STATES OF CAPTURE: ‘SA was close to gone’ — evidence outlines alleged plot to implode country

“There was a clear picture that if we don’t do anything now, the country is gone; that is just the long and short of it.”

This single sentence, uttered by Dr Ntandazo Sifolo, acting head of the National Intelligence Coordinating Committee (Nicoc), reveals how close South Africa allegedly came to being totally captured.

Sifolo testified at the Madlanga Commission of Inquiry last week, on Thursday, 12 November 2026, adding to accusations that a vast web of colluders, inside and outside the State, had worked to disable the criminal justice system.

‘Collective collusion’

Sifolo’s testimony merged various elements of suspected State infiltration.

Pairing it with what other witnesses have already told the Madlanga Commission and related happenings outside the hearings provides the most comprehensive picture so far of what is alleged to have been a collective effort to subvert the State.

All this has also produced accusations of malfeasance in critical structures meant to ensure our safety, including the:

• Inspector-General of Intelligence (IGI) arena, geared to provide oversight of such services.

• South African Police Service (SAPS) and certain senior officers.

• Crime Intelligence, the police unit that consistently generates controversies.

• Investigating Directorate Against Corruption (Idac), part of the National Prosecuting Authority.

This scandal became public on 6 July 2025, when KwaZulu-Natal Police Commissioner Nhlanhla Mkhwanazi held an unprecedented press conference.

He warned that a cartel involved in vast lawbreaking, later identified as the Big Five, had infiltrated South Africa’s criminal justice system, politics and the private sector.

The Madlanga Commission is now investigating those accusations, which Sifolo’s testimony last week sharpened.

‘The country was gone’

Sifolo said the term “the infiltration of the criminal justice system” was coined at Nicoc.

He explained that previously, developments around that infiltration had been presented to intelligence structures in a “fragmented” way.

But in February 2025, Nicoc streamlined actions to clean up the criminal justice system.

Critically, Nicoc took control of the Gauteng Counter-Intelligence Operations team, better known as GCI-OPS, that was conducting highly sensitive investigations – the kind that corrupt figures would want to torpedo.

The GCI-OPS began uncovering the Big Five, which Parliament had previously heard was involved in crimes including contract killings, tender fraud, cross-border vehicle hijackings, cash-in-transit heists, kidnappings and extortion.

Asked during last week’s proceedings what would have happened if Nicoc had not taken control of the GCI-OPS, Sifolo said: “The country was gone and, in fact, the head of the Crime Intelligence [Dumisani Khumalo] had surrendered.”

Khumalo had also directed the GCI-OPS.

Intelligence issues

Sifolo said it had been hoped that Inspector-General of Intelligence – Imtiaz Fazel – would “postpone oversight investigations on active and ongoing operations” while the infiltration crackdown project was under way.

But Fazel allegedly “did not accede” to Nicoc’s request.

“Intelligence later revealed the witting or unwitting role of the IGI and the [Idac] in frustrating the strides [of] the Intelligence Services in addressing the priority of decontamination of the [criminal justice system],” Sifolo said.

The Madlanga Commission also heard that “national intelligence structures have expressed serious concern” about Fazel’s “wanting exposure of operations and related intelligence” when there was no clarity on the relevance to the IGI’s oversight work.

How Senzo Mchunu fits in

At the end of 2024, then police minister Senzo Mchunu ordered the disbandment of KwaZulu-Natal’s Political Killings Task Team (PKTT). That province’s police boss, Nhlanhla Mkhwanazi, later said he believed Mchunu was pressured to act because criminals thought the PKTT was investigating them. But it was actually the Gauteng Counter-Intelligence Operations team, GCI-OPS, headed by Crime Intelligence boss Dumisani Khumalo. Mchunu denied that reasoning.

He had also referred a saga involving Crime Intelligence procuring properties to Inspector-General of Intelligence Imtiaz Fazel. A related report that recommeneded criminal charges against Khumalo was leaked to a journalist, creating an impression it was an attempt to tarnish him. Fazel was suspended in 2025 – he challenged this legally.

“This resistance has not only created frustrations on the part of the IGI but has resulted in desperation to seek information through various means,” Sifolo, reading from a statement, alleged.

“The target of the IGI is the SAPS’ Crime Intelligence and certain information pertaining to an ongoing investigation on criminal networks within the SAPS’ high echelons.”

Fazel has not had the chance to publicly and officially detail his version of events.

Targeting Crime Intelligence

In March 2025, the month after Nicoc streamlined actions to decontaminate the criminal justice sector, the SAPS warned Parliament that there were attempts to derail an operation to clean up the Crime Intelligence unit.

A SAPS presentation said national Crime Intelligence boss Khumalo (who also directed the GCI-OPS and had co-ordinated a political killings task team in KwaZulu-Natal) was being targeted via misinformation.

Whistleblower vs information peddler

When Senzo Mchunu was police minister, he was in contact with, among others, Patricia Morgan-Mashale. Crime Intelligence head Dumisani Khumalo, once in Parliament, labelled her “a disgruntled” former police admin clerk and information peddler.

Mashale reportedly planned to take legal action against him for that description. Her name cropped up again at the Madlanga Commission of Inquiry in November 2026 when it was heard she appeared to have posted classified information on social media, which Mashale had previously denied doing.

Meanwhile, she seemed to support National Coloured Congress leader Fadiel Adams whose complaints, that he said were based on leaked Crime Intelligence documents, led to Khumalo’s arrest in a case he was later cleared of. Adams conceded he may have been used in a plot.

The March 2025 SAPS presentation, meanwhile, warned: “Some… social media postings talk to the misinformation and unfounded allegations that the Commissioner wrongfully appointed two senior managers within the division of which it was found to be not true.”

Months later, in June 2025, Crime Intelligence officers, including Khumalo, were arrested over an allegedly irregular appointment – precisely what the SAPS had warned was misinformation.

The officers denied wrongdoing.

The case against the officers was driven by Idac, which acted on complaints it received from National Coloured Congress leader Fadiel Adams.

For his part, Adams once said his complaints to Idac were based on Crime Intelligence documents that had been slipped under his office door.

He later conceded that he may have been used in a broader policing plot.

‘It wasn’t by chance’

According to what Sifolo told the Madlanga Commission last week, on 30 June last year (four days after the Crime Intelligence arrests), President Cyril Ramaphosa was briefed on “matters of organised criminal networks and the infiltration” of the criminal justice system.

Barely a week later, on 6 July 2025, Mkhwanazi held the country-altering press conference during which he alleged the Big Five cartel had infiltrated the State.

He later said there was a rogue element in Idac and insinuated that Khumalo had been set up. (Evidence now suggests this is true.)

Until last week, it was not quite clear who all had backed Mkhwanazi’s press conference, which some figures initially thought could be part of a coup d’etat.

Sifolo explained to the Madlanga Commission that while Mkhwanazi had addressed the country alone, it was not the “work of one person”.

By that point, Crime Intelligence was not looking good, especially after the arrests.

Sifolo said: “When you realise that you no longer have any other way to deal with this matter because the institutions are so compromised, to an extent that the public is beginning to believe [misinformation] and innocent people who are doing the real work of national security are being targeted, then you [must act…]

“So, the July 6 [press briefing] is not something that happened by chance.”

Simply put, based on Sifolo’s testimony, Mkhwanazi’s press conference was the only way to neutralise a threat involving misinformation portraying innocent people as corrupt.

Tables totally turned

Among subsequent key happenings is that in October 2025, Ramaphosa suspended IGI Fazel over a complaint about his conduct.

Fazel has reportedly challenged this.

When Khumalo was arrested in 2025 in the Idac-driven irregular appointment case, Andrea Johnson headed the directorate.

Earlier in 2026, testifying at the Madlanga Commission, she conceded that the case against him was flawed.

Around that time, it emerged that Johnson had curiously close ties to Feroz Khan, then a senior Crime Intelligence officer who did not see eye-to-eye with Khumalo.

Khan has since been wounded in a shooting, dismissed from the police service, and is facing several accusations.

In July 2026, as allegations against Johnson mounted, she resigned.

At the end of October 2026, she and Khan (who was already facing charges in another matter) were arrested in a case that hinged on accusations that confidential information had been improperly shared between them.

Meanwhile, Khumalo and his criminally charged Crime Intelligence colleagues were cleared in the Idac-driven case.

(National Police Commissioner Fannie Masemola was also arrested – and later cleared – in an Idac-driven case about a dodgy policing tender. Alleged Big Five member Vusimuzi “Cat” Matlala was among his co-accused, and still faces charges in that and other cases.)

The sprawling web

Based on what has emerged from the Madlanga Commission and other events, Khumalo, as head of Crime Intelligence and GCI-OPS, which investigated the Big Five, seems to have been targeted from various angles.

He was arrested after Idac acted on complaints from politician Adams, who said he was working from leaked Crime Intelligence documents.

That implies that a figure or figures in Crime Intelligence were behind passing the documents to Adams.

Johnson’s resignation and concessions that the Khumalo case was flawed suggest underhanded activities may have taken place in Idac.

As for her co-accused Khan, in a previous court saga, he portrayed Khumalo as potentially corrupt.

Khan now faces criminal charges in two cases, and there are other accusations against him that, if true, would indicate he was a corrupt element in Crime Intelligence.

It would also underscore how criminality has infiltrated the broader SAPS.

Other arrests and suspensions of police officers, including now-dishonourably discharged deputy national commissioner for crime detection, Shadrack Sibiya, suggest the same.

Infiltration accusations trickle down to the metro police level in Gauteng, where the Big Five is said to be based.

Meanwhile, assertions of Crime Intelligence targeting that surround IGI Fazel, regardless of the veracity, erode confidence in how South Africa’s shadowy spy arenas are being monitored; in other words, intelligence oversight.

Last week, while testifying at the Madlanga Commission, Sifolo alleged that the IGI’s office could “no longer be trusted to conduct oversight in an impartial manner [and] purely for oversight reasons”.

No matter who is to be believed in this overall scandal, it so far suggests that the term Nicoc coined and what Mkhwanazi alleged during his pivotal press conference last year – “the infiltration of the criminal justice system” – is real. DM