#GuptaLeaks: From cloak and dagger handovers to the Zondo Commission – a hard drive's journey like no other

The State Capture Inquiry has taken possession of hard-drives containing hundreds of thousands of leaked Gupta emails, essentially a critical mountain of evidence that was the undoing of the controversial family in South Africa.

Rewind to 13 February, 2017: The day that marked the beginning of a powerful and effective shift in the country’s fight against State Capture.

This was when renowned South African human rights lawyer, Brian Currin, was first introduced to a whistle-blower who had come into possession of hundreds of thousands of leaked Gupta emails.

Code named “Stan”, this whistle-blower had for months been holding on to the explosive information, unable to figure out who to trust or who to turn to with data he believed could help pull the country out of the doldrums of crippling corruption.

He had confided in an unnamed friend who, upon realising the magnitude of the information and the likelihood it could prove much of the corruption allegations surrounding the Guptas, their companies, public officials and some members of the executive, called in another friend, this time Currin, someone with a long history of fighting for what’s right.

The anxiety, the nervous tension, had to be palpable. Stan asked him: “Can you help me to get out of the country, with my family, I need protection.”

Stan was afraid, justifiably so, said Currin during testimony at the State Capture inquiry on Thursday morning.

Until now Currin’s name has never been publicly linked to the #GuptaLeaks and nor have there ever been details of his first encounter with one of two #GuptaLeaks whistle-blowers and the acquisition of the leaked material.

“Stan had been in possession of the hard drive for some months and looked like he had a need to off-load.”

Stan finally had an opportunity to share some of what he had seen in the leaks and he referenced information about Duduzane Zuma, the Guptas, CEOs of major state-owned companies – all of which he said were on a hard drive containing documents, financial records, spreadsheets and emails of Gupta lieutenant, Ashu Chawla.

Currin said that while subsequent legal opinion obtained has confirmed that Stan was “legally” in possession of the leaks, he could not elaborate on the details of how he came to have them as it may enable the identification of him and an equally important second whistle-blower. Both now live outside the country, unsure of when they may be able to return home safely.

Stan told Currin that he had given the original hard drive containing the leaks to another friend for safekeeping together with a cloned copy thereof. Within days of their first meeting, Stan gave Currin two CDs containing part of the information; this would later be followed by cloned copies and, eventually, also the original hard drive.

Since that first meeting in February 2017, the hard drives containing the emails, documents and travel bookings for Dubai’s Oberoi hotel down to the controversial family’s Sun City wedding in 2013 would make multiple journeys, some across the borders of South Africa, be mirrored and sealed and repackaged – all of which were done to protect the package and to ensure that one day it could be submitted to a credible body investigating State Capture.

The original hard drive and a clone thereof, along with another copy, this time made with the help of United States government officials, are now all in the hands of the State Capture Inquiry.

On Thursday, lawyers for the Commission brought an application that the devices and the content thereof be admitted as evidence in the ongoing investigation into the Gupta heist of state-owned companies and the role played by former president Jacob Zuma and or his son, Duduzane.

Admission of the #GuptaLeaks, it was argued, is vital to ensure the Commission thoroughly investigate the Guptas’ role in State Capture as well as public servants who worked with them.

That the leaks are now sitting with the Commission is remarkable considering the journey it took to secure them over the past 19 months.

Stan initially told Currin that if all went according to plan, he would hand over the hard drives, both the original as well as a clone thereof along with passwords that would allow access to the content.

“I could understand why he couldn’t share anything until safety measures were in place.”

When he gave Currin the two CDs containing some of the data, Currin too realised he would need to call a friend to help.

He reached out to civil society activist Mark Heywood to keep a copy of the cloned hard drive and to assist him with the best possible team to help with the management of the process of handling the leaks until they could eventually be published.

Heywood identified Branko Brkic, editor of Daily Maverick, as the person to be entrusted with the emails. Brkic partnered with the amaBhungane Centre for Investigative Journalism and, together with AmaBhungane's co-founder, Stefaans Brümmer, devised a plan to assemble a team of investigative journalists to sift through the leaks, corroborate the information and develop it into a body of stories, initially scheduled for publication around September 2017.

But, both whistle-blowers were forced to leave the country hurriedly when a copy of the #GuptaLeaks made its way to the Sunday Times, a publication not party to the journey of the devices or that had any knowledge of or engagement with the whistle-blowers.

The newspaper published the first of a series of articles on 28 May and a few Twitter teasers that went out the night before, sending the entire #GuptaLeaks team into crisis as they feared for the safety of Stan and John, by then still on South African soil.

“The unanticipated breaking of the story caused huge anxiety for the whistle-blowers. It impacted on their trust in the process we were following and my role,” Currin told the Commission.

“Stan wanted public support for the project and that required publication of some of the information. But he emphasised that nothing could be published until they were out safely.

“They would need money to live in exile as there was a chance they may never be able to return.

“Fundraising efforts, at times, were unsuccessful. There were ups and downs, promises that didn’t materialise,” Currin said.

And, before they could leave the country, Currin needed to secure the hard drives and get affidavits from Stan and John. Those sworn statements were important because they would enhance the value of the information as evidence, Currin told the Commission.

Two copies of each statement were made and kept separately. The statements cannot be released as they too would compromise the identity of the two whistle-blowers, Currin said.

The team had taken time to build a relationship of trust with the whistle-blowers and took extreme safety precautions for every meeting. The hard drives were sometimes kept apart as an additional security measure.

Subsequent meetings with Stan and/ or John have either been in Kenya or London.

In January 2018, amid clear evidence that the political situation in the country was changing, Currin travelled to London to meet Stan. He wanted to discuss the possibility of making available the original hard drive to authorities now investigating State Capture.

“While in London I got a call from one of my colleagues at the Johannesburg office to say that United States authorities had arrived and wanted to meet with me.

“I wasn’t sure what they wanted to speak to me. I didn’t think they would know of my role in relation to the hard drive.”

“When I met with them, they knew my role, my name. Wouldn’t tell me how they knew. They knew of Stan, one of the whistle-blowers, but didn’t know his true identity.”

The Americans told Currin they were doing international investigations and wanted to meet Stan and asked for access to the leaks.

But the whistle-blower, while willing to meet with the Americans, was not keen on sharing the information.

Currin says Stan and John were adamant from the onset that this should always be a South African process, driven by South Africans, in the interest of SA.

They decided to hear the Americans out and agreed to a meeting in a third country. After that meeting, Stan agreed that only a cloned copy of the original hard drive could be made available to assist the Americans, who had told them they had excellent equipment available to make a mirror of the forensically cloned copy.

Due to the fragility of the original – it had been damaged – this was also the “best and most reliable” evidence at the time.

Another meeting was scheduled for this process, this time in Kenya.

Currin said he then decided that someone from the State Capture Commission should be involved.

“We had agreed to approach Zondo Commission and decided the information about the original hard drive could spread and therefore we agreed that the original and the first clone should be removed from SA as soon as possible before the actual trip to Nairobi.”

He collected the original and the clone from Norton Rose Fulbright, the Johannesburg attorneys’ firm where he had deposited the leaks in a sealed package earlier.

Once in Nairobi, the team again sealed the hard drives and handed them to a different attorney for safe keeping and Currin headed back to Johannesburg.

He testified that he contacted the Commission’s legal team the next day and arranged for them all to meet with the Americans and the whistle-blowers in Nairobi on 11/12 April.

Now, it was Currin, Stan and his wife, the unidentified American team and three representatives from the Zondo Commission – John, the second whistle-blower, could not get there in time.

The purpose, he said, was twofold: One, to facilitate the imaging of the clone in accordance with expert forensic methodology, and two, to introduce whistle-blowers to the Commission’s team.

The US authorities made a copy of the clone. The original hard drive was not touched for any purpose and no attempt was made.

“We all returned to SA, there was discussion about what would happen to the original.”

It was decided that both hard drives would be brought back to South Africa as the handover to the Commission’s team could not take place in Kenya because they had no jurisdiction there.

Once at OR Tambo International Airport, Currin says his lawyer handed the devices to Terence Nombembe, head of investigations for the Zondo Commission.

And then, the hard drives were taken to a secure location in Pretoria under escort of the blue light brigade.

“It was decided the Commission would be responsible for the preservation of the original hard drive and the original clone and keep it until such time as the Commission is able to access the top experts in the world without the original collapsing… at least then the best effort will have been made to ensure it was a successful exercise.”

Currin said his understanding was that the ultimate use of the data as envisaged by the whistle-blowers was precisely what was happening now – to make it available to a credible commission of inquiry to use to ascertain the veracity of the emails and the documents.

Thursday’s application for the hard drives containing the #GuptaLeaks was brought ex parte, meaning neither the Guptas nor their company, Sahara Computers, were given notice thereof.

Should they wish to challenge the admission thereof as evidence they will be confronted with two options: One, to argue privacy or confidentiality, and in doing so they may as well confirm the authenticity of the data. Alternatively, the Guptas may say the material – hundreds of thousands of emails and document files as well as the hidden electronic data – are a fabrication, in which case they would have no real right to challenge its admission to the State Capture inquiry.

In stating the case of the Commission’s legal team, senior advocate Paul Pretorius said admission of the leaks was of “overwhelming” public interest.

“Any privilege based on confidentiality is in principle limited because this principle only applies to information to the extent that it remains confidential – too much of it is already in the public domain.

He highlighted the fact that the Commission has now, through external expertise, gleaned additional data from the original cloned hard drive, but said the full extent of the new information would only become known once the material is fully analysed. The Commission’s expert has already confirmed recovery of 99.9% of the original content of the devices.

Pretorius said the mandate of the Commission would not be fully completed without admission of the #GuptaLeaks and the extraction of the newly discovered content.

“The duty to investigate State Capture, corruption and fraud in the public sector and SoEs is in the interest of all South Africans, particularly the poor,” Pretorius said.

Sahara’s privacy concerns, should they raise that at some point, cannot outweigh public interest, he said.

The hearing resumes on Friday morning. DM