When investigators at the Madlanga Commission, a South African judicial anti-corruption inquiry, projected WhatsApp conversations extracted from seized mobile phones onto courtroom screens, they were doing far more than reading private messages. They were attempting to reconstruct alleged criminal networks.

Every message, timestamp, contact list and call log became another thread in what investigators argue is a sprawling web linking senior police officers, politicians, businesspeople and alleged underworld figures Vusi “Cat” Matlala and Katiso “KT” Molefe.

Among those whose names have surfaced during the commission’s proceedings are Police Minister Senzo Mchunu, National Police Commissioner General Fannie Masemola, Deputy National Commissioner Lieutenant-General Shadrack Sibiya and Crime Intelligence head Major-General Feroz Khan, all of whom have been suspended. Economic Freedom Fighters (EFF) leader Julius Malema, businessman Brown Mogotsi and alleged crime kingpin Vusimuzi “Cat” Matlala, who remains in custody, have also been mentioned.

Several of those named have publicly denied wrongdoing, challenged either the interpretation or the authenticity of evidence presented to the commission, or argued that the material disclosed does not establish unlawful conduct. Malema went further in an affidavit filed with the commission on July 7. 

Responding to allegations arising from WhatsApp messages allegedly exchanged between Khan and tobacco businessman Mohammed Sayed, the EFF leader said he could not verify the authenticity of the message extracts presented to the commission. 

“I do not have knowledge of the exchanges between Mr Sayed and General Khan. I deny any influence… to the extent they infer any unlawful conduct on my part. To the best of my knowledge, I deny any Bertobrite bribery of the EFF,” Malema said in his affidavit.

The commission’s work is ongoing.  It has yet to reach its final findings, and it has made no adverse findings against any of the individuals named 

Yet beyond the political intrigue lies a much bigger story.

Smartphones have become central to modern corruption investigations, joining eyewitness testimony, financial records and traditional paper trails as critical sources of evidence. Every WhatsApp conversation, location ping, cloud backup and piece of metadata can help investigators reconstruct relationships that might once have remained hidden.

The Madlanga Commission, established by President Cyril Ramaphosa in 2025 following explosive allegations by Lieutenant-General Nhlanhla Mkhwanazi, KwaZulu-Natal Police Commissioner, that senior politicians and police leaders interfered in investigations into organised crime and political killings, has become South Africa’s clearest demonstration of a profound shift in modern policing. The smartphone has quietly become one of the country’s most powerful investigative tools.

That transformation is recognised not only by digital forensic experts, like Chad Thomas and Thama Jedidiah Mamphaga, a cybersecurity specialist.

Brigadier Athlenda Mathe, spokesperson for the South African Police Service (SAPS), said organised crime syndicates increasingly rely on digital platforms to communicate, transfer money and coordinate illicit activities, forcing investigators to evolve alongside them.

“Digital evidence has strengthened our ability to establish links between suspects, identify criminal networks and corroborate witness testimony, thereby enhancing the overall quality of investigations,” Mathe told TechCabal in a telephone interview on Thursday.

From conversations to evidence

For Chad Thomas, chief executive officer (CEO) of IRS Forensic Investigations, the significance of smartphones lies not only in the messages they contain but also in the wider digital ecosystem they create.

“Investigators have been able, through the subpoena process, to obtain records from various service providers that show geodata, metadata and, in some instances, if they have access to the devices, download all the related messages,” Thomas told TechCabal. “Cell phones come as a great convenience, but at the same time criminals have become very complacent.”

That complacency, he said, often leaves behind an extraordinarily rich trail of evidence. A seized phone can reveal far more than chat messages. Contact lists, photographs, shared locations, timestamps, cloud synchronisation, deleted content and call records can all help reconstruct an alleged criminal enterprise, provided the material is obtained lawfully.

Thomas emphasised that technology alone is never enough. 

“There has to be a chain of custody,” he said. “It has to show that the chain of evidence followed the letter of the law from the outset, or the presiding officer will chuck it out.”

That process may involve search warrants, Section 205 subpoenas under the Criminal Procedure Act, cybercrime warrants and, in exceptional circumstances, judicial authorisation under the Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA). The value of digital evidence depends as much on maintaining its legal integrity as it does on technology used to collect it.

Mathe said this has fundamentally changed the way police investigate organised crime. According to her, investigators now analyse cellphone records, emails, financial transactions, CCTV footage, geolocation data and social media activity alongside traditional evidence to uncover criminal networks and expose corruption.

WhatsApp is only one piece of the puzzle

Although headlines from the Madlanga Commission have often centred on leaked WhatsApp conversations, Thama Jedidiah Mamphaga, a cybersecurity specialist, said investigators do not build cases around chat messages alone. 

“Chat messages alone rarely win a case,” Mamphaga told TechCabal in a telephone interview on Thursday. “Investigators like to have the money trail, bank records, phone call logs, surveillance and witnesses all pointing in the same direction. WhatsApp messages are one piece of a bigger puzzle, not the whole picture.”

Instead, investigators look for patterns. “A conversation about a ‘delivery’ means little by itself,” she said. “But if it is immediately followed by financial transactions, location data placing suspects together and surveillance footage confirming a meeting, the digital footprint becomes significantly more compelling.”

“It’s not about one suspicious message,” said Mamphaga. “It’s about whether the conversation matches up with something that actually happened.” Mathe echoed that assessment, saying electronic communications are most valuable when corroborated by conventional investigative work. 

“It is important to note that digital evidence is most effective when supported by a broader body of evidence gathered through lawful investigative processes,” she said.

According to Mathe,  investigators combine digital evidence with documentary records, financial analysis and witness testimony to build cases capable of withstanding scrutiny in court.

The rise of the digital detective

Colonel Herby, a retired investigator with the Hawks, South Africa’s elite crime-fighting unit, has witnessed that evolution firsthand. 

“When I was working, you could subpoena the service providers and seize cell phones,” he told TechCabal in a telephone interview on Thursday. “What seems to have developed since then is the ability to recover information.”

The real revolution in policing, he said, is not simply recovering messages but in making sense of vast volumes of digital information. Investigators can now compare phone numbers recovered from seized devices against intelligence databases, revealing relationships that might otherwise remain invisible.

“They download your phone, and then they run those numbers through the database,” Heap explained. “That’s where you start making your links and your connections. The investigators seem to be able to join the dots much more easily than when I was working.”

That ability to map relationships, rather than merely read conversations, has become central to investigations into organised crime, corruption and abuses of state institutions.

Mathe said digital evidence has become indispensable because it helps investigators identify criminal networks and corroborate information gathered from other sources. 

“Rather than replacing traditional detective work, technology has strengthened it by allowing investigators to establish connections that would once have been almost impossible to detect,” she said.

Thomas said one of the biggest misconceptions about encrypted messaging platforms is that end-to-end encryption makes communications invisible to investigators. It does not.

“People need to realise that although there’s a large degree of privacy granted in terms of international and local legislation, it doesn’t cover criminality,” he stated. “If you are the focus of an investigation, the state has got power, and with its international partners it may be able to obtain the information it needs.”

According to Thomas, encryption protects messages while they travel between devices. Once investigators lawfully obtain a device, or gain access through other authorised legal processes, digital evidence may still be recoverable from the handset itself, associated cloud backups or other lawful sources.

South Africa’s Constitution, the Protection of Personal Information Act (POPIA), the Cybercrimes Act, and RICA provide legal safeguards that balance the right to privacy with the needs of legitimate criminal investigations. “Evidence obtained unlawfully risks exclusion from court proceedings,” said Thomas.

Following phones, not just money

The Madlanga Commission may ultimately be remembered not only for the senior political and police figures whose names have surfaced during its hearings, but also for demonstrating how digital evidence is reshaping investigations into organised crime.

Investigators are no longer following only the money. They are also ‘following’ smartphones. For SAPS, the lessons extend well beyond one commission. 

“Technology leaves a trail,” Mathe said. “Electronic communications and transactions can become important pieces of evidence.”

She said that the commission underscores the need for continued investment in digital forensic capabilities, specialist expertise and stronger cooperation between law enforcement agencies as criminals adopt increasingly sophisticated technologies.

Heap believes that the race between investigators and criminals is far from over. “Law enforcement and intelligence agencies always seem to be two steps behind the criminals,” he said. “It’s about time we started enhancing our technology to at least get close to them or be on a par with them.”

Thomas shares that view, arguing that while forensic technology has advanced dramatically over the past decade, investment in investigative capability must keep pace with sophisticated criminal syndicates.

The smartphones at the centre of the Madlanga Commission are no longer just communication devices. They have become digital archives, holding diaries, address books, maps, financial records and relationship networks capable of revealing how power, influence and alleged criminality intersect.

If the commission has exposed one defining reality about modern policing, it is this: in the digital age, organised crime rarely disappears without leaving a trail. And more often than not, that trail begins with the device in someone’s pocket.

True scale demands moving beyond surface-level integrations to robust execution. We’ve filtered the noise out of Moonshot 2026, optimising the conference strictly for high-calibre connections between startup founders, global financial operators, enterprise leaders and individuals rewiring Africa’s technical frameworks. Get 20% off Early Bird tickets for a limited time.