The Mbalula File

The Man The Architecture Produced

There is a tendency in South African political writing to treat each scandal as a discrete event. The Gupta phone call of 2010. The Dubai holiday of 2016. The Russian meeting of 2024. Separate incidents, separate outlets, separate headlines, separate news cycles. What this treatment misses is that the same three-element architecture produced all of them. A principal who receives. An intermediary who routes. A funder who pays. The funders change. The other two positions do not.

Mbalula's first documented appearance inside this architecture is 2003. He was a rising African National Congress Youth League (ANCYL) figure in his early thirties, positioning for the presidency he would win at Nasrec the following year. The mining magnate Brett Kebble, according to sworn testimony from Kebble's butler Andrew Minnaar at the Johannesburg High Court in August 2010, purchased pay-as-you-go cellphones for Mbalula and for Lunga Ncwana. The phones, Minnaar testified, were used for "secret telephonic conversations." Kebble would coach league members on what to say and how to say it at rallies. Mbalula spent time at Kebble's Atholl mansion finishing bottles of Johnnie Walker Blue Label inside an hour.

This is not disputed. Mbalula himself told the Mail and Guardian in April 2011 that he had a "direct line" to Kebble and that he had spoken with Kebble by phone on the day Kebble was murdered. Kebble died on the night of 27 September 2005, shot six times in his Mercedes-Benz on the M1 in Abbotsford, Johannesburg. He was driving to Sello Rasethaba's house for dinner. Mbalula was the last person to speak to him before the call dropped.

What the Sale of Shares Document Shows

Two months before Kebble's death, on 28 July 2003, a Sale of Shares Agreement was signed between Randgold and Exploration Company Limited, Equitant Trading (Pty) Limited, and Phikoloso Mining (Pty) Limited. The Randgold signature was R B Kebble. The Equitant signature was L R Ncwana. The transaction issued 8.8 million new Randgold and Exploration ordinary shares worth approximately R268 million in return for a company (Viking Pony Properties 359) that Umbono Financial Advisory Services would later find held substantially fictitious assets. Umbono's conclusion, recorded in the 2006 Randgold and Exploration Securities and Exchange Commission (SEC) filing, was that the transaction was "a mechanism to provide liquidity and personal gain for some former directors and company officials." The same News24 reporting that documented the fraud named three African National Congress Youth League leaders as connected to the entities receiving the fraudulent shares: Lunga Ncwana, Songezo Mjongile, and Andile Nkuhlu.

This is the 2003–2005 architecture. A listed mining company. A fraudulent Black Economic Empowerment (BEE) consortium. An intermediary layer of African National Congress Youth League figures. A dedicated phone channel between the funder and the beneficiary. A last call on the night the funder is shot dead while driving to the other intermediary's house.

The Template Runs Forward

Between 2010 and 2018 the architecture reappears. Ajay Gupta phoned Mbalula in 2010 to confirm Mbalula's appointment as Sport Minister before President Jacob Zuma had announced it. Mbalula disclosed the call to eighty members of the African National Congress National Executive Committee (ANC NEC) in August 2011. Former State Security Agency (SSA) Foreign Branch head Mo Shaik testified at the Zondo Commission of Inquiry into State Capture that Mbalula's disclosure was the trigger for what would have been the one intelligence investigation capable of pre-empting the entire Gupta cascade. Then State Security Minister Siyabonga Cwele called the three SSA heads (Mzuvukile Maqetuka, Mo Shaik, Gibson Njenje) to Cape Town and instructed them to stop. All three were pushed out within two years.

In 2017, Sello Rasethaba's company Bubesi (Pty) Limited transferred R220,000 into Mbalula's Nedbank account on 29 September, followed by R80,000 on 11 October. The AfriForum Private Prosecutions Unit dossier of March 2026 documents this via the draft charge sheet. The same dossier records R300,000 deposited into Reimon Uniforms CC (a closed corporation not in the business of providing loans) on 24 February 2017, and R150,000 delivered in cash via Tsholofelo Lejaka (named in the AfriForum draft charge sheet as a courier) across two separate bank deposits. These payments sit inside what Mbalula has publicly described as a Dubai holiday loan from Sedgars Sport. The Public Protector found the holiday violated the Executive Ethics Act. The National Prosecuting Authority (NPA) declined to prosecute.

From 2018 forward the architecture acquires a foreign-state dimension. Internal documents from "The Company," a cover organisation for Russia's Foreign Intelligence Service (SVR), were leaked to the Forbidden Stories consortium in March 2026 across thirty international outlets. The 1,400 pages record that Agent 9477 (codename Sokolov) met Mbalula at the African Pride Hotel in Johannesburg on 23 December 2024. The documents record Mbalula requesting continuation of electoral assistance. The same files document $3,000 monthly payments to Mbalula's adviser Bo Mbindwane. A documentary film titled Legacy of Hope, credited to Mbindwane as co-producer, sits on YouTube. Mbindwane denies the meetings and denies the film exists.

The Pattern Only a Continuous File Can See

Read as four separate files, these are four unconnected scandals. Read as one file, they are four iterations of the same structure. Kebble 2003–2005. Gupta 2010–2018. Dubai 2016–2017. SVR 2018–present. The intermediary is Rasethaba or Rasethaba-adjacent at every iteration. The principal is Mbalula at every iteration. The funders change. The communication method modernises: from dedicated prepaid handsets in 2003, to cash intermediaries in 2017, to encrypted SVR channels in 2024. The SVR (Sluzhba Vneshney Razvedki, Russian Foreign Intelligence) is the post-Soviet successor to the KGB. Sworn detainee testimony and academic research confirm the ANC security apparatus operated from the 1970s as a KGB surrogate, with Soviet-trained officers running its intelligence structure. The 2024 handler network documented by Forbidden Stories is not an anomaly. It is the latest iteration of an institutional alignment that has been structurally continuous for fifty years. The underlying transaction (political access in return for protected payment) does not.

This is what the file below documents. Not one allegation. A template.

Why the Dedicated Phone Matters

The significance of the dedicated cellphone arrangement Kebble set up for Mbalula in 2003 is not sentimental. It is structural. A pay-as-you-go handset provided by the funder, used exclusively for communication between the funder and the beneficiary, creates a call record that exists only on the funder's infrastructure. The beneficiary's official phone shows nothing. When Kebble died on 27 September 2005, the handset he had purchased disappeared with the man who controlled it. The communication history was gone before any investigation could read it. This is the operational logic of a channel designed to leave no recoverable trace in the principal's name.

What makes the Minnaar testimony at the Johannesburg High Court in August 2010 so significant is precisely that it came from the only person with physical access to both sides of the arrangement. Minnaar had no political motive. He was testifying in a murder trial about a completely different matter, and the phone detail emerged as background observation. Courts assign considerable weight to incidental corroborating testimony of this kind, because the witness has no reason to fabricate the peripheral detail.

The Cwele Cape Town Meeting

Of all the documented institutional decisions that allowed the architecture around Mbalula to persist, the Cape Town meeting of 2010 carries the most historical weight. Siyabonga Cwele, then State Security Minister, summoned the three most senior State Security Agency (SSA) officials and told them to stop their investigation into the Gupta family. The investigation had begun because of Mbalula's own National Executive Committee (NEC) disclosure. Mo Shaik testified at the Zondo Commission that the Cape Town meeting was "the only time in my tenure that I was called upon by a minister to explain an operation." He described Cwele's conduct as "inappropriate" and went further: he said he would "go so far as to call it illegal." All three officials were pushed out within two years.

Independent Media's Ownership Arithmetic

Sekunjalo Investment Holdings (Iqbal Surve) holds 55 percent of Independent Media through Sekunjalo Independent Media (SIM). The Public Investment Corporation (PIC) holds 25 percent. Chinese state entities hold 20 percent through Interacom Investment Holdings, co-owned by China International Television Corporation (CITVC) and the China Africa Development Fund (CADFund). CITVC is a wholly owned subsidiary of China Central Television (CCTV), which operates under the Publicity Department of the Chinese Communist Party (CPC). Surve himself contributed R150 million of the R2 billion acquisition price: 7.5 percent of the purchase price for 55 percent of editorial control. There is no independent capital in Independent Media.

The Bozwana Shadow

Two gag orders. One murder. The silence that did not adjudicate.

Wandile Bozwana was 43 years old when he was killed on the N1 highway near the Garsfontein off-ramp on 2 October 2015. He was hit by nine bullets while his car was stationary at a traffic light. His business associate Betty Mpho Baloyi, driving the car, survived. The hit team arrived in a silver BMW M3, opened fire, and disappeared. Bozwana died in hospital that day.

He was a North West businessman who had built his fortune on government tenders, served as ANC provincial treasurer, and turned against the Premier League faction in his last years. Four months before his murder, he successfully blocked the then-MEC for Human Settlements Collen Maine from distributing R470 million in tenders without proper CIDB grading. He had attached R30 million from the North West provincial bank account and 44 government vehicles in a separate dispute over the Brits Hospital construction contract. The Constitutional Court upheld his right to retain the seized funds three weeks before his death. His estate was valued in excess of R303 million. His mother, Nopopi Aletta Bozwana, aged 76, was murdered in her Mothibistad home on 22 August 2023.

The hit team was convicted in June 2022. Vusi "Khekhe" Mathibela, a Mamelodi taxi boss, Sipho Patrick Hudla, Matamela Robert Mutapa, and Bonginkosi Paul Khumalo received 30-year sentences each.

The Affidavit Admission

The Emperor's Palace Meeting

The Global Initiative Against Transnational Organized Crime (GI-TOC) documented a detail that contextualises the entire Bozwana file. Two days before the assassination, Bozwana, Mbalula (then Minister of Police), and Vusi Mathibela (the man subsequently convicted of organising the hit) met together at Emperor's Palace, a casino complex near Johannesburg's OR Tambo International Airport. The man who would be murdered, the minister responsible for investigating the murder, and the man who arranged the murder were together at the same table forty-eight hours before the hit was carried out.

At Bozwana's funeral on 10 October 2015, Mbalula spoke publicly. His words, reported by News24 and IOL: "He was a generous man. He was one person I would abuse financially. And sometimes for political reasons." Mbalula has separately admitted to being friends with both Bozwana and with his convicted killer Mathibela. The GI-TOC bulletin further documented that Bozwana allegedly lent Mbalula a substantial sum to attend the Floyd Mayweather vs Manny Pacquiao boxing match in Las Vegas in May 2015, five months before the murder.

A fifth accused, KwaZulu-Natal taxi boss Senzo Mncube, identified as the triggerman through CCTV footage from Sandton City, was arrested in 2021 after evading police for more than five years. His trial continued through 2024 in the Pretoria High Court.

What the affidavit also placed on the public record was the formal documentation of a fifteen-year close association between the senior administrative officer of the ANC and one of the most aggressive tender-economy litigants in the country. Bozwana was inside the Premier League factional environment that produced the tender disputes the Madlanga Commission, the SIU, the Public Protector, and multiple forensic auditors have spent a decade trying to map.

Two Gag Orders by Default

In August 2025, Mbalula obtained a gag order against social commentator Anele Mda. Her X posts referenced the North West court win, the Free State tender allegations involving Nozuko Mbalula, and what Mbalula was doing in Sandton on the day of the hit. Mda appealed and lost. She issued a public apology in November 2025.

In November 2025, Judge Jacobus Strydom granted Mbalula's second gag order, this time against Mogotsi. Mogotsi had alleged on SABC and Newzroom Afrika that Mbalula was seen in Sandton with Mathibela days before the murder, and that the two had travelled overseas together. Mogotsi did not appear to defend the proceedings.

Both orders were granted by default. Default judgment establishes that a statement was published and is presumed defamatory in the absence of a defence. It does not establish that the underlying assertion is false. The legal mechanism produces silence. It does not produce factual exoneration.

In November 2025, between the two gag orders, Mogotsi's vehicle was struck by 11 bullets in Vosloorus. He survived. In February 2026, testifying before the Parliamentary Ad Hoc Committee, Mogotsi admitted he had killed a man during a physical altercation, with charges later withdrawn.

The KGB Inheritance

The SVR meeting was not an anomaly. It was a continuity.

The Forbidden Stories investigation that documented Mbalula's December 2024 contact with a Russian Foreign Intelligence Service operative was treated by commentary as a recent and exceptional development. The structural record suggests otherwise. Russian intelligence relationships with the ANC senior administrative core are not new and they are not occasional. They are the operational expression of an institutional architecture that has been continuous since the 1970s.

The Camp Quatro documents record former ANC detainees describing the security apparatus operating during the exile years as functioning as "an extension in Africa of the KGB." Umkhonto we Sizwe (MK) is described in the same record as having served "primarily as a surrogate to Soviet foreign policy interests" in Angola. The senior security officials of MK were KGB-trained. The institutional templates governing internal discipline, informer networks, and intelligence assessment were imported wholesale from Moscow.

None of this is exotic or speculative. It is in declassified records, in the published memoirs of MK officers, and in the academic record on the Cold War in southern Africa. What has not been done is the connection of that historical architecture to the contemporary operational record. The Forbidden Stories file documents an SVR officer meeting the Secretary General of the ANC in late 2024. The meeting was not arranged through a back channel constructed from scratch. It was held inside an institutional relationship that has been continuous for fifty years.

The post-1994 intelligence services inherited the personnel, the doctrine, and the international relationships of the exile-era ANC security apparatus. The State Security Agency, formed by merging NIA and SASS in 2009, retained the operational assumptions of the inherited structure. Mbalula did not arrive at the SVR meeting as an outsider establishing first contact. He arrived as the senior administrative officer of an institution whose intelligence-architectural DNA was Soviet from the day it was constructed.