Good party sends explosive evidence to Hawks unit of 26 individuals directly implicated in SA’s July unrest

The Good party’s secretary-general, Brett Herron, handed over explosive evidence related to July’s unrest to the Hawks’ Crimes Against the State unit on 4 August.  

This evidence links 26 individuals directly to the riots and looting in which 330 people died and 150,000 jobs were placed at risk, and which ripped R50-billion from anticipated GDP. According to the detailed analysis seen by Daily Maverick, many of them are ANC members or government employees.

Herron reported three WhatsApp groups which were central to organising the unrest. These are the “Ethekwini Shutdown”, the “INK Shutdown” and the “Free Zuma Information” groups. The first two were organising groups while the Free Zuma Information team was the master group, as Daily Maverick reported here.

Now Herron has added 26 names to the group of people who allegedly organised the week of mayhem. Daily Maverick has not named them as they have not yet been charged. 



“The content of the WhatsApp groups and supporting audiovisual material is explosive and shocking,” says Herron. He says organisers set up the three groups from the day after former president Jacob Zuma was jailed on 7 July.

“I had the evidence I could not ignore,” said Herron, who has handed over the material to Col Christiaan Theron of the Hawks unit that investigates crimes against the state. The police will now investigate the evidence.  The SAPS referred queries to the acting minister in the presidency's office.

Herron believes the evidence points to sedition and terrorism. “It was an attempt to disrupt or overturn the state,” he says, picking out a chat message from one ANC member on the group which reads: “Let’s be the terrorists of South Africa.”  

President Cyril Ramaphosa has called the week which shook South Africa a “failed insurrection”, while former president Thabo Mbeki labelled the week a “counter-revolutionary insurgency”, an adjective also used by ANC NEC member and head of the Mapungubwe Institute for Strategic Reflection, Joel Netshitenzhe, in this Daily Maverick piece.  

“We heard [from the government] about 12 instigators, but there are no signs there has been movement to arrest them. Of these 26 names, a lot were directly involved,” says Herron. 



His evidence is chilling – it includes details of alleged ANC members who used a hired bulldozer to move sand to block roads, plans to disrupt the Durban harbour (which did happen) and numerous threats to make the city ungovernable.

“It is clear that these WhatsApp groups contain clear evidence of incitement, planning and involvement of many individuals in the insurrection, looting and acts of terrorism witnessed in KwaZulu-Natal and Gauteng,” says Herron. 

Most of the 26 named are ANC members, whistle-blowers have said. At least three people are believed to work in government (reportedly for the KZN provincial legislature, the KZN health department and the eThekwini municipality). At least one other person is an ANC volunteer employee.  One man calls himself a commander of the now-suspended MKMVA, while a woman on the list claimed to be an SANDF soldier.   

The groups plotted how to cripple Durban’s harbour, with an ANC member posting, “Comrades, our goal is simple… we shut down iBayhead ksasa [the harbour area tomorrow]. Feel free to chip in ngokuty do we go about in achieving this.” On 12 July, the harbour was closed due to looting and violence.

Other posts read like a terrorist wishlist, with instructions to bring “Umetshisi [matches], u Petrol, Petrol bom…” The groups contain numerous posted videos of looted malls, stores and other businesses. For example, when McDonald’s at Umlazi MegaCity was torched, one member of a group responded with the words, “I’m happy to see this.”  

The plan to destabilise the country by cutting off supply chains is clear.  One post reads: “Transnet you. Airport you than business sector you next and we are turn back [sic].” 



Transnet declared force majeure in July after a cyberattack on port facilities, while also suffering disruptions to its coal line earlier in the month. This delayed exports and meant agricultural products were ruined while waiting. 

Intelligence foiled plans to take out the airports, according to the State Security Agency. A man believed to be a government employee posted, “Already ‘state intelligence’ is aware of these plans and im sure they gearing up 4 anything the only thing 2 create a elemnt of surprise is distabilising the country anywhere anytime without any anouncemnt [sic].”

Several of the 26 people named by Brett Herron are likely to have been organisers, as they repeatedly posted from different sites and served the function of egging on the rioters. In one of the messages, a person posted the word “Burn” nine times, like a digital chant to praise the arson attacks on trucks. About 45 trucks were burnt or hijacked at the N3 Mooi River Toll Plaza and on the N2 highway leading into and out of Durban. 

Other videos included evidence like people burning tyres, with the voiceover describing it as a revolution. A man who led the protests at Nkandla during the weekend ahead of Zuma’s jailing also posted an image of an ATM being carried off by a bulldozer. 

Herron says the rioters had access to money as they hired equipment such as bulldozers and angle grinders.    

In its latest “Counting the Cost” bulletin published this week, the SA Property Owners’ Association (Sapoa) said looters had caused R300-million in damage to educational facilities, 90 pharmacies had been destroyed and 112 shopping centres had been looted and damaged. Rampaging mobs had also destroyed 1,223 ATMs, 269 banks and 3,931 stores. Sapoa said 150,000 jobs were in jeopardy, 50,000 informal traders had been impacted and 40,000 businesses affected. DM