Pretoria, November 2005 to March 2006
THE MOST SPECTACULAR BREAKTHROUGH in the inspector general’s investigation came with a raid on a Gauteng home on 1 December 2005. Following investigations of NIA records, including payments for services rendered, an individual whom the IG believed could assist in inquiries was tracked to the address. Accompanied by police with a search and seizure warrant, Zola Ngcakani’s key investigator, Imtiaz Fazel, found the person they sought at home. His name was Muzi Kunene, an IT specialist and company director with a chequered history. A shaken Kunene refused to answer any questions. Computer equipment, documents and his mobile phone were seized for testing. A laptop computer that Kunene had sought to conceal by hiding it in a laundry basket was a prize discovery.
What was surprising among the finds was the photographs on display in his house of Kunene proudly posing with Zuma at a formal event. This was when a partnership had been formed between Kunene’s IT firm and a leading IT company in the States. He had become the CEO in 2002 and the deputy president, Jacob Zuma, had clearly been a guest of honour at the occasion held to celebrate his new role.1
Muziwendoda (Muzi) Kunene, originally from KwaZulu-Natal, had been an IFP member, with links to a German religious and educational mission in the province that was considered by ANC members to be particularly right-wing.2 He had received IT training courtesy of the institution and benefitted by being sent to Germany for further training. He visited Namibia in 1989 in the company of a self-confessed SADF military intelligence agent, Koos Greeff, to sow anti-Swapo3 propaganda in the run-up to that country’s first democratic elections.4 Kunene’s notes revealed contact with an NIA assistant of Masetlha’s, Funi Madlala, who was an IT cyber specialist. There was also reference to a meeting with Masetlha.
The identification of Kunene was a spectacular breakthrough in the IG’s investigation – the smoking gun that was needed. The IG’s report featured forensic evidence acquired from Kunene’s computer. An eye-opening discovery in his computer revealed work on the email collection in the Kgalema dossier.
The analysis of the emails by experts was to prove vital to the IG’s investigation. These included a foremost forensic criminologist, Irma Labuschagne, the head of the Cyber Unit of the South African Police Service, and a top IT expert.5 The forensic criminologist’s analysis was extremely detailed. In the first place she concluded that the style and language used in the emails and accompanying chat room material could not be authentic. Emails of a confidential nature would at least be in a cryptic style employing shorthand, acronyms and initials. Where subject matter was of a treasonable nature, involving educated people, an actual coding programme would have been utilised. As evidenced by the extensive number of identifiable errors in text – in terms of expression, grammar, syntax, spelling and so on – the alleged author(s) conveyed messages in a naïve way, strangely repeated the full names of the so-called conspirators and continually included unnecessary detail, unusual in genuine correspondence. The author(s) had little education and a poor command of English and Afrikaans. One such example related to the prosecutor Gerrie Nel, a fluent Afrikaans speaker, who in the emails wrote in bad Afrikaans.6 Among other highly questionable peculiarities was the almost total use of English in the texts where people familiar with one another would more commonly prefer to use their common language.
Then there was consistency in the misuse of the same phrase by different persons, for example:
Ngcuka: ‘to make sure that the Zulu bastard is nailed to the cross’ (page 2);
Macozoma: ‘to nail this coffin’ (page 8);
Buckland: ‘we need to nail them to the same cross’ (page 15);
Mlambo-Ngcuka: ‘It’s time we nailed Billy to the cross’ (page 74).
Different individuals who knew Motlanthe well all spelled his name incorrectly in the exact same way, i.e. Motlantle. These included Vusi Pikoli, Peter Vundla, Saki Macozoma, Trevor Manuel and Phumzile Mlambo-Ngcuka. So did people more distant from him, such as Tony Leon and Johan du Plooy. Notwithstanding that the two alleged conspiratorial groups were distinct from one another, they continually made the same mistakes in the way in which they spelt the names of the main participants. Billy Masetlha was referred to as ‘Masetla’; Kgalema Motlanthe as ‘Motlantle’; Joel Netshitenzhe as ‘Netshetendze’; and Khampepe as ‘Kamphepe’.
The criminologist found it highly unlikely that any of the individuals who purportedly sent the emails were in fact the author(s). On a conceptual level the ‘storyline’ appeared infantile and naïve. The criminologist believed there were probably two writers involved and probably another person who fed the writers with information. The documentation reminded her of the way in which a ‘soapie’ was written for television whereby the head writer provides the daily ‘storyline’ to various scriptwriters.
While it might be argued that the criminologist’s opinion was based on human judgement and experience, the IG turned to computer science for proof based on forensic evidence. A reputable computer scientist was employed to examine the printed emails and chat sessions to assess whether or not the information represented authentic intercepted data communications.7 He was absolutely clear: the allegedly intercepted emails were fabricated and could not have been transmitted via the internet. Technical errors abounded with innumerable inconsistencies relating to such features as angled brackets, headers, timestamps and what is called spurious data. All these should ordinarily appear in standardised formation as automatically produced by a computer with machine-generated protocols and repetitive formats. The inconsistencies and errors showed beyond doubt that the emails were manufactured and not intercepted. In short, they were fake.
Moreover, messages sent by the Cyber Unit of the SAPS to the mail addresses showed they did not exist. A forensic investigation of computers belonging to the alleged participants was undertaken to establish whether the emails had been sent from those machines. This found that no email communication took place between them on the respective dates and times referred to in the emails.
There was much more evidence. The inquiry revealed that Masetlha had contracted an agent to ‘intercept’ the emails, for which service he received payment from NIA. His identity was established as Muzi Kunene.8 Information found in his possession provided evidence that it was he (with or without others) who fabricated the emails.
The investigation also brought to light the fact that the involvement of Kunene was known only to Masetlha and Funi Madlala, NIA’s manager of cyber operations and IT, whose identity became public when criminal charges were laid against him. It was apparent that the Project Avani team, in particular its most senior members,9 had not readily accepted the authenticity of the ‘intercepted’ emails, which remained in the exclusive custody of Masetlha (with minor exceptions) and Madlala. Attempts to verify the authenticity of the emails were reportedly met with the obstructionist tactics of the director general, who wanted the team to believe they were true.
As a result, I exonerated Gibson Njenje and Bob Mhlanga from involvement in the email fraud. However, they were found complicit in the illegal surveillance operation against Saki Macozoma and in the fabrication of the story about what had led to that botched operation as well as guilty of deliberately attempting to mislead the minister and the IG.10
The IG’s investigation had occupied some six months of dedicated work by his team, from September 2005, when I set his terms of reference, through three phases of inquiry, to March 2006, when he submitted his final report. This consisted of numerous volumes amounting to thousands of pages with relevant annexures. The investigation involved dedicated and painstaking effort, hours of interviews with numerous persons and witnesses, extensive cooperation with the police, hundreds of hours’ worth of analyses by experts, and complex forensic studies of various computers and electronic equipment, not to mention the demanding effort of writing meticulous reports. Anyone doubting the integrity of the investigation and the objectivity of the findings would be hard put to prove otherwise.
For me as the minister it could not have been more satisfactory to interact with the IG, Zola Ngcakani, and his most capable chief assistants, the chief operating officer, Imtiaz Fazel, and his legal adviser, Advocate Jay Govender.
Apart from the fact that the investigation was so definitively able to conclude that the emails were fake and had been concocted to present a supposed conspiracy to prevent Jacob Zuma from becoming president of the country, the most significant achievement was to identify to some degree those behind the falsification of the material.
Based on his findings, the IG recommended that I consider bringing disciplinary hearings against the NIA director general, Billy Masetlha; the general manager: counter-intelligence, Bob Mhlanga; and the operational support manager, Funi Madlala; and criminal charges against Masetlha, Madlala and the source of the fabricated emails, Muzi Kunene.11 Action against Gibson Njenje was dropped as he had resigned from NIA in early November.
The IG presented his report to cabinet, which fully endorsed it. Masetlha’s long-time peers and comrades-in-arms during the liberation struggle, the police commissioner, the chief of the defence force, the head of the National Intelligence Coordinating Committee, and the directors general of defence, justice and the intelligence services, also publicly endorsed the IG’s report and condemned Masetlha’s conduct. The police commissioner, Jackie Selebi, announced that the law enforcement agencies would have to consider issues of criminal liability arising from the report and carry out their own investigations.12
President Mbeki dismissed Masetlha from office on 22 March, citing a ‘breakdown of trust’ between them, which was the conventional formula for terminating the service of senior executives and was well within his powers. The IG and I were on hand as Masetlha received the news at Mbeki’s residence on a sunny afternoon. I recall the chimes of several period clocks in the spacious residence as the meeting got under way. There was certainly no joy or crowing on our part although Masetlha looked quietly defiant and shook his head in disagreement as Mbeki informed him of the parting of the ways. It was a shame Billy Masetlha had brought upon himself. We were relieved to see his back, but not happy about the turn of events. None of us wanted to see him facing criminal charges, though this would depend on police investigations beyond the control of even the president. I am certain none of us thought this was the end of Masetlha, a man with political ambition who never gave up. We were not out to ruin his political career. That would depend on how the ANC membership regarded him. I well knew there were many who sided with him, including powerful forces angling to ensure that Jacob Zuma was elected as the next president after Mbeki. We would also have to hear from Motlanthe’s task team looking into the emails, independently of the IG’s investigation.
As I ambled back to my residence on the presidential estate, I realised that there had been no emails since Masetlha’s suspension in October 2005. Lost in thought, I was not even bothered by those ubiquitous shrieking hadedas. Arriving home, thinking of that long night in October when I had trawled through the report Masetlha had dropped off, and had my first glimpse of the fake emails, I thought of the dots I had been connecting – from Macozoma’s surveillance through the emails to Kunene and the Luthuli House fire and their arrival on the doorstep of the unwitting Kgalema Motlanthe. I had a strong sense of foreboding that, given the conspiratorial murk in the country, the saga had not ended.