Daily Maverick
Dailymaverick logo

Business Maverick

This article is more than a year old

Business Maverick

Laptops seized, officials suspended as probe reveals cybercrooks stole R300m from public works department

Cybercriminals have targeted the Department of Public Works and Infrastructure over a decade, stealing about R300-million. The investigation into this started under former minister Sihle Zikalala. His successor, Dean Macpherson, is now revealing details about it.
Laptops seized, officials suspended as probe reveals cybercrooks stole R300m from public works department Public Works Minister Sihle Zikalala. (Photo: Gallo Images / Darren Stewart)
Caryn Dolley
By Caryn Dolley
10 Jul 2024
Facebook
9

Thirty laptops have been seized and four officials suspended as part of an investigation that has revealed that cybercriminals have stolen R300-million – and counting – from the Department of Public Works and Infrastructure over 10 years.

This is according to Minister of Public Works and Infrastructure Dean Macpherson.

The investigation into the cybercrime started under his predecessor, Sihle Zikalala, with Macpherson taking over as minister roughly a week ago.

“It has become clear that the department has been a soft target and playground for cybercriminals for over a 10-year period and this should have been picked up a lot earlier,” Macpherson said on Wednesday, 10 July 2024.

“I cannot discount the possibility of collusion between officials and criminals in this prolonged period of theft. 

“It is clear that we need better financial controls which I have said to the department are a matter of urgency.”

Hackers target government


Cybercrime is a major problem in South Africa.

Daily Maverick previously reported how the government has been affected by this, including how crooks targeted Transnet and its division that operates the country’s biggest ports.

Read more in Daily Maverick: Cyberattacks: South Africa, you’ve been hacked

On Wednesday, Macpherson elaborated on how the Department of Public Works and Infrastructure has been affected.

The department is involved in building and maintaining critical infrastructure in the country.

cybercrime public works Macpherson Minister of Public Works and Infrastructure Dean Macpherson. (Photo: Gallo Images / Darren Stewart)


‘Staggering’ cybercrime


A statement on Wednesday said Macpherson had “decided to take the public into his confidence in the interests of transparency”. 



The statement went on “to reveal a staggering cybercrime related matter that has been unearthed by the department resulting in an amount of at least R300-million being stolen in the past 10 years. However, this could be more as investigations continue.”

In May 2024, when Zikalala was still public works and infrastructure minister (he is now deputy minister), a statement was issued saying he had ordered a forensic investigation into its information and technology systems.

This came after the department’s banking partners, including Absa and the South African Reserve Bank, had helped it to flag vulnerabilities.

Zikalala said the investigation, involving, among others, the South African Police Service (SAPS) and experts in the cybersecurity industry, would focus on issues including information technology resilience, staff capacity and improving internal controls. 

Payments to creditors affected


The statement from May said the investigation would have “implication on the processing of payments to creditors and beneficiaries”.

According to Wednesday’s statement, it was in May that it emerged that cyberattackers stole R24-million from the department.

Read more in Daily Maverick: Catastrophic global cyber event predicted as SA government faces increasing attacks — experts

Macpherson, who welcomed that investigation launched by Zikalala, said it had so far revealed the causes of breaches, vulnerable areas in the department, and a lack of staff capacity, as well as weak information and computer technology systems.

The investigation would be expanded “and deepened to find the masterminds and the beneficiaries of this grand theft, and I want to see them in prison”.

Three senior management officials in the department had so far been suspended along with another in middle management.

cybercrime Sihle Zikalala Deputy Public Works Minister Sihle Zikalala. (Photo: Gallo Images / Darren Stewart)


Four suspensions, 30 seized laptops


Investigators had also seized dozens of laptops.

“I welcome the precautionary suspension of four individuals including senior managers and the seizure of over 30 laptops for further examination by the investigative teams,” Macpherson said.

“There is simply no place for corruption in this department.” 

Illustrating just how critical the work of the Department of Public Works and Infrastructure is, is an example relating to the SAPS. 

(Coincidentally, based on repeated attempts by this journalist and others to access it, the SAPS’s official website seemed to be down from Tuesday, 9 July into Wednesday, 10 July.)

It was previously heard in Parliament that the department was the custodian of several properties that the SAPS used, but some of those buildings were not fit for them to use.

Read more in Daily Maverick: ‘A catastrophe’ – Minister Bheki Cele describes shocking work conditions for SA police

Other buildings meant to have been built had not materialised.

In 2022, Police Minister Bheki Cele said a laboratory in Amanzimtoti had flooded four times, affecting equipment and operations.

He had added that more than a decade ago the Public Works Department was meant to have built another laboratory in Pinetown, but by 2022 this had not happened.

SA global anti-cybercrime reach


Meanwhile, in cracking down on cybercrime South Africa seems to have extended its powers. 

At the end of 2023, the Special Investigating Unit (SIU) entered a memorandum of understanding with the International Criminal Police Organization, better known as Interpol, in South Africa, that is aligned to its stance on cybercrime.

The memorandum provides the SIU with direct access to data systems in 195 countries.

In June 2023, it was announced that “South Africa and France have entered into a cooperation protocol agreement to improve the Special Investigating Unit’s cyber forensic capabilities”.

The minister of justice at the time, Ronald Lamola, said the cooperation would tighten the SIU’s cyber forensic investigations.

“We are going to benefit a lot through this process of training that will enable our forensic cyber capabilities and investigations to be on par with the standards of the world and the globe because these types of crime are no longer just national, they are transnational in nature,” he said. DM

Comments (5)

James Francis Jul 11, 2024, 11:44 AM

This trend has now surfaced in a few public departments, including the Dept of Justice (if I recall correctly). Staff steal money and then try to claim it was a cyber breach or hack. And there is not enough support or money to train investigators and conduct cyber forensics. It makes me wonder why there is no political will or even media outcry about the dismal state of SITA. If we are in the digital age, SITA is surely as important as the Finance ministry, Eskom or SARS... It made huge headlines when they tried to poison Eskom's CEO. But the outcry was much more muted when SITA's CEOs received death threats. If SITA was functioning properly, tech procurement would be more transparent, and these kind of insider heists would reduce dramatically. Right now, everyone in the public sector does what they want and makes tech deals with whoever has the biggest brown envelope. Many public servants, especially higher up the authority chain, are actively sabotaging digitisation in the Public Service as it will reduce their ability to commit crimes.

lesley.young1945 Jul 10, 2024, 05:05 PM

At least give credit to Sihle who started the investigation.

Kevin Venter Jul 11, 2024, 02:19 AM

So spot the problem on two fronts here: 1) An investigation had already been started YET nothing put in the media. That tells me that the ANC was trying to hide it, which then means guilt through the cadre deployment program and THEY KNOW IT. 2) One week into the new job and this is already uncovered in this department. In the Sports, Arts and Culture portfolio, Gayton then immediately stops the wasteful expendature of super fan fare meaning "MAMA JOY's round the world party comes to an immediate end". So it then stands to reason that the wasteful spend and corruption already uncovered in two departments, means that the same thing applies to ALL departments. And then we wonder why the DA only got 6 cabinet posts when it should have been 12 by the vote % So the whole premise of GNU by the ANC was a calculated approach to "damage control". Well guess what, in the last week of uncovering this malaise, it is now evident that the same is needed in every other department. Cyril and the ANC have made a grave mistake in doing what they have done by going down the road of a GNU. I know it is easy to pass comments from the peanut gallery but a coalition government would have been better in my opinion because that would indicate that the ANC was humble enough to then admit that they are not perfect and in the interest of self preservation and the country, to then confess the sins and allow the country to at least go forward with less corruption. Problem is... when the rot goes all the way to the top (yes Cyril is as guilty with Phala Phala and Bosasa) then it makes sense why they have done what they did. Hopefully the voters are now starting to see the light. The ANC were good as a liberation organization but as history has proven, liberation organisations are not good at running countries unless the measure of success is to run it into the ground. The country no longer needs the ANC, it needs a very different government if we are to see any kind of improvement in South Africa.

Kevin Venter Jul 11, 2024, 02:04 AM

Good that he started it, and the law must follow its course and he is innocent until proven otherwise. Just to then play devils advocate, I am asking myself.... Did HE start the investigation as a way to prevent his own name from being added to the list of suspects? The plot thickens.

Ed Rybicki Jul 10, 2024, 06:57 PM

They did?

Inertia Maharaj Jul 10, 2024, 03:47 PM

I'm sorry to be pedantic, but is it R30 million or R300-million? That headline and the first line of the story don't match up. "Thirty laptops have been seized and four officials suspended as part of an investigation that has revealed that cybercriminals have stolen R30-million – and counting – from the Department of Public Works and Infrastructure over 10 years."

bigbad jon Jul 11, 2024, 12:28 PM

As I understand it, it was at least R300 million over 10 years. Latest was R24 million in May 2024

Middle aged Mike Jul 10, 2024, 02:28 PM

Hands up, who thinks anyone will get and actually sit through some jail time for this? C'mon, all together now!

jcdville@gmail.co.za stormers Jul 10, 2024, 02:18 PM

No wonder they call SA a crime paradise,please turn it around by applying the rule of law