Makerere to develop guidelines to safeguard labs from cyber threats

Makerere University and the Uganda Virus Research Institute (UVRI) are set to unveil standard operating procedures for Ugandan laboratories and lab personnel to protect them against cyber biosecurity threats.

East African countries have the highest rate of cyber-attacks in Africa, according to the Africa Cyber Security Outlook 2023.  In 2023 over 243 cases were reported to the police nationwide, resulting in a loss of Shs5 billion.

Speaking to this publication on Monday, Prof Lawrence Mugisha, principal investigator at Makerere University, said cyberattacks have traditionally targeted IT systems, banks, emails, and networks. However, these attacks have now expanded to biological facilities.

“A new threat has emerged targeting biological facilities. Access to these facilities can be highly lucrative, not only for financial gain but also for exploiting business and property rights, potentially turning these facilities into profit-making ventures,” Prof Mugisha said.

He added: “Most laboratory facilities, ranging from BSL Level one to Level four, have standard operating procedures to ensure safety, biosafety, and biosecurity when working with organisms, but they don’t address cybersecurity.”

Prof Mugisha explained that biological facilities, especially those handling high-risk pathogens, have become targets for intruders, both external and internal.

“If a patent for an organism or pathogen, such as for COVID-19, is left accessible to hackers, those without rights could exploit it if my system is hacked. We need to safeguard our institutions, facilities, and laboratories by raising awareness about cybersecurity and cyber biosecurity,” he said.

It’s from this background that Makerere University’s College of Veterinary Medicine, Animal Resources, and Biosecurity, along with the Uganda Virus Research Institute, are establishing an inventory for cybersecurity, conducting vulnerability assessments, and developing standard operating procedures and guidelines.

“With the overarching aim of creating or developing cyber biosecurity goals, it’s evident that most institutions in Africa, including those in Uganda, currently lack guidelines or standard operating procedures for effective cyber biosecurity. This leaves our facilities vulnerable to unauthorized access,” Prof Mugisha said.

The International Health Regulations (IHR) require all countries to implement procedures and processes to safeguard public health. Prof Mugisha noted that last year’s assessment revealed deficiencies in Uganda's biosafety and biosecurity measures.

“The element of cyber biosecurity was still lacking. It is now our opportunity to highlight this issue to various technical officers from different ministries, including policymakers. cyber biosecurity is a global issue and an emerging concern that requires our collective attention,” Prof. Mugisha said.

Ms Sandra Matinyi, Co-founder and Executive Director of Nuo Bioscience, said that in 2022, the WHO introduced a framework to provide guidance for mitigating biorisks and governing dual-use research, which involves scientific work that could be misused for harmful purposes.

"With the emergence of new technologies and rapid advancements in life sciences research, there was previously no global guidance for identifying or mitigating risks related to dual-use research of concern until the WHO introduced this framework in 2022," Ms Matinyi said.

She added, "Mitigating biorisks and governing dual-use research is a global issue, as we live in a global village. It’s a shared responsibility, and everyone has a role to play, including scientists, researchers, and the public."

Uganda is among the first countries to pilot the implementation of this framework, positioning itself at the forefront of adopting international biosecurity standards.