Okello faces uphill battle defending himself in Ggaba murder trial

_________________________
 GGABA MURDER TRIAL 

On Friday, Christopher Okello Onyum will take the stand and testify in his own defense in a trial in which he is accused of murdering four toddlers in early April this year.

For the first time since the trial got under way on Monday last week, the keenly watching world will hear the previously little-known man tell his side of a tragic story that has left the families of four children in grief and a nation still struggling to come to terms with what happened three weeks ago at Early Childhood Development Programme Centre in Ggaba, Makindye division.

For one, Okello has pleaded not guilty to four counts of murder. He has also sat through tens of hours of proceedings in which the evidence of the 18 prosecution witnesses, including expert testimonies, was taken.

Now, after the state concluded presenting evidence and witnesses on Thursday and after Justice Alice Komuhangi Khaukha finding that Okello has a case to answer, attention now shifts to the defense.

 Having been told of the options of how to defend himself, including the constitutional right to remain silent, Okello eventually made up his mind: he will testify, but not under oath. It was an about-turn from his earlier position of giving a sworn testimony.

By the time he had a change of mind, Justice Khaukha had already granted the accused person access to his mobile phones — earlier admitted in court as exhibits — so he could retrieve the contact details of four people he wanted to present as witnesses in his uphill defense.

Okello will have had a little more time for preparation by the time he is shuttled back to Ggaba Community Church, the venue of these mobile court sessions, on Friday morning to kickstart his defense.

He extracted the contacts of his desired witnesses closely watched by Superintendent of Police Kenneth Henry Angulo, a 34-year-old digital forensics analyst who had examined the same phones as exhibits in the course of police investigations into the case.

Nine exhibits

Angulo is attached to the Cyber Crime Department under the Directorate of Forensic Services, where he has worked for the last nine years.

His work involves supporting investigations in the recovery of electronic evidence (from computers, mobile phones, drones, IT systems, etc). He also performs forensic examination of electronic exhibits and makes reports to that effect.

For this particular case, he authored the Digital Forensic Examination Report dated April 13, 2026, based on the examination of nine exhibits — submitted on Police Form 17A — as requested by the divisional CID officer of Kabalagala Police Division.

A court order from the Chief Magistrates Court of Makindye dated April 7, 2026 okayed the analysis of the exhibits: two laptops, four phones and three flash disks. 

All but one of these items were recovered from suspect Okello after his arrest following the April 2 murder of toddlers Gideon Eteku, Keisha Agenrwoth, Ignatius Sseruyange and Ryan Odeke at Early Childhood Development Programme Centre.

One phone was recovered from a car rental company that communicated with Okello mostly on the eve of the fateful day.

Regarding the exhibits, the request from Kabalagala Police Division to the Cyber Crime Department was to extract and analyse browsing activities, analyse call logs, inspect mobile money transactions and inspect car hire requests.

Testifying as a prosecution witness, Angulo confirmed to court on Wednesday that he duly carried out the requested analyses.

So what did he find?

The last call made through the Samsung Galaxy A16 mobile phone, registered with Okello's Google account, was on October 30, 2025, Anguyo told court.

An analysis of the 2024 Motorola Moto G 5G mobile phone, also with a Google account of Okello, revealed WhatsApp communication between Okello and Trip Car Rental Uganda.

The chat involved the accused sharing geolocation coordinates to the car rental company, pointing to a location near Namugere Drive, which is off Kyanja Ring Road. As at the time of arrest, Okello's most recent place of residence was in Kyanja.

Angulo told court this specific phone was used to search for many locations (using Google Maps), including Church Close Ggaba, where Early Childhood Development Programme Centre is located.

It was also observed to have been used to search names of kindergartens and pre-schools, play centres and nursery schools.

"Specifically, [the Motorola phone] was used to search for SCHOOLS NEAR ME," digital forensics analyst Angulu testified.

He went on to list some of the schools searched, which included Kyanja Junior School, Matugga Pre-School, Lam Kindergarten and Day Care Centre, Mom's Love Kindergarten, Edibet ECD and Play Centre and Golden Infant Kindergarten.

The accused also searched online for: Trip Car Rental Uganda hours of operation, how many kilometres does 14 litres get on a 2000 RAV4, car rental Kabalagala and Bunga Police Station.

In Angulo's report, the Motorola was also used to search online for how long it takes to get a firearm license in Uganda, gun license requirements as well as ISIS beheading.

Another phone examined was a Villaon V40 smartphone, which had an MTN Uganda SIM card. The last call made on this handset was 38 seconds long and made to Police emergency number 999. This was on April 2 at 11:25am.

The witness explained that whichever emergency number one dials — whether 999 or 112 — the call is aggregated and routed to the same National Emergency Call Centre at the Police Headquarters in Naguru, Kampala.

"However, telecoms capture this [in their respective systems] with one emergency call number that is assigned to Uganda, which is 112," said Angulo.

This Villaon V40 was found to have made some mobile money transactions, including one of sh388,000 to a one Juma Hashim on March 31, 2026 at 8:25pm. Another mobile money transfer was of 195,000 to Annet Odong Agoe on April 2, 2026 at 11:09am.

Angulo also examined a web search history on this phone. He discovered that on April 1, 2026, the phone was used to search for Church Close Ggaba, which was shown to be a location for Ggaba Community Church.

An iPhone 12 Pro Max smartphone having a WhatsApp Business app registered in the name of Trip Car Rental Uganda was also analysed.

It was found to have communicated to Okello's WhatsApp registered with a US line. This communication spanned between March 12, 2026 to April 2, 2026 at 2:55am.

Angulo also analysed the flash disks.

On one, a number of documents were found, including a PDF copy of a certificate of achievement from ServSafe awarded to Christopher Onyum, having completed a ServSafe Food Handler course. This certificate is valid from October 9, 2024 until October 2027.

The second flash disk contained documents files, including a text book titled Sun Tzu on the Art of War: the Oldest Military Treaties in the World, which was saved on this memory device on November 6, 2025.

Other documents included a recommendation letter for certificate of residence and a letter by Olive Ssebayiga Onyum recommending Okello to the Ministry of Internal Affairs, DCIC on November 5, 2025.

A disruptive afternoon storm brought Wednesday's court session to a premature stop, cutting short Angulo's testimony.

The digital forensics analyst returned on Thursday, as the final prosecution witness, to complete his testimony.

He told court he authored another report based on a second request from Kabalagala Police Division (April 14) for further examination on the earlier submitted exhibits.

The additional request was to extract and analyse information in relation to the employment records of the accused and any other logical examination.

While Angulo reviewed all the submitted exhibits, he told court that the information relevant to that very request was on one of the two DELL laptops. 

To begin with, he found that that particular computer had last been shut down on March 28, 2026 at 2:16am.

And upon examining the gadget, he discovered an email account belonging to Okello and linked to the website panerabread.com, which was used to access services on the domain and other subdomains.

For instance, this particular laptop was used to access the subdomain pantry.panerabread.com/logout/success on December 31, 2025 at 4:18pm Ugandan time.

Angulo testified finding that only Panera employees could use the subdomain.

Former employees, too, have a portal where they can access some information on the domain using their previous work email address.

"Using open source intelligence gathering techniques, the domain name panerabread.com is a website for an American bakery cafe known as Panera Bread LLC. This cafe is a chain of fast bakery cafes that operates within the US and they serve and sell a variety of foodstuffs, such as sandwiches, salads, soups and generally baked foods," Angulo told court.

With evidence like this brought by the prosecution team, Okello and co have a huge task ahead to defend him.