First published in the Daily Maverick 168 weekly newspaper.

The masterminds behind the scorched-earth-style looting and vandalism gouging into South Africa may include a deep network of rogue intelligence operatives whose work is being – inadvertently or strategically – promoted by public figures, including a former radio DJ.

It appears – based on information from various sources and screengrabs of messages – that some of the criminal chaos was plotted, pushed via platforms including WhatsApp and social media, then launched, with meticulously briefed groups targeting key sites.

Thereafter opportunistic criminals and destitute residents, desperate for necessities, joined in.

This widespread looting, mainly in Jacob Zuma’s home province of KwaZulu-Natal, but also in Gauteng, has led to pockets of residents cut off from food supplies, the closure of vaccination sites, mass job losses and has sparked fears that petrol pumps will run dry. This exacerbates the Covid-19 crisis.

In one of the more sinister moves, roughly 10,000 rounds of live ammunition were stolen from a store in Durban. They were recovered by police. Further unverified reports suggested many more firearms, from a shipping container, may have been misappropriated.

Civilians have taken it upon themselves to fend off looters and several taxi groups – an industry often the source of violence – have also vowed to protect property. By the end of the week, even as the situation looked to be calming, more than 120 people were reported killed. Arrests nationally were nearing 1,500, with one of these being a key instigator of the violence and mayhem.

Justice Minister Ronald Lamola described the situation as “clear economic sabotage”.

Layers of looting

Zuma was jailed for contempt of court just more than a week ago, on 7 July, relating to his failure to cooperate with the Commission of Inquiry into State Capture. This led to his supporters protesting against his incarceration – acts that soon morphed into intense looting.

While some of the plundering is poverty-driven desperation, several red flags indicate a much more sinister game plan. Although the looting eventually became a free-for-all beyond the control of any purported instigators, in key areas it almost certainly originated from well-orchestrated gatherings.

An insider in Johannesburg’s private security industry, who asked to remain anonymous, witnessed the entire drama in the city’s CBD from its inception before the crack of dawn on 11 July.

Private security and local police were well aware of the pending trouble, says the source.

One of the #FreeZuma posters circulated earlier in the week on WhatsApp and other platforms after the former president’s arrest called for a “shutdown” in Joburg and other locations.

Strategic targets mostly in KwaZulu-Natal and Gauteng

• Food Supermarkets, various warehouses emptied out.


• Communication Community radio stations, broadcasting infrastructure – including 113 network towers – vandalised.


• Transport Roads blocked, preventing residents from getting to shops and petrol stations.


• Healthcare Pharmacies vandalised, Covid-19 vaccination sites forced to close.


• Water A treatment plant set on fire in Pietermaritzburg.

At exactly 4am, as per the poster’s instruction, a group of 200 to 300 people gathered near a large block of flats on Albertina Sisulu Road on the eastern side of downtown Joburg.

Things got out of hand almost immediately.

“The group moved towards Marshall Street, breaking windows of businesses and other buildings and looting a Pep outlet on their way,” the security operative told DM168.

According to our source’s information, a large contingent of the group came from the nearby George Koch Hostel, although this could not be independently verified.

Particularly suspicious are the attacks on national infrastructure, which are uncharacteristic of the usual protest action in South Africa. The Independent Communications Authority of South Africa reported that several community radio stations and broadcasting infrastructure, including 113 network towers, were vandalised, representing “a direct attack on the constitutional right of individuals and communities to access news and information … about the current crisis”.

Deputy State Security Minister Zizi Kodwa, during a television interview on 14 July, said: “You can see this operation is run by people who have run operations before… the plan that is well orchestrated… it’s not like sporadic, it’s not like spontaneous. That’s why you hear allegations that people are being paid.”

Kodwa added: “Last night in Maponya [a mall in Soweto]… a number of young people were arrested. They gave names of people who have paid them to carry [out] a certain operation.

“They are now in the custody of police. They form part of the wider investigation of the real instigators behind this violence and chaos we see [with] the particular motives to destabilise the country.”

Dark smoke and huge blazes continue being the order of the day in Durban as more factories are set alight in Springfield and Nandi drives on Wednesday, 14 July. (Photo: Supplied)

Newzroom Afrika footage showed a suspect outside Maponya Mall who, grilled about who sent him, responded: “Thulani.”

Meanwhile, Kodwa also referred to an individual being investigated, whom he did not name but said was mentioned in the media on Wednesday 14 July.

He was probably referring to Thulani Dlomo (whom News24 named as being under investigation), a former spy agency operative and ex-ambassador to Japan accused of working to protect Zuma.

Some instigators, Kodwa said, included celebrity-type figures using social media.

Democracy destabilisers

The looting has magnified cracks running through the ANC, with some prominent party members in the government clearly still maintaining support for Zuma in opposition to President Cyril Ramaphosa.

There are suspicions that this support surreptitiously still runs through policing and intelligence structures and rogues linked to these bodies could be at the core of violence playing out on the streets.

Police reaction to the violence, especially in KwaZulu-Natal, has been widely perceived as lax and ineffectual. There is a big contrast to the heavy hand used in other situations. In January, for instance, a water cannon was used on queueing social grant recipients in Cape Town.

The Commission of Inquiry into State Capture previously heard explosive allegations of how the mandate of the State Security Agency (SSA), during Zuma’s reign, was completely warped to maintain and protect his ANC faction. This while the police’s Crime Intelligence capacity was gutted over the years of the Zuma presidency. It has been headed by several pro-Zuma figures including Richard Mdluli, a now-convicted kidnapper.

State Security Minister Ayanda Dlodlo admitted this week that there were investigations into whether former Zuma-aligned SSA operatives crafted the chaos. Among the names that cropped up was Dlomo’s.

In January, the State Capture Commission heard that in 2008 and 2009 – the start of Zuma’s presidency – a “private force” serving Zuma’s interests was set up. About 48 people, not SSA members, were recruited and trained in VIP protection and to collect intelligence following the 2009 election.

In testimony to the commission, it was indicated Dlomo was directing this force.

Earlier this week it emerged that police were pursuing 12 “agitators” – those behind the violence and looting. These individuals were not named.

Acting Minister in the Presidency Khumbudzo Ntshavheni said on 15 July that one was in custody and the remaining 11 were under “increased surveillance”.

Of Dlomo, she said: “I do not know whether Mr Thulani Dlomo is part of the 12 instigators. The police are investigating, and I can’t comment on the specificity of the one individual… That compromises the investigation.”

She said suspects would not be named prior to appearing in court and would not answer further media questions about Dlomo.

As DM168 was going to print on Friday evening, it was reported that Dlomo had handed himself in to police for questioning. Dlomo’s lawyer Philani Shangase told DM168 he was doing so purely to clear his name, as “there is no evidence nor charges against Mr Dlomo”.

Pro-Zuma politicians and public figures

Police Minister Bheki Cele, in a media briefing on 13 July, said cops needed “to get the agitators”.

There were people referring to themselves as presidents and “addressing the nation”. Without naming anyone, he said “that person will have to explain himself”.

Cele was likely referring to former Ukhozi FM presenter and effusive Zuma supporter Ngizwe Mchunu, who is sometimes referred to by his followers as the “king” or “president” of the Zulu nation. In the days leading up the riots, Mchunu posted a number of videos to Facebook styling himself as “addressing the nation”. It was Mchunu who was the speaker at a gathering of the predominantly Zulu residents of Johannesburg hostels on Sunday 11 July at the Kwa Mai Mai traditional market. In his talk, which seemed to appeal to tribalist sentiments, Mchunu warned: “Release Zuma from prison, or hell will break loose!”

He is one of a number of public figures who were openly pushing pro-Zuma and anti-Ramaphosa rhetoric in the lead-up to the unrest. The role of members of Zuma’s family – and in particular twins Duduzile and Duduzane – has been much discussed, with the DA laying incitement charges against the two this week alongside EFF leader Julius Malema.

On Tuesday 13 July this week, with looting and violence reaching its peak, the Jacob G Zuma Foundation intimated in a social media post that it had the ability to bring the unrest under control if it chose to.

“Peace and stability in South Africa is directly linked to the release of President Zuma with immediate effect,” the foundation tweeted. With the situation calming as the week drew to a close and Zuma still behind bars, however, the words seemed empty.

But high-ranking political figures in the ANC have also made no secret of their support of Zuma and opposition to his incarceration. This is particularly the case in KwaZulu-Natal, where it seems that the most powerful provincial figures are united on this front.

Two days after Zuma was jailed, eThekwini Mayor Mxolisi Kaunda posted on Facebook: “We are Msholozi, Msholozi is us. #FreeZuma.”

Kaunda subsequently defended both his and other citizens’ constitutional right to call for Zuma to be freed, but denied that he had ever incited violence.

A message on a Facebook account under the name of former eThekwini mayor Zandile Gumede, who faces corruption and fraud charges, posted around the time Zuma was jailed, said: “The darkest night is just before the light/ Be strong be brave together we will rise.”

KwaZulu-Natal Premier Sihle Zikalala has also made public his support for the former president, stating on Facebook: “Nxamalala, we stand with you”.

With the top echelons of political power in the province seemingly rooting for the jailed Zuma, questions are being asked about whether this bias is also entrenched within the province’s security forces.

‘Sidelined’ cops and taxi claims

Increasing focus has been on the political will behind South Africa’s policing and intelligence structures in the run-up to Zuma’s incarceration. First there were questions about whether cop bosses would actually jail Zuma, and later how they would respond to the looting, which they clearly failed to nip in the bud.

Underscoring these questions are clear divisions within the South African Police Service, which is headed by National Commissioner Khehla Sitole, appointed while Zuma was still president.

Claims, especially emanating from Western Cape police officers, point to cops being sidelined for exposing crimes within the state. Fired policeman Jeremy Vearey, who headed detectives in the Western Cape until his dismissal in May, and sidelined policeman Peter Jacobs, who was previously Western Cape then national Crime Intelligence boss, investigated intense firearm smuggling, some involving police officers, in what was codenamed Project Impi.

Both were transferred from their positions in the Western Cape police in June 2016 while Zuma was still president, a move they said derailed the investigation. (Jacobs was controversially transferred from heading national Crime Intelligence earlier this year.)

Vearey, in an affidavit, said he believed he was suddenly sidelined in 2016 because he was seen to have been involved in taking down a statement by former ANC MP Vytjie Mentor, who made allegations relating to State Capture and the Zuma family. Project Impi also linked to KwaZulu-Natal: firearms were suspected of being smuggled to, among others, taxi bosses there, and of being used in political violence.

This week tweets surfaced alleging that members of the prominent (and rather controversial) Gcaba family, involved in the transport industry in KwaZulu-Natal and related to the Zumas, were involved in orchestrating violence and looting.

On Monday the family – of which members have previously appeared in court for various reasons and whose names have cropped up in shootings that may be linked to taxi violence – issued a statement rejecting such claims.

Transport Minister Fikile Mbalula tweeted the statement – a move that raised some eyebrows, because he appeared to be doing PR work for the Zuma-linked family.

“While we support President Jacob Zuma… The Gcaba Brothers and Family… refute damaging claims circulated through WhatsApp messages by some unknown people, all other social media posts along with news reports… that allege the family’s involvement in any acts of breaking the law,” the statement said.

“Our businesses in the transport sector have suspended all operations and have been affected like everyone else… We do not condone nor support any acts of violence and unrest.”

In both KwaZulu-Natal and Gauteng, the traditionally vilified taxi industry has emerged as an unlikely hero from the unrest, with taxi drivers and workers banding together to prevent further looting and assist with clean-ups. As many commentators observed, it amounted to one further level of complexity in an already intricately tangled situation. DM168

Could these be some of the destructive puppeteers who pulled the strings?

DJ-turned-pro-Zuma-campaigner Ngizwe Mchunu

Ngizwenkosi Brian Mchunu is a former Ukhozi FM DJ and SABC1 presenter. On his social media platforms, he veers between publicising maskandi artists, promoting commercial opportunities and expressing support for Jacob Zuma. Mchunu has a large following from his radio days, and explicitly targeted Johannesburg’s hostels in a “Free Zuma” address at Kwa Mai Mai Traditional Market on 11 July, after which crowds of hostel dwellers took to the streets singing traditional Zulu war songs. Among his followers, there are suspicions that Mchunu is being paid for his pro-Zuma PR owing to the former DJ’s apparently flashy lifestyle. In the days since his hostel address, Mchunu has seemed to nervously walk back some of his rhetoric, using one of his “address to the nation” videos to plead with South Africans to stop the violence and looting.

Suspended ANC Zuma-ite Carl Niehaus

Zuma’s most famous white supporter, Niehaus was front and centre at official pro-Zuma gatherings until the former president’s incarceration. But Niehaus has denied inciting violence and pointed out that his social media accounts do not support the allegation. In addition, it is unlikely Niehaus has the clout to organise the protests. The Umkhonto weSizwe Military Veterans’ Association spokesperson is already on the ropes in a number of senses, having been suspended from the ANC and detained, fined and released for flouting Covid-19 lockdown protocols for addressing a gathering outside Nkandla. In a February interview with DM168, Niehaus explained his loyalty to Zuma was because Niehaus was the last political prisoner to be released and Zuma visited him in prison. Other former prisoners have emphatically contradicted this account since then. More likely, the relationship between JZ and Niehaus is financial in nature.

Rogue ‘Zuma spy’ Thulani Dlomo

Dlomo was effectively Zuma’s personal spook during his time at the State Security Agency, and has become suspect numero uno for authorities looking into the instigators of the riots. The Zondo Commission heard how Dlomo maintained a parallel intelligence structure aimed at shoring up support for Zuma. Dlomo has gone to ground since his sacking in 2019, and there is no public evidence to link him to the unrest at this time. Because of his deep roots in the ANC and history of allegedly employing rogue operatives off the books to act according to his and Zuma’s mandate, he is one of the likelier candidates to have acted as the architect of the attacks.

DM168 also understands that Dlomo’s brother was at one stage a campaigner for former eThekwini mayor Zandile Gumede.

Terrible Twins Duduzane and Duduzile Zuma-Sambudla

Zuma’s twins are facing incitement charges brought by more than one body, including the DA. It is easy to make the case that Duduzile Zuma-Sambudla in particular fanned the flames of violence through a series of militant posts on social media, including a since-deleted tweet showing an election poster featuring Cyril Ramaphosa’s face being peppered with shotgun bullets. On 9 July, Duduzile Zuma-Sambudla tweeted a poster announcing “Shut down KZN: Roads, Factories, Shops, Government”, and thereafter approvingly publicised acts of protest happening in different locations, usually with the word “Amandla [power]!” On 14 July, Duduzane joined “community leaders” to call for an end to violence. But for all the big talk, the twins are not assumed to have major influence or large constituencies beyond their father’s shadow.

Nkosentsha Shezi

The 44-year-old Shezi runs a funeral parlour in KwaMashu and moonlights as a church pastor. Shezi is a Zulu traditionalist who has previously called for all the land in KwaZulu-Natal to be returned to the Zulu King. He is one of the more mysterious figures in Zuma’s orbit: a constant presence at, and often organiser of, pro-Zuma protests who claims his support is motivated simply by his principled endorsement of Radical Economic Transformation. As a branch member of the ANC, he also took the ruling party to court in June over the suspension of Secretary-General Ace Magashule. On 9 July, Shezi told The Witness: “We are currently mobilising and there will be a number of activities in the coming days.” Since Zuma’s arrest, he has posted countless tributes to the former president and also suggested a “3rd force” might be responsible for violence. Shezi will almost certainly be close to the top of authorities’ investigations into the instigators by virtue of both his passion for his cause and his prominence among Zuma supporters.

The Gcaba brothers

With unverified claims that people were bussed into certain areas to loot, eyes have fallen on the Gcaba brothers – Zuma family members who in the past have run Durban transport as their personal fiefdom. Mandla Gcaba, who is reportedly JZ’s nephew, is described as both powerful and feared, and in the past has exercised control over both the eThekwini bus operation (without a tender) and large portions of the province’s taxi service. Gcaba appears to have a close relationship with police minister Bheki Cele, with Cele reportedly appointing Gcaba to broker peace between warring KZN taxi operators. A 2009 profile of Gcaba in The Mercury recorded that “the stories told about [the Gcaba brothers] are enough to chill the blood of even the most street-smart in the townships”. The Gcabas have released a statement acknowledging support for Zuma but denying involvement in the unrest.

The notorious WhatsApp group

Daily Maverick reported this week that intelligence sources are taking seriously WhatsApps leaked on social media that appear to show the members of a WhatsApp group called “Shutdown eThekwini” plotting to attack certain targets in Durban. The group, established a day after Zuma was incarcerated, discussed highways to block and recommended targeting shops associated with White Monopoly Capital.

It appears that the group members are ordinary ANC branch members, with DM168’s initial investigations suggesting that at least two work for government. When group members were contacted by The Sunday Times this week, they denied involvement in any violent activity, with several suggesting that their phones had been “hacked”.  DM168

Additional reporting by Pieter-Louis Myburgh.