Useful, real and serious – that’s how the contested private intelligence files commissioned by former Eskom CEO André de Ruyter are now being seen by key law enforcement agencies.

“It’s clear that, between the Hawks and the SIU [Special Investigating Unit], they have found the intelligence reports very useful,” said George Fivaz, whose company conducted the intelligence-gathering operation on Eskom’s internal crime cartels.

“They have special teams investigating. So, I don’t think it’s about the rubbishing of the reports any more. That’s old news.”

He was speaking on Friday, 15 September, three days after Advocate Andy Mothibi, head of the SIU, and Lieutenant General Godfrey Lebeya, head of the Hawks, had appeared before Parliament’s Standing Committee on Public Accounts (Scopa). Fivaz was simply rephrasing for Daily Maverick what had been placed on public record in the National Assembly.

On Tuesday, 12 September, about 42 minutes into proceedings, Mothibi had stated the following: “The [files] cannot be ignored, because [they] have information that can point to … areas that require investigation. That is clear.”

This adjective – “clear” – had been used by both Mothibi and Fivaz to describe the latest assessment of the files’ value. Of course, as the founder and executive director of George Fivaz Forensic & Risk (GFFR), this was the result that Fivaz had been waiting for since 26 April, when an explosive series of articles in News24 had dismissed the files as “outlandish conspiracy theories”.

On 1 June, in fact, as Daily Maverick readers may remember, a practising advocate, former police superintendent and author of key textbooks for the SA Police Service (SAPS), Cerita Joubert had published a legal opinion that reached the conclusion that Mothibi would arrive at more than three months later – but, at the time, her opinion had likewise been dismissed by News24. However, the jury was in – according to top law enforcement officials, the Fivaz intelligence files were useful, real and serious. And there was no doubt, based on his latest presentation to Scopa, that Mothibi and his team had read every word of the roughly 1,500 pages that the files contained. 

The 13 monthly intelligence reports, 348 agent reports and various diagrams, Mothibi informed Scopa, had been divided by the SIU into 54 broad themes.

Of those, he added, 22 themes had remained within the mandate of the SIU, and the remaining 32 themes had been handed over to the Hawks (formally the Directorate for Priority Crime Investigation, or DPCI).

For his part, in his own presentation to Scopa on 12 September, Lebeya of the Hawks offered a similar level of insight.

“Certain role players in the [agent reports] were implicated in multiple individual reports,” he stated. “So, one had to do analysis of all the reports to try to make sense of how they related to each other.”

Lebeya then moved on to the allegations of criminal activities contained in the files, beginning with the sabotage of critical Eskom infrastructure. 

“The emergency procurement processes may have been utilised to obtain contracts,” he noted with respect to one of the apparent motives, “and Eskom, obviously facing an emergency, may have had no choice but to pay the excessive fees charged to address these emergencies.”

Regarding the next item, procurement fraud and corruption, Lebeya suggested that the intelligence files provided crucial detail on how “most of the companies that were identified” did not follow the requisite Eskom procedures.

On the Hawks boss went, alighting soon on the “coal mafia”, which the files implicated in “coal theft” and “illegal coal yards” in and around certain power stations in Mpumalanga.

“There were also prominent and influential persons that were mentioned,” Lebeya added under this item, “and as the SIU has stated, there are names that have been [cited] in these reports. We have analysed them and seen [them], but what we need is evidence to link them to specific crimes.”

Here, of course, Lebeya was referring to the two senior ANC politicians who had famously been implicated in the Fivaz files – names that had been known to Daily Maverick since early December 2022, when we first took possession of the diagrams and dossiers.

And indeed, Mothibi had touched on this extremely sensitive subject too.

“There are names mentioned in the reports,” the SIU boss had informed Scopa about 15 minutes earlier, “but at this stage we would like the investigations to unfold before we undergo a legal risk.”

What both Mothibi and Lebeya were implicitly saying, then, was that the Fivaz files had furnished law enforcement with enough raw information and intelligence to warrant a full-scale search for proof of the politicians’ involvement.

But would that particular search ever begin in earnest?

The answer, by Daily Maverick’s reckoning, was not a simple “yes” or “no” – because, though it was indeed “clear” now that the files were being taken seriously, the suggestions of political interference were as strong as ever.

Also, we had our own documentary proof, which indicated not only that security agencies were being less than truthful in their statements on when, exactly, they had come into possession of the files, but also that this fudged timeline may have been hiding a more troubling truth: that the delay in acting on the Fivaz reports had allowed for the destruction of key evidence.

Subterfuge with receipts 

For the first 40 minutes of his presentation to Scopa on 12 September, Mothibi focused on what he termed the “unauthorised” nature of the Fivaz intelligence files, which he was at pains to distinguish from the “separate issue” of their usefulness.

The core allegation, he repeatedly stated, was that De Ruyter had acted unlawfully in commissioning the private investigation and was therefore guilty of “maladministration”.

By implication, he added, GFFR and Business Leadership South Africa, which had funded the intelligence-gathering operation, may have been guilty too.

Early on in his presentation, Mothibi framed the alleged legal breach in stark terms: “We are aware that the former GCEO [group CEO, De Ruyter] was under obligation to report those investigations, and he failed to do so.”

About 10 minutes later, reading from a PowerPoint slide titled “Questions Requiring Answers”, he arrived at the crux of his concerns.

“Why would Eskom appoint a private investigating company when the allegations could have been referred to the SIU, the DPCI or the State Security Agency for investigation?” he asked.

The answer, according to the SIU boss, was this: “Eskom did not appoint GFFR. ADR [André De Ruyter] was acting on his own.”

And then, to drive the point home, Mothibi continued: “We could not really find why the former GCEO would not have reported this to law enforcement agencies.”

By Daily Maverick’s reading of events, based on previous Scopa hearings and our own independent reporting, these allegations were filled with assumptions that were incorrectly presented as facts.

To begin with the allegation that De Ruyter “was acting on his own”, there had already been more than enough parliamentary testimony to cast Mothibi’s version in a tenuous light.

For starters, on 9 May, when Mothibi and Lebeya had first appeared before Scopa on the matter – alongside SAPS head General Fannie Masemola – it was apparent to almost everyone watching that the security establishment had scored an own goal.

Soon after Mothibi and Lebeya had emphatically insisted that they had only recently learnt of the files’ existence, it emerged that a certain Brigadier Jap Burger of the SAPS may have been in possession of the files since at least July 2022.  

At Daily Maverick, this was our cue to approach De Ruyter for comment. He informed us, while the 9 May proceedings were still in session, that not only had Masemola himself designated Burger as the investigative lead, but that the Hawks in Mpumalanga had also been in possession of the files for a long time.

Significantly, De Ruyter also told us: “I reported the matter to the then interim chair of Eskom Holdings SOC, Professor Malega­puru Makgoba. I [later] informed the new board of Eskom of the intelligence operation at a meeting held at the Eskom Academy of Learning in November 2022.”

The next day, 10 May, Scopa quoted from our interview with De Ruyter to establish the truth. And there at Scopa, Makgoba, from the very beginning of his testimony, corroborated the version of the former CEO. 

“If SAPS and the Hawks had done their work effectively and efficiently,” Makgoba began, “we wouldn’t be meeting here as a committee today.”

Then, in the following point of his opening remarks, he took it even further: “The [action] that Mr De Ruyter [took] was operational … because Eskom at the time was besieged with sabotage and corruption, and we were not getting any mileage from the law enforcement agencies.” 

As to whether De Ruyter had informed Makgoba of the private intelligence-gathering operation, the former interim chair was unequivocal.

“Indeed, Mr De Ruyter did inform me,” he stated. “I can also confirm that … on 5 July 2022, Mr De Ruyter did inform [National Security Adviser] Sydney Mufamadi and [Public Enterprises Minister] Pravin Gordhan.”

As it turned out, this date – 5 July 2022 – was the one that De Ruyter had provided us for the meeting with Mufamadi and Gordhan, which we had duly included in our reporting.

But still, when it came time for Gordhan to appear before Scopa, on 17 May 2023, the Cabinet minister outright dismissed almost everything that De Ruyter had claimed – instead referring to the “rogue nature” of the intelligence files and the former CEO’s “messiah complex”.

So, what were the citizens of South Africa to believe?

Minus hard evidence, of course, every­thing that Scopa had heard (from both sides) was technically hearsay.

Receipt signed by Brigadier Jap Burger in November 2022 for sections of the Fivaz intelligence files. (Images: Supplied)

It was fortunate, therefore, that Daily Maverick had been provided with such evidence, in the form of receipts for “SAPS liaison documents” from the Fivaz intelligence files, signed by Brigadier Burger in November 2022.

What these receipts meant, to Daily Maverick at least, was that it was more than likely that De Ruyter had not acted “on his own”.

And although we could not conclusively determine whether the SAPS had taken possession of the files any earlier than November 2022, we could put the question directly to Burger.

Did he confirm or deny the allegation, we asked the now retired brigadier, that he had begun to receive the liaison reports as early as July 2022?

Our WhatsApp message evoked a pair of blue ticks, indicating that it had been read, but at the time of writing it had still not elicited a response from Burger.

This was regrettable because, in our interview with Fivaz on 15 September 2023, we had been told the following: 

“Last year already, July or August, Jap Burger should have summonsed certain documentation from Eskom. I am talking about all the fake tenders, the work with a question mark, that we mentioned in the reports. He should have summonsed the paper trail, because they have the legal authority to do it and we don’t.

“As far as I understand from the Hawks, it’s difficult to get some of the documentation now, because it has been destroyed.”  

Fivaz had volunteered this information after we had asked him, given that he had been in regular contact with the Hawks, how close to making arrests the law enforcement agencies had now come.

And so there were still no simple answers, as had been the case since news of the Fivaz intelligence files first shocked the South African public.

What there was, though, thanks in large part to Scopa, was a pair of dedicated law enforcement teams with subpoena powers and (apparently) strong intent.

Fivaz, as “laughable” as he found the fact that the SIU was considering charges against him, was nevertheless work­­ing closely with security agencies on bringing the real criminals to book – and he was adamant, despite every­thing, that the teams were top-notch. DM

This story first appeared in our weekly Daily Maverick 168 newspaper, which is available countrywide for R29.