The Judicial Commission of Inquiry into Criminality, Political Interference, and Corruption in the Criminal Justice System
Phones & devices
Much of what the commission has been told about who speaks to whom did not come
from witnesses. It came out of seized phones — message threads, call records, photographs and
deleted chats. This is who held which phone, what the record says was found on it, and which
people those devices connect.
5devices and records examined
8message threads described
12connections they draw
3hearing days given to devices
1
Why the phones matter
The inquiry's subject is relationships: who directed whom, who was protected, who was paid, and
who was told what. A phone is where those relationships leave a trace. So the commission has
repeatedly stopped hearing witnesses and spent its days instead reading devices into the record —
message by message, photograph by photograph.
Two of those days matter most. On Day 161, 18 August 2026, the commission sat
with no witness at all and spent the whole day inside the devices of the late Jotham
“King Mswazi” Msibi. On Day 172, 2 September 2026, it was shown the first
verified photograph of the alleged “Big Five” — recovered from a phone.
The evidence matters for a second reason too: it is contested. Much of it is disputed, some of
it was put to witnesses who denied it, and one seizure of a suspect's phone led to an interception
plan being uncovered rather than the other way round.
What this page shows, and what it does not. It reports what the record says each
device or message showed. It does not reproduce the wording of any message — see
section 5 for why, in plain words.
2
The devices
Five devices or device records, in the order the record treats them. Each card says
whose it was, what the record says was on it, and where that comes from.
The phones seized from Matlala's home
Vusimuzi “Cat” Matlala — alleged “Big Five” member and owner of Medicare 24
Police raided Matlala's Pretoria home and seized his phones; a second raid
followed on 18 December 2024. What was taken from them became some of the most-quoted evidence
in the inquiry.
His phone records held the contact details of Capt. Felani Zungu. Crime
Intelligence's Lt Gen Dumisani Khumalo flagged Zungu as a possible “double agent” after those
details were found there.
His messages were put to the commission on a cocaine sale and an
R20 million loan, and were said to detail payments to Brown Mogotsi.
The phone itself was an Apple iPhone 16. An evidence leader described the
exhibit on Day 35, 18 November 2025: a WhatsApp file “that contains a record
of all of the WhatsApp messages, be they voice or chat, between two parties” — and what was
printed out was the entire contents of the WhatsApp calls and chats between
Matlala and the witness then being questioned, Brown Mogotsi.
A spreadsheet, SDK1, was built from the export to mark which messages had been
forwarded and which had been sent. It found no forwarded messages
in the chats between Matlala and Julius Mkhwanazi, or between Matlala and Thato Senona.
The devices of the late Jotham “King Mswazi” Msibi
Jotham “King Mswazi” Msibi — alleged head of the “Big Five” cartel, since deceased
On Day 161 the commission heard no witness. It spent the entire sitting
inside Msibi's devices — the messages, and what they were said to show.
Those messages named Katiso “KT” Molefe and Steve Motsumi
among others as the same alleged circle, and carried the January 2023 “Swazi
deal” chats about buying a cellphone interception device — a “grabber” — from a Czech
supplier, with the purchaser represented as the SAPS.
Msibi's phone was also said to hold an alleged plan with Motsumi and others to buy that
interception device.
A photograph recovered from Molefe's phone became the first verified image
of the alleged “Big Five”. It was shown to the commission on Day 172,
2 September 2026, as Godfrey Lebeya concluded his evidence.
The commission's evidence identifies the five men in that photograph as Molefe,
Steve Motsumi, Ignatius Mothakathi, Mthethwa “King Nyambose”
and Jotham Msibi.
Cellphone records allegedly linked Brigadier Ramanjalum to
Cedric Nkabinde, the Police Minister's chief of staff. Ramanjalum had
completed a five-year sentence after a plea agreement with IDAC.
No device was read out here — the connection rests on the traffic between two numbers, which
is why it appears in this list beside the seized phones.
Eight message threads the record describes. Each card names the two ends of the
conversation, says what the record says the messages showed, and links to where that comes from.
Wording that the record itself quotes appears in brass and in quotation marks;
everything else is the record's own summary, not the words on the screen.
WhatsApp messages detailed payments from Matlala to Mogotsi. Mogotsi was
described as an alleged conduit linking the Police Minister, Senzo Mchunu, and Matlala — and
a witness, Carrim, testified that “Mogotsi and Matlala played me” out
of millions.
Sources: Madlanga Commission (Wikipedia) · The Madlanga Commission ArchiveNamed together 234 times in the record
Matlala asked the acting deputy chief of the Ekurhuleni Metro Police to
“assist” and “intervene” in a speeding arrest.
Mkhwanazi later appeared alongside Matlala and the EMPD fleet manager, Chris Steyn, on
charges of corruption, fraud and defeating the ends of justice.
Sources: Madlanga Commission (Wikipedia) · The Madlanga Commission Archive
A WhatsApp message of 6 December 2024 showed Malcolm X
thanking Lebeya on behalf of a man called “King Nyambose”. Lebeya — then
the national head of the Hawks — said he had never asked who that was. He separately said he
deployed Hawks officers after a call from the same civilian.
Sources: The Madlanga Commission Archive · African News Agency
WhatsApp messages were led alleging that Khan and Sayed plotted to
trap the then Inspector-General of Intelligence into a false statement —
Dr Setlhomamaru Dintwe. An evidence leader put it to the commission that Khan acted as a
“willing facilitator” of tenders on Sayed's behalf.
Mo Sayed→Julius Malemanamed in the evidence; not a record in the graphMessages forwarded up
What the record says the messages showed
An affidavit places Sayed as the alleged
conduit between Khan and political leadership, forwarding messages to
Malema. Malema is alleged to have relayed political protection to Khan, including the
message that Khan “will not ever resign, no matter what”.
WhatsApp messages were put to Johnson, then the head of IDAC, about her
association with Khan. She accepted it was “very deep” and personal.
Separate whistleblower evidence alleges that in 2018, as an NPA prosecutor, she caused an
assault-case docket to be leaked to Khan before he was charged.
Sources: The Madlanga Commission Archive · The Namibian
Senona allegedly received confidential police information from Matlala and
discussed a property deal for his son. Matlala described the relationship in his own words:
“not friends but he's my older brother”, and confirmed Senona lent him
R20,000 after the raid on his home.
Sources: Madlanga Commission (Wikipedia) · The Madlanga Commission Archive
The commission probed messages from Mashaba, the Gauteng traffic police chief,
touching on the late Deputy President David Mabuza and MEC Faith Mazibuko.
The point of the device evidence is the line it draws between people. These are the
connections the record makes through a phone — each one opens the people involved in the graph.
A manifest screenshot on an encrypted phone; forensic evidence pointing to who chose the berth.
Encrypted phone · archive
5
How to read this
Why the cards summarise rather than quote. The commission publishes its transcripts as
PDFs. In those files the text is letter-spaced — a message printed on the page as
G o o d m o r n i n g comes out of the document as a stream of single
letters. The words survive that; what does not survive is the spacing and the
punctuation between them, and it cannot be recovered from the file. So the wording of a message
can be read by a person, but it cannot be reproduced typographically exactly — and on a record
that may be quoted in argument, the difference matters.
This page therefore reports what the record says each message showed, and quotes only
phrases that the record or the reporting around it already puts in quotation marks. Where the
commission's own words describe a device — as on the iPhone 16 below — those words are quoted and
the day is named, so the passage can be looked up in the transcript.
An example, so you can see the problem. The commission's own sentence describing what
was printed out from Matlala's phone (Day 35, 18 November 2025) is stored in the transcript
like this:
Read it and the sentence is perfectly clear. Search it, quote it, or run a spell-check over
it and it is not — every word has been run into the next. That is why the cards above say
what the record says, and why the transcripts are linked rather than reproduced.
Allegations, not findings. Every message, photograph and
device described here was put to the commission as evidence. None of it is a finding: the commission
has made none, and everyone named is presumed innocent. Several of the people above denied the
accounts put to them, and those denials are recorded in the graph alongside the allegations.
Device evidence is also only as good as its custody. The record shows that forensic phone
evidence from the Aeroton scene was never seen by IPID, which was refused the docket — a point put
to the commission under cross-examination. Where the record shows that kind of dispute, the graph
holds both sides of it.
Where to go next. Every person and device named here is a record in the knowledge graph,
with its sources attached — open the graph and search
for any of them. The hearing days given over to the devices are on the
timeline: Day 161 for Msibi's devices, Day 172 for
the photographs.
What the messages actually said
The commission has not published message images — its public record holds transcripts, audio, video,
statements and documents, and exactly one photograph, which is of a witness and not of a phone. So
what follows is the next most direct thing: the words themselves, exactly as they were read into
the record, with the day, the speaker and the source attached to each. Where an image does exist it is
shown; where it does not, the entry says so, because a reader is entitled to know the difference
between seeing a screenshot and reading a transcript of one.