Treasonous. It is a word that has been bandied about in response to the first part of Daily Maverick’s investigation into the underworld of political subterfuge, sabotage and organised crime on the soot-laden streets of Mpumalanga.

Former Eskom CEO André de Ruyter has alleged in interviews that a deliberate and orchestrated programme of sabotage has been one of the key reasons for increased levels of rolling blackouts.

New intelligence reports obtained by Daily Maverick outline how four cartels, allegedly with links to two senior members of President Cyril Ramaphosa’s Cabinet have been able to infiltrate the entire power value chain for personal enrichment and to meet political ends. Although we cannot yet reveal the names of the Cabinet members for legal reasons, and many of the sites, tactics and other detailed specifics of how the cartels operate are deliberately left vague because investigations are ongoing, we can begin here to paint a picture of how Eskom is being sabotaged.

The files Daily Maverick has been combing through reveal how black sites are used to swap good-quality coal for poor-quality coal mixed with rocks, how critical infrastructure is deliberately damaged and how key staff members and security turn a blind eye in exchange for financial gain.

The Eskom Intelligence Files suggest that the utility is not only failing and its ageing infrastructure is falling apart, but that to a larger extent than was previously known, it is being made to fail and stripped of parts and resources. 

Read in Daily Maverick: “Introducing the four crime cartels that have brought Eskom and South Africa to their knees”

While the intelligence files lead straight to the executive branch of the ANC-led government via four criminal cartels operating inside Eskom, they also give us some insight into how these cartels operate.

This is that story.

Daily Maverick’s recent publication of some of the insights contained in the intelligence files follows a televised interview with De Ruyter by e.tv’s Annika Larsen, in which a number of claims and comments about sabotage were made. 

“State Capture was like a cancer that (was) unsuccessfully treated so it is just metastasised and it’s now grown throughout the entire body of the organisation; everywhere there is resistance to implementing controls to conducting investigations to implementing disciplinary action, and that realisation, I think, as we’ve uncovered more and more and more, that has just become clearer that the rot was much worse than I anticipated when I took the job.”  

On sabotage, De Ruyter gave an example.

“If there is a contractor who gets paid a pittance to do cleaning or whatever the case may be, to pay someone like that R5,000 to walk past a gearbox with a screwdriver and just with a sharp jab knock out the sight glass where you can check the oil level, the gearbox oil then drains and the gearbox fails and somebody who’s got a maintenance contract is then called out.

“But the individual who committed the act of sabotage – because that’s what it is – is not the kingpin, that’s just one of the runners and that is where I think we have a systemic problem… it’s really so simple.”

Breaking a sight glass is not the only way sabotage is affected in Eskom. With its complex engineering machinery and thousands of moving parts and potential points of failure spanning a substantial portfolio of physical infrastructure, there are similarly vast, myriad ways in which to extract resources or cause mechanical dysfunction – or both. 

The intelligence files shed light on a number of other ways that the criminals stealing your energy security go about their business.

Sabotage and the coal value chain

The most straightforward way is with coal. In summary: the process of getting coal from a mine to one of Eskom’s power stations involves mining the coal, processing it to remove impurities, transporting it to the power station, burning it to produce steam, generating electricity and disposing of the waste products. 

According to Eskom as well as the intelligence files, the cartels control a link in every part of this chain.

The current protocol of Eskom to procure coal from a mine is for Eskom samplers to obtain samples for analysis. These are taken from three stockpiles, for example, “but crooked officials at the mines collaborate with the samplers who are in on the deal and provide them with samples that meet all the requirements”.

“Once the mine is approved as an Eskom supplier, it is targeted to supply substandard coal or to swap good-quality coal for discard at black sites which is then delivered to power stations. This substandard coal is a major reason for the damage to infrastructure and power outages,” reads one section of the files.

Poor-quality coal and rocks delivered to an Eskom power station (Photo: Supplied)

One example of fraudulent activity that can occur in the coal procurement process involves Power Station A, Mine A and Trucking Company A. Power Station A procures a specific grade and quantity of coal from Mine A, which is then transported by Trucking Company A directly from the mine while enclosed by a seal. However, Mine A and/or Trucking Company A may collaborate with or receive payment from a member of a cartel. In such cases, the truck transporting the high-grade coal destined for Power Station A turns off its GPS tracker upon entering a “black site” where the load is replaced with inferior coal. Truck B then receives the high-quality coal at a discounted price, while Power Station A is supplied with the lower-quality coal.

According to the files, “there are approximately 15 black sites that can generate 10,000 tons each per month at an average cost of R750 per ton which amounts to R112,500,000 per month.”

“Criminal activities involving coal continue at several premises between Kusile, Ogies and Kendal. In addition, several sites serve as coal yards and are located along the Balmoral-Ogies/Kendal road, also referred to as the R545.”

“Side-tipper trucks deliver stolen coal to the coal yards, where high-grade and low-grade coal are mixed. All activities occur outside of view behind high walls and darkness during the night. Front-end loaders can be heard working all night long. Once the coal’s average calorific value has been lowered, the reduced-value coal is sold to Eskom.”

In a statement, Eskom shared one publicly acknowledged example of this process.

“A truck driver and his supervisor from a transport company subcontracted to haul coal to Eskom was arrested at the Matla Power Station,” it reads, adding that “the arrests took place after the truck driver was found to be in possession of subgrade coal destined for the facility. The coal swapping allegedly took place at a known illegal coal yard in the Mpumalanga area, prior to the delivery being made at the Matla Power Station.”

When this subgrade coal is fed into the mills, which are designed to crush coal into fine powder for electricity generation, it can cause significant damage if it is of poor quality or is merely a load of coal-coloured rocks (as has happened with Eskom). This damage can result in the shutdown of one of the mills, contributing to or causing rolling blackouts, depending on the power station’s capacity.

Oil, valves, cables and leaks

Other examples of sabotage are more straightforward and clear-cut. Power lines are cut or conveyor belts are severed, the incorrect fuel oil is poured into a burner or monitoring instrumentation is destroyed.

As Part 1 of the Eskom Intelligence Files explains, sabotage in Eskom is frequently motivated by the opportunities it creates for resource extraction. The files point to one example at Tutuka Power Station. A senior employee allegedly orchestrated sabotage at the plant so that companies close to him would get contracts from Eskom. Current and former employees allegedly stole cables and destroyed other components to receive repeat business and contracts at Tutuka.

Also in the files and confirmed publicly by Eskom is an incident on 17 October 2022 when an employee from Tutuka was arrested for removing 10 drums of hydraulic oil from the on-site storage facility. The value attached to a single drum appears to be at least four times more than the market value, leading to serious questions about the original purchases. The drums were worth about R800,000. The actual price of a single drum of hydraulic oil depends on the type of hydraulic oil; even the most expensive type – fire-resistant hydraulic oil – is commercially available for between R15,000 and R20,000 per 210-litre drum.

This isn’t the only way oils are stolen or otherwise used for nefarious purposes at the utility. In November 2022, a contractor working at the Camden Power Station was “positively linked to an incident of sabotage” after he “intentionally removed the bearing oil drain plug from the bearing, causing the oil burners to trip repeatedly”.

“This malicious act caused all the oil to drain out from the bearing, thus damaging the bearing which, in turn, prevented the mills from operating optimally. Camden Unit 4 subsequently tripped after losing all the mills,” Eskom announced at the time. Camden Power Station comprises eight 200MW units with a total installed capacity of 1,600MW. Put differently, this single malicious act by one contractor contributed to the equivalent of a fifth of one stage of rolling blackouts.

Cables are also a lucrative target for criminals or those who would destabilise South Africa’s source of electricity. Eskom has previously confirmed “an incident in which a cable was severed at the Tutuka Power Station this week while the power station was finalising preparations to return Unit 5 to service. The damage to the cable had the effect of delaying the unit’s return to service by three days as it took some time to locate the fault.”

The utility continues that “on the same day a few hours later, it was again discovered that there was a station control air pressure drop and the same Unit 5 Turbine systems which consume control air for operation were de-energised. It was later discovered that the control air pipe supplying the Turbine systems had been cut with a power tool and the entire bend removed. The same was welded back on and the system charged with control air before being normalised.” 

Eskom explained that “these were deliberate acts of sabotage by someone who had access to the site where only employees have access and knows the security features in the area quite well”.

Another example of alleged sabotage laid bare in the files involves a different power station where Eskom has contracted with a specific company providing engineering services. According to the files, indications are that “employees of the company are still persistently creating breakdowns” at one of the most unreliable Eskom plants. In addition, the “employees have been observed intentionally switching off the boilers, thereby sabotaging the power station”.

At a different power station, the files note that the staff operate under a “run to fail” mentality. By this it is meant that some workers at the plant will continue running a problematic aspect of the system until it breaks down entirely without reporting or fixing it.

The whole part of the system then needs to be replaced, whereas only a few minor maintenance jobs or spare parts could have saved the part. This is the result of a combination of sabotage and inexperienced and incapable employees. 

One such example of this mentality is found at another notoriously problematic power station. If steam is lost through leaking valves, a unit might lose about 10% of its efficiency. In other words, a valve with a small leak should be replaced. “Sometimes, certain parts must be turned upside down because the water flows into the tops causing frequent trips. If they turn it upside down, it works like an umbrella; the top will reflect the water away from the critical working parts, and no tripping will occur.”

Experienced and benevolent Eskom staffers would know and act on this, but where no action is taken in this regard it is seen as an example of the “run to fail” mentality.

Sometimes valves are used to affect the operations of a particular plant more directly. The intelligence files explain that certain valves can be either remotely or manually controlled. Acts of sabotage have occurred when valves are closed by hand and the remote-controlled switch on the valve is disengaged. In addition, when a valve is closed manually, it “often trips a unit” which in turn exacerbates the constraints on supply and can lead to greater levels of load shedding.

Asked by Daily Maverick recently how incidents of alleged and/or potential criminal activity within the boundaries of Eskom’s properties are collated, its media desk said that “the internal reporting and analysis is coordinated through the use of an incident management system. Eskom can quantify the total number of incidents reported per property and across all Divisions.”

Between 19 December 2022 and 10 January 2023, there were at least 12 suspected incidents of sabotage and criminality at Eskom’s various properties. 

They are:

Eskom’s woes and De Ruyter’s months-long pleas for a law enforcement response commensurate with the damage being wrought on key national infrastructure were tacitly acknowledged towards the end of 2022 when Ramaphosa authorised the deployment of South African National Defence Force (SANDF) members to a number of Eskom’s power stations.

Daily Maverick previously reported that since at least 17 December 2022, members of the defence force have been present in varying numbers at Grootvlei, Kriel, Duvha, Camden, Tutuka and Kendal power stations, according to Eskom. 

The deployment has since increased, with the SANDF now patrolling the Matla, Majuba, Kusile, Hendrina and Arnot power stations, Eskom’s media desk told Daily Maverick. The impact of the deployment to date, however, is up for debate.

Asked about the impact the SANDF presence is having on criminality and sabotage at the power stations, the media desk simply said that “there are still crime incidents being reported within the boundaries of the sites where they are deployed”. DM168