A multimillion-rand payment dispute has lifted the lid on allegations that former eThekwini city manager Sipho Nzuza secretly spied on top municipal officials at the time he and others were being investigated in connection with the solid waste tender fraud.
A security company, Solbeth Protection and Risk Management, claims that it was hired to covertly assess, evaluate and monitor the electronic communications of staff — including heads of departments, support staff in the city manager’s office and all his bodyguards — to ensure “safe information flow”.
In a letter to the eThekwini executive council, Siyabonga Xulu, CEO of the security company, said Nzuza acquired his services to deal with an “emergency situation” and bypassed tender systems to keep the operation secret from “some people inside the municipality”.
Xulu, who said he imported surveillance equipment from Russia to help Nzuza keep tabs on his subordinates, told the executive committee that the city still owed him at least R63m for his services.
Nzuza was appointed city manager in 2017 but was suspended in 2020 after being charged along with former mayor Zandile Gumede and others in the R320m solid waste tender fraud case. Once he was dismissed, payments to Solbeth apparently dried up.
An engagement letter — a copy of which the Sunday Times has seen — signed by Nzuza and Xulu describes the “emergency services” requested by Nzuza as “monitoring and evaluation of all mobile, audio and data; flagging; daily reporting; firewall encryption”. An eight-month contract, setting a ceiling of R360,000 a month on Solbeth’s fees, was entered into. This was done without the knowledge the city’s IT department or other senior officials in the council.
You have finally managed to advise the dead city manager Sipho Nzuza to charge and to eventually fire us. By the time that happens you will be buried.
— Text sent to security company CEO Siyabonga Xulu
Xulu maintained in his letter that his company continued to provide services to the city beyond the eight-month period.
Municipal sources who spoke on condition of anonymity said staff had been aware that spying equipment had been installed to monitor their communications. They said Nzuza was “paranoid” about the investigation into the solid waste tender, and about municipal officials against whom he had launched disciplinary proceedings.
WhatsApp messages between Xulu and Nzuza during the contract period indicate a trusting relationship between them.
Information that Xulu shared with Nzuza included a photo of a car he thought was suspicious, evidence of a possible hit list with Nzuza’s name on it, and threatening messages that had been sent to him.
One such message, sent to Xulu by a municipal official, read: “You have finally managed to advise the dead city manager Sipho Nzuza to charge and to eventually fire us. By the time that happens you will be buried, we can go to Pinetown and Dlangezwa, we know everything you been cooking, your days are numbered.” The official later resigned.
Towards the end of the contract, Xulu said in his letter to the city’s executive committee, the risks involved became “elevated”.
He received “further instructions from the office of the city manager that included [asking] our company to manage, assist and ensure total safety by implementing monitoring ... for all administration staff, protectors, COO, including the staff at the city manager’s office”.
Xulu said this necessitated the purchase — approved by Nzuza — of sophisticated equipment from Russia.
“The system was installed and is still functional, running at a R5.7m invoice monthly that has since never been paid, on top of the R62,815,858.78 including VAT, interest and legal fees for the other batch,” Xulu told the executive committee.
Xulu’s timeline suggests that payment for his services ceased when Nzuza was suspended and subsequently fired.
Nzuza told the Sunday Times he knew the company Solbeth Protection and Risk Management but denied any knowledge of the surveillance Xulu claims was carried out with the Russian technology, and denied approving its acquisition.
Nzuza said the services Xulu provided were not covert. They were above board and he had not bypassed supply chain management.
“I know them and I know they have been trying to get some money from the municipality. As far as I am concerned they were engaged in some services and they were paid. Whichever services they are claiming over and above what they did, I don’t think I can be involved in those — I can’t talk much because I am no longer in the service of the municipality,” he said.
Xulu said that when Nzuza was dismissed his successor, Musa Mbhele, asked him to “sweep” his office, his home and his official vehicles for bugs and assess his communication channels for malware.
“This was done through various calls and WhatsApp messages,” the letter to the executive committee said. "[Mbhele] requested a rate card which was sent on September 24 2021 at 20:27pm, an interception report was attached with a secondary report on 12:52pm and a telephone call that followed after 15:15 pm where he requested an invoice to be attached to our monthly claim which was sent to him at 19:45pm.”
Xulu said he had approached Mbhele several times for payment to no avail. A WhatsApp exchange shows Mbhele denied owing any money. “Ungangisabisi mina (don’t threaten me). You know you are lying. You have never done anything for my house let alone the cars (I would never allow you to touch the city vehicles). Ayikho yonke lento oyikhulumayo. I don’t owe you anything futhi usuyahhema manje. Uyogcina ngokusabisa laba abakusabayo! Our conversation ends here.”
Contacted by the Sunday Times, Mbhele denied any knowledge of Xulu’s company and referred questions to the city’s communications department.
The constitution guarantees the right to privacy, which means that employers cannot invasively monitor their employees without their consent.
— Prof Jéan Steyn, an expert in forensic criminology at the University of Zululand
A city spokesperson said: “The municipality is aware of the company. However, our responses may be contained in the court papers because the matter is pending in court. As a matter of principle and respect for the judicial processes, the municipality does not litigate through the media and will not discuss cases that are pending before court.
“The claim about the company being appointed by city manager Mr Musa Mbhele is categorically false because when Mr Mbhele was appointed as the city manager, this dispute was already under way.
“We are, however, unable to comment on payment allegations made against ... Sipho Nzuza and the allegations regarding the procurement of services without following due processes, as Mr Nzuza is no longer in the employ of the municipality. Our responses may be contained in the court papers because the matter is pending in court.”
The MEC for co-operative governance and traditional affairs, Thulasizwe Buthelezi, has written to eThekwini mayor Cyril Xaba asking for a report on Xulu’s allegations within 14 days.
Prof Jéan Steyn, an expert in forensic criminology at the University of Zululand, said staff monitoring by employers was common in South Africa and around the world, “the purpose being to increase productivity and compliance, as well as reducing and managing defined risk”.
“However, monitoring must comply with procedural and substantive law, within the standing jurisdiction. The constitution guarantees the right to privacy, which means that employers cannot invasively monitor their employees without their consent,” Steyn said.
“However, this right is not absolute, and employers have the right to monitor their employees’ activities in relation to what was legally agreed, and legally (reasonably) expected and understood.”
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.