A major shake-up of the country's security cluster - including the axing of ministers - is on the cards after last week's riots that cost 330 lives and R50bn in damage to property and infrastructure.
This follows the government's lack of preparedness for the violence and looting that erupted in KwaZulu-Natal and Gauteng after Jacob Zuma was jailed.
Top government insiders told the Sunday Times that President Cyril Ramaphosa has spoken to ministers about possible changes to his executive after this week's embarrassment where ministers contradicted one another in public, and claims that some were not given crucial information.
The Sunday Times has also seen a document presented by the State Security Agency (SSA) to the National Joint Operational and Intelligence Structure (Natjoints) on July 3, a week before the attacks. Dated June 29 and titled Threat Assessment Input, the document indicates that by then, the government had threadbare information - much of it from social media.
Senior government security insiders criticised the quality of the information, saying there was no indication that intelligence operatives from the SSA or the police's crime intelligence were infiltrating or monitoring groups fomenting violence.
"There was no proper co-ordination, even at the level of Natjoints, because SSA was supposed to brief Natjoints so that it could generate some sort of operation and [plan] what was to be done," said a senior official.
The SSA's sloppiness was also blamed on allegations, denied by state security minister Ayanda Dlodlo, that there remain senior officials in the agency still loyal to Zuma and his allies.
"Agents on the ground produce quality reports. But by the time the reports reach the minister it is soiled," said one official.
Insiders said they expected the president to wield the axe this week. Ramaphosa has been under pressure to reshuffle his cabinet, but in three years has not rushed any changes.
This week, tensions between Dlodlo and police minister Bheki Cele mounted into open hostility amid the fallout from the intelligence failures.
Government insiders said the SSA had since uncovered information that implicated senior politicians, wealthy businesspeople, and ordinary ANC members in fomenting last week's violence.
These people, through their community and social media networks, allegedly got communities to loot, but they are by no means the masterminds
— SSA source
An official said their assumption was that the fightback was going to be in political structures.
"There were just rumours ... and they were making threats in Nkandla. We thought they were going to approach the matter differently and take the fight to the NEC [ANC's national executive committee]. The information came after the fact," said another senior official.
The Sunday Times understands that the spat between Cele and Dlodlo continued at a meeting on Friday. Cele again accused her of not sharing intelligence. Cele allegedly sought to clear his name, saying the police could not have prevented the riots without warnings from the SSA.
Dlodlo is said to have provided "evidence" that the cabinet received regular reports of threats of riots linked to poverty and a struggling economy. These included regular national intelligence estimates given to ministers and senior officials through the directors-general.
In the meeting Dlodlo is said to have pointed fingers at Cele, saying police were so underprepared that their water cannons were not working and they had not ordered vital equipment, including rubber bullets. Another insider said police had no riot plan.
Acting presidency spokesperson Tyrone Seale told the Sunday Times the government was committed to a "thorough and critical review" of the state's preparedness to respond to challenges "of this kind".
"Security forces and law enforcement bodies are now working well together, co-ordinated by Natjoints and under direction of the NSC [National Security Council]."
In defence of the SSA presentation to Natjoints, a senior state security insider said the information shared there was redacted to avoid leaks.
Natjoints, led by the police, disseminates intelligence for the government to act on. Its meetings are attended by senior officials from the SSA, the defence force and other government departments that deal with security. After the meetings, plans are made to counter threats and recommendations are made to ministers.
The Natjoints spokesperson, Maj-Gen Mathapelo Peters, said: "Matters of intelligence as well as running investigations are operational issues which we are not at liberty to comment on publicly."
The Threat Assessment Input document included only the following excerpts:
• "A poster is in circulation via social media calling for the occupation of the Constitutional Court on 2 July 2021 at 6am to defend the 'Father" of the Radical Economic Transformation (RET)';
• "On 29 June 2021, Nancefield hostel dwellers attacked people and vehicles around Klipspruit Valley Road [Soweto, Gauteng] to display outrage with the Constitutional Court's ruling ...";
• "On 30 June 2021, supporters were asked to gather on 30 June 2021 and 1 July 2021 and on 4 July 2021 at 10am at the Durban city hall, Meadow Gardens to be transported to Nkandla. The movement of supporters of the former president is expected to continue over the weekend as per the various messages being circulated"; and
• "Incitement to mobilise ... was also noted in Msunduzi [municipality in Pietermaritzburg], whilst supporters were asked to gather at the Umvoti toll on 1 July 2021 at 8am to proceed in a motorcade to Eshowe as part of the #HANDSOFFZUMA campaign."
A subsequent Defense Intelligence (DI) presentation dated July 7-14 recommended that law enforcement monitor several groups mobilising support for Zuma.
"Any planned action would place the rollout and distribution of the vaccines at risk and potentially override the current DMA [Disaster Management Act] regulations.
"An additional risk is that the security forces deployed to ensure the safety and security of communities at large, could be viewed in a negative light holding the risk of becoming targets," the DI said.
This week, acting minister in the presidency Khumbudzo Ntshavheni said it was not in the country's interest to disclose intelligence received relating to the riots.
So far, 750 people have been arrested for looting, and four others for inciting public violence and breaking lockdown regulations.
The four accused of incitement include Sibusiso Mavuso, who allegedly provoked public violence relating to an incident at a Pick n Pay in Westonaria, Gauteng.
Former Ukhozi FM DJ and Zuma loyalist Ngizwe Mchunu, Patriotic Alliance member Bruce Nimmerhoudt and West Rand ANC ward councilor Clarence Tabane were also arrested.
All four appeared in the Randburg, Westonaria and Roodepoort magistrates' courts this week and were remanded in custody until next week.
However, some of the crimes for which no-one has been arrested include attacks on cellphone towers, setting fire to 25 trucks along the N3 in KZN, armed attacks on Durban harbour, and the theft of over 1-million rounds of ammunition from a container outside the harbour.
Only a few thousand rounds of the ammunition, mainly 9mm bullets, were recovered.
An SSA source involved in the investigation said the four who appeared in court this week were "lower than low-hanging fruit".
"These people, through their community and social media networks, allegedly got communities to loot, but they are by no means the masterminds," the source said.
A senior government official said the strategy was to arrest those in the public eye so they implicate "the big fish" suspected to be involved.
Gareth Newham, head of the governance, crime and justice division at the Institute for Security Studies, said the state's failure to arrest and charge anyone responsible for planning the violence showed it had little credible intelligence.
"If that is the sum total of information, then we've got a serious problem ... I mean crime intelligence has a R4bn budget and 8,000 people in that division, and if that's the best, then we're in serious trouble," he said.
Newham said while there could be reluctance to provide detailed information to a structure like Natjoints, which may consist of people with varying degrees of security clearance, "you want to be able to say 'we have credible, verified information, that there's going to be attempts to foment widespread public violence in the following areas' ... That's the kind of information you expect the National Joint Operations centre to have."
He said that after the gathering at Nkandla before Zuma was jailed, where people openly threatened violence, there should have been steps taken to understand whether these were idle threats, if not then who was behind it, and whether plans had been made using methods like covert surveillance and communication interception.
- Additional reporting by Graeme Hosken
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.