Witness J applied for an in-camera hearing citing safety and security concerns for himself and his family, the need to protect ongoing investigations, and to protect investigative methods.
“Witness J submitted to the Commission an application to be heard in complete camera, citing three reasons in the main. Safety and security concerns for himself and his family. The second is to protect investigative needs and ongoing investigation concerns. And the last is to protect investigative methods.”
The Chairperson ruled that Witness J's testimony will be heard in-camera and that transcripts will be redacted to protect Witness J's identity and ongoing investigations.
“The testimony of Witness J will be heard in-camera... The transcript must be redacted to protect the identity of Witness J and the integrity of ongoing investigations.”
Mr Nku's testimony was scheduled to be postponed to allow sufficient time for his evidence due to its expected length and other scheduling constraints including General Senona's testimony.
“The Evidence Leaders considered the scheduling as well as the fact that Mr Nku's evidence is likely to take more than one day... the Evidence Leaders deemed it fit to reschedule him to next week where sufficient time for his complete testimony can take place... the evidence of General Senona is scheduled to take place tomorrow, and that evidence cannot be moved.”
Mr Nku's evidence was postponed from last week to this week and then further postponed to next week due to scheduling and the potential length of his testimony.
“An application was agreed to by the parties to have Mr Nku's evidence postponed from last week to this week... the Evidence Leaders deemed it fit to reschedule him to next week... We have engaged with Mr Nku's legal representatives and are in the process of agreeing to the dates for next week.”
Witness J was appointed by the South African Police Service as a student constable and underwent basic training at Police College, was posted to perform crime prevention duties at SAPS and later moved to SAPS.
“I was appointed by the South African Police Service as a student Constable, and underwent my basic training in Police College. I was then posted to perform crime prevention duties at SAPS and later moved to SAPS.”
During August 2021, Lieutenant Colonel Sebola requested an analysis of cellphone data linked to suspects involved in a drug case related to the Booysens CAS investigation.
“During the month of August 2021, I was asked by Lieutenant Colonel Sebola, who was then a Captain, Captain Sebola, where he requested that I do an analysis on the data extracted from handsets to determine if the suspects are in any way linking to each other and to the crime that they were charged to be as per Booysens CAS.”
Three encrypted messaging applications - Threema, WhatsApp, and Telegram - were found on devices linked to the investigation and were used for communications related to the case.
“Encrypted messaging applications. I discovered the use of three encrypted messaging applications, Threema, WhatsApp, and Telegram...”
Cellphone devices analyzed belonged to Tumelo Nku and were linked via social media and contact numbers to shipment of containers associated with the drug case.
“It then discovered that the cellphone devices belong to Mr Tumelo Nku and this was confirmed by the information contained in the devices. While analysing the devices off Tumelo Nku, I then discovered images, messages from social media applications, and contact numbers linking him to the shipment of containers.”
Analysis revealed screenshots from Threema app indicating usage by a user identified with the username 'John Wick' linked to the investigation.
“the right-hand side, that screenshot that has a blue colour, it has a username that says John Wick. Under that username it says Threema ID next to the red dots there. It says, That is a username of that particular person, who is using the username of John Wick. I mean, that is an ID of John Wick.”
Screenshots of the Threema application on a device cover a period from May 5, 2021 to July 7, 2021, with no further screenshots saved after July 7, 2021.
“The first screenshot of the Threema application was saved on the device on 2021-05-05 at 13:09:42 seconds, and the last screenshot was saved on 21-07-07 at 11:25:52 seconds... After the 7th there is no other screenshot that was saved on the device from the Threema application”
Screenshots capture a chat between users identified as Alpha and another user, discussing urgency and pressure related to some operation involving containers.
“The above screenshot is a communication between two users, with one user Alpha mentions... 'When do we get this stuff' followed by the message 'I need to plan with people and the bosses are on my case'... The other user mentions 'Boss, this thing is going to kill us going to happen. I am telling you. This is a do or die for me and everyone there.'”
The chat messages reveal coordination about timing and arrangements for moving containers, with concerns over delays and security issues, and efforts to avoid inspections by Customs.
“Alpha: 'They give us the time and we arrange everything. The other truckers are already kicking their containers.'... The other user says: 'Boss, I know the guys are delaying, but it is not that they are failing. Inside everything is well sorted out. Just a small hurdle of final gate release... Alpha: 'Mate, I really do not understand this. Why are there security issues? They take in the containers for inspection. They are Customs. This is starting not to make sense to me.'... Messages suggest the user had people assisting with the release and did not want the container subjected for inspection, which suggests it contains something illegal.”
There was a coordinated communication about moving containers with a tight deadline and pressure to perform before the shift ends at 10 p.m., with concerns about 'heat' or pressure if not done that day.
“The client's transporter is booked for tomorrow. They will allow some containers to go out first. Their shift ends at 10 p.m. We have from now till then to perform. We acknowledge the type of heat that is coming if this is not done today.”
[p29 #1 UNATTRIBUTED]Day 121 · 18 Jun 2026Refers to: 2021-05-20Location: Port of Durban
There was pressure to obtain a container by a certain date, with people assisting at the Port of Durban to release the container and its contents, despite no recorded out movement at court at the time.
“This user makes mention of heat that is coming, which suggests that there was pressure to obtain what was in the container. And again, the conversations, it is clear that the user had people who are sitting at the Port of Durban who were assisting to get the container and these contents released. The container was due to be picked up upon the 2021-05-1, as per the message of the unidentified user mentioning transporter is booked for tomorrow.”
WITNESS JDay 121 · 18 Jun 2026Refers to: 2021-05-20 to 2021-05-21Location: Port of Durban
A conversation between 'Alpha' and Philipp Plein was identified from metadata on WhatsApp screenshots relating to the timing and messages exchanged around container transport details.
“Now we have identified that person as Philipp Plein now. So now we can confirm to say this conversation is between Alpha and Philipp Plein.”
It is disputed whether a user communicating with Alpha is Philipp Plein or another person forwarding messages, but timing and metadata strongly indicate Philipp Plein was directly involved in the communications.
“I disagree because if we look back to the first screenshots, ... this other unidentified user, we have not identified him as Philipp Plein yet... It appears to say that person was Philipp Plein.”
There was a WhatsApp communication between Alpha and Philipp Plein where Philipp Plein was identified to be the other party communicating with Alpha regarding container and seal pictures.
“Philipp Plein now, because already I have identified to say the other person is Philipp Plein ... Philipp Plein is answering now the point by Alpha ... Alpha : " I need that pics of container and seal so I can also take pressure off me . " Philipp Plein : " On it , boss "”
Alpha was under pressure and expressed nervousness about the delay in getting pictures of the container and seal, pressing Philipp Plein to open the container and take out the stuff urgently.
“Alpha : " Boss , I am getting really nervous now . How come your guys do not know this ? Please just go to container and open and take the stuff . I am telling you we are going to have big , big , big shit if we do not give this stuff today . We made a lot of promises and not delivered . "”
There is suspicion that container contents were successfully retrieved on 2021-05-21 based on message timestamps and absence of screenshots saved on subsequent days.
“I am of the suspicions that the contents were successfully retrieved on 2021-05-21 . There were never any screenshots saved on 2021-05-22 and 2021-05-23 . That is why I am saying I am of the suspicion to say those contents were retrieved on the 21st .”
Based on device movement, Philipp Plein aka Tumelo Nku was back in Gauteng from 2021-05-23 after the suspected retrieval of container contents in Durban.
“The movement of Tumelo Nku through these devices indicated that he was back in Gauteng from the 2021-5-23 .”
Tu m e l o N k u was once an employee of Transnet and may have connections to assist in opening containers at ports.
“Tu m e l o w a s o n c e a n e m p l o y e e o f Tr a n s n e t . H e m i g h t h a v e c o n n e c t i o n s , m a y b e t o g o i n s i d e t h e p o r t s a n d g e t a s s i s t a n c e t o o p e n t h e c o n t a i n e r”
Cell phone data from Vodacom shows that the cell phone number with MSISDA belongs to Tu m e l o N k u and that this phone was used on those phones shown by the IMEI numbers.
“S o t h a t w o u l d b e t h e c e l l p h o n e n u m b e r, t h e o n e t h a t s a y s M S I S D A , t h a t i s a c e l l p h o n e n u m b e r o f Tu m e l o . S o a b o v e t h e I M E I n u m b e r s , s o i t s h o w s t h a t t h a t p h o n e w a s – a c e l l p h o n e n u m b e r, s o r r y, w a s u s e d w a s u s e d o n t h o s e p h o n e s”
The cell phone username 'Philipp Plein' was used by Tu m e l o N k u as the screenshots were from his device. The number used by Tu m e l o N k u was saved in the Truecaller app as Philipp Plein.
“Philip p P l e i n i s t h e u s e r n a m e t h a t w a s u s e d b y Tu m e l o N k u , a s t h e s c r e e n s h o t s w e r e f r o m h i s d e v i c e . ... T h e n u m b e r w a s s e a r c h e d o n t h e Tr u e c a l l e r a p p l i c a t i o n , a n d i t s h o w s t h a t i t w a s s a v e d a s P h i l i p p P l e i n”
Analysis of phone data indicates that two phone numbers used by Tu m e l o N k u were located in the same vicinity at the same time.
“a n a l y s i s o f b o t h h i s c e l l p h o n e n u m b e r s i s p l a c i n g b o t h n u m b e r s i n t h e s a m e v i c i n i t y a t t h e s a m e t i m e”
Cell phone data analysis and WhatsApp chat showed that Tu m e l o N k u was in Bedford area on May 5, 2021 and that meetings were arranged possibly related to retrieving a balance owed to him.
“A n a l y s i s o f t h e c e l l p h o n e d a t a r e c o r d s i n d i c a t e t h a t Tu m e l o N k u w a s i n t h e v i c i n i t y o f B e d f o r d a r e a o n t h e 2 0 2 1 - 0 5 - 5 a r o u n d 8 a . m . ... H e m a d e a n a p p o i n t m e n t w i t h Tu m e l o a b o u t a n o t h e r r e s t a u r a n t A n d i c c i o . ... S o T u m e l o w e n t t o B e d f o r d t o c o l l e c t t h e b a l a n c e”
The profile and location data indicates it is confirmed that Tu m e l o N k u visited Bedford view to meet and collect a balance.
“I t i s c o n f i r m e d t o s a y t h i s i s t h e s a m e p e r s o n ... h i s a d d r e s s i s i n B e d f o r d v i e w... So Tu m e l o w e n t t o B e d f o r d ... to collect the balance”
Witness J explained how they profiled a phone number (starting with 27) used by a person linked to the South African Police Service (SAPS) system and Home Affairs population register.
“That is correct. The number starts with 27... it is a SAPS system... population register... information from Home Affairs”
Conversation on 1 July 2021 between Alpha, Philipp Plein, and Tumelo Nku indicated pressures and issues related to container shipments at Pier 1 and Pier 2.
“Alpha say: 'Please get back to me straight away' ... Philipp Plein says: 'Boss, can't they get Pier 2? We are going to have to pull another mission impossible.' ... Alpha says: 'Look here, the vessel is already set. Let us do last one, Pier 1. We do a mission impossible. I want good pressure. At least we now know the system now.'”
Alpha communicated with syndicates responsible for placing items inside containers, and Tumelo Nku facilitates the release of those containers to retrieve the goods.
“Alpha has communication with syndicates, which are responsible of placing stuff inside the containers. And Tumelo Nku is the one to facilitate the release of those containers in order to retrieve the stuff”
Messages reference coordination about vessels and container shipments to Pier 1, with instructions to avoid containers carrying metal or automobiles due to a recent bust a week earlier at Isipingo.
“Boss, please tell the people that avoid any containers with metal or anything automobile. Only load goods or sugar. Anything that goes to Pier 1 or 2 is workable. Remember there was a bust a week ago”
The last WhatsApp conversation on 1 July 2021 shows Alpha noting 'I only got to know now' and Philipp Plein expressing frustration about job difficulties, discussing container contents and specifying to avoid containers with metal or automobile goods due to recent busts.
“Alpha says: 'I only got to know now'... Philipp Plein says: 'Boss, these people are really making our job impossible by the day.' ... Boss, please tell the people that avoid any containers with metal or anything automobile. Only load goods or sugar.”
There was a successful extraction of data from May 24th referring to a container recovered in Aeroton.
“From page 15, if we checked the date, it is May. So it is May the 24th. So I suspect there was another container before this conversation of the 1st of April. And I will say this, this conversation talks about the container that was recovered in Aeroton.”
The conversation on the 1st relates to the container recovered in Aeroton, which was the last Threema conversation about that container.
“This conversation of the 1st. Yes. It relates to the container that was recovered in Aeroton. This is the last Threema conversation regarding the container in Piers, or Pier 1 or Pier 2. So this is the last one where they talk.”
There are images in Tumelo's gallery depicting the white truck cap where drugs were placed, though the drugs are not visually present in these images.
“There is pictures in Tumelo's gallery where you see the truck cap, the white truck cap, though there are no drugs there, but he has those images. So it shows to want to say this is where they are placing those drugs.”
Warrant Officer Phakula spoke to his Commander Colonel Sephungu who in turn spoke to General Khan, as confirmed through call records.
“Yes, indeed, he did speak to his Commander, Colonel Sephungu. Even Colonel Sephungu, we did check to say, okay, indeed, he did speak to General Khan.”
A dispute arose regarding call logs when a warrant officer (Phakula) used a state phone for calls, complicating retrieval of call data.
“The dispute was on his call because he used a state phone. By then I did not know that he was using a state phone. The dispute was regarding those calls.”
There were two WhatsApp chats on the site first page with initials E-by and I-by referring to different persons, with 'I-by' being Tumelo.
“There was two WhatsApp chats on the site on the first page. I think it is the first screenshot. It was written as E-b-y. But if you check the WhatsApp conversation of Tumelo and it is I-b-y. So this person who is calling I-by as E-by, it is another person, it is not Tumelo. But he knows Alpha.”
The WhatsApp chats included messages discussing a meeting with Mashaba and a person called Tumi, and the messages referred to 'General' as Samuel Mashaba.
“It says: 'Salams, boss. The lawyer sent me a message to ask if the meeting with Mashaba and the people happened. Did Tumi or Mashaba give you feedback?' ... It also confirms these individuals are the same and they addressed Samuel Mashaba as General.”
Messages saved as E-by (another person) were forwarded to Tumelo who saved them as I-by; these were not original Tumelo conversations but involved communications about Tumelo and Mashaba.
“It was somebody else talking about Tumelo and Mashaba. Hence, this person saved as E-by. Tumelo saved as I-by. These were screenshots but now on Tumelo's phone, they were forwarded by this person who took the screenshots.”
Samuel Mashaba was referred to as 'General' on an audio found on his device and in chats, although within the traffic department there is no rank called 'General', the equivalent is Chief Director; only SAPS has a general rank.
“M a s h a b a w a s r e f e r r e d t o a s G e n e r a l”
Chats show that Mashaba was referred to as 'General' only when talking to Tumelo Nku, which suggests a specific context for the use of that title.
“o n a l l t h e c h a t s t h a t I w e n t t h r o u g h o f Tu m e l o , t h e r e i s n o w a y h e m e n t i o n s G e n e r a l e x c e p t h i m t a l k i n g t o H e o n l y r e f e r s t o M a s h a b a a s G e n e r a l”
Mashaba used two phone numbers, one state phone and one personal phone, and was using names linked to 'Hawks' such as 'Doggie Hawks'.
“M a s h a b a w a s u s i n g t w o n u m b e r s . I b e l i e v e o n e w a s a s t a t e p h o n e . Th e o t h e r w a s h i s p e r s o n a l . H e i s s a v e d i s . . . M a s h a b a H a w k s .”
Chats suggest that Tumelo Nku was trying to avoid law enforcement stop-and-searches while transporting drugs and mentions K9 units which are dog units used for detecting drugs.
“Tu m e l o N k u s a y s ... W e g o t s t u c k a t , t h i s i s B e a u f o r t We s t , K 9 U n i t s i n t h e b l o c k s . ...Tu m e l o w a s a v o i d i n g t h e r o a d ... K 9 U n i t s a r e t h e d o g u n i t s ...”
Tumelo Nku financially supported Samuel Mashaba, which is atypical as normally informers receive money from law enforcement, not the other way around.
“I n t h i s c a s e , i t i s Tu m e l o N k u w h o i s f i n a n c i a l l y s u p p o r t i n g S a m u e l M a s h a b a , n o t t h e c o n v e n t i o n a l w a y w h e r e a n i n f o r m e r i s r e c e i v i n g m o n e y f r o m t h e l a w e n f o r c e m e n t .”
Samuel Mashaba used the phone number saved as 'Doggy Hawks' on Tumelo Nku's device, but Tumelo Nku saved the number, not Mashaba himself.
“I t i s n o t h i m w h o s a v e d h i m s e l f a s D o g g y H a w k s . I t i s Tu m e l o N k u w h o s a v e d h i m o r h i s n u m b e r a s D o g g y H a w k s .”
The Telegram messages were extracted by digital forensic investigation and explain the format of the messages between Tumelo Nku and Samuel Mashaba.
“The Telegram messages appear to have been typed out due to the formatting which they were extracted by the digital forensic... Here I was explaining why does it appear the way it appears. It is how it was extracted by the DFI.”
Tumelo Nku sent a message to Samuel Mashaba with directions and coordinates using a Telegram account, specifying location as Yellow Jersey.
“He sent Samuel Mashaba, now... Mashaba Hawks, a location through Telegram of where they should go and the coordinates are that of Yellow Jersey. So it was Tumelo Nku sending Mashaba those directions.”
There was a correction in the record that Samuel Mashaba received the message from Tumelo Nku at 00:25:19 on 21 July 2021, based on evidence from the Evidence Leader.
“The correct correction was that Mashaba received at that time 00:25:19... On 21-07-09, Samuel Mashaba received from Tumelo Nku a location through Telegram... because of the Evidence Leader... we need to correct that.”
It is asserted that Tumelo Nku is the person who sent directions via Telegram to Samuel Mashaba using his device.
“This Telegram message is from Tumelo Nku's device. So he is the one who sent those directions or the message to Mashaba at that time. That is why I am saying Tumelo Nku sent the message.”
There was a communication linkage between Tumelo Nku and a Yellow Jersey Logistics employee on 8 July 2021 when Tumelo Nku was in Durban.
“There was a communication linkage between Tumelo Nku and the Yellow Jersey Logistic employee on the 2021-7-08 while Tumelo Nku was in the vicinity of Durban.”
Calls were made from Tumelo Nku to the Yellow Jersey Logistics employee's cellphone and later to a landline belonging to Yellow Jersey Logistics, showing Tumelo Nku had the landline number to contact.
“The first three calls were made to the employee's cellphone number... Then later on, they changed to the land line... indicated that the land line number belonged to Yellow Jersey Logistics.”
A Section 205 Criminal Procedure Act authorization was obtained to get information from the cellphone records of an employee named Sandra.
“An application in terms of section 205 of the Criminal Procedure Act 51 of 1977 was authorised to obtain information from the cellphone records of the employee, Sandra.”
Phone records show that Tumelo Nku was making calls connected to a tower in KwaZulu-Natal (KZN) on 2021-07-09, confirming his location in KZN at that time.
“the tower where Tumelo was making a call . That is the tower that connected during his call . So he was in KZN”
Call records extracted from Tumelo Nku's phone match data from the cell provider, which cannot be tampered with during import to the analyst notebook program.
“Those call records , he cannot dispute them because even the cell provider is giving us the same information”
Analysis of the call data in an analyst notebook program confirms calls between Tumelo Nku and Sandra Engelbrecht of Yellow Jersey Logistics at specified times.
“The directon of the arrows indicates the person or subject who received the call . The blue arrows represents the calls received by Yellow Jersey ... Sandra Engelbrecht ... The first call was at 17:16:54 and the second call was at 17:18:19”
Images found on Tumelo Nku's phone included a computer screen with a Transnet logo matching a Yellow Jersey Logistics truck found at the crime scene in Aeroton.
“There were images discovered from Tumelo Nku's phone of a computer screen with a Transnet logo ... The details on the image were compared to the Yellow Jersey Logistics truck found on the crime scene at Aeroton”
The registration and company name of the Yellow Jersey Logistics truck found at Aeroton match those seen on the image found on Tumelo Nku's phone, confirming he had information about the truck and container.
“The registration and the company name is the same as it appears on the computer screen ... This confirms what was on Tumelo's phone”
Tumelo had the container number and registration of the truck carrying the drugs before the incident happened.
“So Tumelo had the registration of the truck, he had the serial number of the container that will be carrying the drugs . So he had those before the incident”
Photos on Tumelo Nku's official photo album from LCRC show he took photos close to the Yellow Jersey Logistics truck found at the crime scene, contradicting witness Magane's claim that Nku was 300 meters away from the truck.
“One of the witnesses, Magane, said Nku was never close to the truck . He was 300 metres away ... Looking at the photo on page 25 and 26, it suggests that he was very close to the truck when he was taking these photos ... the photos ... extracted from the photo album the official photo album from LCRC”
Tumelo Nku was taking pictures inside his vehicle including images of bags similar to those found in a bakkie on the day of the incident.
“this is Tumelo Nku sitting inside his vehicle taking a picture ... those pictures were taken from Tumelo Nku ... the bags on the back of the bakkie are the bags which were recovered on the day of the incident ... they are very similar in the way they are wrapped with the ones which were found on Tumelo Nku's gallery”
The pictures were saved on July 7, two days before the Aeroton incident on July 9, 2021, but it is uncertain when the photos were taken or if they relate directly to Aeroton event.
“these pictures were saved on the 7th ... which is two days before the Aeroton ... that is correct, Commissioner”
On 2021-07-09, Samuel Mashaba contacted Warrant Officer Phokungwana from Aeroton SAPS and received via WhatsApp the cellphone number of Warrant Officer Magane from Zonkizizwe SAPS.
“On 2021-07-09, which is the day of the incident, Samuel Mashaba called Warrant Officer Phokungwana from Aeroton SAPS, who then gave Samuel Mashaba via WhatsApp the cellphone number of Warrant Officer Magane of Zonkizizwe SAPS”
Samuel Mashaba, also known as 'Killer', was found to be linked to the phone number shared between Warrant Officer Phokungwana and others, indicating he used multiple numbers.
“That blue image, it is an extract from the phone itself ... Killer Owner, Killer is Samuel Mashaba ... Killer is Samuel Mashaba ... Yes, that is correct, Commissioner ... Killer is Samuel Mashaba”
Samuel Mashaba received the phone number of Joseph Marumo (saved as Marumos) from Warrant Officer Phokungwana on 2021-07-09 and could not have called before receiving it.
“So he received the number from Phokungwana ... he could not have phoned before he received the number ... So he received the number from Phokungwana”
Call records show that on 2021-07-09, Samuel Mashaba spoke to Warrant Officer Phokungwana for almost two minutes at 05:38, received Joseph Marumo's number at 05:41, then called Marumo and later Phokungwana again.
“at 05:38, that is when Samuel Mashaba spoke to Warrant Officer Phokungwana for almost two minutes ... then number was given to Samuel at 05:41 ... then Marumo, second call 07:12:30 ... then he phoned Warrant Officer Phokungwana”
Warrant Officer Phokungwana's call location data shows he was at Sunward Trinity Church and later at Windmill Park on 2021-07-09.
“The call data request is Warrant Officer Phokungwana ... to say Sunward Trinity Church, he was there ... later on the last call, he was at Windmill Park”
W I T N E S S JDay 121 · 18 Jun 2026Refers to: 2021-07-09Location: Sunward Trinity Church, Windmill Park
Samuel Mashaba sent a location to Marumo Joseph Magane at 6:40:53 seconds, and the location was that of Yellow Jersey Logistics, Roodekop as per Google map.
“Samuel Mashaba then sent a location to Marumo Joseph Magane with cell phone number at 6:40:53 seconds. The location was that of Yellow Jersey Logistics, Roodekop as per the Google map.”
During one statement, Marumo said he was at the parade at Zonkizizwe Police Station at 06:00, briefing the parade, confirming his presence there when he received a call from Mashaba at 06:24:31.
“During one of his statements, he says Marumo, he was at the parade at Zonkizizwe doing duty officers because he needed to brief the parade. The parade in the morning is at 06:00. So it confirms the time that he was in Zonkizizwe Police Station when he received this call.”
Extracted cell phone data from Joseph Marumo's phone was used to confirm communications among suspects including Mashaba, Magane, and Warrant Officer Phakula but excluding Tumelo because there was no communication between Tumelo and these individuals.
“This was extracted from Joseph Marumo's phone ... communication between Marumo, Mashaba and Rambos i.e. Warrant Officer Phakula ... even Warrant Officer Phakula and Warrant Officer Magane do not have any communication with Tumelo.”
Tumelo Nku was in KwaZulu-Natal from 2021-07-07 and left Gauteng the same day according to cell tower data on both his cell numbers.
“Tumelo was in the vicinity of KwaZulu-Natal from 2021-07-07 as he left Gauteng on the same day, according to cell phone towers active on both his cell phone numbers.”
The container referred to was still at the port in Durban on 2021-07-07 and was released and transported on 2021-07-08, the date Tumelo Nku traveled back to Gauteng from KwaZulu-Natal as confirmed by Transnet logos.
“The container was still at the port in Durban on 2021-07-07 and it was released and transported on 2021-07-08. We got this information from those pictures that had Transnet logos... It was released on the 8th, which is the date Tumelo Nku travelled back to Gauteng from KwaZulu-Natal.”
WITNESS JDay 121 · 18 Jun 2026Refers to: 2021-07-07 to 2021-07-08Location: Durban port
Cell phone data shows Tumelo Nku's movements on 2021-07-07 from Krugersdorp to Durban and on 2021-07-08 from Durban to Gauteng, indicating he was monitoring the container's movement.
“On map dated 2021-07-07 with yellow tower icons, it is when Tumelo Nku was moving from Gauteng to Durban. The icons start from Krugersdorp which is where Tumelo Nku is residing, and later was in the vicinity of Durban... 2021-7-08 is the date Tumelo Nku travelled back to Gauteng from KwaZulu-Natal. This indicates that Tumelo Nku was monitoring the container from KwaZulu-Natal to Gauteng.”
Tumelo Nku is a facilitator for containers used to conceal illegal drugs and is involved in drug trafficking with assistance from others.
“Tumelo is a facilitator for the containers that are used to conceal illegal drugs. He is involved in drug trafficking and has people who are assisting him to facilitate the trafficking”
Tumelo Nku is not an informer and was working with law enforcement contacts who assisted him with illegal activities, including retrieving illegal drugs from a truck.
“Tumelo Nku is not an informer as he alleges because if that was the case, the drug-seizing was supposed to be seized in Durban. Why would he risk travelling all the way to Durban and come back following the truck? Tumelo was working for and had contacts within law enforcement who were assisting him with illegal activities. Samuel Mashaba, the law enforcement officer within the Gauteng Traffic Department, had connections with other units that he used to assist Tumelo to achieve his objective, which was to retrieve illegal drugs from the truck.”
Tumelo Nku has immovable property registered under his mother's name and other immovable properties purchased with companies to conceal true source of income.
“Tumelo has an immovable property that is registered under his mother, immovable properties that he purchased using companies so to hide his true source of income.”
Tumelo Nku owns vehicles and properties not under his name but under companies and his mother's name, which are used by him.
“There is a property and vehicle that are used by Tumelo, but all those are not under his name. The property was purchased for R2900000. That property, you can see, he takes pictures inside that property, even outside. ... Even when Tumelo is sending the code to his visitors, that code, it will tell you to say address so-and-so, we are visiting Tumelo Nku. It does not say we are visiting Dina ... it says we are visiting Tumelo Nku with that address. So it can tell to say it is his property: On the registration of that property, he is using his mother's name and ID number, but the email, he is using his email address. So we can tell to say even communication, it needs to be directed to him, not his mother, because that property belongs to him. So even the vehicles, those vehicles are registered under companies, so not to Tumelo's name.”
Tumelo Nku operates as a businessman distributing Coca-Cola products alongside his drug trafficking activities.
“I will say, Commissioner, he is a business person, also doing drug trafficking, because he does have a company that is running now, distributing Coca-Cola products.”
Tumelo Nku is connected to the African National Congress (ANC) through funding of other organizations and branches that request donations.
“You can see that he is connected to the organisation, African National Congress, because most branches, they ask for donations. Others, they will say ... he is funding other organisations.”
Tumelo Nku owns at least five foreign bank cards registered in his name.
“We do have cards that are in Tumelo's name. All these bank cards are foreign bank cards, but they belong to Tumelo, because there is initial info ... Four or five, five, yes, five different banks.”
Digital evidence including WhatsApp and Telegram messages show consistent communication between Tumelo Nku and Samuel Mashaba regarding containers suspected to conceal illicit goods and logistics around transport and retrieval.
“The analysis of the extracted handset data, WhatsApp chats, Telegram messages, Three mac screenshot images, call data records and movement reports indicates a consistent pattern of communication and utility between Tumelo Nku, and Samuel Mashaba and other identified individuals ... The Three mac communications show repeated references to containers, vessels, Pier 1, Customs, seals, truckers, transporters, and stuff ... The communications further indicate that Tumelo Nku, using the alias Philipp Plein, was in direct communication with the user identified as Alpha ... The cell phone data records places Tumelo Nku in the vicinity of Durban and KwaZulu-Natal during relevant periods when the Three mac conversations concerning containers and port activities took place, including May 2021 and July 2021 ... The Telegram communications between Tumelo Nku and Samuel Mashaba, including the shared route to Yellow Jersey Logistics, together with call data records and images found on Tumelo Nku's device, establish a further linkage between the subjects, Yellow Jersey Logistics and the container later found at Aeroton crime scene ... The images recovered from Tumelo Nku's device, including images of bags wrapped in black tape and images reflecting container or transport information, further corroborate the communication and movement analysis relating to the container and its contents ... The call data records analysed in respect of Tumelo Nku, Yellow Jersey Logistics, Sandra Engelbrecht, Samuel Mashaba, Warrant Officer Phokungwana, and Marumo Joseph Magane show communication linkages before and on the day of the incident, including the sharing of locations and contact numbers relevant to Yellow Jersey Logistics and the movement of the container ... The WhatsApp and Telegram communications between Tumelo Nku and Samuel Mashaba establishes that there was an existing relationship between them prior to the incident and that their communication included... The totality of the digital evidence analysed indicates that Tumelo Nku played an active role in monitoring, facilitating, and communicating about the movement of containers from the port of Durban to Gauteng, and that it was linked to communication and movement data to other persons relevant to Booysen's CAS ... The digital evidence supports the existence of a coordinated network of individuals communicating across encrypted messaging applications and ordinary cellular platforms in relation to the movement of containers, transport arrangements, and the suspected retrieval of illicit goods.”
On the day of 9th, location data cannot confirm that the truck driver passed Yellow Jersey, raising questions about the track of the truck and its actual location.
“location on the day of the 9th , he cant tell you to say he went past Yellow Jersey ... Location of him ... Roodekop , so which was where Yellow Jersey is situated. Maybe he want to check the physical location of where the truck was”