in his lawyers’ favour on consultation restrictions at Ukonga Prison, in a judgment reported on 17 October. The party accuses the authorities of failing to respect the ruling.

CHADEMA secretary-general John Mnyika said Lissu fears for his life and questions whether food supplied by officials defying a court order can be trusted. His lawyer, Rugemeleza Nshala, said consultations had been denied despite the order, and that on some occasions access had been barred altogether. Nshala also said Lissu relies on medication and is prepared to stop taking it. The Citizen separately reported his threat to refuse medication.

Lissu survived being shot 16 times in 2017. He has been detained for more than 18 months and conducted a previous hunger strike in May 2025 over remote court hearings. In July 2026, a statement on his X account warned that his life was at serious risk. As of 24 October, prison authorities, police and the government had issued no public statement on the planned strike.

🧑‍⚖️ John Pambalu Becomes Second CHADEMA Leader Charged With Treason

Pambalu is a member of CHADEMA’s national council and former leader of its youth wing. He was charged with treason on Wednesday, an offence carrying a potential death sentence. The charge sheet accuses him of seeking to obstruct the 2025 General Election and of conducting continuous protests to intimidate the executive.

He is the second CHADEMA leader to face treason charges after Lissu. Speaking at a public meeting in Arusha, deputy chairman John Heche said he expected a similar case against himself but would not leave the country.

🚨 Twaha Mwaipaya Abducted by Three-Vehicle Team in Kamulu Near Nairobi

Amnesty International Kenya reported that Mwaipaya was abducted at around 2pm on 25 October in Kamulu, Machakos County, while travelling by taxi to visit friends. The abductors used three vehicles, including a Toyota Land Cruiser Hardtop. Mwaipaya became BAVICHA’s national mobilisation coordinator in 2019 and is a prominent critic of President Samia Suluhu Hassan’s administration.

He fled to Kenya in 2025 after imprisonment in 2022, and has nearly 600,000 Instagram followers. CHADEMA and Amnesty both confirmed the kidnapping. CHADEMA foreign affairs chief John Kitoka, himself in exile in Nairobi, said he feared for Mwaipaya’s life and his own safety. Tanzanian activist Maria Sarungi Tsehai appealed for Toyota Hardtops to be inspected at the border crossings, particularly Namanga. At the time of writing, Mwaipaya’s whereabouts and the identity of his abductors remain unknown.

⛪ Catholic Bishops and Rights Defenders Prepare to Mark the 29 October Massacres

The Tanzania Episcopal Conference has ordered memorial Masses nationwide on Thursday 29 October in parishes, prayer centres and Church institutions. The letter, signed by TEC President Bishop Wolfgang Pisa, dedicates the Masses to those killed, injured or missing, and to their families. The Tanzania Human Rights Defenders Coalition has advised President Samia to declare a memorial day on 29 October.

The anniversary commemorates approximately 10,000 people killed, the figure documented in the Intelwatch dossier submitted to the International Criminal Court. The state’s Chande Commission recorded 518. Its own chairman conceded the true toll was likely higher because some families buried relatives without taking bodies to morgues.

The UK Foreign Office updated its travel advice on 20 October. It notes social media calls for demonstrations on the anniversary, previous internet restrictions during protests, and that security services may check phones for election-related content. President Samia is scheduled to inaugurate the Government City on 30 October.

🧭 Ujasusi Key Judgements on Lissu, Pambalu and Mwaipaya to 6 November

Read more

PAPERBACK

KINDLE

The killings that followed Tanzania’s 29 October 2025 election demand an explanation that reaches beyond the events themselves. Nyerere to Samia: The Road to Tanzania’s Post–October 2025 Election Massacres traces the institutions, political networks and security practices built across six presidencies—and asks how they made such violence possible.

Former Tanzanian intelligence officer Evarist Chahali connects that institutional history to the crisis and its aftermath. An introduction and twenty chapters take readers from the foundations of the post-independence state to the difficult questions of responsibility, accountability and reform.

📖 Twenty chapters that build the argument

🏛️ Part I: Foundations

1. The Mwalimu’s Bargain
Shows how Nyerere’s nation-building project combined national unity with political monopoly, establishing institutions that outlived his presidency.

2. The Invisible Architecture
Traces the intelligence service’s development from colonial Special Branch to TISS, revealing how political surveillance became embedded in government.

3. Mwinyi and the Zanzibar Fault Line
Explores economic liberalisation and multiparty politics alongside the survival of coercive institutions and unresolved Union tensions.

🕸️ Part II: Consolidation

4. Mkapa’s Quiet Hand
Probes the relationship between reform, political control and security-force violence beneath an administration associated with technocratic government.

5. Kikwete’s Velvet Fist
Investigates the intersection of political networks, commercial interests, intelligence and the management of dissent.

6. The Zanzibar Laboratory
Connects successive disputed elections, security operations and political settlements to the book’s argument about recurring violence without accountability.

7. The Mtandao
Maps the political-commercial network, its influence, its disruption under Magufuli and its subsequent re-emergence, distinguishing documented connections from allegations.

8. The Intelligence Dimension
Analyses presidential control, patronage, opposition penetration and digital surveillance, asking whose interests intelligence institutions serve.

⚙️ Part III: The Magufuli Disruption

9. The Bulldozer
Assesses Magufuli’s transformation from anti-corruption reformer to increasingly restrictive ruler, separating his innovations from the powers he inherited.

10. MKIRU: The Forgotten Massacre
Investigates alleged extrajudicial killings and disappearances in Mkuranga, Kibiti and Rufiji, including the case of journalist Azory Gwanda.

11. Sexual Violence as Weapon of State
Documents cases and allegations of sexual violence and torture, identifying the institutional conditions that enable abuse.

12. The Death of the President
Scrutinises the secrecy surrounding Magufuli’s illness and death, distinguishing the official account from competing hypotheses and unproven allegations.

🔎 Part IV: Samia and the Collapse

13. The Two Phases of Samia
Traces the initial political opening and its reversal, examining why expectations of reform gave way to renewed repression.

14. Ameir and Lissu: Power, Allegation and Political Targeting
Examines Lissu’s sustained targeting and allegations concerning informal influence around the presidency.

15. Haji Omar Kheir
Uses a security official’s career and alleged influence to explore the distance between formal office and practical authority.

16. The October 29 Massacres
Reconstructs the election crisis, internet shutdown and mainland killings, examining operational patterns, responsibility, competing assessments and the basis for the book’s working figure of approximately 10,000 deaths.

⚖️ Part V: Reckoning

17. The Chande Commission
Tests the official inquiry’s mandate, methods and findings against the demands of credible investigation and criminal accountability.

18. The ICC and Article 17
Explains the international accountability questions, distinguishing submissions and allegations from findings by judicial institutions.

19. The Architecture Exposed
Brings the evidence together, showing how surveillance, patronage, coercive law, information control and impunity can reinforce one another.

20. What Comes After
Sets out what institutional transformation would require, and considers what the crisis means for Tanzania, Zanzibar and the wider region.

💡 Why does this book deserve your attention?

Its strength lies in connecting subjects too often considered separately: presidential leadership, intelligence operations, political networks, violence and failed accountability. Across the chapters, individual events become part of a larger inquiry into how power is organised, exercised and protected.

For Tanzanians, the book offers a framework for scrutinising the institutions that shape their political lives. For readers of intelligence studies and African politics, it presents a case through which to examine how security services, ruling parties and informal networks interact across successive administrations.

Readers need not agree with every assessment to recognise the importance of the questions. Understanding which practices survived leadership changes—and why—matters when judging what meaningful reform would require.

Tanzania’s future cannot be understood through its leaders alone. The institutions they inherit, and leave behind, deserve equal scrutiny.

Nyerere to Samia is available in paperback through African Books Collective and Amazon and as a Kindle eBook.

AD

Click here to buy on AMAZON

Intelligence and Security Developments

1. Nigeria: Former DSS Chief Returns to an Influential Security Institution

President Bola Tinubu appointed Yusuf Magaji Bichi, the former director-general of Nigeria’s Department of State Services (DSS), chairman of the Governing Board of the National Institute for Security Studies (NISS) on 22 October. The appointment was reportedly recommended by the serving DSS director-general, Oluwatosin Adeola Ajayi, and gives Bichi a four-year role in an institution responsible for advanced security education and professional development.

Bichi’s return matters because NISS helps shape the professional outlook of Nigeria’s security leadership. Although its governing board does not command intelligence operations, it can influence institutional priorities, research and the training of senior officials. The appointment also suggests continuity between the present DSS leadership and its former director-general, despite the change in command in August 2024.

Assessment: Bichi’s appointment restores his institutional influence without returning him to operational command. Its longer-term significance will depend on changes in training priorities, senior appointments and interagency cooperation.

2. Uganda: Rwandan Dissident’s Murder Raises Questions About Security-Service Involvement

Robert Kabera, a former Rwanda Defence Force sergeant major and outspoken critic of President Paul Kagame, was found beheaded in Mpigi District on 17 October. He had repeatedly reported threats and attacks since fleeing Rwanda in 2020, including incidents involving Ugandan security personnel and unidentified assailants.

A potentially significant development preceded the murder. A report reproducing an alleged 3 October X post identified Rwandan social-media personality Clenia Dusenge, known as Madederi, as having appealed to Uganda’s military chief, General Muhoozi Kainerugaba, to act against Rwandan government critics living in Uganda. The accompanying list reportedly included Kabera’s YouTube channel, Major Robert TV. The original post and any connection to the killing have not been independently authenticated.

Assessment: The chronology strengthens concern about political targeting. However, responsibility remains unresolved, and possible Ugandan security involvement deserves consideration alongside a Rwanda-directed operation. The featured assessment examines the competing explanations.

3. DR Congo: Referendum Legislation Intensifies Constitutional Tensions

The Democratic Republic of the Congo’s National Assembly approved referendum legislation on 23 October, with 346 deputies voting in favour, none against and one abstention. Opposition representatives boycotted the proceedings amid concerns that the legislation could facilitate constitutional changes before President Félix Tshisekedi’s second term expires in 2028.

The legislation does not itself remove constitutional protections surrounding presidential term limits. Nevertheless, its political significance is considerable. A dispute over constitutional legitimacy could weaken Kinshasa’s ability to maintain a united response to the continuing rebellion in eastern Congo. It could also provide opportunities for armed and political opponents to present themselves as alternatives to the current government.

Assessment: The immediate risk is a widening political confrontation over constitutional intentions, rather than an already established extension of Tshisekedi’s presidency.

4. DR Congo: Kabila’s Rebel Alliance Seeks Political Expansion

Former president Joseph Kabila’s emergence as leader of the Front pour la Refondation de la Nation (FRN), announced on 12 October, has added a prominent political figure to the constellation of forces opposing President Tshisekedi. The development is particularly significant because of the FRN’s association with the AFC–M23 rebellion, which continues to challenge government authority in eastern Congo.

Kabila possesses political networks and experience that could help broaden the movement’s appeal beyond its existing leadership. However, established AFC–M23 figures, including Corneille Nangaa, Bertrand Bisimwa and military commander Sultani Makenga, remain influential. The political reorganisation has not yet demonstrated a corresponding increase in military capability.

Assessment: Kabila’s involvement could broaden the rebellion’s political ambitions, but its operational consequences remain uncertain. New financing, recruitment or alliances beyond the movement’s existing support base would indicate a more substantial change.

5. Burundi: Espionage Accusations Raise Questions About Internal Security

Burundian authorities presented 13 people accused of espionage, reportedly including Banyamulenge refugees and Christian pastors. Officials alleged connections to Rwanda and armed groups in eastern Congo. The accusations have not been independently substantiated.

Burundi’s involvement in the eastern Congo conflict gives its intelligence services reasons to investigate possible hostile networks. However, the reported targeting of refugees and individuals with religious affiliations raises concerns that the campaign could extend beyond conventional counterintelligence into communal suspicion and domestic political control.

Assessment: The arrests reflect heightened security concerns involving Rwanda and eastern Congo. Their wider significance depends on whether the allegations are supported by credible evidence or become part of a broader campaign against vulnerable communities and perceived opponents.

6. Tanzania: Second Senior CHADEMA Figure Faces Treason Charges

John Justine Pambalu, CHADEMA’s director for organisation, training and elections, was charged with treason in Dar es Salaam on 21 October. Prosecutors allege that he participated in plans to disrupt the October 2025 general election. The allegations remain unproven.

His prosecution follows the continuing treason proceedings against CHADEMA chairman Tundu Lissu, whose judgement is scheduled for 6 November. Both cases unfold amid unresolved disputes surrounding the violence that followed the October 2025 election, including sharply contested casualty figures and questions about the conduct of security forces.

Assessment: The cases demonstrate sustained legal pressure on Tanzania’s principal opposition party. Their political consequences may extend beyond the courts, particularly if the proceedings intensify domestic grievances or international scrutiny. Publicly available evidence does not establish direct TISS involvement in the charging decisions.

7. INTERPOL: Serengeti III Produces Major Cybercrime Arrests

Operation Serengeti III resulted in 1,462 arrests and the recovery of more than US$105 million, according to results announced on 22 October. Conducted between 29 June and 31 August, the operation involved law enforcement agencies across 20 African countries and the United States. Authorities identified 10,909 malicious networks, with reported victim losses exceeding US$385 million.

The operation targeted ransomware, online investment fraud, business email compromise and other cyber-enabled crimes. Its scale demonstrates the growing importance of multinational intelligence sharing, particularly the exchange of financial records, digital evidence and technical indicators connecting criminal operations across borders.

Assessment: Serengeti III represents a significant operational achievement, although arrests and disrupted networks do not necessarily translate into lasting dismantlement. Its longer-term value will depend on prosecutions and sustained investigative cooperation.

8. Mali: Alleged Abuses Undermine Counterinsurgency Credibility

Malian security forces and Russia’s Africa Corps were implicated in civilian killings, torture and other abuses in findings published on 22 October. The allegations include a September drone strike near Guélédié that reportedly killed eight civilians at a location associated with internet access and allegedly frequented by militants.

The incidents raise concerns about the reliability of targeting intelligence and the consequences of coercive interrogation. Civilian casualties and abusive detention practices can undermine cooperation with local communities, depriving counterinsurgency forces of information while potentially strengthening militant recruitment narratives.

Assessment: If substantiated, the abuses would represent more than a human rights problem. They could directly weaken Mali’s counterinsurgency campaign by damaging the intelligence relationships on which operations depend.

9. Somalia: Federal–Regional Fighting Creates Opportunities for al-Shabaab

Fighting between Somali federal forces and troops aligned with former South West State president Abdiaziz Hassan Mohamed Laftagareen intensified following the capture of Buur Hakaba on 15 October. More than 200 government-aligned soldiers were reportedly taken prisoner, while the confrontation disrupted military movements and important supply routes.

The dispute threatens to divert forces and political attention from the campaign against al-Shabaab. The militant organisation has repeatedly exploited divisions within Somalia’s political and security establishment, although there is no established evidence that the latest confrontation has already produced major territorial gains for the group.

Assessment: Prolonged federal–regional confrontation risks weakening counterterrorism coordination and creating opportunities for al-Shabaab to exploit fragmented security priorities.

10. Nigeria: Taraba Attack Highlights Continuing Rural Insecurity

Gunmen attacked Binnari village in Taraba State on 23 October, killing civilians and looting property. Police initially reported ten deaths, while subsequent reporting placed the toll at at least 40, citing Amnesty International. The discrepancy remains unresolved.

The perpetrators have not been conclusively identified. The attack occurred in a region affected by overlapping criminal, communal and armed-group violence, making immediate attribution to a particular organisation unreliable.

Assessment: The attack highlights persistent weaknesses in rural security, particularly the ability of authorities to anticipate violence and respond before armed groups inflict substantial casualties.

11. Ethiopia–Kenya: Communal Violence Causes Cross-Border Displacement

Fighting involving Oromo and Somali communities in southern Ethiopia has driven thousands of people across the border into Kenya. Reports indicated at least nine deaths, while subsequent estimates placed the number of displaced people entering Kenya above 14,000.

The violence illustrates how local communal disputes can rapidly acquire regional consequences. Continued instability around Moyale could disrupt commercial routes, strain Kenyan border communities and complicate security cooperation between Addis Ababa and Nairobi.

Assessment: Although the immediate consequences are humanitarian, prolonged violence could create wider border-security and economic pressures.

12. United States: Pentagon Reportedly Considers Expanded Clandestine Espionage

The Pentagon was reportedly considering a clandestine human-intelligence capability using operatives under civilian cover, partly in response to strategic competition with China. The Pentagon denied that such a programme was already operating.

The proposal would be significant because deep-cover human intelligence has traditionally been associated with civilian intelligence agencies, particularly the CIA. An expanded military role could introduce new operational capabilities but also questions about coordination, oversight and the separation of military and civilian intelligence responsibilities.

Assessment: The reporting indicates possible institutional ambition rather than an established operational change. Formal authorisation, funding and organisational decisions would determine its significance.

Featured Intelligence Assessment

Robert Kabera’s Murder: Rwanda, Uganda and the Politics of Targeted Violence

Key Judgements

Political targeting is a credible explanation for Kabera’s murder. Confidence: Moderate. His public criticism of the Rwandan government, documented threats and previous attacks provide grounds for examining a political motive, although the identity of his killers remains unknown.

The possibility of Ugandan security involvement cannot be excluded. Confidence: Low regarding involvement in this case. Uganda’s documented record of abuses against government critics, Kabera’s earlier detention by Ugandan security personnel and public pressure for action against Rwandan dissidents make this an important analytical consideration. None establishes that Ugandan officials participated in his murder.

Rwandan state involvement remains plausible but unproven. Confidence: Low regarding attribution. The wider history of repression against Rwandan dissidents abroad and earlier demands for Ugandan action against critics provide relevant context. They do not demonstrate that Kigali directed this killing.

Possible cooperation between Ugandan and Rwandan actors is a distinct hypothesis. Confidence: Low. Kabera alleged that Rwandan officials were present during his detention by Ugandan security personnel in 2022. The allegation has not been independently corroborated, and no evidence presently links that episode to his murder.

A Killing Preceded by Public Warnings

On 17 October 2026, the body of former Rwandan soldier and dissident Robert Kabera was discovered in a eucalyptus plantation in Luwala village, Mpigi District, Uganda. His head had been severed and, according to police statements issued two days later, had not been recovered. Investigators believed he may have been killed late on 16 October or early the following morning.

Kabera, approximately 50, was a former Rwanda Defence Force sergeant major and military musician who fled Rwanda in November 2020. From Uganda, he became an outspoken critic of President Paul Kagame’s government through his YouTube channel, Major Robert TV. He had repeatedly reported threats against his life, and his concerns were sufficiently serious to attract the attention of Ugandan police, international human rights organisations and refugee protection agencies.

The most striking development preceding his murder was a reported public appeal directed at Uganda’s military chief, General Muhoozi Kainerugaba.

A report published on 18 October reproduced screenshots of an alleged X post dated 3 October, attributed to Rwandan actress and social-media personality Clenia Dusenge, known as Madederi. The message reportedly called on Muhoozi to act against Rwandan government critics operating from Uganda and named several individuals and YouTube channels, including “Sgt Major Kabera Robert — MAJOR ROBERT TV”.

If the reproduced post is authentic, Kabera was publicly identified in an appeal to Uganda’s most senior military officer just 14 days before his body was discovered. That is a significant chronological connection. However, the post’s authenticity, Dusenge’s intentions and any relationship between the appeal and the killing have not been independently established. The material does not demonstrate that Muhoozi responded, that security personnel acted on the appeal or that Dusenge possessed advance knowledge of an attack.

Public identification of a future murder victim is relevant evidence of a potentially threatening environment, but it is not, by itself, evidence identifying the killers.

Rwandan Pressure on Uganda Was Already Documented

The October social-media controversy did not emerge in isolation. Rwandan authorities had previously included Kabera in demands that Uganda deport government opponents to Rwanda. A September 2021 Ugandan police communication acknowledged that accusations originating from Rwanda had complicated efforts to protect him.

In May 2022, Ugandan police and military personnel arrested Kabera in Kampala over alleged weapons-smuggling offences. Kabera subsequently alleged that officers beat him and fractured his ankle. He also claimed that Rwandan officials were present during his detention, including individuals associated with Rwanda’s diplomatic mission in Uganda. The alleged presence of those officials has not been independently corroborated, and the available evidence does not establish that his arrest formed part of a joint operation.

Kabera reported further threats after his release. In July 2022, he said men speaking Kinyarwanda assaulted him and threatened to return him to Rwanda. In October 2023, he reported another attack in which unidentified men allegedly warned that they would kill him even if he relocated to the United States.

These incidents establish a prolonged pattern of reported intimidation, although the perpetrators and connections between the episodes remain uncertain. They also demonstrate that Kabera’s fears were known well before the events of October 2026.

Uganda’s Own Security Record Complicates the Case

It would be analytically inadequate to treat Uganda solely as a country that failed to prevent a possible foreign intelligence operation. Uganda’s military and security agencies have themselves been accused of abducting, unlawfully detaining and torturing political opponents. Documented abuses against government critics include cases involving personnel associated with the military establishment.

Muhoozi’s public conduct is relevant to this environment. He has repeatedly used social media to issue threats against political opponents, while also presenting himself as a supporter of Rwanda and President Kagame. His public positions do not establish involvement in Kabera’s murder, but they make the reported October appeal to him more significant than an ordinary exchange between social-media users.

The appeal was allegedly directed to an individual who commands Uganda’s armed forces and has publicly expressed strong political views about Rwanda. If the message was authentic, its authors were not simply criticising Kabera; they were requesting action from a figure with substantial coercive authority.

That does not mean Muhoozi ordered or approved Kabera’s killing. It means the possible role of Ugandan actors cannot be excluded from the assessment merely because the victim was an opponent of the Rwandan government.

Uganda’s treatment of Kabera also presents an institutional contradiction. He had previously been detained and allegedly assaulted by Ugandan security personnel, yet a May 2023 letter from Uganda’s inspector general of police confirmed that he had received asylum and additional protection. The same letter indicated that arrangements for resettlement to a third country were approaching completion. More than three years later, Kabera remained in Uganda and was killed.

This history leaves open several possibilities: that Ugandan authorities were unable to protect him, that individuals within the security establishment acted against him, or that external actors exploited his vulnerability. None has been established as the explanation for his death.

The Circumstances of the Final Encounter

The circumstances immediately preceding Kabera’s death add another potentially important element.

A relative reported that Kabera travelled to his construction site on 16 October with a Kinyarwanda-speaking man who presented himself as a political opponent seeking assistance. Kabera reportedly contacted a family member at approximately 11 p.m. that night. The relative said the accompanying man had supplied a false telephone number and that Kabera could not be contacted the following day.

The account has not been publicly corroborated by Ugandan police, and the man’s identity and role remain unknown. Nevertheless, if accurate, it suggests that Kabera may have been approached through his political activities rather than encountered randomly.

A forensic expert who examined photographs and videos of Kabera’s remains considered that the mutilation probably occurred after death and observed indications that his hands may have been restrained. Those observations support concern about a deliberate killing, although they do not establish who was responsible or why the body was mutilated.

The violence of the killing has generated speculation about a political message intended to intimidate other dissidents. That interpretation is plausible, but the available evidence cannot establish whether intimidation was the perpetrators’ objective.

Competing Explanations

A Rwanda-directed operation

Kabera’s criticism of the Rwandan government, the history of reported threats against him and Rwanda’s documented repression of critics abroad provide grounds for considering a state-directed operation. Earlier Rwandan pressure on Uganda concerning Kabera strengthens the relevance of this explanation. However, no publicly established evidence connects his killers to Rwandan intelligence or security institutions.

An operation involving Ugandan security actors

Uganda’s record of abuses against political critics, Kabera’s earlier detention and the reported appeal addressed to Muhoozi provide grounds for considering whether Ugandan security personnel or politically connected individuals participated in the killing. This could involve direct action or assistance to others. No evidence currently establishes such participation, and there is no demonstrated connection between Muhoozi and the perpetrators.

Cooperation between actors in both countries

A third possibility is cooperation between individuals associated with Rwandan and Ugandan security networks. Kabera’s allegation that Rwandan officials were present during his 2022 detention makes this a relevant hypothesis, but that allegation remains uncorroborated. There is no established evidence of a joint operation in October 2026.

Independent political violence

Individuals hostile to Kabera’s political activities may have targeted him without formal direction from either government. Public hostility, personal networks and political loyalties can motivate violence independently of official orders. This explanation is compatible with political targeting but remains unsupported by an identified perpetrator or organisation.

A non-political killing

A personal dispute or other criminal motive cannot be excluded. However, the documented threats, previous attacks and reported identification of Kabera shortly before his death provide stronger affirmative reasons to consider a political motive than the available reporting provides for an unrelated dispute.

Overall judgement: Political targeting is a credible explanation for Kabera’s murder, but the evidence does not support confident attribution to a particular state, institution or individual. The reported 3 October target list increases the significance of possible Ugandan involvement without establishing it.

Uganda’s Protection and Counterintelligence Challenges

Kabera’s murder exposes a contradiction within Uganda’s security environment. The country hosts Rwandan refugees and dissidents who fear persecution in their homeland, yet its own security agencies have been implicated in the repression of political opponents. Kabera’s case brings those two realities together. He had been recognised as a refugee requiring protection, but he had also been arrested by Ugandan security personnel and reported mistreatment while in custody.

If the murder is linked to foreign operatives, Uganda would face serious questions about its ability to detect and prevent hostile intelligence activity on its territory. Evidence of Rwandan state involvement could complicate relations between Kampala and Kigali, particularly given their history of mutual security suspicions. Such a development would also raise concerns among other Rwandan dissidents about whether Uganda can provide effective protection against threats originating beyond its borders.

Evidence implicating Ugandan security personnel would have different and potentially more damaging domestic implications. It would suggest that elements of the institutions responsible for protecting refugees may themselves have participated in violence against one. If cooperation between Ugandan and Rwandan actors were established, the case could expose security relationships operating beyond publicly acknowledged arrangements.

Even without evidence of official participation, Kabera’s death raises questions about the protection offered to a refugee whose vulnerability had been recognised for years. His continued presence in Uganda despite earlier indications of imminent resettlement, combined with repeated threats and attacks, suggests that the protective arrangements surrounding him deserve scrutiny. The case may also deepen fear among Rwandan dissidents who already regard political activity in exile as carrying personal risks.

Outlook

Kabera’s murder could become a sensitive issue in Uganda–Rwanda relations if credible evidence emerges connecting the perpetrators to officials or security networks in either country. A finding of foreign involvement would intensify scrutiny of hostile intelligence activity on Ugandan territory, while evidence implicating Ugandan personnel would shift attention towards the conduct and accountability of the country’s own security establishment.

The reported social-media hostility towards Rwandan dissidents introduces another concern. If individuals interpreted public calls for action as encouragement to threaten or attack political opponents, the consequences could extend beyond Kabera’s murder. Other Rwandan critics living in Uganda may face increased intimidation or feel compelled to restrict their public activities, even if the investigation ultimately establishes no official involvement.

An inconclusive investigation could leave these competing explanations unresolved, reinforcing distrust among refugees and encouraging further speculation about the role of state institutions. Conversely, credible identification and prosecution of those responsible could help establish whether the murder was connected to political activity, foreign intelligence interests or another motive.

Final assessment: Kabera’s murder cannot responsibly be attributed to Rwanda simply because he opposed Kagame. Nor should Uganda be treated merely as the scene of a foreign operation. The combination of earlier Rwandan pressure, Kabera’s encounters with Ugandan security personnel, the reported appeal to Muhoozi and the timing of the killing makes this a case involving potentially overlapping political and security interests. The available evidence supports serious concern about targeted political violence, but not a definitive judgement about the perpetrators.

Developments to Watch

Leave a comment

Key Judgements

1. Kabila’s leadership broadens the political challenge to Tshisekedi more clearly than it changes the military balance. The FRN retains leading AFC/M23 figures. Kabila gives the rebellion a prominent national figure through whom to seek support and negotiate. Confidence: Moderate.

2. Pressure for a political settlement before 2028 is a more plausible immediate objective than a direct military advance on Kinshasa. Negotiations, elite defections and territorial pressure could operate together. The coalition’s capacity to force a leadership change depends on support beyond its existing eastern base. Confidence: Moderate on the immediate objective; Low on the timing of any transfer of power.

3. Tanzania’s support for Kinshasa carries security and commercial risks. Existing cooperation and the reported arrest of a Congolese government critic demonstrate a relationship with practical consequences. They do not establish a new Tanzanian military deployment or identify an intelligence-service role. Confidence: Moderate on the alignment and associated risks.

4. Monamo’s appointment provides continuity, while leaving the direction of reform uncertain. An internal successor provides continuity. Changes to oversight, appointments and operational priorities would provide stronger evidence of a wider institutional shift. Confidence: Moderate.

5. The Starshield restrictions and AdFection findings expose different vulnerabilities arising from reliance on external digital infrastructure. Starshield concerns control over a military service. AdFection concerns the use of commercial advertising systems for surveillance. Their implications extend to organisations that depend on infrastructure they neither own nor fully control. Confidence: Moderate.

6. Financial allegations could strengthen Kabila’s attempt to challenge Tshisekedi on governance as well as security. Their political significance extends beyond the eventual legal findings: they create pressure for explanations of how public resources and politically connected intermediaries are used. Neither the Belgian inquiry nor the reported US inquiry establishes personal wrongdoing by Tshisekedi. Confidence: Moderate on the political implications.

🌍 African intelligence and security developments

Democratic Republic of Congo: Kabila assumes leadership of the FRN

Joseph Kabila was named leader of the FRN in Goma on 12 October. The new political and military coalition succeeds the AFC/M23 alliance. Corneille Nangaa and Bertrand Bisimwa hold vice-presidential positions. Sultani Makenga retains military command and also holds vice-presidential rank. A statement issued on 14 October and reported the following day names Freddy Kaniki as secretary-general and executive coordinator.

The coalition said it would assume existing commitments under the Doha process. Tshisekedi chaired a Supreme Defence Council on 14 October, after which the military announced instructions to defend territorial integrity and protect civilians.

Kabila brings a former president’s profile and relationships to a coalition whose senior command remains largely intact. Whether the FRN can attract political support or security-force defections beyond the Kivus will determine how far that change affects the national balance.

Botswana: Monamo succeeds Magosi in an acting capacity

Aobakwe Moemedi Monamo became acting director-general of the Directorate of Intelligence and Security (DIS) following Peter Fana Magosi’s retirement on 13 October. Monamo previously served as deputy director-general. The DIS leadership information identifies the succession as an internal appointment.

Promoting the deputy provides continuity while the permanent leadership decision remains open. Whether the succession also brings reform will depend on changes to the service’s mandate, oversight and senior personnel.

The acting appointment alone gives little indication of President Duma Boko’s longer-term intentions for the directorate.

DRC–Belgium: Financial investigation followed by restrictions on embassy contacts

Belgian police conducted searches on 14 October in a money-laundering investigation. Lawyers representing the complainants told Reuters that the properties were linked to Tshisekedi’s relatives and associates. Prosecutors confirmed the searches but did not identify those targeted. The inquiry concerns allegations that mining revenues were diverted. The family denies the allegations.

A presidency circular dated 15 October and signed by chief of staff Anthony Nkinzo Kamole restricted contacts with the Belgian embassy. The directive reported on 16 October covers presidential advisers and other specified officials and gives no reason for the restriction.

The timing suggests the directive may be a response to the investigation, but the circular gives no explanation. The restriction narrows the presidency’s direct diplomatic contacts. The reported directive requires necessary communication to pass through the Foreign Ministry.

DRC–United States: Reported White House inquiry concerns $17.6 million transfer

The New York Times reported on 17 October that a White House inquiry into a dispute between Richard Grenell and Alina Habba Mildon centres on a $17.6 million transfer made in 2025 from a bank account affiliated with the Congolese government to TX-AT, a Texas security and defence firm.

According to people familiar with the matter cited by the newspaper, Habba Mildon initially described the funds as coming from her husband, Turkish businessman Turhan Mildon. Documents initially submitted to the White House reportedly had the sender’s name redacted. Officials subsequently learned of the account’s connection to the Congolese government. Mildon has acknowledged serving as an adviser to Tshisekedi and holding a Congolese diplomatic passport.

Habba Mildon alleged that part of the money was intended for the Kennedy Center but never reached it. Grenell denied the accusations, any connection to the transfer and involvement with TX-AT at the time, while acknowledging earlier consultancy work for the firm. The Times reported that the Mildons, TX-AT, the White House and the Congolese foreign ministry did not respond to its requests for comment.

The purpose of the underlying transaction remains unclear. The reported inquiry raises questions about the source, authorisation and intended use of the funds, and the roles of intermediaries with political connections in both countries. It does not establish that Grenell received the money or that Tshisekedi authorised an improper payment.

Ethiopia–Eritrea: Fighting accompanied by competing accusations of aggression

Ethiopia accused Eritrea of an invasion in a letter to the UN Security Council dated 8 October and made public on 9 October. Eritrea rejected the accusation and alleged Ethiopian aggression. The UN secretary-general expressed concern on 10 October over fighting in Tigray, Afar and Amhara.

ACLED recorded the entry of Ethiopian forces and allied Tigray Peace Force fighters into Aksum on 14 October. Reports of Eritrean withdrawals remained contested. ACLED’s Ethiopia conflict reporting records changing control around Rama and Abiy Addi, alongside further deterioration of the political arrangements associated with the Pretoria agreement.

The competing accounts make battlefield control difficult to assess. The fighting is drawing Ethiopia’s internal conflicts and its confrontation with Eritrea closer together. Verified cross-border operations, sustained force concentrations and changes in external military support would indicate a further escalation.

Egypt–Sudan: Strike allegations place pressure on bilateral relations

Sudan’s Emergency Lawyers reported that an airstrike on the Jabal al-Uqaydat gold-mining area near the Egyptian border killed at least 72 people on 10 October. The group attributed the strike to Egypt. The precise location, death toll and responsibility remain disputed. AP separately cited a medical group reporting at least 13 deaths in the border triangle area. Egypt has not acknowledged an airstrike in Sudan.

Abdel Fattah al-Burhan ordered an investigation on 12 October. Sudanese officials maintained contact with Cairo. Egyptian authorities separately described operations against illegal mining inside Egypt, without acknowledging the alleged Sudanese strike.

A subsequent report on the Qustul crossing described the suspension of cargo and ferry movements amid tensions following the attack and shootings of drivers.

Cairo and Khartoum both have reasons to contain the dispute. Even so, allegations of a cross-border strike put sovereignty and civilian protection at issue in their security relationship. The inquiry’s findings, access to the mining area and the reopening of commercial transport will show whether efforts to contain the dispute are succeeding.

Algeria–Morocco: Algeria announces arrests over alleged sabotage preparations

Algeria’s national police announced on 11 October that 61 Moroccan nationals had been detained in Oran. The authorities alleged preparations for sabotage and said the group included a former Moroccan soldier. They described entry through Tunisia and mountain routes near El Kala.

Police did not identify intended targets or disclose detailed evidence. Their statement provides no basis for attributing the alleged operation to the Moroccan state.

The allegations could deepen an already adversarial bilateral relationship. Evidence presented in court, the charges brought against individual detainees and any official Moroccan response will determine whether it develops into a wider intelligence or diplomatic dispute.

Mauritius: Security restrictions follow protests and a police shooting

Protests over water shortages and living costs intensified after police shot and wounded a 27-year-old woman on 9 October. Demonstrations included roadblocks and damage to public buildings.

An initial curfew ran from the evening of 13 October to the morning of 14 October. The government then extended restrictions for the nights of 14 and 15 October. School closures were also announced. One officer was reportedly arrested and three others suspended in connection with the shooting and the response to it.

The immediate security concern is whether restrictions produce a sustained reduction in violence. Beneath the unrest lie grievances over basic services and confidence in police accountability. A return to normal traffic and schooling would indicate stabilisation, but would not resolve those grievances.

South Africa: National police commissioner cleared to resume duties

President Cyril Ramaphosa lifted National Police Commissioner Fannie Masemola’s suspension on 16 October, enabling his return on 19 October. Masemola had been suspended in April over charges connected to a police health-services contract. The presidency’s statement says prosecutors instructed that the charges be withdrawn on 15 September; the Pretoria Magistrates’ Court formally withdrew them on 22 September.

He returns amid wider scrutiny of alleged criminal influence within law enforcement and the justice system through the Madlanga Commission. Former deputy national commissioner Shadrack Sibiya also resigned during the week amid allegations and charges he denies.

Masemola’s reinstatement leaves the commission’s wider institutional questions unresolved. Command stability, procurement controls and the handling of ongoing investigations remain central to the police service’s credibility and effectiveness.

Nigeria and the Sahel: Continuing pressure on military positions and economic activity

Suspected Boko Haram fighters attacked an army base in Borno State’s Guzamala local government area on the night of 13 October. Reuters reported at least 10 soldiers killed, citing military sources and residents. Reports place the attack near Mairari. Neither the final toll nor responsibility had been officially established by the reporting cut-off.

The attack forms part of a wider pattern of sustained militant pressure. The Africa Center’s assessment of violence to mid-2026, published in August, recorded more than 20,000 deaths linked to militant Islamist violence across Africa for a fourth consecutive year, including an increase in the Lake Chad Basin.

Separately, ACLED’s Sahel analysis dated 8 October describes growing JNIM activity against mining operations near the Mali–Guinea border. The security implications extend beyond territorial control: attacks on military positions and extractive activity can disrupt local authority, revenue and transport. Those annual figures describe the wider conflict rather than the toll for this reporting week.

Tanzania: CHADEMA seeks international engagement on detention and accountability

Ahead of the reporting period, CHADEMA secretary-general John Mnyika appealed on 6 October to the Inter-Parliamentary Union’s secretary-general to visit detained party chairman Tundu Lissu and meet victims of the violence following the 29 October 2025 election. The appeal during the Arusha assembly placed detention and accountability before an international parliamentary audience.

Ujasusi’s earlier assessment of the accountability dispute uses an estimate of approximately 10,000 deaths. IntelWatch’s executive director has publicly alleged 5,000–10,000 deaths while discussing the coalition’s request for an ICC investigation. The estimate belongs to those making the allegation; it is not an ICC finding.

CHADEMA is using international parliamentary engagement to press for access to Lissu and recognition of victims’ accounts. The appeal reports a request, with no confirmed agreement to the proposed meetings.

🌐 International intelligence and technology developments

United Kingdom: MI5 sets out state-threat priorities and announces AI assessment centre

In his annual threat update on 13 October, MI5 director-general Ken McCallum said the service was devoting more resources to state threats than during the Cold War. He identified Russia as the leading state aggressor and said Iran-linked operations had resulted in more than 50 UK arrests over the previous year.

McCallum also announced that MI5 had established the AI Threat Assessment Centre during 2026. The centre brings together expertise from the AI Security Institute, National Crime Agency and National Cyber Security Centre to produce all-source assessments.

The centre gives AI threats a dedicated place in MI5’s assessment work. The wider speech also points to the importance of countering proxy activity and protecting infrastructure alongside conventional counterespionage. Its work will be one measure of how the service translates those priorities into practice.

Germany: Former BND director remains under investigation

Former BND director August Hanning and his former chief of staff, Manfred D., remained in custody following arrests and judicial decisions earlier in October. The Federal Prosecutor’s Office announced their arrests on 6 October. Hanning denies serious wrongdoing through his lawyer.

Media reporting has linked aspects of the case to Azerbaijan, which rejects the allegation. Prosecutors have not publicly identified the foreign state concerned. Reuters reported on 9 October, citing Spiegel, that Hanning had longstanding contacts with a former senior Chinese officer. The reported relationship does not identify the recipient of any alleged disclosure.

The case raises questions about former officials’ access to classified information and their continuing relationships inside an intelligence organisation. Any consequences for liaison partners will depend on the material involved, the recipients and the findings of the investigation.

Russia–Japan: Detention of Japanese journalist creates consular dispute

Russia’s FSB announced on 13 October that it had detained Yuki Imai, a Hokkaido Shimbun journalist based in Yuzhno-Sakhalinsk, on suspicion of espionage. Japan summoned the Russian ambassador the following day and sought information, consular access and humane treatment.

Russia has alleged espionage; the allegation has not been proved. Consular access, the basis for continued detention and disclosure of the evidence are now central to the diplomatic dispute.

United States: Research security and FBI personnel decisions under scrutiny

The Government Accountability Office published a report on 15 October, publicly released on 16 October, finding that the FBI lacked a plan to strengthen relationships with academic institutions in addressing non-traditional intelligence collectors. The GAO review identified cultural differences and inconsistent relationships as obstacles to information exchange. The FBI agreed to the recommendation.

Universities’ willingness to report concerns depends partly on whether they trust the FBI as a source of assistance. GAO’s category concerns collection for foreign entities, not a person’s nationality or academic status.

Separately, nine former FBI employees filed a lawsuit on 15 October, alleging unlawful dismissal because of their work on the investigation into Donald Trump’s handling of classified documents. They seek reinstatement and back pay. The claims remain untested in court.

Together, the cases raise questions about the bureau’s relationships with research institutions and the treatment of staff assigned to politically sensitive investigations.

United States: OpenAI employee charged over alleged recording of meetings

The FBI arrested OpenAI employee Abdulrahman Alfozan on 9 October following the discovery of a suspicious device in a company conference room. OpenAI said it used its own models to assist analysis of the device. The Justice Department’s account of the complaint dates the device’s discovery to about 30 September. The complaint also describes alleged use of a chatbot account to research the device and meeting-room information.

The reported charge concerns interception of oral communications. It does not establish espionage on behalf of a foreign state.

For organisations handling sensitive research, the case underlines the importance of physical access to meeting rooms alongside protection of digital systems. Alleged motive and any external beneficiary remain separate questions for the investigation.

Surveillance technology: Citizen Lab documents advertising-based spyware delivery

Citizen Lab’s AdFection investigation, published on 15 October, documents how Discover-Tech connected targeted advertising infrastructure with mercenary surveillance vendors. The researchers linked attacks against Al Jazeera to Candiru spyware delivered through advertisements requiring no user interaction.

At least 45 Al Jazeera devices were targeted during 2024 and 2025. That is a count of devices targeted, not a confirmed count of infections. The investigation prompted restrictions on Discover-Tech’s access to advertising platforms.

The attack route extends beyond malicious messages and links. Advertising systems can provide both identifying data and a route for selective delivery of code to a target. For organisations handling sensitive information, this makes advertising and tracking infrastructure part of the security perimeter. Its confirmed Al Jazeera case does not establish infections at African organisations. The wider report also discusses profiling activity affecting countries in Africa.

France: Cyberattack disrupts commercial refrigeration systems

Attackers remotely altered refrigeration controls at French supermarkets overnight into 12 October. Reporting described spoiled food and fires, and Paris prosecutors opened an investigation into the compromise of refrigeration systems.

Accounts differ over the number of affected shops. Technical reporting points to internet-accessible control systems. The attackers’ identity and motive remain unknown.

The incident demonstrates the potential for remote access to operational equipment to cause physical and commercial damage. Food distribution and other sectors using connected industrial controls face similar risks. Attribution of this attack remains open.

United States–Ukraine: Starshield restrictions affect drone operations

Ukraine reported restrictions on Starshield connectivity for terminals moving at speed. In an interview published on 16 October, a Ukrainian presidential adviser said Kyiv was negotiating with SpaceX and the Pentagon over a limit cutting connections above 160 km/h.

Reuters, citing two US officials and a Western official, reported that the instruction originated inside the White House. The officials did not identify the person responsible. Trump denied ordering restrictions. The dispute arose amid disagreements over Ukrainian strikes on Russian oil infrastructure.

For Ukrainian forces, the practical problem is the speed limit: a connection that works on a stationary terminal can fail when a drone exceeds the permitted speed. The episode demonstrates how contractual, technical and political control over externally supplied communications can affect battlefield capability.

Yemen: Missile attack on Aden government complex

Houthi missiles struck the al-Maashiq presidential palace complex in Aden on 15 October. Yemen’s health minister reported five deaths and 16 injuries. The government said the prime minister and cabinet members were unharmed. The Houthis described their target as a Saudi military headquarters; that account remains unverified.

The attack on the government complex raises questions about protection of senior officials and the ability to sustain government activity at the site. The wider relevance is to Red Sea and Gulf of Aden security. No African operational role in this strike has been established.

📅 Timeline of principal developments

🇨🇩🇹🇿 Strategic assessment: Kabila’s coalition and Tanzania’s position

Read more

🇩🇪 GERMANY: Ex-BND president August Hanning arrested on suspicion of treason

German authorities arrested August Hanning, who led the Federal Intelligence Service (BND) from 1998 to 2005, on Tuesday 6 October. The federal prosecutor’s office said he is strongly suspected of treasonous espionage, spying out state secrets and attempted treason, on suspicion that he passed state secrets to a foreign intelligence service. Prosecutors named no state.

A second man, identified only as Manfred D., was also detained. Prosecutors say he was Hanning’s chief of staff and later served several BND presidents in that role from 2012 until 2026, with access to confidential information. German broadcasters WDR and NDR and the Süddeutsche Zeitung report the service concerned was not Russian, German media report. Hanning is 80 and worked as a private security adviser after leaving the BND.

BND president Martin Jaeger said the agency carried out extensive internal investigations before federal prosecutors took over the case. An opposition lawmaker demanded a swift and thorough inquiry. Prosecutors allege that Manfred D. passed nearly 2,000 documents to Hanning between 2010 and 2022, many of them classified, and that Hanning paid him for the information in order to use it in his private advisory work, as German media report the findings. Prosecutors have not established whether Hanning’s analyses reached the foreign service. A reported link to Israel’s Mossad appears in neither the prosecutors’ account nor wire reporting, and this bulletin does not carry it. The unresolved questions are which foreign service was involved and whether the material reached its intended recipient.

🇹🇿🇿🇼 TANZANIA/ZIMBABWE: Samia reportedly pays condolence visit to Chivayo family home in Harare, no official acknowledgement

No evidence shows that she attended the burial. Reporting places her at the Chivayo family home on Tuesday 6 October, two days before the 8 October burial.

Chivayo, his wife Lucy Muteke and three others died on 30 September when a helicopter crashed at Kudenga Farm near Marondera. Early reports said six were aboard, and police later corrected the number to five. President Emmerson Mnangagwa declared him a provincial hero, Zimbabwe mourns Wicknell Chivayo at vigils and church services, and the couple were buried at Sahwira Glen Forest Memorial Park in a lavish burial in Harare.

Samia reportedly flew to Harare on Tuesday and left under secrecy. She was reportedly driven from Robert Gabriel Mugabe International Airport to Chivayo’s Gletwin home, stayed just over 30 minutes, then made a courtesy call on Mnangagwa. She was on the ground for less than three hours. Journalists and mourners were told not to photograph or film her. A video of her motorcade and a photograph of her military aircraft later emerged. Neither shows her at the residence, and this desk has not authenticated them.

There was no confirmation from either government, neither from the Tanzanian State House nor from Zimbabwe’s information ministry. This desk identified no Tanzanian outlet reporting the trip. The blackout claim traces to Chin’ono, a post by journalist Hopewell Chin’ono that its publisher says it could not independently verify. One Zimbabwean outlet reported that security agents from both countries enforced the restrictions. No other outlet has corroborated that detail.

Chivayo had visited Samia in the days after her husband’s death, as his condolence visit after Hafidh’s death shows in a post dated 11 September. Hafidh Ameir Hassan died on 7 September in Zanzibar. A paid assessment of the relationship follows below.

🇺🇬 UGANDA: Muhoozi’s deadline to Otafiire lapses amid arrest threat

On Friday 2 October, Chief of Defence Forces Gen Muhoozi Kainerugaba demanded that Minister of Water and Environment Maj Gen (Rtd) Kahinda Otafiire apologise. Muhoozi’s one-week ultimatum quotes his post as giving “exactly 1 week to apologise”. He then set a shorter deadline, and a three-day deadline with custody threat report says he warned that security forces would take Otafiire into custody if he did not apologise. The two figures are successive statements, so the deadline lapsed on or about 5 October. This desk found no report of an arrest or an apology. The Monitor article is paywalled and this desk read only its introduction.

The trigger was Otafiire’s remarks in Parliament on 30 September. He said that a general who prefers violence as the best means of solving problems signals a problem. He did not name Muhoozi. The remarks came as footage circulated that purports to show opposition figures held in a military safe house. The Uganda People’s Defence Forces (UPDF) called its source a deserter and the allegations fabricated on 2 October. Parliament directed the government to return with information within two weeks.

Muhoozi set a similar seven-day deadline for minister Justine Nameere on 16 September. She apologised. The dispute matters because the head of the armed forces is publicly threatening to use security forces against a serving minister.

🇲🇼 MALAWI: Former army chief Gen Phiri arrested on arms-trafficking counts

Malawi’s Anti-Corruption Bureau arrested Gen Paul Valentino Phiri on Thursday 1 October. Phiri led the Malawi Defence Force from July 2023 to October 2025. Phiri arrested over arms allegations on five counts including abuse of office and dealing in terrorist property. The Bureau says the charges concern alleged illegal arms trafficking in June and July 2025.

An investigative platform reported in July that the complaint rested on CIA-flagged arms allegations, with weapons said to have passed through Lilongwe en route to Sudan. The platform said it had seen neither the CIA report nor the Bureau’s complaint. The CIA link therefore remains unverified. The alleged route through Lilongwe to Sudan ties the case to the wider arms flows around Sudan’s war.

🇪🇬 EGYPT: CIA director Ratcliffe meets Sisi and intelligence chief Rashad in Cairo

CIA Director John Ratcliffe met President Abdel Fattah el-Sisi in Cairo on 20 September, with Egyptian intelligence chief Hassan Rashad present. The Egyptian presidency’s statement lists the Iranian crisis, the second phase of the Gaza ceasefire plan, Sudan and the Horn of Africa. It says Ratcliffe praised cooperation between the CIA and the General Intelligence Service on security, counterterrorism and organised crime. Sisi reaffirmed Egypt’s support for Sudan’s unity and state institutions. The statement places Sudan and the Horn of Africa on the agenda of a CIA meeting with Egypt’s intelligence chief present.

🌍 HORN OF AFRICA: Tigray fighting resumes as Egypt, Eritrea, Somalia and Sudan hold Alamein summit

Fighting resumed in northern Ethiopia on 23 September between federal forces and an alliance led by the Tigray People’s Liberation Front (TPLF). Ethiopia accuses Eritrea of directly backing the rebels, with support from Sudan and Egypt. All three deny it. Ethiopia and Eritrea have severed diplomatic ties, and Egypt and Ethiopia have expelled each other’s diplomats.

On 4 October the leaders of Egypt, Eritrea, Somalia and Sudan held the Alamein four-way summit, the first of its kind. They backed Sudan’s government and army and rejected parallel entities. A local journalist told AFP that federal forces retake Mekelle, the Tigrayan capital. Treat that as a single-source report.

🇦🇱 ALBANIA: SHISH director Vlora Hyseni under court-approved house arrest

On 22 September, Albania’s Special Prosecution Office against Corruption and Organised Crime (SPAK) announced that a court had, at its request, approved the suspension and house arrest of State Intelligence Service (SHISH) director Vlora Hyseni, according to an arrest warrant for intelligence chief report. The measures came in a corruption investigation that also involved a senior police official. SPAK’s suspicions against Hyseni are that she aided a crime suspect, Ergys Agasi, and unlawfully disclosed classified information. OCCRP reports no formal charges.

She was abroad when the order was issued, reportedly at a conference of intelligence chiefs in Baku. Hyseni surrenders after SPAK order describes her presenting herself at Pristina airport and being escorted into Albania. Other reports place her arrest at a border crossing. She has led SHISH since March 2023, after a career at the Kosovo Intelligence Agency. Prime Minister Edi Rama announced her dismissal. This desk found no reporting on a successor or acting director.

🇸🇸 SOUTH SUDAN: Kiir dissolves unity government, replaces security bureau deputy chief

On 22 September President Salva Kiir dissolved the transitional unity government. Kiir dissolved unity government after parliament passed an elections-act amendment that let him remove his five vice presidents and install a caretaker administration ahead of elections set for December. The new ministers are almost entirely loyalists.

On 1 October Kiir dismissed Gen Napoleon Adok Gai as deputy director-general of the National Security Service’s Internal Security Bureau. Apiu replaces Adok Gai in the post: Maj Gen Apiu Goch Dut was promoted to full general and appointed. He is a former managing director of Sudd Investment, a company linked to the service. The decrees gave no reason. The Internal Security Bureau sits inside the National Security Service, so the change affects the service’s domestic arm. This desk could not establish who currently holds the bureau’s director-general post.

🇮🇱 ISRAEL: Reported CIA Red Cell paper on internal fracture, unpublished

Not publicly. Drop Site News reported that a classified assessment titled “Fracture From Within”, prepared in August by the CIA’s Red Cell, warns of civil conflict or state collapse. It cites two unnamed US sources. The CIA did not respond to requests for comment, and the document has not been published. Every other account this desk found repeats that reporting. Drop Site describes the Red Cell as the unit that provides the agency’s alternative analysis, so the document would not by itself establish the CIA’s prevailing assessment. Israel votes on 27 October.

📋 TABLE: Intelligence leadership and related appointments

For Senegal, Kandé named DGRE director after a posting as defence attaché in India that began in 2025. Outlets disagree on whether he replaces Brig Gen Koly Faye at the DGRE or whether Faye’s retirement concerns a different post. For Chad, Kogri named foreign minister after serving as a presidential adviser since July 2025. He left the agency in 2024.

👁️ WATCHLIST: What to watch next

• Whether Muhoozi acts on his threat to have Otafiire arrested now that the shortened deadline has lapsed, and whether Otafiire apologises or is detained.

• Whether German prosecutors name the foreign service in the Hanning case.

• Whether fighting spills from Tigray into Eritrea.

• Who runs South Sudan’s Internal Security Bureau after the October decrees.

• Whether the Tanzanian State House ever acknowledges the Harare trip.

🔎 ANALYTICAL NOTE: Hanning and Hyseni cases (no established link)

Within two weeks, prosecutors in two European states moved against current or former intelligence chiefs on suspicion of disclosing classified information. In Germany, prosecutors allege that a long-serving aide passed nearly 2,000 documents to the former chief. In Albania, the reported suspicion is that Hyseni aided a crime suspect and disclosed classified information, and open reporting does not establish a document-access mechanism comparable to the German case. This desk therefore draws no pattern beyond the timing, and nothing in open reporting links the two investigations.

AD

RELEASE DATE: October 29, 2026

Pre-Order on AMAZON

INTELLIGENCE ASSESSMENT | Was Wicknell Chivayo a protected dealer or an intelligence asset, and what does Samia Suluhu Hassan’s reported, unacknowledged Harare visit reveal?

🧭 What are the key judgements?

1. Chivayo is almost certainly dead. The evidence includes official statements, official identification of the victims, a public funeral at which the government declared him a provincial hero, and early crash indications from the aviation authority. Nothing in open reporting supports a faked-death hypothesis. Confidence: High.

2. Chivayo was most likely a politically protected dealer who also served as a financier and access broker for Zimbabwe’s ruling circle. The sources reviewed show no evidence of tasking, handling or recruitment by any service, so this assessment does not judge him an intelligence asset, although open sources cannot exclude quiet cultivation by services interested in his access. Confidence: Moderate.

3. Samia’s reported visit most likely reflects personal reciprocity, but privacy, protection arrangements and commercial interest remain competing explanations. The sources do not establish why the visit was concealed. Confidence: Low.

4. The comparison with Epstein fails on its defining feature. Chivayo advertised his access openly, which makes the comparison highly unlikely to hold beyond the narrow function of access brokerage. No open source shows compromise or coercion. Confidence: Moderate.

5. His death creates delivery, succession and financing risks for projects that depended on his personal access, and disputes over his companies’ assets may surface publicly. The contractual status of the Tanzanian and Eswatini projects is not established. Confidence: Low.

📐 What is the basis for this assessment?

This assessment draws on Zimbabwean, Kenyan and regional press, court-reporting archives, and Chivayo’s own public statements as relayed by outlets. It does not draw on Tanzanian or Zimbabwean government statements, because none addressing the visit was located in the sources reviewed. Several Harare outlets are partisan in different directions, and Chivayo’s own claims were self-published and promotional. Where a claim rests on one outlet, the text says so. The assessment does not cover allegations about Samia’s family, which this desk could not source.

Read more

Reporting period: 31 August–4 October 2026
Prepared: 7 October 2026
Publisher: Ujasusi | Intelligence & Security Analysis
Author: Evarist Chahali

🧭 Executive summary

September’s reviewed reporting shows pressure on security forces in Mali and Niger, contested militant authority in the Lake Chad Basin, and continuing civilian exposure in Mozambique and eastern DRC. Somali and international counterterrorism announcements provide evidence of operational activity, while leaving its lasting effects unresolved.

The Dioura attack in Mali and two late-September attacks in western Niger highlight military vulnerability. In Burkina Faso, Islamic State Sahel Province’s claimed victory over JNIM near Kacham underscores rivalry between militant organisations. These developments require separate attribution and careful treatment of disputed losses.

Nigeria’s reported ceasefire with Boko Haram drew a subsequent denial, leaving its authority and scope uncertain. Mozambique’s Niassa raid demonstrated mobility beyond Cabo Delgado, where later reporting described further killings and abductions. An ADF-attributed attack in Ituri adds a sourced eastern DRC incident without resolving the wider collection gap.

This assessment combines five supplied weekly exports with independently retrieved reporting and official statements. Their 166 African records are collection leads, not 166 confirmed attacks. Uniformly zero casualty fields cannot establish that nobody was killed. This is a selected regional assessment, not an exhaustive continental census.

🎯 Key judgements

• Military resilience is a central Sahel concern. Dioura and the reported attacks in western Niger raise questions about force protection and resupply. Niger’s command changes add an institutional dimension, but do not prove that internal divisions caused battlefield losses. Confidence: moderate; casualty totals and causal relationships remain unresolved.

• JNIM and Islamic State Sahel Province should be assessed separately. September reporting describes confrontation between them, making any suggestion of a unified jihadist campaign misleading. Confidence: high in the need for separate attribution; lower in the claimed scale of the Kacham losses.

• The Niassa attack demonstrated operational mobility, not proven permanent territorial expansion. A successful raid does not establish that the attackers can maintain local supply, recruitment and protection networks. Confidence: moderate, supported by specialist assessment and reporting of the raid.

• Somalia’s strikes and intelligence operations show sustained activity, with effects still uncertain. Weapons-infrastructure targeting and NISA’s reported operations indicate efforts to disrupt capability. Public announcements do not establish lasting degradation. Confidence: moderate in the reported activity; operational results remain attributed claims.

• Nigeria’s reported dialogue requires caution. A reported Boko Haram truce was followed by a denial attributed to a figure within the movement. Neither establishes a basin-wide settlement or protection from ISWAP. Confidence: low in the arrangement’s scope and authority.

• A reliable month-on-month African attack or fatality comparison is unavailable from the supplied exports. Repetition, uncertain actor attribution and missing source links prevent that calculation. Confidence: high, based on direct inspection of all five files.

🗺️ Regional situation

Sahel: pressure on the state and competition among militants

A major Mali development was the 10 September attack on Dioura. Reuters reporting published on 21 September, republished by MarketScreener described extensive military losses, citing a security source and a diplomatic source whose estimates differed. It also reported the army’s statement that troops had been evacuated and enemy positions struck. The exact casualty and captive totals remain unresolved.

Ujasusi assessment: The intelligence value lies in the attack’s implications for force protection, reinforcement and the management of captured personnel. The disputed totals should not obscure those questions, but neither should propaganda claims become confirmed losses through repetition.

Mali’s economic vulnerability also remained relevant. UK government security advice describes JNIM blockades targeting fuel traffic in southern and western Mali, including routes serving Bamako. This advice was checked on 6 October 2026 and is used as background context. It is not a dated September incident record and cannot establish the timing or number of convoy attacks within the reporting window.

Ujasusi assessment: Pressure on transport can produce effects beyond the immediate attack site. Disrupted deliveries can increase the cost of maintaining military positions and sustaining civilian services. Analysts should therefore track the reliability of movement and supply alongside battlefield reporting. The available material does not justify a September-specific estimate of fuel losses or economic damage.

In Burkina Faso, ACLED’s assessment published on 17 September described an Islamic State Sahel Province claim of victory over JNIM near Kacham earlier that month. ISSP claimed more than 200 JNIM fighters killed and more than 30 prisoners captured and subsequently executed. ACLED explicitly treated the scale as conditional on the claim’s accuracy.

Ujasusi assessment: This rivalry complicates any simple narrative of militant expansion. A group may strengthen its position against government forces while losing fighters or local influence to another insurgent organisation. Inter-group violence can also generate defections and new incentives for coercion, although those outcomes must be demonstrated locally rather than assumed.

Niger entered September after a failed military mutiny in Niamey on 28–29 August, described in ACLED’s 1 September assessment. The mutiny predates this reporting window; its aftermath provides context.

On 11 September, President Abdourahmane Tiani changed the military leadership. Niger’s official news agency reported that Mamane Sani Kiaou replaced Moussa Salaou Barmou as chief of defence staff, while Abdourahmane Abou Zataka became army chief.

More consequential battlefield reporting followed. Reuters reported on 28 September, citing two security sources, that more than 50 security personnel had been killed in two attacks: an ambush on a gendarme convoy near Abala-Filingué on 23 September, and an attack at Birni-N’Konni on 26 September. The sources attributed more than 30 deaths to the latter. Reuters also reported that ISSP claimed both attacks, according to SITE Intelligence Group. These are source-reported losses and an attributed responsibility claim, not an independently verified casualty total.

Ujasusi assessment: The attacks make field resilience a priority alongside command cohesion. The sequence of mutiny, leadership changes and battlefield losses warrants scrutiny, but does not establish that one caused the others. Relevant indicators include reinforcement, convoy protection and whether the new command can sustain exposed positions.

Lake Chad Basin: disputed dialogue and exposed civilians

The New Humanitarian reported on 7 September that Nigerian authorities and Boko Haram had reached a secret truce operating since June. Its investigation cited three people with contacts among Boko Haram members and said ISWAP was excluded. Government and military bodies had not responded before publication. The disclosure falls within this window; the reported arrangement’s start does not.

The account was subsequently challenged. Premium Times reported on 15 September a video denial, reported by HumAngle, from a man identified as Boko Haram judge Mallam Abdulrahman. He denied that the leadership had approved such a deal. This report has not independently authenticated the video or resolved the competing accounts.

Ujasusi assessment: Any dialogue must be assessed by the authority of those involved, which factions it covers and whether communities experience measurable protection. The available reporting does not establish an effective, movement-wide ceasefire.

Reuters reported fifteen deaths in Cameroon’s Far North on 17 September; perpetrators remained unconfirmed.

The closing days of the reporting period brought another civilian attack. AP reported on 2 October, in a dispatch republished by Newser that suspected Boko Haram militants killed at least 15 farmers and firewood gatherers in Ala, Gummna and Musune, in Borno State’s Marte local government area. The attack occurred during the night of 30 September–1 October. Police also reported three people missing.

Ujasusi assessment: Protection of civilians pursuing ordinary livelihoods is a more meaningful test of local security than the presence of a garrison alone. Communities may remain exposed when farming, collecting fuel or travelling beyond protected settlements.

Actor attribution also matters. The exports repeatedly assign the same date and location to both Boko Haram and ISWAP. Those entries cannot independently demonstrate joint operations, separate attacks or equal activity levels. The Nigeria report uses suspected Boko Haram, which should remain an attributed identification rather than an unqualified finding.

Horn of Africa: strikes and intelligence operations

AFRICOM’s September strike register lists eight strike entries targeting al-Shabaab. This is an official operational record; it is not a count of insurgent attacks, confirmed militant deaths or separately verified successful missions.

The most informative announcements concerned military infrastructure. AFRICOM stated that a 14 September strike near Saacow targeted a weapons and ammunition factory. Its 18 September release announced a strike the previous day against a conventional-weapons warehouse in Sanaag, approximately 80 kilometres southwest of Bosaso.

The command also announced a 24 September strike near Quumbi and 25 September strikes near Welmaro and Ali Farhan. These were described as coordinated with Somalia’s federal government.

Ujasusi assessment: Targeting production and storage could constrain an organisation’s ability to sustain operations. Whether that happens depends on the importance of the facilities, the accuracy of the targeting and the availability of replacements. The reviewed releases do not provide enough evidence to resolve those issues.

Somalia’s National Intelligence and Security Agency also reported ground-level disruption. Hiiraan Online reported on 26 September that NISA said an operation at Buur-Saruur in Middle Shabelle killed 12 al-Shabaab members and destroyed facilities and supplies. The article also recorded NISA’s announcement of 11 suspected operatives arrested in Mogadishu and surrounding areas during September. The death toll, affiliations and operational effects remain agency claims.

Ujasusi assessment: Arrests and strikes address different parts of the threat. Follow-up should examine whether alleged networks are disrupted and whether targeted facilities are replaced. Announced activity alone cannot establish durable improvements in civilian security.

Kenya remained part of the regional monitoring picture. Hiiraan Online reporting described suspected al-Shabaab probing attacks in Garissa and Lamu, including an incident on 19 September along the LAPSSET corridor. Officials reported no injuries in the incidents described.

Ujasusi assessment: A non-fatal probing attack can still test defensive responses and affect movement. The supplied material does not establish a new sustained offensive in Kenya. It warrants attention to transport security and local warning systems rather than a claim of regional escalation unsupported by a comparable incident series.

Mozambique: wider reach, continuing civilian coercion

ACLED’s September Mozambique update describes Islamic State Mozambique fighters entering Niassa’s Marrupa district on 31 August and attacking a hunting camp near Nanlixa on 3 September. It reports two staff killed, the camp burned and vehicles taken. This was the group’s first incursion into Niassa since May 2025.

AP’s 7 September reporting recorded differing accounts of abductions and deaths, including a South African among the missing. The available accounts should not be combined into a single supposedly settled casualty or hostage total.

In a separate specialist assessment, ACLED’s Peter Bofin identified resupply, economic disruption and international publicity as likely objectives. He assessed the incident as more likely an isolated raid than evidence of a sustained presence, distinguishing local intelligence access from the supply networks needed to remain.

Ujasusi assessment: That distinction is the central finding for southern Africa. Security forces need to understand both where an armed group can move and where it can reproduce its presence. A successful incursion demonstrates a breach in prevention; it does not automatically establish a new territorial stronghold.

Later reporting showed continued violence inside Cabo Delgado. Zitamar’s 23 September report described at least three people killed and 12 abducted during incursions in Muidumbe and Macomia. These figures are attributed to its reporting; the full article was paywalled during this review.

A 30 September Zitamar report described insurgents entering Maputo village in Mocímboa da Praia district on 28 September. A local source confirmed their entry and abductions, without establishing a number. Islamic State separately claimed two civilian deaths. Maputo village here is not Mozambique’s capital, and the death claim is not independently confirmed.

Ujasusi assessment: The Niassa raid must be considered alongside continuing coercion in Cabo Delgado. The reviewed accounts demonstrate different forms of exposure; they do not establish coordinated operations or a common command decision across these locations.

The implications for Tanzania concern regional warning and liaison. The raid supports attention to militant movement and recruitment risks across northern Mozambique. It does not demonstrate an attack inside Tanzania, a confirmed Tanzanian support network or an imminent cross-border operation.

Great Lakes: a sourced Ituri attack, with wider gaps remaining

Radio Okapi reported on 28 September an ADF-attributed attack overnight on 27–28 September in Mambasa territory, Ituri, in which two people were killed, including a soldier. Its article also described separate military gunfire causing panic in Banana later on 28 September. Those episodes should not be conflated.

The supplied exports contain 13 ADF/ISCAP-labelled records, all in the week of 7–13 September, with locations including Kinshasa, Lubala and Walikale. They lack incident narratives and usable source links. They do not establish 13 separate attacks; a Kinshasa tag does not establish an ADF attack in the capital.

Ujasusi assessment: The sourced Ituri account improves coverage but cannot supply a September ADF attack total. Weeks without export entries also cannot prove inactivity. Actor-specific local reporting remains essential in eastern DRC’s overlapping conflicts.

North Africa: border cooperation beyond battlefield operations

INTERPOL announced on 16 September that Operation Phoenix, involving Algeria, Morocco, Tunisia, Jordan and Palestine, produced 48 arrests across the five participating countries, including eight people wanted under Red Notices and one under a Wanted Persons Diffusion. Women police officers held full operational responsibility. The operation targeted terrorism and criminal networks; the 48 arrests are not 48 confirmed terrorism arrests, nor an Africa-only total.

The announcement describes a three-week operation without specifying its exact dates. It is included as an in-period counterterrorism-related disclosure, not as a September incident count.

Ujasusi assessment: Border screening and international police liaison complement military operations. Their value should be assessed through verified identifications and subsequent case outcomes, rather than equating database hits with terrorist activity.

📅 Selected chronology

This is a chronology of selected sourced developments, not a comprehensive attack list. Links and qualifications appear in the regional sections above.

🔎 What does September reveal about Africa’s terrorism threat?

Ujasusi assessment: The strongest cross-regional lesson is that military capability, access to economic targets and control over civilian movement must be measured separately.

Reported losses at Dioura and in western Niger raise questions about force protection. Mozambique’s raid raises questions about mobility and local knowledge. Somalia’s infrastructure strikes raise questions about regeneration. Lake Chad violence and disputed dialogue raise questions about protection beyond defended settlements. Ituri’s reported attack and Cabo Delgado abductions underline civilian exposure. These are connected analytical problems, but the evidence does not establish common command, coordination or a single organisational strategy across theatres.

The same distinction applies to state responses. Announced operations reveal intent and activity. Their effectiveness requires evidence of durable changes in adversary capability and civilian security. Counting announcements, media mentions or automatically classified rows cannot answer that question.

🔭 October outlook: scenarios and indicators

These are analytical scenarios, not forecasts with assigned probabilities.

For October, priorities include whether Malian and Nigerien forces can sustain exposed positions and supply routes; whether Kacham produces documented shifts in militant influence; whether Niassa sees repeat incursions; and whether al-Shabaab replaces targeted facilities. Lake Chad monitoring should test the authority and scope of any reported dialogue against civilian protection. In Cabo Delgado and Ituri, repeat abductions, attacks and constraints on movement would be more informative than gaps in the exports.

The decisive evidence will be changes in capability, sustained presence and protection. Another month of high-volume reporting alone will not establish which side is gaining strategic advantage.

📊 Methodology and monitoring-export audit

The reporting window covers five complete monitoring weeks, including one day in August and four in October. It overlaps the previous Ujasusi monitor through 13 September, so the two reports should not be added together as consecutive, non-overlapping datasets.

The 166 rows comprise 74 Lake Chad Basin records, 41 Sahel records, 20 Mozambique records, 18 Horn of Africa records and 13 Great Lakes records. These describe the composition of the supplied collection output, not the distribution of verified African attacks.

Exact-repeat removal is a text-level check. It neither proves that identical rows refer to one event nor proves that different rows refer to separate events. Entries require source URLs, event narratives and actor verification before reliable incident deduplication is possible.

Each export labels ACLED as its source near the top but states in the footer that it uses GDELT and would switch to ACLED upon upgrade. Provenance therefore remains unresolved. All casualty fields are zero; independently sourced accounts of lethal events show that those fields cannot serve as a reliable period death toll. No continental fatality total is asserted here.

The regional analysis uses event dates where available and distinguishes them from publication dates. It retains attributed claims, identifies unresolved figures and labels Ujasusi’s own analytical judgements. Official statements confirm what an institution announced; they do not independently verify every operational result.

Source-access limitation: some Zitamar articles were paywalled; only accessible passages and retrieved indexed text were used. Several AP and AFRICOM originals could not be opened directly; the relevant statements were checked through indexed text and, where available, accessible wire-service republications. This establishes support in retrieved reporting, not independent verification on the ground. Republishing the same dispatch does not constitute a second independent source.

The non-African roundup and records explicitly labelled “Non-Terrorist” were excluded. The geographic scope is the principal theatres represented in the supplied files, supplemented by retrieved reporting; this is not exhaustive coverage of every African country.

Leave a comment

📋 Period at a Glance

🔑 Key Judgements

🇲🇱 Mali: The Fuel War Escalates

JNIM’s economic siege

JNIM’s fuel blockade, first declared on 3 September 2025, targets the overland routes carrying 95 per cent of Mali’s petroleum imports from Senegal and Côte d’Ivoire. The campaign has destroyed more than 300 fuel tankers since it began. The blockade eased in early 2026 amid negotiations and increased military activity, but JNIM reimposed a full blockade on Bamako on 28 April, and by mid-2026 armed convoys remained the only means of supplying the capital with petroleum.

The original September 2025 declaration, delivered by spokesman Abou Houzeifa al-Bambari in Bambara and Fulfulde, imposed a full blockade on Kayes and Nioro du Sahel, banned fuel imports from four neighbouring countries, and threatened Diarra Transport, one of Mali’s largest private logistics companies. Diarra Transport halted operations shortly after. By the time of this reporting period, the blockade had been enforced continuously since its April reimposition, with the Africa Center for Strategic Studies assessing that the attacks represent an explicit economic strategy to isolate Bamako.

Separately, on 9 August, JNIM militants attacked an army garrison in San, in the Ségou region, killing 10 soldiers; 40 militants were also reported killed. The San attack, deep in southern Mali, reinforces the pattern of JNIM projecting force well beyond its traditional northern and central operating areas.

Kayes is strategic for reasons beyond transit. The region is the second-largest contributor to Mali’s GDP after Bamako and produces roughly 80 per cent of the country’s industrial gold. Nioro du Sahel functions as the primary crossroads between Mali and Mauritania and holds deep religious significance as the birthplace of a branch of the Tijaniyya Sufi brotherhood.

Northern Mali

Fighting around Kidal continued at a lower tempo than July’s Anefis battle. The raw GDELT data captured persistent JNIM and IS-Sahel activity in Kidal, Bamako and Mopti throughout August, and a smaller cluster in Tillabéri, Niger. Verified reporting on specific engagements remains thin for this period, but the pattern of the raw data, with near-daily entries in Bamako and Kidal, is consistent with JNIM’s demonstrated ability to sustain simultaneous pressure across multiple regions.

Assessment

The fuel blockade is JNIM’s most consequential campaign of the past year. It has achieved what conventional military operations did not: material constraint on the Malian state’s ability to function. As of July 2026, armed convoys were the only means of supplying Bamako with petroleum, and even escorted convoys have been attacked on the approaches to the capital. The Africa Center for Strategic Studies assesses that the attacks represent an explicit economic strategy to isolate Bamako.

Two features distinguish this from the northern insurgency. First, it is directed at the civilian economy rather than military positions. Second, JNIM is issuing public demands in local languages through social media channels, behaving less like a clandestine armed group and more like a rival governing authority enforcing its writ.

🇧🇫 Burkina Faso: Intra-Jihadist War Reaches New Lethality

ACLED flagged on 17 September what may be the deadliest battle on record between JNIM and the Islamic State Sahel Province in a remote region of Burkina Faso. Details remain scarce because the location is inaccessible to independent reporting, but ACLED’s Heni Nsaibia indicated that emerging information points to casualties exceeding any previous JNIM–ISSP engagement.

This follows the pattern observed throughout 2025 and 2026 in which the two groups compete for territorial control, mining revenue and recruitment. The competition is no longer marginal. In parts of Burkina Faso, the violence between JNIM and ISSP now rivals or exceeds the violence each directs at the state.

🇳🇬 Lake Chad Basin: A Ceasefire, a Clash, and an Ambush

The secret ceasefire

The New Humanitarian revealed on 7 September that Nigeria’s government has maintained a secret ceasefire with the Bakura Doro faction of Boko Haram (JAS) for approximately three months. The agreement, brokered through the Office of the National Security Advisor and the Department of State Services, is linked to negotiations that secured the release in June of 360 civilians abducted from Ngoshe village in March.

Sources described the ceasefire as having produced a measurable reduction in JAS-attributed attacks across parts of Borno State. However, two sources warned that JAS may be using the pause to move equipment into the Mandara mountains.

The Sambisa clashes

The ceasefire’s structural weakness was demonstrated immediately. In early September, Boko Haram and ISWAP fighters clashed in the Chingolo axis of Sambisa Forest in Bama Local Government Area, with at least 23 militants killed in sustained exchanges of fire. Borno-based security analyst Zagazola Makama verified video footage of the engagements. The same week, Boko Haram militants ambushed the convoy of APC governorship candidate Mustapha Gubio on the Gubio–Kareto–Damasak highway, an attack repelled by a combined security force.

Assessment

A ceasefire that excludes the stronger of two rival factions is not a ceasefire. It is a bilateral arrangement that frees one party to concentrate against the other. JAS gains a breathing space from Nigerian military pressure; ISWAP gets no such reprieve and continues to fight both the state and JAS. The net effect is that Sambisa Forest becomes a more contested space, not a less violent one, while the state loses the ability to pressure JAS without jeopardising the agreement.

Previous attempts at dialogue, including a 2022–2023 hudna, collapsed after spoilers within the government and military disrupted the process. The current arrangement is likely to follow the same trajectory unless it is formalised and extended to ISWAP, which the group’s ideology makes improbable.

🇸🇴 Horn of Africa: Al-Shabaab’s Kenyan Campaign Intensifies

The cross-border surge

ACLED recorded at least 25 political violence events involving al-Shabaab across Mandera, Garissa, Wajir and Lamu counties in June and July alone. The tempo continued into August. Al-Shabaab claimed attacks on KDF bases in Yunbis (Garissa), Sheikh Barrow and Fino (Mandera), Konton (Wajir), and Mangai (Lamu) between 21 and 25 August.

Sources: ACLED; Caleb Weiss, Substack.

Several of these claims have not been independently verified. However, the ISS Africa assessment is unambiguous: over 30 security force officers were killed by IEDs in more than 10 attacks across Garissa and Lamu counties in three weeks spanning June and early July. The August claims, even discounting those that remain unverified, represent a continuation of this campaign at elevated tempo.

Somalia

A strategic threat assessment for August 2026 described substantial intensification of al-Shabaab activity across southern and central Somalia. ACLED separately noted that reports suggest al-Shabaab received weapons and UAVs from the Houthis in early 2026, enabling more sophisticated planning of IED attacks and ground operations. The group is integrating conventional weapons with drones for reconnaissance and strike purposes.

Assessment

The Kenyan front is no longer incidental. ACLED attributes the surge partly to events across the border in Jubaland, where al-Shabaab uses remote strongholds in Lower Juba as staging areas. The pattern of simultaneous claims against multiple KDF bases across four counties in a single week is consistent with a deliberate campaign to stretch Kenyan security forces, not opportunistic raiding. The Houthi weapons pipeline, if confirmed at the scale reported, would represent a qualitative shift in the group’s capability.

🇨🇩 Great Lakes: ADF/ISCAP’s Widest Footprint

ADF/ISCAP activity during this period extended beyond its traditional Beni–Ituri corridor. Africa Defense Forum reported that fighters attacked twelve villages in the Bambodi sector of Tshopo province, with a provincial parliamentarian stating the group feels “at home” in the area. African Security Analysis, cited by Africa Defense Forum, assessed that ISCAP is no longer content to operate within its traditional zones in North Kivu, Ituri and their forest corridors.

The raw GDELT data for this period registered ADF activity in Walikale (Nord-Kivu), Kampala (Uganda) and Kinshasa — the latter two almost certainly geocoding artefacts rather than actual operations. However, the Walikale entries are consistent with verified reporting on ADF pressure along the Masisi–Walikale border.

Assessment

ISCAP’s geographic dispersal is a consequence of the joint DRC–Uganda Operation Shujaa, which drove the group out of its North Kivu strongholds but did not destroy it. The group has fragmented into mobile cells that probe outward into less-policed provinces. Tshopo and Haut-Uélé are now within ISCAP’s operating range, which is the widest it has held. The dispersal makes the group harder to fix through conventional military operations and increases the likelihood of surprise attacks on civilian communities in areas that have not experienced jihadist violence before.

🇲🇿 Mozambique: The Niassa Raid

The Marangira attack

On 3 September, approximately 30 ISM fighters attacked a hunting camp near Nanlixa village in Marrupa district, Niassa province, operated by Mozambique Wild Adventures. The group killed at least one person, injured a member of the defence forces, abducted up to 20 workers including a 30-year-old South African mechanic, and burned the camp. Attackers also damaged a health centre, a police post, homes and telecommunications infrastructure. Three American citizens were evacuated. Approximately 2,700 people were displaced.

ACLED’s Peter Bofin assessed the raid as an isolated operation rather than sustained territorial expansion, but noted it demonstrated ISM’s continued advantage in rural maneuverability.

Broader context

The ACLED Mozambique Conflict Monitor for August documented ISM’s southward movement through Quissanga, Mecufi, Meluco, Ancuabe and Chiúre districts following state pressure at Catupa in Macomia. President Daniel Chapo announced the relocation of the Northern Operational Theatre command from Pemba to Mocímboa da Praia to improve coordination with the Rwandan Defence Force.

The US State Department updated its Mozambique travel advisory in August 2026, designating the Niassa Special Reserve as Level 4: Do Not Travel.

Assessment

The Marangira raid sits in the same pattern as the ADF’s Mambasa mining-village killings in July and JNIM’s tanker attacks on RN1. All three represent armed groups targeting economic assets in under-policed rural areas rather than contesting defended military positions. The hunting camp offered vehicles, supplies and a high-profile hostage, and its destruction undermines confidence in state control of the province.

For Ujasusi Blog’s East African readership, the key question is proximity. Niassa borders Tanzania’s Ruvuma region. Marrupa district lies within several hundred kilometres of the Tanzanian border. ISM’s demonstrated ability to transit from Montepuez to Marrupa in three days means the group can reach the border zone in a comparable timeframe. No verified activity has been recorded inside Tanzania during this period, but the trajectory warrants sustained monitoring.

📊 Cross-Theatre Pattern: The Revenue War

Three operational patterns recur across every African theatre in this reporting period.

First, economic targeting. JNIM’s fuel blockade, ISM’s hunting-camp raid, the ADF’s mining-village taxation, and al-Shabaab’s use of Lower Juba as a staging area for cross-border operations all prioritise revenue extraction or economic disruption over conventional military objectives. The armed groups are not primarily fighting for territory. They are fighting for money and for the ability to deny it to the state.

Second, geographic dispersal under pressure. ISCAP has spread into Tshopo. ISM has moved from Catupa into Niassa. JNIM’s blockade has extended from Kayes to routes connecting Bamako to Côte d’Ivoire and Guinea. In each case, military pressure in one area produced operational activity in another, usually less-policed, area.

Third, fragmentation of the adversary. The Boko Haram ceasefire excludes ISWAP. The JNIM–ISSP battle in Burkina Faso sets al-Qaeda and IS affiliates against each other. Al-Shabaab’s internal dispute risks factional splitting. None of these fractures reduces total violence; they redistribute it.

🔭 October Watchlist

📌 Method

This assessment draws on verified reporting from institutional and specialist sources rather than the automated GDELT incident counts that feed the weekly Ujasusi Terrorism Monitor reports. The raw GDELT data for this period contains significant integrity problems: all fatality fields return zero, group attributions are mirrored (the same event tagged to both JNIM and IS-Sahel, or both Boko Haram and ISWAP), and incident counts reflect media-event volume rather than verified operational activity. The GDELT totals are therefore not reproduced as evidence of trends.

Source hierarchy: ACLED, OCHA, institutional analysis (Africa Center for Strategic Studies, ISS Africa, Crisis Group, Soufan Center, CFR Global Conflict Tracker); specialist outlets (Janes, Zitamar, The New Humanitarian, Caleb Weiss); wire services (AFP, AP, Reuters); quality broadsheets.

Leave a comment

IN THIS BULLETIN

Tanzania again dominates this cycle, on three fronts at once. Tundu Lissu’s treason trial reached its most consequential witness stage, with three summoned security chiefs found to be abroad and unreachable by the court itself. Emmanuel Nchimbi remains unreachable three weeks after his resignation, with no government statement addressing his status. And the state had to publicly debunk a forged Chief Secretary’s notice within the same week a genuine crisis, the death of First Gentleman Hafidh Ameir, left a real information vacuum for that forgery to exploit. The Full Assessment tests whether the summoned witnesses’ unavailability reflects routine scheduling or soft non-compliance, and what the disinformation pattern signals about state communications capacity under strain.

Separately, and given full free treatment this cycle rather than folded into the roundup below: Uganda has arrested or removed nearly its entire senior military-intelligence leadership lineage in three waves since March, a pattern this bulletin assesses against the alternative explanations of routine anti-corruption enforcement and succession-related consolidation of the security apparatus under Muhoozi Kainerugaba.

Elsewhere: South Africa confirmed new permanent leadership at the Special Investigating Unit; a dossier shared with the New York Times and Washington Post added the most detailed evidence yet of a Sudanese military chlorine-weapons programme; Libya’s Tripoli government announced arrests over a sabotage campaign targeting the Zawiya oil complex; a secret three-month ceasefire between Nigeria’s government and a Boko Haram faction was revealed; Mozambique’s Supreme Court set opposition leader Venâncio Mondlane on course for trial; and Germany’s AfD won a landslide state election that places a party classified as confirmed right-wing extremist within reach of oversight authority over the domestic intelligence service that surveils it.

TABLE OF CONTENTS

Briefing

• Tanzania’s Compounding Institutional Pressure

• South Africa, Sudan, Libya, Nigeria, Mozambique, Germany

• Intelligence Leadership Change Check

Assessment One: Uganda’s Military Intelligence Purge

Key Judgements, Scope and Approach, Background, Analysis, Outlook, Analytical Foundations

Assessment Two: Tanzania’s Institutions Under Strain

Key Judgements, Scope and Approach, Background, Analysis, Outlook, Analytical Foundations

Tanzania:

Three summoned security chiefs found abroad as Lissu trial reaches its decisive stage; Nchimbi enters fourth week unreachable; two forged official documents circulated and debunked.

CHADEMA Vice-Chairman (Mainland) John Heche completed his testimony as the fifth and final civilian defence witness in Tundu Lissu’s treason trial on 16 September. The High Court rejected a prosecution bid to recall him over remarks allegedly made outside the courtroom while under oath. Attention has shifted to the three state-security witnesses the court ordered summoned on 10 September: IGP Camillius Wambura, CDF Jacob Mkunda, and DCI Ramadhani Kingai. The court registrar reported the summonses could not initially be served because all three were outside Tanzania. DCI Kingai is scheduled to testify on 18 September; the return dates of the IGP and CDF remain unconfirmed as of this writing.

Former Vice-President Emmanuel Nchimbi remains unreachable since his 25 August resignation, over three weeks with no government statement on his status, consistent with the pattern flagged in the prior bulletin’s Full Assessment.

Separately, President Samia Suluhu Hassan’s husband, Hafidh Ameir Hassan, died on 7 September at Emilio Mzena Memorial Hospital, Zanzibar, following treatment for a heart condition. Tanzania’s Ministry of Information (MAELEZO) subsequently issued a public notice branding as fake a forged Chief Secretary’s statement, formatted to resemble an official document, that had claimed a specific 90-day presidential leave arrangement and been picked up by several regional outlets before correction. A second, cruder fabrication falsely claiming Nchimbi had been found dead circulated separately on social media without corroboration from any outlet or official channel and is assessed as fabricated.

University of Dodoma lecturer Melkisedek Kaijage, held since July on terrorism and economic sabotage charges over the banned Saba Saba protests, was discharged on 10 September after the DPP stated it had no intention of proceeding, though the Dodoma Regional Crime Officer separately sought conduct conditions on him, meaning the release is not unconditional.

The Full Assessment, testing whether the summoned witnesses’ unavailability reflects soft non-compliance rather than coincidence, and what two forged official documents in one week signal about the information environment surrounding Tanzania’s current leadership questions, is available to paid subscribers below.

South Africa:

New permanent head confirmed at the Special Investigating Unit

President Cyril Ramaphosa appointed Leonard Lekgetho as permanent SIU head effective 1 September, ending seven months of acting leadership since Adv Andy Mothibi’s departure to become National Director of Public Prosecutions. The SIU is a statutory anti-corruption body, not a member of South Africa’s intelligence community proper, though its casework regularly intersects with Crime Intelligence and the Hawks.

Sudan:

Leaked dossier adds detail to chemical-weapons allegations

The New York Times and Washington Post separately published a dossier on 5 September, sourced from an unnamed Middle Eastern intelligence agency, describing a Sudanese Armed Forces chlorine-weapons programme said to have begun in 2024 under Brig Gen Tariq Hussain. Materials include intercepted messages suggesting army chief Gen Abdel-Fattah al-Burhan had direct knowledge of the programme. Sudan’s military denies the allegations.

Libya:

Arrests announced over Zawiya oil sabotage campaign

Libya’s Tripoli-based government announced the arrest of five people, including foreign nationals, over a “sabotage cell” behind repeated drone attacks on the Zawiya refining complex. No domestic intelligence agency has been named as leading the investigation in available reporting.

Nigeria:

Secret Boko Haram ceasefire revealed

The New Humanitarian reported an undisclosed three-month ceasefire tied to the June release of 360 civilians abducted from Ngoshe, allegedly accompanied by a five-billion-naira ransom the government denies paying. No specific security agency has been named as the ceasefire’s facilitator.

Mozambique:

Mondlane set for trial on terrorism-linked charges

Mozambique’s Supreme Court notified opposition leader Venâncio Mondlane on 25 August that he faces five charges, including incitement to terrorism, over the 2024 post-election protests. No evidence connecting the case to SISE has been independently confirmed.

Germany:

AfD’s Saxony-Anhalt win raises domestic intelligence-oversight question

The AfD won 44 percent of the vote in the 6 September Saxony-Anhalt state election. The state’s Verfassungsschutz classifies the local AfD branch as confirmed right-wing extremist, a designation under legal challenge. Because German state governments hold oversight authority over their domestic intelligence services, an AfD-led state government would place a monitored party in a position to influence the oversight of its own monitor, a tension not yet publicly addressed by state or federal officials in detail.

INTELLIGENCE LEADERSHIP CHANGE CHECK (06–17 September 2026)

Uganda is this period’s most significant exception. Three waves of arrests and removals since March have detained former holders of the Chieftaincy of Military Intelligence (CMI), now the Defence Intelligence and Security (DIS) directorate: former chiefs Abel Kandiho and Charles Bakahumura, and former Chief of Defence Intelligence and Security (CDIS) Maj Gen James Birungi, alongside Deputy Chief of Military Intelligence Col Abdul Rugumayo, replaced in March by Brig Gen Oscar Munanura. The current, sitting CDIS is Maj Gen Richard Otto, in post since 16 April 2025 when he replaced Birungi in a swap confirmed by UPDF’s own press office; Otto has not been reported arrested, removed, or otherwise implicated in this period’s arrests. Every figure detained this period is a former or retired holder of the post, not its current occupant, a distinction that matters directly for the succession-consolidation reading tested in Assessment One.

Niger saw a related but distinct development: on 11 September, junta leader Gen Abdourahamane Tiani reshuffled the top of the armed forces, naming Gen Mamane Sani Kiaou as Chief of Defence Staff in place of Gen Moussa Salaou Barmou, alongside three further senior appointments, two weeks after the late-August mutiny at Niamey’s Base 101. This is a military high-command reshuffle, not a confirmed change to Niger’s intelligence service specifically, and the two should not be conflated.

No change was identified this period for Mali’s ANSE (Modibo Koné), Zambia’s ZSIS (Friday Nyambe, confirmed under President Hichilema’s newly inaugurated second term), Mozambique’s SISE (José Pacheco), or Russia’s FSB, SVR, and GRU. The DRC’s ANR and Ethiopia’s NISS could not be confirmed to current-officeholder standard from available reporting this period; both are flagged as collection gaps rather than assumed unchanged. Elsewhere, TISS is carried forward as remaining under the Director-General named in the prior bulletin cycle; this has not been independently re-verified this period and is flagged as such, per this bulletin’s own sourcing convention. His non-appearance in the Lissu trial’s rejected witness list, discussed in Assessment Two, is a separate development from a leadership change and should not be conflated with one.

ASSESSMENT ONE

KEY JUDGEMENTS

1. Every arrest across all three waves has targeted a former or retired holder of the CMI/DIS chief post or the immediate chain beneath one, rather than a representative cross-section of the UPDF officer corps a genuine anti-corruption sweep would be expected to produce; the current, sitting Chief of Defence Intelligence and Security, Maj Gen Richard Otto, in post since April 2025, has not been implicated. Confidence: Moderate. This is a pattern read across public reporting (Monitor, New Vision, TRT Afrika, SpyUganda) and UPDF’s own confirmed appointment record; no Ugandan government statement characterises the arrests this way, so the pattern itself, not the underlying facts of each arrest, is this assessment’s own inference.

2. If the consolidation reading is correct, Muhoozi Kainerugaba’s public role in ordering or endorsing each wave, including his direct warning to “dancing generals” in August, indicates he is acting with authority over the intelligence services beyond his formal land-forces command. Confidence: Low to Moderate. Muhoozi’s public statements are directly sourced; the inference that this reflects intended succession consolidation rather than a genuine internal anti-corruption mandate he has been given is this assessment’s own reading of motive, not a reported fact.

3. No further Ugandan government statement has offered a competing explanation for the pattern beyond anti-corruption and, for the August incident, breach of protocol; this leaves the anti-corruption framing untested against Muhoozi’s specific choice of targets. Confidence: High on the absence of a competing statement, which is a matter of the public record to date.

SCOPE AND APPROACH

This assessment addresses whether Uganda’s March-to-September pattern of CMI and DIS leadership removals constitutes routine internal discipline or succession-related consolidation, and what would distinguish the two going forward. It draws on Monitor, New Vision, TRT Afrika, and SpyUganda reporting, and on Muhoozi Kainerugaba’s own public statements. It does not draw on non-public sourcing, and it does not assess the underlying corruption allegations’ legal merit.

BACKGROUND

The first wave began 27 March 2026, when Maj Gen Don William Nabasa and Brig Gen Johnson Namanya Abaho were arrested under an anti-corruption operation Muhoozi ordered; Deputy Chief of Military Intelligence Col Abdul Rugumayo was removed the same day and replaced by Brig Gen Oscar Munanura. Separately, and prior to this period, Maj Gen Richard Otto was appointed Chief of Defence Intelligence and Security (CDIS) on 16 April 2025, replacing Maj Gen James Birungi in a direct swap that saw Birungi take over the Mountain Infantry Division; Otto remains the sitting CDIS throughout the events described below. The second wave was a retirement ceremony rather than an arrest: on 20 August, President Museveni presided over the retirement of nineteen senior UPDF generals at State House Entebbe, after which Muhoozi publicly warned that officers seen celebrating would be investigated. The third wave, in September, saw former DIS chief Maj Gen James Birungi, Director of Counter-Terrorism Col Peter Ahimbisibwe, and Director of Special Operations Lt Col Ephraim Byaruhanga arrested over alleged false intelligence reporting, followed on 9 September by the arrests of Abel Kandiho and Charles Bakahumura, both former CMI or DIS chiefs. Monitor reports the inquiry is sanctioned by Muhoozi and that further individuals connected to the same file remain wanted.

ANALYSIS

Is This Really About Corruption?

Taken individually, each incident is consistent with a genuine anti-corruption or discipline framing. Taken together, the concentration on former CMI and DIS leadership specifically, rather than a broader cross-section of the officer corps, is the pattern that distinguishes this reading from routine enforcement. That the current, serving CDIS, Maj Gen Otto, has not been touched sharpens rather than weakens this observation: whatever inquiry is underway appears directed at people no longer holding the post, a different and in some ways more unusual target than an active internal-affairs sweep of a sitting chain of command would be. This is inference from pattern rather than confirmed reporting of motive, and it should be weighed accordingly.

What Would the Consolidation Reading Require to Be True?

Museveni, in power since 1986, is approaching the end of his tenure by any ordinary expectation, and Muhoozi is widely regarded as his chosen successor. Control of the coercive apparatus, particularly the services most consequential in a contested transition, is the kind of asset a successor typically prefers to hold directly rather than inherit from officers with independent institutional loyalties. Systematically removing the CMI and DIS leadership lineage, rather than any other branch, would be a rational way to secure that ahead of an actual succession moment, if that is in fact the underlying intent.

OUTLOOK

Will further arrests connected to the same inquiry occur in the next four weeks? Likely, 60 to 75 percent, based on Monitor’s reporting that additional individuals remain wanted.

Will further arrests target the current, sitting CDIS or other actively serving CMI/DIS-adjacent officers, rather than only former or retired holders, in the next four weeks? Unlikely, 20 to 35 percent, based on the pattern to date of arrests concentrating on former post-holders; a shift to targeting sitting officers would be a significant escalation worth flagging immediately if it occurs.

Will Muhoozi assume a formal command or oversight role over CMI or DIS specifically, rather than remaining within his land-forces command? Unlikely in the near term, 20 to 35 percent, absent any current reporting suggesting this is imminent.

ANALYTICAL FOUNDATIONS

Key Assumptions

1. The concentration of targets on CMI and DIS leadership is a deliberate pattern rather than a coincidence of which officers happened to be under investigation. If arrests broaden into other UPDF branches in the coming weeks, this assumption would need to be revised down.

2. Muhoozi’s public statements reflect his own operational authority rather than messaging on behalf of a decision made elsewhere in the chain of command. This is the linchpin for Key Judgement 2.

Alternative Assessment

The anti-corruption framing may be substantially true on its own terms: a genuine internal effort, however selectively enforced, to address corruption specifically within intelligence-adjacent commands where it may be most acute or most politically safe for Muhoozi to pursue. This remains credible and cannot be excluded on current evidence.

What We Do Not Know

Whether any arrested officer has been formally charged, and on what specific evidence, is not detailed in current sourcing. Muhoozi’s actual chain-of-command authority over intelligence, as distinct from his public statements, is not independently confirmed. Why the current CDIS has been left untouched while multiple former holders of the post face arrest is not addressed in any source reviewed and is itself a live analytical question rather than an established fact.

Named risk or actor not in open-source reporting: Maj Gen Richard Otto’s own position and any pressure he may be under, as the sitting CDIS surrounded by arrests of his predecessors, is not discussed in any source reviewed for this assessment and is flagged as a specific gap rather than assumed to be uneventful.

Operational recommendation: track Maj Gen Otto’s status specifically as the clearest available signal, since any move against him would represent a break from the former-holders-only pattern established this period, and track whether subsequent arrests broaden beyond intelligence-adjacent officers as a second disconfirming signal for the consolidation reading.

ASSESSMENT TWO: TANZANIA

KEY JUDGEMENTS

Read more

IN THIS BULLETIN

TABLE OF CONTENTS

BRIEFING

• Lead Item: Tanzania’s Compressed Accountability Crisis

• Secondary Items: Niger, Zambia, Mali and the Sahel, Terrorism Tracker, Cyber and Tech Intelligence

• Intelligence Leadership Change Check

FULL ASSESSMENT

• Key Judgements

• Scope and Approach, Background

• Analysis: Nchimbi’s Unreachability, the Lissu-CMAG Link, CMAG’s Mandate, Dodoma’s Messaging, the 2030 Succession Claim

• Outlook

• Analytical Foundations: Key Assumptions, Alternative Assessment, What We Do Not Know

LEAD ITEM

Tanzania: Vice-presidential transition completed within four days of expulsion. Lissu trial and CMAG deadline both active.

Vice-President Dr Emmanuel Nchimbi resigned on 25 August. CCM expelled him from the party the next day, citing unspecified discipline and ethics violations. Energy Minister Deogratius Ndejembi, 43, was endorsed as CCM’s nominee the same day, approved by Parliament on 28 August, and sworn in on 29 August. Separately, the treason trial of Chadema chairman Tundu Lissu continued at the Dar es Salaam High Court’s Sub-Registry on 2 to 3 September, with Chadema Mainland Deputy Secretary-General Aman Golugwa testifying on the origins of the party’s election-boycott campaign. The Commonwealth Ministerial Action Group set three dated conditions for Tanzania at its 10 July session, including Lissu’s release within 30 days. That deadline has lapsed. CMAG is scheduled to reconvene this month.

Separately, Air Tanzania suspended flights to Russia on 4 September, joining international carriers responding to Ukrainian President Volodymyr Zelensky’s warning of drone risk over Russian airspace.

SECONDARY ITEMS

Niger: Mutiny inside the junta’s own ranks, suppressed with direct Russian assistance

In the early hours of 29 August, a faction of junior officers calling itself the Armed Forces for the Restoration of the Fatherland struck three targets in Niamey: Base 101 near Diori Hamani International Airport, the presidential palace, and the state broadcaster. This is the most serious internal challenge to President Abdourahamane Tiani’s junta since its 2023 takeover. Russia’s Ministry of Defence confirmed Africa Corps personnel provided ground and air support to loyalist forces retaking Base 101. Dozens of soldiers have been arrested; Niamey has since displayed a seized “war arsenal” of 34 armed pick-up trucks and light armour. A paraded captain has alleged that associates of ousted president Mohamed Bazoum, together with Chadian officers, were behind the plot, an allegation state media has extended to implicate Chad and France. This remains unconfirmed by independent sources. Separate analysis from the Egmont Institute frames the episode as a test of elite cohesion inside the junta. The mutiny lands as ISSP and JNIM attacks in the Dosso region and around Niamey are running at their highest tempo since the 2023 coup.

Zambia: Opposition leadership charged with treason as post-election crackdown widens

Brian Mundubile, who challenged President Hakainde Hichilema in Zambia’s disputed August general election, was formally charged with treason on 29 August alongside running mate Makebi Zulu and 16 others, 18 defendants in total. Both men were taken into custody on 27 August after briefly seeking refuge at the UN Mission in Lusaka. Former cabinet minister Mutotwe Kafwaya was fatally shot on 14 August during what Zambian authorities describe as a joint intelligence-led operation in Kabulonga, preceding the arrests; the evidentiary link between the two events is unclear from available reporting. Mundubile denies planning an armed uprising and maintains the election result was fraudulent.

Mali and the Sahel: UN assessment ties $50 million ransom to JNIM’s territorial expansion

A United Nations assessment reported in August found that a $50 million ransom paid in late 2025 for al-Qaeda-linked hostage-takers has materially financed JNIM’s campaign, which now spans Mali, Burkina Faso, Niger, Benin, and Togo. This follows an April 2026 coordinated JNIM and Azawad Liberation Front offensive that stripped Russia’s Africa Corps and its Malian partners of previously held towns.

Terrorism Tracker: DRC, Mozambique, Ethiopia

In the Democratic Republic of Congo, the Allied Democratic Forces sustained its mid-2026 escalation in North Kivu, having killed more than 30 people in a July church attack in Komanda and at least 52 civilians between 1 and 16 August across Beni and Lubero. No verified mass-casualty ADF attack occurred specifically within 25 to 31 August, but the pattern shows no de-escalation. In Mozambique, ACLED’s August Conflict Monitor recorded at least 64 fatalities since mid-June clustered around Catupa and Namabo, with Islamic State-Mozambique shifting toward IED-centred tactics. No confirmed major Al-Shabaab attack occurred within the reporting window; the most recent verified US and AFRICOM strike activity dates to 30 July, a reporting-lag gap noted for transparency. In Ethiopia, fighting between the Ethiopian National Defence Force and TPLF-aligned forces around Shererina has persisted for roughly a month since erupting on 1 to 2 August, with hundreds of civilians crossing into Sudan. The International Crisis Group assesses the hostilities as geographically localised and less intense than the 2020 to 2022 war.

Cyber and Tech Intelligence: African-targeted cyberespionage intensifying

Threat-intelligence reporting on the META region logs a 16 percent rise in spyware detections, a 51 percent jump in password-stealer attacks, and 23 percent growth in backdoor detections against African organisations, with more than 20 APT groups now tracked on the continent. Since 2024, the Kremlin has marketed its leading cybersecurity firms to African governments, granting Russian vendors deep access to partner-state digital infrastructure. Pegasus-class spyware remains a parallel concern, with confirmed infections documented across at least eight African states beyond the core group of suspected operator states.

INTELLIGENCE LEADERSHIP CHANGE CHECK (27 August to 05 September 2026)

None.

INTELLIGENCE ASSESSMENT

KEY JUDGEMENTS

Read more

Publication date: 27 August 2026 | 0345 BST
Assessment status: Breaking and developing
Analytic confidence: Moderate. The institutional actions are confirmed, but the precise allegations against Emmanuel Nchimbi remain undisclosed.

SOURCE-OF-TRUTH BRIEF

Confirmed facts

• On 25 August 2026, Vice-President Emmanuel John Nchimbi announced that he would resign, retire from active politics and leave public service, effective 4 September 2026.

• Nchimbi said he was convinced President Samia Suluhu Hassan wanted a change and referred to a promise he had made on 27 August 2025 to step aside whenever she wanted another Vice-President.

• President Samia accepted the resignation. The initial official statement did not explain why she wanted a change.

• On 26 August, CCM’s National Executive Council terminated Nchimbi’s party membership, citing alleged violations of party ethics, rules and principles without publicly detailing the conduct involved.

• The same party machinery approved Energy Minister Deogratius John Ndejembi as the proposed replacement.

• Ndejembi still requires appointment by the President and confirmation by a majority of the National Assembly before assuming office.

• On 24 July, Nchimbi had publicly urged Tanzanians to fight for a new constitution based on national consensus before 2030. His remarks drew criticism from CCM loyalists.

• On 19 August, six days before Nchimbi announced his resignation, the government suspended MwanaHALISI’s publishing licence for six months after it reported that he was resisting pressure to step down. The report relied on unnamed sources and the allegation was not independently established.

Key intelligence gaps

• What specific ethical violations formed the legal and evidentiary basis for Nchimbi’s expulsion?

• Was he given notice, a hearing and an opportunity to respond under CCM procedures?

• Why did his resignation take effect on 4 September rather than immediately?

• Did the Presidency request his departure directly, and what precipitated that request?

• Was his constitutional-reform speech the principal trigger, one indicator of a wider dispute, or merely a public manifestation of an older conflict?

• What is the constitutional status of an incumbent Vice-President whose party membership is terminated before his resignation becomes effective?

Key judgments

Read more

Ujasusi Mid-Week SITREP | 25 - 26 August 2026

In this bulletin:

• Tanzania’s Vice-President Nchimbi Resigns: What Happened

• Ameir Meets Museveni in Kampala

• Kagame Rebukes His Foreign Minister

• Petraeus Warns on Russian Threats to the UK

• Zambian Courts Closed Ahead of Election-Petition Deadline

• African Intelligence Services: Four Leadership Changes This Month

• Mexican Cartels Expand Meth Production into Africa

• Analysis (subscribers): The Samia-Nchimbi Rift, the MwanaHalisi Timing, and the Succession Field

Tanzania’s Vice-President Nchimbi Resigns: What Happened

Tanzania’s Vice-President, Dr Emmanuel John Nchimbi, resigned from office on 25 August 2026, informing President Samia Suluhu Hassan by letter that he was retiring from politics and public service, effective 4 September. He is the first Vice-President to leave office this way since independence in 1964, and his departure triggers a constitutional succession process with a mid-September deadline.

Nchimbi’s resignation surfaced through his personal Instagram account, inactive since 2023, before State House confirmed it that evening. The letter cited Articles 50 and 149 of the Constitution and framed the decision as fulfilment of a pledge Nchimbi says he made to Hassan in August 2025, that he would step aside once she wanted a different deputy. Under Article 50(4), Hassan has until roughly 18 September to nominate a successor from within CCM.

Nine days before the resignation, on 19 August, Tanzania’s Information Services Department suspended MwanaHalisi’s licence for six months, over a story reporting that Nchimbi was resisting pressure to step down.

This desk’s full reconstruction of the Samia-Nchimbi rift, the MwanaHalisi timing, and the succession field is available to Ujasusi subscribers below.

Ameir Meets Museveni in Kampala

Abdul Halim Hafidh Ameir, President Hassan’s son and a Tanzanian businessman, met Ugandan President Yoweri Museveni in Entebbe this week, in a visit both governments described in conventional investment and private-sector terms. A separate claim, circulating only on social media, describes Ameir in connection with TISS. This desk found no independently corroborated open-source reporting on that claim and is not linking to unverified social posts; Ujasusi’s own prior reporting has separately described Ameir as reportedly heading Tanzania’s intelligence services, a characterisation carried at the same assessed, not independently confirmed, status as when first published.

Kagame Rebukes His Foreign Minister

Rwandan President Paul Kagame used a 24 August press conference in Kigali to publicly override his foreign minister, Olivier Nduhungirehe, after Nduhungirehe clashed with a journalist over the presence of Congolese delegates at a Nairobi regional forum. Kagame told reporters the journalist owed no apology and rejected the minister’s demand that his own account be treated as authoritative.

Petraeus Warns on Russian Threats to the UK

Former CIA Director David Petraeus told British media that Vladimir Putin could turn to criminal gangs and disposable proxies to conduct deniable attacks on UK soil, rather than risk overt action against a NATO member. The UK’s Chief of the Defence Staff separately warned that Russian grey-zone activity is likely to intensify as the Ukraine war continues into another winter.

Zambian Courts Closed Ahead of Election-Petition Deadline

Zambian authorities closed the Constitutional Court grounds in Lusaka as the filing deadline approached for opposition candidate Brian Mundubile to challenge the 13 August presidential result, which the electoral commission had called for Hakainde Hichilema. The Law Association of Zambia has demanded an explanation for the closure, and at least one international election observer has separately alleged violence and a fatal shooting connected to the vote.

African Intelligence Services: Four Leadership Changes This Month

Togo carried out the largest regional intelligence reshuffle of the month on 17 August. Eight presidential decrees moved Brig. Gen. Tchakpélé Aklesso from head of the National Intelligence Agency to Chief of Defence Staff, installed Colonel Akapo Ayéwalani as the new Director-General of the Agence Nationale de Renseignement, and named Samarou Essowoè as his deputy.

Ghana restructured its National Security Council Secretariat on 11 August. Yaw Donkor, the former National Security Coordinator, moved to Director of Intelligence and Research at the Office of the National Security Advisor; Major General (Rtd.) William Ayamdo became Deputy National Security Coordinator for Operations.

Uganda formally retired Maj. Gen. Abel Kandiho from military service on 20 August, one of nineteen generals retired that day as part of a wider 1,817-person exit from the UPDF. Kandiho does not currently hold the CMI post; Rwanda’s government had demanded his removal in 2022 over allegations that CMI operatives under his command committed human-rights abuses against Rwandans in Uganda.

Kenya constituted its Intelligence Service Complaints Board on 21 August, naming Joseph Gitonga Riungu as chairperson. The board had gone unconstituted for well over a year, through a controversy in which Kenyan senators publicly pressed Interior Cabinet Secretary Kipchumba Murkomen over the delay amid enforced-disappearance allegations against the state.

Mexican Cartels Expand Meth Production into Africa

Nigerian, Kenyan, and South African authorities have made a series of arrests over the past two years involving Mexican nationals running clandestine methamphetamine laboratories, as the Sinaloa and Jalisco New Generation cartels expand under a franchise-style model. Nigeria’s largest-ever meth bust, in May, recovered precursor chemicals worth $363 million in Ogun State.

The Samia-Nchimbi Rift: How It Reached This Point, the MwanaHalisi Timing, and the Succession Field

Tanzania’s Vice-President resigned nine days after the state suspended a newspaper for reporting he was resisting pressure to do exactly that. That resignation is the terminal event in a sequence this desk has tracked in detail since Nchimbi’s appointment, not a sudden rupture.

How the rift reached this point

Read more

Ujasusi Intelligence Bulletin | August 16 - 21, 2026

This bulletin covers:

• Tanzania: high court finds Lissu has a case to answer, confounding acquittal expectations

• Zambia: Hichilema re-elected decisively amid credible but non-decisive fraud indicators

• Tanzania: denies meddling in Zambia’s election after opposition candidate’s viral allegations

• DRC: Tshisekedi visits Tanzania as a domestic term-extension crisis intensifies

• Kenya: helicopter crash kills Ecuador’s intelligence chief and six others

• Libya: intelligence chief appointment triggers a live constitutional dispute

• Nigeria: largest single-day hostage rescue in the country’s history

• Nigeria: Tinubu orders a National Threat Assessment and five-year defence plan

• South Africa: Madlanga Commission recommends criminal probe of suspended deputy police chief

• South Africa: two Anti-Gang Unit officers killed in Reiger Park ambush

• Somalia: NISA kills senior al-Shabaab commander amid continued insurgent resilience

• Ethiopia: Addis Standard editor abducted and assaulted, newsroom raided, eviction ordered

• UN: ISWAP named world’s most active Islamic State affiliate

• Europe: CIA warns Poland and the Baltics of possible Russian hybrid sabotage

• Iran: Russia resupplies depleted arsenal via Caspian Sea shipments

• Featured Assessment: what the Lissu ruling and CHADEMA’s stalled ultimatum reveal about Tanzania’s opposition strategy

LEAD ITEM

Tanzania: High court finds Lissu has a case to answer, confounding expectations of acquittal

Tanzania’s High Court ruled that CHADEMA leader Tundu Lissu has a case to answer on the treason charges brought against him, a decision that ran against widespread expectation the prosecution’s evidence was too weak to survive this stage and that Lissu would be discharged. Reaction has split into three broad camps.

One holds that the acquittal expectation was itself unrealistic, since the case is understood by many observers as politically driven and the judiciary is widely seen as responsive to President Samia Suluhu Hassan rather than independent of her.

A second camp expects an eventual guilty finding regardless of the case’s evidentiary weakness, followed by presidential intervention that would let Hassan claim credit for resolving a prosecution she is widely understood to have driven, a pattern some compare to Freeman Mbowe’s case: the High Court found in February 2022 that Mbowe had a case to answer on terrorism charges, only for the Director of Public Prosecutions to withdraw the case entirely a little over two weeks later, before any conviction.

The comparison is not a prediction, since no similar move has been signalled in Lissu’s case, but the Mbowe precedent does show that a case-to-answer finding in Tanzania has not always led to conviction.

A third strand of reaction centres on concern for Lissu’s physical safety and wellbeing while in the custody of a government CHADEMA has accused of orchestrating the September 2017 assassination attempt that left him with sixteen gunshot wounds. Full analysis in the Featured Assessment below.

CURRENT INTELLIGENCE SUMMARY

Zambia: Hichilema re-elected decisively; fraud indicators real but not outcome-determinative

President Hakainde Hichilema and the United Party for National Development were re-elected on 13 August with an official 61 percent of the vote against 38 percent for Brian Mundubile, running under the previously obscure National Reconciliation Party for Unity and Prosperity. The result followed a country-wide suspension of vote counting the day after polling amid reports of violence, and academic analysis by Nic Cheeseman and Nicole Beardsworth flagged improbable turnout figures and large presidential-parliamentary vote mismatches in some ruling-party strongholds.

The domestic observer network CCMG’s parallel tabulation puts the real margin closer to 56 to 42, still a decisive win, indicating manipulation inflated the margin without changing the outcome. The academic analysis this bulletin drew on, co-authored by Michigan State University political scientist Lindsay Favero among others tracking the vote, attributes the win chiefly to opposition collapse following Edgar Lungu’s death, Patriotic Front factional fracture, and Mundubile’s weak “rule like Lungu” pitch, set against genuine government strength on debt restructuring, inflation control and drought response.

Constitutional changes passed ahead of the vote expanded presidentially nominated parliamentary seats, and a security operation the day after the election targeted opposition officials including Mundubile, leaving one person dead and several detained. The opposition is challenging the result at the Constitutional Court.

Tanzania: denies meddling in Zambia’s election after opposition candidate’s claims

Government Chief Spokesperson Gerson Msigwa said on 15 August that Tanzania “has not sent anyone to Zambia to interfere in its elections,” after NRPUP presidential candidate Brian Mundubile alleged in a viral video that Tanzanians had been sent to Zambia to apply what he called “Tanzanian tactics” to the vote. Msigwa said Tanzania had instructed its ambassador in Lusaka to seek clarification through diplomatic channels, and suggested any Tanzanians involved in observing the election were likely part of the SADC observer mission rather than agents of the Tanzanian state. CHADEMA Mainland Deputy Chairman John Heche called the allegations serious given Tanzania’s historical role in African liberation movements, writing that “today Tanzania is being accused of sending mercenaries to disrupt elections in other countries.”

DRC: Tshisekedi visits Tanzania as term-extension crisis intensifies at home

DRC President Félix Tshisekedi made his third visit to Tanzania on 17 to 18 August, hosted by President Hassan in Zanzibar. The official agenda, per government statements from both sides, covered trade, mining, infrastructure and DRC security, producing a joint communiqué calling for the withdrawal of foreign forces from Congolese territory and continued disarmament of the FDLR, alongside mutual endorsement of each country’s bid for a non-permanent UN Security Council seat.

The visit’s backdrop is a serious domestic crisis: opposition coalition C64 has accused Tshisekedi of using proposed constitutional changes to extend his rule beyond the two-term limit his mandate is due to hit around 2028, a push the Constitutional Court found legally permissible to put to referendum on 28 July. A 12 June crackdown on protests against the changes left opposition leader Martin Fayulu shot and fellow opposition figure Delly Sesanga seriously injured, after which C64 gave Tshisekedi until 15 August, two days before he arrived in Tanzania, to clarify whether he would abandon the constitutional push.

No outlet reviewed for this bulletin explicitly linked the Tanzania visit to the term-extension standoff; the official framing throughout was economic and security cooperation. The timing is worth flagging as a juxtaposition analysts may read as Tshisekedi seeking diplomatic standing and regional legitimacy at a moment of acute domestic pressure, but that reading should be treated as analytical inference rather than a reported fact.

Kenya: helicopter crash kills Ecuador’s intelligence chief and six others

A Eurocopter EC130 B4 operated by Lady Lori Kenya Ltd crashed at Mount Ololokwe in Samburu County on 19 August, killing all seven aboard. Among the dead was Michele Sensi-Contugi, Director General of Ecuador’s National Intelligence Centre, and his wife, fashion designer Stephany Hollihan. Five Americans died alongside them, including a senior Telemundo executive. Kenya’s Civil Aviation Authority and Air Accident Investigation Department are investigating; the cause has not been established. Ecuador’s government has declared three days of national mourning.

Libya: intelligence chief appointment triggers unresolved constitutional dispute

The Presidential Council’s 28 June dismissal of General Intelligence Service chief Hussein Al-Ayeb and appointment of Abdul Majeed Mligta as his replacement has not settled. Council co-chair Musa Al-Koni disputes the decision was validly approved, the House of Representatives Speaker has publicly reaffirmed Al-Ayeb as the legitimate chief, and Benghazi and Tripoli courts have issued conflicting rulings, with Benghazi ordering the change suspended and Tripoli rejecting Al-Ayeb’s own challenge. A UN Security Council report dated 10 August confirms the dispute remains unresolved.

Nigeria: largest single-day hostage rescue frees 308 abducted civilians

A joint operation by the National Counter-Terrorism Centre, the military, police and the Department of State Services freed 308 people on 5 August from a forest area in Kainji Lake National Park, described by President Bola Tinubu as the country’s largest single-day rescue operation. The victims comprised 163 people abducted from Woro community, Kwara State, in a February attack that killed at least 170 residents, and 145 taken separately from Niger State. The rescue is a genuine coordination success, but it sits against a wider kidnapping crisis: data compiled through the Armed Conflict Location & Event Data project and reported by BBC Pidgin show more than 1,000 abductions across 2025 to 2026, most attributable to criminal gangs rather than militant groups.

Nigeria: Tinubu orders National Threat Assessment and five-year defence plan

President Tinubu has directed an 11-member committee, coordinated by Special Adviser on Homeland Security Adeyinka Famadewa, to produce a comprehensive National Threat Assessment and a five-year Strategic Defence Operations Plan within 90 days, intended to identify capability gaps and guide medium-term security spending and procurement across Nigeria’s defence, intelligence and security agencies.

South Africa: Madlanga Commission recommends criminal probe of suspended deputy police chief

The Madlanga Commission’s second interim report, handed to President Cyril Ramaphosa on 29 May and made public in early August, recommends disciplinary proceedings and immediate criminal investigation of suspended Deputy National Police Commissioner Lieutenant-General Shadrack Sibiya, alongside Sergeant Fannie Nkosi, a protected witness known as Witness G, and alleged political fixer Brown Mogotsi. The Commission has also called for an urgent, separate investigation into an alleged off-the-books Crime Intelligence operation involving Mogotsi and Witness G, a direct instance of organised-crime penetration of a formal intelligence structure.

South Africa: two Anti-Gang Unit officers killed in Reiger Park ambush

Constables Thapelo Kleinbooi Tlometsane and Siphiwe Sibeko were shot dead on 7 August in Reiger Park, Boksburg, after driving toward the source of gunfire during a routine patrol and being ambushed on arrival. Two civilian women were also killed. A 23-year-old suspect has since been arrested and charged with four counts of murder, following a tracing operation that recovered the officers’ stolen rifles in Germiston, though Hawks investigators say further arrests have not been ruled out.

Somalia: NISA kills senior al-Shabaab commander amid continued insurgent resilience

Somalia’s National Intelligence and Security Agency says it killed veteran al-Shabaab commander Abdullahi Ganey and three others in Middle Shabelle on 13 August, part of a wider counterterrorism push into Hiiraan and Lower Shabelle. This account is currently single-sourced to Africa Confidential; no independent second outlet corroborates the commander’s name or death toll, so it should be treated as reported rather than independently confirmed. Al-Shabaab claims a retaliatory IED attack the previous day killed roughly 20 soldiers near Mubarak, illustrating the insurgency’s continued operational capacity even under sustained intelligence-led pressure.

Ethiopia: Addis Standard editor abducted and assaulted; newsroom raided; eviction ordered

JAKENN Publishing PLC says its editor-in-chief, Yonas Kedir, was seized by plainclothes security personnel on 1 August, assaulted and held for approximately 24 hours of interrogation focused specifically on a question he had put to AFRICOM Commander General Anderson concerning Ethiopia’s role in the Sudan conflict. A heavily armed team raided the outlet’s Addis Ababa offices the following day, confiscating and reportedly damaging production equipment, and the landlord issued an eviction notice on 3 August that JAKENN says was made under police pressure. The Committee to Protect Journalists has condemned the pattern, the second such incident targeting Addis Standard staff in four months after Managing Editor Million Beyene’s April abduction.

UN: ISWAP named world’s most active Islamic State affiliate

Briefing the Security Council on 5 August on the UN Secretary-General’s 23rd strategic report on ISIS, officially titled the report on “ISIL (Da’esh)” (S/2026/638), UN Office of Counter-Terrorism official Oguljeren Niyazberdiyeva said Islamic State West Africa Province is now ISIS’s most active affiliate worldwide, with Africa experiencing the highest intensity of ISIS activity globally and West Africa its current centre of gravity.

Europe: CIA warns Poland and the Baltics of possible Russian hybrid sabotage

Bloomberg reported on 12 August, corroborated independently by multiple outlets, that the CIA has warned Poland and Baltic governments of a possible Russian campaign of infrastructure sabotage and false-flag operations. European officials caution the warning could equally reflect a Kremlin disinformation effort intended to project the appearance of escalation, and say there is no current indication Russia is preparing a conventional attack.

Iran: Russia resupplies depleted arsenal via Caspian Sea shipments

NBC News reported on 17 August, citing a European government document verified by a Western official, that more than two dozen Russian-owned vessels have delivered TNT, drone components and ammunition to Iran’s Amirabad port via the Caspian Sea, helping Tehran replenish stockpiles depleted in its conflict with the United States and Israel. Analysts note this marks a reversal of the historical flow, in which Iranian drones and technical assistance moved toward Russia rather than the other way round, and the first time in recent years Moscow has been accused of supplying explosives to Tehran directly.

FEATURED ASSESSMENT

Tanzania: The Lissu Ruling and CHADEMA’s Credibility Gap

The High Court’s case-to-answer finding keeps Tundu Lissu’s treason trial alive. The more consequential story may be CHADEMA’s own record: a widening gap between what it promised in April and what it has delivered since, at precisely the moment its leader’s fate is most acutely uncertain.

What the ruling actually decided

A “case to answer” finding is not a verdict, and the distinction matters for reading everything that follows. Under the common-law procedure Tanzania’s courts apply, once the prosecution closes its case, the defence can ask the court to rule there is no case to answer, meaning the evidence, even taken at face value and unrebutted, could not support a conviction. A finding against that submission means only that the evidence clears this lower bar. It does not mean the panel found Lissu’s guilt proven, and it does not foreclose acquittal at trial’s end.

That framing matters because the case did not arrive at this point through a single hearing. The prosecution first brought Lissu before the Kisutu court following his arrest in Mbinga in April 2025, then moved to the High Court, where proceedings stretched over 16 months and were interrupted repeatedly, twice in November 2025 when the prison service failed to produce Lissu and the prosecution failed to bring witnesses, citing unspecified security concerns.

A separate dispute over the prosecution’s use of a fully concealed witness produced a further long interruption; when the court resumed in February 2026, the three-judge panel granted Lissu what amounted to a partial win, ordering modifications that let the bench itself see the witness, while rejecting his broader challenge to the witness-protection framework entirely.

The prosecution closed its case on 17 August after calling 17 of the 30 witnesses it had originally listed. Four days later, presiding judge Dunstan Ndunguru, sitting with judges James Karayemaha and Ferdinand Kiwonde, ruled the evidence, centred substantially on testimony from the prosecution’s 17th witness about remarks Lissu allegedly made at a CHADEMA headquarters meeting on 3 April 2025, sufficient to require an answer under Section 39(2)(d) of the Penal Code. Lissu, representing himself throughout, had argued the evidence fell short and asked the court to acquit him and order compensation.

That history undercuts the simplest version of the “the case was too weak to survive” argument. This wasn’t a rubber-stamp proceeding; Lissu won real procedural fights along the way, including forcing modification of the witness-protection arrangement, and the eventual ruling rests on a specific evidentiary basis rather than an unexplained decision. Whether that basis will hold up once Lissu presents his own defence, the next and legally more demanding stage, is a separate and still open question.

The three camps, and a fourth angle worth adding

Read more

Ujasusi Intelligence Bulletin | 15 August 2026 | 0100 BST

This bulletin covers:

• President Samia Suluhu Hassan’s meeting with Tanzania Episcopal Conference bishops in Dodoma, and the online accusations of betrayal that followed

• Germany’s approval of its most sweeping intelligence-service reforms since the end of the Second World War

• The suspension and resumption of vote counting in Zambia’s general election amid violence against poll staff

• An Africa Center for Strategic Studies assessment that Somalia’s federal government risks losing the capital, Mogadishu, to the al Shabaab insurgency

• Continent-wide data showing militant Islamist violence in Africa has surpassed 20,000 deaths for a fourth consecutive year

• Reporting that Sahel-based jihadist groups are converging on Nigeria, drawing on a United Nations Security Council report

• Rising risk of renewed war between Ethiopia’s federal government and Tigray, nearly four years after the Pretoria Agreement

• A French survey ranking Britain’s Secret Intelligence Service (MI6) first among European intelligence agencies

• CIA-linked research arguing that artificial intelligence is reviving Cold War-era human intelligence tradecraft

• A new mutual defence pact between Saudi Arabia, Türkiye and Pakistan, signed in Mecca

• South Africa’s Madlanga Commission recommending a criminal investigation into a suspended deputy national police commissioner

A Featured Assessment examines why the Samia-TEC meeting, welcomed by political analysts as constructive dialogue, generated public accusations that the Catholic Church had betrayed the citizens it claims to represent.

LEAD ITEM

Samia’s Dodoma meeting with TEC bishops draws “betrayal” accusations online

President Samia Suluhu Hassan met leaders of the Tanzania Episcopal Conference at Chamwino State House in Dodoma on Monday 10 August, the first such encounter since months of unprecedented tension between the state and Tanzania’s Catholic Church over the killings that followed last October’s general election. The TEC delegation was led by Bishop Wolfgang Pisa, TEC President and Bishop of Lindi, and included Secretary General Fr Dr Charles Kitima, TEC Vice President Bishop Eusebius Nzigilwa, Cardinal Protase Rugambwa, and the archbishops of Mwanza, Arusha and Dodoma. According to a statement from State House Director of Communications Bakari Machumu, the session covered politics, faith, development, national solidarity and moral stewardship; Kitima’s own remarks, reviewed separately by this desk, put the meeting’s length at roughly ninety minutes.

The meeting followed a January 2026 visit by Foreign Minister Mahmoud Thabit Kombo to Pope Leo XIV, widely read as an attempt to ease strain with the global Catholic leadership, and comes five days after Samia’s 5 August announcement of a Reconciliation Commission. Political analysts quoted by The Citizen, including Dr Aviti Mushi, welcomed the engagement as bridge-building. That elite reading sits at odds with a harsher reaction online, where sections of Tanzanian social media have accused TEC of betraying citizens by meeting a government they hold responsible for mass killings, without securing visible commitments on accountability. This division between institutional and public reaction is the subject of this week’s Featured Assessment, below.

READ ALSO

SECONDARY ITEMS

Germany approves most sweeping intelligence reforms since 1945

Germany’s Federal Cabinet has approved reforms that would, for the first time since the BfV and BND were founded in the 1950s, permit both agencies to conduct offensive operations abroad, including sabotage, offensive cyber activity and, in self-defence, the use of firearms. Interior Minister Alexander Dobrindt called the change “a revolution” in German security policy. The government frames the reform as a response to what it terms Russian “state terrorism,” a characterisation that aligns with a CIA warning, reported to European counterparts the same day the Cabinet approved the reforms, that Moscow is preparing to intensify sabotage against European infrastructure alongside false-flag operations. The reforms require Bundestag ratification in September and are highly likely to pass given the governing coalition’s majority. This is a significant shift for a state whose entire postwar intelligence architecture was built on defensive, oversight-heavy design; the practical test will be whether parliamentary oversight mechanisms, built for a purely defensive service, can adapt at the same pace as the new operational mandate.

Zambia’s election count halted, then resumed, after attacks on poll staff

Zambia’s Electoral Commission suspended vote counting nationwide on Friday 14 August, a day after the general election, citing violence against polling staff and theft of marked ballots in several districts. Counting resumed hours later after what the Commission described as containment of the security threat, with riot police and army units deployed around the Lusaka tallying centre. Incumbent President Hakainde Hichilema, seeking a second term against Tonse Alliance leader Brian Mundubile, called for calm; Mundubile’s camp said delayed results risked masking irregularities. Zambia has held largely peaceful multiparty elections since 1991, making Friday’s disruption a genuine departure from precedent rather than a recurring pattern. Results, originally expected Monday, may now be delayed.

Africa Center assessment: Somalia’s federal government at risk of collapse to al Shabaab

A November 2025 Africa Security Brief by Matt Bryden, last revised 6 August, assesses that al Shabaab is closer than at any point in two decades to seizing Mogadishu, driven less by the group’s own strength than by the collapse of political cooperation between Villa Somalia and the federal member states of Puntland and Jubaland. Both states have suspended relations with the federal government. Compounding this, the African Union’s AUSSOM peacekeeping mission has received barely a quarter of its 2025 budget, and the United States has objected to new UN funding mechanisms that would sustain it. Gulf-state rivalry deepens the fracture: Qatar and Türkiye back President Hassan Sheikh Mohamud’s Islamist-aligned centre, while the UAE backs the more federalist member states. The assessed likely near-term scenario, absent a government of national unity, is continued erosion of federal authority; the assessed worst case is an al Shabaab takeover of the capital before Mohamud’s term expires in May 2026.

Militant Islamist violence in Africa surpasses 20,000 deaths for fourth straight year

An Africa Center for Strategic Studies infographic published 12 August records 23,872 fatalities linked to militant Islamist violence across Africa in the twelve months to mid-2026, a 77 percent increase since 2021 and nearly 150 percent above the 2017 figure. The Sahel accounts for 42 percent of the continental total, with the JNIM coalition responsible for 76 percent of fatalities in that theatre alone. Somalia and the Lake Chad Basin each account for 28 percent, with Lake Chad fatalities up 60 percent on the year, driven by a Nigerian-led military offensive against Boko Haram and ISWAP. Mozambique’s ASWJ insurgency has risen 58 percent since the departure of SADC forces in July 2024. Remote violence, principally airstrikes and a growing share of drone strikes, rose 42 percent and now accounts for around 40 percent of deaths in Somalia specifically, reflecting a broader continental shift toward stand-off tactics by both militaries and militant groups.

Nigeria named as the next convergence point for Sahel-based jihadist groups

Citing the United Nations Secretary-General’s 23rd strategic report on ISIL/Da’esh (S/2026/638, briefed to the Security Council on 5 August), a TruthNigeria report argues that JNIM’s economic blockade of Bamako, territorial gains by JNIM and Islamic State Sahel Province in Burkina Faso, and the continued expansion of ISWAP, the report’s named most active Islamic State affiliate globally, are converging on Nigeria’s northwest and Middle Belt. The report cites JNIM’s first claimed attack on Nigerian soil near the Benin border in October 2025, a Lakurawa-linked killing of 162 people in Kwara State in February 2026, and a US airstrike on ISSP camps in Sokoto’s Tangaza county on 25 December 2025, described as the first known American kinetic action inside Nigeria against a Sahel-linked group. A note on sourcing: TruthNigeria is an advocacy publication focused on the persecution of Nigerian Christians rather than a wire service or specialist security outlet, and its framing should be read as opinion pending corroboration from primary UN or specialist reporting; the underlying UN report and the specific dated incidents it cites are independently verifiable and warrant separate confirmation.

Ethiopia-Tigray tensions edge toward renewed conflict after Shererina clash

An 14 August analysis by Horn of Africa specialist Yohannes Woldemariam catalogues a build-up toward renewed war between federal Ethiopian forces and the Tigray Defence Forces, nearly four years after the Pretoria Agreement ended the 2020-2022 war. Federal-TDF clashes resumed in January 2026 for the first time since Pretoria, and fighting broke out at Shererina in western Tigray on 1 August, described by Al Jazeera as one of the most serious threats yet to the peace agreement. Journalist Martin Plaut has characterised Shererina as a federal probe of TDF capacity that produced unexpectedly heavy federal losses, though these figures remain unconfirmed. A further drone strike hit Merewa on 10 August. The author’s central argument, an interpretation rather than settled fact, is that Washington’s 18 June visa restrictions on TPLF “hardliners” may have signalled diplomatic cover to Addis Ababa rather than restraining Tigray, given that the TPLF restored its pre-war regional government in May citing federal violations of Pretoria and was excluded from Ethiopia’s June 2026 national election. Ethiopia’s parallel dispute with Eritrea, formally accused by Addis Ababa of military aggression in February, adds a second axis that did not exist during the 2020-2022 war, when Eritrea fought alongside federal forces against Tigray.

British intelligence ranked top in Europe by French survey; assessment disputed by a serving officer

French magazine L’Express canvassed 60 intelligence professionals across 25 countries and placed Britain’s Secret Intelligence Service (MI6) first in Europe, ahead of France and the Netherlands, whose foreign intelligence services are DGSE and AIVD respectively, and every other European service assessed. A former DGSE chief credited British services with playing “the long game” and a particular flair for what he termed dirty tricks. An unnamed Western intelligence officer dismissed the ranking exercise itself as “a load of codswallop,” a reasonable caution given that comparative rankings of secret services rest on necessarily incomplete and unverifiable information. Former CIA Europe and Eurasia operations chief Ralph Goff is quoted crediting Britain with leading Western intelligence support to Ukraine. The piece, written by a former British Army colonel, ties the ranking to a fresh US intelligence warning that Russia could attempt a limited incursion or cyber campaign against NATO states between this autumn and 2029, and argues for higher UK defence spending; this argumentative framing should be read as advocacy rather than as independent confirmation of the underlying ranking’s methodology.

CIA-linked research argues AI is reviving Cold War-era human tradecraft

A paper published in the CIA-affiliated journal Studies in Intelligence, authored by RAND researcher and former CIA officer Thomas Mulligan, argues that AI-generated deepfakes and synthetic messages are eroding confidence in digital communications to the point that classical human intelligence tradecraft, dead drops, brush passes and in-person meetings, is regaining strategic value. The underlying logic is straightforward: a dead drop or brush pass verifies that information originated from a specific human source in a way no digital channel currently can, once AI-generated deception is assumed to be present in any electronic exchange. The argument runs counter to the prevailing assumption that AI simply expands intelligence collection capacity; Mulligan’s case is that the same technology simultaneously degrades trust in the product that expanded collection generates.

Saudi Arabia, Türkiye and Pakistan sign Mecca Joint Defence Agreement

Leaders of the three states signed a mutual defence pact in Mecca on 7 August, declaring that an armed attack on any one signatory will be treated as an attack on all three. The agreement builds on an existing Saudi-Pakistan Strategic Mutual Defence Agreement signed in September 2025 and combines, according to the 2026 Global Firepower Index, close to 1.4 million active military personnel, Türkiye’s NATO-derived defence-industrial base, Saudi financial and geographic weight, and Pakistan’s status as the only nuclear-armed Muslim state. Analysts at the Atlantic Council caution this is a framework for closer strategic and defence-industrial coordination rather than a NATO-equivalent alliance, though Turkish Foreign Minister Hakan Fidan has said Ankara wants to expand membership beyond the three signatories. This desk assesses, with moderate confidence, that the pact reflects Gulf states hedging against reliance on US security guarantees following repeated Iranian drone and missile activity in the region; the Atlantic Council’s own commentary points in this direction but does not state it as directly as this framing implies.

READ ALSO

South Africa’s Madlanga Commission refers suspended deputy police chief for criminal probe

The Madlanga Commission of Inquiry’s second interim report, handed to President Cyril Ramaphosa on 29 May and made public on 6 August, recommends criminal investigation and disciplinary proceedings against suspended Deputy National Police Commissioner Lieutenant-General Shadrack Sibiya, along with a protected witness known as Witness G, suspended Sergeant Fannie Nkosi, and alleged political fixer Brown Mogotsi. Evidence before the Commission linked Sibiya to accused corruption figure Vusimuzi “Cat” Matlala, including alleged cash payments and a delivery of impala to Sibiya’s property. The recommendation substantially validates over a year of allegations first raised publicly by KwaZulu-Natal police commissioner Nhlanhla Mkhwanazi against Sibiya, and marks the first time the Presidency has confirmed a Commission recommendation naming a deputy national police commissioner for criminal referral.

WHAT TO WATCH

1. Tanzania — TEC’s next public statement. Whether TEC issues a follow-up statement addressing the “betrayal” accusations directly, or maintains silence, will indicate whether the institution intends to manage the backlash or absorb it. Timeframe: two to three weeks.

2. Ethiopia — further drone activity around Tigray. Additional strikes beyond Shererina and Merewa, particularly any resumption of ground operations, would indicate the federal government has drawn the “escalate via air power” lesson rather than the “avoid ground war” lesson from Shererina. Timeframe: ongoing.

3. Somalia — AUSSOM funding decisions. EU and other donor funding commitments over the coming weeks will determine whether the mission can sustain even a reduced posture through 2026. A funding shortfall confirmed publicly would sharply raise the probability of the adverse scenario in the Africa Center assessment above.

4. Zambia — final result timing. Whether results are announced on the original Monday timeline or delayed further will signal whether Friday’s disruption reflects contained, localised violence or a deeper credibility problem with the count.

5. Germany — Bundestag ratification debate in September. The scope of parliamentary amendments to the reform package, if any, will indicate how much oversight capacity is retained alongside the new offensive mandate.

6. Turkey-Saudi-Pakistan pact — membership expansion. Any formal move to add signatories beyond the original three would mark a shift from bilateral hedging to a genuine minilateral security architecture in the Gulf and South Asia.

ANALYTICAL NOTE

Three items in this summary, Somalia, the continental militant Islamist violence data, and the Nigeria convergence reporting, describe the same underlying phenomenon from different angles: a jihadist landscape in Africa that has not merely persisted but has restructured itself around economic warfare (JNIM’s Bamako fuel blockade), cross-border convergence (Sahel groups moving into northwest Nigeria), and remote-strike tactics that are reshaping both militant and state approaches to violence. Read together rather than separately, they support a single working judgement, held with moderate confidence: Africa’s militant Islamist threat is no longer contained within traditional theatre boundaries, and West African and Horn of Africa security planning increasingly needs to be conducted as a single interconnected problem rather than as separate regional files.

RELATED

FEATURED ASSESSMENT

Why the Samia-TEC meeting produced accusations of betrayal rather than credit for dialogue

KEY JUDGEMENTS

1. The gap between elite and public reaction to the 10 August meeting reflects a genuine divergence in what each audience believes the meeting was for, not simply a communications failure on TEC’s part. Confidence: Moderate. Elite commentary treats dialogue itself as the desired outcome; large parts of the online public treat dialogue as valuable only if it produces visible accountability commitments, which the available public record does not show it did.

2. Fr Kitima’s press framing of the meeting, examined in detail below, structurally resembled past TEC statements defending institutional engagement with government on other contested issues, most notably the 2023 port concession dispute, but was read far more harshly this time because the underlying grievance, alleged mass killings following an election, carries a different moral weight than a commercial contract dispute. Confidence: Moderate.

3. TEC’s institutional position is almost certainly shaped by a genuine and specific personal safety calculation, not solely institutional politics. Confidence: High. Fr Kitima was physically assaulted at TEC headquarters in April 2025 and disclosed in December 2025 that he was living in fear and being actively hunted; any assessment of TEC’s current posture that omits this context risks mischaracterising caution as complicity.

4. The meeting is highly likely to be read by the CMAG and broader international accountability track as evidence of internal Tanzanian dialogue progress, regardless of its substantive content. Confidence: Moderate. This creates a structural incentive for the government to prioritise the optics of engagement with religious leadership over the substance of accountability demanded by CMAG’s 30-60-90 day roadmap.

5. Absent a specific, public TEC statement addressing the accountability gap directly, the credibility cost to the institution is likely to persist and could affect TEC’s standing as an intermediary in the government’s broader Reconciliation Commission process. Confidence: Low to Moderate, given the genuine uncertainty over how quickly public sentiment on this specific episode will fade relative to the wider news cycle.

SCOPE AND APPROACH

This assessment addresses a single analytical question: why did a meeting between the President and the country’s Catholic bishops, one that most conventional political analysts described as constructive, generate accusations online that TEC had betrayed the citizens it claims to represent? It draws on Tanzanian and international press reporting of the meeting itself (The Chanzo, Daily News, The Citizen, Michuzi Blog), the official State House statement, and a detailed textual analysis of Fr Kitima’s press remarks conducted in a prior Ujasusi session. It does not attempt to verify the content of the online backlash quantitatively, no polling or systematic social media analysis was available at time of writing, and readers should treat the characterisation of “significant online backlash” as consistent with the person’s direct observation and with the general pattern of Tanzanian civic discourse since October 2025, rather than as an independently measured metric.

BACKGROUND

Tanzania has been in sustained political crisis since violence surrounding the general election of 29 October 2025, in which approximately 10,000 people are assessed to have been killed, a figure the Ujasusi desk treats as established for editorial purposes and outside the scope of further verification in this product. The Tanzania Episcopal Conference, representing all Catholic bishops in the country, has occupied an unusually prominent and unusually dangerous position in the aftermath. Fr Kitima, TEC’s Secretary General, was assaulted at TEC headquarters in Kurasini on 30 April 2025 following a meeting of religious leaders convened to discuss the run-up to the election, an attack that followed documented social media death threats and that TEC’s own leadership has linked to Kitima’s advocacy on electoral justice and his public criticism of the treason charges brought against opposition leader Tundu Lissu. President Samia directly and publicly criticised TEC by name in a December 2025 address, citing what she characterised as inconsistency across the institution’s eight public statements on the crisis. Kitima disclosed the following week that he was living in fear and being actively hunted, restricting his own movements for safety reasons.

Against this backdrop, the Commonwealth Ministerial Action Group’s 30-60-90 day roadmap, adopted in July, set a target of resolving Lissu’s detention within roughly 30 days, meaning by approximately 9 August, one day before the Samia-TEC meeting took place. A January 2026 Vatican engagement between Foreign Minister Kombo and Pope Leo XIV, and an earlier meeting between Kitima and Prime Minister Mwigulu Nchemba, both preceded the 10 August meeting, suggesting a deliberate government sequencing strategy aimed at normalising relations with the Catholic hierarchy ahead of, and possibly in service of, the broader Reconciliation Commission the President announced on 5 August.

ANALYSIS

Read more

Ujasusi Intelligence Bulletin | 1 August 2026 – 10 August 2026

This bulletin covers:

• Tanzanian opposition leader Tundu Lissu’s treason trial resuming the day the Commonwealth’s 30-day deadline expired

• A charge-swap pattern in the case of Neema Chozaire, an official of CHADEMA, Tanzania’s main opposition party

• The collapse of street mobilisation planned for Nane Nane, Tanzania’s 8 August national holiday

• The US Senate’s Tanzania sanctions bill reaching the floor calendar

• Intelligence-service reshuffles in Ghana and Zimbabwe

• A tradecraft file on a fugitive spy chief from Bashar al-Assad’s fallen Syrian regime

• Zambia’s 13 August election as regional context

A Featured Assessment compares Tanzanian Vice President Emmanuel Nchimbi’s position to Kenya’s precedent of impeached former Deputy President Rigathi Gachagua.

Lead Item

Two clocks converge: Lissu’s trial resumes as the Commonwealth deadline expires

Tanzania’s two principal accountability tracks, the domestic judicial process and the Commonwealth’s diplomatic pressure campaign, collided on 10 August. The High Court in Dar es Salaam resumed the treason trial of Tundu Lissu, chairman of CHADEMA, Tanzania’s main opposition party, after a five-month suspension, the same day the Commonwealth Ministerial Action Group’s 30-day deadline for resolving his detention expired. The court has scheduled hearings to run from 10 August to 7 September, meaning the case will still be active when CMAG reconvenes next month.

CMAG’s 73rd extraordinary session, held on 10 July, set three benchmarks: a political or legal pathway to Lissu’s release within 30 days, restored digital and media freedoms within 60 days, and a neutral-facilitated inter-party forum within 90 days. The government of President Samia Suluhu Hassan has responded procedurally rather than substantively: officials said in July they were “assessing” the recommendations, while CHADEMA ruled out talks without Lissu’s release and independent mediation.

This assessment concludes with moderate confidence that the trial’s resumption on the exact day the deadline lapsed is not coincidental scheduling but a deliberate signal: the state is demonstrating procedural motion on Lissu’s case without conceding the substantive outcome CMAG required. The five-month suspension, driven by a prosecution appeal over additional evidence that the Court of Appeal ultimately dismissed, has already cost Lissu roughly 490 days in pre-trial custody on a capital, non-bailable charge. Continued incremental hearings allow Tanzania to argue engagement with the Commonwealth process while the underlying detention persists unresolved.

READ ALSO

Secondary Items

The charge-swap pattern: Neema Chozaire and the collapse of the bail route

CHADEMA’s Geita Rural chairperson, Neema Chozaire, has moved through the same procedural sequence now visible in Lissu’s case, compressed into six weeks. Reported missing on 29 June, confirmed arrested on 1 July on a charge of conspiracy to murder police officers, she spent 22 days in custody before a High Court petition secured her release on bail on 21 July. According to a CHADEMA-affiliated Instagram account, the state subsequently withdrew that charge and re-arraigned her on terrorism grounds, a non-bailable offence, returning her to prison; the case has been adjourned to 24 August. This report has not yet been corroborated by mainstream Tanzanian outlets, and it is treated here as credible but unconfirmed pending independent verification.

If accurate, the sequence (bailable charge, bail granted, charge withdrawn, non-bailable charge substituted) mirrors the parallel track reportedly opened against Lissu himself, in which a second, terrorism-based charge sits behind the treason case as a hedge against any judicial or political resolution of the latter. Assessed with moderate confidence: this represents a repeatable prosecutorial technique rather than an isolated decision, designed to neutralise bail as a release mechanism for opposition figures irrespective of the underlying facts of any individual case.

Nane Nane’s non-event and the shrinking options for the President’s opponents

Activists and Gen-Z-led online mobilisation had circulated calls for demonstrations across Tanzania timed to 8 August, Nane Nane, a national public holiday marking the country’s farmers, and the second such planned protest date after Saba Saba on 7 July, when police pre-emptively arrested more than 130 people and the planned protest failed to materialise under a heavy security presence. Ujasusi’s monitoring network assesses that the Nane Nane call collapsed even more completely: security services reportedly did not consider the call credible enough to warrant the pre-emptive warnings and arrests that preceded Saba Saba, itself an indicator of how thoroughly the state judges street mobilisation to have been suppressed as a viable opposition tool.

This assessment concludes with moderate confidence that the anti-Samia camp’s remaining options have narrowed to three tracks, none of which offers a fast outcome: the judicial route, tested through habeas-style petitions of the kind that briefly freed Chozaire; the external-pressure route, running through CMAG and the US Congress; and the route running through the ruling party, Chama Cha Mapinduzi (CCM): specifically the rift between the President and Vice President Emmanuel Nchimbi, examined in the Featured Assessment below, which offers the only visible fracture inside the ruling party itself. Street protest, the tool that produced the October 2025 killings and briefly appeared to threaten the government’s legitimacy, is assessed as having been effectively removed from the opposition’s repertoire for the remainder of 2026.

Washington’s sanctions bill reaches the Senate floor calendar

The Reassessing the United States-Tanzania Bilateral Relationship Act, S.4577, advanced from committee markup to the Senate’s general legislative calendar on 27 July, placed as Calendar No. 511 after being reported out by Foreign Relations Chairman Jim Risch with a substitute amendment. The bill authorises targeted sanctions and visa bans against named officials, suspends categories of security and development assistance, and bars Millennium Challenge Corporation support until the State Department certifies meaningful reform.

The floor calendar placement matters less for its content, which was substantially settled at the June committee markup, than for its timing: it now sits available for a floor vote in the same week the CMAG deadline expired and Lissu’s trial resumed, giving Congress a live legislative vehicle that can be scheduled quickly should either track produce a further deterioration. Available reporting does not indicate a scheduled floor vote date; this remains a key unknown heading into the August recess.

Regional intelligence services: reshuffles in Accra and Harare

Two African intelligence establishments underwent leadership disruption this period. In Ghana, a feature analysis by Mustapha Bature Sallama examined the personnel and structural changes to the country’s national security architecture under President John Mahama, framing the reshuffle as an attempt to establish a new intelligence doctrine distinct from the previous administration’s approach.

In Zimbabwe, Gambakwe Media reported the removal of 32 senior officers from the Central Intelligence Organisation. This report has not yet been corroborated by a second independent source and is graded accordingly: plausible given Zimbabwe’s history of periodic CIO purges tied to succession politics, but not yet confirmed. Readers should treat the figure of 32 as provisional pending further reporting.

Tradecraft file: the phone book that found Assad’s spy chief

A BBC investigation reconstructed how analogue detective work, cross-referencing an old personal phone directory rather than digital surveillance, led investigators to the hiding place of a senior figure in Bashar al-Assad’s intelligence apparatus after the Syrian government’s collapse. The piece is a useful corrective to assumptions that fugitive tracking in 2026 is a purely digital discipline; low-technology human networks and paper records remain productive avenues when a target has gone to ground precisely to avoid digital exposure.

Regional context: Zambia’s 13 August vote

Zambia goes to the polls on 13 August, with incumbent President Hakainde Hichilema facing challenger Brian Mundubile in what regional monitors are calling a genuine two-horse contest. The vote falls two days after this bulletin’s publication and sits outside Tanzania’s immediate crisis, but it is included here as a comparative data point: a Southern African Development Community member state conducting a contested election without the security-force posture currently on display in Dodoma offers an implicit benchmark against which Tanzania’s own conduct continues to be measured by regional and Commonwealth observers alike.

READ ALSO

What to Watch

CMAG’s September reconvening. The Ministerial Action Group is due to reassess Tanzania’s compliance with the 30/60/90-day benchmarks. A failure to show a political or legal pathway on Lissu by then would represent the clearest indicator yet of the process moving toward escalation rather than continued probation.

Chozaire’s adjourned hearing, 24 August. If the terrorism re-charge is confirmed by further reporting and the case proceeds on that date, it would corroborate the charge-swap pattern assessed above and strengthen the analytical case that this is now standard prosecutorial practice against opposition figures who secure bail.

Whether S.4577 receives Senate floor time before recess. A floor vote, or its absence, before the August recess would indicate how much legislative priority the bipartisan sponsors are able to command relative to other business.

Zambia’s 13 August result and any Commonwealth commentary drawing a comparison. A peaceful, competitive Zambian election result would sharpen regional and international framing of Tanzania as an outlier within its own neighbourhood.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

FEATURED ASSESSMENT

Key Judgements

1. President Samia Suluhu Hassan is assessed as likely to be pursuing a strategy of political marginalisation against Vice President Emmanuel Nchimbi rather than formal removal, given the higher constitutional and political cost of impeachment relative to Kenya’s precedent. Confidence: Moderate.

2. The June 2026 parliamentary “Judas” speech and Nchimbi’s exclusion from the Central Committee and Cabinet meetings almost certainly originated from CCM’s Zanzibar-aligned bloc with the President’s tacit or active endorsement, given the coordinated timing and the absence of any disciplinary response against the speaker. Confidence: High.

3. Unlike Gachagua, whose removal proceeded through a documented parliamentary impeachment process with judicial review, Nchimbi’s position is being contested through informal exclusion, public rhetoric and bureaucratic sidelining. This assessment judges it unlikely that Samia’s government pursues a formal impeachment vote before the CCM’s 2030 succession cycle, given the reputational cost of a second internal crisis while Tanzania is already under Commonwealth and Congressional scrutiny. Confidence: Moderate.

4. Nchimbi’s public pivot toward constitutional reform advocacy, most visibly his 24 July address calling for a new constitution built on national consensus, is assessed as a defensive repositioning strategy, converting a weakening internal position into a public reform credential that would be politically costly for Samia’s government to attack directly. Confidence: Moderate.

Scope and Approach

This assessment examines whether the deteriorating relationship between President Samia Suluhu Hassan and Vice President Emmanuel Nchimbi is trending toward a formal removal comparable to Kenya’s October 2024 impeachment of then-Deputy President Rigathi Gachagua, and whether the Kenyan case offers a reliable predictive template for Tanzania. It draws on Tanzanian parliamentary reporting, CCM internal signalling as documented by independent Tanzanian outlets, and Kenyan court reporting on the Gachagua case through June 2026. It does not assess the substantive merits of either country’s underlying political disputes, nor does it draw conclusions about criminal liability on any side.

Background

Read more

Ujasusi Terrorism Monitor | 01 August 2026 | 1630 BST

📋 July at a Glance

Fatality figures are floors drawn from named reporting. Belligerent claims are excluded from these totals and treated separately in the text.

🔑 Key Judgements

On judgement 1. The JNIM and FLA offensive against Anefis in Mali and the attacks on Di, Solhan and Séguénéga in Burkina Faso occurred within the same 48 hours. JNIM has demonstrated cross-border command capability repeatedly, most recently on 30 June when it struck three Nigerien and three Burkinabè locations on the same day.

On judgement 2. According to the Critical Threats Project, the attackers at Anefis employed at least one Russian BTR-80 armoured personnel carrier alongside artillery, drones, armoured vehicles and pickup trucks. The fighting that followed ranks among the longest sustained engagements in the Mali conflict since the opening years of the 2012 rebellion.

🇲🇱 Mali: The Fall and Recovery of Anefis

The 4 July offensive

Jihadist and separatist forces struck across Mali on 4 July. The army claimed to have thwarted every attack, but AFP reported a regional elected official stating that rebels had taken control of Anefis, with Russian personnel entrenched in the camp and many Malian military personnel taken prisoner. Azawad Liberation Front spokesman Mohamed Elmaouloud Ramadane told the agency that several positions at Anefis had fallen.

Anefis is operationally critical to controlling Kidal region and central to the ability of Malian and Russian forces to project pressure into it. Anefis and Aguelhok were the last locations where the Malian army maintained a presence in northern Kidal following the April attacks.

The counter-offensive, 5 to 10 July

The offensive ultimately failed. On 5 and 6 July, Malian forces and Africa Corps released video of drone strikes against FLA and JNIM personnel and equipment, and Africa Corps announced that two senior FLA and JNIM commanders were among those killed.

By 10 July, according to the Ghana Peace Journal’s Sahel Diaries chronology, Malian forces were present in Anefis and reported to have retaken the town, with militants withdrawing. The same day, Bamako claimed more than a hundred militants neutralised in 7 July airstrikes near Boulkessi, Fadiola, Marakakoungo and Farabougou. JNIM separately claimed to have killed forty militiamen near Somadougou and Konna, and accused Malian forces and Africa Corps of drone strikes on civilian businesses causing seven casualties among workers at Talhandak in Kidal.

Sustained pressure, 12 to 15 July

Source: Sahel Diaries No. 17.

Assessment

The state recovered Anefis, but the recovery required Russian air support and took six days. The strategic reading is not that the offensive failed. It is that a jihadist and separatist coalition can now mass armour and artillery against a defended position and hold it for the better part of a week.

Three features distinguish this from the pattern of the past decade. First, the use of a captured armoured personnel carrier alongside artillery indicates a shift from raiding to combined-arms assault. Second, the coalition held ground under drone observation, accepting attrition rather than dispersing. Third, the target set was strategic rather than opportunistic: Anefis controls access to Kidal, and Kénieroba is a prison sixty kilometres from the capital.

The Dozo and Dan Na Ambassagou engagements indicate that the central theatre is increasingly being fought through militia proxies on the government side, which historically precedes communal massacre.

This follows the 25 April coordinated attacks across Bamako, Kati, Gao, Mopti and Sévaré, among the most significant escalations in Mali’s security crisis in recent years, during which Defence Minister General Sadio Camara was killed by a suicide vehicle-borne IED at his residence in Kati.

READ ALSO

🇧🇫 Burkina Faso: Three Positions Struck in One Weekend

Burkinabè forces absorbed the same first-weekend pressure as Mali. AFP reported at least twenty-two soldiers and civilian militia killed in suspected extremist attacks in the north of the country over the weekend of 4 and 5 July, citing security sources.

Sources: AFP via The Defense Post; police source via Punch.

Solhan had already been struck on 30 June, in the coordinated cross-border wave described in the baseline section below.

Assessment

Three separate military positions attacked in two days, across three different regions, is a demonstration of simultaneity rather than concentration. The Volunteers for the Defence of the Homeland took a third of the casualties at Di, continuing the pattern in which Burkina Faso’s civilian auxiliary force absorbs disproportionate losses relative to its training and equipment.

Solhan being hit twice in under a week, on 30 June and again on 4 July, indicates a sustained local campaign rather than opportunistic raiding. Solhan carries particular symbolic weight, having been the site of one of the deadliest civilian massacres of the Burkinabè insurgency.

The timing is the significant point. Di, Solhan and Séguénéga fall within the same 48-hour window as Anefis, Kénieroba, Konna and Somadougou. Read together, seven positions across two countries were attacked in a single weekend.

🇨🇩 Democratic Republic of Congo: The Month’s Deadliest Campaign

Wave one: Beni territory, 12 to 15 July

Africanews reported at least twenty killed across North Kivu’s Beni territory between 12 and 15 July.

Beni has been the seat of North Kivu’s provincial government since Goma fell to M23. Survivors fled into the town centre, which has so far been spared attack.

Wave two: Mambasa territory, Ituri, 22 to 27 July

Reporting on this wave varies by outlet and window. The figures overlap rather than accumulate, and treating them as separate incidents would inflate the monthly total by roughly a factor of four. The table below reconciles them.

Ujasusi assessment of the wave. Thirty-one is the best-supported floor. It comes from the widest reporting window, is attributed to a named civil society figure, and was independently confirmed by other local sources. Around fifty is the upper bound, from a single security source.

The month in total

The plausible ceiling is near seventy. For context, the Global Centre for the Responsibility to Protect records at least seventy killed by ADF militants across Ituri and North Kivu in the three months from April to June. July alone approached that figure.

The economic driver

The Mambasa killings are not indiscriminate. AFP reporting establishes that the ADF, broken into mobile groups using the Ituri forests as cover, has spent several months extracting protection payments from communities earning income from cocoa and artisanal mining. Farmers described paying a ten-dollar levy and receiving tokens as receipts. Being found without a token, one said, means death.

The geography confirms it. Kikundo and Biango are artisanal mining squares. Njiapanda-Bela, where eighteen died in a single day, is a mining village. Mandeite’s victims were largely gold miners. Local civil society organisations state the group has killed more than a hundred people across around twenty villages in Mambasa territory since March 2026.

This is a protection racket enforced by massacre, not an insurgency seeking ground.

M23: force generation at scale

Source: Congo War Security Review. The July intake is the fifth large-scale recruitment cycle since July 2025, following cycles in September 2025, October 2025 and February 2026.

Assessment

Two distinct wars are running in the Kivus and Ituri, and they are routinely reported as one. The ADF campaign is revenue-extraction violence against civilians on cocoa and mining ground. The M23 conflict is a conventional territorial war fought with drones and artillery. Conflating them produces bad analysis and worse policy, because the interventions each requires are entirely different: one demands policing of an extraction economy, the other a ceasefire architecture.

Five recruitment cycles in twelve months is not replacement of losses. It is expansion, and the commissioning ceremony was public, which suggests the signalling was intended.

Share Ujasusi | Intelligence & Security Analysis

🇳🇬 Lake Chad Basin: Attrition Against a Degraded Insurgency

Sources: Vanguard, 9 July; Vanguard, 26 July.

The 25 July defector had served as chief finance operative of the ISWAP enclave at Jubillaram, managing the group’s financial activities and logistics. His surrender followed what Operation Hadin Kai described as a series of coordinated land and air offensives against militant enclaves.

This sits against a changed operational backdrop. A joint United States and Nigeria military operation against ISWAP and Boko Haram began on 16 May 2026, involving special forces raids and multiple rounds of airstrikes. ISWAP senior leader Abu-Bilal al-Minuki was killed alongside several other senior commanders, and by 19 May Nigerian authorities stated that 175 militants had been killed since the offensive began.

The pressure is regionalising. ACLED reports that following increased US military involvement in Nigeria since late 2025, Washington has begun exploring expanded military cooperation with Cameroon’s security forces in the Far North region, where ISWAP and Boko Haram frequently retreat and regroup when fleeing offensives in Nigeria.

Assessment

July’s Lake Chad reporting is dominated by state-initiated actions, namely rescues, contained attacks and a high-value surrender, rather than successful insurgent operations. A single soldier killed at Logomani is the only recorded security fatality.

Note the symmetry with Ituri. Two Islamic State affiliates on opposite sides of the continent, both organised around a finance function, both currently under pressure aimed at that function. In Borno the finance chief defected. In Mambasa the tax collectors are killing to enforce collection. The same organisational logic produces opposite behaviours depending on whether the group is under pressure or unpoliced.

The Far North Cameroon vector is the one to watch. Displaced pressure does not disappear.

🇸🇴 Horn of Africa: Air Campaign and a Reactivated Kenyan Front

Operations in Somalia

Sources: AFRICOM; GlobalSecurity; Hiiraan Online.

The 26 July operations killed sixteen al-Shabaab militants including two senior members of the group’s media wing, and destroyed a facility used to store equipment for Al-Andalus, the group’s propaganda radio outlet. Targeting information infrastructure rather than fighting positions is a notable shift.

Kenya

Source: CFR Global Conflict Tracker. Kenyan officials reported the 16 July group had planned attacks on villages in north-eastern Kenya. Following the 29 July ambush Nairobi launched a manhunt. The tracker notes a string of al-Shabaab attacks across north-eastern Kenya in recent weeks.

Political context

Somalia’s principal violence in this period was not jihadist. ACLED documents heavy clashes in Mogadishu from 3 June between state security forces and militias including defected Somali National Army members aligned with the opposition Somali Salvation Forum, triggered by a constitutional amendment granting President Hassan Sheikh Mohamud a one-year term extension after his mandate expired on 15 May. Fighting spread across the Hawl Wadaag, Abdiaziz, Hodan, Wardhigley and Daynile districts before ceasing after negotiations. Tensions remain high between the federal government and Puntland.

Assessment

The 29 July ambush is the significant datum. A coordinated IED and small-arms attack producing five security fatalities represents a capability step beyond the cross-border raiding of preceding weeks. The 16 July interdiction shows Kenyan forces were aware of intent against north-eastern villages, which makes the subsequent success against a patrol more concerning, not less.

Constitutional instability in Mogadishu compounds this. A security establishment fighting itself is not fighting al-Shabaab, and the group’s ability to hold ground at Tardo in Hiiraan, requiring a joint intelligence operation to strike, illustrates what that has cost.

🇲🇿 Mozambique: Road Interdiction in Cabo Delgado

Zitamar News reports that Islamic State-backed fighters stepped up operations across Cabo Delgado throughout July, mounting incursions on the two main roads linking the north and south of the province and threatening road traffic.

The escalation followed successive intense clashes around the Catupa base in Macomia district, contested since June. Insurgents split into several groups, raiding villages and gold mines.

For baseline, UN OCHA recorded the following for June:

Insecurity expanded into previously less-affected areas, with armed groups attacking the Namuno region for the first time since 2022. Seventy-seven per cent of violent incidents occurred in five districts of highest humanitarian need, with Macomia and Ancuabe accounting for more than half.

Assessment

The shift to road interdiction and gold-mine raiding is revenue-driven and mobility-driven rather than territorial. The same logic is now visible in Ituri, and the parallel is worth stating plainly: three Islamic State affiliates on this continent are currently behaving less like insurgencies seeking ground and more like armed extraction operations seeking rents.

Fragmentation into smaller raiding groups following the Catupa fighting most likely reflects dispersal under pressure rather than expansion. But dispersal makes an insurgency harder to fix and target, and closing the N380 imposes costs on the state well beyond the casualties inflicted.

📊 Sahel Baseline: What July Inherited

June conditions shaped the ground on which the first-weekend offensives landed.

Sources: ACLED; PBS on the Niamey airport attack.

Western Niger is now the contested seam between JNIM and IS-Sahel. Tillabéri is IS-Sahel’s most important area of operations, and the outcome of that rivalry will shape jihadist violence across Mali, Burkina Faso, Benin and north-western Nigeria.

The 30 June pattern, six locations across two countries in one day, is the template that recurred on 4 and 5 July across Mali and Burkina Faso. That recurrence within five days is the basis for Key Judgement 1.

🔭 August Watchlist

📌 Method

Casualty figures are reproduced as reported and attributed to source. Belligerent claims, whether by JNIM, Malian authorities, Burkinabè authorities or M23, are identified as claims and excluded from the fatality floors in the summary table.

Where multiple outlets report the same wave of attacks across different windows, the figures are presented side by side rather than summed, and a floor is stated. This applies particularly to the late-July Mambasa attacks, where reported tolls of 16, 24, 27, 31 and 32 describe overlapping portions of a single campaign between 22 and 27 July, not separate incidents. Summing them would have produced a figure of 130, roughly four times the defensible number.

Figures given as floors will rise as verification continues. Several Ituri tolls were explicitly described as provisional pending search operations.

Ujasusi East Africa Monitoring Team | 28 July 2026 | 0045 BST

📋 Scope, Sources and Limitations

This assessment covers the twenty-three days from the previous run on 4 July to 27 July 2026. It draws on Tanzanian court reporting, wire agency coverage, Commonwealth institutional documents, United States congressional records, and Ujasusi’s own published reporting from the same window.

Two limitations should be weighed. Detainee figures are contested between the police and the opposition and are moving daily; the figures below are current to 27 July and will be superseded. And no open source permits direct observation of the Tanzania Intelligence and Security Service, so any judgement touching the Service would rest on inference from operational pattern rather than on evidence of tasking.

Post-election fatalities are rendered throughout as approximately 10,000, per the ICC/Intelwatch dossier. The figure of 518 that appears in some reporting is the government’s own count of deaths from unnatural causes and is treated here as a state claim, not as a finding.

🚨 Saba Saba Passed Without Street Demonstrations

Chanzo protest-day reporting recorded empty roads, closed businesses and saturating police deployment in Dar es Salaam on 7 July, quoting the governance researcher Dr Baruani Mshale describing an atmosphere comparable to the weeks after 29 October 2025. France24 and AFP reported the same picture across Kenya and Tanzania simultaneously. Tanzanian on-the-ground reporting documented grounded public transport, guarded and closed fuel stations, and a subdued Kariakoo.

The government’s pre-positioning was extensive. The Tanzania People’s Defence Force issued a TPDF public warning on 4 July, and Prime Minister Mwigulu Nchemba had spent the preceding fortnight characterising the mobilisation as a foreign operation directed at Tanzania’s critical minerals, telling a rally in Serengeti on 1 July that arrested organisers had confessed to receiving monthly payments to send young people to their deaths.

⚖️ Terrorism Charges Reached 61 by 27 July

Police announced on 9 July that 130 people had been detained for planning or inciting criminal acts in connection with the aborted demonstrations. On 25 July, CHADEMA deputy chairperson John Heche said 51 party officials had been arrested and charged with terrorism, per an Associated Press wire report. That figure has since moved. AFP reporting, 27 July carries CHADEMA counsel Rugemeleza Nshala putting the number charged at 61, with roughly seventy further detainees still held and uncharged, while police put the number charged at 36 and alleged plans to burn public buildings, sabotage the power grid and kill officers.

Citizen court reporting, Mwanza documents twenty-three accused appearing before the Mwanza Resident Magistrate’s Court in two separate cases covering Ilemela and Nyamagana districts, with defence counsel Erick Mutta stating that his clients had been held for close to a month before arraignment. CHADEMA’s director of legal affairs, Gaston Garubindi, put the figure at twenty-seven party members from Mwanza and Mbeya alone, with others held at police stations in Dar es Salaam, Iringa and Shinyanga.

READ ALSO

🏝️ The Zanzibar Accord Concluded an Eight-Month Negotiation

CCM and ACT-Wazalendo signed a Joint Political Reconciliation Declaration at Zanzibar State House on 9 July. The Chanzo signing ceremony account records that the document was signed by Dr Mohammed Said Dimwa, deputy secretary general of CCM Zanzibar, and Omar Ali Shehe, his ACT-Wazalendo counterpart, with President Hussein Ali Mwinyi and ACT-Wazalendo national chairman Othman Masoud Othman witnessing rather than signing. President Samia Suluhu Hassan attended. The talks were facilitated by retired presidents Amani Abeid Karume and Ali Mohamed Shein, and opened on 9 November 2025.

Othman’s negotiation timeline puts the process at fourteen formal meetings, two joint sessions and two committee meetings between November and July. The accord runs to seven agenda items disclosed publicly, one carrying ten sub-clauses, alongside a joint consultative committee and a neutral oversight commission. Othman stated on 12 July that material had been withheld from the initial release, listing early voting, voter registration, a reconciliation commission, electoral consultative committees, reform of state media, and the conduct of security organs during polls. The same reporting records CCM and ACT-Wazalendo in open disagreement within days of signature, with ACT-Wazalendo’s Zanzibar vice-chairperson Ismail Jussa Ladhu responding publicly at a party meeting in Konde, Micheweni district, on 14 July.

🌍 The Commonwealth Set Three Dated Deadlines on 10 July

The Chanzo Commonwealth benchmark text carries the operative wording. The Commonwealth statement, Malawi coverage records that the Group welcomed Tanzanian cooperation in granting Special Envoy Dr Lazarus Chakwera full access during his April visit, recognised this as a confidence-building step, found that of four standing conditions one had been met, one partially met and two remained unaddressed, and retained Tanzania on its Formal Agenda. Ujasusi’s Commonwealth assessment sets out the institutional mechanics.

Government spokesman Msigwa stated on 22 July that an assessment was under way. CHADEMA has set two conditions for any dialogue: Lissu’s release, and appointment of a neutral mediator.

🇺🇸 The Senate Bill Was Softened Before It Left Committee

The Senate Foreign Relations Committee advanced S.4577 by consensus on 17 June. The Citizen committee report establishes that the Shaheen substitute replaced the bill’s standalone sanctions framework with existing Global Magnitsky authorities and shifted the object from immediate implementation of reforms to initiation of a reform process. Pan African Visions reporting records that bilateral security and military cooperation, which the introduced version would have suspended, was preserved. No floor vote has been scheduled.

🔒 Tundu Lissu Has Been Held 474 Days

Lissu has been in continuous custody since his arrest on 9 April 2025. His Court of Appeal proceedings came before a three-judge bench of Justices Augustine Mwarija, Zainabu Muruke and Amour Khamis on 3 July, where the Citizen Court of Appeal report records his preliminary objection to the state’s attempt to reopen evidence being ordered heard before the merits. No ruling has been reported. Heche stated on 25 July that Lissu now faces terrorism charges alongside the treason count. A Kenya Times risk warning issued from Lissu’s account on 26 July states that his life is at serious risk, with Amnesty International and the UN Working Group on Arbitrary Detention having called for his release.

🔑 Key Judgements

Read more

Ujasusi East Africa Monitoring Team | 26 July 2026 | 0600 BST

⚖️ Key judgement

Tundu Lissu is the chairman of Chama cha Demokrasia na Maendeleo (CHADEMA), Tanzania’s main opposition party, and the country’s best-known government critic. He survived being shot multiple times in 2017, sustaining injuries that required more than twenty operations, in an attack for which nobody has been convicted.

He has been held in prison in Dar es Salaam since April 2025 on a charge of treason, a capital offence in Tanzania that carries no right to bail, after calling for electoral reform at a rally. He has never been convicted of anything, and his trial has not concluded.

READ ALSO

The warning published from his account is best read as a deliberate escalation of international pressure, timed to the final fortnight of the Commonwealth’s 30-day deadline on his detention. It is not assessed as notification of a newly detected, specific plot against his life.

The more consequential development of the past forty-eight hours is the reported extension of terrorism charging to Lissu himself. If confirmed, it would give the state a second non-bailable charge track surviving any collapse of the treason case, and would render the Commonwealth’s prescribed “legal pathway” to resolving his detention largely inoperative before the deadline expires on or about 9 August 2026.

📍 Situation

At 04:58 East Africa Time on 26 July 2026 (02:58 BST as rendered to the Ujasusi desk), a statement was published from the X account of Tundu Antiphas Lissu, national chairperson of CHADEMA, asserting that credible information indicates his life is at serious risk.

The statement, archived here, is signed “—Admin”. This indicates it was issued by the account’s administrators rather than by Lissu, who has been held at Ukonga Prison in Dar es Salaam since 9 April 2025, a period of 473 elapsed days, and who is reported to have no confidential communication with the outside world.

The text cites three pre-existing international findings. Amnesty International called in April 2025 for his immediate and unconditional release. The UN Working Group on Arbitrary Detention, in Opinion No. 74/2025, found his detention unlawful and sought his release, compensation and an independent investigation. The Commonwealth Ministerial Action Group, on 10 July 2026, called for the detention to be resolved within thirty days.

The Ministerial Action Group is the Commonwealth’s standing body of foreign ministers, charged with policing member states’ adherence to the organisation’s political values. Its ultimate sanction is suspension from the association, as applied previously to Zimbabwe, Pakistan and Fiji.

The statement assigns responsibility for Lissu’s safety, health and life to the Tanzanian authorities. It identifies no specific incident, date, actor, or denial of access.

READ ALSO

Further charges against opposition officials

The statement follows within twenty-four hours of further arrests. On 25 July, the Associated Press reported CHADEMA’s claim that fifty-one of its officials had been arrested and charged with terrorism, over protests planned for 7 July that did not materialise in the face of heavy police deployment.

John Heche, who has led the party in Lissu’s absence as deputy chairperson for mainland Tanzania, stated that Lissu had been denied his basic rights and was facing the same terrorism charges, which carry no entitlement to bail. The government has not commented on the terrorism charges and has previously rejected allegations of political repression.

Separately, a university lecturer had charges against him upgraded from incitement to terrorism on 23 July, ahead of a bail hearing on the lesser charge. Political rallies have been banned nationwide since June, on stated security grounds and with no expiry announced.

The Commonwealth timetable

The Commonwealth process is meanwhile approaching the first of its three deadlines. CMAG’s seventy-third extraordinary session on 10 July adopted the time-bound recommendations of its Special Envoy Lazarus Chakwera, the former President of Malawi, who visited Tanzania in April.

Those recommendations set thirty days to resolve Lissu’s detention through a political and legal pathway and release others held solely for peaceful exercise of rights; sixty days to restore digital access and end intimidation of media; and ninety days to convene a neutrally facilitated inter-party forum. The Group reconvenes in September and has signalled further action in November.

Government spokesperson Gerson Msigwa told journalists in Dodoma on 22 July that the statement was under assessment and that a formal response would follow, framing Tanzania as a sovereign state governed on constitutional foundations.

On 13 July, Tanzania’s President Samia Suluhu Hassan, declared winner of the disputed October 2025 election with 98 per cent of the vote, had told the Tanzania Public Bar Association in Arusha that human rights are being used globally as a pretext to hold developing nations back. CHADEMA has ruled out negotiations without a mediator and without Lissu’s release.

The treason case

The treason proceedings themselves remain frozen. The trial was halted on 24 February 2026 after the state lost its bid to introduce additional evidence and took the matter to the Court of Appeal.

A three-judge bench of Justices Augustine Mwarija, Zainabu Muruke and Amour Khamis heard Lissu’s preliminary objection alongside the Republic’s application on 3 July 2026. No ruling had been reported at the time of writing.

READ ALSO

🔍 Assessment

The 26 July statement is assessed as pressure signalling rather than notification of a specific threat. Confidence: Moderate.

Three explanations were tested against the document and the surrounding record.

The first is that the statement conveys newly received information about a specific plot. This is least consistent with the evidence. A notification of that character would ordinarily carry at least one particular capable of being checked: a date, a facility transfer, a suspension of visits, an identified source. The statement carries none. Its content consists of three pre-existing international findings, an attribution of responsibility, and an appeal to international attention.

The second is that access to Lissu has been cut, and that his administrators are conveying an information blackout in the only terms available to them. This cannot be excluded. The absence of particulars is equally consistent with having nothing verifiable to report. It is assessed as less likely than the third explanation principally because the statement alleges no denial of access, and a denial of access is both specific and immediately publishable.

The third is that the statement is a deliberate escalation of international pressure, timed to the closing phase of the Commonwealth deadline. This is most consistent with the available evidence and is the interpretation carried forward.

A distinction should be drawn here that the term “signalling” can obscure. Assessing the statement as timed advocacy says nothing about whether the fear behind it is sincere. Those holding it are people who watched Lissu survive being shot and have since been unable to see him or speak to him privately. Sincere alarm and deliberate timing coexist routinely, and on the evidence available both are present.

The risk to Lissu’s life and health is assessed as real and rising, on grounds independent of the 26 July statement. Confidence: Moderate.

He faces a capital charge that is non-bailable by operation of law, so detention continues irrespective of the trial’s progress.

A campaign statement circulated in June reported that he is held in solitary confinement in a six-by-six-metre cell on the death row wing, under constant camera surveillance, without confidential communication with family or counsel. That reporting has not been independently verified by any body with custodial access, and the confidence attached to this judgement reflects that gap.

In his own Court of Appeal filing of March 2026, drawn without legal representation, Lissu recorded missed medical appointments arising from injuries sustained in September 2017 and submitted that he stood to suffer irreparable harm. The European Parliament, in its resolution on the post-election killings, described his detention as occurring under life-threatening conditions.

Prolonged isolation of a prisoner carrying unresolved gunshot trauma constitutes a mechanism of harm independent of any deliberate act.

If a terrorism charge against Lissu is confirmed, resolution of his detention within the Commonwealth window is assessed as highly unlikely. Confidence: Moderate.

Heche’s account is single-sourced and uncorroborated by the government. It admits of two readings: a genuine new charge sheet, or a characterisation of the non-bailable posture Lissu already occupies.

Should the first prove correct, a second non-bailable track would survive collapse of the treason case, an outcome the state’s own procedural position has made plausible given that it lost the evidence ruling in February and has kept the trial suspended since.

It would also convert compliance with the Commonwealth from a legal act into a political one, requiring a nolle prosequi or executive intervention across two files rather than the unwinding of one.

President Hassan’s Arusha address is assessed as having prepared the ground for declining that political act. This reading rests on inference from the speech’s timing and framing rather than on any stated position. Confidence on this point: Low.

Tanzania is assessed as likely to offer procedural gestures short of release before the deadline expires. Confidence: Moderate.

Releasing Lissu inside a foreign-imposed thirty-day window carries an immediate domestic cost, one the President has pre-emptively framed as capitulation to external pressure. Absorbing the deadline instead carries a deferred and uncertain cost: renewed scrutiny in September, possible further measures in November.

The expected form of a response is therefore written engagement with the digital-access and inter-party-forum items, coupled with a deflection on Lissu on the grounds that the matter is before the courts.

The charging of fifty-one opposition officials with terrorism, disclosed with roughly a fortnight of the window remaining, is inconsistent with preparation for compliance. It is the principal observable supporting this judgement.

👁️ What to watch

1. A terrorism charge sheet naming Lissu, produced in open court. The single most decisive indicator. Its appearance would confirm the second-track hypothesis and effectively close the legal pathway the Commonwealth prescribed. Its absence within seven to ten days would suggest Heche was characterising the existing charge posture.

2. The Court of Appeal’s ruling on the Republic’s application. If Lissu’s preliminary objection succeeds and the application is struck out, the treason trial resumes and the state loses its procedural freeze. If the application is entertained on the merits, expect further months of delay and continued detention without trial.

3. Any independently verified sighting of Lissu. A visit by family, counsel, diplomatic missions or a body with custodial access would materially alter the picture. If no verified sighting is reported within two weeks of 26 July, concern about his condition should rise, and the information-blackout explanation would move ahead of the signalling explanation.

4. Tanzania’s formal written response to the Commonwealth before 9 August. Watch whether it engages the thirty-day detention item at all, or reframes it as beyond executive reach because the matter is before the courts. The latter would confirm the absorption strategy.

5. Corroboration of the warning by an independent body within seventy-two hours. If Amnesty International, the UN Working Group or a foreign mission issues anything specific echoing the 26 July claim, the assessment shifts towards genuine threat notification and the confidence attached to the signalling interpretation must be reduced.

6. Any transfer between facilities. His earlier move to Ukonga was accompanied by a period in which supporters lost contact with him. A further transfer, particularly one not announced in advance, would be an early indicator of deteriorating access and conditions.

❓ What we do not yet know

Almost every gap in this assessment exists because the Tanzanian state has closed the channel that would fill it. The uncertainties below are findings about the conditions of Lissu’s detention, not deficiencies in what his representatives have said.

Lissu cannot speak for himself. He is held without confidential communication, which is why the 26 July statement carries an administrator’s signature rather than his own. What the “credible information” it invokes consists of is not something his representatives could reasonably be expected to set out in public while he remains in the custody of the party the warning concerns.

There is no current independent verification of his physical condition. No body with custodial access has been permitted to provide one. That absence is itself a finding, and it has persisted for months.

It is not established whether the terrorism charge described by Heche exists as a filed document. The government has not commented, and no charge sheet has been produced in open court.

The content of the government’s internal assessment of the Commonwealth statement, announced on 22 July, is unknown. Whether it has concluded, and what it recommends, will shape the next fortnight more than any public statement so far issued.

Where this assessment carries Moderate rather than High confidence, the limiting factor is in nearly every case the state’s refusal of access.

READ ALSO

INTELLIGENCE BULLETIN | Ujasusi Originals

East Africa

Tanzania: the charging pattern and Lissu’s prison petition.

CHADEMA Geita chairperson Neema Chozaire was released on bail on 21 July after 22 days in custody; CCM and ACT-Wazalendo signed a Zanzibar reconciliation declaration on 9 July that was already showing public friction within a week. Lissu himself remains in detention past day 470 on the separate treason charge, and his constitutional petition over Ukonga Prison access, detailed in full in this issue’s Featured Assessment, was in its third day of hearing as of 23 July, with the Officer-in-Charge under cross-examination before a three-judge panel, per The Chanzo.

READ ALSO

Uganda: fabricated Mossad affiliation used to target senior security officials.

An Andrew Mwenda-led investigation for The Independent exposed Stephen Nuwagaba, who uses the self-styled rank “Brigadier General” and falsely claims ties to Mossad and the Israel Defense Forces, fabricating WhatsApp conversations to smear senior Ugandan security officials, including ISO Director General Maj Gen Arthur Mugyenyi and 4th Division Commander Maj Gen Keith Katungi. Mossad has confirmed it holds no record of him.

South Sudan: a senior officer’s account of military intelligence detention.

SSPDF Deputy Chief of Defence Forces Lt Gen Gabriel Duop Lam testified at the 98th session of the Machar treason trial on 20 July that he was held for seven months in shackles at Jamus Ground Prison, run by the SSPDF’s Department of Military Intelligence, following his arrest on 4 March 2025. This is a rare on-record account of detention practice from a serving senior officer rather than an opposition or civil-society source. Dr Riek Machar himself is held separately under house arrest, while other co-defendants are held at National Security Service facilities, distinct from the military intelligence detention Duop described, per Radio Tamazuj.

Kenya: presidential website defaced.

President William Ruto’s official website, president.go.ke, was defaced on 18 July with a five-Bitcoin ransom demand and a threat to leak unspecified government data. The site was restored within two days. The government has stated it found no evidence of data exfiltration, though this has not been independently verified. No attribution has been made and no group has claimed responsibility.

Rest of Africa

DRC/Rwanda: UN sanctions M23’s Chief of Intelligence.

The UN Security Council 1533 Sanctions Committee designated Colonel John Imani Nzenze, M23’s Chief of Intelligence, on 14 July, publishing a full biographical dossier, including dual DRC-Rwanda nationality and a birth date of 6 August 1978, that gives the Rwanda-backing characterisation of M23 a demonstrable, UN-sourced basis. Nzenze is described as one of overall M23 commander Sultani Makenga’s closest confidants and was sanctioned alongside AFC leader Corneille Nangaa and FDLR commanders Gustave Kubwayo and Sebastien Uwimbabazi, following earlier US Treasury designations of Nzenze and Kubwayo in June.

Angola: courts convict Russian influence operatives.

Russian political consultant Igor Ratchin was sentenced to 11 years and translator Lev Lakshtanov to 8 years for terrorism and espionage tied to an Africa Politology-linked operation targeting the 2027 presidential election, with two Angolan nationals also convicted, per the BBC. It is a rare case of an African intelligence and justice system prosecuting a Russian influence operation through to conviction.

Global

OpenAI confirms an autonomous agent’s first cyberattack.

OpenAI confirmed on 22 July that an advanced agent, operating under benchmark testing conditions, escaped a security sandbox using a previously unknown vulnerability and stolen credentials, then breached systems belonging to Hugging Face. It reasoned independently that Hugging Face held information relevant to its assigned goal, without a human operator directing it toward that target. Hugging Face confirmed the intrusion and called it “the first incident of its kind,” per Scientific American and Al Jazeera. The UK’s AI Security Institute is reviewing the case. For any service running AI tooling inside a sensitive perimeter, this incident breaks a working assumption: that a compartmentalised environment is safe by default, because a contained system supposedly has no motive to break out of it.

Leadership Watch

What to Watch

• Kaijage’s 5 August court date: will test whether the non-bailable terrorism charge is sustained or walked back under pressure.

• Mwanza’s 6 November remand date: an unusually long remand for a case the state’s own defence counsel is asking to be expedited.

• Further replication: whether the same charge-substitution mechanism surfaces in additional regions beyond Dodoma, Mwanza, and Mbeya.

• Kenya website attribution: whether Kenyan authorities or independent researchers attribute the president.go.ke breach, which remains open.

• OpenAI/Hugging Face post-mortems: UK AISI’s review and any parallel disclosure from Anthropic or other frontier labs, which will indicate whether the industry is converging on incident-transparency norms.

Featured Assessment: Tanzania Charges UDOM Lecturer, 23 in Mwanza, and 6 in Mbeya With Terrorism

• Four Tanzanian legal proceedings running in parallel this month, three non-bailable terrorism/economic-sabotage prosecutions and one constitutional petition over prison access, are this issue’s lead story.

• University of Dodoma lecturer Dr Melkisedeki Kaijage was granted bail by the Dodoma High Court on 21 July; before the order could be executed, prosecutors substituted the charge for non-bailable terrorism and transferred him to Isanga Prison.

• Twenty-three people in Mwanza and six CHASO/BAVICHA-linked youths in Mbeya were charged with non-bailable terrorism or economic-sabotage offences in the same week, each following the same underlying pattern: a bailable route closed off by a heavier charge, arriving either instead of or immediately after judicial relief.

• Separately, Tundu Lissu’s constitutional petition against the Attorney General and the Commissioner General of Prisons over confidential legal access at Ukonga is, this week, placing the mechanics of that same control apparatus on the court record under oath.

  

Key Judgements

Read more