Uganda confirms state surveillance ambition with new social media tax

Communications watchdog calls for VPNs to be blocked

The Ugandan government is threatening to block the country’s access to virtual private networks (VPN), amid claims that citizens are turning to these services to evade a new social media tax.

Earlier this week, state legislators, under the administration of President Yoweri Museveni, passed the Excise Duty Act – a law which requires Ugandans to pay 200 shillings ($0.05) each day social media is used.

The tax affects the platforms facilitating “voice and messaging over the internet” like WhatsApp, Facebook, and Twitter, all of which have brought increased communication and benefit for the 41% of Ugandans that are online.

The rest of the population cannot afford internet access – 1GB mobile broadband plan cost more than 15% of the average monthly income for Ugandans in 2016.

“I am not going to propose a tax on internet use for educational, research, or reference purposes… these must remain free,” Museveni wrote in a March finance letter.

“However, lugambo on social media (opinions, prejudices, insults, friendly chats) and advertisements by Google and I do not know who else must pay tax because we need resources to cope with the consequences of their lugambo.”

Museveni’s government has said that the aim of the tax will not only create revenue to absolve some of the country’s growing debt, but also as means to curb gossip, so easily spread online.

The day the tax was introduced, however, traffic to a VPN review website surged by 1,600%, with people seeking ways to protest the new measures. Uganda’s communications watchdog then called for ISPs to block VPN services as they were enabling users to hide their IP address and thus circumvent the levy.

“BestVPN.com has received a couple of unconfirmed reports from its users that Uganda is blocking access to VPN services,” Douglas Crawford, an online security expert at BestVPN, told The Daily Swig.

A similar increase of VPN use has occurred during previous internet blackouts in Uganda, such as during the 2016 Presidential election, for example, when the government decried social media a “threat to public order and safety”.

Communications watchdog executive director, Godfrey Mutabazi, admitted that the sheer volume of VPNs available meant that blocking all of them would be impossible, and since the majority of Ugandan users get online through their mobiles, Crawford thinks that it’s “significant that the Google and Apple [VPN] app stores do not appear to be blocked” at this time.

“If access to VPN servers is blocked, many VPN apps allow users to change the VPN protocol to OpenVPN over TCP port 443,” he said. “Unless sophisticated Deep Packet Inspection [DPI] is used, this makes VPN traffic look like regular HTTPS traffic.

“HTTPS is used to secure all commercial websites, so it is very difficult to block without completely damaging access to all internet services.”

DPI, a technique used to analyse network traffic and detect VPN protocols, are used by states like China that have an advance surveillance apparatus.

Although this is highly unlikely to be matched by the digital infrastructure found in Uganda, the country’s state surveillance ambition should not be underestimated.

“We have laws that really encourage surveillance, with no laws that protect citizens,” Dorothy Mukasa, executive director of Unwanted Witness, told The Daily Swig.

“Last year our minister of IT took a tour to China within the confines of how do we get to know what people are saying online and how do we build our capacity to overtake the issues of the internet.”

Unwanted Witness is a Ugandan NGO that recently teamed up with Privacy International to release a report documenting the state of privacy in the country and rise in government capacity to monitor its citizens.

There are currently no data protection laws in Uganda, and Mukasa’s organization continues to push for legislation amid various initiatives aimed at digital rights and education.

“Authorities have the powers to infringe on anyone’s privacy and collect any data without any checks and balances,” said Mukasa. “We’ve also seen arrests of activists, and arrests of journalists.”

Like many, Mukawsa does not believe that the “spirit” of the government’s social media tax will be realized, nor was it particularly well thought out in the first place.

“So it [the Excise Duty Act] could be about collecting revenue, or cutting down on gossip, but it’s also about supressing voices and reducing the numbers of people that share opinions on social media. Who can afford the tax as well?”

Blocking access to VPN websites, Crawford notes, is a fairly common tactic for deploying censorship, safety, or copyright regulations onto a population. VPN servers that offer stealth servers could also be a good workaround for any blockage.

“These are often designed specifically with China in mind, but if a VPN works through the Great Firewall then it should have no problem overcoming any blocks that Uganda might have in place,” said Crawford.

“In the unlikely event that more sophisticated VPN blocking techniques are being used, BestVPN.com has an advanced guide on how to bypass VPN blocks.”