State Capacity, Public Legitimacy and Biosecurity During the 2026 Bundibugyo Virus Outbreak in Uganda and the Democratic Republic of the Congo

Full text

Text extracted from the article PDF for reading and search. Tables, figures and equations are in the PDF, which remains the authoritative version.

1. Introduction

National security has long been tied to territorial integrity, political independence and the defence of state institutions against organised violence. Infectious disease outbreaks show where that view falls short. Biological threats can damage public safety, disrupt essential services and force governments to act together across national jurisdictions. The securitisation of health has therefore become an established topic in international relations, although scholars still disagree about whether framing disease as a security matter leads to suitable or effective responses (Buzan et al., 1998; Wenham, 2019) [2, 5]. The 2026 Bundibugyo virus disease outbreak in the Democratic Republic of the Congo is a demanding setting in which to study this question. By 6 October 2026, the World Health Organization (WHO) had recorded 8,728 confirmed cases and 4,205 confirmed deaths in the DRC, with transmission reported in 64 health zones across seven provinces (WHO, 2026a). The size of the outbreak, its geographical spread and the difficulty of following up exposed people make it relevant to security analysis, especially where institutional access, health service delivery and cross border movement affect how control measures are carried out (WHO, 2026a).

Uganda's experience shows that the threat does not stay within the territory where an outbreak first takes hold. By mid July 2026, WHO had reported 20 confirmed cases in Uganda. These included cases imported from the DRC and secondary cases among contacts and health workers linked to those imports (WHO, 2026b). On 8 October 2026, WHO also reported a laboratory confirmed imported case in Kenya. The patient had travelled from the DRC through Uganda before reaching Nairobi, where the patient was isolated, treated and later died (WHO, 2026a). The available account does not show that transmission took place in Uganda during that journey, and the patient's travel history should not be read as proof that any particular national authority failed (WHO, 2026a).

These events raise a question that goes beyond the technical handling of an epidemic. A country may have laboratories, surveillance procedures, trained health staff and formal emergency plans, and still struggle to identify infections, keep up contact follow up or reach communities affected by insecurity. WHO's July 2026 assessment of the DRC outbreak recorded infections among health workers, restricted access linked to security incidents and large differences in contact follow up between affected areas (WHO, 2026b). Evidence of this kind makes it necessary to study how institutions work under real conditions, instead of assuming they are effective because policies or emergency declarations exist.

The article approaches the problem through securitisation theory, which looks at how threats are presented politically and how those presentations can justify exceptional action (Buzan et al., 1998) [2]. It pairs that view with an institutional analysis of the capacity to turn recognition of a threat into practical protection. This approach also responds to Wenham's (2019) [5] argument that the growth of global health security can lead to too much reliance on security institutions or emergency framing, without any proof that the resulting interventions are appropriate or lasting. The central argument of the article is that the effectiveness of biosecurity cannot be read from the strength of emergency declarations, border controls or formal coordination mechanisms alone. It depends on how technical capability, institutional implementation, public cooperation and the exchange of information across borders fit together. The article develops and tests this argument using the 2026 outbreak and historical documents, while acknowledging that the current outbreak is still active and that final epidemiological outcomes are not yet known.

2. Research Problem, Objectives and Questions

2.1. Statement of the Research Problem

Biological outbreaks become national security problems when their effects exceed the ability of institutions to identify infections, coordinate a response and protect people across administrative and national boundaries. The International Health Regulations (2005) [6] require countries to maintain surveillance and response capacities and to notify WHO of public health risks that may have international consequences (WHO, 2016). Having these obligations on paper, however, does not show that countries can meet them consistently when there is conflict, limited access or rapid geographical spread.

The 2026 Bundibugyo virus disease outbreak shows the gap between formal preparedness and real performance. WHO reported that contact follow up in the DRC reached 80.4% in the latest reporting period before 8 October, with 23,741 of 29,535 contacts reached by 4 October (WHO, 2026a). The same report recorded 264 community deaths among the 372 deaths reported since the previous situation update, which means that a large share of deaths in that period happened outside treatment centres (WHO, 2026a). These figures do not explain why people died in their communities, but they raise questions about how quickly cases were identified, whether people could reach treatment and whether response institutions could get to affected households. The problem is not limited to the DRC. Uganda recorded imported cases and secondary infections linked to them during the 2026 outbreak. The 2019 episode in Kasese, meanwhile, showed that infections acquired across the border could be detected and managed through rapid notification and coordinated action (WHO, 2019, 2021). Together these experiences call for an examination of which institutional arrangements turn cross border information into effective protective action, and why similar arrangements can work differently in different conditions.

Existing research also warns against reading an outbreak response only through its medical or administrative parts. Mayhew et al. (2021) [3] found little evidence that local actors in the DRC's 2018 to 2020 response had real influence over decisions, and McKay et al. (2022) [4] studied how community feedback was used during that epidemic. These studies indicate that public engagement should be judged by its influence on decisions and by whether response measures were adapted, and not simply by the number of meetings held or messages sent.

There is a further complication. The literature already contains a 2026 systematic review on cross border Ebola preparedness in Uganda and the DRC (Anyanwu et al., 2026) [1]. A new article that only listed preparedness capacities, institutional gaps and regional priorities would risk repeating that work. The research problem adopted here is narrower: how do technical capacity, institutional implementation, public legitimacy and cross border coordination interact to shape the security value of an outbreak response? The article studies this problem through documents and does not claim to measure the causal effect of each factor statistically. Its purpose is to establish which mechanisms the available record supports, to point out where the evidence is thin and to develop a framework that can guide further comparative research.

2.2. General Objective

To examine the institutional and political conditions under which biosecurity contributes to national and regional security, using the 2026 Bundibugyo virus disease outbreak in Uganda and the DRC as the main empirical case.

2.3. Specific Objectives

1. To examine how institutional capacity shaped the detection, notification and management of the 2026 outbreak in Uganda and the DRC.

2. To assess how public legitimacy and community cooperation relate to the carrying out of outbreak response measures.

3. To analyse how cross border information sharing and operational coordination contribute to the management of biological threats.

4. To develop a theoretically grounded explanation of the relationship between biosecurity effectiveness and national security.

2.4. Research Questions

1. How did institutional capacity shape the detection, notification and management of the 2026 outbreak in Uganda and the DRC?

2. How did public legitimacy and community cooperation affect the carrying out of response measures? 3. How did cross border information sharing and operational coordination contribute to the management of the biological threat?

4. What does the evidence reveal about the limits of conventional approaches to national security as explanations?

3. Conceptual Clarification

3.1. Biosecurity and Biosafety

Biosecurity covers measures meant to prevent, detect and respond to biological threats, including the risks that come with dangerous biological agents and their possible misuse. Biosafety, in contrast, covers the practices and containment measures that prevent accidental exposure to biological agents or their unintended release. The two terms overlap in some institutional settings, but they describe different risk management functions.

This article uses biosecurity in the broader health security sense of protecting populations and institutions against naturally occurring biological threats. That usage suits a study of surveillance, preparedness, detection, notification and response to Bundibugyo virus disease. It does not suggest that the outbreak came from a deliberate release, biological weapons or terrorist activity. WHO describes Bundibugyo virus disease as a zoonotic disease that can pass between people through contact with infected bodily fluids and contaminated materials (WHO, 2026a).

3.2. National Security and Health Security

National security is about protecting a state's population, institutions and territorial integrity from threats that can cause serious harm. A broader approach accepts that threats do not have to come from armed adversaries to affect state authority, social stability or the continuity of essential services (Buzan et al., 1998) [2].

Health security is the capacity to prevent, detect and respond to health events that threaten populations and may have effects beyond national borders. The International Health Regulations offer an international legal framework for managing public health risks with possible cross border consequences (WHO, 2016). The two concepts overlap when a biological threat places heavy demands on state institutions, cross border coordination and the protection of people, but they should not be treated as interchangeable in every context.

3.3. State Capacity

In this article, state capacity means the ability of public institutions to obtain reliable information, make decisions, coordinate responsibilities and carry out measures within their jurisdiction. For outbreak analysis, the concept has to be linked to activities that can be observed, and it should not be inferred from a country's formal administrative structure. Useful indicators include how quickly cases are notified, the share of identified contacts who are reached, the continuity of surveillance, the availability of infection prevention measures and the ability of response teams to reach affected areas. WHO's reporting on contact follow up and access restrictions in the DRC gives examples of indicators that can be used to assess particular functions, although no single indicator captures the overall performance of a state (WHO, 2026a, 2026b).

3.4. Public Legitimacy and Community Cooperation

Public legitimacy refers to how appropriate and acceptable people find institutional authority. Community cooperation refers to the things people do to take part in measures such as reporting symptoms, naming contacts, seeking care, helping investigations and following public health guidance. The two ideas are related but not the same. A person may cooperate because treatment is accessible, because a trusted local leader has explained a measure, because they fear legal compulsion or because they believe the intervention is justified. Compliance that can be observed therefore cannot automatically be taken as evidence of trust. Research on the 2018 to 2020 DRC outbreak suggests that community involvement, local decision making and the use of feedback each need to be examined separately (Mayhew et al., 2021;

3.5. Cross Border Cooperation

Cross border cooperation includes exchanging relevant information, coordinating investigations, notifying neighbouring countries of suspected cases, preparing jointly and arranging how risks that affect neighbours will be managed. It should be judged by documented actions and not inferred from the existence of regional agreements. The 2019 Kasese episode shows why this matters. WHO's after action case study names open information sharing, collaboration among stakeholders, community surveillance and border surveillance as important elements of the response to three confirmed cases imported from the DRC (WHO, 2021). The case is evidence that a coordination mechanism worked in one specific episode, but it cannot show that all cross border arrangements were consistently effective.

4. Theoretical Framework and Literature Review

4.1. Securitisation Theory

Securitisation theory questions the idea that a threat becomes a security issue only because of what it is materially. Buzan et al. (1998) [2] argue that security is also a political practice. Actors present an issue as an existential threat and ask others to accept measures that would normally be seen as exceptional.

The theory is useful for studying biological threats because calling an outbreak a security emergency can change how resources are mobilised, who is responsible for what and how far extraordinary action is seen as legitimate. In May 2026, WHO declared a public health emergency of international concern, which placed the Bundibugyo virus outbreak inside an international emergency framework and called for coordinated action by affected and at risk countries (WHO, 2026c). The declaration shows formal international recognition. It does not prove that every national response measure was carried out well.

A securitisation analysis therefore has to keep three questions apart. First, how did political and institutional actors portray the biological threat? Second, what measures did that portrayal authorise or encourage? Third, what evidence shows the effects of those measures? An emergency declaration can answer the first question without settling the other two.

Wenham (2019) [5] adds an important qualification. She argues that the growth of global health security has widened the range of issues treated as security threats, increased the involvement of security institutions and created risks that come from the way health security itself is carried out. Her critique warns against assuming that more securitisation leads to better health outcomes.

Applied to this study, securitisation theory explains why Ebola can be lifted from a concern of the health sector to a national or international security priority. It does not explain, on its own, why one response system performs better than another once the threat has been recognised. That limit is the reason for adding an institutional perspective.

4.2. State Capacity and Institutional Performance

Institutional capacity is the link between political recognition and operational action. It is about turning decisions into consistent practice, especially when delivery depends on several organisations and different levels of government. The 2026 outbreak shows why this distinction matters. WHO's July assessment recorded 20 confirmed cases in Uganda and reported that the most recent case had been discharged after two negative tests. Enhanced surveillance then continued through the period required before the outbreak could be declared over (WHO, 2026b). These records establish certain response activities and outcomes at a given time. They do not show that every part of the surveillance system worked equally well. In the DRC, the October assessment documented contact follow up below the target level and continued transmission in several health zones (WHO, 2026a). These observations point to operational constraints, but their causes cannot be reduced to one variable. Insecurity, population movement, late presentation, limited access to health services and the geographical spread of the outbreak may each affect different response functions.

The institutional perspective therefore draws attention to the relationship between capability and implementation. It also discourages sweeping judgements about a whole country based on isolated indicators. A high rate of contact follow up in one province does not prove strong national performance in every respect, and a low rate in one area does not prove that the entire national system has failed.

4.3. Community Legitimacy and Outbreak Response

The literature on the DRC's 2018 to 2020 outbreak shows why community relations cannot be treated as an optional extra added to a technical response. Mayhew et al. (2021) [3] reviewed the evidence on community involvement, trust and resilience. They concluded that there was little evidence of adaptation that allowed local actors to shape decisions. Their analysis challenges approaches in which institutions consult communities to understand their views but keep control over how interventions are designed and delivered. McKay et al. (2022) [4] looked at how community feedback was used during the same outbreak and how far it informed response decisions. This work matters because feedback systems are only useful when institutions can act on the concerns they uncover. Collecting complaints, questions or observations is not the same as changing a response measure because of them.

The link to security is practical. If communities avoid health facilities, withhold information or refuse access to response teams, surveillance and contact follow up can become harder. Even so, this article should not assume that every instance of resistance reflects mistrust, or that public cooperation is always decided by legitimacy. Access to transport, income, treatment, information in a language people understand and safe services can also shape how people behave. The analytical task is to work out when public cooperation affects how a response is carried out, and whether institutions changed their conduct in ways that addressed the reasons for non cooperation. That requires evidence about specific events and responses, and not general statements that communities must be sensitised.

4.4. Cross Border Cooperation and the Limits of

Territorial Security The International Health Regulations recognise that public health risks can have international consequences and set obligations for surveillance, response and notification (WHO, 2016). These obligations reflect a simple reality: states cannot manage every biological threat within their own borders.

The June 2019 Kasese episode is a concrete example. WHO reported that three members of a family who had travelled from the DRC were confirmed with Ebola in Uganda. Congolese authorities alerted their Ugandan counterparts, the cases were quickly identified and isolated, and no further cases were reported from that episode (WHO, 2019, 2021). The episode shows how information sharing and domestic response capacity can work together.

It does not show that border screening alone prevented further transmission. The documented response involved communication between authorities, identification of cases, isolation, contact monitoring and preparedness arrangements inside Uganda (WHO, 2019). A narrow focus on border controls would miss the institutional work needed after a potentially infected person has already crossed. This point matters for the 2026 outbreak. The patient who travelled from the DRC through Uganda before being diagnosed in Kenya illustrates how easily individuals move across several jurisdictions. But the travel history alone does not show where the infection happened or whether a particular border measure was inadequate (WHO, 2026a). The case instead raises questions about the continuity of health information, the recognition of illness, access to diagnosis and coordination among national authorities. The wider literature therefore suggests that regional cooperation should be judged as an operational relationship and not only as a diplomatic commitment. A protocol matters, but evidence of timely notification, investigation and follow up says more about whether the protocol contributes to biosecurity.

4.5. The Gap and the Contribution of This Article

The literature reviewed already shows that cross border preparedness, community engagement and institutional coordination all matter for Ebola response (Anyanwu et al., 2026; Mayhew et al., 2021; McKay et al., 2022) [1, 3, 4]. This article does not claim that these factors have been overlooked.

Its contribution is to bring these strands together in a security studies explanation that separates recognition of a threat from its implementation. Securitisation theory explains why a biological threat rises on the political agenda. Institutional analysis examines how that recognition is turned into practical action. The evidence on community cooperation and cross border coordination helps explain why implementation varies from one setting to another.

The contribution is therefore conditional and not universal. The article proposes that biosecurity is more likely to support national and regional security when technical capability is backed by effective implementation, workable relationships with affected communities and reliable cross border information flows. The evidence must then be examined to see when these conditions are present, when they are missing and what else explains the outcomes observed.

5. Methodology

5.1. Research Design

The article uses a comparative qualitative case study design based on documentary evidence and process tracing. A qualitative design suits the research questions, which concern institutional decisions, implementation mechanisms, political legitimacy and cross border cooperation, and not the statistical effect of a single intervention. The main case is the 2026 Bundibugyo virus disease outbreak in the DRC and Uganda. The analysis draws on WHO outbreak reporting, official health authority statements and relevant peer reviewed research. Two historical episodes provide comparative evidence: the cross border response in Uganda in June 2019 and the DRC's 2018 to 2020 outbreak, particularly the documented difficulties with community participation and operational access (WHO, 2019, 2021; Mayhew et al., 2021) [3].

The comparison is organised around four dimensions: threat recognition, institutional implementation, public legitimacy and cross border coordination. These give a consistent basis for comparing the cases while leaving room to recognise differences in the characteristics of the pathogen, geographical coverage, conflict conditions and how far each response had matured.

5.2. Case Selection

The 2026 outbreak was chosen because it offers direct evidence of a biological threat affecting both Uganda and the DRC, with wider implications for regional movement and coordination. By October 2026, WHO had documented extensive transmission in the DRC and a confirmed imported case in Kenya involving travel through Uganda (WHO, 2026a).

The 2019 Kasese episode was chosen because it is a documented example of cross border notification followed by case identification and isolation in Uganda (WHO, 2019, 2021). The 2018 to 2020 DRC outbreak provides evidence on how insecurity, community participation and response implementation relate to one another (Mayhew et al., 2021) [3]. The cases are not treated as equivalent. The 2019 episode involved three related imported cases in a small geographical area, while the 2026 outbreak had spread across many health zones and provinces in the DRC by the reporting cutoff (WHO, 2019, 2026a). Their value lies in showing how mechanisms work under different conditions, and not in ranking countries by comparing case counts.

5.3. Sources and Documentary Analysis

The main sources are WHO's dated disease outbreak reports, its 2019 account of the Uganda cases, its after action case study published in 2021, the International Health Regulations and peer reviewed research on the DRC response (WHO, 2016, 2019, 2021, 2026a, 2026b; Mayhew et al., 2021; Each document was assessed for the kind of claim it could support. Epidemiological reports were used for reported cases, deaths, contact follow up and response activities. Peer reviewed studies were used to examine theoretical arguments, community engagement and institutional practices. Legal and policy documents were used to establish formal obligations and arrangements.

The analysis separates three forms of evidence: documented events, institutional assessments and analytical interpretations. A reported case count is a documented epidemiological figure. A statement that coordination was effective is an assessment, and the evidence behind it needs to be examined. An argument that coordination contributes to national security is an analytical proposition to be tested against the record.

The study did not involve interviews, field observation or confidential intelligence analysis. It therefore cannot directly establish the private motives of officials, the experiences of every affected community or the full operational performance of institutions that have not been independently assessed.

5.4. Analytical Procedure

The documents were organised around the research questions and examined for evidence of threat recognition, detection, notification, institutional coordination, contact follow up, community engagement, operational access and documented outcomes.

Process tracing was used conceptually to test whether the sequence of events supported the proposed mechanisms. In the 2019 episode, the sequence runs from notification by Congolese authorities to case identification and isolation in Uganda, followed by monitoring and no further reported cases from the episode (WHO, 2019, 2021). That sequence supports the view that information sharing and response capacity worked together in this instance. It does not prove that either factor alone caused the outcome, because the small number of cases, their epidemiological relationship and the geographical concentration of the episode also matter. For the 2026 outbreak, the analysis looks at how the growth in reported cases relates to contact follow up, operational access and cross border movement. The documentary record allows an assessment of reported conditions and response activities, but it does not support a definitive causal estimate of how much each factor contributed.

5.5. Reliability, Limitations and Ethical Considerations

Reliability was addressed by giving priority to original institutional records for facts about the outbreak and to peer reviewed publications for scholarly interpretation. Figures are tied to their reporting dates because cumulative totals and assessments can change as surveillance and diagnostic capacity develop. WHO itself notes that newly reported cases and deaths may include backlogged samples and not infections that occurred during the reporting interval (WHO, 2026a).

The main limitation is the reliance on documentary evidence during an ongoing outbreak. Official reporting may not capture every difficulty in implementation, and the absence of a reported incident cannot prove that no incident occurred. The study also cannot offer a final assessment of containment or of the eventual consequences of the outbreak. On ethics, the analysis avoids blaming affected communities or national authorities without supporting evidence. It separates documented transmission from travel history, and it treats public cooperation as something that needs explaining, and not as a quality that communities either have or lack.

6. Empirical Analysis and Findings

6.1. The 2026 Outbreak and the Limits of Formal Preparedness The 2026 outbreak shows how large a challenge response institutions have faced. By 6 October, WHO had recorded 8,728 confirmed cases and 4,205 confirmed deaths in the DRC, with cases reported across seven provinces (WHO, 2026a). These figures show how severe the recorded outbreak is, but they should not be read as a direct measure of how well any single institution has performed.

The operational indicators give a more specific picture. WHO reported that 23,741 of 29,535 identified contacts had been reached by 4 October. That is 80.4% contact follow up, which is below the response target (WHO, 2026a). The report also recorded continued transmission in several health zones and a large number of deaths in communities and not in treatment centres (WHO, 2026a).

These indicators suggest that the response kept running into difficulty in following up contacts and reaching people who needed care. They do not establish the exact reason for each missed contact or community death. Population movement, areas that are hard to reach, late identification and limits in health services are plausible explanations, but the contribution of each would need closer investigation. The evidence still supports a clear analytical point. Formal preparedness arrangements and emergency recognition are necessary institutional resources, but neither shows that surveillance and response functions are being carried out consistently. The real security question is whether institutions can keep those functions going in the conditions where the threat is spreading.

6.2. Uganda's Response and the Importance of

Institutional Implementation Uganda's experience shows both the risks that come with imported infections and the importance of sustained response procedures. WHO's July 2026 report recorded 20 confirmed cases in Uganda, including imported cases and secondary cases among contacts and health workers linked to imports from the DRC (WHO, 2026b).

The same report stated that the last confirmed case had been identified on 21 June and that the most recent patient had been discharged after two negative tests by 16 July. Uganda then began the required 42 day period of enhanced surveillance before an outbreak could be declared over (WHO, 2026b).

This sequence shows why response performance cannot be measured only by the number of cases at one moment. Identification, isolation, contact monitoring and continued surveillance are separate functions, and each must keep working over time. A period without newly confirmed cases does not remove the need for monitoring, because the incubation period and the continuing risk of importation justify it.

The evidence also warns against reading the detection of secondary cases as proof that the response failed. Secondary infections can occur before an imported case is identified, especially when early symptoms are not specific. WHO notes that Bundibugyo virus disease can be hard to tell apart from other febrile illnesses without laboratory confirmation (WHO, 2026a).

A fairer assessment looks at what happened after cases were identified. Were contacts listed and followed? Were health workers protected? Did surveillance continue? Were further cases detected? These measures say more about institutional performance than the assumption that a successful response must prevent every secondary infection.

6.3. The 2019 Kasese Episode: Coordination in Practice The 2019 episode is a documented case of cross border cooperation. On 11 June 2019, Uganda confirmed Ebola in a child who had travelled from the DRC with family members after attending the funeral of a relative who had been confirmed with the disease. Two other family members were later confirmed, and the cases were epidemiologically linked to the outbreak in the DRC (WHO, 2019).

WHO reported that the cases were quickly identified and isolated after notification from Congolese authorities, and no further cases were reported from that episode (WHO, 2019, 2021). The after action review named information sharing, collaboration among stakeholders, community surveillance and border surveillance as important elements of the response (WHO, 2021).

The episode supports the idea that cross border information sharing can be valuable in practice when it is connected to a functioning national response. Notification was not an end in itself. It allowed health authorities to identify and manage cases inside Uganda.

The episode also shows the limits of an analysis centred on borders. The cases had already crossed into Uganda before they were confirmed, so the response depended on clinical recognition, laboratory confirmation, isolation and contact monitoring as well as border preparedness (WHO, 2019). The evidence therefore supports a system wide view of biosecurity, in which border measures are one part of a longer chain of detection and response.

This historical case does not prove that the same arrangements would produce the same results in a larger outbreak. In 2019, the reported cases formed a single family cluster in a small area, while the 2026 outbreak covers a much wider geography (WHO, 2019, 2026a). The sensible conclusion is that cross border coordination can support containment under specific conditions, and not that one successful episode proves general institutional superiority.

6.4. Community Legitimacy and the Practical Limits of

Command and Control The DRC's 2018 to 2020 outbreak provides evidence on how public legitimacy relates to the carrying out of a response. Mayhew et al. (2021) [3] found little evidence that local actors had been given meaningful influence over response decisions, while McKay et al. (2022) [4] examined the use of community feedback and how far it shaped the response. These studies suggest that consultation and participation should not be treated as the same thing. Communities may be asked about their concerns without gaining any real influence over how interventions are designed or delivered. A response that gathers information but does not adapt to it may miss chances to deal with the practical or social reasons behind reluctance to cooperate.

The implications for security are significant, but they need to be stated with care. Surveillance and contact follow up depend partly on access to households and on the willingness of people to give information. Where a response is seen as coercive, unresponsive or disconnected from local concerns, some measures may become harder to carry out. The cited studies support the importance of community involvement in the earlier DRC outbreak, but they do not establish the attitudes of every community during the 2026 outbreak. The lesson is not that community acceptance should replace technical standards or emergency authority. Local knowledge and feedback should instead shape how response measures are communicated and delivered. The technical requirements of infection prevention and control remain necessary, but how well they are carried out can depend on the relationships through which institutions reach people. This argument also places a limit on a purely securitised response. If emergency governance leans too heavily on command and control, it may overlook the social conditions needed for effective implementation. Wenham's (2019) [5] critique of oversecuritisation is relevant here because it asks whether security framing always produces the most suitable response to a health threat.

6.5. Cross Border Movement and Regional Security

The 2026 outbreak shows why a national response cannot be judged in isolation. WHO's October report documented a patient who travelled from the DRC through Uganda to Kenya before the diagnosis was confirmed in Kenya (WHO, 2026a). The patient's illness history and travel route created a need for contact tracing and coordination among the countries involved, but the report did not establish that transmission occurred in Uganda during the journey (WHO, 2026a).

This episode shows the difference between territorial control and continuity of public health information. A state can exercise authority over its borders, but a person's health status may not be known when they cross, and symptoms may be hard to tell apart from those of other illnesses. WHO identifies the non-specific early symptoms of Bundibugyo virus disease as a factor that complicates diagnosis and may delay detection (WHO, 2026a).

Border screening can therefore contribute to preparedness, but it cannot replace surveillance within communities, accessible health facilities, diagnostic capacity and information exchange. Nor should every traveller from an affected country be treated as infected. In its October report, WHO advised against restrictions on travel to or trade with affected countries, while continuing to monitor travel and trade measures (WHO, 2026a).

The security implication is that cross border cooperation must preserve the ability to identify risks without assuming that movement is itself wrongdoing. Public health measures need credible information, proportionate implementation and coordination among jurisdictions. The 2019 Kasese experience shows that timely notification can support a response, while the 2026 travel episode shows the continuing need to coordinate investigations when a case crosses several borders (WHO, 2019, 2021, 2026a).

6.6. Conflict, Access and the Limits of Institutional

Reach The DRC outbreak also shows how insecurity can limit the carrying out of public health measures. WHO's July 2026 report described a complex humanitarian and conflict affected environment, with displaced and mobile populations, limited access to essential services and security incidents affecting health facilities and response operations (WHO, 2026b).

These conditions can affect surveillance, access to treatment and the ability of response teams to reach communities. They also make epidemiological data harder to interpret. A drop in reported cases may reflect falling transmission, but where access and testing are disrupted, fewer reported cases do not necessarily mean that transmission has fallen. That second possibility must be checked against surveillance coverage and other evidence and should not be assumed in every setting.

Institutional capacity in this context is not simply the number of personnel or the existence of a response plan. It includes the practical ability to work safely and consistently in affected places. Where security incidents restrict access, the same formal policy may produce different results in different areas.

This finding qualifies explanations that put outbreak outcomes down entirely to public trust or the quality of national leadership. Institutional performance is shaped by the conditions in which institutions work. The effects of insecurity should be examined alongside resource availability, community relations, epidemiological characteristics and coordination, and should not be treated as a complete explanation by themselves.

7. Discussion: Rethinking Biosecurity as a National

7.1. Threat Recognition Is Not the Same as Effective

Protection The evidence supports a distinction between recognising a biological threat and keeping the institutional capacity to manage it. Securitisation theory explains how an outbreak can gain security significance and draw exceptional political attention, but it does not show whether the measures adopted will produce the intended results (Buzan et al., 1998; Wenham, 2019) [2, 5].

The 2026 outbreak illustrates this distinction. International emergency recognition has existed alongside continued transmission, contact follow up below the reported target and high mortality in the DRC (WHO, 2026a). These observations do not prove that securitisation caused weak implementation, since the scale of the outbreak, its epidemiological characteristics, its geographical spread and security conditions also shaped the response. They do show that formal recognition and operational performance have to be assessed separately.

A security framework that measures success mainly by emergency declarations, new coordination structures or announced funding risks mistaking institutional activity for institutional effectiveness. A more defensible assessment asks whether alerts are investigated, contacts are followed, suspected cases receive proper attention and response teams can reach affected people. These functions can be measured without assuming that every bad outcome is an institutional failure.

7.2. Public Legitimacy Is an Operational Consideration

The evidence from the earlier DRC outbreak indicates that community involvement can be weakened when local actors are consulted but have little influence over decisions (Mayhew et al., 2021; McKay et al., 2022) [3, 4]. This has implications for security policy because the delivery of surveillance, treatment and contact follow up depends partly on relationships between institutions and the people they serve.

Public legitimacy should not be treated as a substitute for technical capacity. Nor should cooperation be understood as unconditional acceptance of government authority. People may comply with a measure while distrusting the institution that introduced it, or they may decline a measure because of practical barriers and not because of political opposition. The task for institutions is to find out why cooperation is difficult and to decide whether response practices can address those difficulties without weakening infection prevention. Local leaders, community health workers and other trusted intermediaries can help communicate risks, but their involvement should also include giving feedback that influences decisions. The earlier DRC experience suggests that participation without real influence can leave institutional responses poorly adapted to local concerns (Mayhew et al., 2021) [3].

7.3. Regional Cooperation Should Be Judged by What It

Enables The 2019 Kasese episode shows the value of cross border information sharing when notification is followed by prompt investigation and case management (WHO, 2019, 2021). The 2026 outbreak, meanwhile, shows that the movement of a patient through several countries can create a need for contact tracing and coordinated public health action across jurisdictions (WHO, 2026a).

Together, these episodes support a practical understanding of regional cooperation. The important question is not simply whether Uganda and the DRC take part in international health arrangements. It is whether information reaches the right authorities in time, whether investigations can be coordinated and whether follow up continues when people move between jurisdictions.

Regional cooperation also needs clear responsibility for particular tasks. If institutions exchange information but do not settle who must investigate an alert, contact an exposed person or communicate a finding, the information sharing may have little practical value. These are institutional questions that can be assessed through response records and after action reviews.

The article does not establish that every cross border mechanism in the 2026 response worked well or failed. The available documents support the importance of coordination, but a fuller assessment would need bilateral records, national situation reports and evidence of how specific joint activities were carried out.

7.4. A Conditional Model of Biosecurity Effectiveness

The evidence supports a framework in which the effectiveness of biosecurity depends on how four dimensions relate to one another:

1. Technical and epidemiological capability, including

surveillance, diagnostics, infection prevention and contact follow up.

2. Institutional implementation, including coordination, timely decisions and the ability to keep response activities going.

3. Public legitimacy and cooperation, including meaningful

community participation and the use of local feedback. 4. Cross border coordination, including notification, information exchange and continuity of follow up.

The model is conditional and not deterministic. Strong laboratory capacity may improve detection without solving access constraints. Community cooperation may support surveillance but cannot make up for a lack of diagnostic capacity. Cross border notification may identify a threat, yet its benefits depend on whether the receiving institutions can investigate and respond. These relationships fit the documented demands of the 2026 outbreak and the lessons drawn from the earlier Uganda and DRC cases (WHO, 2019, 2021, 2026a; Mayhew et al., 2021) [3].

The main contribution of the model is to move the focus from whether security arrangements exist to the conditions under which they produce protection. It offers a basis for evaluating outbreak response without assuming that emergency framing, border restrictions or a larger security role necessarily improve outcomes.

The model remains a proposition drawn from documentary analysis and is not a validated predictive theory. Further research using interviews, comparative institutional data and detailed after action assessments would be needed to establish the relative importance of each dimension and to test whether the relationships hold across different biological threats.

8. Policy Implications for Uganda and the DRC

8.1. Measure Implementation, Not Only Preparedness

Uganda and the DRC should judge preparedness using indicators that reflect how things work in practice. These include how quickly alerts are investigated, laboratory turnaround, contact follow up, referral, infection prevention and the continuity of surveillance. The International Health Regulations set obligations for surveillance and response, and WHO's outbreak reports show the value of monitoring specific operational functions (WHO, 2016, 2026a). National reviews should separate the existence of a procedure from evidence that it was carried out. Response targets should also be read alongside geographical coverage, access constraints and the quality of reporting.

8.2. Strengthen Cross Border Operational Arrangements

Uganda and the DRC should keep clear procedures for notifying one another of suspected cases with cross border implications, verifying alerts, coordinating investigations and sharing relevant follow up information. The 2019 Kasese episode is a documented example of the value of timely notification and cooperation (WHO, 2021). Joint preparedness exercises should test specific operational tasks, including the exchange of case information, referral across borders and continuity of contact follow up. Their results should be recorded and used to correct weaknesses that are found, and not treated merely as proof that an exercise took place.

8.3. Give Communities a Meaningful Role in Response

Decisions Community engagement should include ways for local feedback to change how interventions are carried out. The literature on the 2018 to 2020 DRC outbreak indicates that consultation did not consistently lead to meaningful local influence over response decisions (Mayhew et al., 2021; Response teams should record the concerns raised, the action taken and the reasons when a requested change cannot be adopted. This would make community engagement more accountable and would allow later evaluation of whether feedback improved access or cooperation.

8.4. Protect Response Personnel and Operational Access

Health workers need proper infection prevention measures, training, equipment and workable referral arrangements. WHO's July 2026 assessment recorded infections and deaths among health workers in the DRC, which shows the occupational risks of the outbreak (WHO, 2026b). Security support should be organised in ways that protect personnel and keep access to communities open. The earlier DRC response literature warns that heavily militarised approaches can damage relationships when response teams are seen as aligned with coercive authorities (Mayhew et al., 2021) [3]. Decisions about security deployments should therefore weigh both the protection they provide and their possible effects on community access.

8.5. Apply Proportionate Measures at Borders

Border surveillance should be part of a broader system that includes community based detection, accessible health services and reliable diagnostic capacity. The movement of a patient through Uganda to Kenya in 2026 shows the need for coordinated follow up, but it does not by itself establish that a particular border control failed (WHO, 2026a). Measures should rest on documented risks and be reviewed as the evidence changes. WHO's October 2026 advice against restrictions on travel to or trade with affected countries is an important caution against treating broad movement restrictions as the default response to a biological threat (WHO, 2026a).

8.6. Institutionalise After Action Reviews

After action reviews should record what happened, which arrangements worked, where delays arose and which changes were put in place. The WHO review of the 2019 Kasese episode shows how an individual response can be examined for lessons that matter for future preparedness (WHO, 2021). For the 2026 outbreak, such reviews should be carried out once enough evidence is available, and they should separate preliminary observations from conclusions backed by the full record. Findings should be assigned to responsible institutions, with timelines and indicators for monitoring corrective action.

9. Conclusion

The 2026 Bundibugyo virus disease outbreak shows why biological threats need to be analysed beyond the boundaries of conventional public health administration. The scale of transmission in the DRC, the reported cases in Uganda and the cross border travel episode involving Kenya show that managing a biological threat depends on institutional action across jurisdictions (WHO, 2026a, 2026b). The evidence supports a distinction between recognising a threat and managing it effectively. Securitisation theory helps explain why biological outbreaks gain national and international security significance, but institutional performance decides whether that recognition becomes practical protection (Buzan et al., 1998; Wenham, 2019) [2, 5]. Surveillance, laboratory confirmation, contact follow up and operational access give more direct evidence of implementation than emergency declarations alone. The comparison with Uganda's 2019 response shows that cross border notification can contribute to effective case management when it is followed by prompt investigation and isolation (WHO, 2019, 2021). Research on the DRC's 2018 to 2020 outbreak also shows why community participation should be judged by its real influence over decisions and not by consultation alone (Mayhew et al., 2021; McKay et al., 2022) [3, 4].

The main contribution of the article is a conditional framework that connects technical capability, institutional implementation, public legitimacy and cross border cooperation. It proposes that biosecurity becomes a more effective instrument of national and regional security when these dimensions support one another. This does not mean that each factor carries equal weight in every outbreak, and the available evidence does not establish a universal causal relationship.

The conclusions must remain provisional because the 2026 outbreak was still active at the reporting cutoff of 8 October. The documentary evidence establishes the scale of the outbreak and several operational constraints, but it cannot determine the final epidemiological outcome or the independent effect of each institutional factor (WHO, 2026a). For Uganda, the DRC and their regional partners, the practical lesson is that biosecurity should be assessed by the capacity to detect, communicate and manage biological threats while keeping public cooperation and operational access. Border control remains relevant, but it cannot take the place of the institutions and relationships needed to identify cases and sustain an effective response.