Summary

  • As read on 19 October 2026, CERT-MU describes itself as a department under the Ministry of Information Technology, Communication and Innovation and lists dated notices by reference number and class rather than by author.
  • The Cybercrime and Cybersecurity Act 2021 could not be obtained as readable text on the review date, so no function, appointment or ministerial-direction clause can be quoted from it.
  • No document obtained for this review names Kaleem Ahmed Usmani as head of CERT-MU, signs a notice in his name, or attributes a specific decision to him; that role pairing is a claim carried in BTW's own Directory.

A series organised by date and class

The office's own front page, read on 19 October 2026, presents itself in one sentence as "A Department under the Ministry of Information Technology, Communication and Innovation" and then, immediately below, as a running list of dated items (CERT-MU). The three items visible in that read were a Vulnerability Note, VN-2026-10, dated 17 September 2026 and concerned with Docker Sandboxes; an Advisory, AD-2026-03, dated 30 June 2026 and concerned with Cisco Identity Services Engine; and a Security Alert, SA-2026-05, dated 1 October 2026, about fraudulent property advertisements on TikTok.

That is a specific editorial form. The numbering separates three document classes — vulnerability note, advisory, alert — and the dates spread across four months, which means the pattern is recurring rather than a single campaign. A reader can reconstruct the office's output cadence from the front page alone: roughly one notice per class per cycle, each dated, each carrying a reference that encodes year and sequence.

What the same read does not supply is equally specific. There is no named head, director or duty officer on the page. There is no byline, no signature block, no "issued by" line, and no contact attribution inside the notice titles. There is no caseload figure, no incident count, no response-time statistic and no annual report on the material read. The absence is not a gap in one page; it is the consistent shape of the published surface.

The instrument that could not be read

The Cybercrime and Cybersecurity Act 2021, as hosted by the National Assembly, is the instrument a reader would ordinarily consult to learn what a national computer emergency response team is empowered to do, how its head is appointed, and what the minister's direction reaches. On 19 October 2026 that document did not resolve into readable text: no section number, no list of functions, no appointment clause and no ministerial-direction clause was obtained from it (Cybercrime and Cybersecurity Act 2021).

This matters because it removes the layer that would normally anchor a person-level finding. Without the text, a briefing cannot say that the office's head holds a statutory office, cannot say the appointment is made on stated criteria, and cannot say the minister may or may not direct the office's technical judgments. Any of those statements would be an inference from the office's existence rather than a reading of the instrument. The absence is recorded here as a property of the record on a stated date, not as a comment on the legislature, the ministry or the office.

A further probe of the office's own site for an archive index, an annual report or an incident-statistics page produced no readable text of that kind either (CERT-MU archive). So the record available for this review consists of a departmental self-description and three dated notices. That is a thin base for any claim about institutional performance, and it is a thin base for any claim about an individual's control.

Where the role pairing actually lives

BTW's Directory records Kaleem Ahmed Usmani as holding the role of Head of CERT-MU. That record is the origin of the pairing examined here, and it is a claim in a directory rather than a quotation from a first-party role notice. The review set out to test it and did not confirm it.

What the review found instead is narrower. No document obtained named him as head of CERT-MU. No notice in the published series was signed by him or attributed to him. Nothing tied a specific technical decision — the choice to publish a vulnerability note on a container-sandbox flaw, the timing of an advisory on an enterprise identity product, the framing of a consumer-fraud alert — to any identifiable officer of the office.

That result should not be read backwards. It does not show he does not hold the role. It does not show the office conceals its leadership. It shows that the published record, as read, separates the office's output from the person entirely: the institution speaks in dates and reference numbers, and the question of who decides is left to other kinds of record — an appointment instrument, a gazette notice, a staff list, an annual report — none of which was obtained here.

Why this is an accountability finding and not a biography

The point of the record-silence is not that a man is invisible. It is that a reader who wants to hold someone answerable for a national cyber-response function has, on this evidence base, nothing to hold. The notices are dated and citable; the office is named; the responsible human being is not identified anywhere in the chain.

That asymmetry has consequences for how the office's output should be read. Credit for a timely advisory cannot be assigned, and neither can blame for a missed one. A briefing that praised the office's cadence would be describing a publication schedule. A briefing that criticised a gap would be describing an absence in a page, not a failure by a named decision-maker. Both moves would convert an institutional surface into a personal judgement, and neither is supported.

The honest formulation is layered. The record says: three dated notices, three reference classes, a departmental self-description, in the four months to 1 October 2026. The record does not say: who heads the office, who approves a notice, what the statute assigns, or how many incidents were handled. The institutional narrative asserts, through the department line, a ministerial parentage that the instrument itself was not read to confirm. And what cannot be established from this evidence base is whether the role premise, the statutory power and the personal attribution would all survive a full documentary read.

The next step that would change the picture is documentary rather than analytical: a readable text of the Act, or any first-party notice naming an accountable officer, would convert the pairing from a directory claim into a checked fact. Until then the finding stands as dated and bounded, and the subject of this briefing remains, in the record as reviewed, a name without a signature.