The Hidden Hand Question Nobody Answered
• Andrea Johnson completed her final 3 days of testimony at the Madlanga Commission on 29 July 2026, with the evidence leaving the Commission to draw adverse inferences about her conduct.
• While media coverage focused on WhatsApp messages between Johnson and Crime Intelligence Major General Feroz Khan, the more significant evidence concerned 2 competing sets of witness statements and whether the founding document of IDAC’s prosecutions was backdated.
• Hours after President Ramaphosa accepted her resignation, NPA head Andy Mothibi provisionally withdrew IDAC’s corruption case against Crime Intelligence head Lieutenant General Dumisani Khumalo.
• Commissioner Sandile Khumalo asked who the hidden hand was behind IDAC’s investigations. Nobody answered him.
Every newsroom in South Africa led on the WhatsApp messages between former IDAC head Andrea Johnson and Crime Intelligence Major General Feroz Khan. They called each other gorgeous and dearest. Johnson told Khan she was bringing her family over for supper. Her husband Junaid, who works in Crime Intelligence, attended Khan’s 50th birthday party. Evidence leader Mahlape Sello told the Commission the messages contained private information and elected not to put them on the screen, reading from them instead.
Johnson, who had described the relationship in her sworn statement as professional, conceded on 29 July that she considered Khan a very good friend.
It is also the least significant thing that happened in her final 3 days on the stand.
Khan was IDAC’s witnessKhan was IDAC’s witness
IDAC investigator Brian Padayachee confirmed in his evidence that Khan was a witness for IDAC in 2 of its cases against Lieutenant General Dumisani Khumalo and his colleagues. IDAC investigators showed Khan the docket. Khan gave IDAC an affidavit commenting on whether Brigadier Dineo Mokwele was suitable for the post she was appointed to. Commissioner Khumalo told Johnson that IDAC’s charge sheet appeared to mirror Khan’s affidavit.
Khan himself faces allegations of tender rigging, corruption, abuse of power and the improper channelling of police information and resources to the cigarette company Carnilinx. He also channelled questions to EFF leader Julius Malema aimed at removing then Inspector General of Intelligence Setlhomamaru Dintwe, who had been investigating Khan’s business interests. Khan was shot shortly before he was due to take the stand at this Commission. He has not testified.
Johnson also arranged for Khan to enter the IDAC building through the VIP entrance on an undated occasion, bypassing reception sign-in. Khan had asked for her help because he suspected the Hawks were plotting against him. Johnson’s initial explanation was that IDAC often lets senior police officers use the side entrance. Sello told her Khan was not coming in his capacity as a VIP. Johnson conceded: “No, this was my friend.”
The 2 sets of statementsThe 2 sets of statements
The evidence that received far less coverage concerns 2 competing sets of supplementary statements from Fadiel Adams, the MP whose November 2024 referral started the IDAC investigation. Both sets are dated 6 January 2025. Both purport to come from a trip to Cape Town.
One set was taken by IDAC investigator Mansha Rapetsu in Cape Town, with prosecutor Drushantha Ramsamy and chief investigator Dylan Perumal present. The other set bears Perumal’s name alone, and each statement carries the impossible wording: done and signed at Pretoria, witnessed at Cape Town, on the same day. Sello called these the schizophrenic ones.
On 27 July, Sello played voice notes from Ramsamy and Rapetsu into the Commission’s record. Neither was in the room. Both are due to testify later.
Ramsamy said only 4 statements were taken in her presence, that Perumal commissioned nothing in front of her, that the 3 of them travelled in one vehicle, ate every meal together, and did not have the Pretoria stamp with them. Rapetsu said Adams’s signature looks like someone was trying to jigga it. He said he is not a handwriting expert.
The Perumal statement sits in the Mokwele docket, which means it was disclosed to the court and to the accused. Commissioner Khumalo said that amounts to serious misconduct. Commissioner Sesi Baloyi put it to Johnson that if those statements were manufactured it amounts to defeating the ends of justice, lying to the court, lying to Johnson herself, and undermining the entire prosecution. Johnson agreed to each proposition.
What the 2 sets actually sayWhat the 2 sets actually say
The difference between the 2 statement sets is not procedural. The Rapetsu statements refer to unspecified crimes and to high ranking police officials in general. The Perumal statements name Khumalo, Bheki Cele and Nozipho Madondo. They introduce the words fraud and corruption. Madondo’s security clearance, the basis on which IDAC sought to arrest her and Khumalo in June 2026, appears in the Perumal statement and nowhere else.
Every person IDAC went after who does not appear in the original referral arrives through a document that 2 of the 3 people in that room say was never taken.
Was the section 27 itself backdated?Was the section 27 itself backdated?
The Rapetsu statements also contain material that appears nowhere in the section 27 referral the Commission has been working from since November 2024: a forklift procurement contract and, critically, allegations that Secret Service funds were used to purchase resources for the Political Killings Task Team for the benefit of Bheki Cele.
Sello asked why 3 experienced officials would take a statement about the task team to supplement a referral that never mentions the task team. Johnson said it makes no sense.
Both Ramsamy and Rapetsu will testify that the section 27 they worked from that day did mention the task team. On 27 July, Commissioner Khumalo put the implication plainly: the section 27 the Commission is looking at was produced at a much later date and then backdated to 21 November 2024.
Sello asked Johnson whether they are dealing with a fraudulent section 27. Johnson, who authorised the investigation on the basis of that document, said she can no longer give a definitive answer about which affidavit she actually read in December 2024.
The hidden handThe hidden hand
On 28 July, Commissioner Khumalo put the question that 3 days of evidence had been building towards.
He said it looks like there was a hidden hand driving IDAC’s investigations into Crime Intelligence and the Political Killings Task Team. He asked who and what that hidden hand is. He asked whether it was political interference or infiltration of IDAC by unknown people, and said those are the questions the Commission must answer.
Johnson’s first response was that the best person to explain it would be the investigator who drew up the documents. Baloyi told her that she is the final decision maker, she is the one who authorised it, and she is the last person to speak to it.
By the end of the exchange, Johnson said she cannot shy away from the possibility that there was a hidden hand in how this played itself out.
The pattern the question sits onThe pattern the question sits on
The hidden hand question is not rhetorical. It rests on a series of established facts from those same 3 days.
A summons signed in April 2025 demanded performance assessments for every major general and every provincial and section head in Crime Intelligence, recordings of interviews, and records of why Lieutenant General Peter Jacobs refused to return to the division. None of it traces to Adams’s complaint. Item 6 of the same summons demanded the promotion files of every commander and member of the Political Killings Task Team. Johnson told the Commission IDAC was not investigating the task team.
Commissioner Khumalo then produced task team performance reports from IDAC’s own files, listing cases in court, withdrawn, finalised, suspects in custody and convictions. Baloyi told Johnson her denial was false when she gave it. Madlanga ordered a press scan. The Commission’s own communications head produced a summary of wall to wall coverage of the task team’s disbandment from 1 January 2025 through to April. Johnson accepted she reads the media. Madlanga said he found it hard to believe her.
An 11 May 2026 summons demanded the names, travel documents and approvals of every task team member who went to the Western Cape to arrest Adams. It was issued under the case number of the Mokwele matter, which was already enrolled in court. Johnson had never seen it. Baloyi called it an outright abuse of a power prescribed by law, used for ulterior purposes. The police complied. IDAC now holds the names of the officers who arrested Adams.
A Public Service Commission report of August 2023 found that Khumalo’s appointment as Head of Crime Intelligence was regular. It was in IDAC’s files. Johnson said it was irresponsible of IDAC not to bring it to her attention. The complaint that produced the report was lodged in December 2022 by Mary de Haas, who has been publicly critical of the task team.
The bail condition barring Khumalo and his colleagues from every Crime Intelligence office in the country, with Padayachee as sole conduit for fetching their belongings, was never requested by the prosecutor in open court. The High Court said so on appeal. IDAC then fought to preserve the condition. Padayachee filed an affidavit saying Madondo has the propensity to commit criminal offences. A general with no connection to the matter filed a supporting affidavit alleging Madondo has an ulterior motive. Johnson signed a letter to the National Commissioner repeating the condition, drafted by Perumal, without ever reading the actual court order.
IDAC investigator Suneel Bellochun, who leads the work on the Matlala matter, has a live warrant of arrest against his own name for assault. The Pretoria DPP directed in June 2021 that it be cancelled. It was never cancelled and was never circulated, so it does not appear on the police system. Bellochun previously gave IDAC an LCRC printout showing no illicit activity, on the strength of which IDAC gave the Ad Hoc Committee a clean report about him. Johnson said he continues to investigate and arrest people while under an active warrant.
On 13 July 2026, hours after Cat Matlala’s plea deal collapsed, Bellochun and 8 colleagues visited Sergeant Fannie Nkosi in prison without his attorney. They pressed him on a corrupt relationship between Matlala, General Masemola and General Khumalo. Nkosi said he knew of Matlala’s ties to Lieutenant General Sibiya and Major General Khan. Bellochun told him he had not asked about those 2. Baloyi said IDAC went looking for dirt on Masemola and Khumalo without foundation. Johnson agreed.
The Masemola collapseThe Masemola collapse
National Commissioner Fannie Masemola faces 4 charges arising from the R360 million Medicare24 contract. All 4 are Public Finance Management Act charges. Not one alleges corruption.
The SAPS internal audit signed its preliminary report on 29 April 2025, recommending termination and advising the accounting officer to take legal advice first. Masemola cancelled the contract on 15 May 2025. The full 284-page audit report only reached IDAC on 26 June 2026. He was charged in March 2026.
Madlanga walked Johnson through the Criminal Procedure Act provisions on separation of trials. She accepted Masemola should never have been joined with accused facing fraud and corruption, that he would suffer prejudice, and that the joinder reasoning she was given was ultimately wrong. Madlanga said at face value it appears this was done to embarrass him and to taint him.
Baloyi said the charge sheet reads like a scheme to get him arrested and presented to court, with the consequence that he is no longer in office. Johnson said it might have been clumsily or incompetently put, but denied ill intent.
The 2018 docketThe 2018 docket
On 29 July, retired Hawks Colonel Kobus Roelofse’s earlier evidence was put to Johnson in full. On 26 June 2018, Brigadier Leonora Phetlhe opened an assault and intimidation case against Feroz Khan. A journalist, Barry Bateman, sent Johnson material from that case.
On 4 July 2018 Khan handed his phone to a colonel in a boardroom and said Andrea was on the line. The caller asked for the colonel’s personal email address, said the contents of an email must be given to Khan, and told her to delete the email afterwards. The colonel did not delete it. She gave the contents to the Commission.
The email came from a Gmail address in Johnson’s name. Subject line: Phethle complaint. Inside were photographs of Phetlhe’s A1 statement, a J88 medical report of her alleged injuries, and an audio recording of Khan. Khan received this before he gave a warning statement as a suspect, at a point where no prosecution decision had been made. Roelofse said this amounted to defeating the ends of justice.
In 2022, then National Director Shamila Batohi told Johnson her conduct was under investigation. Roelofse testified that Johnson then contacted Bateman and alerted him to the investigation. That allegation runs against Johnson.
On 29 July, Johnson told the Commission this is not a decision I make lightly, nor do I make this decision to frustrate the commission. She said she elects not to answer questions on the matter so as not to incriminate herself. She accepted the evidence stands unchallenged.
Madlanga told her the evidence is strong enough that, if uncontested, it may lead the Commission to find she shared the docket. Johnson said she understood.
What this costsWhat this costs
Madlanga was careful throughout. He said more than once that the Commission is not suggesting those who were charged have no case to answer. The enquiry is into IDAC’s motives and mandate, not into guilt.
Johnson said it herself: if the disputed statement is false and the evidence derives from it, the investigation is tainted. She said the only rescue is independent evidence that stands on its own.
A weak founding document does not make a guilty person innocent. It makes them unconvictable. If IDAC was directed by a hidden hand, whoever directed it may have done more damage to these prosecutions than any defence advocate ever could.
Commissioner Khumalo asked who the hidden hand is. Dylan Perumal, the investigator best placed to answer, was in hospital for all 3 days and did not appear. He is expected to testify.
