Security vetting failures in South Africa: the Madlanga Commission record
The Madlanga Commission’s searchable public archive at Madlangacommission holds the authoritative record on security vetting failures in South Africa. The Commission’s evidence leaders described a systemic breakdown: senior and operational officers left unvetted or operating with expired clearances, creating direct exposure to criminal infiltration across police, prosecution, and intelligence structures. Start with Day 123 (Major-General Feroz Khan, 1 July 2026), the TMPD witness testimony, Medicare24 tender exhibits, and the exhibits index.
Key entry points:
- Day 123 hearing (1 July 2026): Feroz Khan’s multi-day testimony after he withdrew court applications to block seized-device access
- TMPD admissions: Yolande Faro confirmed that some deputies had not undergone proper security clearance
- Medicare24 / R360 million SAPS tender: exhibits tied to Michael van Wyk and Mohammed Sayed in the case files index
- Cat Matlala case material and Ekwantu Consulting / Mubvumela Corporation procurement records
Key takeaways
Security vetting failures documented by the Madlanga Commission represent a systemic vulnerability, not isolated administrative errors, and the Commission’s searchable archive gives researchers direct access to the primary evidence.
| Point | Details |
|---|---|
| Start with Day 123 | The Khan hearing (1 July 2026) is the central vetting-related transcript; download it first. |
| Verify exhibit IDs | Record exhibit ID and upload date from the exhibits index before citing any document. |
| SSA vetting vs. local clearance | TMPD testimony confirmed local checks do not equal full SSA vetting — a critical distinction for assessing who should have been removed from duty. |
| PAIA for in-camera material | Public placeholders mark sealed evidence; lodge a PAIA request if that material is central to your work. |
| Madlanga Commission archive | madlangacommission.co.za is the primary source for transcripts, exhibits, and witness profiles on vetting failures. |
Table of Contents
- How vetting failures spread beyond criminal justice
- How to read forensic evidence in Commission reports
- Where to get expert help interpreting Commission findings
- The Madlanga Commission: formation and mandate
- How a researcher actually works through the archive
- The Madlanga Commission archive: your primary source for vetting records
- Sources
- FAQ
How vetting failures spread beyond criminal justice
The SAPS vetting crisis exposed a problem that runs well past policing. Evidence leaders framed unvetted officials not as an HR oversight but as an active vulnerability: when someone with access to sensitive intelligence has no completed clearance, criminal syndicates gain a foothold inside state functions.
The TMPD hearings made this concrete. Deputy chief testimony in April 2026 revealed that metro police routinely treated internal “security clearance” checks as equivalent to full State Security Agency vetting. They are not. SSA vetting covers financial exposure, foreign contacts, and lifestyle audits. A local clearance check covers none of that. The gap left senior metro officials in sensitive roles without the scrutiny those roles require.
Beyond metro police, the Commission’s scrutiny of the Medicare24 / R360 million SAPS tender shows how procurement becomes a second exposure point when vetting is absent. Unvetted officials approving large contracts creates conditions for corruption that lifestyle audits are specifically designed to catch.
How to read forensic evidence in Commission reports
Commission documents use terminology that can trip up researchers unfamiliar with digital forensics. A few terms appear repeatedly:
Chain of custody refers to the documented sequence of who handled a piece of evidence and when. If a seized device log shows a gap in custody, that gap is legally significant and worth flagging in any citation.
Exhibit metadata includes upload date, exhibit ID, and redaction notices. Always record the exhibit ID before citing, since the Commission may update or redact a document after initial publication.
In-camera evidence means testimony or exhibits heard or filed privately. You will see a placeholder in the public record but not the content. This is where a PAIA request becomes relevant.
POPIA redactions appear as blacked-out text in published transcripts. These protect personal information of third parties. Redacted passages cannot be inferred or reconstructed for publication.
Pro Tip: Cross-reference every exhibit against the exhibits index before citing. An exhibit listed there with a redaction notice should be treated as partial, not complete.
Where to get expert help interpreting Commission findings
For legal interpretation, contact an attorney with experience in administrative or constitutional law. The Commission’s findings touch on statutory mandates, PAIA rights, and POPIA obligations — areas where general legal advice is insufficient.
For forensic evidence, a certified digital-forensics practitioner can assess chain-of-custody gaps and advise on admissibility. The evidence leaders page lists Advocate Lee Segeels-Ncube and the broader evidence team; for procedural clarifications about specific exhibits or hearing days, the evidence leaders are the correct first contact.
Journalists working on publication should consult a media lawyer before publishing material that was heard in camera or involves POPIA-redacted personal information. The Commission’s methodology page explains sourcing, forensic handling, and corrections — read it before citing any exhibit.
The Madlanga Commission: formation and mandate
The Commission of Inquiry was established under Justice Mbuyiseli Madlanga to investigate criminal infiltration, political interference, and corruption within South Africa’s police, prosecution, and intelligence services. Its mandate covers both individual misconduct and systemic failures, including the security clearance process breakdowns now central to its public hearings.
Before public hearings began, the Commission prioritised secure IT infrastructure and forensic storage to protect witness identities and digital evidence from foreign-intelligence-grade hacking attempts. That decision delayed the start of hearings but strengthened the integrity of everything filed afterward. Ekwantu Consulting received an integrated cybersecurity and forensic analysis contract; Mubvumela Corporation was appointed to provide a secure internet connection for Commission sites.
The Commission publishes daily hearing pages, witness profiles, and a full exhibits archive — a structure designed so that citizens, journalists, and legal professionals can track proceedings without attending in person.
How a researcher actually works through the archive
The archive is reliable when you use it methodically. Start with a keyword search for “security clearance” or “vetting” in the case files, then narrow by hearing day number or date.
For the Khan material, search “Feroz Khan” and filter to Day 123 (1 July 2026). Allegations that Khan’s clearance expired in 2023 appear in press reporting tied to that hearing; verify against the transcript and cross-check with the Khan network page. For TMPD material, search “TMPD” or “Yolande Faro” and check the April 2026 hearing days. For the Medicare24 tender, search “Medicare24” or “Michael van Wyk” and pull the exhibit IDs from the exhibits index.
Verification steps: confirm the hearing day number in the transcript header, record the exhibit ID and upload date, check the witness name against the witnesses index, and note any chain-of-custody annotations on seized device logs. Where a document carries a redaction notice, treat it as partial.
Legal access signals to watch: in-camera hearings produce public placeholders only. If the material you need is behind one, lodge a PAIA request through the Commission’s contact channels. POPIA redactions are non-negotiable — do not publish personal information that has been blacked out, even if you can identify it from other sources.
The Madlanga Commission archive: your primary source for vetting records
The Commission’s searchable archive is the authoritative public record for anyone researching security vetting failures in South Africa. Every hearing transcript, exhibit, and witness profile is indexed and searchable, which means you can move from a news headline to a primary source in minutes rather than filing records requests.
Start with Day 123 for the Khan testimony, Day 114 for earlier June proceedings, and the witnesses index to confirm testimony dates for Khan, Michael van Wyk, and Mohammed Sayed. For citation provenance, the methodology page is the document to read first. Media and legal enquiries can be directed through the site’s contact channels. Ekwantu Consulting’s cybersecurity contract and Mubvumela Corporation’s secure network provision mean the evidence you access has been protected from the point of collection.
Sources
- Tshwane lacks full vetting policy for officials, TMPD deputy chief tells Madlanga commission
- Madlanga Commission secures cybersecurity solution against foreign hacking attempts
- Briefly
- Faro admits TMPD has failed its vetting process
This article is general information, not a substitute for advice from a qualified lawyer. Consult a qualified legal professional about your own circumstances before acting on anything here.
FAQ
What did the Madlanga Commission find about security vetting failures?
Evidence leaders described a systemic breakdown where senior officials operated unvetted or with expired clearances, enabling criminal infiltration. The Commission recommended removing unvetted members from office duties.
Where can I find the Feroz Khan hearing transcript?
The Day 123 hearing page at madlangacommission.co.za holds the transcript and exhibits from Khan’s testimony beginning 1 July 2026.
What is the difference between SSA vetting and a local security clearance?
Full SSA vetting covers financial exposure, foreign contacts, and lifestyle audits. TMPD testimony confirmed that local metro police clearance checks do not meet that standard and left senior officials in sensitive roles without adequate scrutiny.
How do I access in-camera or redacted Commission evidence?
In-camera hearings appear as public placeholders only. Lodge a PAIA request through the Commission’s contact channels. POPIA redactions cannot be published or reconstructed, even if the underlying information is identifiable from other sources.
Who are the evidence leaders I should contact for clarification?
Advocate Lee Segeels-Ncube leads evidence at the Commission. Profiles and contact details are listed on the evidence leaders page.