South Africa’s security institutions are poorly prepared to deal with Islamist extremists and terrorists operating across the border in Mozambique, a new report has found.
This is according to the Global Initiative Against Transnational Organised Crime (GI-TOC), which released a report entitled ‘Insurgency, illicit markets and corruption: The Cabo Delgado conflict and its regional implications’.
Looking at Islamic State networks in South Africa, it notes that South Africa has some history of extremism movements linked to vigilante groups, such as PAGAD (People Against Gangsterism and Drugs), but the country has rarely been a target for radical Islamic terrorism. The emergence of some cases linked to Islamic State since 2015, however, has led some analysts to argue that this situation is changing.
“Some have speculated that South Africa’s intervention via SADC in neighbouring Mozambique could make the country a bigger target. South African president Cyril Ramaphosa, for example, warned that Islamic State militants could target South Africa and other allied nations intervening in Mozambique at a summit with Kenya’s president Uhuru Kenyatta in November 2021,” the report stated.
There have been several instances over the past two decades where South Africa has been used as a base for terrorists operating internationally: as a base to plan attacks, a conduit for financing, or a hiding place. Some analysts have argued that South Africa’s extensive issues with gangsterism, corruption and entrenched organized crime have created a febrile situation that terror networks can exploit to their advantage.
This includes the case of Samantha Lewthwaite, a British national who was instrumental in planning the Westgate mall attack in Nairobi by al-Shabaab. In 2014, Lewthwaite was discovered to have been living in South Africa, using a fake South African passport, since at least 2008. Other terror suspects have used falsified South African passports and South African nationals have also been identified joining terrorist networks overseas.
The use of South Africa as a ‘rear base’ for training, concealment and fundraising for Islamist militants was acknowledged by South African state security sources in the first decade of the 2000s. This dynamic appears to continue today. A report released by SADC states that some funding for the Mozambican insurgency has been channelled through individuals and private organizations in South Africa and other countries in East Africa, including such Tanzania, DRC, Uganda and Burundi.
Since the emergence of Islamic State, a number of South Africans have reportedly travelled to join the group in Syria. An estimate from 2017 ranged widely between 60 and 100 individuals. Since 2015, several Islamic State-linked incidents have taken place in South Africa. Some argue this represents a shift whereby South Africa is becoming an active theatre of operations for Islamist terrorism. In two of these incidents, suspects or people linked to the cases also joined the Islamic State-aligned insurgents in Mozambique, suggesting that the newer, southern African front of the caliphate can draw in individuals inspired by global Islamic State ideals, the GI-TOC report stated.
The report notes that some observers argue that the cases that have emerged since 2015 prove that South Africa now ‘faces an imminent threat of jihadist terrorism’. Whereas previously South Africa avoided becoming the target of Islamic State’s jihadist ire because of its stance on international terrorism policy, it now faces ‘blowback’ due to its intervention in the Mozambican insurgency, as Islamic State itself has threatened in a 2020 issue of its publication Al Nabā.
South African law enforcement reports that there are at least seven South African nationals known to be currently fighting in Mozambique, but that 30–40 are suspected.
Security institutions in disarray
“The incidents linked to Islamic State that have emerged in South Africa since 2015 do not necessarily show an immediate, sustained threat of Islamic terrorism to the country. However, they do starkly demonstrate that the institutions tasked with identifying, prosecuting and preventing these cases are fundamentally weak,” the report stated.
“South Africa’s security institutions have long been riddled with corruption, maladministration and infiltration by organized crime. Concerted efforts by powerful political interests to undermine their independence, misappropriate intelligence resources for political purposes, and cripple police and prosecutorial capacity to act on corruption – notably during the decade-long tenure of President Jacob Zuma – have had a devastating effect.”
The State Security Agency (SSA) – which is key to assessing intelligence on foreign and domestic threats – is among the many agencies that have been undermined. The SSA faced accusations of incompetence after the widespread violence in KwaZuluNatal and Gauteng provinces following Zuma’s imprisonment for contempt of court in July 2021. In August 2021, as part of a cabinet reshuffle, Ramaphosa scrapped the Ministry of Intelligence and announced the SSA would now be directly accountable to the presidency.
Similarly, the police’s Crime Intelligence Division has been all but crippled by years of systemic abuses and corruption, the report said, adding that the National Prosecuting Authority (NPA), also partially hollowed out during the Zuma years and hamstrung by state capture, politically pliant appointments and a rapid turnover in staff and leadership, is now struggling to right itself.
The impact of weak institutions influences South Africa’s response to terrorism cases. The Financial Action Task Force (FATF) – a global intergovernment watchdog of money laundering and terrorist financing – published a report in October 2021 which found that South Africa was not pursuing investigations into terrorism financing consistent with international standards. FATF notes that South Africa has only ever convicted one person involved in terrorism financing, while highlighting that South Africa has thousands of charitable and non-profit organizations with insufficient oversight, suggesting some might be at risk of terror financing abuse.
Authorities have stated that they are engaged in active investigations into terrorist financing from South Africa to Mozambique. Hawks spokesperson Lloyd Ramovha told media in August 2020 that South Africans were aiding and abetting Islamic State in Mozambique with ‘financial and material support’.
“However, sources we spoke to levelled criticisms at the way counterterror investigations have been handled,” the GI-TOC report stated. “Investigators with close knowledge of Islamic State-linked cases expressed fears that South African authorities do not currently have enough technical and specialist capacity to deal with cases of this nature. Terrorism cases also require significant manpower, informer networks, cyber capabilities, specialist language skills, cultural knowledge and an understanding of militant ideology, elements that are largely lacking in South Africa’s security establishment today.”
Several sources told the GI-TOC that there is a single South African Police Services expert who analyses data seized in terror raids, for example. This lack of investigative capacity contributed to what the magistrate criticized as ‘unreasonable’ delays, which led to the Verulam mosque prosecution being struck from the roll. Significant delays have also affected other terror offence cases. In October 2021, when the Thulsie twins appeared in court, the judge slammed the delays in their trial as ‘preposterous’. Senior Hawks sources allege that a lack of expertise domestically has left South African investigators reliant on the cooperation of overseas partners.
Publicly, the South African government has affirmed its commitment to counterterrorism, but several sources in South Africa’s justice and security cluster expressed fears that there is little appetite in government to see terrorism as a serious issue, the GI-TOC report stated. This is attributed to authorities being otherwise preoccupied with high-profile corruption cases in South Africa.
A Hawks officer investigating terror cases told GI-TOC that while police wanted to pursue terror cases, the state’s capacity to do so is increasingly diminished as more and more senior detectives retire.
Fact box: Islamic State-linked cases in South Africa since 2015
The ‘Thulsie twins’ case
First among these cases to make headlines was that of the ‘Thulsie twins’. Along with their friend Renaldo Galdino Smith, Brandon-Lee and Tony-Lee Thulsie made attempts to join Islamic State but were intercepted by law enforcement. The trio were then arrested by the Hawks in a counterterrorism raid in Johannesburg in July 2016. Smith initially turned state witness against the Thulsie twins but then refused the offer of a state witness protection programme and fled to Mozambique to join the Mozambican insurgency in 2018. Sources suggest that he has since been killed fighting in Mozambique.
The Thulsie twins became the first South Africans to be arrested and charged for having Islamic State links, accused of having cultivated links with known Islamic State leaders on social media, gathered materials on terrorism and bomb-making (including consulting an undercover US FBI agent for bomb-making advice and funding) and planned attacks in South Africa. In February 2022, more than five years after their arrest, the Thulsie twins entered into a plea bargain with the state. Tony-Lee Thulsie received an 11-year prison sentence and Brandon-Lee Thulsie was sentenced to eight years.
The Del Vecchio and Patel case
In February 2018, Sayfudeen Aslam Del Vecchio, his wife Fatima Patel and a Malawian national, Jackson Ahmad Mussa, were arrested on suspicion of the kidnapping and murder of two British-born botanists, Rodney and Rachel Saunders. The couple had been travelling in KwaZulu-Natal in search of rare plants at the time of their disappearance, a week prior to the arrest. Del Vecchio and Patel were not charged with terrorism, yet several aspects of their case attest to their links with Islamic State. For many years, Del Vecchio had made no secret of his radical views and his ‘affiliation to the Islamic State’. Fatima Patel was suspected of helping a 15-year-old join Islamic State in 2015 and had been active in posting jihadist content on social media, establishing an extremist Twitter profile as ‘The Lioness’.
Police stated in court proceedings that the couple were suspected of terrorist activity from as early as 2017 and that the state was in the process of drafting an affidavit asking to search their home when it came to light that they were suspected of kidnapping. The search of Del Vecchio and Patel’s home also uncovered Islamic State flags, a modified cell phone, which appeared to be the trigger for an improvised explosive device (IED), and handbooks on bomb-making. Analysis of their phones discovered messages between Del Vecchio, Patel and Mussa about ‘killing the kuffar’ in apparent reference to the killing of Rodney and Rachel Saunders. A Dutch jihadist named Mohammed Ghorshid was later reportedly found using stolen money that came from Rachel Saunders’ credit card to buy cryptocurrency, having received the details from Del Vecchio and Patel.
Del Vecchio and Patel appeared in court in a Durban area known as Verulam in May 2018. Towards the end of a day of court proceedings, there was a disturbance in the press gallery. The nearby Imam Hussain mosque was on fire as men armed with knives attacked the Shia place of worship, killing one man and critically injuring two others. Three days later, an IED was discovered in the mosque. Several other incendiary devices – reportedly of the same type planted at the Verulam mosque – were planted in Woolworths stores and markets around Durban in July 2018. Phone calls were made to Woolworths demanding Bitcoin payments for the bombings to cease. Twelve suspects were accused of alleged involvement in the Verulam mosque attack, including Durban businessman Farhad Hoomer. The trial of Del Vecchio, Patel and Mussa has yet to commence.
Farhad Hoomer
Farhad Hoomer and the other men were charged with several crimes relating to the mosque attack: murder and attempted murder, planting explosive materials and arson. The charge sheet was later amended to include planting incendiary devices around Durban and terrorism charges. They were also charged with possessing an IED remote control and extortion of three Durban businessmen (who allegedly had dealings with Hoomer), demanding they each pay R10 million into a hawala account in Dubai.
In a series of raids on the day of the arrests, police reported that they discovered a Tanzanian man being held for ransom in the basement of a property belonging to Hoomer – in an apparently unrelated criminal scheme in which undocumented foreign nationals were kidnapped for ransom. Police reported that extremist literature was also found and in court proceedings, the state alleged the suspects were linked to Islamic State. Yet the case against them was later dropped. A further postponement (requested by the state) was refused by the magistrate, who criticized unreasonable delays in the trial as prejudicial to the accused. State prosecutors said investigators had yet to analyze the five terabytes of data recovered from over 200 devices seized from the accused.
Senior state prosecutor Mahen Naidu said the state would continue with its investigations. ‘We already have all this information. As much as the court wouldn’t accept that COVID-19 affected the police and hampered investigations, it did. We will finalize our investigations and approach the DPP [director of public prosecutions] to get the authority to prosecute and to place the matter back on the roll,’ Naidu said. Hoomer and his co-accused have since threatened to launch a damages claim of R156 million against the state for malicious prosecution. In June 2021, a second case was also dropped after Hoomer and four others were arrested at a warehouse in Mayville, Durban. Police seized over 5 000 rounds of ammunition and handguns, an AK-47 and a bolt action rifle with a scope. Some of the ammunition was identified as coming from a state source. This case was dropped a few months later, to the frustration of police and prosecutors. A policeman close to the investigation said the evidence was incorrectly gathered, either intentionally or because of ineptitude.
Kliprivier case
Shortly after charges against Hoomer and the other suspects in the Verulam mosque attack were dropped in July 2020, police raided a house in Kliprivier, south of Johannesburg, and arrested an alleged kidnapping and extortion syndicate described by South African authorities as ‘one of the biggest breakthroughs [in] investigations of international terrorism in South Africa’. Islamic State-related material was reportedly found at the house, just as Islamic State ‘training DVDs’ were recovered from Hoomer’s property after the Verulam mosque attack investigation.
Police claimed that some of the firearms recovered at the house had been used in other kidnapping cases in KwaZulu-Natal and in a shooting at a restaurant in Melville, Johannesburg, that had been identified as a terrorist incident. One of the suspects was successfully prosecuted for kidnapping and extortion. It has been reported that some of the accomplices of the Kliprivier incident have since fled to join the insurgency in northern Mozambique.
An officer in the Hawks unit for Crimes Against the State told the GI-TOC that they believe that this extremist network is moving members between ‘cells’ in different parts of South Africa, including Johannesburg and Durban, either so these members can be involved in extremist operations or to allow members to evade law enforcement.
