SA’s ransomware problem is hiding a much bigger issue

South Africa has a cyber problem. The harder question is whether we would recognise it if part of that problem were not crime.In the past two months, Cartrack confirmed a ransomware attack on 26 August. EasyEquities and Satrix warned clients after RelyComply, the identity-verification provider behind their Know Your Customer checks, confirmed an intruder in its environment. Alexforbes has linked its own exposure to the same provider. Cell C says its incident involved a different one. Bidvest Bank has issued its own notice. Air Traffic and Navigation Services has appointed forensic investigators.None of this, taken alone, proves anything geopolitical. Cartrack told customers the incident was believed to have been carried out by Dire Wolf, a double-extortion ransomware crew, though its public web notice does not name the group. Dire Wolf separately listed Cartrack on its leak site and claimed 500GB of data. MyBroadband’s review of the leaked material found that much of it concerned American customers. Dire Wolf has also claimed RelyComply, and says it seeks only money and has no political stance. The public record fits ordinary extortion far better than statecraft.Air Traffic and Navigation Services is harder. It is dealing with two matters. Preliminary findings indicate a ransomware incident in an operational-technology environment supporting weather-related air-traffic services. Separately, initial inquiries could not substantiate an allegation of employee data theft. In the first, network monitoring reportedly indicated possible exfiltration to IP addresses located in China. That identifies where a server sits, not who controls it.TestMy argument is not that South Africa’s foreign policy caused any of these incidents. It is that a state claiming strategic autonomy must be able to distinguish ordinary cybercrime from strategic operations when the evidence starts to overlap. The recent incidents are not evidence of a campaign. They are a test of whether South Africa could tell a campaign from an ordinary run of cybercrime. What is publicly visible does not answer that question.The reflex is to ask whether this is cyberwarfare. That is the wrong question. Thomas Rid argued long ago that cyberwar will not take place. The consequential activity sits between crime and war, in espionage, subversion and sabotage. The law draws similar lines. Tallinn Manual 2.0, the influential but non-binding expert analysis of international law in cyberspace, works through 79 rules on sovereignty, state responsibility, specialised regimes and international peace and security before it reaches the law of armed conflict. Violation of sovereignty (itself contested as a standalone rule), coercive intervention, use of force and armed attack are different thresholds with different consequences. “Cyberwarfare” should not be the category that does the initial analytical work.But not war does not mean not strategic. Cyberpersistence theorists argue that states compete through continuous campaigns whose effects accumulate below the armed-attack threshold: access gained, credentials harvested, suppliers mapped. Cyberpersistence theory therefore gives us a reason to test for campaigns, not to infer one from a cluster.Nor does crime versus state divide cleanly. Tim Maurer shows that states delegate operations to proxies, orchestrate them through looser support, or sanction them by knowingly tolerating activity they could stop. Criminals carry political motives. States buy criminal access. “It’s ransomware” does not end the inquiry. “The victim was strategic” does not begin one.South Africa has already seen political grievance turn digital. In May, #OpSouthAfrica, a campaign by Nigerian-linked hacktivist groups including Nullsec Nigeria, claimed attacks on Sita, the Civil Aviation Authority, the SA Social Security Agency and Correctional Services in retaliation for xenophobic violence. Many of the claims remain unverified. The retaliatory intent was explicit even where the claimed compromises were not.Intelligence interestForeign policy can create intelligence interest. South Africa is the applicant against Israel at the International Court of Justice, a prominent BRICS member, and a self-described non-aligned state with public positions on Ukraine and the Middle East. But interest is not evidence of targeting, and targeting is not evidence of responsibility for any present incident. There is no public evidence that any state is behind these incidents, and naming one would turn a security question into a conspiracy theory.Henry Farrell and Abraham Newman offer a structural lens. States that control the hubs of asymmetric global networks can use that position to watch and to coerce. For South Africa, the question is which financial, communications, cloud and identity networks run through foreign-controlled hubs through which strategically valuable information or leverage could flow. That is the attack surface.Seeing it turns on attribution, which is five questions, not one. What happened technically? Who ran the operation? What is their relationship to any state? Is their conduct legally attributable to that state? Should the government say so publicly? Maurer’s categories answer the third question, not the fourth. For private actors of this kind, conduct becomes attributable to a state where they act on its instructions or under its direction or control, or where the state later acknowledges and adopts the conduct as its own. Tolerance and sympathy do not suffice.Peacetime espionage is not, as such, unlawful under international law, though the means used may breach other rules. That makes espionage especially difficult to condemn in legal terms. And the African Union’s 2024 Common African Position treats due diligence as an obligation: a state that knows or should know that wrongful cyber operations are using infrastructure in its territory or under its control must take feasible measures within its capacity to stop them. That can give South Africa an argument about the territorial state’s own omission even where the underlying operation cannot be attributed to it. Not every state agrees. The United Kingdom, for one, does not accept that state practice yet establishes such a rule.Discipline requires saying what would disprove the hypothesis, and none of the relevant indicators is state-specific. Clean monetisation, interest only in saleable data, and apparent links that dissolve into shared suppliers point towards crime. Selective collection of material with intelligence value but no resale value, persistence without visible return, and re-entry after eviction point, weakly, the other way. CluesCriminals persist too, and absent monetisation may simply be monetisation not yet seen. What matters is whether several weak clues begin pointing in the same direction. A cluster becomes a campaign only when independent evidence links the incidents operationally or by a coherent common objective. Chronology does neither. Nor does diplomatic timing. There is always a diplomatic event.Each forensic firm answers for its client. The National Cybersecurity Hub is a national response team linked to sector teams. The Information Regulator receives security-compromise notifications under section 22 of the Protection of Personal Information Act. But the public architecture does not establish that any single institution receives a compulsory, sufficiently detailed cross-sector technical feed capable of campaign-level correlation. Nor can the public record show what intelligence structures already see. Section 54 of the Cybercrimes Act would oblige communications providers and financial institutions to report specified offences to the police. It is still not in force, and it would not create such a feed on its own.A lawful mechanism is needed for sharing minimised technical indicators, and enough metadata to correlate them, with privacy and confidentiality controls built in. It should build on the reporting duties the Critical Infrastructure Protection Act already contemplates. Section 54 should be commenced. More fundamentally, an institution needs clear national responsibility for cross-sector correlation and for escalating suspicious patterns into intelligence assessment.If the evidence shows a global ransomware economy hitting vulnerable systems, that is worth knowing. If it shows something else, we need to know that too. Being able to reject the geopolitical hypothesis on evidence, rather than assumption, is itself a form of state capability.“Ransomware” answers one question. Sovereignty requires us to ask the rest. Foreign policy has an attack surface.South Africa wants strategic autonomy. But would we know if someone were using cyberspace to contest it? DM