Speaking before the Ad Hoc Committee in Parliament last Tuesday KwaZulu-Natal Police Commissioner Nhlanhla Mkhwanazi called for “state security” to conduct a: “thorough counterintelligence investigation on the role of the media in this country.”

The following day, he repeated the call and said that certain journalists needed to be held to account for their wrongdoing, with “prison” the ideal place for some of them.

Although Mkhwanazi acknowledged that News24: “has got very credible journalists who are doing a wonderful job” investigating cases of corruption and murder: “we have these ones, who then are used to publish the wrong information, the disinformation.”

In response the South African National Editors’ Forum described Mkhwanazi’s remarks as: “a chilling attack on the Constitutional rights to a free press,” while Nicole Fritz of the Campaign for Free Expression described them as: “particularly sinister.”

Though Mkhwanazi’s remarks were obviously untenable, it is still worth taking some time to assess the substance of his complaint.

In the first half of this year there were a series of stories targeting Crime Intelligence boss Dumisani Khumalo. This began with the News24 report in mid-January 2025 that a Crime Intelligence front company had bought a “boutique hotel” in Pretoria North for R22.7 million. The article contained numerous identifying photographs of the property concerned.

Then in June, News24 reported that Major General Philani Lushaba, Crime Intelligence’s Chief Financial Officer, surrendered to face charges relating to a burglary he reported in 2022 where his official laptop, cellphone, and firearm were taken. In reporting this arrest to the police, he had allegedly lied to cover-up the embarrassing fact that the items had actually been filched by a prostitute. The publication noted that the National Prosecuting Authority’s Investigating Directorate Against Corruption (IDAC) was driving this investigation.

Extensive coverage

This coverage culminated in News24’s extensive coverage of the arrest of Khumalo by IDAC on his arrival at OR Tambo Airport upon arrival from Cape Town. Khumalo and several others were charged for appointing a 29-year-old, who had previously worked as an IT cybersecurity specialist for BMW South Africa as a police Brigadier on a R1 million salary.

Up until 6 July of this year an average reader would have been led to believe that Khumalo was engaged in serious misconduct at crime intelligence, and IDAC’s corruption busters were diligently cleaning up the organisation.

On that day Mkhwanazi held his bombshell press conference where he started laying out a counter-narrative. He alleged, first of all, that the Police Minister Senzo Mchunu’s order to disestablish the KwaZulu-Natal Political Killings Task Team (PKTT) was triggered by the secondment of ten members of the PKTT to join a Gauteng counter-intelligence team charged with pursuing the powerful criminal-political-police network trying to obstruct the investigations into the hit squad responsible for the murder of Armand Swart and many others. The person in charge of assembling that team was Dumisani Khumalo.

Mkhwanazi has gone on to allege that the leaks against Khumalo, the subsequent IDAC investigation, and his public arrest, were driven by similar ulterior motives.

These leaks have continued. Mkhwanazi complained that only last week News24 reported that the Inspector General of Intelligence, Imtiaz Patel, had recommended in April that charges be brought against National Police Commissioner Fannie Masemola, Khumalo, and Lushaba over various property purchases, including the Pretoria North “boutique hotel.” The article quoted a: “senior intelligence source” on the matter and noted that only: “three copies” of the report exist, one of which News24 obtained.

Lives at risk

Before the Parliamentary Ad Hoc committee Mkhwanazi stated that the publication of photographs of the safe house where the Gauteng team members had been staying had put their lives at risk. The public arrest of Khumalo over a personnel matter was moreover excessive and intended to maximise the harm done to his reputation. In addition, the Inspector General’s report was a classified document not meant to land up in the hands of journalists, but somehow it did.

An obvious point is that the leaks driving these stories all originated from within the state intelligence apparatus itself. State security should be required to get its own house in order, not be given a green light to go after the media, a power they would certainly abuse. Mkhwanazi’s criticism is thus misdirected and his solution wholly counterproductive.

Those individuals and organisations accused of wrongdoing by Mkhwanazi have also not presented their side to the Ad Hoc or Madlanga commissions, and his allegations as to their motives remain untested. It is thus highly premature to judge the merits of his claims at such an early stage of the process and before all the evidence is presented.

It is nonetheless useful to make some general observations about a perennial problem facing the South African media. Much “investigative journalism” relies on leaks of highly sensitive information, usually collected by others. This can come from whistleblowers seeking to expose wrongdoing or from those with less pure motives, such as those trying to damage a rival’s reputation. Both types of leaks pose relatively little reputational risk for the publication running stories based on them.

A third type of leak is one where damaging information is provided against a target because these individuals or institutions are seen as an obstacle or a threat to serious mafia-like interests and activity. The resultant media reporting is then used as a justification for the removal or suspension of the individual, or even closure of the institution.

Manufactured

The manufactured controversy over the Browse Mole Report, which provided a pretext for closing the Scorpions and removing Vusi Pikoli as National Director of Public Prosecutions, is but one example of a practice spanning decades. More recent examples of this third type of leak include the South African Revenue Service “Rogue Unit”, “Cato Manor death squad,” and “Zimbabwe renditions” reports. Initially hailed as exemplars of “investigative journalism” these exposes later caused huge reputational damage to the Sunday Times when the sinister purposes behind the leaks were revealed, years after the fact.

How can a publication avoid getting “played” in this way? One red flag is when the wrongdoing relates to relatively minor infringements of the law and fairly trivial offences in the South African scheme of things. Another is when the activity suddenly being aggressively probed by state organs was previously widely condoned. This was the real “tell” that something was off about the Browse Mole and SARS “Rogue Unit” scandals.

When evaluating leaked information, especially from spooky sources, a publication needs to look in two directions. Not just, does the information about the target check out? But from whom does this information originate – given it may well have been provided by cut outs – and what is the real motive for these leaks?

Dutifully adhering to basic journalistic principles, making sure the facts check out, eliciting comment from those accused, and so on, are all necessary but insufficient. Editors and reporters further need a high degree of situational awareness to safely navigate these most treacherous of waters.