MADLANGA COMMISSION: Intelligence chief warns of ongoing state infiltration by mafia-like networks

Dr Ntandazo Sifolo, acting coordinator of the National Intelligence Coordinating Committee (Nicoc), on Thursday, 12 November, testified at the Madlanga Commission that criminal syndicates had become embedded in the state, while political power struggles and corrupt law enforcement officials were compromising security. His testimony exposed what Nicoc’s 2024 National Intelligence Estimate had identified as a systemic national security threat: the contamination of the criminal justice system value chain.At the heart of these warnings was the growing infiltration of state institutions by organised criminal networks, the alleged use of political influence to obstruct investigations and the involvement of elements within law enforcement in syndicated criminal activities.Nicoc is the coordinating body that brings together South Africa’s intelligence structures, including SAPS Crime Intelligence, the State Security Agency (SSA), Defence Intelligence and the intelligence coordinator.Sifolo’s testimony provides intelligence context to the allegations made by KwaZulu-Natal police commissioner Lieutenant General Nhlanhla Mkhwanazi at a media briefing on 6 July 2025. Mkhwanazi alleged that a criminal syndicate involving police officers, prison officials, judges and politicians had infiltrated South African law enforcement structures and was effectively holding the country hostage.Lieutenant General Nhlanhla Mkhwanazi on 18 March at the parliamentary ad hoc committee inquiry into alleged corruption and political interference in the criminal justice system. (Photo: Brenton Geach / Gallo Images) The weight of Sifolo’s evidence is reflected in the documentary record before the commission: a 25-page witness statement, a 536-page bundle of exhibits, National Intelligence Estimates covering 2022 to 2025, and Nicoc intelligence briefs and reports dealing with organised crime and the infiltration of the criminal justice system.The examination of this material is being conducted in two parts. Annexures A and C are being dealt with in public, subject to disclosure restrictions, while Annexure B – containing classified intelligence material – is being heard in camera.Media freedom versus national security The split of Sifolo’s testimony into open and private sittings has exposed the balance between the public’s right to know and the state’s obligation to protect classified intelligence, particularly when allegations concern the possible infiltration of state institutions by organised criminal networks.Evidence leaders argued that the sensitive nature of the material warranted an in camera hearing. However, amaBhungane, News24 and Daily Maverick challenged what they regarded as a blanket secrecy approach, arguing that less restrictive measures could protect genuinely sensitive information without excluding the public from the proceedings.The media organisations maintained that national security should not become an automatic justification for withholding evidence from public scrutiny, particularly when allegations involve possible corruption, political interference and the infiltration of state institutions.In addressing the dispute, Sifolo distinguished between exposing wrongdoing within intelligence services and revealing the intelligence capabilities on which the security of the country depends.He argued that media freedom and national security should complement, rather than undermine, each other, stressing that accountability must not come at the expense of security.“The question is not who should be exempted from accountability. It is how accountability can be exercised without destroying the very public interest it is intended to protect. The guardians must be accountable. Those who scrutinise the guardians must act responsibly, and the republic must remain secure. These, in our understanding, are mutually reinforcing obligations,” he said.However, Sifolo cautioned that information supplied to journalists was not necessarily motivated by a desire to expose corruption or abuses of power. Some disclosures, he said, could be driven by personal grievances, institutional rivalries, attempts to obstruct investigations, criminal interests or the deliberate manipulation of public opinion.He warned that journalists could unknowingly be used to advance agendas that differed from their commitment to transparency and accountability.Organised criminal networksSifolo told the commission that Nicoc had consistently raised concerns about organised criminal networks and their growing influence. These concerns were documented in successive National Intelligence Estimates covering 2022 to 2025, which were approved by the National Security Council (NSC).The threat, he emphasised, had become particularly pronounced during the 2021 local government elections, when politically motivated killings and intimidation threatened to become normalised as instruments of political competition.“These concerns were reflected in the National Intelligence Priorities, which identify the threats intelligence agencies must prioritise. Two priorities were singled out: investigating and neutralising politically motivated crimes and killings, and investigating and neutralising the killings of police officers and other law enforcement officials,” he added.The 2023 National Intelligence Estimate painted an alarming picture of state institutions increasingly failing in their responsibility to protect citizens and deliver effective services. It identified weaknesses within the state security apparatus, warning that it was failing to prevent, protect against and sanction wrongdoing.According to Sifolo, it also raised concerns about law enforcement officials allegedly participating in syndicated criminal activities, including cash-in-transit heists, illegal mining, human smuggling and contraband trafficking. Such involvement, it warned, was widening the trust deficit between citizens and the state.“The country had become increasingly accustomed to a culture of mediocrity, lack of patriotism, corruption, selfishness, malevolence and dereliction of duty among public servants,” he said.A more troubling picture emerged in a July 2023 intelligence assessment prepared by Nicoc for the NSC ahead of the 2024 national and provincial elections. It warned of a growing merger between political and criminal interests, describing it as a mafia-like operation within the state.“Furthermore, the mingling of political and criminal activity has created a concerning complex mafia-like operation in the state,” he told the commission.According to Sifolo, this convergence had contributed to the normalisation of criminal extortion at economic sites, with the practice spreading into the transport sector. Law enforcement agencies were struggling to contain it, largely because of corruption, infiltration and contamination within their own ranks.Criminal extortion is prevalent in SA’s transport sector. (Photo: Antonio Muchave Gallo Images / Sowetan)Decontamination project Sifolo explained that intelligence structures had often assessed the infiltration of the criminal justice system by organised criminal syndicates in a fragmented manner, treating kidnappings, targeted killings, drug trafficking, extortion and gun-running as separate threats rather than recognising their interconnected nature.Against this backdrop, Nicoc decided in February 2025 to coordinate efforts involving SAPS Crime Intelligence, the Directorate of Intelligence and the SSA to prioritise the decontamination of the criminal justice system.The Minister in the Presidency responsible for political oversight of state security and intelligence, Khumbudzo Ntshavheni, was informed of the decision, including Nicoc’s request that the Inspector-General of Intelligence (IGI) postpone oversight investigations into active and ongoing operations until the project had been concluded. Minister in the Presidency Khumbudzo Ntshavheni. (Photo: Frennie Shivambu / Gallo Images) However, the IGI did not accede to the request, which had been conveyed by the minister on 11 February 2025.Sifolo said Nicoc became increasingly concerned that the IGI’s actions were targeting the Gauteng Counter-Intelligence Operations project, particularly as the IGI continued demanding information despite the request to protect the ongoing operation.He also raised concerns about an IGI report that was allegedly about to be leaked to a City Press journalist. Nicoc became aware of the possible leak after the journalist began asking questions. WhatsApp exchanges, Sifolo said, suggested that the leak was deliberate.Nicoc examined the report after becoming aware of the exchanges and was troubled by what it regarded as far-reaching recommendations affecting individuals, despite concerns about whether the underlying facts had been properly verified.Sifolo said Nicoc was also concerned about the report’s potential impact on public opinion following the charges brought against the national police commissioner, Fannie Masemola. He argued that intelligence structures could not simply enter the public domain to correct what they believed was an incomplete or misleading narrative.Police commissioner Fannie Masemola, who in September was cleared of four charges of contravening the Public Finance Management Act. (Photo: Gallo Images / Frennie Shivambu) Turning to the matter involving Crime Intelligence head Lieutenant General Dumisani Khumalo, Sifolo pointed to “inconsistencies” in how the IGI handled the investigation.“On 24 April 2025, the IGI wrote to the minister confirming that the investigation had been completed and that the report was being submitted. Yet, on 28 August 2025, the IGI wrote to the acting divisional commissioner requesting information on the same matters. “Nicoc was saying: if the IGI was done, why would he wait for Dumisani Khumalo to be suspended and then begin to request this information?” said Sifolo.Dumisani Khumalo testifies at the Madlanga Commission on 4 November 2025. (Photo: Frennie Shivambu / Gallo Images) Khumalo and six SAPS colleagues were arrested on 26 June 2025 by the Investigating Directorate Against Corruption (Idac) on charges of fraud and corruption tied to the appointment and vetting of Brigadier Dineo Mokwele, as well as controversial property acquisitions.The National Prosecuting Authority (NPA) has since withdrawn the charges against Khumalo and his co-accused relating to Mokwele’s alleged irregular appointment.Among the significant revelations from Sifolo’s testimony was that President Cyril Ramaphosa had received a verbal intelligence briefing on 30 June 2025 – six days before Mkhwanazi went public with his allegations. DM