Regional perspective: Eastern and Southern Africa

Case study (Uganda Revenue Authority Electronic Fraud)

In 2011, the Uganda Revenue Authority (URA) discovered its computer system had been compromised after finding a suspicious entry in the vehicle registration database. It followed an internal investigation that uncovered one of the biggest cybercrimes the country ever experienced, with losses calculated by the Public Prosecutor in Shs 2,4 billion (over 500,000 US dollars). 

Preliminary investigations discovered that more than 150 cars had number plates, but none had paid taxes. The bank receipts, which tax collectors had used to clear the vehicles, were forged. Investigators followed the trail to establish ownership of the vehicles. According to URA documents, three of them, which were supposed to be re-exported to Burundi, were in the hands of a company trusted to Mr. Nsubuga.

The police arrested Mr. Nsubuga, together with three other persons (one of whom was later released), in a car parked nearby the URA premises. Three laptops, an inverter, an external hard disk and other electronic gadgets were seized. Within one week of the arrest of the suspects, a fourth man, Mr.  Byamukama was picked up at his place of work at MTN - a Ugandan major telecommunication company - and his work computer was seized.

Forensic analysis of the electronic devices discovered that they had been used to gain access to URA computers and servers. Specific programs used for vehicle registration and foreign trade procedures, as well as staff user’s login access information, were also found in one of the sized laptops.

The four defendants were indicted on four charges derived from the Computer Misuse Act and two charges drawn from the East African Community Customs Management Act.

The Anti Corruption Division of the High Court of Uganda sentenced Mr. Nsubuga and Mr. Byamukama to 12 years of imprisonment on count II (Electronic Fraud, contrary to section 19 of the Computer Misuse Act), 8 years of imprisonment on counts I,III, and IV (count I: Unauthorized use and interception of computer services, contrary to sections 15(1) and 20 of the Computer Misuse Act; Count III: Unauthorized access to data, contrary to sections 12(2) and 20 of the Computer Misuse Act; Count IV: Producing, selling or procuring, designing and being in possession of devices, computers, computer programmes designed to overcome security measures for protection of data, contrary to sections 12(3) and 20 of the Computer Misuse Act), and a fine of 4.500 US dollars. The other two defendants were acquitted. 

Case-related files

• Uganda v Nsubuga & 3 Others (HCT-00-AC-SC-0084-2012) [2013] UGHCACD 12 (3 April 2013). 

Significant feature

• Cybercrime

Discussion questions

• Analyze the perpetrators’ different roles, modus operandi and their internal organization. Refer to the content studied in previous Modules. 
• Argue in favor, or against, the punishment imposed by the Court. Focus on the social consequences of the crime perpetrated in this case. 
• Identify the factors that make your jurisdiction/country/region vulnerable to cybercrime as well as those that mitigate the risk.