Rwandans have long been used to Pegasus-style surveillance
It was a silver BlackBerry, surprisingly heavy in the hand, belonging to a businessman who had flown from Kigali to South Africa to visit the exiled former Rwandan intelligence chief Patrick Karegeya. The businessman, Apollo Kiririsi Gafaranga, boasted that he had bought it in Qatar.
"It cost me $10,000," a friend of Karegeya's remembers the businessman telling them. "It's a model you can only buy in the Middle East, a phone you can't be tracked on." Karegeya picked it up, weighed it, and put it back down on the counter where it was charging. "You've been robbed," the ex spy chief joked.
Looking back, Karegeya's friend thinks the phone was just one in a series of clues that they failed to spot. "I've never seen a BlackBerry like it – that colour, that weight," he recalled. "There was something very suspicious about it." He is convinced that the phone was actually a recording device to tape the conversations that Karegeya – who fled Rwanda in 2007 and co-founded the Rwanda National Congress (RNC) opposition party – was having with fellow exiled activists during Gafaranga's visit.
By New Year's Eve in 2013, Karegeya was dead. On another trip to Johannesburg, Gafaranga allegedly lured him to a room in Sandton's five-star Michelangelo hotel, where Karegeya was jumped on by a four-man team and throttled to death. In September 2019, a South African magistrate issued arrest warrants for Gafaranga and alleged fellow plotter Alex Sugira, yet to be extradited from Rwanda. Officially, Karegeya's former boss, President Paul Kagame, denies involvement. But his message to a prayer breakfast soon afterwards was nakedly triumphalist: "You cannot betray Rwanda and get away with it," he crowed.
The revelation this week that Carine Kanimba, daughter of the former "Hotel Rwanda" manager Paul Rusesabagina, had her phone repeatedly infiltrated, with evidence found of multiple attacks using NSO Group spyware while campaigning for her father's release after he was abducted in Dubai and then jailed in Kigali, has come as no surprise to Rwanda's exiled journalists, dissidents and human rights activists.
Few African societies are more closely monitored, and critics of the government have been repeatedly made aware that the arm of the state extends well beyond its borders – with Kagame seemingly determined to track down dissidents as far afield as Australia, Canada, the US, the UK and mainland Europe.
If Rwanda is a client of the NSO Group, as the Pegasus project suggests, it presents a frightening picture of what a government determined to hunt down "enemies of the state" could do with cyberweapons of this sort. In February, the US advocacy group Freedom House cited Rwanda as one of the world's most prolific practitioners of "transnational repression", ranking alongside Saudi Arabia, China, Russia and Turkey. "The commitment to controlling Rwandans abroad and the resources devoted to the effort are stunning when considering that Rwanda is a country of 13 million people where roughly a third of the population lives below the poverty line," it said.
Information-gathering has always been something of a Kagame speciality; modern technology has simply extended the range of his curiosity. A Rwandan refugee who had grown up in western Uganda, Kagame was sent by Yoweri Museveni – today Uganda's president – to be trained in Dar es Salaam by Tanzanian military intelligence.
Joining Museveni's rebel National Resistance Movement (NRM) in the Luwero Triangle, his allotted task was to collect incriminating information on fighters suspected of failing in their duties: falling asleep on sentry duty, showing cowardice on patrol. His role in the resulting courts martial – which could result in execution – won Kagame the nickname "Pilato", after Pontius Pilate.
When the Ugandan capital, Kampala, fell to the NRM in 1986, Kagame was given a job in military intelligence and played a key role in the formation of the Rwandan Patriotic Front (RPF), a secret force nestling within Uganda's armed forces. After the RPF's charismatic leader was killed invading Rwanda in 1990, Kagame nervously took the lead, relying on a personal network of informants to double check on commanders whose loyalty he doubted.
When the RPF captured Kigali after the 1994 genocide, during which 500,000 to 1 million people were killed by Rwandan soldiers and Hutu extremists, it won control of a tiny former monarchy where the state's hand always rested heavy on its citizens. The late president Juvénal Habyarimana had run a system of domestic monitoring in which local officials reported back on 10-house clusters (nyumba kumi), while the intelligence services kept careful lists of citizens judged either subversive or slavishly loyal.
At home, Kagame has maintained nyumba kumi, run by politically sensitised RPF cadres, as a highly effective instrument of social control. "The entire country is a spying machine," David Himbara, former economic adviser to Kagame, told me while I was researching my book. "The army, the police, they come to his office to tell him things. He doesn't govern, he collects rumours."
Abroad, Rwanda's network of embassies and high commissions has been used to track down, intimidate and in some cases even kill journalists, human rights activists and opposition party members: challengers increasingly emanating not from the ranks of the Hutu majority but from Kagame's own Tutsi elite.
In the past the Metropolitan police has formally warned several RNC activists based in London of an "imminent threat" to their lives from Kigali; in Belgium, a former Rwandan prime minister was placed under armed guard; while Australian police have advised dissidents in exile to steer clear of Rwandan agents said to be operating in Brisbane.
Officially, Rwanda denies using NSO's Pegasus software, but former intelligence chief and RNC co-founder Kayumba Nyamwasa – who has survived repeated attempts on his life in South Africa – notes that the RPF has enjoyed extremely close military and intelligence ties with Israel since the genocide, and that the line between Israel's military and spin-off firms selling intelligence equipment is distinctly blurred.
Kayumba, who was already notified by WhatsApp in 2019 that he was one of 1,400 users targeted by Pegasus, recalls becoming aware his phone had been compromised. "When I left Rwanda I thought I was probably being monitored by Rwanda's state telecoms system and private telecoms firms in South Africa," he told me. "But in 2018 I was told the details of a conversation someone close to me had had with a friend, I checked back, those details were correct, and I sensed a higher system of surveillance was involved."
Aware they are likely to be tracked, Rwandans abroad try to remain under the radar by changing handsets and numbers, using anonymous "handles", and migrating from one platform to another. WhatsApp has been largely jettisoned in favour of Signal and Telegram, but many users don't trust either, timing messages to automatically disappear after set periods. It's an uphill battle, though, activists say, as new numbers and handsets can soon be identified and locked on to via targets' conversations with existing contacts.
Many Rwandans are so intensely suspicious of all modes of electronic communication they will only stray beyond the prosaic and banal when sitting face to face. In that way, the mere knowledge of Pegasus's existence has had a chilling effect on freedom of thought in this small but influential central African nation.
