Evaluating the security sector’s response to violent unrest and looting in Kwazulu-Natal and Gauteng
Last week, South Africa was rocked by scenes of violent unrest and looting concentrated in KwaZulu-Natal and Gauteng. At least 200 people have lost their lives so far and the cost to the economy is estimated to run into the tens of billions. The government, particularly the security cluster, has been widely criticised for failing to respond effectively to a supreme emergency, the depth of which we are only beginning to understand, leaving many communities to fend for themselves while their houses and businesses burned to the ground.
To date, the South African government has not been able to provide a comprehensive explanation as to what or who was behind the violence and unrest, or account for its poor response. Various terms have been used to describe the events, from ‘coup’ and ‘insurrection’, to ‘criminality’ and ‘counterrevolution’. Regardless of the term used, what transpired was a clear attempt at a change of government. This was emphasised in President Cyril Ramaphosa’s address to the nation of Friday, 16 July, where he stated:
“It is clear now that the events of the past week were nothing less than a deliberate, coordinated and well-planned attack on our democracy.”
“The actions are intended to cripple the economy, cause social instability and severely weaken – or even dislodge – the democratic state.”
Members of the South African Defence Force (SANDF) patrol Alexandra township, Johannesburg on 15 July 2021. Stores and warehouses in South Africa were hit by looters on 13 July. Photo: Phill Magakoe / AFP
Statements by Deputy State Security Minister Zizi Kodwa, Minister of State Security Ayanda Dlodlo, Police Minister Beki Cele, and Defence Minister Nosiviwe Mapisa-Nqakula regarding alleged “masterminds”, the level of planning and coordination involved, and forewarning and prior intelligence contain several contradictions and differ in significant ways. This indicates an attempt to divert blame between ministries, a profound intelligence failure, or both.
Interrogating the government’s narrative of events
Over the past week, perhaps in an attempt to absolve the security cluster of responsibility, government has begun to propagate a certain narrative about the nature of the “plot” and how a response was coordinated.
It posits that the riots and looting were orchestrated by a group of key instigators as a diversion tactic to stretch the capacity of the security forces and shift attention away from critical infrastructure, such as oil refineries, power stations, hospitals, and water reservoirs in Kwazulu-Natal and Gauteng.
Based on proactive intelligence gathering by our intelligence services, government then faced the difficult decision of where to deploy limited security forces. The decision was taken to prioritise the protection of critical infrastructure before moving to quell civil unrest and looting, and in doing so, several attacks on infrastructure and national key points were successfully thwarted.
However, if this is to believed, a number of questions arise, including:
- What was the nature of the operation to ostensibly overthrow the government and how closely did it resemble a “coup” or “organised insurrection”?
- What was the end goal of those who put the plan into action?
- If our intelligence services had early warning of the events which unfolded as they claim, why was more not done to stop the extreme levels of devastation we have seen?
- Did government actively decide to hedge their bets and deploy to key points before moving on to quell the looting, or did intelligence fail to identify the threat and scale of looting and violence?
According to remarks made by Deputy State Security Minister Zizi Kodwa, the State Security Agency (SSA) had received information about parts of a “big plot” for domestic instability and popular revolt with “right wing-elements at play” prior to former President Jacob Zuma’s imprisonment on 7 July.
The deputy minister stated that its instigators “are people with experience running operations” who were planning to first target the “distribution and supply” of water, fuel, and airports to cut off resources to communities and then work with criminal networks to encourage communities to rise up in a popular revolt.
The deputy minister also stated that: “The plan was just to destroy everything else, there must be agitation and remove this government”, adding: “To an extent, they wanted to destabilise the country and they also planned what is called in a right-wing language, a lone wolf, must start racial tension and racial war in South Africa.”
Kodwa’s remarks raise several questions, such as what is meant by “right-wing elements” and whether or not a list of key instigators were provided to police before the unrest began, while slightly differing accounts by Police Minister Bheki Cele and Minister Dlodlo add to the confusion.
What we do know is that on Saturday, 10 July, over 20 trucks were torched on the N3 near the Mooi River toll Plaza, which links Gauteng to KwaZulu-Natal and is a crucial national food and fuel route. Arson attacks against truckers in anti-foreign driver campaigns is not new to Kwazulu-Natal, however, these attacks were combined with public protests calling for the freeing of President Zuma and logs and tires used to block the N3.
Screenshots of social media messages by those alleged to be involved show that following torching of trucks on the N3, the organisers worked, potentially with disgruntled ward councillors and/or local ANC leaders, to coordinate and drive the looting of malls, warehouses, and other symbols of “white monopoly capital”. The term “white monopoly capital” was first seeded into the public domain by the London-listed PR firm Bell Pottinger, as a strategy to undermine critics of President Zuma and build support for him and his allies within the party who favoured a Radical Economic Transformation Agenda.
Once looting was underway, Duduzile Zuma-Sambundla (Zuma’s daughter) and other public figures aligned with the Radical Economic Transformation (RET) faction of the ANC encouraged further civil disobedience and are currently being investigated for their role in the unrest.
Thulani Dlomo is widely considered to be one of the 12 “masterminds” being investigated for this alleged role in plot. Dlomo was head of the State Security Agency’s rogue special operations unit (SSA) which is claimed to have acted as a parallel intelligence structured and was linked to a campaign to purge SARs officers to protect President Zuma against investigations into alleged corruption.
It is important to note that Dlomo has gone on to deny any involvement, stating, “I do not know of any 12 so- called instigators, and this is simply a smokescreen and a figment of the imagination of people such as Deputy Minister Zizi Kodwa”. On Friday, he presented himself to Durban police, but was not arrested and told to go home as no case had been opened against him. On 15 July, it was announced that one of the instigators had been arrested and SAPS are working to arrest the remaining 11 subjects. On 18 July, another three suspects were arrested.
On 12 July, President Ramaphosa authorised the deployment of 2500 members of the South African National Defence Force (SANDF) in terms of sections 52 and 54 of the Defence Act to help preserve law and order. The operation was subsequently dubbed Operation Prosper and on Wednesday 14 July, Minister of Defence Nosiviwe Mapisa-Nqakula stated at a Joint Standing Committee on Defence meeting that she was seeking authorisation for an increase in troop strength to 25 000. By 18 July, 10 000 troops had been deployed across Kwazulu-Natal and Gauteng.
However, to many citizens caught up in the hot spots of pillaging and violent activity, the deployment of the SANDF was clearly too little too late, as over the course of the week thousands of businesses burned as uncontested looting continued across Gauteng and KZN. Citizens were left wondering where the promised soldiers were while to trying to protect their communities by forming ad hoc militia and creating makeshift roadblocks with little help from an overstretched police force who clearly had not the planning, training nor equipment needed for effective riot control.
Intelligence failure or the best of a bad situation?
Two conflicting narratives have started to form in response to events of the past week. Statements by members of the security sector paint a picture of proactive intelligence services assisting the police and military who, facing a well-planned plot and challenging security dilemma, were able to prevent a potential “coup-like” operation from transpiring and even greater levels of instability.
The other paints a picture of a massive intelligence failure and poor policy decisions in the face of a rudimentary plan to render parts of the country ungovernable but which was nonetheless successful in creating massive economic damage.
At a Justice, Crime Prevention and Security (JCPS) cluster media briefing on 13 July, Minister Dlodlo insisted that the SSA was not “missing in action” and that even before the violence began, her agency was sharing information with the police under the auspices of the Counterintelligence Coordinating Forum including the National Intelligence Co-ordinating Committee (NICOC) which was successfully acted upon to avert a greater level of crisis.
In her remarks, the Minister stated, “we averted a lot more than what you see on national television because of the proactive stance that was taken by both intelligence services of the three ministries but also the work done by the police intercepting greater crime that could have occurred in that time”.
As evidence of this proactive stance, the Minister cited examples of planned attacks that were thwarted, including:
- An attack on an area of Sandton planned for 12 July
- An attack on an electricity substation in Musunduzi Local Municipality which supplies the city of Pietermaritzburg
- A potential event at Westville Prison
- An attack on the ANC Provincial Headquarters in Durban
Similarly, Minister of Defence Mapisa-Nqakula, in a briefing to the Joint Standing Committee on Defence, stated the reason for the lack of SANDF presence at major sites of looting was that, acting on intelligence, force deployment was first prioritised towards critical infrastructure.
Typically, coup d’etats involve the forceful seizure of the machinery of the state, usually by the military, a paramilitary, or an opposing political faction that deposes the current government. Every coup is different and tailored to the local context but there are common characteristics to this form of seizure of state power, such as a high degree of operational planning, the destruction or capture of critical infrastructure, and the capture of radio stations and/or other national broadcasting platforms.
For example, in the November 2017 Zimbabwe coup, elements within the Zimbabwe Defence Force (ZDF) first seized control of the Zimbabwe Broadcasting Corporation (ZBC) and key areas of the capital, Harare, before taking effective control of the government. The plot was so well executed that Zimbabwe President Emmerson Mnangagwa was able to maintain a charade (however poor) that the operation was not a coup but a house cleaning exercise to get rid of “criminals” around President Robert Mugabe.
According to some media reports, the initial burning of trucks on the N3 was organised by renegade former MK members active in the transport sector. However, there is no indication that factions of our armed forces or police services were complicit in the plot, and there has not been any cases of widespread defections.
While the blocking of the N3 as a major fuel and food transport route resembles the beginning of a more sophisticated ‘coup-like’ plan, there were no successful or rebuffed attacks on Pretoria or other national key points, no broadcaster captured, or further indication that a major operation to overthrow the government was underway or President Ramaphosa’s life in danger. None of the examples provided by Minister Dlodlo of thwarted attacks could be considered the sort of vital infrastructure that would cripple the state and it is not clear how these few planned attacks would overstretch the capacity of the security sector as claimed. Furthermore, without a heavily armed military or paramilitary group, it is not clear who would be able to stage an effective attack on guarded national infrastructure, unless those behind the plan expected major defections within the security forces.
One potential scenario could be that the instigators’ objective was to create enough chaos to force President Ramaphosa to deploy the SANDF. The SANDF would then use excessive force against civilians, turning public and party sentiment against the president to the benefit of the RET faction within the ANC. On 16 July, members of the RET faction released a media statement which somewhat speaks to this scenario, stating: “Evidently the ill-conceived imprisonment of President Zuma was the spark in a proverbial powder keg. Thus, steps to release President Zuma with immediate effect from his unjust political incarceration must be taken.”
Reforming our intelligence services
The mandate of the SSA is to provide the government with intelligence on domestic and foreign threats or potential threats to national stability, the constitutional order, and the safety and well-being of our people.
If, as indicated by Minister Dlodlo, the SSA knew of plans of a big operation to destabilise the country and our various intelligence branches were effectively working together under the auspices of NICOC, why was preemptive action not taken to arrest those responsible? How could limiting the initial deployment of SANDF members to 2500 and deploying these forces away from public spaces be the result of anything other than intelligence gaps and a misunderstanding of the reality of the situation? Why was there seemingly no contingency planning to quickly shift deployment towards warehouses and shopping malls when it was becoming abundantly clear the extent of the damage being done and potential interruptions to food and fuel supplies?
Despite statements to the contrary, events on the ground this week indicate the inability across our intelligence services to effectively gather and share time-sensitive intelligence and not the existence of a highly sophisticated plot to overthrow the government.
Stephen Buchanan-Clarke is a security analyst with several years' experience working in both conflict and post-conflict settings in Africa, primarily on issues of peace and security; transitional justice and reconciliation; democratisation and governance; and preventing and countering violent extremism. He currently serves as head of the Human Security and Climate Change (HSCC) project at Good Governance Africa and is a co-editor of the Extremisms in Africa anthology series.
Chris Maroleng is an accomplished public and corporate affairs practitioner with close to 20 years working experience, specialising in strategy, research, media, communication, security, corporate governance and public affairs. Prior to his GGA appointment, Chris was the Chief Operations Officer of the South African Broadcasting Corporation (SABC), where he was responsible for the organisation’s turnaround strategy, improving the SABC’s cash balance, enforcing governance and driving efficiencies within the operations cluster, as well as promoting a performance culture for optimal outcomes. With a sound understanding of what drives a successful business, as Group Executive for Corporate Affairs at Africa’s largest mobile operator, MTN, he assisted the company through a tumultuous period during which it was faced with a huge penalty that could have placed the organisation in an untenable situation. Chris also spent six years at eNews Channel Africa (eNCA), where he was Africa Editor, and head of department for the Africa division. As an integral member of the eNews founding management team, key among his successes during his tenure was the establishment of the eNews Africa division. Prior to joining eNews, Chris worked at the Institute for Security Studies (ISS) in the African Security Analysis Programme (ASAP), as a senior researcher in peace and security issues in Africa, and where he published extensive reports related to African affairs. Chris holds a MA in International and Comparative Politics from the University of Cape Town. He was also a Menell Media Fellow, at Duke University’s Dewitt Wallace Center for Media and Democracy.
Craig Moffat, PhD is the Head of Programme: Governance Delivery and Impact for Good Governance Africa. He has more than 17 years of practical experience working for government institutions and multilateral organisations. He was previously employed by the South African Foreign Service, where he worked extensively at identifying and analysing security threats towards South Africa as well as the southern Africa region. Previously, he was the political advisor for the Pretoria Regional Delegation of the International Committee of the Red Cross. He holds a PhD in Political Science from Stellenbosch University.
