Madlanga Commission hearing record
Day 193 of the Madlanga Commission
Witness: Dr Ntandazo Sifolo
Evidence led by Advocate Matthew Chaskalson SC (chief evidence leader), Advocate Ofentse Motlhasedi
After four rulings in a month and one appearance pulled the night before, the country's acting intelligence coordinator finally gave evidence, and the day ran in the exact shape the chairperson had ordered: public first, then the doors closed. In the public part he put the National Intelligence Coordinating Committee in President Ramaphosa's office on 30 June 2025, six days before Mkhwanazi's briefing, and accused two oversight bodies of frustrating the clean-up of the criminal justice system.
The day in brief
What you need to know
- NOTHING ON THIS PAGE IS A FINDING, and the direction of the allegation is unusual here. For once the witness is not accused of anything: no allegation has been made against Dr Sifolo on this commission's record at all. What he says about other institutions, in particular the Inspector-General of Intelligence and IDAC, is his own institution's assessment, untested, and neither body has answered it before this commission.
- THE OFFICIAL TRANSCRIPT FOR THIS DAY IS NOT PUBLISHED, and part of it never will be. The ruling of 9 November 2026 seals the in-camera portion: the Annexure B evidence 'shall not be publicly disclosed or disseminated, unless otherwise authorised by a further ruling of the Commission or an order of a court of competent jurisdiction'. This page can only ever be a record of the public half.
- THE RULING HELD ITS SHAPE EXACTLY. Public hearing first, with the evidence leaders free to question him by reference to Annexures A and C, Annexure A usable but not displayed, Annexure C displayable at their discretion. Then, on completion of the public portion, the evidence continued in camera on Annexure B under Rule 4.2, with attendance restricted to the chairperson and commissioners, the evidence leaders, Dr Sifolo and his representatives, and necessary commission staff.
- THE BIGGEST FACT OF THE DAY IS A DATE. Per the IOL network and the TimesLIVE and Sowetan report, he told the commission that NICOC secured an audience with President Cyril Ramaphosa and briefed him verbally on 30 June 2025, six days before Lieutenant-General Nhlanhla Mkhwanazi's media briefing of 6 July 2025. Whether the President acted inside those six days is not on this record, and this archive does not supply an answer.
- THE TWO ACCOUNTS OF WHAT THAT BRIEFING COVERED DIFFER SLIGHTLY AND BOTH ARE RECORDED. IOL reports that the committee briefed him on the arrests of senior Crime Intelligence officials and the reasons behind them. TimesLIVE reports a verbal briefing on organised criminal networks and infiltration threats, built on reports beyond the national intelligence estimates. They are not inconsistent, but they are not the same sentence either.
- HE ACCUSED TWO OVERSIGHT BODIES, VERBATIM IN TWO OUTLETS: 'Intelligence later revealed the witting or unwitting role of the Inspector General and the Investigating Directorate Against Crime (IDAC) in frustrating the strides of the intelligence services in addressing the priority of decontamination of the criminal justice system.' Per both SABC News and Eyewitness News, he said NICOC had asked for certain oversight investigations to be suspended because they risked interfering with a live operation, and the request was not acceded to.
- THE ASSESSMENTS GO BACK TO 2022 AND THEY ARE BLUNT ABOUT THE STATE. Reading from an assessment: 'The major contributor to the malaise has been the weakness within the state security apparatus to actively prevent, protect and sanction those associated with malfeasance', with law enforcement involvement in cash-in-transit heists, illegal mining, human smuggling and contraband adding 'impetus to the hopelessness of the public and widening trust deficit'.
- THE ELECTION YEAR HE NAMES IS 2021. 'This threat became more pronounced during the local government election of 2021, where murder and intimidation in the name of politics threatened to become a norm.' That is NICOC's own dating of when the intertwining of politics and the criminal underworld became a national security priority, and it is three and a half years before the disbandment of the Political Killings Task Team that this commission was created to examine.
- A SECOND WARNING THAT HAS NOT BEEN MADE HERE BEFORE: per SABC News he raised the private security industry taking on functions the law reserves to state law enforcement agencies. That is a structural concern about who polices South Africa, and it arrives from the coordinating body rather than from a complainant.
- HELD, NOT RELIED ON, ALL SINGLE-OUTLET: that Minister in the Presidency Khumbudzo Ntshavheni approved the verbal briefings after recusing herself from reports that could implicate cabinet colleagues (TimesLIVE alone); the Presidency's response and the line 'Intelligence is not evidence' (IOL alone); the 11 February 2025 date for the minister's request to the Inspector-General and the February 2025 decision to coordinate Gauteng operations (Eyewitness News alone); a pre-2024-election national security council report describing a 'Mafia-like' operation in the state (TimesLIVE alone); and the withdrawal of JMPD K9 officer Johannes Mokgatle through ill health (SABC News alone).
Full coverage
The day, in depth
A month of rulings, and the shape they gave this day
Dr Sifolo was first set down for Day 183, Tuesday 13 October 2026, and the appearance was pulled late the night before with no reason published. What followed was not a dispute about him but about this commission's power. The evidence leaders, not the witness, had applied on 12 October 2026 for his entire evidence to be heard in camera, on the ground that it rests on classified material declassified for the commission's use and not for public release. amaBhungane, the Daily Maverick and Media24 opposed. The application was argued in open session on Day 185, 21 October 2026, and the chairperson reserved. His ruling of 22 October decided neither way and ordered the asking instead: the evidence leaders were to approach NICOC, in terms of paragraph 15 of Dr Sifolo's own letter of 31 August 2026, for permission to use the documents publicly. He answered inside the deadline and released most of the material, withholding one schedule. The directions of 29 October split the documents into three annexures. The final ruling of 9 November 2026, signed by Commission Secretary Dr N Vukuza by order of the chairperson, recorded that the media respondents had 'elected not to pursue further relief ... at this stage, while reserving their rights to in future seek access to the relevant documents and evidence after Dr Sifolo has testified', and ordered the split hearing that this day then followed to the letter. A request to hear the country's most senior intelligence official entirely behind closed doors had been reduced, over nineteen days and four rulings, to a dispute about one list.
The opening statement, read into the record
He began by reading a statement rather than answering questions, and its subject was the argument that had delayed him. Per SABC News, he told the commission that media freedom and national security should be understood as complementary responsibilities in a constitutional democracy rather than as opposing interests, and he framed the balance in his own words: 'Let us defend the right to know while recognising that there are circumstances in which the manner of disclosure matters as much as the information itself. Let us expose corruption and unlawfulness without exposing those whose lives depend on legitimate operational confidentiality.' Per Eyewitness News he put the same point as a set of obligations that do not cancel each other out: 'The question is not who should be exempted from accountability. It is how accountability can be exercised without destroying the very public interest it is intended to protect. The guardians must be accountable. Those who scrutinise the guardians must act responsibly and the republic must remain secure. These, in our understanding, are mutually reinforcing obligations.' Per SABC News he also thanked the commission for hearing his evidence in public before the closed portion began. It is worth noting what this is and is not. It is the witness at the centre of a month of secrecy litigation using his first minutes in public to argue against a flat choice between openness and security. It is not a ruling, and it does not change the fact that the material he withheld stays withheld.
Six days before Mkhwanazi: the briefing to the President
The single hardest fact on this record is a date. Per the IOL network, under the byline of Kamogelo Moichela, and per TimesLIVE carrying a Sowetan report under the byline of Herman Moloi, Dr Sifolo told the commission that NICOC members met President Cyril Ramaphosa on 30 June 2025 and briefed him verbally. IOL quotes him: 'We were given an audience, we met the president, and we briefed the president as a committee.' TimesLIVE has him describing reports on organised criminal networks beyond the national intelligence estimates, which served as the basis for 'a verbal briefing to the president prior to the July 6 2025 media briefing, particularly on June 30 2025'. The significance is the gap. Lieutenant-General Nhlanhla Mkhwanazi held his media briefing on 6 July 2025, alleging that criminal syndicates had infiltrated the criminal justice system. If the coordinating intelligence body had put a version of the same picture in front of the President six days earlier, the question of what happened in between becomes a live one. This archive states the gap and stops there: whether the President acted inside those six days is not on this record, no finding has been made about it, and nothing in this evidence alleges wrongdoing by him. The two outlets describe the briefing's subject slightly differently and both readings are recorded above. The more sensitive surrounding detail, that the minister in the Presidency approved the verbal briefings after recusing herself from intelligence reports that could implicate cabinet colleagues, rests on one outlet and is held.
What the assessments say, in their own words
Per SABC News, which carried the passage twice across a midday and an evening report, he told the commission that a standing concern of the national intelligence structures has been 'the intertwining between politics and the criminal underworld, leading to high levels of insecurity in the country', and he dated the point at which it sharpened: 'This threat became more pronounced during the local government election of 2021, where murder and intimidation in the name of politics threatened to become a norm.' The source he was reading from is NICOC's 2022 national intelligence estimate. He said it remains the duty of the national intelligence structures 'to assure the conditions of safety and security in order to allow a thriving economic and stable environment', and that crime intelligence was accordingly directed to prioritise and neutralise politically motivated killings, including killings of law enforcement officials. He then read the diagnosis that the whole day turns on: 'The major contributor to the malaise has been the weakness within the state security apparatus to actively prevent, protect and sanction those associated with malfeasance.' The assessment goes on, in his reading of it, to say that 'the involvement of law enforcement in various syndicated crimes such as cash in transit, heists, illegal mining, human smuggling, contraband, etc.' adds 'impetus to the hopelessness of the public and widening trust deficit'. Note what that sentence does. It is not an outside complaint about the police. It is the state's own coordinating intelligence body recording, in a document written years before this commission existed, that law enforcement is inside the syndicates.
Mafia-like networks, and a private industry doing public work
Per SABC News he warned of growing mafia-like criminal networks tied to corruption and to the infiltration of law enforcement structures, and said the intelligence assessments identified dysfunction within the state security apparatus that has weakened the ability to prevent and act against crime and corruption. Alongside that he raised a concern this archive has not recorded from any previous witness: that the private security sector is increasingly taking on functions that the law reserves to state law enforcement agencies. That is a structural observation rather than an accusation against any company, and it is one of the few moments in this commission's record where the question has been widened from who is corrupt to who is actually doing the policing. Per TimesLIVE, carrying Sowetan, he also described a national security council report produced before the 2024 elections which stressed the mingling of political leaders and underworld figures in a complex operation inside the state, and which recommended strengthening investigative capacity against serious organised and commercial crime, a dedicated approach to embezzlement in municipalities and state-owned companies, and the expediting of investigations and prosecutions arising from state capture findings. That report and its contents rest on one outlet and are recorded here as single-sourced.
The accusation against the watchdogs
The sharpest passage of the public session is an allegation by one state body against two others, and it is carried verbatim and almost identically by SABC News and by Eyewitness News, which is why this archive publishes it. In Dr Sifolo's words: 'Intelligence later revealed the witting or unwitting role of the Inspector General and the Investigating Directorate Against Crime (IDAC) in frustrating the strides of the intelligence services in addressing the priority of the decontamination of the criminal justice system.' Per both outlets the context is a request that was refused. NICOC asked that certain oversight investigations into ongoing operations be suspended, on the ground that they risked interfering with a live intelligence operation, and the Inspector-General of Intelligence did not accede. Eyewitness News alone supplies the date and the channel, reporting him as saying the request 'had been conveyed by the minister on the 11th of February 2025'; that date and the identity of the minister are held as single-sourced. Two things have to be said plainly next to this. The phrase 'witting or unwitting' is doing a great deal of work: it is the difference between an accusation of complicity and an observation about effect, and he did not choose between them. And the Inspector-General, Mr Imtiaz Fazel, is not in a position to answer. He has been suspended since October 2025, is challenging that suspension in the high court, has given no evidence to this commission, and has answered none of this before it. IDAC has not answered it here either. Neither is accused of an offence by this evidence, nothing here is a finding, and both are presumed innocent. Readers should also hold in mind that documents titled 'Concerns Regarding the Activities of the Suspended Inspector-General' and 'Underhanded Machinations of the Inspector-General of Intelligence Regarding Crime Intelligence' appear in the schedules cleared for use in these hearings. Those are titles of documents, not evidence and not findings, and their contents remain unpublished.
What closed behind the doors, and why it matters that it did
Per SABC News the public portion ended and the proceedings continued behind closed doors, and the commission continues on Friday. What went in there is defined by the 9 November ruling and not by anyone's discretion on the day: the classified documents listed in Annexure B, 'together with such matters arising therefrom as cannot be ventilated publicly'. Fourteen items sit on that schedule, their titles redacted but for two, a 'Record of the Legislated NICOC Members Meeting 01 December 2025' and the '2025 NIE: Counterintelligence Chapter'. The four national intelligence estimates of 2022, 2023, 2024 and 2025 were released to the public hearings as their domestic sections only, expressly excluding the counterintelligence chapter, so the withheld part is precisely the chapter about who has penetrated what. Attendance at the closed session is restricted to the chairperson and commissioners, the evidence leaders, Dr Sifolo and his legal representatives, the commission staff necessary to conduct and record the proceedings, and anyone the chairperson expressly authorises. The seal is double: the Annexure B documents may not be displayed or disclosed in the public hearing, and the evidence given about them in camera may not be publicly disclosed or disseminated without a further ruling of the commission or a court order. The media respondents have reserved the right to come back for it once he has testified. He has now testified, so that reservation becomes live.
In their words
Key moments from the record
“We were given an audience, we met the president, and we briefed the president as a committee.”
“Let us defend the right to know while recognising that there are circumstances in which the manner of disclosure matters as much as the information itself. Let us expose corruption and unlawfulness without exposing those whose lives depend on legitimate operational confidentiality.”
“The question is not who should be exempted from accountability. It is how accountability can be exercised without destroying the very public interest it is intended to protect. The guardians must be accountable. Those who scrutinise the guardians must act responsibly and the republic must remain secure. These, in our understanding, are mutually reinforcing obligations.”
“Intelligence later revealed the witting or unwitting role of the Inspector General and the Investigating Directorate Against Crime (IDAC) in frustrating the strides of the intelligence services in addressing the priority of the decontamination of the criminal justice system.”
“This threat became more pronounced during the local government election of 2021, where murder and intimidation in the name of politics threatened to become a norm.”
“The major contributor to the malaise has been the weakness within the state security apparatus to actively prevent, protect and sanction those associated with malfeasance.”
“the involvement of law enforcement in various syndicated crimes such as cash in transit, heists, illegal mining, human smuggling, contraband, etc. adds impetus to the hopelessness of the public and widening trust deficit”
“Upon completion of the public portion of Dr Sifolo's evidence, his evidence shall continue in-camera in terms of Rule 4.2 of the Rules Governing the Proceedings of the Commission.”
Our analysis
The bottom line
This is the first day of this commission on which the evidence came from the top of the system rather than from inside the mess. Every major witness so far has been a participant, a complainant or an accused: a businessman testifying from custody, generals accusing each other, investigators accused of writing statements for people. Dr Sifolo is none of those. He is the official whose statutory job is to assemble what all the intelligence structures know into one picture for the President, and he arrived with that picture in documents written years before anyone had heard of this commission. That changes what the evidence is for. It cannot tell you whether a particular person took a particular bribe. It can tell you whether the state knew, and when.
On that question the day produced one hard fact and one large silence. The hard fact is 30 June 2025. The silence is what happened next. This archive is not in a position to say, and will not imply, that the President failed to act; no evidence before this commission addresses what he did in those six days, and the reporting does not either. But the sequence is now on the record in a way it was not before, and it reframes Mkhwanazi's 6 July briefing. That briefing has been treated throughout as a rupture, an officer going public because the ordinary channels had failed. The evidence of this day is that the ordinary channel had just been used, at the highest level available, days earlier. Whether that makes the briefing redundant or necessary is exactly the question, and it is not answered here.
The accusation against the Inspector-General and IDAC deserves to be read slowly, because it is institutionally extraordinary and evidentially thin in the same breath. Extraordinary, because the coordinating intelligence body is saying in a public hearing that the statutory watchdog over intelligence and the directorate prosecuting corruption got in the way of cleaning up the criminal justice system. Thin, because 'witting or unwitting' refuses to say whether that was collusion or incompetence, and because the specific grievance underneath it, that oversight investigations were not suspended on request, is a thing oversight bodies are supposed to be able to refuse. An inspector-general who paused investigations whenever the services said an operation was running would not be much of an inspector-general. That tension is worth naming even while the assessment stands unanswered, because Mr Fazel is suspended and cannot answer it here, and because the same schedules carry document titles attacking him by name.
The structure of the day is itself part of the record. A commission created to examine the capture of the criminal justice system heard its most senior intelligence witness in public for a morning and then sealed the rest, including the counterintelligence chapter of every national intelligence estimate, which is to say the part that addresses who has penetrated what. The reasoning for that seal is not published; the 9 November ruling gives orders and no reasons. The media houses did not fight the final order, but they reserved the right to seek the documents once he had testified. He has now testified. If that reservation is not exercised, the most consequential evidence this commission hears about infiltration will exist only in a sealed transcript, and the public account of it will be the half-day summarised on this page.
A final caution about this page specifically. It is written from same-day reporting, with no official transcript, by an archive that has been corrected by the transcript on each of the last four hearing days it published this way. Two outlets rendered the same Sifolo sentence with different words ('intertwining' against 'intertwine', 'ensure' against 'assure'), which is the ordinary noise of live transcription and a reminder that the quotations here are reporters' renderings. The spine of the account is corroborated across SABC News, Eyewitness News, the IOL network and TimesLIVE. The detail should be treated as provisional, and everything marked held above should be treated as unpublished.
Analysis is the archive’s own comment on the public proceedings, grounded in the record above. It weighs the evidence and the process; questions of individual guilt are for the courts and the commission to decide. Everyone named is presumed innocent.
Follow the threads
Who Dr Ntandazo Sifolo connects to
Lieutenant-General Nhlanhla Mkhwanazi
Per the IOL network and TimesLIVE, Dr Sifolo told the commission on Day 193 that NICOC briefed President Ramaphosa verbally on 30 June 2025. Lieutenant-General Mkhwanazi held his media briefing on 6 July 2025. The sequence matters because Mkhwanazi's briefing has been read throughout as an officer going public after the ordinary channels failed, and this evidence places the most senior ordinary channel in use six days earlier. What happened in between is not on this record, no finding has been made about it, and nothing in this evidence alleges wrongdoing by anyone named in it.
View profile →Same intelligence stream, both heard in cameraMajor-General Feroz Khan
Khan, the dismissed former deputy head of SAPS Crime Intelligence, is the other senior intelligence figure whose evidence this commission ordered to be heard behind closed doors. The two applications rest on different grounds: Khan's on the confidentiality of evidence already led in private, Dr Sifolo's on the classification status of his documents.
View profile →The suspended watchdog named in the titles Sifolo released for public useImtiaz Fazel
Two of the six Annexure C documents cleared for display in open hearings are titled 'Concerns Regarding the Activities of the Suspended Inspector-General' and 'Underhanded Machinations of the Inspector-General of Intelligence Regarding Crime Intelligence', the second also appearing in Annexure A dated 25 May 2025. They are titles of documents, not evidence and not findings, their contents are unpublished, and Fazel has given no evidence to this commission and answered none of it. Both men are presumed innocent.
View profile →In the room & on the record
Counsel, the panel and sources
On the panel
Sources
- Madlanga Commission - official ruling on the in camera application of Dr N Sifolo, dated at Pretoria 9 November 2026, signed by Commission Secretary Dr N Vukuza ↗
- SABC News, Sibahle Motha - Madlanga Commission hears testimony from NICOC's Dr Ntandazo Sifolo (12 Nov 2026, 10:25) ↗
- SABC News, Sibahle Motha - Sifolo tells Madlanga Commission media freedom and security coexist (12 Nov 2026, 10:51) ↗
- SABC News, Sibahle Motha - Political, criminal links threaten national security: Dr Sifolo (12 Nov 2026, 17:24) ↗
- SABC News - 'Mafia-like networks infiltrating law enforcement' (12 Nov 2026, 14:29) ↗
- Eyewitness News, Tsholo Tsoku - NICOC accuses inspector-general and IDAC of frustrating efforts to tackle criminal infiltration (12 Nov 2026, 14:10) ↗
- Eyewitness News, Tsholo Tsoku - Madlanga Commission: Media freedom must not compromise national security, says Sifolo (12 Nov 2026, 09:16) ↗
- IOL, Kamogelo Moichela - Ramaphosa was warned of national security threats days before Mkhwanazi's briefing (12 Nov 2026) ↗
- TimesLIVE / Sowetan, Herman Moloi - WATCH | 'Ramaphosa told about criminal infiltration days before Mkhwanazi's media briefing' (12 Nov 2026, 14:15) ↗
- Daily Maverick / amaBhungane, Orrin Singh - Openness or secrecy: media and evidence leaders square off at Madlanga Commission (21 Oct 2026), for the argument that produced the ruling ↗