South Africa’s most important crime witness isn’t human. It’s a smartphone.
When investigators at the Madlanga Commission, a South African judicial anti-corruption inquiry, projected WhatsApp conversations extracted from seized mobile phones onto courtroom screens, they were doing far more than reading private messages.
When investigators at the Madlanga Commission, a South African judicial anti-corruption inquiry, projected WhatsApp conversations extracted from seized mobile phones onto courtroom screens, they were doing far more than reading private messages. They were attempting to reconstruct alleged criminal networks.
Every message, timestamp, contact list and call log became another thread in what investigators argue is a sprawling web linking senior police officers, politicians, businesspeople and alleged underworld figures Vusi “Cat” Matlala and Katiso “KT” Molefe.
Among those whose names have surfaced during the commission’s proceedings are Police Minister Senzo Mchunu, National Police Commissioner General Fannie Masemola, Deputy National Commissioner Lieutenant-General Shadrack Sibiya and Crime Intelligence head Major-General Feroz Khan, all of whom have been suspended. Economic Freedom Fighters (EFF) leader Julius Malema, businessman Brown Mogotsi and alleged crime kingpin Vusimuzi “Cat” Matlala, who remains in custody, have also been mentioned.
Several of those named have publicly denied wrongdoing, challenged either the interpretation or the authenticity of evidence presented to the commission, or argued that the material disclosed does not establish unlawful conduct. Malema went further in an affidavit filed with the commission on July 7.
Responding to allegations arising from WhatsApp messages allegedly exchanged between Khan and tobacco businessman Mohammed Sayed, the EFF leader said he could not verify the authenticity of the message extracts presented to the commission.
“I do not have knowledge of the exchanges between Mr Sayed and General Khan. I deny any influence… to the extent they infer any unlawful conduct on my part. To the best of my knowledge, I deny any Bertobrite bribery of the EFF,” Malema said in his affidavit.
The commission’s work is ongoing. It has yet to reach its final findings, and it has made no adverse findings against any of the individuals named
Yet beyond the political intrigue lies a much bigger story.
Smartphones have become central to modern corruption investigations, joining eyewitness testimony, financial records and traditional paper trails as critical sources of evidence. Every WhatsApp conversation, location ping, cloud backup and piece of metadata can help investigators reconstruct relationships that might once have remained hidden.
The Madlanga Commission, established by President Cyril Ramaphosa in 2025 following explosive allegations by Lieutenant-General Nhlanhla Mkhwanazi, KwaZulu-Natal Police Commissioner, that senior politicians and police leaders interfered in investigations into organised crime and political killings, has become South Africa’s clearest demonstration of a profound shift in modern policing. The smartphone has quietly become one of the country’s most powerful investigative tools.
That transformation is recognised not only by digital forensic experts, like Chad Thomas and Thama Jedidiah Mamphaga, a cybersecurity specialist.
Brigadier Athlenda Mathe, spokesperson for the South African Police Service (SAPS), said organised crime syndicates increasingly rely on digital platforms to communicate, transfer money and coordinate illicit activities, forcing investigators to evolve alongside them.
“Digital evidence has strengthened our ability to establish links between suspects, identify criminal networks and corroborate witness testimony, thereby enhancing the overall quality of investigations,” Mathe told TechCabal in a telephone interview on Thursday.
For Chad Thomas, chief executive officer (CEO) of IRS Forensic Investigations, the significance of smartphones lies not only in the messages they contain but also in the wider digital ecosystem they create.
“Investigators have been able, through the subpoena process, to obtain records from various service providers that show geodata, metadata and, in some instances, if they have access to the devices, download all the related messages,” Thomas told TechCabal. “Cell phones come as a great convenience, but at the same time criminals have become very complacent.”
That complacency, he said, often leaves behind an extraordinarily rich trail of evidence. A seized phone can reveal far more than chat messages. Contact lists, photographs, shared locations, timestamps, cloud synchronisation, deleted content and call records can all help reconstruct an alleged criminal enterprise, provided the material is obtained lawfully.
Thomas emphasised that technology alone is never enough.
“There has to be a chain of custody,” he said. “It has to show that the chain of evidence followed the letter of the law from the outset, or the presiding officer will chuck it out.”
That process may involve search warrants, Section 205 subpoenas under the Criminal Procedure Act, cybercrime warrants and, in exceptional circumstances, judicial authorisation under the Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA). The value of digital evidence depends as much on maintaining its legal integrity as it does on technology used to collect it.
Mathe said this has fundamentally changed the way police investigate organised crime. According to her, investigators now analyse cellphone records, emails, financial transactions, CCTV footage, geolocation data and social media activity alongside traditional evidence to uncover criminal networks and expose corruption.
Although headlines from the Madlanga Commission have often centred on leaked WhatsApp conversations, Thama Jedidiah Mamphaga, a cybersecurity specialist, said investigators do not build cases around chat messages alone.
“Chat messages alone rarely win a case,” Mamphaga told TechCabal in a telephone interview on Thursday. “Investigators like to have the money trail, bank records, phone call logs, surveillance and witnesses all pointing in the same direction. WhatsApp messages are one piece of a bigger puzzle, not the whole picture.”
Instead, investigators look for patterns. “A conversation about a ‘delivery’ means little by itself,” she said. “But if it is immediately followed by financial transactions, location data placing suspects together and surveillance footage confirming a meeting, the digital footprint becomes significantly more compelling.”
“It’s not about one suspicious message,” said Mamphaga. “It’s about whether the conversation matches up with something that actually happened.” Mathe echoed that assessment, saying electronic communications are most valuable when corroborated by conventional investigative work.
“It is important to note that digital evidence is most effective when supported by a broader body of evidence gathered through lawful investigative processes,” she said.
