Wednesday’s terror alert by the US Embassy on a possible attack in Sandton, Johannesburg, has blown a six-week antiterrorism operation. South African law-enforcement operatives were just weeks away from arresting at least nine Islamic State operatives.
TimesLIVE Investigations can reveal that the cell that was being tracked included South Africans and foreigners from across Africa, with links to Uganda, Nigeria, Somalia and Kenya.
A Hawks Crimes Against the State (Cats) official, speaking on condition of anonymity, described the situation as “a total f**k-up”.
“There is no other way it can be put. We were so close to these guys. We had identified seven definite targets [suspects] and were waiting for credible information on the identities of another two,” he said..
“We were literally waiting for the guys with the explosives. The guys who would have arranged the explosives would have taken the suspects to at least 13. We were gathering information on the operation’s financiers, we had identified their local religious leaders, who were involved in the recruitment of the cell’s members.
“We had already identified and were monitoring safe houses and vehicles the suspects were using. Our plan was to catch them in the act of building bombs, just before they could launch their attacks. We had been following the seven for more than a month.
“We did not want another Thulsie twins situation, where you only catch the guys for planning, but have no hard evidence of guns and explosives which can be used to prove they had intent and were going to commit terror acts.”
Our plan was to catch them in the actual act of building bombs, just before they could launch their attacks
— Hawks Crimes Against the State official
Brandon-Lee and Tony-Lee Thulsie were released from prison in August for planning to carry out terror attacks on US and Jewish targets in South Africa. They were caught communicating their plans with undercover FBI agents, but were never caught with weapons or explosives.
They were sentenced to five years’ imprisonment each for attempting to leave South Africa to join Isis in Syria. Brandon-Lee was sentenced to another three years’ imprisonment for possession of a document linked to terrorist activities, while Tony-Lee was sentenced to a further six years’ imprisonment for conspiring with a known terrorist.
Cats is a unit within the Hawks, which — with the SAPS and State Security Agency (SSA) —investigates terrorism, including the planning and carrying out of operations on foreign targets from SA.
Asked about the operation and the US alert botching it, SSA spokesperson Mava Scott said: “Please note that the law precludes us from discussing operational matters. We are not in a position to comment on this.”
The US embassy, in the communique published on its website, said: “The US government has received information that terrorists may be planning to conduct an attack targeting large gatherings of people at an unspecified location in the greater Sandton area of Johannesburg, South Africa, on October 29 2022.
“There is no further information regarding the timing, method or target of the potential attack. The US Embassy has advised staff to avoid crowds of people and other large public gatherings in the greater Sandton area during the weekend of October 29-30 2022.”
The US consulate is based in Sandton and on Saturday the Johannesburg Pride carnival would have taken place close to the building.
Within hours of the alert, the UK, Australia and EU-linked organisations issued travel advisories to their citizens and staff.
The US and UK also issued terror threat alerts for their embassies and high commissions in Abuja, Nigeria, days before the South African alert.
TimesLIVE Investigations understands from independent sources within Cats that a high-level meeting was held on Wednesday evening between US and South African security officials and the department of international relations and co-operation (Dirco) to discuss the threat alert.
At the time of publishing, Dirco had not responded to questions. TimesLIVE will update this story once further information is received.
An SSA source, indicating South African intelligence operatives' disappointment at the alert being published without consultation, said: “SA is still demanding evidence of the threat. We are demanding to know why the evidence was not shared. There has, in the past, been a really good working relationship between SA and the US and our other joint allies, especially on the sanctioning of known terror suspects. This time there was zilch.
This was not about sending a message to the US — it was a warning to SA and the government
— Gauteng Cat source
“They would not provide the information on the evidence, either because there is none or they have been instructed not to. It leaves South Africa in an awkward position because if there is an attack the world is going to ask why we did nothing to stop it and why our anti-terror capabilities are so lacking.
“This plays into the greylisting of SA because of our lax anti-terror-funding laws, which has the world’s financial sector worried.”
The two separate sources within the Hawks national and Gauteng Cats units said investigators had people close to the cell providing information on “credible attacks” being planned in South Africa.
“We are not talking about imaginary horror Hollywood tales. We are talking about real-life attacks we were receiving credible information on. Our information was not based on corridor gossip,” said the Gauteng source.
“The information our unit and informants had gathered showed that not one of the attacks was going to be against US targets. This was not about sending a message to the US — it was a warning to SA and the government.
“It would have all been SA targets and it is our citizens who would have been killed, hurt and maimed. It was not just attack sites in Gauteng, but also potential sites in KwaZulu-Natal and Cape Town. We were trying to identify and zero in on what the targets would be.”
He said it was still a mystery what the US was warning about.
“They give detail about dates, but then the alert leaves you hanging. If you have dates and information that it is your citizens who will be attacked, then you likely have good information on the exact location of attack. You do not just issue a broad statement that it is Sandton. Do they realise how vast Sandton is?
“If you read the note properly it states US citizens are targets. What we have gleaned though, is that they don’t care about any other nationality, including South Africans. If they did they would have come to us to help us catch these guys before disaster unfolds.
“What this alert has done now is plunge us into the dark. The people we identified have gone to ground. They have left the safe houses, destroyed phones, abandoned vehicles and disappeared. It’s a badly lost opportunity. We must now start from scratch and hope there is [online] chatter somewhere about where they could be.”
He said national and Gauteng Hawks officers met US security officials throughout Wednesday. “But they left with the feeling that the US thinks we are incapable of handling these types of things. Instead of creating broad panic, they should have joined forces and we could all have announced that these terror suspects were caught red-handed.”
A South African government security cluster source described the alert as “troublesome”.
If you look back at the major terror attacks in Africa, it was not the local intelligence guys that picked it up, but the foreign services. Just look at the Westgate attack
— A South African government security cluster source
“These guys [Cats] have IS people under surveillance. These included at least two Johannesburg-based religious leaders, who are foreigners, who have been involved in recruitment, who are known for their radical agendas.”
On explosives allegedly being sourced by the cell, he said they would not have been brought into the country.
“[They] would have been sourced locally due to availability.”
He said warnings by foreign missions were frowned upon as they exposed potential failings in local anti-terror operations.
“If you look back at the major terror attacks in Africa, it was not the local intelligence guys who picked it up, but the foreign services. Just look at the Westgate attack,” he said, referencing the shopping mall attack in Kenya in 2013 in which 71 people died.
He said from information this country’s security services had obtained recently, the US had been ordering the withdrawal of all non-essential personnel from the consulate.
“It is an indication that they take this threat seriously. These guys will not just issue a warning like that if they do not have credible information.
“There is also a Gay Pride event that will be in front of their consulate on Saturday. We need to look closer at this one and maybe act [as if it’s a bomb threat that’s credible].”
Minister in the presidency Mondli Gungubele, whose office oversees state security and which reports directly to President Cyril Ramaphosa after the intelligence ministry was scrapped last August, downplayed the threats.
Speaking to SABC News on Wednesday, he said: “I have checked this with my security unit and I will be saying up front we are a bit disturbed. This alarm has been going on, but up to this point it is not backed up by any evidence.
“Our teams have been following the matter for them to give evidence and they have not been able to do that.”
Would you like to comment on this article?
Sign up (it's quick and free) or sign in now.
Please read our Comment Policy before commenting.