A Spy’s Guide to Saba Saba Protests: Tanzania Demonstrations Tradecraft
Ujasusi Originals
Tanzania faces nationwide demonstrations on 7 July 2026 under conditions more dangerous than any protest cycle since the October 2025 election. This guide is written on a single premise: the state you are dealing with does not recognise the right to protest, and its October 2025 conduct, which independent and ICC-linked monitoring assesses at approximately 10,000 deaths against a government-commissioned count of 518, is the operating baseline, not an outlier to plan around. What follows is not generic safety advice repackaged with a spy theme. It is the actual tradecraft spies use to survive and operate in hostile territory, translated into what a protester, bystander, or journalist can apply on the ground on 7 July.
👥 Who This Guide Is For
This guide is written for three overlapping groups: people planning to attend the 7 July demonstrations, bystanders who may find themselves near one without having planned to be, and journalists or documentarians covering the day. Not every section applies equally to each group. If you are attending deliberately, read all of it. If you expect only to be nearby, the sections on crowd reading, avoiding being taken, and digital hygiene matter most. If you are documenting the day for reporting purposes, pay particular attention to the sections on documentation, compartmentalisation, and dead man’s switches, since your material has evidentiary value the state has a direct interest in suppressing.
READ ALSO
✅ Quick Start Checklist
This is a working summary. It does not replace the detail below, but it is what to review in the last hour before you leave home.
Before you leave:
Agree a check-in time, a signal site phrase, and a duress code with one trusted contact, not a group.
Set any dead man’s switch to trigger on a fixed time, hosted by a contact outside Tanzania, not on a missed message alone.
Disable lock-screen notifications and set a passcode, not biometric unlock.
Remove political symbols, branded items, and anything with your name on it from what you carry.
Know your legend: where you are coming from, where you are going, and why, and be able to explain everything in your possession accordingly.
On route:
Take a route with at least two unnecessary changes of direction and one stop where you can observe who follows you in.
Identify your safe haven and the route to it before you need it.
At the crowd:
Position yourself nearer your exit than the centre.
Watch for staged vehicles, repeated faces at unrelated points, and camera crews suddenly repositioning.
Never stand alone at the margins.
On exit and after:
Leave at the earliest indicator of escalation, not the clearest one.
Vary your route home. Do not sleep at your usual address if you were visibly present or vocal online.
Avoid predictable online activity, including posting an “I’m safe” message, for 48 to 72 hours.
READ ALSO
What Risk Environment Does This Guide Respond To?
Three weeks before Saba Saba, Tanzania’s government banned all political rallies nationwide, with Home Affairs Minister Patrobas Katambi citing security concerns tied to the Dar es Salaam International Trade Fair. The ban reversed the tolerance shown to Chadema rallies through May and June, and arrived eleven days before the planned demonstrations.
Katambi followed with a public warning in Dodoma against those using political platforms to incite hatred and violence, urging citizens to ignore anyone mobilising them to commit crimes. Police spokesperson David Misime reinforced this on 20 June, stating that no constitutional right permits demonstrations intended to cause violence, and that police are prepared to respond to security threats. Treat that as a description of intent, not a legal boundary. The October 2025 precedent shows the state’s response extended to live ammunition against demonstrators broadly, alongside a ten-day nationwide internet blackout.
Footage shared by broadcaster Chief Odemba of Star TV, exact date and venue unconfirmed, shows Prime Minister Mwigulu Nchemba alleging that organisers have been paid to send young people into the streets, and have separately paid other individuals to assault those same demonstrators, so the resulting violence appears to be the government’s doing. This tracks Nchemba’s established pattern of attributing unrest to externally orchestrated actors rather than genuine grievance, seen most recently in his 23 May Iringa remarks describing disappearances as “schemes of people with intelligence who are looking for our country.” Whether or not the allegation is true, its function matches a pattern spies are trained to recognise in hostile states generally: pre-positioning a narrative that shifts blame for coming violence onto the people about to be its target.
A fracture has also opened within the anti-Samia movement itself. Rachel Dangwa, a prominent and outspoken voice known for firebrand, often profanity-laced commentary that has drawn both a large following and criticism over its tone, has broken from fellow activists to urge Tanzanians not to take part in the 7 July protests. Her stated reasoning centres on a prior attempt to fundraise for two victims of the 29 October violence, an effort she says fellow activists declined to support. She maintains her anti-Samia position but says she can no longer bring herself to encourage young people into the streets when the same activists pushing for turnout are not present to help those subsequently injured. This split matters analytically: a decentralised movement’s biggest vulnerability is not leadership decapitation but horizontal fracturing, and the government’s messaging apparatus can be expected to weaponise this one to induce hesitation among potential participants.
This rhetoric does not emerge in a vacuum. Since mid-November 2025, police have arrested at least ten activists specifically for online posts connected to protest planning, including Mbeya teacher Clemence Mwandambo, detained on 21 November for circulating “provocative” Facebook and Instagram messages. Several of these were not announced arrests but confirmed only after families reported people missing.
📊 What Do Past Suppression Precedents Show?
The gap between the Chande Commission’s official figure and the independently assessed toll tells you the state’s own accounting understates reality by a wide margin. Plan against the higher figure, not the official one, while recognising that the precise upper number carries less certainty than the documented pattern of live ammunition, blackout, and arrest that produced it.
🧭 What Is the OPSEC Cycle, and How Do You Run It Before Saba Saba?
Every professional spy operation begins with Operational Security, OPSEC, a five-step process for protecting information from an adversary before that adversary can exploit it. Run this cycle yourself, in writing if possible, before 7 July.
Step one: identify your critical information. This is anything that, if known to the state, would let it locate, identify, or target you. Your planned route, your meeting point, your affiliations, the names of people travelling with you, and your home address all qualify.
Step two: analyse the threat. The threat here is confirmed and specific, not hypothetical. It is a state that has used live ammunition against demonstrators, conducted enforced disappearances of activists based on WhatsApp posts, and monitors social media platforms systematically. Assume the threat has the technical capacity to intercept unencrypted communication and the physical capacity to seize individuals without immediate acknowledgment.
Step three: analyse your vulnerabilities. Where does your critical information leak? A group chat with unvetted members, a social media post announcing your attendance, a visible political symbol, an unlocked phone, a predictable daily routine, all of these are vulnerabilities a spy would flag and close before an operation, not after.
Step four: assess the risk. Weigh each vulnerability against the harm if it is exploited. A leaked meeting point risks your safety directly. A visible T-shirt risks selection out of a crowd. Rank these, because you cannot close every vulnerability at once and spies never try to.
Step five: apply countermeasures. This is everything else in this guide. OPSEC is not a single action. It is the discipline of running this cycle continuously, before, during, and after the day.
🎯 What Is a Surveillance Detection Route, and Why Does It Matter Here?
A Surveillance Detection Route, an SDR, is a deliberately structured path spies walk or drive before an operational act, designed not to lose a pursuer but to reveal whether one exists. The technique rests on a simple principle: genuine pedestrians and drivers behave inconsistently, doubling back, changing pace, entering shops without buying, taking a longer route than necessary. Someone conducting surveillance on you cannot replicate that inconsistency without either staying suspiciously close or losing you.
Applied to Saba Saba, an SDR means not walking directly from your home to the protest site. Take a route with at least two unnecessary changes of direction, a stop inside a shop or public building where you can observe who follows you in, and a final approach to the assembly point that differs from the most obvious road. Spies also use reflective surfaces, a shop window, a parked car’s glass, to glance behind without turning around, which reads as natural window-shopping rather than suspicious checking.
If the same face, vehicle, or motorcycle appears at two or more of these unrelated points, that is what spies call a flag: a specific, unmistakable indicator that the same person or asset has appeared in two separate, geographically unconnected locations relevant to you. One flag might be chance. Two flags in a short window is deliberate. Avoid repeating the same SDR on consecutive days if you expect to attend related events across the protest cycle, since repetition itself creates a pattern an observer can learn and exploit. If you detect a flag, abort the movement to your intended destination entirely. Being seen at your actual destination while under surveillance is the single most avoidable outcome an SDR exists to prevent.
🚨 What Does It Mean to Be “Burned,” and What Should You Do?
In tradecraft, being burned means your cover, your purpose, or your identity has been compromised to the opposing side, whether you know precisely how or not. A burned spy does not continue the operation and hope for the best. They abort immediately, using a pre-planned route away from the compromised area, and they do not return to any location connected to the burned identity, home included, until the exposure has been assessed.
Apply this literally on 7 July. If you notice you have been photographed at close range by someone who is clearly documenting individuals rather than the event, if a stranger addresses you by name unexpectedly, or if you spot the same SDR flag twice, treat yourself as burned. Do not attempt to test or confirm whether you are actually burned by lingering, doubling back to check, or asking questions. Spies never confirm exposure before acting; they act on the indicator alone, because the act of testing is itself what gets people caught. Abort your plan for the day, move to your pre-identified safe haven first, assess whether you were followed there, and only return home once you are reasonably confident you were not tracked to it.
🗂️ Why Does Compartmentalisation Matter for Protesters?
Compartmentalisation is the principle that no single person should know more than they operationally need. It is why a spy network survives the arrest of one member: that individual simply cannot betray information they were never given.
For Saba Saba, this means your check-in contact does not need your full route, your affiliations, or who else is attending, only your expected location windows and what to do if you miss a check-in. Your protest-day companions do not need your home address relayed in a group chat. This is precisely why HRW’s documented arrests repeatedly targeted WhatsApp group administrators, a single administrator with visibility into an entire group’s membership and plans is a single point of catastrophic failure.
Close this specific vulnerability directly. If you administer an existing coordination group, transfer admin rights to a diaspora-based or offshore number before 7 July, so that a local phone seizure cannot be used to compel changes to group settings or extraction of the full member list. Where possible, migrate coordination to a platform with default auto-deleting messages, so intercepted or seized devices yield a shrinking, not accumulating, record over time. Flatten your information structure generally. No one node should be able to expose the whole.
READ ALSO
🎭 What Is a Legend, and How Do You Build One for the Day?
A legend is the full, internally consistent cover identity and backstory a spy adopts, distinct from simple cover for status in that it can withstand sustained questioning, not just a glance. Building a workable legend for Saba Saba means more than carrying a shopping bag. It means being able to answer, without hesitation, where you are coming from, where you are going, and why, in a way that matches your appearance, your possessions, and your location at the time you are asked.
Keep it simple and true where possible. A legend built on a real, nearby errand survives scrutiny better than an elaborate fabrication, because spies know the most durable legends require the least invention. A core rule of tradecraft applies directly here: your legend should account for every item you carry. If you are questioned and cannot explain why you have a particular object in your bag, that inconsistency is more damaging than the object itself. Audit what you are carrying against your stated purpose before you leave home, not after you are asked.
A legend will not survive interrogation under duress, and it is not a substitute for the evasion measures elsewhere in this guide. Its function is narrower: raising the threshold of suspicion required before you are treated as a target rather than a bystander.
🎒 What Should You Not Carry?
Consistent with the legend principle above, certain items convert you from an anonymous bystander into a selectable target or a chargeable one, and should be left at home regardless of how useful they might seem:
Political symbols or branded materials, party colours, printed slogans, anything visibly tying you to the protest’s cause.
Any document bearing your name that is not strictly required for the errand your legend describes.
A secondary device containing any of your normal personal data, if you are carrying a clean phone, it must actually be clean.
Anything that could be construed as a weapon, including tools or objects with an innocent everyday use elsewhere but no plausible reason to be in your possession at a demonstration, since this is a documented pretext for reclassifying a detained bystander as a violent actor.
📡 How Do Spies Communicate Without Being Traced, and How Does That Apply Here?
Four techniques matter here: signal sites, brush contacts, duress codes, and dead man’s switches.
A signal site is a pre-agreed, innocuous marker, an object placed in a specific position, a specific emoji sent to a group, that communicates status without transmitting content a monitor could act on. Agree with your check-in contact, before the day, on a specific word or emoji that means “I am safe and clear,” distinct from your normal messaging style, so that even if your phone is later compelled open, a coerced or generic-sounding message does not read as a genuine safety signal to the people relying on it.
A brush contact is a momentary, seemingly incidental physical passing of information between two people who do not appear to know each other, used specifically to avoid the sustained proximity that draws surveillance attention. If you need to pass a phone, a note, or a physical item to another person during a dispersal, a brief, unremarkable pass while walking past each other in opposite directions is lower-risk than stopping together to exchange it.
A duress code is a pre-agreed word or phrase that means “I am being coerced,” distinct from your normal communication, so that if you are forced to contact someone under compulsion, they know the message cannot be trusted. Agree one with your check-in contact now.
A dead man’s switch is a pre-arranged action that triggers automatically if you fail to intervene. Two operational details matter given Tanzania’s specific precedent. First, the trigger should be strictly time-based, a fixed check-in deadline, rather than dependent on the absence of a specific message, since a time-based trigger is far harder to manipulate under duress than one that can be satisfied by a coerced text. Second, and critically, given the confirmed ten-day internet blackout in October 2025, the switch must be hosted and monitored by a contact physically outside Tanzania, in the diaspora or at an international human rights organisation. If the domestic network is cut entirely, a local phone cannot ping a server or confirm a check-in either way, and an in-country-hosted switch fails silently at exactly the moment it is needed most. An externally hosted switch triggers correctly regardless of what happens to Tanzania’s internet gateway that day.
📵 What Should You Do If Communications Are Cut?
Plan for a repeat of the October 2025 blackout as the default scenario, not the worst case. Digital coordination and digital dead man’s switches cannot function if the network is down, so build a parallel, offline plan before 7 July:
Agree a physical rendezvous window with your contacts in advance, a specific time and place to regroup or confirm safety in person if messaging fails, rather than assuming you will simply reconnect once service returns.
Confirm your safe haven’s location by memory, not by saved map data, since a phone with no signal is still a phone that can be searched if seized, and a saved address is a liability either way.
Run your SDR using only observation, not apps or location sharing. The technique described above works entirely without connectivity. Do not treat a blackout as removing your ability to detect surveillance, only your ability to communicate about it in real time.
👁️ How Should You Read a Crowd Using Counter-Surveillance Method?
Spies use the ABC method to identify surveillance: Awareness of the environment, Blending into it while remaining alert, and Cover for status if challenged. Applied here:
Establish at least two independent exit routes that do not funnel through a single chokepoint. State forces in both the October and December precedents concentrated blocking manoeuvres at main junctions.
Note where security vehicles are staged, not just where officers are standing. Staged vehicles indicate planned dispersal routes and likely seizure points.
Watch for the same specific individuals appearing at unrelated points around the crowd’s perimeter over time, the crowd-level equivalent of an SDR flag.
Watch for sudden, coordinated repositioning of camera crews or journalists away from a specific area. In multiple African crowd-control contexts, media repositioning has preceded a security response, since crews with their own sources or observers often move before the crowd itself is aware of what is coming.
A sudden influx of unfamiliar, aggressive individuals mixing into an otherwise calm gathering is the most consistent precursor to violence in the precedents above, and matches the false-flag pattern Nchemba himself described, regardless of who is actually orchestrating it. Do not wait for confirmation that the crowd has turned violent before leaving. In a state whose documented response to protest is lethal force, the correct decision point is the earliest indicator, not the clearest one.
📱 What Digital Hygiene Actually Protects You?
Given confirmed monitoring of WhatsApp groups, TikTok, and other platforms since November 2025, assume any unencrypted communication is visible to the state, and that visibility can translate directly into being physically targeted.
Carry a secondary, minimal-data device for the day itself if possible, the civilian equivalent of a spy’s clean phone, containing none of your normal contacts, photos, or app history.
Use end-to-end encrypted messaging for coordination, and avoid naming specific meeting points in any group larger than a handful of trusted contacts. Group infiltration, not just interception, has preceded confirmed arrests in this cycle.
Enable a passcode lock rather than biometric unlock. Fingerprint or facial unlock can be compelled by anyone who has physically seized you, uniformed or not, in ways a memorised passcode cannot.
Disable lock-screen notifications entirely. A passcode protects the contents of your phone, but a visible notification banner can still display a contact’s name, a group name, or a message preview to anyone who glances at a locked screen in your hand or on a table, leaking exactly the information the passcode was meant to protect.
Do not post real-time location, even to a private group. Share your status only after you have safely left the area, using your pre-agreed signal site language rather than a plain description, and avoid it entirely for 48 to 72 hours afterward if you were visibly present, since a public “I’m safe” post creates a predictable window and confirms your location pattern to anyone monitoring your account.
📸 How Do You Document Abuses Safely?
Evidence from Saba Saba could feed the same ICC dossier process already handling the October 2025 violence. Film in short segments with visible timestamps rather than long continuous takes, avoid filming your own face or voice unless you intend to be identified as a witness, and note location markers verbally or visually rather than relying on metadata alone, since metadata can be stripped or altered in transit.
Preserve original files unedited and back them up to a location not tied to your primary device before the day ends. Avoid cloud backup services linked to your personal identity, your named email, your registered phone number, since a compelled login is as effective as a compelled device search. Where possible, use anonymous upload channels or drop points maintained by human rights organisations or newsrooms specifically for this purpose, so the material’s existence is not traceable back to your identity even if your device is later seized. Treat your footage the way a spy treats collected material: assume the device holding it may be seized, and ensure the information survives that seizure regardless. A dead man’s switch, described above, is the natural complement here: footage set to auto-release if you do not check in externally is footage the state cannot suppress by seizing you.
🕳️ How Do You Avoid Being Taken at All?
This is escape and evasion, the discipline spies use to avoid capture in hostile territory, and it is the priority here, not a contingency. The documented pattern from November and December 2025 is opportunistic seizure of anyone who becomes isolated, identifiable, or conspicuous, frequently by individuals who never identify themselves as police, in a state whose October 2025 baseline killed by conservative count 518 people and by independent assessment approximately 10,000. Work on the assumption that a seizure carries lethal or indefinite risk, not a chargeable one.
Never be alone at the margins of a crowd. Every confirmed abduction in the documented record involved someone isolated: at home, travelling alone, or working alone in a hotel room. Move with at least one other person at all times, including arrival and departure, when isolation risk peaks.
Identify your safe haven before you need it. A safe haven is a pre-identified location you can reach quickly that offers genuine refuge, not just distance, a relative’s home off the main protest corridor, a business with a back exit, anywhere you have a legitimate reason to be and that isn’t obviously connected to you politically.
Treat your exit as more important than your position in the crowd. Position yourself nearer your planned exit than the centre, and move toward it at the first sign of escalation rather than waiting to confirm the threat.
Minimise identifiers before you leave home, the grey man principle: nothing about your appearance should make you memorable to someone scanning a crowd for targets.
Vary your route home and avoid predictable movement for 48 to 72 hours afterward. Several confirmed abductions occurred at the target’s home, days after online activity had already flagged them, not at the protest site itself. Do not sleep at your usual address on the night of the 7th if you were visible during the day, and avoid predictable online activity, including a public “I’m safe” announcement, during that window.
Use your signal site, duress code, and externally hosted dead man’s switch as agreed. If you miss your check-in, your contact escalates immediately: the Legal and Human Rights Centre, an opposition structure if you’re affiliated with one, and at least one outlet with an international audience, Ujasusi included. Silence protects the state’s capacity to deny holding someone, or worse, to deny it ever happened. Visibility is the only available counter.
If you are approached despite all of this, do not go quietly if you can avoid it. Say your name and location aloud for anyone nearby to hear or record. This converts an unwitnessed disappearance into a documented one, the only lever available once contact has occurred.
Assume no phone call, no stated charge, and no lawyer at the point of contact, and assume formal acknowledgment of custody may never come through official channels at all. Family and contacts should treat the first 24 to 48 hours as the highest-leverage window for making a disappearance visible and costly to deny.
🛑 The Red Lines: When to Abort Instantly
Three indicators require immediate abort, no further assessment, no attempt to confirm:
Two flags. The same face, motorcycle, or vehicle appearing at two geographically unrelated points on your route.
Close-range documentation. An unidentified individual systematically photographing your face or specific identifiers rather than the event generally.
Chokepoint saturation. Your primary and secondary exit routes both blocked by staged security assets before the crowd has even peaked.
Any one of these means leave immediately, using your pre-planned exit, toward your pre-identified safe haven. Do not wait for a second confirming indicator.
🔮 What Does the Rally Ban Signal About July 7?
A blanket ban imposed this far ahead of a symbolically loaded protest date reflects a government that judges its own capacity to manage a demonstration without repeating October’s lethality as insufficient, and prefers to prevent assembly outright rather than risk that outcome before an international audience now attaching sanctions legislation and aid freezes to its conduct. Read alongside Nchemba’s false-flag allegation, the state is pre-positioning a narrative that shifts blame for any violence onto organisers before the day occurs.
The Dangwa fracture adds a second pressure point the state did not need to manufacture. A decentralised movement is harder to decapitate through coordinator arrests, but more exposed to a credible internal voice publicly withdrawing support days before the event. Whether or not her reasoning was independently arrived at, its effect on turnout calculations is the same.
The most probable outcome on 7 July is a repeat of the December 9 pattern, pre-emptive arrests and disappearances, heavy security saturation, and possible communications restrictions, against a movement more distributed and less centrally organised than in December. That structure is harder to fully suppress through leadership arrests, but harder to coordinate safely at scale, and it offers no protection against a state that has already shown willingness to use lethal force well beyond proportionate crowd control. Treat the days immediately after the 7th, not just the day itself, as part of the risk window, since disappearances in both prior precedents continued for days following the triggering events.
No advertisers. No corporate backers. Just you. Ujasusi is 100% reader-supported. Keep our journalism independent. [Support Ujasusi Here]