Gauteng health department corruption-buster Babita Deokaran's alleged killers stalked her for more than a month.
Just three days after the brazen daylight hit this week they were traced by a maze of CCTV cameras that pieced together their getaway route, and led to their arrest.
The suspects went to great lengths to cover their tracks, apparently using remote tech to disable cameras at a petrol station near the site of the shooting, which could have identified them or their vehicle.
"For days almost every private security company's camera system in the area was scanned," said a source close to the investigation of the killing outside Deokaran's home in southern Johannesburg on Monday morning.
"The killers were seen fleeing, but once they left the suburbs under surveillance there was no trace of them. They used back roads to try avoid detection. Through informants and cyberforensic tools one of the suspects was eventually traced to a rented house."
Police had one more clue to go on: pictures of a white BMW taken earlier in the week by a neighbour who saw people in the car photographing Deokaran's townhouse complex.
The arrest of seven KwaZulu-Natal men on Friday morning followed a race against time to identify and apprehend them, after police received a tip-off that they were planning to return to the province this weekend.
Sources close to the investigation said the masterminds shelled out millions of rands for Deokaran's assassination. She was a key whistleblower in the province's personal protective equipment (PPE) scandal.
Her grisly killing in cold blood after dropping her daughter at school has raised questions over the lack of protection for whistleblowers and public servants who refuse to turn a blind eye to corruption.
The source said the killers had been brought to Johannesburg specifically for the hit. Police discovered the hideouts of two other hit men on Thursday, "one of which had been rented for over a month". They had been renting homes in Rosettenville, 5km from Deokaran's home in Winchester Hills.
Deokaran was a long-time whistleblower who had exposed much irregularity and corruption in the department. Gauteng premier David Makhura said on Wednesday there was "a link" between her murder and those facing charges involving R332m in PPE tender fraud.
A Gauteng health department official who is a witness in the Special Investigating Unit (SIU) investigation into the PPE fraud, told the Sunday Times that Deokaran, who was acting chief financial officer, had been greatly respected by her colleagues.
The suspects were allegedly paid R2.8m for the hit
"Babita was not just providing information on the PPE matter, but lots of other matters. People trusted her. We all did. She led the charge.
"Colleagues saw her as someone who could make a change, who could stop the rot, especially given what she had done to help the SIU... Senior Gauteng government officials took her seriously."
The witness said people need to look beyond the PPE scandal.
"What happened has scared witnesses in several big internal investigations. I've left my home for a friend's home in another province. I'm looking over my shoulder. This was a definite message to witnesses by very powerful people."
It is understood Deokaran had recently uncovered irregularities related to several Johannesburg hospitals' procurement.
Shafique Sarlie, the suspects' lawyer, on Friday confirmed his clients were from KwaZulu-Natal. "We have no idea of the case against them, what the evidence is or what they are charged with." He said he had been prevented from seeing his clients.
"The police are frustrating us. The families are extremely worried about them."
Deokaran, a single mother, was shot at least five times at 8.20am on Monday. Nothing was taken in the attack.
Gauteng Hawks spokesperson Ndivhuwo Mulamu confirmed that two cars and two pistols, one of them licensed and one not, were recovered during the arrests.
She said the suspects, aged between 24 and 31, would appear in the Johannesburg magistrate's court tomorrow on charges of murder and possession of an unlicensed firearm and ammunition.
Mulamu declined to comment further. The Gauteng health department did not respond to questions.
The case is now being investigated by the Hawks, but a team of detectives from the Gauteng Serious Organised Crime Unit, which investigates assassinations, was initially set up to solve the murder.
A police officer with insight into the investigation said the team had been established because of the corruption Deokaran had exposed and because of information indicating the murder was a hit using hi-tech computer systems to carry it out.
"A potentially worrying anomaly was detected just after the killing. CCTV cameras at a Shell petrol station opposite Deokaran's house, some of which look at the driveway gate, suddenly stopped working at the exact time of the shooting.
"They were working fine in the minutes leading up to the shooting and directly afterwards, but not during the murder. Cyber experts are looking to see if they were deliberately hacked or jammed."
He said investigators were also looking into the alleged remote monitoring of Deokaran's cellphones, tablet and computer.
"It seems someone was possibly spying on her."
Asked about a motive, he said detectives were looking at whether it was linked to information Deokaran had already provided to the SIU, or recent alleged financial irregularities she had reportedly uncovered.
"It looks like she had come across some questionable things in the past five months, which she was raising the alarm on. Apparently she stopped some big payments."
An employee from the petrol station, speaking on condition of anonymity, confirmed their CCTV cameras went "haywire" moments before the shooting.
"One moment they were fine and then the next there was nothing. There was no power failure in the area at the time.
"We tried retrieving the footage, but there is a recording gap over the time of the shooting. When they came back on all we could see was the aftermath of the attack."
Professor Danny Myburgh from Cyanre, The Digital Forensic Lab, said depending on the type of networks CCTV cameras are linked to they can be disabled by hacking unprotected Wi-Fi systems.
"It requires knowledge, laptops and certain software. You drive down a street searching for the Wi-Fi systems. Once you identify the target you hack it. It is called ward-driving."
The Sunday Times has learnt from two separate sources with knowledge of the investigation that the suspects were allegedly paid R2.8m for the hit.
"In total we have heard that nearly R4m was put aside for the hit. We are currently tracking the others who were also involved in planning this murder," said one of the sources.
"Some of those arrested were here for a month to source vehicles, and begin monitoring their target. They are all from KwaZulu-Natal, although some have links to Gauteng through their families."
Another source said the suspects were caught following a hi-tech security operation involving Fidelity's elite Specialised Services and Community Active Protection services.
"Officers used sophisticated cyberforensic tools and vehicle tracking and surveillance systems to eventually trace the suspects.
"They found them through the white BMW 3 Series that Deokaran's killers were driving. It was finally traced on Wednesday.
"The tracing occurred through use of surveillance systems, which tracked Deokaran's movements in the days and hours leading up to her death.
"With that information, together with photographs of the vehicle taken earlier in the week by a neighbour who saw the occupants photographing Deokaran's townhouse complex, police tracked the BMW."
He said the investigation had been incredibly difficult, with huge time pressures.
Deokaran's sister, Renu Williams, confirmed police had taken Deokaran's electronic devices for analysis.
"She never mentioned any word of receiving threats on her life. Even if she did she probably didn't take it seriously. She never would have dreamt that they would do this to her."
She said her sister never went into details regarding the types of corruption she was exposing.
"She always spoke with anger about corruption that was happening in the public sector. [But] when she spoke to us it was never [about] the extent of what was going on."
Williams, who shared a close relationship with her sister, said Deokaran lit up a room when she walked in. "She was so humble and down to earth and got along with absolutely everybody, young and old."
Her grisly killing in cold blood has raised questions over the lack of protection for whistleblowers who refuse to turn a blind eye to corruption
— Source close to the investigation
Vuyo Mhaga, spokesperson for premier Makhura, confirmed Deokaran had provided critical information during internal investigations and the disciplinary hearings.
"In the PPE case her testimony ... resulted in the dismissal of health department officials. Some officials also resigned. Her information resulted in the SIU successfully freezing bank accounts."
SIU spokesperson Kaizer Kganyago would not entertain detailed questions but said Deokaran "provided evidence to the SIU in line with her job title and functions. She was one of more than 320 witnesses providing evidence, information and records."
Deokaran's close friend, Gauteng legislature member Sergio dos Santos, said she had recently uncovered information pointing to alleged financial irregularities.
"The information she obtained seems to point to the wrongdoing beyond just the PPE scandal."
A provincial government source said the information related to hospital procurement programmes. "She had halted payments and raised potential red flags."
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.