U.S. Ruling on NSO Sends Warning as Pegasus Targets Ugandan Journalists

by AdvocacyDigital SecurityDigital SecurityResearch

By Noelyn Nassuuna | 8 May 2025

In a historic decision on May 6, 2025, a U.S. jury in California ordered NSO Group to pay $168 million in damages for deploying its Pegasus spyware to hack WhatsApp’s infrastructure. This unprecedented verdict—$447,719 in compensatory damages and over $167 million in punitive damages—marks the first time the notorious Israeli spyware company is held financially accountable in court for its hacking operations.

This ruling is a major victory for global digital rights defenders and a critical warning to companies enabling unlawful surveillance. For years, NSO Group’s Pegasus spyware has been linked to grave human rights violations, including the targeting of journalists, activists, and dissidents worldwide. Meta, the parent company of WhatsApp, pursued a six-year legal battle to expose these abuses and protect its users. The judgment follows a landmark January 2025 summary ruling that found NSO guilty of violating U.S. and California hacking laws and breaching WhatsApp’s Terms of Service.

“This verdict sends a clear message to spyware companies that targeting people through U.S.-based platforms will come with a high price,” said Michael De Dora, U.S. Policy and Advocacy Manager at Access Now.

But while the courtroom victory occurred in the United States, its impact reverberates far beyond. Just days before the judgment, Ugandan investigative journalist Canary Mugume took to X (formerly Twitter) to reveal that Pegasus spyware had attempted to infiltrate his device. His post sent shockwaves through Uganda’s media and civil society sectors, especially as the nation edges closer to its 2026 general elections.

This is not the first time Pegasus has been used to target journalists globally. In Uganda, such incidents signal a chilling escalation in the digital threats facing the press. The implications are grave: surveillance software like Pegasus doesn’t just spy on individuals—it compromises entire newsrooms, sources, and the right to information.

“Apple sent this notification to me indicating that I am being targeted by a mercenary spyware. Most of these are used by Governments to hack into phones of journalists, high-profile figures and activists. They last sent this in 2021, there’s a pattern – electoral season.”

In past years, several journalists and human rights defenders in Uganda have reported suspicious digital intrusions, but rarely with hard evidence pointing to a tool as sophisticated and invasive as Pegasus. The spyware is known for its ability to silently infiltrate phones, access messages, camera, microphone, and more—all without the user’s knowledge.

At Defenders Protection Initiative (DPI), we continue to raise alarm and awareness over the growing use of surveillance technologies to intimidate, silence, or endanger the work of journalists, activists, and civil society organizations. The risks are particularly heightened during politically sensitive periods such as elections, where access to reliable information and protection of press freedom are critical for democratic integrity.

The recent U.S. court ruling is a reminder: accountability is possible. It is also a call to action for governments, tech companies, and civil society in Uganda and across Africa to:

  • Strengthen digital security protocols for journalists and human rights defenders
  • Demand transparency and oversight over surveillance technologies
  • Challenge spyware vendors through legal, policy, and public channels

We stand in solidarity with journalists like Canary Mugume and urge all media professionals to report digital threats and seek expert support. DPI remains committed to supporting journalists and human rights defenders through digital security trainings, emergency response, and legal support.

As elections approach, the protection of digital rights is not just a tech issue—it is a human rights imperative.

The Guardians of Peace: The Crucial Role of Human Rights Defenders in Building a Peaceful World

by AdvocacyCivic SpaceProjects/Our Work SectionResearchSecurity

By Noelyn Tracy Nassuuna

International Peace Day has come and gone, but the mission of building and sustaining peace continues every single day, especially for human rights defenders (HRDs) around the world. These courageous individuals are often on the front lines, advocating for justice, equality, and human dignity in the face of adversity. Their work is crucial in addressing the root causes of conflict and promoting long-lasting peace.

Download Article

Holding Regulators Accountable for Data Privacy and Protection in Uganda’s NGO Sector -DPI

by AdvocacyAdvocacyCivic SpaceProjects/Our Work SectionResearchRisk AssessmentSecurity

By Helen Namyalo Kimbugwe and Noelyn Tracy Nassuuna

As Uganda heads toward a pivotal election season, the release of sensitive financial statements for Non-Governmental Organizations (NGOs) like Chapter Four Uganda has sparked intense debate. These disclosures carry significant implications for donors, NGOs, and the public, shaping trust, transparency, and operational stability.

What does this mean for NGOs operating in Uganda, their donors, and the communities they serve? How can transparency be balanced with protection in such politically charged times?

To delve deeper into these issues, download the full article now and stay informed about the future of civil society in Uganda.

Holding Regulators Accountable for Data Privacy and Protection in Uganda’s NGO Sector -by DPIDownload
WhatsApp Image 2024-06-24 at 12.51.09

Protection of Environmental Defenders: Safeguarding Fundamental Rights and Environmental Sustainability 

by AdvocacyLEDs ProtectionProjects/Our Work Section

Land and environmental defenders are some of the most passionate and committed people who unfortunately experience significant reprisals, as reported through our Seek Support portal. Instances of arbitrary arrests, harassment, physical attacks, and threats have hampered their work and forced many to withdraw from advocacy.

The survival of our environment and the defence of fundamental rights are interlinked with the protection of environmental advocate. Prioritising these crucial areas of protection is necessary to achieve these interconnected goals:

  1. Legal Protection: Instituting robust legal frameworks that explicitly safeguard the rights of LED proponents against discrimination, harassment, and violence. 
  2. Access to Justice: Guaranteeing access to justice for LEDs. This involves providing adequate legal resources and support to ensure that perpetrators are brought to justice.
  3. Context-Specific Responses: Recognizing the dynamic challenges faced by environmental defenders, it is crucial to tailor responses to their specific contexts and provide specialised training, resources, and protection mechanisms to address evolving threats.
  4. Inclusion in Climate Policy Formulation: Incorporating environmental protectors into the formulation of climate policies ensures that their voices are heard and their expertise is utilised. This inclusion not only strengthens policy effectiveness but also enhances the legitimacy of environmental governance.
  5. Recognition of Cultural Leaders and Custodians: Acknowledging the rights of cultural leaders and customary landowners as custodians of the land is essential. Their traditional knowledge and stewardship play a vital role in sustainable land management and conservation efforts.

Explore the diverse channels and tools of protection available to LEDs from DPI:

  • Land and Environmental Task Force (LEDTAF): A coalition of diverse organisations providing collective leverage for coordinated response mechanisms for LEDs. Services include legal aid, relocation and rapid response among others.
  • Kyotos (Fireside Chats): Community fireside chats provide a relaxed setting for dialogue, bringing together communities and relevant stakeholders to share information, mediate issues, and address grievances.
  • Digital Security and Security Management Training: To individuals and organisations to enhance operational effectiveness and ensure safety during advocacy efforts.
  • Talk to Your Regulator: Closing the awareness gap on NGO legal frameworks to improve operational efficiency and regulatory compliance for defenders and organisations in the environmental rights landscape.
2-3-1024x576

Collaborative Innovation: The Dynamic Relationship Between NGOs and Regulators

by AdvocacyCivic Space

In today’s rapidly changing world, NGOs have emerged as powerful change agents, addressing social, environmental, and humanitarian issues. These organizations, driven by passion and purpose, often collaborate with regulators to navigate complex challenges and make a lasting impact. This article explores the unique angle of the collaborative relationship between NGOs and their regulators, highlighting the innovative approaches they employ to drive positive change.

1. Embracing Shared Goals:

NGOs and regulators often share common objectives, such as promoting human rights, environmental sustainability, or social justice. By aligning their goals, these entities can work hand in hand, leveraging their respective strengths to achieve meaningful outcomes. Through open dialogue and mutual understanding, NGOs and regulators can effectively create policies and frameworks that address societal needs.

2. Co-Creation of Solutions:

Innovation thrives when diverse perspectives come together. NGOs, with their grassroots knowledge and hands-on experience, bring valuable insights. Regulators, on the other hand, possess expertise in policy-making and governance. By collaborating, NGOs and regulators can co-create innovative solutions that are both practical and sustainable. This collaborative approach ensures that policies and regulations are not only effective but also rooted in real-world experiences.

3. Leveraging Technology:

Technology has become a powerful tool for NGOs and regulators in the digital age. From leveraging data analytics to enhance decision-making to utilizing social media platforms for advocacy, technology has revolutionized the way these entities operate. NGOs and regulators can harness the power of technology to streamline processes, amplify their impact, and engage with a wider audience. By embracing digital innovations, they can adapt to changing landscapes and address emerging challenges effectively.

4. Building Trust and Transparency:

Trust is the foundation of any successful collaboration. NGOs and regulators must foster an environment of trust and transparency to ensure a productive partnership. Open communication channels, regular consultations, and shared information contribute to building trust between these entities. By establishing strong relationships, NGOs and regulators can work together more effectively, creating a positive ecosystem for change.

The relationship between NGOs and regulators is a dynamic and evolving one. These entities can create a synergistic approach to address complex challenges by embracing collaboration and innovation. Through our Talk to Your Regulator program, DPI brings together NGOs and their regulators to build strategic relationships and foster a suitable and accommodating working environment.

1697312026600

Investing in Women’s Safety and Security

by AdvocacyDigital SecurityDigital SecuritySecurity

We hope you were celebrated or honored by the women in your life, and we encourage you to continue this appreciation beyond Women’s Day.

Speaking of Women’s Day, this year’s theme, “Invest in Women: Accelerate Progress,” underscores the critical need for increased financing in gender equality efforts, including funding gender-responsive, green energy initiatives, and support for female and feminist changemakers.

These challenges notwithstanding, as experts in the fields of security, safety, and human rights, we have witnessed firsthand how the unique security risks and threats faced by women impede progress not only toward achieving equity but also in improving their overall quality of life.

Here are four impactful ways in which we can invest in women to accelerate progress through enhanced security and safety measures.

Enhancing  Responsiveness of Security and Justice Institutions 

According to a 2020 Violence Against Women and Girls Survey (VAWG) conducted by UBOS, a staggering 95% of women surveyed reported experiencing physical and sexual violence. Shockingly, only 45% of those who had experienced intimate partner physical and sexual violence chose to report it, primarily due to a deep-seated mistrust in the judicial system.

Despite efforts such as the establishment of Gender-Based Violence help desks by Uganda Police, significant gaps remain in addressing these issues effectively. There is an urgent need to bolster the responsiveness of law enforcement and judicial institutions in apprehending and prosecuting perpetrators. Strengthening these mechanisms is crucial in not only delivering justice to survivors but also contributing significantly to deterring future occurrences.

GBV Toll Free Helpline 0800199195

Support, NOT Survivor Blaming

The UBOS survey also revealed that the other reasons why women opted not to report physical/sexual abuse were fear of being blamed for the incidents and the threat of continued abuse or worse consequences by their abusers if they spoke up.

In light of these distressing findings, it is clear that women who have endured abuse and violations, need tools and assistance to cope, recover, and pursue justice, to help them navigate these harrowing experiences and gradually rebuild a sense of safety and stability in their lives. This can be informed by psychosocial support or training in basic self-defense skills among others.

Equipping Women with Knowledge and Skills to Navigate the Evolving Digital Landscape

In today’s rapidly evolving digital world, it’s crucial to empower women with the necessary knowledge and skills to navigate cyberspaces safely. This includes providing them with the tools to prevent, recognize, and respond to cyber-attacks effectively. Explore our website for digital security support options/offerings.

As more aspects of our lives move online, women are increasingly vulnerable to various forms of digital abuse, including hacking, cyberbullying, harassment, and online stalking. By skilling women in cybersecurity and digital safety, we can empower women to protect themselves against such threats and confidently engage in online activities.

Investing in Gender-Inclusive Tech for Safety and Security 

By allocating resources toward the creation and refinement of tech tools tailored to women’s needs, we can address existing safety concerns and foster a more inclusive digital environment. 

Here are a few we like; digitalsafetea.com safebangle.org bitdefender.com 

Screenshot 2024-03-12 at 12.06.51

Child/Teen Online Safety Tips and Tools

by Digital SecuritySecuritySecurity

More children and teenagers are actively engaging with the internet, and this trend is expected to persist. However, the online environment hasn’t always been tailored to cater to the needs of minors. Therefore, it is crucial to prioritise their safety. In honour of Safer Internet Month, here are some essential tips and tools parents, educators, and even the young netizens can use to guarantee online safety.

Online safety for children InfographicDownload
For blog article

Data Privacy and Protection: Essential Insights for NPOs.

by AdvocacyBusinessDigital SecurityDigital Security

Like other organisations/companies, Non-Profit Organisations (NPOs) collect and utilise data from their program participants, partners or donors. It is therefore imperative that they prioritize data privacy and protection.

Data privacy and protection essentially entail safeguarding sensitive personally identifiable information, covering data collection, storage, and organizational use. Data collected by NPOs may include details such as names, addresses, emails, and financial information. 

Here are key insights for NPOs as they navigate the landscape of data privacy and protection.

Why Data Privacy and Protection?

Data protection and privacy aren’t just checkboxes for NPOs; failure to safeguard sensitive information can lead to severe consequences, posing significant risks to organisations.

Loss of Data

Losing valuable data can be detrimental to an NPO’s operations. Whether it’s program participant information, donor records, or financial data, the loss of such information can disrupt essential activities and hinder effective decision-making. Additionally, recovering lost data can be a time-consuming and costly process. 

Financial Loss

Data breaches can lead to financial losses. NPOs may face financial liabilities associated with rectifying the situation. This could include expenses related to legal actions, regulatory fines, or compensating affected individuals. By implementing robust data protection measures, the risk of financial loss can be minimised and resources can be allocated to their core mission.

Damage to Reputation

NPOs and civil society organizations in general rely heavily on the trust and support of their stakeholders, including donors, partners, and the civil society at large. A data breach or mishandling of sensitive information can severely damage their reputation. Negative publicity, loss of trust, and public scrutiny can have long-term consequences. 

What to Do: Take Action

Digital Security

One of the primary steps in ensuring data protection is to prioritize digital security—measures to secure all data collected, processed, or stored electronically. This includes implementing robust firewalls, encryption techniques, and access controls to prevent unauthorized access or damage to sensitive information. Regularly updating security software and conducting vulnerability assessments can help identify and address any potential vulnerabilities in the organization’s systems. Additionally, establishing strong internal policies and educating staff about cybersecurity best practices can significantly enhance data protection.

Transparency

It is crucial to provide data subjects with enough information to make informed decisions about the data collected from them to obtain informed consent. This includes being transparent about the purpose of data collection, how it will be used, and whether it will be shared with any third parties. This can be achieved through clear and concise privacy policies, consent forms, and opt-in mechanisms. 

Compliance

Compliance with relevant data privacy and protection laws can minimise the risk of legal consequences and demonstrate their commitment to protecting individuals’ privacy.

The Personal Data Protection and Privacy Act 2019, spells out specific regulations on data handling. It may also be helpful for NPOs to familiarise themselves with international laws, such as the General Data Protection Regulation (GDPR), to stay informed about how data may be used by third parties operating under EU jurisdiction. This also ensures that they (NPOs) handle data from the same jurisdiction in a way that aligns with the required standards.

Where To Start: Available Resources 

  • At DPI, we provide training and capacity building in data privacy and protection specifically tailored for NGOs. Feel free to reach out to us here for assistance.