Uganda Police director of forensic services Andrew Mubiru has called for stronger cybersecurity defences and greater collaboration across Africa, warning that the continent’s rapidly expanding digital infrastructure is increasingly exposed to cyberattacks.Mubiru said African countries need to move beyond building digital systems and invest in stronger safeguards to protect them from increasingly sophisticated threats. He cited an analogy shared with him by a cybersecurity solutions provider during a recent engagement in Thailand, who likened many African countries to a “glass house with fancy curtains”.“As this glass house with the very nice fancy curtains…I think we need to begin building some brick walls around that fancy house…The attack surface is increasing,” Mubiru said.He warned that the growing digitisation of economies and public services is creating more opportunities for cybercriminals to exploit vulnerabilities. Mubiru cited a recent cyberattack on a bank in neighbouring Rwanda, in which money stolen during the attack was transferred to Uganda and withdrawn.He declined to identify the affected bank or disclose the amount of money withdrawn in Uganda. He also did not say whether suspects had been arrested or the money recovered.The incident, he said, demonstrates how easily cybercrime can cross borders, forcing investigators in one country to rely on authorities elsewhere to trace funds, identify suspects and investigate attacks.Mubiru warned that vulnerabilities in one country could become a security threat to its neighbours.“If your neighbour construes that this attack would equate to a kinetic action, you are in trouble,” he said.He illustrated the risk using the example of two neighbouring homeowners, saying vulnerabilities in one country could spill over into another in much the same way that snakes from an overgrown bush could enter a neighbour’s compound.“So a cybersecurity exposure may actually turn out to be a national security risk,” Mubiru said.Digital expansion, growing risksThe warning comes as Uganda’s digital economy expands rapidly. Bank of Uganda Governor Michael Atingi-Ego said an estimated 23 million Ugandans, nearly half the population, are now online, driving commerce, financial inclusion, education and government service delivery.Atingi-Ego said technology can accelerate Uganda’s transformation, while finance can turn that transformation into investment, production and opportunity. However, he said trust is essential for businesses and institutions to participate confidently in the digital economy.He said cybersecurity can no longer be treated merely as an information technology issue, but as a matter of economic and financial stability. A national assessment by the National Information Technology Authority-Uganda (NITA-U) found that roughly four in every 10 Ugandan small and medium enterprises had experienced some form of cyberattack.Mubiru, meanwhile, cited figures from cases received by his law enforcement unit, saying reported cases had increased to about 833 from 129 in 2019.“About 833 cases. This is from just a mere 129 that we were receiving in 2019. The numbers are increasing,” he said.Banks remain prime targetsMubiru said the financial sector remains a major target because of the large amounts of money moving through it.“Everybody is looking at the money. Where is the money? And I checked the other day that actually I can be able to procure an exploit for $400 and that exploit is able to earn me a good billions from Bank of Uganda if I know where to deploy it,” he said.But he warned that the threat does not come only from external hackers.“The compromise also is from within. The insider threat is real. So the insider threat for me is the bigger problem as much as we may talk about all this AI and so many things,” Mubiru said.He said the threat also extends to critical government infrastructure.“As we build the oil refineries, as we go digital in government services, we are likely to expose our public sector to more of this threat,” he said.Mubiru identified business email compromise as another major source of financial losses, particularly for companies dealing with foreign partners. He said criminals who gain access to business email accounts can manipulate transactions and divert funds, leaving businesses with significant losses.AI threatens digital identityMubiru also warned that rapid advances in artificial intelligence and other technologies are creating new risks around digital identity. He said criminals can manipulate people’s identities, voices and other personal characteristics to facilitate impersonation and fraud.“Nowadays, people can even get your identity and manipulate it. They can manipulate your voice. They can manipulate anything about you. So in other words, our digital identity is at risk,” he said.The concern is particularly significant as Uganda increasingly relies on digital identity systems for public services and financial transactions.Mubiru also raised concerns about cyberstalking and cyberbullying involving children, calling for greater public awareness and accessible channels for reporting incidents.Late reporting hampers investigationsDespite the growing threat, Mubiru said Uganda’s ability to respond effectively is being undermined by delayed reporting and fragmented institutional responses. He said many cyber incidents are brought to the attention of police only after victims have suffered substantial losses.“People are not reporting incidents. Nobody is reporting incidents. Actually, from the banking sector, we receive just the incidents when the situation has gone out of hand,” he said.Mubiru said some institutions report incidents to the Uganda Communications Commission, while others approach the National Information Technology Authority-Uganda or hire private cybersecurity specialists.The fragmented approach, he said, can create gaps in the national response.“We need to harmonise across board. So I would want to see a harmonised approach to some of these cybersecurity threats that we are seeing. Different sectors approach the problem differently,” he said.He called for stronger cooperation between Uganda and other countries, arguing that the cross-border nature of cybercrime requires joint investigations.The movement of money from Rwanda into Uganda, he said, highlights the challenge. Investigators may need cooperation from Ugandan authorities to obtain transaction records, identify accounts, trace suspects and recover assets.Uganda yet to ratify cybercrime conventionsMubiru said Uganda is a signatory to the United Nations Convention against Cybercrime, launched in Hanoi in 2025, but has yet to complete local ratification.He also said Uganda needs to domesticate the African Union Convention on Cyber Security and Personal Data Protection, commonly known as the Malabo Convention.For law enforcement agencies, Mubiru said ratifying and domesticating the conventions would strengthen cooperation with international partners and improve access to advanced digital and computer-forensics tools.“Currently, we are struggling with our digital forensics and our computer forensics tools to be enhanced, because some of the solution providers globally would ask you, did you ratify the Malabo Convention? And Uganda has not,” he said.Mubiru said Uganda has made progress in establishing a national cybersecurity framework but still has significant gaps to address. He called for closer collaboration between government agencies, regulators, law enforcement and the private sector, alongside greater public awareness and trust.He also urged Uganda to extend cybersecurity regulation beyond the financial sector, where the Bank of Uganda has already introduced stronger requirements.“We need to extend the regulation just beyond finance because what is happening is that in the financial sector, there are a lot of regulations. Bank of Uganda is leading the way. But in other areas, we don’t see much of this regulation coming through,” he said.Mubiru’s concerns reflect a broader challenge identified by Atingi-Ego: Uganda’s digital transformation is advancing rapidly, but its resilience must keep pace.Atingi-Ego said institutions should not measure preparedness solely by their ability to prevent every cyber incident, but by their capacity to withstand attacks, recover from disruptions and learn from them.He urged institutions to build security into digital systems from the outset rather than treating it as an afterthought.“Build security in, do not bolt it on,” Atingi-Ego said.The post African cybersecurity solutions akin to glass house with fancy curtains – Uganda police appeared first on The Observer Media Ltd.