Field notes

Joel Cedras, who founded Digifend, investigates the security of systems South Africans depend on, such as government websites, banks and mobile networks. He also looks into scams. His investigations are published by GroundUp, and each note below links to the full story.

  1. How Gauteng’s new panic app exposed your data

    The database behind the Gauteng government’s e-Panic emergency app was left unsecured. Crime reports, including reports of domestic violence and assault, could be read along with the names, phone numbers, locations and movement histories of the people who made them.

    Data breach

  2. Exposing a syndicate — by getting scammed

    Joel answered a fake job advert to “process orders” for Amazon. He was scammed out of almost R4,000, the bank and the police didn’t help, and he traced the scam back to a syndicate based in China.

    Fraud

  3. South Africans lose hundreds of millions of rands to Morita Forestry investment scam

    Morita Forestry promised daily returns from American woodlands. There were no woodlands: it was a pyramid scheme, spread through TikTok, WhatsApp and Facebook, and South Africans lost hundreds of millions of rands to it.

    Fraud

  4. The state says its computer systems are secure. We looked. They’re not

    SITA, the agency that runs much of the state’s IT, said its systems were secure. They had more than 5,000 security flaws. Government websites outside SITA’s network carried more than 4,400 more, and one in every five servers was vulnerable.

    Government systems

  5. New bank takes swift action after GroundUp alerts it to data breach

    A data breach at a new bank, eNL Mutual. To its credit, the bank took responsibility and plugged it quickly once it was alerted.

    Data breach

  6. SIM card provider dodges law

    uConnect was issuing free SIM cards online without verifying customers’ identity or address, as RICA requires.

    Identity checks

  7. This mobile provider is failing to implement RICA law

    eSIMs from me&you mobile could be activated within minutes using false RICA information. It began as a question from the SASSA investigation: where were the fraudsters getting their phone numbers?

    Identity checks

  8. We discovered massive fraud in SASSA’s grant system

    SASSA’s SRD grant portal would answer about 700 ID-number lookups a minute without complaint. 74,931 applications had been made for people born in February 2005, a month with 82,097 recorded births: strong evidence of organised fraud.

    Government systems

That’s the record so far.