When investigators at the Madlanga Commission, a South African judicial anti-corruption inquiry, projected WhatsApp conversations extracted from seized mobile phones onto courtroom screens, they were doing more than reading private messages. They were trying to reconstruct alleged criminal networks.

Each message, timestamp, contact list and call log became another strand in what investigators describe as a wide-ranging web linking senior police officers, politicians, businesspeople and alleged underworld figures Vusi “Cat” Matlala and Katiso “KT” Molefe.

Among the people whose names have surfaced during the commission’s proceedings are Police Minister Senzo Mchunu, National Police Commissioner General Fannie Masemola, Deputy National Commissioner Lieutenant-General Shadrack Sibiya and Crime Intelligence head Major-General Feroz Khan, all of whom have been suspended. Economic Freedom Fighters (EFF) leader Julius Malema, businessman Brown Mogotsi and alleged crime kingpin Vusimuzi “Cat” Matlala, who remains in custody, have also been mentioned.

Several of those named have publicly denied wrongdoing, disputed the interpretation or authenticity of evidence presented to the commission, or argued that the material disclosed does not prove unlawful conduct. Malema went further in an affidavit filed with the commission on July 7.

Responding to allegations arising from WhatsApp messages allegedly exchanged between Khan and tobacco businessman Mohammed Sayed, the EFF leader said he could not verify the authenticity of the message extracts presented to the commission.

“I do not have knowledge of the exchanges between Mr Sayed and General Khan. I deny any influence… to the extent they infer any unlawful conduct on my part. To the best of my knowledge, I deny any Bertobrite bribery of the EFF,” Malema said in his affidavit.

The commission’s work is continuing. It has not reached final findings and has made no adverse findings against any of the individuals named.

Beyond the political controversy, the proceedings highlight a broader shift in criminal investigations. Smartphones have become central to modern corruption probes, joining eyewitness testimony, financial records and traditional paper trails as critical sources of evidence. WhatsApp conversations, location pings, cloud backups and metadata can help investigators reconstruct relationships that may previously have remained hidden.

The Madlanga Commission was established by President Cyril Ramaphosa in 2025 after allegations by Lieutenant-General Nhlanhla Mkhwanazi, KwaZulu-Natal Police Commissioner, that senior politicians and police leaders had interfered in investigations into organised crime and political killings. It has become one of South Africa’s clearest examples of a major change in modern policing: the smartphone has become one of the country’s most powerful investigative tools.

That shift is recognised not only by digital forensic experts such as Chad Thomas and cybersecurity specialist Thama Jedidiah Mamphaga. Brigadier Athlenda Mathe, spokesperson for the South African Police Service (SAPS), said organised crime syndicates increasingly use digital platforms to communicate, transfer money and coordinate illicit activities, requiring investigators to evolve with them.

“Digital evidence has strengthened our ability to establish links between suspects, identify criminal networks and corroborate witness testimony, thereby enhancing the overall quality of investigations,” Mathe told TechCabal in a telephone interview on Thursday.

For commissions of inquiry and criminal investigators alike, the growing reliance on phones also raises the evidentiary stakes. Digital records can be detailed and time-stamped, but their usefulness depends on how they are collected, authenticated and matched with other evidence.

From conversations to evidence

For Chad Thomas, chief executive officer (CEO) of IRS Forensic Investigations, the importance of smartphones lies not only in the messages they contain but also in the wider digital ecosystem they create.

“Investigators have been able, through the subpoena process, to obtain records from various service providers that show geodata, metadata and, in some instances, if they have access to the devices, download all the related messages,” Thomas told TechCabal. “Cell phones come as a great convenience, but at the same time criminals have become very complacent.”

That complacency, he said, can leave behind an unusually rich evidence trail. A seized phone can reveal far more than chat messages. Contact lists, photographs, shared locations, timestamps, cloud synchronisation, deleted content and call records can all help reconstruct an alleged criminal enterprise, provided the material is obtained lawfully.

Thomas said technology on its own is never sufficient.

“There has to be a chain of custody,” he said. “It has to show that the chain of evidence followed the letter of the law from the outset, or the presiding officer will chuck it out.”

That process may involve search warrants, Section 205 subpoenas under the Criminal Procedure Act, cybercrime warrants and, in exceptional circumstances, judicial authorisation under the Regulation of Interception of Communications and Provision of Communication-related Information Act (RICA). The value of digital evidence depends on preserving its legal integrity as much as on the technology used to collect it.

Mathe said this has fundamentally changed the way police investigate organised crime. According to her, investigators now analyse cellphone records, emails, financial transactions, CCTV footage, geolocation data and social media activity alongside traditional evidence to uncover criminal networks and expose corruption.

WhatsApp is only one part of the case

Although headlines from the Madlanga Commission have often focused on leaked WhatsApp conversations, Mamphaga said investigators do not build cases around chat messages alone.

“Chat messages alone rarely win a case,” Mamphaga told TechCabal in a telephone interview on Thursday. “Investigators like to have the money trail, bank records, phone call logs, surveillance and witnesses all pointing in the same direction. WhatsApp messages are one piece of a bigger puzzle, not the whole picture.”

Instead, investigators search for patterns. “A conversation about a ‘delivery’ means little by itself,” she said. “But if it is immediately followed by financial transactions, location data placing suspects together and surveillance footage confirming a meeting, the digital footprint becomes significantly more compelling.”

“It’s not about one suspicious message,” Mamphaga said. “It’s about whether the conversation matches up with something that actually happened.”

Mathe echoed that view, saying electronic communications are most valuable when they are corroborated by conventional investigative work.

“It is important to note that digital evidence is most effective when supported by a broader body of evidence gathered through lawful investigative processes,” she said.

According to Mathe, investigators combine digital evidence with documentary records, financial analysis and witness testimony to build cases capable of withstanding scrutiny in court.

The rise of the digital detective

Colonel Herby, a retired investigator with the Hawks, South Africa’s elite crime-fighting unit, said he has seen that evolution firsthand.

“When I was working, you could subpoena the service providers and seize cell phones,” he told TechCabal in a telephone interview on Thursday. “What seems to have developed since then is the ability to recover information.”

The major change in policing, he said, is not simply the recovery of messages but the ability to make sense of large volumes of digital information. Investigators can now compare phone numbers recovered from seized devices against intelligence databases, revealing relationships that might otherwise remain invisible.

“They download your phone, and then they run those numbers through the database,” Heap explained. “That’s where you start making your links and your connections. The investigators seem to be able to join the dots much more easily than when I was working.”

The ability to map relationships, rather than simply read conversations, has become central to investigations into organised crime, corruption and abuses of state institutions. In complex cases involving multiple suspects, companies and intermediaries, link analysis can help investigators test whether apparent connections are coincidental or supported by independent records.

Mathe said digital evidence has become indispensable because it helps investigators identify criminal networks and corroborate information obtained from other sources.

“Rather than replacing traditional detective work, technology has strengthened it by allowing investigators to establish connections that would once have been almost impossible to detect,” she said.

Thomas said one of the biggest misconceptions about encrypted messaging platforms is that end-to-end encryption makes communications invisible to investigators. It does not, he said.

“People need to realise that although there’s a large degree of privacy granted in terms of international and local legislation, it doesn’t cover criminality,” he stated. “If you are the focus of an investigation, the state has got power, and with its international partners it may be able to obtain the information it needs.”

According to Thomas, encryption protects messages while they travel between devices. Once investigators lawfully obtain a device, or gain access through other authorised legal processes, digital evidence may still be recoverable from the handset itself, associated cloud backups or other lawful sources.

South Africa’s Constitution, the Protection of Personal Information Act (POPIA), the Cybercrimes Act and RICA provide legal safeguards that balance the right to privacy with the requirements of legitimate criminal investigations. “Evidence obtained unlawfully risks exclusion from court proceedings,” Thomas said.

Following phones, not just money

The Madlanga Commission may ultimately be remembered not only for the senior political and police figures whose names have surfaced during its hearings, but also for showing how digital evidence is changing investigations into organised crime.

Investigators are no longer following only the money. They are also following smartphones. For SAPS, the lessons extend beyond one commission.

“Technology leaves a trail,” Mathe said. “Electronic communications and transactions can become important pieces of evidence.”

She said the commission highlights the need for continued investment in digital forensic capabilities, specialist expertise and stronger cooperation between law enforcement agencies as criminals adopt increasingly sophisticated technologies.

Heap said the race between investigators and criminals is far from over. “Law enforcement and intelligence agencies always seem to be two steps behind the criminals,” he said. “It’s about time we started enhancing our technology to at least get close to them or be on a par with them.”

Thomas also said forensic technology has advanced significantly over the past decade, but investment in investigative capability must keep pace with sophisticated criminal syndicates.

The smartphones at the centre of the Madlanga Commission are no longer merely communication devices. They have become digital archives holding diaries, address books, maps, financial records and relationship networks that can reveal how power, influence and alleged criminality intersect.

If the commission has exposed one defining reality about modern policing, it is that in the digital age, organised crime rarely disappears without leaving a trail. More often than not, that trail begins with the device in someone’s pocket.