It’s the night before Christmas for the thieves. Tomorrow, on 13 July 2021, looters will strip bare the Massmart warehouse on Queen Nandi Drive in Durban. But tonight, a band of men secretly break into the facility, shut off the CCTV cameras and escape with survival gear.

“Tents, generators, stuff you need to live rough for weeks,” explains a source in the security sector with knowledge of police operations who spoke to us on condition of anonymity. Then, the source says, word went out on WhatsApp that the building was unguarded and open for business; chaos ensued on the 13th as looters ransacked the store, carrying off large appliances by the truckload in broad daylight. With all the attention on the blatant looting, the theft of the previous evening went unnoticed. 

Three independent sources with ties to the police, the Hawks and the State Security Agency told us about the quiet break-in. Sources explained that it was one of five events that took place around the time of the 2021 unrest that were probably aimed at laying the groundwork for a future insurrection. The 2021 looting, says the security sector source, was a “dry run”, and the thefts that took place during the riots were a part of gathering supplies and weapons to equip a small army.

Cash and guns, ammo and comms

The first event took care of the gear.

Event number two was all about the guns: two containers of AK-47-type rifles not destined for South Africa went missing during the chaos that ensued at the Durban harbour when Transnet suffered a cyberattack, sources say. A source with ties to state intelligence explained that the rifles utilised 7.62mm rounds similar to those used in the Russian AK-47 and its Chinese knock-off, the Type-56. Those guns are yet to be found, but, said an intelligence specialist with ties to the public and private security sector who also confirmed the theft, “I’m telling you: those guns are in KZN.”

Number three: The bullets. More specifically, the million-plus rounds of ammunition stolen during the July 2021 riots after it was moved, under suspicious circumstances, to a depot near the Durban harbour with scant security measures in place. According to the sources, the vast majority of the bullets still haven’t been retrieved, despite numerous media reports. “Where’s the manifest? If they had retrieved them, the photos would have been on the front page of every newspaper.”

The intelligence specialist also said that the bullets were still in circulation. 

Number four: The comms. During the 2021 looting, several radio stations were stripped bare of their equipment. On the surface, this might seem like straightforward looting, or an attempt to disable communications within the community and disrupt daily life.

But there’s a more sinister element, explains the intelligence specialist. The looters also made off with repeaters — devices that capture fading radio signals, boost them, and then transmit them again.

See: South Africa’s darkest eight days in 19 terrifying photos 

They are necessary to communicate over long distances and could be used to set up an alternative communications system — exactly what insurrectionists would need if the government shuts down the major providers’ cellular and fixed-line networks. And, explains the source, disabling communications infrastructure is a common technique used by guerilla fighters in Africa.

But, says the security sector source, another scenario is far more likely, since setting up your own communications network is an intricate process that may be overly visible. The repeaters could more likely be used to tap into the police’s encrypted radio communications over the Tetra system. That would give insurrectionists a bird’s-eye view of the police actions. 

And, finally, number five: The cash. Around the time of the riots, R120-million in cash was stolen from more than 1,200 ATMs in just one week. That money still hasn’t been retrieved, sources say. Of the massive operation, the source in the security sector says: “They [the ATMs] were bombed, ripped out of the wall. What you have is enough cash to pay an army.” 

All of this, our sources say, points to one thing: An organised insurrection driven by guerilla tactics. “It’ll only take the slightest spark now,” says the intelligence specialist.

That, says the source in the security sector, is because strike season, the rising petrol price, Eskom outages, power struggles in the ANC, and former president Jacob Zuma’s upcoming trial in August are all converging to form a political pressure cooker:

“We’re on a knife’s edge. We’re a country on the verge of tearing itself apart.”

The gift of cadre deployment 

The stolen guns and ammunition, say sources, indicate some level of organisation at play. A former employee of a major shipping company with knowledge of the South African port environment explained that if the containers’ arrival at the harbour was illegal, it must have been carefully orchestrated. 

“You need a logistical structure and custom and clearance agents’ cooperation. I remember these guns going missing. It had to have been with the assistance of whoever despatched the weapons and Transnet agents in the harbour. You need quite a few parties working together. It wasn’t an impulsive theft.”

According to the source in the security sector with knowledge of police operations, the movement of the container of ammunition to a non-secure depot indicates that someone from within the SAPS’s ranks was involved.

The intelligence specialist explained that weapons are normally smuggled into the southern African region through Cabo Delgado in Mozambique, but with the Isis terror campaign in the north of that country, the port had garnered unwanted attention. The result is that Durban became an alternative entry point. Those benefiting from this type of smuggling are terror groups and highly placed government officials.

But the people who shipped the weapons and ammunition to South Africa, whether legally or not, aren’t necessarily those who took them; the original senders may have been one-upped by the thieves, as one risk analyst explained.

“The fact is, even if it is a legit import, key people have been placed through cadre deployment in key posts all over the place, and with the breakdown of the ANC into two factions, at least half of those people are with the one side and half with the other. So there are people inside key entities like ports, airports and border posts, who have a clear line of sight and control over things that are happening. That’s an issue.

“We’ve got insider threats in National Key Points and in key infrastructure entities all over the place. That’s the gift of cadre deployment and the meltdown of the ANC that created this toxic issue.”

And, says the source, it’s a “legacy” problem, not easily solved: “You can’t just fire everybody. You’ve got to actually prove they’ve done something wrong. You can’t just fire someone because you know he’s a Zuma man. Cadre deployment worked for them when the ANC was of one mind. But now they’re at war with each other. Literally.”

The source in the security sector agrees, remarking that during Zuma’s tenure, the Cabinet ballooned. “He basically cut several ministries in half. That’s twice as many ministers, twice as many deputies, twice as many DGs — twice as many people who have to kneel down and kiss the ring.”

The security sector source and another person in the security industry with inside knowledge of state intelligence operations believe that it would have been government insiders who deliberately allowed the movement of containers from the Durban harbour to locations with less stringent security where they could be easily stolen.

“It doesn’t say ‘guns’ on the outside” of the container, explains the security sector source, and added to that, says the source close to state intelligence, they are stored amid dozens of other containers. However, an insider would know what to look for. With all the hallmarks of an inside job, the theft points to a division within the ranks of state officials responsible for the cargo’s safety, the sources say. It’s a division along the factional lines of the ANC: those for Zuma, and those against. This division is not only probably within the Transnet staff, but also within the police and the State Security Agency, the sources say.

It’s this division that very likely led to the event that would have made possible the alleged weapons theft: the cyberattack on Transnet’s port systems in the Durban harbour. (During the hack of Transnet’s systems, the management of freight containers was in disarray, and processing slowed down drastically.) All of our sources are convinced that the correlation of events was no accident, but rather specifically orchestrated to facilitate the theft of the weapons. But the hack doesn’t necessarily point to insurgents with sophisticated cyber capabilities; rather, it’s likely to be another inside job.

A cybersecurity expert who spoke on condition of anonymity explained that the hack could be due to the simple installation of malware purchased from one of many “hacking-as-a-service” outlets — people selling computer viruses to those unable to brew their own. Placing it on a USB stick and getting an insider to do the job is “easy as pie” says the expert. “Have you ever been asked (upon entering a building) if you’ve got a USB in your pocket? No. Better still, have a workshop on the ground floor and hand out a free branded USB stick to everyone as part of the swag for the day. You don’t have to hack your way into a system. Just hand out some free stuff.”

In this way, an insider would easily have been able to plant malware. The risk analyst explains that this is a realistic scenario given Zuma’s background and connections in intelligence, and estimates there is a high likelihood that supporters of Zuma and the Radical Economic Transformation (RET) faction would have been involved in such actions, even if attribution of the attack is near-impossible due to the opaque nature of cyber warfare.

“They [the RET faction] will have their sleepers all over the place. Those guys, because of cadre deployment, are sitting in every single key state infrastructure entity, from Eskom to Transnet, to all over the place. When they were appointed in the early 2010s, Zuma’s camp was in charge and they were put into key positions.”

Blunt force, with a chance of sophistication

Despite the level of organisation displayed with the stolen gear and guns, a coup — which is defined as a government being removed with the help of its own military — is highly unlikely, according to our sources. There are several reasons for this. For one, the risk analyst said, President Cyril Ramaphosa has made some deliberate moves to gain control over the military and security services.

“He put Thandi Modise in there [as defence minister] when he changed his Cabinet. He’s brought the minister of state security into the Presidency.” Says the intelligence specialist: “Ramaphosa has put his greatest confidants in charge of the military.”

To boot, says the analyst, the military still has a culture of loyalty to the commander-in-chief — the democratically elected president. “There was a lot of talk, in 2017, that the generals went to tell Zuma, ‘Look, you need to stand down.’ There was talk that Zuma had an idea that the generals would back him up. And they didn’t. Military discipline is a big thing. I think there are a lot of senior officers in the SANDF who just want to do their job.”

Rather, all our sources agree, an insurrection is highly likely. Whereas a military coup requires precision and a near-instant transition of power, an insurrection is a blunt-force instrument aimed at destabilising a country over a period of time to gain leverage to force the government to negotiate with you. And a repeat of last year’s events is bound to be more violent and involve more firepower.

The intelligence specialist maintains that Zuma would use intelligence and guerilla tactics to make the country ungovernable. Says the risk analyst: “You manipulate the population into doing your dirty work. You stay behind the scenes, and you have plausible deniability, and there’s no clear attribution — a clear trail can’t be proven. And that’s exactly where we are, after last year’s insurrection.” Adds the intelligence specialist: “The 12 that were arrested for organising the riots — they were [part of the] RET, but they’re just pawns.”

According to the source with knowledge of state intelligence operations, the looting of 2021 was an example of manipulating ordinary people (who aren’t in any faction) to serve your political purpose. Many of the looters only stole food: “Our people are hungry. There are millions of people who go to bed hungry, tired and cold every night in this country.”

This destabilisation, says the source with knowledge of state intelligence, has one simple goal: Keeping people out of jail, especially Zuma. “Zuma is extremely powerful. People don’t realise this.”

Read more: South Africa’s July riots and the long shadow of Jacob Zuma fall over party and state

His incarceration in 2021 all but assured an insurrection, says the source. And now, with the Zondo Commission’s reports into State Capture released, there is even more at stake.

Says the risk analyst: “Already on the table, you’re beginning to see talk about amnesty for State Capture people because we need to move on and we need stability.

“These guys will take us all down with them rather than go to the slammer. To stay out of jail — that is the goal.” And, says the security sector source, things aren’t looking good for the National Prosecuting Authority (NPA) anyway: “Zuma knows where all the bodies are buried and he’s got the shovel. The NPA has to decide: How far down the rabbit hole do they want to go?”

They were warned

The government, thus far, has been slow to react to warnings from observers in the security field. It’s a near-repeat of their reaction last year, explains the security sector source.

The source says that private intelligence firms constantly observe the security situation in Africa; they are paid by large corporations that want to protect assets. These observers knew that the riots would happen in July 2021. But the government wouldn’t listen.

According to one such observer, they had warned the government several “months before the riot” with multiple reports, but to no avail: “There were more than enough red flags.”

According to the source with knowledge of state intelligence operations, the government was warned as early as March, yet did nothing: “They told them not to lock up Zuma.” The source in the security sector also says that private sector security firms warned the government, but to no avail: “The government waited until KZN was burning.”

Read more: July looting panel confirms what we knew: SA was failed by the ANC, government and security cluster

The government’s response to a new insurrection is anything but coordinated.

This time around, sources say things are not looking much better; police are still outmanned, outplanned and outgunned. Says the intelligence specialist: “Even if we had 10,000 extra policemen, it wouldn’t be enough.”

The source said their intelligence last year revealed that there was an appetite for violence and looting countrywide following the KZN and Gauteng unrest: “It’s as if people were just waiting for something to set them off.” Next time, says the source, violence may well spread to other parts of the country. 

The source in the security sector said that 2021 proved that “security forces were not prepared and aren’t prepared”. In 2021, the key targets were already struck before the looting, and private security firms could only protect small enclaves. The source close to state intelligence said that preparations to handle the scale of insurrection seen in 2021 take several months, and preparations on that scale have not happened.

One thing that the state has done, the sources say, is to beef up VIP protection for top government officials. The security sector source says that the reaction is very similar to the government’s response during the flooding in KZN, when a water tanker was allegedly purposely sent to the home of KwaZulu-Natal Premier Sihle Zikalala and not to the local community (although this was later officially written off as a misunderstanding).

“They are making sure to protect the fat cats,” says the source.

In June this year, discussions in Parliament saw the South African Institute of Chartered Accountants question the R1.7-billion allocated to VIP protection.

None of this is reassuring, especially not when taking into account the nature of guerilla insurgency. Warns the risk analyst: “The state needs to position itself to respond accordingly now, because the essence of guerilla warfare tends to be regrouping, learning from mistakes and coming back stronger.” 

The responses

We asked the Hawks a series of specific questions about investigations into the missing R120-million in ATM cash, the alleged theft of the automatic weapons and the actual theft of the ammunition, as well as the potential threat posed to the police’s Tetra system following the theft of the radio repeaters.

We also asked them to comment on the potential link between a future insurrection and the missing items. They did not answer our questions specifically, but spokesperson Brigadier Thandi Mbambo did confirm the following: 

“Our major investigations led by two brigadiers, one of whom was solely dedicated to the task have wrapped their major part and the matters are being assessed by the NPA for decision [sic]. So far eight cases have been successfully investigated and accused identified and arrested. Two of the cases have been struck off the roll due to insufficient evidence, whilst two have been withdrawn for further investigation. Four cases are trial-ready and will be heard in July, August and September. As such we cannot confirm details of any ongoing investigation until the DPP has given a decision on those matters. The investigations are still continuing.”

We asked the SAPS similar questions, but did not receive a response despite repeated requests for comment and an extended deadline. 

We asked Transnet whether the alleged moving of the shipping containers carrying automatic weapons and ammunition was being investigated, and if they suspected a link between the thefts and the cyberattack on July 22. Transnet spokesperson Ayanda Shezi said there was no reported incident of theft within its “operating environment”.

“Containers are coded according to the United Nations cargo classification of International Maritime Dangerous Goods (IMDG) and the declaration of all dangerous goods is compulsory as per the National Ports Act 2005 and the Port rules. This cargo classification prescribes the handling and ensures the transaction adheres to a specified standard operating procedure. 

“In the case of ammunition or automatic weapons, the classification would be Class 1 because the material is explosive in nature. Three approvals are required in this instance, and include the SAPS Explosives Unit, Transnet National Ports Authority (TNPA), the harbourmaster and the South African Maritime Safety Authority. 

“Class 1 cargo is offloaded only if a container road haulage vehicle is waiting as per the standard operating procedure because evacuation is immediate. The cargo cannot be kept in the vicinity of the port. The contents of all containers loaded or offloaded are not disclosed to the terminals/operators to ensure cargo safety and minimise incidents of theft.

“Once the cargo leaves the port, TNPA does not have any authority to oversee or control the cargo, it becomes the responsibility of the SAPS Explosives Unit and traffic departments to ensure the safety of the public and security of the cargo. The cargo owner is also responsible for ensuring the security of their cargo throughout the logistics chain.

“According to Transnet records, the containers in question were declared and handled as IMDG Class 1 cargo. Transnet has not recorded an incident of either stolen automatic weapons or stolen ammunition within its operating environment. There were no investigations related to this matter within Transnet. 

“The KZN unrest commenced on 12 July 2021. The Transnet cyberattack occurred two weeks after this event on 22 July 2021. The cyberattack had no impact on the evacuation of the IMDG container referred to above.”

The State Security Agency’s Mava Scott said:

“Most of these questions relate to police and I suggest you make contact with them. There are also operational issues that you are raising which the law prohibits us from discussing with third parties.”

The National Prosecuting Authority referred us to the Hawks for comment. 

Asked about Zuma’s potential role in the insurrection, the Jacob Zuma Foundation spokesperson Jimmy Manyi went straight for the jugular:

“Even before I trouble H.E Zuma, the Foundation responds as follows:

“1. H. E President Zuma does not engage in wild speculation based on insecurities of others. If anyone is known to be breaking the law, the one who is aware has a duty to report. Let’s not repeat Phala phala Farm where criminality is left unreported.

“2. The Independent Panel of Experts said the Convenor of National Security Council, President Ramaphosa FAILED to convene meetings and thus the intelligence information could not be processed and acted upon. Right now you should be directing your questions to Ramaphosa and ask him if he has been convening any of these meetings since July 2021. If Ramaphosa has been doing his job, there should be no anxiety.

“3. Typically, the Deputy President of the ANC is the traditional chair of the Deployment Committee. During the reign of H.E President Zuma, Cyril Ramaphosa was the chair of the Deployment Committee. Any questions related to shenanigans of Ramaphosa’s deployees must be directed to him.

“In addition, it’s curious that Daily Maverick has not followed up on the perjury by Ramaphosa in the Zondo Commission where he said the Deployment Committee does not involve itself with the appointment of judges. This was later exposed to be a lie through the minutes of the Deployment Committee that the DA managed to source.”

We raised the issues pointed out by Manyi with Presidency spokesperson Vincent Magwenya, along with a number of other questions. The Presidency recommended we attend a press conference scheduled to take place after the publication of this article.

The ANC did not respond to repeated requests for comment.

Numerous attempts to contact Massmart for comment were unsuccessful. DM

Heidi Swart is a journalist who reports on surveillance and data privacy. This report was commissioned by the Media Policy and Democracy Project, an initiative of the University of Johannesburg’s Department of Journalism, Film and TV and Unisa’s Department of Communication Science.