EXCLUSIVE: Alleged 28s gang boss ‘captured’ mega rail project – with Prasa’s ‘help’

Ralph Stanfield, the alleged head of South Africa’s notorious 28s organised crime gang, and his criminally co-accused wife, Nicole Johnson, appear to have used Prasa’s security chief, Alexio Papadopulo, to capture chunks of the government’s multibillion-rand Cape Town Central Line presidential reconstruction project.

The Central Line, operated by Prasa but out of commission since the vandalism that began in late 2019, is the lifeline for Cape Town’s working class, funnelling poor commuters from the Cape Flats areas of Nyanga, Langa, Valhalla Park, Mitchells Plain, Khayelitsha, Belhar and Bellville into the city centre daily.

An investigation by amaBhungane reveals how, from at least 2022 until the infamous couple’s latest arrest in September 2023, Papadopulo allegedly aided their family enterprise in its elaborate scheme to control contracts that flowed from this beleaguered presidential project.

For years, the project has been plagued by extortionists and wracked by deadly violence.

While Prasa’s security boss has, in a slickly edited video, punted the success of efforts to restore control of the Central Line, our evidence shows that he achieved this by bending to Stanfield’s will.

On the one hand, in what looks like a classic extortion tactic, gunmen allegedly linked to Stanfield deliberately destabilised parts of the project – and Stanfield himself was filmed allegedly threatening a Prasa contractor.

On the other hand, evidence shows that Papadopulo punted at least one company associated with Stanfield to assist Prasa in dealing “with the problems faced on the ground” and “in keeping the peace” on the railway.

Our Prasa investigation dates back to 2022, when amaBhungane first began investigating Stanfield’s expansive business empire, whose commercial tentacles have spread into both the private sector and national government.

AmaBhungane has previously reported how Stanfield was able to trade on his reputation as an enforcer to develop relationships and bag contracts with big private sector players who wanted to develop King Air Industria, a commercial-industrial area around Cape Town International Airport.

Now we can reveal, based on evidence that we have been gathering since our investigation first began, how Stanfield and Johnson allegedly plotted and then carried out one of their most audacious project “heists” to date – at Prasa – and the crucial role played by Papadopulo and a specialised internal security team that he established in 2021. AmaBhungane has pieced together this picture based on evidence that includes financial documents, interviews with sources both within Prasa and companies contracted onto the project, videos and leaked emails, including from Papadopulo’s private account.

This evidence backs up circumstantial information, allegedly contained in handwritten business diaries, which we believe come from within the Stanfield-Johnson syndicate.

Papadopulo, a self-proclaimed cybersecurity expert, has attracted media attention for years over his current appointment, qualifications, and alleged closeness to former transport minister and ANC Secretary-General Fikile Mbalula.

In 2019, he made headlines when he was accused of leaking confidential financial information while running President Cyril Ramaphosa’s 2017 ANC leadership campaign’s online security. He claimed in a previous report by amaBhungane to have been cleared by the Hawks.

Evidence gathered by amaBhungane indicates that, thanks to pressure from Papadopulo, Stanfield gained access to lucrative contracts awarded by Prasa to Mzansi Securi Fire, a KwaZulu-Natal-based security company.

Between November 2022 and May 2024, Mzansi received approximately R600-million worth of Central Line contracts.

These contracts involved removing vegetation and rubble from train tracks, rehabilitating service roads, relocating families living on the tracks, and providing security services to protect terrified contractors working on the railway.

Our evidence shows the Stanfield-Johnson enterprise was able to capture significant subcontracts via Mzansi, although the full extent of their companies’ participation remains unclear.

These contracts do not include the hundreds of millions of rands worth of contracts Prasa awarded to companies to re-lay stolen railway tracks and electrical cabling for overhead transmission equipment, which the Stanfield family enterprise also apparently targeted.

What overall success Stanfield had in capturing these infrastructure contracts is unknown.

Emails that we have uncovered from 2022, which Papadopulo sent to his Western Cape colleagues and the Central Line’s main contractors at the height of the violence, which occurred between June and September 2022, show that, somehow, within Stanfield’s business enterprise, Papadopulo found the right people and businesses to help get the project back on track.

What we will show from our investigation is that some of these “saviours” were allegedly behind at least some of the project’s initial derailment.

While it is not known what ultimately led Papadopulo to decide to work with Stanfield & Co, he would have known, thanks to years of extensive media coverage, exactly who he was dealing with and whose companies he was helping board the Central Line project.

Papadopulo’s latest foray into controversy raises new and very serious questions about the extent he would go to help ensure the project’s completion, and whether he was operating of his own volition or whether he was doing someone else’s bidding, and if so, whose and to what end?

What is known is that as early as September 2022, the main contractors raised their concerns about working with the Stanfield-linked companies and facilitators being pushed by Papadopulo – and that they were told their reservations had been conveyed to Prasa CEO Hishaam Emeran.

What makes matters worse is that amaBhungane itself wrote to Prasa in September 2022, raising red flags about Stanfield and questions about his relationship with Papadopulo.

Nevertheless, because of Papadopulo’s seeming complicity and Prasa’s apparent negligence, Stanfield was able, despite being the subject of a serious criminal investigation, to execute a classic mafia-type infiltration of a major state enterprise and strategic project.

He was able to do this while both he and Johnson were under formal sequestration, and in apparent violation of several laws, including the Private Security Industry Regulation Act.

This investigation shows that Stanfield has been enabled to leverage territorial control over areas of the Cape Flats into economic and political power that affects not only the Western Cape, but also the national government.

Responses

Aadil Mayet and Johan Eksteen, who represent Johnson and Stanfield, respectively, said that because their clients were in prison, they could not take instructions to comment on the allegations.

Neither Prasa nor Papadopulo responded to detailed questions about the allegations and evidence we set out below.

Instead, Prasa, responding also on behalf of its named employees, shifted blame for the involvement of Stanfield and Johnson in the project onto the Central Line’s contractors, and said amaBhungane had “misunderstood” the contractual relationships between Prasa, its main contractors and subcontractors.

The company said: “When Prasa officials facilitate meetings between main contractors and local stakeholders, or provide information about community expectations, this is not ‘involvement’ in subcontracting. It is the fulfilment of Prasa’s obligations to support community participation and SMME development within contracts that vest primary responsibility in the main contractors.”

The company said the Central Line recovery project operated in an “extraordinarily challenging environment characterised by high levels of crime as well as infrastructure theft.

“In this context, engagement with a wide range of stakeholders was essential to ensure worker safety and project continuity. The mere fact of such engagement does not constitute impropriety.

“The allegations rely heavily on circumstantial associations, communications taken out of context, and assumptions about routine business interactions. Your correspondence references ‘internal Prasa emails’ and ‘extracts of handwritten notes’ without providing complete documentation that would allow meaningful evaluation. This selective presentation makes it difficult to provide fully informed responses.

“Prasa is open to conducting an internal review of the specific matters raised to determine whether any internal policies or procedures require attention. Should this review identify evidence of serious wrongdoing, Prasa will take appropriate action, which may include referrals to law enforcement.”

The Department of Transport aligned itself with Prasa’s response.

Mzansi’s attorney, Devan Moodley, declined to respond to questions saying that the matter was sub judice.

Creating the perfect storm

In October 2019, just five months before SA went into its first Covid-19 hard lockdown, and while Fikile Mbalula was minister of transport, Prasa cancelled all its contracts for the protection of its infrastructure without putting proper alternatives in place.

At the time, Prasa said the cancellation, which led to ongoing litigation, was because the contracts had been irregularly awarded.

The overnight cancellation, which was described as “reckless” by Parliament’s Standing Committee on Public Accounts (Scopa) in 2023, created the perfect storm.

With no guards to protect Prasa’s infrastructure, vandals descended onto the railway networks in a free-for-all.

Cape Town’s railways, in particular the Central Line, were decimated – with thieves spending months unhindered stealing cabling for signalling systems and overhead transportation equipment, train tracks and stripping train stations bare.

The destruction forced Prasa to suspend the Central Line’s services in November 2019, with people invading portions of the railway reserve and erecting their homes, often where railway tracks had once been – a situation that worsened in the aftermath of lockdown.

The pressure mounts

In August 2021, with pressure mounting from the government over growing delays in getting the railway functioning, Prasa appointed Diphatse Trading and Projects and Mpande Business Enterprises as the main central line contractors.

Transnet Freight Rail’s Rail Network Construction (RNC) was appointed in May 2022 as the third main contractor, with Mzansi appointed effective November 2022.

RNC was contracted to do tracklaying, while Diphatse and Mpande were contracted to reinstall high-voltage lines and other overhead track equipment. Prasa also contracted Diphatse to build foundations for the temporary homes of households relocated from the railway reserve by Mzansi.

Several former Prasa employees, speaking on condition of anonymity, said that while the project should have steamed ahead, within months of the appointments it was being derailed.

A former Prasa employee said the deteriorating security situation led to increasing delays for the line’s reconstruction.

He said “warnings” were sounded that there would be major problems with the project: “We were told the problems would come from Stanfield.”

He added: “Prasa was told that it had to pay the gangs. This was because the Central Line was running through the 28s’ areas.” If this did not happen, then “there would be war”.

He said they were told Stanfield wanted a cut because the Central Line’s epicentre, which is the Bonteheuwel Split, was near Valhalla Park, the heart of his home turf.

The Split, as it’s known, is a section of the network that sees trains travelling from Cape Town either branching off to transport commuters to Bellville on the northeastern parts of the line, or Mitchells Plain and Khayelitsha to the southeast.

Large sections of the 77km line wind their way through other parts of Stanfield’s extensive territory.

The same source said Prasa managers were alerted to the threats, but the local team was frozen out: “Western Cape was told by the national office that a special security team would be deployed and that it would resolve the situation.”

A source who works for one of the Central Line’s contractors said: “When we were first told by Stanfield’s people that he was the only one who could allow the project to go ahead, we told them to piss off. For him, that was a declaration of war.”

Who we’re dealing with: The Baron and The Firm

When the police arrested Stanfield and Johnson at their plush Constantia home on 29 September 2023, a treasure trove of evidence was discovered.

A gold-framed colour photograph of Stanfield with his arms folded over his chest was among the items found. Emblazoned in red in the top left corner was the word “Baron”. The “R” is a silhouette of what resembles a Beretta pistol pointing down. The gun, it is said, is his weapon of choice. The image is fashioned on the logo of the hit mob-TV series, The Sopranos.

Property deed searches show that Glomix House Brokers, a key company in the family’s enterprise, developed blocks of flats outside Cape Town in Blue Downs, one of which is called The Baron. Another block the company developed in the area is called Nicole Heights.

The photograph’s background is a collage made up of the faces of 24 different men.

Credible sources said the collage consists of some of his most trusted associates and alleged senior gang members, who are often referred to in court records as “The Firm”. Some of those in the collage are currently in prison awaiting trial with Stanfield.

With “The Firm”, Stanfield has pedigree: in the 1990s, Ralph’s late uncle, Colin Stanfield, was instrumental in setting up “The Firm” as a forum for different gang bosses to cooperate in countering the onslaught by Pagad (People Against Gangsterism and Drugs).

The new “Firm” is a different beast.

The Global Initiative Against Transnational Organised Crime told amaBhungane that The Firm is made up of members of both 28s street and prison gangs.

While in prison awaiting trial, Stanfield has reportedly advanced that consolidation.

In May last year, a global initiative report alleged that Stanfield had successfully made his way into the upper echelons of the 28s prison gang. The report states that “as the [alleged] leader of the street 28s”, he had been able to “exploit and formalise the connections that existed between his street gang and the prison 28s”.

The Global Initiative against Transnational Organised Crime estimates the 28s street gang has roughly 15,000 members across the Western Cape, and told amaBhungane that The Firm allegedly operated as the strong arm of Stanfield and Johnson’s family commercial enterprise.

Court records show that law enforcement authorities have dubbed their commercial business empire, the “Ralph Stanfield and Nicole Johnson Enterprise”.

It is a multi-layered business. The directors of the various companies are all either relatives, close friends, or associates of Stanfield and Johnson, linked to each other in various ways, including shared physical addresses and telephone numbers, as well as periods when they served as co-directors of the different businesses that comprise the Stanfield-Johnson enterprise.

Already notorious

By 2007, aged 27, Ralph had already been acquitted of committing five murders, including of three children, the youngest of whom was two, and arson, and, since 2014, when he and Nicole were first arrested in the wider dragnet of the now-famous guns-to-gangs case, the couple have repeatedly made the headlines.

The guns-to-gangs investigation exposed how former police officer Colonel Christiaan Prinsloo stole thousands of police-controlled firearms that were supposed to be destroyed and then sold them into the criminal underworld, especially on the Cape Flats.

Stanfield and Johnson, along with several of their relatives, were charged with fraud and corruption under the Prevention and Combating of Corrupt Activities Act and the Firearms Control Act for allegedly illegally obtaining sporting firearm licences and firearm competency certificates from officers at the South African Police Service (SAPS) central firearms registry in Pretoria. (With a sporting licence, one can possess more than four firearms, including certain semi-automatic firearms, and more than 200 rounds of ammunition per licensed firearm.)

That case, as we’ll see, is important in surfacing certain relationships in our Prasa evidence, notably with a company called PPE Security and Projects.

The firearm charges were provisionally withdrawn by the State in 2016. The case was reinstated in 2018, this time under the Prevention of Organised Crime Act (Poca). Poca is specifically designed to tackle racketeering and gang activities.

The case was again withdrawn in September 2024, so at the time of Stanfield’s dealings with Prasa in 2022 and 2023, his background was already notorious.

More recently, Stanfield and Johnson were arrested and charged with fraud and car theft. These charges relate to their allegedly stealing their former driver’s BMW, whom they claim skimmed large volumes of cash from Stanfield. The driver, a key witness, was eventually hunted down and shot in June last year, while his pregnant wife was shot and seriously injured a month later.

In 2024, Johnson and Stanfield, along with nine co-accused, including former City of Cape Town member of the mayoral committee (MMC) for human settlements, Malusi Booi, were also facing a fraud and corruption trial relating to a R1-billion City housing tender scam for the construction of homes in some of the city’s most impoverished areas, although in May 2025 the NPA provisionally withdrew these charges pending the finalisation of an additional investigation into newfound evidence.

On 7 November 2025, Stanfield and Johnson returned to court, this time alongside 12 of their alleged associates from The Firm. The group, which appeared in the Western Cape Division of the High Court for a pre-trial hearing, are in prison awaiting trial.

In this case, they have been charged under the Prevention of Organised Crime Act and go on trial in October 2026 for, among other alleged crimes, attempted murder and murder.

They are accused of trying to kill Joel Booysen, the son of alleged Sexy Boys gang leader, Jerome “Donkie” Booysen; and of the murders of Hard Livings gang boss Rashied Staggie, 27s gang leader William “Red” Stevens, off-duty police officer Sergeant Faizel Adams, gangster Ismail Abrahams; and City of Cape Town housing official Wendy Kloppers.

Staggie died in December 2019, Stevens in February 2021, Adams and Abrahams in September 2021, and Kloppers in February 2023.

Back to Prasa: blood on the tracks

A former Prasa employee and a Central Line contractor told us that the initial resistance to onboarding certain Stanfield-associated businesses unleashed a wave of orchestrated terror, with gunmen carrying out several attacks.

Sources suggest these gunmen, who in at least one video shared on social media sounded warnings to Prasa and contractors, are among several “shooters” used to allegedly extort construction companies.

The same sources, who are independent of each other, helped amaBhungane identify one of the gunmen in the viral video as Stanfield’s former right-hand man, Ernest McLaughlin, who was murdered in March 2023.

A Prasa contractor told amaBhungane that his staff often had to deal with McLaughlin and his team.

“They would tell my people that Stanfield had sent them. They said they were there to ensure that whatever the job was for the day was getting done and that his community people were the only ones who were to do the work.”

At the time of his death, McLaughlin was co-director, along with Stanfield’s sister, Francisca Stanfield, of two of the family’s community-based organisations, the Cape Flats Liberators and the Flats Liberators Forum. The organisations allegedly find jobs for those loyal to Stanfield.

In April 2023, an incident, filmed by two different people, was also posted on social media of Stanfield appearing to threaten a site manager on the line. While the manager refused to comment and the sound quality is poor, Stanfield appears to be saying, “Jy luister nie” and “Jy is fokken slim” (You don’t listen; You’re fucking clever).

AmaBhungane understands that the alleged intimidation was over the site manager refusing to hire local community members, apparently loyal to Stanfield, to work on the project.

AmaBhungane has mapped some of the attacks that escalated from June 2022 – although these cannot confidently be ascribed to Stanfield associates, like the one involving McLaughlin.

These include:

• Two guards shot and wounded on 7 June 2022 during a 15-minute gunfight while protecting Rail Network Construction workers in Kalksteenfontein between the Netreg Station and the Bonteheuwel Split.
• Gunmen opening fire on 3 August 2022 on contractors working between Netreg and Heideveld train stations. In an email to Prasa, Transnet Freight Rail’s Rail Network Construction alleges that the shooting was because Papadopulo failed to engage communities about the rollout of its security plan and the involvement of local businesses in this plan.
• Contractors forced to abandon their work site while working on the railway line in the Bonteheuwel area after they were threatened on 29 August 2022 by gunmen.
• Two gunmen on 31 August 2022 filmed at Netreg train station firing into the air with assault rifles, issuing warnings to Prasa and contractors working on the Central Line.
• A team of contractors attacked and robbed in September 2022 by gunmen.

Presentations made by Prasa to Scopa in May and July 2023 described the extortion situation as “rife” and showed that the state of security was so bad that between 31 August and 30 October 2022, it was forced to halt construction and deploy a specialised security intervention force to regain control of the situation.

This intervention force was provided by Mzansi – of which more later.

Prasa’s July presentation to Scopa revealed that, after the hiring of Mzansi, work resumed in January 2023.

Despite the intervention force, the violence and intimidation continued into late 2023, though there are no allegations that Stanfield was behind the later attacks.

What is clear is that by late 2022, Prasa, under increasing pressure from the government and with the violence continuing unabated, was desperate to regain control.

It seems Papadopulo would do anything to get the contractors back to work and the project back on track. Our evidence, which is hard-won but limited, provides a strong indication of how far he went.

But first, just who is this mysterious Papadopulo, and how did he come to hold such a powerful position within Prasa?

The mysterious Mr Papadopulo and his A-Team

Papadopulo, a former sales employee and later business partner at an electronic goods outlet, reportedly claims he has “vast experience with intelligence, SSA [State Security Agency] and even helped set up the Presidential Climate Commission”.

Papadopulo’s actual security experience, though, is an enigma.

Records from the Private Security Industry Regulatory Authority (PSIRA) show that he was not accredited with the authority when he was appointed in 2021 to his current position within Prasa, something that was a mandatory requirement, according to a former senior Prasa executive.

PSIRA records show that Papadopulo applied for his accreditation on 24 May 2022, and it was approved on 7 December 2022, 18 months after he joined Prasa.

Papadopulo was controversially appointed as Prasa’s acting head of security after his predecessor, Trevor Fredericks, died in August 2021.

The two, along with seven other security officials, were parachuted into Prasa in June 2021, seemingly as a politically connected cohort.

The CVs of three of the cohort, Ephraim Samaai, Marius Schaffers and Clarence Syfers, reveal that they worked with Fredericks for the private security risk management company of former top spy Arthur Fraser, Resurgent Risk Managers, and alongside Fraser and Papadopulo on President Cyril Ramaphosa’s CR17 campaign in the run-up to the ANC’s 2017 elective conference.

In an email Papadopulo sent to Prasa’s national and regional executives on 25 October 2021, titled “Monitoring and Evaluation Unit (PS Task Team)”, he announced that he had “established a unit in my office that will focus on monitoring and evaluation within Prasa Security”.

Papadopulo added that the team had been established to “expedite any issues faced in the regions as well as the total alignment of Prasa Security”.

As we’ll shortly show, at least one of Papadopulo’s security cohort also allegedly worked with one of the Stanfield-Johnson enterprise’s most trusted members, providing insight and advice on Prasa contracts.

A source who previously worked at Prasa alleged that Papadopulo used the unit, which reports only to him, to carry out “off-book” operations.

The source added that the team operated as an independent parallel structure within Prasa’s well-established security division. He said they refused to share security plans with either their senior colleagues who were managing the Central Line’s reconstruction, or the main contractors and their security teams.

AmaBhungane has seen a similar complaint recorded in an email a Prasa employee sent to a Transnet colleague, both of whom worked on the reconstruction project at the time.

As we will see, when it came to dealing with the complex and worsening security situation on the Central Line, Papadopulo found that his answer lay with Stanfield and his family’s enterprise.

Pals and connections

Whether Papadopulo and Stanfield met, and if so who introduced them, remains opaque.

Circumstantial evidence said to be drawn from the so-called Stanfield syndicate diaries suggests that they did meet face to face and allegedly also planned to establish a secure electronic communication channel.

While amaBhungane cannot prove either claim, evidence we gathered from sources working for Prasa and its contractors shows that Papadopulo used both his private and work emails to engage with contractors to get them to hire the Stanfield family linked businesses and work with his people, including his brother Kyle Stanfield.

In addition, our evidence shows that Papadopulo liaised directly with Stanfield’s associate, Suraya Manuel.

Manuel is an accountant who apparently worked on different aspects of the Stanfield family enterprise. Manuel was also an accused alongside Stanfield and Johnson in the now provisionally withdrawn City of Cape Town R1-billion housing tender fraud case.

Our evidence also shows that Papadopulo and Stanfield had a common connection through another of Stanfield’s co-accused in that case, Malusi Booi.

Between August and September 2022, during the height of the violence on the central line, Papadopulo and Booi interacted over several days.

Some of these interactions were through an official who apparently works in Prasa’s Western Cape regional office. The official discussed with Booi, seemingly on Papadopulo’s behalf, Papadopulo’s arrival in Cape Town and enquired about a meeting the two were meant to have.

In the meeting discussion, Booi revealed that he was waiting for Papadopulo at the luxury One & Only hotel in Cape Town.

Exactly how Booi and Papadopulo became acquainted, why they would need to interact with each other and whether Stanfield used Booi as an intermediary is unknown.

Booi failed to respond to questions.

AmaBhungane also understands that the names of Papadopulo’s team members, Syfers, Schaffers, and Samaai, also apparently appear in what we have dubbed Stanfield’s business diaries, suggesting that they may have collaborated while work was carried out on the Central Line.

We have been told by a Prasa source that Samaai was Papadopulo’s lead Cape Town person for dealing with Central Line security issues.

Evidence shows Samaai and Manuel, the Stanfield accountant, interacting with each other.

In February 2023, Samaai advised Manuel to approach Prasa’s then-Western Cape acting regional head, Raymond Maseko, to lodge an appeal after Johnson’s company, Glomix House Brokers CC, was disallowed from tendering for a contract for the refurbishment and alteration of buildings at the Cape Town train station.

Glomix was disqualified because its representatives had missed attending a compulsory contractors’ briefing in January. Evidence shows that Samaai arranged to help Manuel draft the email to send to Maseko.

AmaBhungane has copies of emails between Manuel and an official within Prasa Corporate Real Estate Solutions, which was responsible for the refurbishment, referring to the January dates of the contractors’ compulsory meeting, which Glomix had missed. It seems Manuel approached Samaai after the official failed to assist her any further. Manuel then forwarded these emails on to Johnson.

Why Manuel would approach Samaai about construction tenders, and why Samaai would advise her on whom to approach in Prasa’s Western Cape management, is unknown, but it suggests a scenario in which contracts were being traded for security.

Attempts to obtain a comment from Manuel – via her lawyers, various cellphone numbers listed for her, and email – were unsuccessful.

Now, back to Stanfield’s “diaries”.

The black books

The existence of the alleged Stanfield business diaries was first publicly revealed after Western Cape commercial crimes commander, Colonel Carel Lourens, filed an affidavit for a search and seizure warrant to raid City of Cape Town safety and security MMC JP Smith’s office in January.

The raid on Smith’s office was carried out as part of Lourens’ investigation into his alleged involvement with Stanfield. In September 2025, the courts declared the raid unlawful.

Lourens’ affidavit reveals that the business diary entries, which he says are contained in three black books, were found by the police in a hidden compartment in Stanfield’s office during a search and seizure operation carried out in September 2024 at the John Ramsay Service Station, in the Cape Town suburb of Bishop Lavis. The Racole Family Trust, of which Johnson is a trustee, is the sole member of the service station.

It is understood that the three black books are suggestive of Stanfield’s relationship with Papadopulo. Circumstantial evidence, apparently in the books, suggests Stanfield made references to variants of Papadopulo’s name and nationality.

There is at least one unconfirmed report that Papadopulo, who is based in Johannesburg, and Stanfield would meet on occasion at the same John Ramsay Service Station when Papadopulo travelled to Cape Town.

As we will read, a former Mzansi employee has also told us that Prasa officials attended a meeting at the garage at least once, where the employee was present.

From information amaBhungane has obtained from credible sources, along with Papadopulo’s social media accounts, publicly available information from Prasa’s website and a report on a Scopa meeting, we have confirmed that Papadopulo would have been in Cape Town for at least some of the dates on which the black books apparently reflect meetings or planned meetings.

We understand that the books or diaries also indicate that at other times Stanfield made plans to either meet with Papadopulo’s colleagues – Samaai, Syfers, and Schaffers, who were based in Cape Town – or have some of his most trusted associates, McLaughlin, Teenage Fanie, Warren-Lee Dennis and his brother Kyle deal with them.

We have, however, been unable to verify if any of these meetings took place.

Dennis is to stand trial alongside Stanfield for the murder of Kloppers. Fanie, who Stanfield apparently used with McLaughlin as his enterprise’s community liaison officers, was murdered in Bishop Lavis in May 2023. No one has been arrested for his murder.

While the diaries seemingly provide only hints of contact, we understand that what they seem to show more clearly is a detailed business strategy for the Stanfield-Johnson enterprise to piggyback on various aspects of the central line reconstruction.

The ‘capture’ begins

Internal Prasa emails show that in July 2022, at the height of the violence, Prasa started engaging with stakeholders and its main contractors in a series of meetings to address safety concerns.

The first meeting that we are aware of was called by Western Cape Prasa executive Kaparo Molefi for 27 July 2022. We will soon read about his association with some of Stanfield’s acolytes.

The subject of Molefi’s meeting invite was “security coordination and alignment of Central Line”.

While Papadopulo was marked as a potential participant, we do not know if he attended.

AmaBhungane understands from one source who attended the meeting that the contractors expressed concerns among themselves over the attacks and their level of coordination, and questioned whether something other than simple criminality was at play.

“We were asking these questions because this seemed far too coordinated. Usually, on a site, there will always be some intimidation or extortion ... But this was completely different. It was highly orchestrated, extremely violent, and when our security resisted, there were intense gunfights.

“Also, the police were not prepared to intervene. They told us straight up that they were not there to guard us … It was worrying.”

AmaBhungane has an internal Transnet email, from about six weeks later, where the lack of police support was flagged.

The email states that “further the RRPU [the SAPS Rapid Rail Police Unit] made it clear that they cannot deploy static to ensure the safety of RNC employees while working in central line. […] Criminals send threats with wielding firearms discharging at the station, warning contractors not to return. SAPS confirm they cannot be available around the project all day and have other high priority crimes to attend.”

The email’s writer warned that the safety risk would only worsen as work progressed towards “the Philippi and Khayelitsha areas”.

The second meeting we are aware of (although we do not know the exact date) involved Prasa, contractors, and City of Cape Town sub-council 15, which straddles the Central Line and includes Stanfield’s home turf of Valhalla Park.

On 3 August, an email sent by Transnet’s RNC to Prasa, which confirms the earlier council meeting, revealed that it was withdrawing from its sites because of a shooting that had occurred that day between Netreg and Heideveld stations.

A senior Transnet official working on the project informed their Prasa counterpart of their temporary withdrawal, alleging that Prasa’s security chief had failed to “engage the communities” about the rollout of Prasa’s security plan for local businesses, “as per the meeting held with sub-council 15”.

“Please advise when this engagements will happen as today could have been fatal [sic].”

AmaBhungane understands the security chief referred to was Papadopulo.

It is clear that Transnet’s withdrawal, followed by that of Diphatse and Mpande, would increase the pressure Papadopulo was under to resolve the security issues and get the contractors back on site.

Enter Mr Booi

Evidence shows that on 4 August, the day after Rail Network Construction’s withdrawal, Molefi, who had set up the 27 July meeting between Prasa and its main contractors, coordinated a planned meeting between Papadopulo and Malusi Booi (the City of Cape Town human settlements MMC, who was later sacked and put on trial with Stanfield in the R1-billion City housing tender fraud case).

The meeting was to take place at One&Only Cape Town hotel.

Molefi failed to respond to questions.

While it is not known whether the meeting took place or what was discussed, what is known is that four days later, on 8 August, Booi sent Papadopulo the email address of an Eastern Cape-based construction company, ZSM Developers and Projects.

Why he sent it and the context for sending it are unknown.

ZSM was started in 2013 by Zanodumo Sinovuyo Mtingane, who used the email address zsmdevpro@gmail.com – the same email address Booi sent to Papadopulo.

Mtingane was ZSM’s director until October 2021, when he resigned and another Stanfield-Johnson associate – Abdul Kader Davids – was appointed in his place.

Three independent sources allege that Stanfield targeted and then hijacked the company because of its high construction grading level in order to target higher-value government construction tenders.

Credible sources claim Mtingane, who amaBhungane has learnt was at one stage a close friend of Booi’s from the Eastern Cape, was forced to resign and hand over control of his company. Stanfield then allegedly had Davids take control of the company.

Mtingane refused to speak to us.

Company records show that at the time of Davids’s appointment, he and Johnson were co-directors of the Sea Point tourist trinket business Gift House Curios and, in court documents, he confirmed being Johnson’s business partner.

Until his murder in September 2024, Davids was also an accused in the (provisionally withdrawn) R1-billion City of Cape Town housing tender fraud case against Stanfield and Booi.

Davids, who it is said walked Stanfield and Johnson’s dogs, ran errands for them and worked as their butler, was murdered in Mitchells Plain two days after he got bail in the City of Cape Town housing fraud trial.

He was shot outside a house, which court records show ZSM rented from Johnson’s business, House of Israel, which also owns Stanfield and Johnson’s upmarket Constantia home.

The same sources claim he was preparing to depose to an affidavit about the Stanfield-Johnson enterprise and his knowledge of payoffs to Western Cape provincial and local government politicians, including luxury golfing weekends away.

But now, back to Booi, Papadopulo and their interactions about “social facilitators”, travel and Prasa.

Meeting plans and security quotes: Stanfield ‘Inc’ shows itself

On 9 August 2022, a day after receiving ZSM’s email address from Booi, Papadopulo forwarded Booi a link to Prasa’s tender listings page.

What exact tender he had in mind is unknown, although at the time, Prasa and the City had been engaged for some time over the relocation of those living on the railway reserve.

Booi, remember, was the City’s human settlements MMC.

Five days later, on Sunday, 14 August, Papadopulo let Booi know that he had arrived in Cape Town and that he would be around for the week, asking, “How does tomorrow evening look for dinner?”.

It’s not known whether they eventually met, but it is understood that the diaries apparently show Stanfield also planning to meet Papadopulo. That meeting was apparently to take place at a restaurant that Friday. Whether it happened is also unknown.

What is known, though, is that in the same week, two companies associated with Stanfield and Johnson addressed quotes respectively to two of Prasa’s three main contractors.

The first quote was from Johnson’s Glomix and addressed to Mpande, to supply it with security services for five months for R27.7-million. Included were guards, armoured vehicles and drones.

The second quote was from a then-little-known Mitchells Plain company called Yibaninati, to supply RNC with similar services for R13.8-million, also for five months.

In providing the quotes and offering to facilitate security services, PSIRA spokesperson Bonang Kleinbooi says the companies violated the Private Security Industry Regulation Act, as neither was registered with the authority and neither were their directors.

She said that while both Johnson and Stanfield had applied for PSIRA accreditation in 2017 and 2018, respectively, their applications were rejected in 2021 because they were “awaiting trial”.

“There is no recorded appeal application from the two,” Kleinbooi said, adding that rendering a security service without being registered with the PSIRA was a criminal offence.

Company records show Yibaninati to have been co-founded by Johnson in 2014. Although she resigned as director five years later, the company remained associated with the family.

Johnson’s place as director was taken by Rachelle Abrahams, who was charged alongside Stanfield and Johnson in 2014 in the guns-to-gangs matter, and who, along with Johnson, co-founded Johnson’s non-profit company, Hopenest Foundation, which we’ll encounter again.

When Abrahams was to leave Yibaninati the following year, the Companies and Intellectual Properties Commission was informed of a new director, one Muhammad Saban, and a new email address for the company: admin@glomixbrokers.co.za.

Yibaninati’s new email address starts to raise important questions about whether Johnson was really no longer involved in the company. Saban also happens to be co-director with Johnson in two of her other businesses.

It appears that what Stanfield wanted, and what Papadopulo appears to have supported, was for Stanfield-linked companies to facilitate the appointment of preselected security firms to protect the three main contractors.

Papadopulo follows up?

On the morning of Friday, 19 August 2022, the day after the Glomix and Yibaninati quotes were dated and the day of Stanfield’s apparent restaurant booking for his meeting with Papadopulo, Papadopulo emailed Niren Singh, the chief engineer for Diphatse, one of Prasa’s three main contractors.

Papadopulo told him discussions had been held with “a company that will help manage on the ground in security from September for the next 5–6 months [sic][…] I have no doubt that we will be able to deal with the problems once and for all.”

Papadopulo asked Singh to review an attachment. If Singh agreed, Papadopulo would escalate it to Prasa’s bid adjudication committee “to allow these security measures to be put in place from September”.

Although we do not have a copy of the attachment Papadopulo emailed Singh, the five-to-six-month time period he referred to ties in with the five-month period of Glomix and Yibaninati’s quotes to the other two main contractors, suggesting something similar was occurring.

Singh declined to comment and referred questions to the company’s directors, who failed to respond.

Mpande’s director, Bongani Sambo, also failed to respond to questions.

The following Monday, on 22 August, Papadopulo emailed a Western Cape Prasa colleague responsible for infrastructure in the province.

He attached a quote for “security via [an] SMME that will help assist in keeping the peace on all the projects,” saying it “will need to go to the [bid adjudication committee] urgently for noting and adjustment to the RNC contract.”

Although we don’t have the attachment, he repeated the five-to-six-month period, suggesting it was Yibaninati’s quote to RNC.

Transnet’s spokesperson, Ayanda Shezi, said Transnet never had any dealings with Glomix, Yibaninati, Stanfield, or Johnson.

“RNC requested Prasa as the employer to provide security after a shooting incident that happened on site. Security services were arranged and provided by Prasa. RNC has no knowledge of who was contracted or the costs […] .”

Just what was happening here?

Papadopulo, it seems, was trying to get Prasa’s procurement machinery to adjust the main contracts so that they could subcontract Stanfield-Johnson-linked companies as their security providers.

At the time, Prasa already had a tender open for a more permanent private “intervention unit” to secure the Central Line. It was advertised on 19 July with its closing date on 18 August, coincidentally, the day of the Glomix and Yibaninati quotes.

But they could not have bid for this tender because, as we pointed out earlier, they were not registered with the PSIRA as security providers. So the plan at that point may have been to use them on an emergency basis as facilitators of security services until the main contract had been adjudicated and awarded – hence the five-to-six-month period.

It also appears that Stanfield and Johnson had another scheme on the go at the same time – this one entailed simultaneously feeding from the Prasa tender trough on contracts other than security.

It is understood that the Stanfield business diaries contain notes dated 25 August appearing to reflect an interaction between him and Papadopulo.

What followed were apparent plans for the signing of service-level agreements (SLAs) and the establishment of some sort of business cooperative involving Johnson’s Hopenest Foundation, which would apparently be involved in hiring workers for station cleaning and vegetation and rubble removal.

It seems that the plan was that the cooperative would be subcontracted by the security company winning the intervention contract

The plan was now about to morph into a multi-pronged attack targeting contracts, which, as we will see, formed part of the larger R600-million security contract that Prasa would award to Mzansi later that year.

Now, on to two crucial and high-intensity months for the Stanfield-Johnson family enterprise – which go to the heart of questions about Papadopulo’s role.

Push, push, push

In the final week of August, it was chaos on the Central Line.

On 29 August 2022, just 11 days after the Glomix and Yibaninati security quotes, contractors were threatened by gunmen and forced to abandon their work site in the Bonteheuwel area.

On the same day, the video previously mentioned, showing two gunmen issuing threats and firing into the air with assault rifles, was reportedly sent to Prasa and subsequently circulated on social media.

The understanding is that in the final week of August, Stanfield arranged with Papadopulo for the security SLAs to be signed with the three main contractors.

But, it appears that no sooner was this done than obstacles began to arise. As we will see, RNC was still not comfortable – and the SLAs were not signed.

A week later, on 6 September, seemingly out of the blue, Bishop Lavis’s then-acting police station commissioner, Colonel Muneeb Africa, emailed crime intelligence officers, the RNC and Prasa executives, including Papadopulo, inviting them to meet the next day at Manenberg Police Station to discuss the Central Line’s security issues.

AmaBhungane understands that it was at this meeting that RNC was introduced to representatives of two SMME security companies, GParm Protection Services and PPE Security and Projects, and told that, along with Yibaninati, they would help resolve the security situation.

Africa’s intervention would naturally have added credibility to the three companies and calmed the nerves of RNC officials.

Africa has subsequently been accused of acting improperly in Stanfield’s interest.

Records from one of Stanfield’s bail applications reveal that Africa allegedly tried to dissuade a woman whose car had been stolen, apparently on the instruction of Stanfield, from opening a case against him.

In an affidavit opposing bail, senior SAPS Western Cape anti-gang unit officer, Colonel Christiaan van Reenen, claimed Africa had told the motorist that if she opened the case, she could expect trouble.

“She further showed Col Africa the papers of her vehicle. Col Africa told her, ‘As jy nou ‘n saakmaak, jy weet mos wat gaan gebeur met jou en jou kinders’ [If you now open a case, you know what will happen to you and your children].”

Van Reenen stated the car was eventually set alight and that the woman never got it back.

Although Africa’s intentions in both cases might have been benign, police management barred Africa from responding to questions from amaBhungane.

Western Cape police spokesperson André Traut said the SAPS was not in a position to release any information “pertaining to a serious matter that is currently under investigation.

“It would be procedurally inappropriate to expect an employee of the police, who is implicated in the matter, to respond to media enquiries. The member has been advised to refrain from engaging with the media.”

Both GParm and PPE have done business for Stanfield and his family before.

GParm was providing security to the Cape Town Ayepyep nightclub, when the Stanfield family enterprise allegedly hijacked it from its previous owners, the murdered Oupa “DJ Sumbody” Sefoka and Kagiso Setsetse.

PPE has provided bodyguards to Stanfield and his family ever since he survived an assassination attempt in Johannesburg in 2017.

In his latest arrest, Stanfield was also charged with being in the illegal possession of a shotgun and ammunition, licensed to PPE.

Two sources independent of each other claimed that at the time Stanfield and his family were taking over the nightclub, GParm was itself subjected to hostile takeover attempts.

“It was something that the owner only narrowly averted,” said one of the sources.

On Thursday, 8 September (a day after the meeting arranged by Colonel Africa and following another meeting involving the contractors), emails show that same afternoon Papadopulo emailed a Transnet official involved in the Central Line project.

Copied on the email was admin@yibaninati.co.za (i.e. the Johnson-linked company).

Papadopulo told the official that he had attached documents for the “facilitator”, which was Yibaninati, and the two SMMEs “selected” for their records.

The email contains attachments for Yibaninati and GParm, and a different security firm, Atticus Risk Management. We do not know why PPE was not included in this particular email, but team Stanfield was clearly still casting their net around for security companies they could subcontract.

Atticus director Clifford Gobetz told us, “Atticus Risk Management was approached in September 2022 by Glomix House Brokers CC and requested to provide a quote pertaining to the rendering of security services to Prasa. […] Our quote was evidently not accepted, as we did not hear anything from Prasa or Glomix subsequent to the submission of our quote.”

GParm director Siqgobo Sithole confirmed that they submitted a quote, but said they declined to do the work. He would not elaborate on why.

He said he did not know why their quote would have been submitted to RNC.

“The quote was submitted to Prasa. This was after several meetings were held with Prasa, the main contractors and other security companies in early September.

“The first [meeting] was at Prasa’s Salt River offices in Cape Town. We were specifically called to that meeting.”

He would not say who called him to that meeting, or how or why his company was identified to provide security services.

Sithole said: “We submitted our quote, but that’s as far as we went. […] We never worked on the Central Line. I do not know about a meeting at a police station with a police colonel, Prasa or its contractors. I don’t know why the police would need to call a meeting between Prasa and the contractors.”

He declined to comment further or on claims that Stanfield tried to hijack his company.

“You have asked enough. No more.”

A source, who attended the Prasa Salt River depot meeting, claimed it was called to introduce the main contractors to “pre-identified” security companies, and Glomix and Yibaninati.

He claimed Johnson and McLaughlin attended the meeting, “as Glomix and Yibaninati representatives”.

“Papadopulo was in charge. He introduced Glomix and Yibaninati, and Nicole [Johnson] and Ernest [McLaughlin] as their representatives. He said they would manage the security situation on the ground, including the security companies, and would deal with any community issues.

“The contractors were furious. They accused Papadopulo of pushing facilitators and their representatives on them, who they said were the very same people scaring them off their sites. At least one singled out McLaughlin as the main man harassing them. It got really ugly.”

The source claimed Papadopulo had to plead and beg them not to walk off the project.

“They were gatvol [pissed off]. […] He promised them that he had ensured that special budgets had been made available […] that the contractors would not have to pay a cent for the selected security companies. He specifically said Glomix and Yibaninati had been selected to facilitate and manage the [security] budget. He said all they needed to do was stay on site and finish the job.”

In the meantime, Papadopulo was telling RNC all they needed to do was onboard the facilitator, who Papadopulo said would “manage the SMMEs”.

He urged that the process be expedited and told the Transnet official to liaise with the facilitator to get the final quotes and any paperwork required for the onboarding processes.

The deadline Papadopulo set in the email, which he sent at 5.03pm that Thursday, was Monday, 12 September, effectively giving RNC just two working days to complete the processes.

Papadopulo’s reason was that Prasa “is pressed for time to get the project moving”.

RNC resisted, with the Transnet official telling Papadopulo, “our timeline for approvals are a bit timeously. [sic]” while telling their Western Cape Prasa counterpart in a separate email that Transnet would not conclude the contracts without Prasa providing the necessary additional funding.

A rush for quotes and onboarding

It was clear that the RNC’s roadblocks would have to be dealt with quickly.

On Sunday, 11 September, just after 9am, Papadopulo emailed Prasa’s Western Cape senior managers, copying in RNC, Mpande and Diphatse.

The email, whose subject line was “Facilitators & SMMEs-WC”, was to “align” the contractors with the previous week’s meetings.

Papadopulo instructed that the onboarding be “out of the way by Monday and Tuesday this coming week”.

He stressed that Prasa’s necessary bid adjudicating committee processes had been followed, “and confirmations of the [contract] variation orders to be sent to the three service providers accordingly”.

This would have allowed contractors to pass on the extra costs to Prasa.

Despite this instruction, on 12 September, RNC threw up yet another roadblock.

Internal Transnet emails show one of their security managers recommended that RNC totally withdraw because of security threats.

On 13 September, RNC issued Prasa with yet another security warning based on “theft and damages on site”. It stated that a “site de-establishment” was to be done “due to security risk on the project”, and warned Prasa of rising costs because of their “intention to claim standing time” for time lost and work that needed to be redone because of crime.

On the same day, Papadopulo emailed Yibaninati – interestingly via Suraya Manuel, whom we pointed out was a Stanfield associate – and copied in RNC and his security colleague, Ephraim Samaai.

He told Manuel that Prasa was finalising internal processes to take to the site on Monday, 19 September, and stressed “the urgency of receiving your updated quote”, questioning her on “the process of SLA with RNC.”

Within two hours, Manuel had replied, attaching a quote “valid for a period of 6 months [sic]”, telling Papadopulo the security SMMEs had been onboarded by Yibaninati, which would manage the security service providers, “as per the alignments with sub-council, councillors, and community SMME involvement.”

The attachment was a second quote from Yibaninati, which this time had ballooned from the original R13.8-million to R32-million.

Manuel told Papadopulo: “We await the SLA Agreements as it is understood work needs to commence on Monday, 19 September. Kindly expedite this process, we need to be on the ground by Monday.”

Off the rails?

The identity of the SMME security companies that were to supply services to the main contractors via the Stanfield-Johnson enterprise, however, seems to have kept changing.

On 13 September, PPE and yet another security company, Mjayeli Security Services, compiled quotes for the provision of various security services, including guards and vehicles.

Mjayeli’s R1.6-million quote was addressed to Glomix. PPE’s R2-million quote was not addressed to anyone and simply named “Prasa Quotation”. But from the context, it appears to have gone to Manuel.

Mjayeli failed to respond to questions.

From our understanding of the evidence we have gathered, and what is apparently written in the Stanfield diaries, PPE and Mjayeli were among four companies intended to provide guards and equipment, via the Stanfield-Johnson enterprise, to protect the main contractors.

The 19 September deadline was, however, to be sunk by yet another roadblock, when, on 14 September, at least two of the main contractors again met Prasa to discuss the security situation.

Emails written five days later by Mpande’s director, Bongani Sambo, and Diphatse’s chief engineer, Niren Singh, show how unhappy they were and their concern about how Prasa was dealing with the security situation,

On 20 September, addressing all the main contractors, Prasa’s Western Cape lead programme manager, Jaco Cupido, wrote that he had raised their concerns with the CEO, Hishaam Emeran, who he said had asked that they, in writing, inform Prasa about “your reservations around the onboarding of the identified SMMEs and the facilitators.”

Interestingly, Papadopulo was not copied on this email.

It appears that what Papadopulo was pushing for – a Stanfield-Johnson “facilitator” like Yibaninati, providing the three main contractors with security services from SMME security firms – did not materialise in that form.

However, evidence shows that despite these roadblocks, the larger “capture” plan remained on track.

Enter Mzansi Securifire – and ‘Plan B’

On 31 October, Papadopulo emailed Prasa’s Cupido to arrange for the three main contractors to meet Mzansi, the company which had finally been selected for the long-anticipated award of a longer-term security intervention contract.

The meeting was scheduled for 3 November.

The arrival of Mzansi, combined with contractors having expressed concern about using the security facilitating services of Yibaninati and the selected SMME security companies, meant that this option fell away.

Nevertheless, as we will read, Mzansi would ultimately become the Stanfield-Johnson enterprise’s key new vehicle for capturing chunks of the project.

Until now, finding definitive proof of the Stanfield-Johnson enterprise moving from merely planning the capture to actually executing it has been difficult.

Yes, plans seemingly were laid out, but were they actually carried through?

It is understood that the diaries show the Stanfield-Johnson enterprise knew, on the same day that Mzansi was introduced to the main contractors, that there would be road servicing and bush clearing contracts coming their way, that purchase orders were to be approved and that teams had to be on site on 14 November.

AmaBhungane has uncovered several crucial pieces of evidence that indicate it panned out exactly as planned.

Kyle, the contact man

The first piece of evidence is in an email Papadopulo sent from his private iCloud address to Mzansi assistant finance manager, Sudesh Sewdutt, on 10 November. (A Tap Air Portugal data hack in August 2022 shows that the iCloud account belongs to Papadopulo.)

In the email, whose subject is “Yibaninati: Contacts and Purchase Orders”, Papadopulo told Sewdutt he was giving him “the contact details of the team working on the reestablishment of the roads, the clean-up and vegetation control”, and asked him to “send through the necessary purchase orders regarding the clusters 1, 2 & 3”.

Papadopulo said he had discussed with “Mr Amesh” – an apparent reference to Mzansi’s CEO, Amesh Harinarain – that the purchase orders would be sent by 11 November.

“Please note that this is extremely important as the teams will be ready to start taking the site on Monday, the 14th November 2022, to start work.

“The contact person to get the site going from Monday […] is Kyle […]. Please could you make contact by tomorrow with Kyle in order to make a time to start work Monday.”

He adds a cellphone number that traces to Stanfield’s brother, Kyle. His LinkedIn profile shows he works for Glomix as a construction supervisor.

Papadopulo stressed it was “imperative that the purchase orders get sent as early tomorrow morning in order for the teams to be ready to take site on Monday and begin work”.

What this shows is that a way had now been found to get the Stanfield-Johnson commercial enterprise onto the project – via Mzansi, which would bill Prasa.

Papadopulo’s email shows that the deployment of the Stanfield-Johnson enterprise was to be on Monday, 14 November.

AmaBhungane has four invoices, all produced by Yibaninati and addressed to Mzansi during the remaining two weeks of November. They totalled R9.3-million worth of invoices for bush clearing, service road maintenance and rubble removal services. A fifth invoice, whose date is not clear, takes the amount to almost R10-million.

The invoices bill for work in Langa, Bonteheuwel, Lavistown, Netreg, Heideveld, Nyanga, Philippi, Stock Road and Mandalay train stations, which comprise the three clusters that Papadopulo referred to in his 10 November email.

A Yibaninati workflow plan shows site establishments were carried out at these train stations on Monday, 14 November. Work was to begin on 15 November, with the last day of work earmarked for 9 February 2023.

AmaBhungane also has evidence of Glomix preparing quotes for Mzansi in December for fencing and pedestrian bridges, running to between R62-million and R80-million. The fences and bridges were to be erected between Nyanga and Phillippi train stations.

This was one of the areas of the Central Line which had been occupied by those left homeless after the Covid-19 lockdown. As we mentioned earlier, Mzansi’s contract included relocating those occupying the railway line.

The Stanfield diary entries apparently show detailed notes of what work needed to be done and equipment that needed to be ordered.

Building roads

The second piece of evidence of documented plans actually coming to fruition involves “road servicing”.

In the final weeks of December 2022, Glomix, which at the time was involved in construction at the King Air Industria site, hired equipment from Greymo Construction, which was also working on the industrial development.

AmaBhungane previously reported how, for the R3-billion project, Atterbury Group and Old Mutual Property’s joint venture signed agreements with the Cape Flats Liberators, the “community-based organisation” whose directors were Stanfield’s sister, Francisca, and his right-hand man, Ernest McLaughlin.

Greymo’s director, Tim Moffit, told amaBhungane: “In December, as our […] final involvement in the entire project [King Air Industria] drew to a close, and the utilisation of our heavy machinery dipped prior to the builders’ holiday […] I agreed to lease a grader and rollers to Glomix for a short-term task clearing Prasa access roads starting in Epping.

“This lasted two to three weeks.”

The company carrying out the road clearing and maintenance on behalf of Glomix was RJM Civils, which was contracted for six months to work on the service roads. The RJM Civils director, Randall Mullins, was also a co-accused of Stanfield’s in the provisionally withdrawn R1-billion City of Cape Town housing tender fraud case.

In January 2023, Kyle Stanfield sent a report to his brother as well as Johnson, Manuel and Glomix’s quantity surveyor, Phakamisa Nondabula, about meeting Mullins to conduct site inspections on the central line.

Mullins declined to comment.

Right to the top?

The coordination with Mzansi appears to have been driven at the top level.

Mzansi’s former Western Cape branch manager, Riyaaz van Rooyen, told us in an email that one Saturday in November 2022, while conducting a pre-deployment orientation at the Prasa Langa depot, he noticed around 10 men dressed in blue overalls approaching. They asked: “Who is Riyaaz?”

Van Rooyen identified himself, and one of the men introduced himself as Ralph Stanfield.

He says Stanfield told him they were there to inspect the service road and the vegetation growing along the Central Line, which they will clean “as per agreement with Mr Amesh Harinarain” – the CEO of Mzansi.

“I did not know this person at the time, so I duly phoned Mr Amesh Harinarain. I asked him why did he send this person to me? He answered that this is the company that they have awarded the subcontract to clear the vegetation along the Central Line. I was not involved at all in the proposing or vetting and awarding of this contract to Stanfield/Johnson Enterprises [sic].”

Van Rooyen also confirmed that he was requested by Mzanzi’s head office to provide them with a company profile of Yibaninati.

“I then requested it from Ralph Stanfield who referred me to their administrator Suraya Manuel. She emailed the profile to me and it was sent to Mzanzi Securifire Head office. My role was limited only to obtain the profile and to send it to head office for further processing [sic].”

This was apparently for a “cleaning service tender” – one of the ad hoc tenders that Prasa had awarded to Mzansi in November 2022.

Interestingly, Van Rooyen said that “around April 2023”, he attended a work-related meeting at the MBT garage (the John Ramsay Service station, which Johnson owns), in Bishop Lavis, together with his project manager, Prasa officials and subcontractors.

He declined, in follow-up questions, to say who the Prasa officials were or who from Mzansi instructed him to attend the meeting at the service station.

Van Rooyen insists that all sub-contractor appointments and tender bids were centralised at Mzanzi’s head office in Durban and that he was “in constant communication” with Harinarain.

Van Rooyen’s attempts to place all responsibility on his superiors are undercut slightly by evidence that shows that in August 2023, he told Manuel that a person by the name of Neville would be calling her from Mzansi head office (presumably Neville Naidoo, the then-operations director).

He told her not to provide information, as “Neville” was trying to fish out information about whether Van Rooyen had been helping the Stanfield-linked subcontractors with compiling quotes for work.

Van Rooyen disputed this when it was put to him by amaBhungane.

Interestingly, company registration records show that in April 2024, Van Rooyen became a director of a company called Subtiguard Protection Services. The first director of the company, which was registered in November 2022, was Mogamat Petersen, understood to be Nicole Johnson’s brother, and Subtiguard also made use of the Glomix email address. Petersen, until his death last year, was also co-director with Johnson in her business Rocket Mode Trading.

Van Rooyen told us he was no longer employed by Mzanzi when he was appointed as director of Subtiguard. “This company, however, secured no business, and I had no further interest in the business until the company folded.”

As noted earlier, Mzansi’s attorney, Devan Moodley, declined to respond to questions, saying that the matter was sub judice: “Our clients are therefore constrained not to issue any comment.”

Steaming ahead with security

We understand that the diary entries also apparently suggest that following Mzansi’s appointment, plans to involve the Stanfield-Johnson enterprise in security contracts – seemingly previously thwarted by the main contractors’ foot-dragging – came within reach again.

In mid-December 2022, Stanfield apparently made a note to himself to get advice from Papadopulo for the deployment of day and night guards. It is not known if this happened.

Our understanding is that at the time Stanfield was seemingly weighing up different guard scenarios; planning for the guards to undergo induction at Prasa’s Koeberg innovation centre in Salt River ahead of their imminent deployment, and factoring into his budgets expenses such as guards’ medical aid, UIF, and PSIRA fees, while also toying with the idea that his enterprise subcontract six different security companies to Mzansi.

One of these companies we have discovered was PPE, the Stanfield-linked company that Papadopulo had tried to introduce to the main contractors before they baulked.

There is other evidence, however, which shows that the company was ultimately appointed with Stanfield engaged in PPE’s day-to-day security operations from at least July 2023, demanding shift rosters and taking part in the firing of guards.

These rosters show not only how many guards were deployed but also where they were deployed, and that at some stations, they were to work alongside Mzansi guards.

AmaBhungane has discovered that the PPE people with whom Stanfield interacted were none other than Mary-Gail Cartwright and Mehloti Priscilla Manganye – the two former Pretoria-based SAPS Central Firearms Registry officers who, in 2014, were arrested for allegedly aiding him and Johnson to illegally acquire firearms licences.

A Pretoria police source claimed that after they were fired, Stanfield helped Manganye and Cartwright find work at PPE. Online searches show they work for PPE.

Neither PPE’s owner, Phaladi Seboko, nor Cartwright nor Manganye responded to detailed questions despite repeated requests.

Manna from heaven

Sources who worked for some of the Central Line’s contractors described the reconstruction project as a gift from heaven for Stanfield.

“It was his cash cow,” one said.

“He didn’t even have to leave home to go find a project to hijack,” a Transnet source said.

“His people made it known to us that just as he had captured King Air, he would capture our contracts.

“His community-run organisations provided labour from the communities for the Central Line’s reconstruction.”

In 2024, amaBhungane and Daily Maverick reported how, for the R3-billion King Air Industria development, Stanfield’s Cape Flats Liberators sourced unemployed workers and struggling businesses from surrounding communities for the developers to use in the construction of the industrial site.

At Prasa, team Stanfield appears to have used the same template.

The scale of Stanfield’s influence and benefit is hard to quantify.

A Prasa presentation to Scopa showed that 1,654 jobs were created through Protection Services for SMMEs and Community Involvement, with 300 community members involved in clean-ups.

Our Transnet source claimed that the only reason the Central Line was largely functioning today was “not because the government finished the project, but because Stanfield did”.

“He made sure his guys’ businesses were hired. He made sure the people from his communities were employed.”

That may seem like a good bargain, but, as GI-TOC executive director Mark Shaw recently told us, this is a classic mafia move that solidified Stanfield’s geographic control and allowed him to enter a lucrative grey area between a reputation for violence and a foothold on the ladders of corporate and political access and bounty.

The price of that bargain is, in fact, not cheap: it is incalculable and may just keep growing. DM