Malema answered 2 allegations and folded the other 4 into a single line: what the Khan WhatsApp chats put on record
WhatsApp evidence at the Madlanga Commission links Major General Feroz Khan to an alleged plot to remove the Inspector General of Intelligence, routed through Carnilinx executive Mohamed Sayed to Julius Malema. The chats also show Khan handing over the name and home address of the complainant in a VBS case implicating Malema. In a sworn affidavit, Malema denied 2 of the 6 allegations put to him and answered the remaining 4 with a single line about having no knowledge of the Khan and Sayed exchanges.
The Madlanga Commission of Inquiry spent 7 July working through the WhatsApp messages of Major General Feroz Khan, the crime intelligence officer who is in hospital after being shot days before he was due to testify. With Khan unable to appear, chief evidence leader advocate Matthew Chaskalson read the chats into the record. What emerged was a set of exchanges that tie Khan, through an intermediary, to the leader of the EFF.
The story starts in June 2021 with Setlhomamaru Dintwe, who was then the Inspector General of Intelligence. Dintwe’s office oversees crime intelligence, which means it oversaw Khan. On 11 June 2021 Khan drafted a set of parliamentary questions about Dintwe’s alleged relationship with Timmy Marimuthu, a man convicted of drug dealing in 1992. Khan did not submit those questions himself. He sent them to Mohamed Sayed, the chief operating officer of cigarette manufacturer and EFF benefactor Carnilinx.
In the chats, Sayed indicated the questions were going to Malema. Reworked versions came back the next day, and Sayed told Khan they came from Malema. Within a week those questions appeared on an EFF letterhead addressed to the Minister of Police, word for word the version sent back to Khan, including a spelling correction Khan had flagged.
Khan’s own words removed any doubt about the purpose. In a message about the questions, Khan said: “This should get him to lie and in return we can ask for his removal.” Commission investigator Tshepo Nyatlo argued in court papers that the questions were designed to trap Dintwe into a dishonest answer to Parliament so that his removal could then be demanded. Chaskalson made the same point on 7 July, adding that a genuine concern about Dintwe would have gone through official channels rather than through an intermediary to a political party.
4 days into that operation, on 15 June 2021, Sayed forwarded Khan a Sandton case number and indicated the request came from Malema. Khan pulled the case up on the internal SAPS database and sent back the complainant’s name. He then sent the complainant’s home address as well, which had not been asked for. The complainant was the curator overseeing VBS Mutual Bank, and the case related to the VBS scandal in which the bank’s former chair stated in a plea affidavit that he paid millions of rand to Malema and Floyd Shivambu in the guise of EFF donations. Chaskalson said Malema was not entitled to the complainant’s identity and that Khan was not entitled to provide it, still less the address.
The timing is what the evidence leaders kept returning to. Chaskalson suggested the exchanges carry the appearance of a quid pro quo, a characterisation that remains his argument rather than a finding. Neither Khan nor Malema has testified on any of this.
A second thread runs through Khan’s disciplinary trouble. On 30 July 2021 Khan received a disciplinary notice for allegedly exceeding his delegated authority. He forwarded it to Sayed, who asked whether he could send it to Malema. Khan initially said no. 2 days later the story of his disciplinary trouble appeared in the Afrikaans press, and the day after that Khan sent Sayed a photo of Malema and Sayed at a dinner table. By 26 August Sayed had sent Khan Malema’s direct contact details. On 5 September Sayed sent a voice note relaying that Malema had called and that Khan’s things were coming along very nicely. On 22 September Sayed relayed a message that Khan would never have to resign, that this was a fight, and that they would emerge victorious.
In between, on 3 August, Sayed sent Khan the details of a company called Bertobrite, which had bid for a SAPS fleet management tender, saying the request came from Malema and adding that he thought Malema wanted them to do it. By that stage Bertobrite had already been named in media reports alleging it secured a City of Tshwane fuel tender by paying bribes to the EFF.
Malema was served with a Rule 3 notice listing 6 ways the evidence may implicate him, and he responded in a sworn affidavit. His answer to the substantive allegations runs to 4 short paragraphs. He denies conspiring to orchestrate Dintwe’s removal. He denies, to the best of his knowledge, any Bertobrite bribery of the EFF. He explains that as a Member of Parliament he regularly receives information from various sources, including police officials, and points out that KwaZulu-Natal police commissioner Nhlanhla Mkhwanazi shared details of the AKA murder investigation with him.
The remaining allegations, the VBS complainant’s details, the disciplinary notice, the voice note and the message of support, are covered by one line. Malema states that he has no knowledge of the exchanges between Sayed and Khan and denies any inference of unlawful conduct on his part. He does not confirm, deny or explain any of those specific events. A blanket denial is a legally careful position, but it does not engage the evidence, and it leaves 4 of the 6 allegations without a direct answer.
There are genuine limits to what the chats prove. Every request attributed to Malema arrives through Sayed, and no direct message between Malema and Khan appears anywhere in the record. Dintwe has also confirmed to News24 that he did meet Marimuthu once, with Khan present, over harassment complaints from Marimuthu’s family, and says there was nothing corrupt about a public servant taking a meeting.
What sharpens the picture is history. Dintwe previously investigated 2 anonymous complaints against Khan, one over a R300 000 additional income from his motor spares company and one over a property Khan rented to crime intelligence as a safe house. Khan was largely cleared, partly because he had declared the extra income, though Dintwe found the rental payments significantly higher than normal and reported it to the head of crime intelligence. 2 years later, Khan was drafting questions built around the one meeting on record, aimed at the man who had investigated him.
The pattern also casts an older decision in a new light. Ian Cameron, chairperson of the Portfolio Committee on Police, says that when he called for accountability over Khan in 2024 he received a lawyer’s letter demanding a retraction rather than answers, over concerns that included questionable procurement, the Secret Service Account, alleged smear campaigns and allegations of defeating the ends of justice. Cameron has suggested the resistance to calling Khan before Parliament’s ad hoc committee may now make more sense, though that connection is his inference and not a commission finding.
Proving a pattern is not the same as proving a crime. What the commission has put on record is a timeline in which confidential police information, disciplinary support and tender interest consistently line up with requests attributed to Malema, all travelling through the same intermediary. That timeline now sits in evidence, and 4 of the 6 questions it raises remain unanswered.
