Executive Summary
One year after Tanzania’s October 2025 election massacres, victims’ families continue to seek answers while the government retains control over the official inquiry process. Approximately 10,000 people were killed. The government-appointed Chande Commission reported at least 518 deaths, but its full report remains unpublished.
The anniversary coincided with renewed scrutiny of the use of terrorism charges against political opponents. At least 64 people among a group of 130 arrested in July were charged under the non-bailable Prevention of Terrorism Act. The cases raise questions about how security agencies collect and interpret information on political activity and how that information is used in prosecutions.
This edition’s subscriber assessment examines an apparent campaign against Vice-President Deogratius Ndejembi on X. It investigates the shift by some accounts from promoting Tanzania-related government activities to circulating hostile claims about him. The assessment considers Samia’s political circle as the principal line of inquiry and business interests potentially affected by Ndejembi’s decisions as a second possibility. Neither has been established as the sponsor.
In Kenya, the High Court ordered officials to produce missing Tanzanian activist Twaha Mwaipaya or account for his alleged detention. The case is a test of whether regional institutions can establish the fate of a political dissident reportedly taken across the border.
Elsewhere, Uganda appointed a new military intelligence chief amid discussions about political succession and engagement with detained opposition figure Kizza Besigye. In Sudan, the RSF-aligned TASIS alliance reportedly appointed an intelligence chief as it builds parallel institutions. Washington also sanctioned Rwanda’s Ministry of Defence and a financial institution over alleged support linked to the Rwanda Defence Force and M23 in eastern Democratic Republic of Congo.
An alleged intrusion at an African Union residence, suspected surveillance of Starlink users and Russian-linked information activity around unrest in France illustrate different forms of intelligence risk. They also demonstrate the need to distinguish evidence of access or amplification from proof of a successful operation.
Key Judgements
Tanzania’s government retains control over the official reckoning with the 2025 massacres, but not over their public memory. The full Chande report remains unavailable, while families, religious leaders and rights organisations continue to demand answers.
A campaign targeting Vice-President Ndejembi shows signs of organised amplification. Some accounts reportedly shifted from promoting Tanzania-related government activities to circulating hostile allegations about him. The sponsor and political purpose remain unconfirmed.
Non-bailable terrorism charges can remove political actors from public life before a court determines their guilt. The cases warrant closer examination of how security information is collected, tested and presented.
Mwaipaya’s disappearance exposes a regional protection gap. The Kenyan court order demands answers but does not establish which actor was responsible or whether he is being held by a state agency.
Uganda’s military intelligence appointment matters in a period of succession uncertainty. There is no evidence that the appointment was made specifically to secure Muhoozi Kainerugaba’s political succession.
Sudan’s reported parallel intelligence service would extend the RSF-aligned alliance’s institutional reach. Its actual capabilities and control over personnel and territory remain unclear.
Foreign intelligence and surveillance activities exposed vulnerabilities across Africa and Europe. An alleged intrusion at an African Union residence, suspected targeting of Starlink users and Russian-linked messaging around the French protests show how physical access and digital platforms can be used for intelligence collection and influence.
READ ALSO
New Book: NYERERE TO SAMIA — The Road to Tanzania’s Post–October 2025 Election Massacres
The killings that followed Tanzania’s 29 October 2025 election demand an explanation that reaches beyond the events themselves. Nyerere to Samia: The Road to Tanzania’s Post–October 2025 Election Massacres traces the institutions, political networks and security practices built across six presidencies—and asks how they made such violence possible.
🇹🇿 Tanzania: One Year After the Massacres
The struggle over remembrance and the official account
On 29 October, Tanzanians marked one year since the disputed 2025 election and the massacres that followed it.
The Tanzania Episcopal Conference called on parishes, prayer centres and Church institutions to hold special Masses for those killed and affected. Catholic churches subsequently held memorial services across the country.
Abubakari Mngodo, deputy secretary-general of Tanzania’s Council of Imams, spoke of the importance of remembrance and called on the government to be truthful about what happened. The British High Commission and US Embassy publicly remembered the victims and acknowledged the families affected.
CHADEMA announced a period of mourning. Widely publicised protests planned for the anniversary did not take place after police banned processions.
The number killed remains contested. Approximately 10,000 people were estimated to have been killed. The government-appointed Chande Commission reported at least 518 deaths. The higher estimate has not been independently verified. The commission’s full report remains unpublished, preventing independent scrutiny of its evidence and methods.
On the anniversary, independent UN human rights experts called for publication of the full report and for independent investigations. They said withholding the findings undermined victims’ rights to truth and justice.
Ujasusi assessment: The government retains control over the official inquiry process, but the anniversary showed that it does not control the public meaning of the killings. The Catholic Church’s nationwide services provided an institutional platform for remembrance, while families and rights organisations continued to challenge the absence of a full public account.
The unreleased Chande report is also an intelligence and security governance issue. Without access to its evidence, the public cannot adequately examine how the commission assessed the role of security institutions, operational orders, responsibility for lethal force or the fate of missing people.
What to watch: Whether the Lila Commission examines the role of security-force leadership, whether families can participate meaningfully, and whether its full findings are published.
Terrorism charges as a tool against political opposition
A human rights investigation published during the anniversary week accused Tanzanian authorities of using counterterrorism laws to restrict civic space.
Police had reported the arrest of 130 people in July over alleged activity intended to destabilise the country. At least 64 of those arrested were subsequently charged under the Prevention of Terrorism Act, an offence for which bail is unavailable.
The investigation said it had verified terrorism charge sheets from different parts of Tanzania. In one case, it documented allegations that detained CHADEMA student members were beaten during interrogation and forced to record confessions and name party leaders as financiers. These remain allegations.
The arrests and charges occurred before this reporting period. The available evidence does not establish that the Tanzania Intelligence and Security Service directed every case.
Ujasusi assessment: Non-bailable terrorism charges can have a political effect before a case reaches trial: accused organisers are removed from public activity, legal defence becomes more difficult and other potential participants may reconsider their involvement.
The intelligence question is how authorities collect and interpret information about political organising, communications and alleged financing—and whether that information is independently tested before serious charges are brought. The available evidence does not establish the complete chain of command behind the cases.
What to watch: The evidence disclosed in court, the treatment of detainees and lawyers, and whether prosecutions identify specific acts supporting the terrorism allegations.
🇰🇪 Kenya–Tanzania: The Mwaipaya Case and the Regional Protection Gap
Kenya’s High Court on 30 October ordered security officials to produce missing Tanzanian activist Twaha Mwaipaya before the Milimani High Court on 2 November, with any detention warrant and an explanation of why he should not be released.
The order followed an urgent application by human rights organisation Vocal Africa. Mwaipaya was reportedly taken in the Kamulu area on 25 October.
The order does not establish that Kenyan police, Tanzanian officials or another respondent seized or detained Mwaipaya. His location, condition and the identities of those responsible for his reported abduction remained unresolved.
Ujasusi assessment: The case exposes the difficulty of protecting political dissidents when an alleged seizure occurs across a national border. It also creates a test for Kenyan institutions: whether police records, detention information and other evidence can establish Mwaipaya’s fate.
The intelligence significance lies in the questions the case raises about monitoring, identification and movement across jurisdictions. Those questions cannot yet be answered by attributing the reported abduction to a particular service.
What to watch: The 2 November court proceedings; any detention warrant or official denial; and whether investigators preserve relevant communications, vehicle and surveillance records.
🇺🇬 Uganda: Military Intelligence, Succession and Political Accommodation
A new defence intelligence chief
The Uganda People’s Defence Forces confirmed that Chief of Defence Forces General Muhoozi Kainerugaba promoted Brigadier Oscar Munanura to acting major general and appointed him Chief of Defence Intelligence and Security.
Munanura had been deputy to the outgoing chief, Major General Richard Otto, who was moved for redeployment.
Military intelligence is central to assessing threats to the armed forces and providing security information to military leadership. A change at its head therefore matters during a period of uncertainty about the future distribution of political and security power.
Muhoozi is both defence chief and President Yoweri Museveni’s son. That relationship gives the appointment wider political relevance, but the available evidence does not establish that it was made specifically to secure a succession.
The reported succession discussion
A discussion paper reportedly circulated within the ruling National Resistance Movement addressed leadership beyond 2031 and calls for Muhoozi to succeed Museveni.
The document reportedly opened a discussion about succession but stopped short of an explicit retirement pledge. Ujasusi has not independently reviewed the paper.
Ujasusi assessment: The reported paper and the military intelligence appointment should be monitored together because both concern institutions that could matter during a future transition. They should not, however, be treated as evidence of a single coordinated succession plan.
What to watch: Further appointments in the military and intelligence services, formal NRM decisions and any public clarification by Museveni or Muhoozi.
Saleh and Besigye: A comparison for Tanzania
Retired General Salim Saleh, Museveni’s brother, has discussed political accommodation and reported contact with detained opposition figure Kizza Besigye. There have also been efforts by government figures to explore a political solution concerning Besigye. The scope and outcome of those discussions remain uncertain.
For Tanzania, the development raises a question: could political engagement eventually offer a route out of the confrontation over detained CHADEMA leader Tundu Lissu?
Ujasusi assessment: A negotiated outcome would require an opening acceptable to both the government and Lissu, as well as a way to address the legal case and wider political dispute. The Ugandan experience is useful as a comparison, but it is not evidence that an equivalent negotiation is under way in Tanzania.
What to watch: Besigye’s legal status, direct statements by the parties and the scheduled 6 November judgment in Lissu’s treason case.
🇷🇼 Rwanda–DRC: Sanctions Reach the Security Establishment
On 28 October, the United States sanctioned Rwanda’s Ministry of Defence and Zigama Credit and Savings Society over alleged support linked to the Rwanda Defence Force and the M23 armed group in eastern Democratic Republic of Congo.
Washington said Zigama operated on behalf of Rwanda’s security services and alleged that the institution facilitated transactions linked to the Rwanda Defence Force, M23 and the Congo River Alliance. The Front for the Refoundation of the Nation had been announced on 12 October as the successor to the Congo River Alliance.
The designations block relevant property under US jurisdiction and generally prohibit transactions involving designated entities by US persons or within US jurisdiction, subject to applicable exemptions and licences.
Ujasusi assessment: The measures reach beyond individual commanders into the institutional and financial infrastructure supporting Rwanda’s security establishment. Their effect will depend on how far the designated entities rely on transactions exposed to US jurisdiction and on how other financial partners respond.
The sanctions also create an intelligence requirement for regional and international actors: to assess whether support networks change their financing arrangements, logistics or partnerships in response. Such adaptation should not be assumed without evidence.
What to watch: Kigali’s response, implementation and exemptions, changes in financial or logistical arrangements, and evidence of any change in support to M23.
🇸🇩 Sudan: RSF-Aligned Alliance Builds a Parallel Intelligence Structure
The Sudanese Founding Alliance, known as TASIS, has reportedly appointed Idris Madallal to head a newly established security and intelligence service.
Madallal is described as a senior Rapid Support Forces figure. The alliance has reportedly established the service’s structure and appointed officers to departments.
Some appointees reportedly served in Sudan’s General Intelligence Service, while others came from the RSF intelligence apparatus. Ujasusi has not independently confirmed the appointments or the organisation’s structure.
Ujasusi assessment: A parallel intelligence service could help the alliance gather information, monitor perceived threats and extend security control in territory under its influence. It may also institutionalise a division between competing authorities claiming the functions of the Sudanese state.
The existence of a reported organisational structure does not establish effective operational capacity. Personnel, funding, command relationships and territorial reach remain unclear.
What to watch: Public confirmation, further appointments, evidence of activity in RSF-held areas and the relationship between the new service and existing RSF intelligence structures.
🇪🇹 African Union–Russia: Alleged Intrusion at an AU Residence
An investigation published on 23 October, followed by further coverage on 26 October, alleged that a Russian military intelligence officer entered an African Union residence in Addis Ababa on 28 April 2025 while AU Commission chair Mahamoud Ali Youssouf was staying there.
The property was described as the official residence of deputy Commission chair Selma Haddadi, but was reportedly being used by Youssouf and his family at the time. The alleged intruder was identified using CCTV images and facial recognition. Ujasusi has not independently authenticated the footage or identification.
Youssouf reportedly denied the account and described it as an attempted manipulation. His full comments have not been independently reviewed by Ujasusi.
Ujasusi assessment: Unauthorised access to a senior official’s accommodation would create a potential opportunity to examine documents or devices, observe the premises or install surveillance equipment. Those are possible collection opportunities, not established actions in this case.
The central unresolved questions are whether the reported intrusion occurred as described, whether the person was correctly identified, and what—if anything—was done inside the residence.
What to watch: An AU response addressing the specific allegation, independent authentication of the images and any verifiable explanation from Ethiopian or Russian authorities.
🌍 Surveillance: Starlink Users and the Intelligence Value of Advertising Data
An Israeli advertising technology company, Discover-Tech, has been linked to suspected efforts to target Starlink users through online advertising.
The underlying technical research used the name Shadow-Earth-79 without publicly naming the company. The connection between that name and Discover-Tech was attributed to people familiar with the research.
The actor was described as a leading buyer of advertisements in countries including Libya and South Sudan, and was said to have won an unusually large share of bids in countries including Egypt.
Advertising systems can disclose data that, when combined with other information, may help identify, locate or profile users. The available evidence does not establish that every user exposed to an advertisement was successfully tracked, or identify a government customer for the specific activity.
Ujasusi assessment: Starlink can offer connectivity where conventional networks are disrupted or restricted, but the satellite link does not remove the data trails generated by devices, applications and advertising systems. For journalists, activists and organisations working in sensitive environments, the intelligence risk extends beyond who controls the connection itself.
What to watch: Further technical evidence, identifiable customers, Discover-Tech’s response and evidence distinguishing advertising bids from successful surveillance.
🇬🇦 United States–Gabon: CIA Fraud and an Alleged Surveillance Connection
Former US federal employee David Rush pleaded guilty on 6 October to a fraud scheme that caused an approximately $194 million loss to the US government. The CIA said it referred the matter to the FBI following an internal investigation.
A separate investigation published on 26 October described an alleged Gabonese surveillance connection involving a former CIA technical officer and a former French intelligence official. Subsequent Gabonese coverage identified Rush and attributed further details to that investigation.
The US guilty plea is confirmed. The US Justice Department’s announcement does not establish the alleged Gabon operation, and the subsequent Gabonese account relies on the same investigation.
Ujasusi assessment: The confirmed fraud case illustrates the insider-threat problem created when access, secrecy and restricted oversight can be abused for personal gain. The alleged Gabon connection raises additional questions about surveillance and control of collected data, but those operational claims require further verification before they can support a fuller assessment.
🇸🇴 Somalia: Airstrikes and the Intelligence Attribution Problem
An investigation published on 26 October reported allegations that repeated airstrikes around Jilib had made it difficult for civilians to escape conflict and flooding.
Residents’ accounts described frequent attacks, while US Africa Command had publicly acknowledged a smaller number of strikes in the area. AFRICOM denied targeting civilians, using operations to displace them or using weather and flooding as a method of warfare. It said it publicised all airstrikes conducted under its authority in Somalia.
The discrepancy raises an accountability question, but it does not establish that every reported attack was conducted by the United States or that flooding was deliberately weaponised. Other actors also operate aircraft in Somalia.
Ujasusi assessment: The case illustrates the difficulty of attributing air operations in a conflict where several actors possess strike capabilities and public reporting is incomplete. A credible assessment requires matching witness accounts with the date and location of an incident, available imagery, weapons evidence and the operational records of possible operators.
Without that incident-level work, a pattern of civilian testimony may identify a serious problem while leaving responsibility for individual strikes unresolved.
🇮🇶 Iraq: Prime Minister Takes Direct Control of Intelligence Service
Iraqi Prime Minister Ali al-Zaidi removed Hamid al-Shatri as head of the Iraqi National Intelligence Service on 26 October. The termination of his assignment was publicly announced that day.
Days later, al-Zaidi assumed the duties of intelligence chief. The government referred to current security challenges and a wider effort to strengthen state sovereignty. Authorities did not publicly explain al-Shatri’s dismissal.
Ujasusi assessment: Direct prime-ministerial control may give the head of government greater immediate authority over intelligence priorities and coordination. It also concentrates decision-making, making the duration of the arrangement and the effectiveness of oversight especially important.
The dismissal alone does not establish whether the change reflects operational dissatisfaction, political competition or a broader restructuring.
What to watch: Whether a permanent intelligence chief is appointed, changes to the service’s leadership and any further restructuring of security decision-making.
🇫🇷 France: Warning Failure and Russian-Linked Information Activity
Violence around protests in France has raised three separate intelligence questions:
Did authorities adequately anticipate the scale and character of the unrest?
Did foreign actors amplify or manipulate information about it?
Is there evidence that foreign actors organised the protests or directed the violence?
The adequacy of intelligence assessment and police deployment has come under scrutiny. Misleading material also circulated around the protests, including old footage presented as current events.
An investigation into online activity found no evidence that a foreign actor caused the protests. It nevertheless attributed a network circulating coordinated messages around French grievances to Russia’s Doppelganger operation.
The activity was assessed to have preceded and followed the protests and sought to amplify divisions. Ujasusi has not independently verified the network’s state direction.
Ujasusi assessment: A failure to anticipate unrest, exploitation of the unrest by foreign information networks, and foreign orchestration of violence are distinct propositions. Evidence supporting one does not automatically prove the others.
Russian-linked networks may seek to intensify distrust by attaching their messages to genuine grievances. An external influence explanation must not displace examination of the domestic causes of protest or any shortcomings in the French security response.
What to watch: Findings from French investigations, evidence linking specific operations to Russian state direction, and any official review of intelligence warnings and police preparations.
The anti- Ndejembi Campaign on X: Who Is Behind the Attack on Tanzania’s Vice-President?
Period examined: 27–31 October 2026, with an earlier activity baseline
Assessment date: 1 November 2026
Scope: Public-source analysis
Executive Summary
A group of accounts on X repeatedly circulated hostile allegations about Tanzania’s Vice-President, Deogratius Ndejembi, between 27 and 31 October 2026.
The accounts used overlapping hashtags, similar wording, images and short posting intervals. Some also reposted one another’s material. Several had previously published positive or promotional posts about Tanzania earlier in October, including material concerning the Inter-Parliamentary Union Assembly and the Tanzania–United Kingdom partnership.
The activity is consistent with organised amplification of a prepared message set. The most significant feature is the reported shift by some accounts from promoting government-related activities to attacking the vice-president. That shift raises the possibility that the campaign serves a political or commercial interest with a specific grievance against Ndejembi.
The principal line of inquiry is whether the activity originated from President Samia Suluhu Hassan’s political circle or actors seeking to protect her interests. A second possibility is that it was commissioned by business interests affected by Ndejembi’s decisions, particularly during his previous tenure in the energy portfolio.
Neither hypothesis has been established. The available evidence does not identify who initiated the activity, whether participants were paid, whether automated tools were used or whether any political, commercial or state actor commissioned it.
The sampled posts generally recorded modest engagement. The available material does not establish that the campaign formally trended in Kenya or Tanzania, nor does it establish the geographic distribution of its audience or a measurable effect on public opinion.