UJASUSI INTELLIGENCE BRIEF — 25 JUNE 2026
DAILY OSINT BRIEFING | 25 JUNE 2026 | 0050 BST
TOP STORY
Tanzania: Saba Saba crackdown preparations converge with EU pressure and ICC accountability track
The Tanzanian government has publicly vowed an unprecedented crackdown against planned Saba Saba Day demonstrations on 7 July. The European Parliament has escalated institutional pressure through two successive votes: a 539–0 full plenary resolution adopted on 27 November 2025 condemning the post-election violence, followed by a second full plenary resolution on 18 June 2026, adopted by show of hands — demanding the European Commission withdraw its proposed €156 million (~$179 million) annual action plan for Tanzania. The June vote came after the Parliament’s Foreign Affairs and Development committees had already blocked the same proposal by 81 votes to 1 with 4 abstentions on 3 June 2026.
Accountability for the October 2025 crackdown is entering a potentially decisive phase. The government’s own Chande Commission documented 518 confirmed deaths in its April 2026 report but produced no security force accountability. Human Rights Watch called it a missed opportunity, noting that President Hassan deflected responsibility by ordering an inquiry into protest organisation rather than into state killings. Civil society organisations are now assembling perpetrator dossiers, including material naming President Hassan and her son, for potential ICC referral, while Washington has moved to individually sanction a senior Tanzanian police official. The gap between the commission’s 518 figure and the approximately 10,000 fatalities documented in the ICC/Intelwatch dossier remains the central evidentiary dispute.
Security services have confirmed the arrests of at least ten activists since mid-November 2025 for online posts linked to protest planning, with digital surveillance now the primary counter-protest tool. The combination of pre-emptive detention, documented live-fire responses, and the 7 July date creates conditions for violent escalation in the coming weeks.
EAST AFRICA WATCH
Uganda blocks Kenyan opposition lawyer — cross-border repression flagged
Kenyan Senior Counsel Martha Karua, leader of the People’s Liberation Party, was detained at Entebbe International Airport on 22 June and deported to Kenya after Ugandan immigration authorities confiscated her phones and denied her entry. She had travelled to attend a bail hearing for lead defence counsel Erias Lukwago, who himself faces misprision of treason charges and who co-leads the legal team representing imprisoned Ugandan opposition figure Kizza Besigye. Uganda’s Chief of Defence Forces personally claimed responsibility for the deportation, declaring Karua permanently banned from the country. Amnesty International condemned the incident as part of a long and disturbing pattern of harassment targeting Besigye’s legal team. The episode fits a documented regional pattern that includes Tanzanian surveillance of diaspora activists and Rwanda’s cross-border operations against political opponents.
Somalia: AFRICOM strike near Kismayo; AUSSOM funding crisis threatens mission viability
US Africa Command, coordinating with the Federal Government of Somalia, conducted an airstrike on 19 June targeting Al-Shabaab near Welmaro, approximately 103 km north of Kismayo. The strike occurred against a backdrop of acute institutional strain. AUSSOM, the AU mission that replaced ATMIS in January 2025, has 11,826 authorised uniformed personnel from Uganda, Ethiopia, Djibouti, Kenya, and Egypt — plus police contributors from Nigeria and Sierra Leone — but the US rejection of an AU funding request puts the mission’s sustainability in doubt. If US financing is withheld, Al-Shabaab gains strategic breathing space at the same moment the group is demonstrating renewed offensive capacity. A former Somali intelligence chief has separately warned that the fight against Al-Shabaab has been weakened by mistrust in intelligence sharing between federal and state-level agencies, a structural gap the group continues to exploit. Somalia’s Defence Ministry separately reported that Somali forces and international partners killed at least 54 militants in coordinated airstrikes on 15 April 2026 across Hiran, Lower Shabelle, Bay, and Lower Juba regions.
DRC: Ebola outbreak surpasses 1,094 cases; M23 forced recruitment continues
Confirmed Ebola cases in the Democratic Republic of Congo have surpassed 1,094, including 277 confirmed deaths, driven by the rare Bundibugyo strain for which no approved vaccine or treatment exists. The outbreak has expanded beyond its Ituri Province epicentre to North Kivu (94 confirmed cases from 11 health zones) and South Kivu (three cases from one health zone). WHO declared a Public Health Emergency of International Concern on 17 May. The crisis is compounding existing state-community trust deficits in a zone already destabilised by armed group activity. Separately, HRW documented on 10 June that Rwandan military forces and M23 carried out forced recruitment and abusive detention of thousands of combatants and civilians in eastern DRC — including children as young as 12 held at the Rumangabo and Tshanzu training camps in North Kivu — even as peace talks between the DRC government and M23 are expected to resume in Switzerland. Earlier ceasefire provisions, including Rwandan troop withdrawal, remain unimplemented.
Kenya: Ebola facility contempt ruling; Q1 cyber threat surge
Kenya’s Health Minister Aden Duale was found guilty of contempt of court on 22 June for continuing construction of a US-funded Ebola quarantine facility in Nanyuki despite a court injunction. Protests against the facility resulted in three deaths. The episode reveals deepening tensions around US health-security infrastructure in East Africa and the political liability of perceived foreign-aligned government projects. On the cyber front, Kenya’s Communications Authority reported 3.37 billion cyber threat events in Q1 2026, with brute-force attacks accounting for 46.4 million incidents — part of a threat profile dominated by system attacks at 96% of total volume.
Ethiopia-Eritrea: relations deteriorating
Seven years after their landmark peace agreement, Ethiopia-Eritrea relations are sliding toward open confrontation. The International Crisis Group has identified the bilateral as one of seven priority African peace and security concerns for 2026, with both countries preparing for the possibility of war over Ethiopia’s pursuit of Red Sea access. A February 2026 ICG briefing warns that a slide toward hostilities would be easy to start and much more difficult to stop.
Gulf of Aden: piracy surge, three attacks in one week
Maritime security authorities reported three attempted vessel boardings northeast of Aden between 15 and 17 June. In one incident, attackers fired an RPG at a tanker approximately 111 nautical miles southeast of Aden. The frequency and brazenness of the attacks signals renewed capability among Somali-linked pirate networks, likely encouraged by the maritime security vacuum created by the Iran-US Hormuz crisis.
Introducing “A Spy’s Guide to Deception” — The First in the Spy Guide Series
Intelligence work is built on deception. Every service that has ever run an agent, mounted a cover operation, or manufactured a false narrative has done so through principles that remain largely invisible to the public. Not because they are secret, but because no one has taken the time to explain them plainly.
AFRICAN INTELLIGENCE AND ESPIONAGE
China’s $2 billion surveillance footprint across Africa
A 2026 investigation by Rest of World found that eleven African countries have collectively spent over $2 billion on Chinese AI-powered surveillance systems, financed by private Chinese banks — a finding corroborated by the UK-based Institute of Development Studies and the African Digital Rights Network. Separately, Chinese companies have, since 1966, constructed at least 186 government buildings on the continent — including 32 military or police installations and 24 presidential residences — a dataset compiled through approximately 2020 that almost certainly understates current exposure. The AU headquarters Huawei data-exfiltration case remains the clearest operational precedent. In June 2026, US authorities disabled 13 fake consulting firm websites linked to Chinese intelligence operations as part of a broader Five Eyes warning about China’s espionage activities. Africa, where Chinese diplomatic, economic, and telecoms infrastructure — Huawei, StarTimes, OVM — is deeply embedded, remains largely outside the Five Eyes protected intelligence perimeter.
Five Eyes warning: China targeting security professionals via LinkedIn
The US and Five Eyes partners issued a joint bulletin on 3 June 2026 — described by officials as an unprecedented coordinated public warning — that China’s military intelligence services are using LinkedIn and professional job platforms to elicit classified or sensitive information from military officers, intelligence personnel, and others. Operatives pose as recruiters for fake consulting firms and commission trial reports on sensitive topics before escalating contact to encrypted channels. The Washington Post reported the warning has direct relevance to African states that partner with Western defence and intelligence structures.
India-Ethiopia intelligence cooperation formalised at BRICS margins
India’s National Security Advisor Ajit Doval met with Million Lema Tadesse, Executive Director of Analysis at Ethiopia’s National Intelligence and Security Service, on 22 June on the sidelines of the 16th BRICS NSAs Meeting. Both sides discussed deepening the India-Ethiopia Strategic Partnership through intelligence cooperation. The engagement signals India’s expanding security footprint in the Horn of Africa at a moment when Ethiopia is a contested theatre for the US, China, Turkey, and Gulf states.
Uganda-Rwanda intelligence rivalry: information operations in the Great Lakes
Reporting from The Standard (Nairobi) reveals that Uganda’s Chieftaincy of Military Intelligence has been running proxy blogs and fabricated narratives to undermine Rwanda, apparently to deflect scrutiny of Kampala’s relationship with the Rwanda National Congress, a designated terrorist organisation in Kigali. The episode demonstrates how inter-state intelligence competition in the Great Lakes increasingly runs through information operations rather than direct confrontation.
Africa cyber threat landscape: 24% surge, March–May 2026
A Barracuda Networks analysis documents a 24% increase in cyber incidents across Africa between March and May 2026 — from 186 incidents in March, rising to 239 in April, then settling at 231 in May. The continent recorded 1,335 incidents in 2025, more than double year-over-year. Espionage, credential theft, and fraud incidents remain largely unreported, which distorts the overall threat picture.
GLOBAL INTELLIGENCE (Africa-relevant)
DNI annual threat assessment: Africa jihadist threat is materialising
The 2026 Annual Threat Assessment of the US Intelligence Community, released in March 2026, identified sub-Saharan Africa as the global centre of jihadist expansion and flagged critical mineral wealth as a driver of intensifying external competition. Three months on, the developments documented in this brief — AUSSOM’s funding collapse, Al-Shabaab’s exploitation of inter-agency intelligence gaps, JNIM’s continued mass-casualty operations, IS-CAP’s entrenchment in eastern DRC, and the Gulf of Aden piracy resurgence — constitute a live confirmation of that assessment. The gap between the intelligence community’s published threat picture and Washington’s actual resource commitments to the continent is widening, not narrowing.
JNIM now second-deadliest terrorist group globally
The Global Terrorism Index 2026 ranks JNIM (Jamaat Nusrat Al-Islam wal Muslimeen) as the second-deadliest terror group worldwide, responsible for 147 incidents and 1,274 deaths in 2025 across Mali, Burkina Faso, Niger, and Benin. JNIM’s westward expansion, ISWAP’s northward corridor, and IS-CAP’s exploitation of the DRC security vacuum are creating conditions for multi-theatre deterioration through 2026–2027.
Somalia as new geopolitical battleground: Hormuz spillover
The Iran-US conflict and partial closure of the Strait of Hormuz is intensifying competition over the Bab el-Mandeb. Israel’s recognition of Somaliland in December 2025 and pursuit of a strategic military presence, Turkey’s deep-sea drilling vessels in Mogadishu, and UAE investments in Berbera port are drawing Somalia into a geopolitical rivalry that risks destabilising its already fragile internal security environment, compounded by the Gulf of Aden piracy resurgence documented above.
Aid securitisation reshaping Africa policy
The global trend of governments prioritising geopolitical competition over development cooperation is fundamentally reshaping foreign policy toward Africa. Security-conditioned aid creates leverage points for foreign intelligence services and undermines governance structures in fragile states — a dynamic analysed in depth by Africa at LSE and in a Foreign Affairs assessment of the continent’s response to major donor withdrawal in 2026.
Here is the corrected DNI entry and the closing section, ready to copy-paste:
DNI annual threat assessment: Africa jihadist threat is materialising
The 2026 Annual Threat Assessment of the US Intelligence Community, released in March 2026, identified sub-Saharan Africa as the global centre of jihadist expansion and flagged critical mineral wealth as a driver of intensifying external competition. Three months on, the developments documented in this brief — AUSSOM’s funding collapse, Al-Shabaab’s exploitation of inter-agency intelligence gaps, JNIM’s continued mass-casualty operations, IS-CAP’s entrenchment in eastern DRC, and the Gulf of Aden piracy resurgence — constitute a live confirmation of that assessment. The gap between the intelligence community’s published threat picture and Washington’s actual resource commitments to the continent is widening, not narrowing.
Q3 2026 WATCHLIST
Tanzania’s escalation arc
The pre-Saba Saba crackdown, two successive European Parliament votes targeting €156 million in EU funding, active ICC dossier preparation, and real-time digital surveillance of activists represent the most acute domestic-international pressure the Hassan administration has faced. The documented pattern of pre-emptive arrests and live-fire responses places 7 July at high risk of violent state action. This is the dominant Tanzania story of the coming weeks and warrants a dedicated Ujasusi Blog deep-dive.
Cross-border repression as regional intelligence tool
Uganda’s detention and deportation of Martha Karua — with personal CDF authorisation — combined with Tanzanian surveillance of diaspora activists and Rwanda’s transnational repression operations, points to an East African pattern of security services operating across borders to neutralise political opposition. The CMI-RNC information operations dimension adds a further layer. This is an underreported intelligence and human rights story.
Somalia at the nexus of counterterrorism failure and geopolitical competition.
The AUSSOM funding crisis, Al-Shabaab’s exploitation of inter-agency intelligence mistrust, Hormuz spillover intensifying Bab el-Mandeb competition, and the Gulf of Aden piracy resurgence place Somalia at the intersection of institutional failure and great-power rivalry. A strategic assessment connecting the Horn of Africa to the broader Iran-war fallout would be timely.
China’s embedded intelligence infrastructure
The $2 billion surveillance figure, combined with at least 186 government buildings constructed by Chinese firms including 32 military or police installations, is a documented operational reality. The Five Eyes LinkedIn warning adds an active human intelligence dimension. A deep-dive connecting the AU Huawei precedent to current infrastructure exposure across the continent is overdue.