In September 2020, Lieutenant-Colonel Kinnear, who was investigating corrupt cops involved in a firearm licensing racket with links to organised crime, was assassinated outside his home in Bishop Lavis. 

A lone gunman, who is still at large, pulled the trigger. At whose behest is still to be determined by the courts. Alleged underworld player Nafiz Modack, whom Kinnear was investigating, currently faces murder charges alongside others.

Kinnear’s assassin(s) had illegally used a cellphone tracking location-based service, known as a “ping”, to monitor his every move. 

There was a 24-hour, on-duty killer in Kinnear’s pocket, in other words.

Many aided and abetted the dedicated officer’s death, including those who make the technology available and fail to curb its abuse.

The 61-page extensive Ipid investigation into Kinnear’s murder found that members of the DPCI in Gauteng “had failed to initiate a criminal investigation into the illegal monitoring of the late Lieutenant-Colonel Kinnear’s cellphone as the investigation revealed that the DPCI had knowledge of the person or particulars of the person or persons involved in the illegal monitoring of the late Lieutenant-Colonel Kinnear’s phone/movement”.

Hawks officers did nothing to prevent Charl Kinnear assassination, should be criminally charged – SAPS watchdog

The owner of a company that in effect sold “pings” to those who tracked Kinnear had corroborated this. This businessman, noticing the consistent tracking of Kinnear on 3 September 2020, allegedly alerted a warrant officer in Gauteng as he had feared Kinnear was in danger. 

And he was. In mortal danger.

While the DPCI and SAPS twiddled their thumbs (and Ipid has suggested criminal charges at the highest levels be lodged for this), Kinnear’s killers used technology to corner him outside his house, in front of his wife and sons.

Kinnear’s phone had been pinged 2,116 times in the months leading up to his assassination.

After Kinnear’s murder and the arrest of private investigator Charl Kilian, it was revealed that millions of South Africans were exposed to being tracked by two-bit investigators, jealous spouses and criminals through the tracking of the phones of the police and private individuals.

Before all this, back in November 2016, Ipid investigator Mandla Mahlangu, who was probing acting National Commissioner Khomotso Phahlane (since dismissed and facing criminal charges), received a message on his cellphone.

It was a death threat.

In February 2017, Mahlangu received a second threat. Analysis at the time indicated that the “initial handshake” of the cellphone used to send the ominous warning occurred “in close proximity” to a tower situated in Erasmuskloof, next to the Crime Intelligence head office.

In 2018, before his assassination two years later during an alleged “botched” break-in at his plot east of Pretoria in March 2020, Mahlangu had opened a case of defeating the ends of justice against Brigadier Tlou Kgomo.

Kgomo had transferred out of Ipid when executive director Robert McBride returned from exile in 2016 after his illegal suspension.

Mahlangu had recorded a call wherein an offer was made by Kgomo of promotion to a brigadier in the SAPS in return for Mahlangu’s implicating Ipid management in “wrongdoing”. This to neutralise McBride and the investigation into Phahlane.

Mahlangu was murdered days before he was to testify in the departmental disciplinary hearing against Kgomo that March. 

An assassin and two accomplices were arrested in April 2020 and allegedly confessed that the orders had come from within SAPS ranks and that R50,000 had been the price.

No doubt who the killers spoke to and when this will be triangulated and given as evidence in court.

What all these crimes, and others, prove is that the same technology that can be deployed to expertly plot a murder, or any other crime, can be turned against those who commit it.

The technology allows for the mining of an irrefutable record, a body of hard evidence of who was where, when, and who spoke to whom.

An affidavit submitted to the Zondo Commission on 1 September 2021 sets out exactly how cellphone networks can be used to triangulate your every move, every second of your life.

Former Ipid investigator Thereza Heather-May Kunneke (formerly Botha), a senior intelligence analyst and former acting deputy director with Ipid and the SAPS, submitted the affidavit to set out exactly the movements of a bevvy of senior police officers, led by Jan Mabula of the North West, who plotted to thwart an Ipid investigation into Phahlane.

Kunneke was singled out later and suspended from Ipid after McBride’s final bid to secure a second term as Ipid director was illegally thwarted by Police Minister Bheki Cele.

She has 22 years’ worth of experience in the DPCI, the SAPS, Ipid and now a private firm.

Explaining the technology, Kunneke noted that in South Africa a cellphone, unlike a hand-held, two-way radio transmitter, received and transmitted radio signals through a phone network operated by either Vodacom or MTN.

When a cellphone is activated, it automatically logs on to the relevant network, depending on the SIM card installed in the handpiece. (SIM is an acronym for Subscriber Identity Module.)

This SIM card carries the cellphone number assigned to the user of the handset. 

“Technically, the SIM card securely stores the Service Subscriber Key (IMSI) used to identify the subscriber on a cellphone telephony device once it is turned on. The relevant network immediately authenticates the validity of the SIM card and the handset,” Kunneke set out.

The network then establishes whether you, the subscriber, have enough “credit” in relation to the contract with the network, or whether sufficient airtime has been purchased.

The purpose of the authentication of the handset is to establish whether it has been blacklisted in the case of theft, she noted.

This authentication, referred to as a “handshake”, is performed by the network’s central database or “core network”.

“The communication between the cellphone and the core network takes place through a network of cellphone towers usually located some considerable distance apart alongside major roads in rural areas and relatively closely spaced and widely spread in urban areas – the purpose being to effect cellphone service coverage as fully as possible.” 

In rural areas, the radio signal, or beam, usually has a 360 degree spread. In other words, the signal is directed omni-directionally. 

In urban areas, towers are usually “sectorised”, meaning that radio beams are directed in a specific compass direction at a spread of 120 degrees, “i.e. the signal speak is in the direction where cellphone signal coverage is required for a specific urban area”.

The signal power of towers in rural areas is generally stronger and reaches further than towers in urban areas. The signal or beam reach of towers in rural areas can be up to 32 kilometres.

“Where the caller or receiver is within the signal spread or reach of two cellphone towers, the closest will pick up and process the call.”

When a cellphone is switched on and authentication takes place or a call is made, radio signals pass between the cellphone and the cellphone tower which carries the strongest signal, usually the tower closest to the location of the cellphone and the person using it. 

In turn, the tower transfers the signal to the central database of the network by means of landline cables. 

The reverse occurs between the base and the cellphone during the authentication process. 

“In the case of a call being made, the central database forwards the call signal to the tower closest to the cellphone being called. Where the latter is on the move, for example in a motor vehicle on the road, the tower through which the call signal is received and transmitted to the cellphone being called will continue to transmit the signal and the receiving cellphone will continue to receive the call until the outer limit of the towers range is reached.”

At this point, she noted, the call was immediately “and without interruption handed over or transferred to the next closest tower further along the road”. 

The exchange of signal between the central database and the call-transmitting cellphone and call-receiving cellphone was constant, said Kunneke.

“In a sense, the central database of the network will constantly know the location of both the cellphone caller and the cellphone called, provided they are within signal range of a cellphone tower.”

The area where one tower’s radio signal spread and reach ends, and another’s spread and reach begins, is known as the “equal power boundary”. 

“Those boundaries may overlap, in which case any cellphone call made or received in that area will be picked up by the tower which is closer to the cellphone and has the stronger signal.”

In such instances, the record of the call reflected the detail and location of the tower through which the call was initiated. 

Where the caller and the cellphone moves out of the signal range of a tower prior to the signal range of the next tower being entered, the call will end.

“To reconnect, a new call will have to be made. The record of this reconnection will reflect the location and detail of the tower through which it is initiated by means of the new call.”

While Vodacom and MTN had their own towers, “occasionally a cellphone tower is shared between the two networks, but as each network has its own designated radio frequency range, the call data of each remains its own and cannot at all be mingled with the data of the other network.” 

All calls made and received through the Vodacom and MTN networks are separately recorded, and the caller and receiver, the location of each, the time and duration to the nearest second of each and every cellphone call, are recorded and stored. 

There you have it.

The cellphone data, she said, could be used to identify where the cellphone was at specific points in time and with which cellphone it interacted.

And so it was that Kunneke set out exactly who it was who came and went from Phahlane’s home as well as that of other senior SAPS members implicated in protecting the acting commissioner and his coterie of protectors who are all now facing criminal charges.

There they were, one after another, not only signing into guestbooks, but calling across provinces to initiate the counteroffensive against Ipid.

Deputy Chief Justice Raymond Zondo is due to soon hand over to President Cyril Ramaphosa Part 1 of the State Capture Report. 

While it may not cover the depth of the rot in the SAPS or law enforcement in general in the sprawling web of corruption and repurposing of the state as testified to at the Zondo Commission, Kunneke’s affidavit and the irrefutable testimony of the cellphone towers which don’t lie is bound to make its way to the NPA’s Independent Directorate (ID) and whoever will find themselves leading it to add to the bubbling pot. DM