Jeremy Seekings is Professor of Political Studies and Sociology at the University of Cape Town.

The extraordinary speed at which events have unfolded over the past two weeks has made it difficult to discern patterns in the mayhem. If the government has detailed intelligence or even basic information on the “unrest” — which might back up its allegations about the conspiracy behind the failed “insurrection” — then it hasn’t shared this with the media or public. The intelligence services and police certainly give the impression of cluelessness.

A preliminary examination of the chronology of reported events, however, suggests some patterns. Specifically, the disorder escalated through a series of phases. These can be simplified into two broad phases: in the first, lasting about 72 hours from Thursday through to Sunday (8 to 11 July), direct action appears to have been widespread but limited, only slowly escalating into violence. Despite the absence of explicit demands or grievances, these actions appear to have been parts of a coordinated strategy to disrupt KwaZulu-Natal and later parts of Gauteng in protest against the jailing of former president Jacob Zuma.

The second phase, from Monday through to Wednesday or Thursday (12 to 14/15 July, in different parts of the region), entailed mass looting and selective arson against a wide range of shops, warehouses and other facilities. While the first phase appears highly coordinated, there is insufficient evidence to assess how much coordination or centralised instigation there was in this second phase. It is possible that the second phase entailed primarily opportunistic copycat looting, whether by criminal networks or the public.

If this analysis is correct, it helps to explain both the government’s initial complacency and its belated embrace of more comprehensive containment (through both military deployment and the endorsement of private, community-based vigilantism). The government may have been complacent at first because it believed — perhaps correctly — that the police could contain the road blockages that characterised the first phase. It was only when the second phase erupted that it became clear that the police were incapable of containing disorder (and in some cases, it has been alleged, were fearful of leaving the safety of their police stations).

Even if this two-phase analysis of the government’s response — as well as of the disorder itself — is correct, it raises at least one important question: why did the government and its security forces not take more effective action against the limited protests in the first phase? Why did it fail to contain these? As we shall see below, key flashpoints could and should have been predicted and the escalation through the first phase and then into the second phase could have been predicted.

Disrupting KZN’s roads

Zuma surrendered himself to the police on the night of Wednesday/Thursday, 7/8 July. The Constitutional Court had ordered him to hand himself over by or on the previous Sunday and had ordered the police to arrest him by the end of Wednesday.

The first protests were reported in the late afternoon on that Thursday: pro-Zuma protests closed the N2 and R102 in the KwaDukuza (formerly Stanger) and Ballito area on the KZN north coast (according to the Twitter feed of Rob Beezy, @TrafficSA, which is an invaluable source for road closures).

The next morning (Friday, 9 July), widely retweeted messages stated that blockades would begin at 8am as part of a “Shutdown KZN” operation. #FreeJacobZuma and #KZNShutdown trended on social media. While calls to shut down roads were evident, it is unclear how widespread (at this time) were calls for factories, government services and shops to be shut down. Whether or not there were calls, there were few reported attacks on buildings on the Thursday and Friday.

Protests proliferated through Friday morning. From about 5am, protesters burnt tyres on the N2 near Umlazi (on the south side of Durban) and Umhlanga (on the north side), but it seemed that the roads were not yet blocked. At 6am, Beezy warned motorists of road closures “at multiple locations across the province”. Details followed in rapid succession: the R34 at Empangeni, Umgeni and Alpine roads in north Durban, the N2 at Umgababa, the M4 south of Ballito (again), the N3 between Assagay and Hammarsdale. Protesters — perhaps in quite small numbers — appear to have burnt tyres and wood. The police seem to have reopened some of these roads quite quickly. Images of these protests do not suggest that there were placards showing grievances.

That morning, Pietermaritzburg High Court Judge Bhekisisa Mnguni rejected Zuma’s application to delay his imprisonment.

Almost immediately a new form of direct action appeared. Hijacked trucks were used to block several major roads out of Durban, at Mandeni (on the North Coast), the M27 at Verulam, the N2 at Richards Bay and perhaps elsewhere also. The trucks were abandoned, but not torched. Protesters also tried to block roads using burning tyres, including the N11 outside Ladysmith and the N3 between Durban and Pietermaritzburg (north of the Mariannhill Plaza).

The simultaneous use of hijacked trucks suggested a much higher degree of coordination than social media alone.

On the Friday evening, there were the first reports of trucks being burnt on the N3 next to Bruntville township at Mooi River. Some of the people involved reportedly wore ANC T-shirts.

In the early hours of Saturday, burning trucks also blocked the N2 north of Richards Bay. Later, trucks were reported to have been looted and burnt on the N3 near Howick and on the N121 near Newcastle.

Throughout Saturday, many more roads were closed using burning tyres: the N2 at several points south and north of Durban, several major roads in north Durban, and the N3 between Ladysmith and Van Reenen’s Pass.

The hijacking and later burning of trucks are well-established elements in the repertoire of direct action — encompassing elements of crime and protest — in South Africa. In 2019 and 2020, more than 1,200 cases were reported of trucks that had been hijacked. Trucks have also been burnt as part of focused campaigns.

Burnt out trucks in Durban, KwaZulu-Natal on Monday 12 July 2021. (Photo: Supplied)

Mooi River itself was the site of a series of attacks on trucks in 2018 and 2019. In one of these incidents, in April 2018, 18 trucks were torched and another 17 damaged; the N3 and R103 were briefly closed. Attacks on trucks continued through 2019 and into 2020. Government ministers later stated that 84 attacks had been recorded between April and November 2020. In November 2020, 18 trucks were torched at different spots along the N3.

The 2020 attacks were linked to a xenophobic organisation that on other occasions has acted in concert with the Umkhonto weSizwe Military Veterans’ Association, itself closely aligned with Zuma. The government was well aware of this: President Cyril Ramaphosa himself deplored the attacks on trucks and established a ministerial task force; his minister of police (Bheki Cele) even admitted that the government was considering the deployment of the army.

Burning tyres, hijacked trucks and burning trucks were all entirely predictable activities as part of any attempt to shut down KZN. Moreover, the police should have known and been present at the sites where this was most likely to take place, including Mooi River.

Direct action begins in Gauteng

During the first 48 hours of protest, there appears to have been little looting. Direct action was focused on roads, not on shops or other buildings. While participants in most of these actions did not appear to have placards or to communicate grievances or demands in any other way, it seems appropriate to describe them as “protests”.

The first reported actions in Gauteng appear to have been on the afternoon of Friday, 9 July, when tyres were burnt on the N3 next to Spruitview (Katlehong) and Vosloorus. Disruption appears to have been minimal. The first significant action was on Saturday evening. First, several hundred people — apparently from the Denver Hostel — closed the M2 highway adjacent to the hostel.

When police dispersed them, they reportedly moved into the neighbouring areas of Jeppestown and Malvern, where they looted and burnt shops. Instructions appear to have circulated on social media. Shots were reportedly fired at motorists on the M2 from the Denver and Cleveland hostels. Also on Saturday night, looting began in Alexandra, near the Pan African Mall. A large crowd attacked — and shot at — police.

A member of a private security company points his rifle at a taxi after pushing back protesters in Jeppestown, Johannesburg, on 12 July 2021. (Photo: Shiraaz Mohamed)

The four hostels in downtown Johannesburg (Denver, Cleveland, Mai Mai and Wolhuter) are well-known sites of violence, not only in the 1990s, but recently also. Just two years ago, in September 2019, Minister of Police Cele blamed violent attacks and looting of foreign-owned shops and stalls on hostel residents, most of whom are from KwaZulu-Natal.

Mangosuthu Buthelezi travelled to Johannesburg and called on hostel residents to desist from xenophobic attacks, but they ignored him and, after his address, went on another rampage, during which South African-owned shops were also ransacked and two more people were killed. Hostel residents may have been behind similar xenophobic attacks in Alexandra, Tembisa, Katlehong and elsewhere around Gauteng at that time.

Two years on, in July 2021, the hostels appear to be linked closely to the #FreeJacobZuma and #ShutdownGauteng campaigns. On the Sunday — as the M2 remained closed — a prominent supporter of Zuma (and former radio presenter), Ngizwe Mchunu, spoke to hostel leaders near the Mai Mai hostel. Mchunu reportedly warned that if Zuma was not released, “hell will break loose”. Looting appears to have extended up the hill into Hillbrow and elsewhere.

Again, the mobilisation of Zulu migrants in hostels around Johannesburg and parts of the East Rand was an entirely predictable activity as part of any effort to extend disruption beyond KZN. The police should have been prepared for this.

The shift to looting and burning shops, malls and other buildings

A residents flees from police after sporadic looting at Letshoho Mall in Katlehong. (Photo: Felix Dlangamandla / Daily Maverick)

That evening — Sunday, 11 July — Naledi Mall in Vosloorus was looted and vandalised (and later torched). The Naledi Mall is less than a kilometre from the historical  “Zulu” hostel in Vosloorus. The Cambridge shopping centre in Vosloorus was looted on Sunday night. Elsewhere on the East Rand, Daveyton Mall and some shops in Germiston were looted or torched. Stores at Goldspot were looted. These appear to have been the first attacks on malls. The mall was set alight early on Monday morning. Shops in Benoni were also looted, reportedly by hostel dwellers. Hostel residents were involved in several of the attacks on malls in Soweto and elsewhere over the following days, even as very large numbers of other residents participated eagerly in looting. Migrants from KZN in Johannesburg’s hostels appear to have been integral to this initial escalation of direct action in Gauteng.

The looting of Naledi Mall in Vosloorus marks the transition in Gauteng from the first phase of focused disorder to a second phase of massified disorder.

In KZN, also, some looting of shops seems to have begun on Saturday night, but these appear to have been localised attacks on small shops (and in some instances trucks), as in downtown Johannesburg. The blockage of roads remained the primary feature through the day on Sunday. It appeared that the police were beginning to contain the disruption. For example, the N3 was reopened, despite burning tyres at various spots (including Estcourt). By Sunday evening, however, the N3 was again closed due to fires and later burning trucks at Mooi River and blockages around Pietermaritzburg.

The disruption of roads spread outside to parts of Mpumalanga on the Sunday. Trucks were used to block the N12 at Ogies, the N11 near Middelburg and the N4 at eMalahleni. Burning coal trucks were reported on the N12 at Ogies on Sunday evening.

It was on Sunday night that direct action in KZN, as in Gauteng, shifted with the marked escalation of looting. Shops were looted in the Durban city centre, Springfield and Overport (Durban), as well as in Tongaat, Verulam and Amanzimtoti on the North Coast. By 7am on Monday (12 July), Brookside Mall in Pietermaritzburg was on fire. Later on Monday, a shopping centre in Springfield (Durban) was also torched. Shots were fired and a metro police officer wounded when the Westwood Mall (in Westville, Durban) was attacked. Toll plazas and other facilities along the N3 were looted and burnt. The N3 was closed north of Pietermaritzburg. As the looting of shops spread — and other buildings, including a mosque in Durban’s Mayville — were burnt, residents began to defend themselves.

In both Gauteng and KZN attacks on malls and warehouses proliferated rapidly. Around lunchtime on Monday, Jabulani Mall in Soweto was looted after a hijacked (Pikitup) rubbish truck was used to smash through the gates and brush past the metro police; the SAPS was nowhere to be seen. The initial target was the liquor store, but by early afternoon thousands of residents were engaged in looting that continued into Tuesday morning.

In KZN, shops, malls and warehouses were attacked. The geography of much of KZN — with shack settlements and townships close to malls, warehouses and factories — facilitated attacks, whereas in Gauteng most looting was confined within townships. Attempts were even made to attack shops in middle-class residential neighbourhoods in Durban and elsewhere in KZN. In the absence of self-defence, shops were looted and burnt — including in Glenwood.

Umbilo community patrollers gather around a fire on Tuesday 13 July 2021. (Photo: Des Erasmus)

By the end of Monday, direct action was firmly in its second phase of generalised attacks on shops (including pharmacies), warehouses and factories, and even clinics, crematoria and schools. Whether or not some of these attacks were instigated, they clearly attracted both criminal gangs (after alcohol and high-value goods) and huge numbers of local residents. As the Sunday Times editorialised (on 18 July), looting was “how real freedom tasted”. Des Erasmus (in Daily Maverick, 12 July) put this well earlier in the week, reporting on the residential areas of lower Glenwood and Umbilo, in Durban: “‘Amandla!’ shouted one young woman, punching a slim fist into the air as she tried to balance a trolley full of booze while trotting down the road. ‘Amandla, amandla,’ she giggled, visibly drunk.”

How do we understand the government’s apparent understanding?

The government presents the disorder as an attempted insurrection, apparently by disaffected factions within the ANC. But efforts to identify instigators do not inspire confidence in the quality of the state’s “intelligence”. The president and some of his ministers acknowledge that mistakes were made in the first days of disorder. But they are reluctant to be specific about these errors.

William Gumede suggests that the slow police response might be deliberate inaction rather than incompetence. Certainly, the failure of the SAPS to respond to the generalised looting and arson in the second phase constitutes inaction, but it is not clear that this inaction was strategic (ie based in disloyalty to the president and the dominant factions within the ANC) as opposed to being based in fear: academic studies of the SAPS have suggested that many police officers routinely avoid the settings where most violence happens.

In the first phase, however, the police were not entirely inactive. They did manage to reopen the N3 and other roads for periods, clearing burning barricades and dispersing protesters, even if only temporarily. They could and should have done much more, with a more sustained presence at those sites where disorder was most likely to occur (including the N3 at Mooi River and elsewhere). Had they done so, it is possible that the protests would not have escalated into a second phase.

When the second phase of looting and arson erupted, from Sunday evening, the police lost all control and apparently all will to regain it. As has been widely recognised, the president then deployed too few soldiers too slowly. In many neighbourhoods, residents organised their own protection. Malls, factories and warehouses outside of residential areas were especially vulnerable to looting and arson.

Disorder may therefore have entailed both an attempted and coordinated insurrection (in the first phase) and a general orgy of looting and arson (in the second phase). If so, the government must explain both its failure to anticipate and contain the predictable activities in the first phase and its failure to deploy large numbers of soldiers as soon as disorder shifted into a second phase on the Sunday evening. DM