Unwanted Witness Uganda says it is concerned about how this prolonged social media restriction is driving Ugandans to use VPN that comes with a lot of data manipulation risks.
Ugandans could have surrendered their data privacy to unknown
people over the last two weeks since the government shut down social media
access.
The shutdown of the internet on the eve of the presidential and parliamentary
elections forced Ugandans to find ways of communicating, and the Virtual Private
Networks (VPN) came in handy.
"Privacy, data safety and trust are eroding in Uganda as
government censorship intensifies", says Unwanted Witness, a human rights
advocacy group, as the world marked the international Data Privacy Day. The
day aims at raising awareness about respecting privacy, safeguarding data and
enabling trust.
However, the day is being marked at a critical moment when
privacy, data safety and trust is eroding amidst intensified government
censorship and surveillance in Uganda.
On election eve government shut down the internet on grounds of
maintaining public order, and although the internet has partially been
restored, social media platforms remain restricted.
Unwanted Witness Uganda says it is concerned about how this prolonged social
media restriction is driving Ugandans to use VPN that comes with a lot of data
manipulation risks.
“Using VPNs in our daily lives creates an addiction but they siphon our data in
form of names, addresses to do behavioral analytics for marketing and
profiling.
This information is transferred to third party users or the makers without the
users’ consent”, says Chris Kalema, the Lead Technologist at Unwanted
Witness.
He adds that VPNs are designed with codes that have trackers that the users may
never know and unfortunately Ugandans are using them without any clarity.
"VPN applications are free but they have permissions and
pre-installed trackers that users cannot control or uninstall by design and
therefore cannot be trusted", he adds.
The group says that throughout the election process, Unwanted Witness observed
increased use of technology by security agencies for surveillance on street
protests and opposition political rallies, with an intent to limit dissenting
voices.
"This has resulted in arrests and disappearance of an unidentified number
of youths and scores of deaths."
The elections also posed another risk to people's privacy, as
there was lack of public scrutiny in the use of biometric machines to verify
voters, and unknown results transmission system-generated mistrust between
citizens and the Electoral Commission, jeopardizing the credibility of the
process, according to Unwanted Witness.
As a move to curb the spread of Covid-19, the Electoral Commission
instructed political candidates to use digital platforms to look for votes, but
the group says it witnessed an unprecedented illegal use of people’s data by
politicians.
"Political parties were not transparent about their data
processing activities, including publicly identifying the mechanisms they used
to engage with voters, like social media, websites, and direct messaging, and
how they collected people’s data, what data they collected, and the sources of
it and how they used it.
“The Electoral Commission failed to have in place effective
safeguards (Binding code of conduct/Regulations) that reflected changes in digital
campaigning.
By doing this they would have fulfilled their mandate established
under Article 60 and Article 61 of the Constitution of the Republic of Uganda
1995 (as amended) to organise, conduct and supervise regular, free and fair
elections and referenda, among other functions” Says Dorothy Mukasa the
Executive Director of Unwanted Witness Uganda.
She notes that one of the qualities of a trusted data collector is the ability
to be transparent and accountable to the data subjects as enshrined in Section
3 (a) and (f) of the Data Protection and Privacy Act 2019.
They also allege that statutory agencies that use people's data, like the
Electoral Commission or NIRA which gather, use, disclose and manage a person’s
data, do not have a Privacy Policy.
"This lack of transparency led to voters missing out on the voting
exercise because the voters’ register was unclean with voters’ names repeated,
name-face mismatches and deletion of some voters’ names from the
register", the statement claims.
It also urges the government of Uganda to expedite the enactment of Data
Protection and Privacy regulations for effective enforcement of the Data
Protection and Privacy Act 2019 and to fully restore internet to avoid data
manipulation risks that come with the use of VPN.
