Minister in the Presideny, Khumbudzo Ntshavheni: State Security Agency 2026/27 Budget Vote

Address by Minister in The Presidency, Ms. Khumbudzo Ntshavheni (MP), State Security 2026/27 Budget Vote

Honourable House Chairperson 
Chairperson of the Joint Standing Committee on Intelligence, the Honourable Sylvia Izaks
Members of the Joint Standing Committee on Intelligence
The Acting Director General of the SSA, Ambassador Tony (Gab) Msimanga.
The Acting Coordinator of the National Intelligence Coordinating Committee (NICOC) Dr Ntandazo Sifolo.
Top Management Committee of the SSA
Honourable Members,

The rapidly changing global landscape is not only reshaping the international order but fundamentally challenging longstanding arrangements on security, economic stability, and the role of the state itself. We are living in an era where threats evolve faster, risks spread wider, and certainty grows thinner. Heightened geopolitical tensions, technological disruptions, cyber threats and transnational nature of organised crime continue to define the security environment confronting nations.

Under these conditions, the responsibility placed on the intelligence community has never been greater. The intelligence community is called upon not to merely gather information but to convert information into strategic insight, not to merely anticipate events but to interrupt them, For intelligence without foresight is like a radar without range, that remains operational in form, but unable to detect the dangers approaching the nation. These demands institutions that are agile in thought, focused in conduct, and decisive in action. Institutions that can protect the Republic while remaining firmly grounded in the Constitution and democratic accountability.

Honourable Members,

For State Security Agency to fulfill this responsibility of securing the Republic, we must: Modernise our systems
Strengthen the capacity to anticipate and respond to emerging threats.
Build the skills and capabilities required for a changing security environment.
And above all, we must decisively act to secure the Republic.

ORGANISED CRIME

Our most immediate frontier to secure the Republic is through a focused, non-negotiable and decisive fight against organised crime. Organised crime in South Africa has escalated into a multi-dimensional and deeply entrenched threat that undermines the country’s national security, economic stability, democratic governance, and social cohesion. We are witnessing structured and highly coordinated criminal networks that operate systematically for profit through illegal activities. These networks range from local gangs to transnational syndicates and often exploit weaknesses in border management, socio-economic conditions, corruption and state capture risks, international criminal connections, technological systems, and limited law-enforcement & coordination capacity in some areas.

During the 2025/26 financial year, the State Security Agency (SSA) completed a comprehensive intelligence-led Anti-Organised Crime Strategy to focus its operational plans. This strategy prioritises critical pillars such as as criminal networks, cartels and syndicate profiling, mapping & monitoring, enhanced disruption and enforcement capabilities including through multi-agency collaboration & cooperation, increased partnerships with critical role players, building our technological capabilities, as well as improving the technical ability of our members to stay ahead of evolving criminal tactics.

In the 2026/27 financial year, the SSA will spare no effort in translating the goals of our Anti-Organised Crime strategy into tangible results. Accordingly, we commit to a strengthened, intelligence-led approach that prioritises the identification of priority syndicates, and the coordinated deployment of multidisciplinary capabilities to disrupt and dismantle criminal networks.

DECONTAMINATING THE CRIMINAL JUSTICE SYSTEM AND DEALING WITH CORRUPTION AND MALFEASANCE IN GOVERNMENT

The fight against organised crime in South Africa and across the globe is always undermined by the contamination of the criminal justice system. Since 2021, the National Intelligence Estimates raised the need to decontaminate the criminal justice, however compromised elements within the system have always made it impossible to implement this National Intelligence Priority. I must take this moment to appreciate the decision by HE President Cyril Ramaphosa to appoint the Madlanga Commission that is bring to the public the extent of the contamination of the criminal justice system and thus making it slightly difficult for compromised elements to continue to operate.

On our part, the SSA has commenced to implement the State of the Nation Address directive to re-vet members of senior management service of the SAPS and vet members of the Metro Police departments and metro municipalities. This work coincided with our own project of implementing the e-Vetting system and reviewing the Vetting Regulations. The e-vetting system will make it possible for the SSA to undertake large scale vetting projects. Currently, the User acceptance testing (UAT) on phase 1 of the eVetting system has commenced and will be deployed for SAPS and EMPD vetting in 1st Quarter of 2026/2027 financial year. A total of 39 000 files out of 56 000 dating back from 2018 have been digitized to date. The reviewed Vetting Regulations are undergoing consultations with a plan to have them finalised by end of September 2026. Two of the critical new provisions of this Regulations are worth mentioning, (a) the provision to refer criminal suspicions to law enforcement for investigations as part of the outcomes of the vetting process, (b) the provision for continuous lifestyle audit for public sector personnel in strategic positions.

VIOLENT SOCIETAL CONFLICTS AND INTELLIGENCE MEASURE TO PREVENT THE SCOURGE OF ILLEGAL MIGRATION

Honourable members,

A stable and cohesive society is the bedrock of national security. Violent societal conflicts, pose a direct threat to social cohesion, economic stability, and South Africa’s international standing. These tensions, when left unchecked, manifest in sporadic outbreaks of violence, community clashes, and heightened polarisation that undermine the very foundations of our constitutional democracy. Such conflicts not only endanger lives and destroy livelihoods but also damage investor confidence and disrupt local economies. We are starting to observe the intersection of violent societal conflicts with organised crime and influence of foreign actors.

Of recent, South Africa is experiencing a rise in anti-illegal immigration linked protests that are exploitating the genuine concerns of South Africans about the spiralling illegal immigration programme and these genuine concerns are opportunistically being used by criminal elements, populist agitators, and external actors seeking to destabilise our nation.

In the 2025/26 financial year, the State Security Agency strengthened its focus on early detection and mitigation of these threats. The SSA will continue to monitor underlying drivers of violent societal conflict, including economic inequality, service delivery failures, unemployment, and inflammatory rhetoric and provides timely strategic and operational intelligence to relevant government departments and law enforcement agencies to address the challenges.

As the lead agency for national security, the SSA remains committed to safeguarding social cohesion without compromising the rights and freedoms enshrined in our Constitution. Our assessment is that  South Africans are not xenophobic, hence we uphold the constitutional principles that “National Security must reflect the resolve of South African, as individuals and as a nation, to live as equals, to live in peace and harmony, to be free from fear and want and to seek a better life”.

Honourable members,

The intelligence services recognise that illegal migration, when exploited by organised criminal syndicates, constitutes not merely a domestic border-management challenge, but a broader transnational security concern requiring coordinated regional and international intelligence cooperation.  In this regard, the Republic remains guided by the provisions of the United Nations Convention and Protocols, within which South African intelligence services are increasingly engaging foreign intelligence and security counterparts on the need for a coordinated continental and regional security response directed not against lawful migration itself, but against organised criminal facilitation networks that exploit vulnerable populations, porous borders, corruption vulnerabilities and weak governance environments for financial and operational gain.

South Africa continues to advocate for enhanced intelligence-sharing mechanisms among regional and continental partners regarding organised migrant smuggling syndicates, trafficking networks, fraudulent documentation systems, illicit financial flows and transnational criminal facilitators operating across multiple jurisdictions. The Republic further supports the strengthening of cooperative early-warning systems capable of identifying emerging migration-security risks, criminal transit corridors and evolving patterns of cross-border organised criminal activity.

South Africa also continues to encourage greater cooperation within the African Union and the Southern African Development Community frameworks regarding harmonised border-security standards, intelligence fusion mechanisms and coordinated counter-organised crime strategies aligned with the obligations contemplated under the Palermo Convention.

In fulfilment of South Africa’s international obligations and national security responsibilities, intelligence cooperation with foreign counterparts will therefore remain focused on strengthening regional stability, protecting territorial integrity, combating organised criminal exploitation and promoting coordinated African solutions to transnational organised crime and irregular migration challenges

COUNTER TERRORISM (CT)  

Modern terrorism increasingly operates through decentralised networks, digital platforms, illicit financial flows and transnational facilitation systems. This means that counterterrorism today is not only about preventing attacks, but also about protecting the integrity of financial systems, strengthening institutional coordination, and disrupting the financial infrastructure that enables extremist activity

In the last year, South Africa has shown great progress in strengthening its resilience and response to countering of violent extremism and terrorism. The State Security Agency (SSA) and other Law Enforcement Agencies have placed specific focus on disrupting and countering Terrorist Financing (TF) and improving institutional coordination. This included better inter-agency and inter-department collaboration, an increased use of financial intelligence in investigations and an increase in the detection of terrorism and terrorist financing related activities in line with the countries Risk profile.

Noteworthy advancements have been made in this regard, such as  finalising the comprehensive Terrorism Financing National Risk Assessment (NRA); compiling a National Countering the Financing of Terrorism Strategy (NCFTS); developing and implementing a Targeted Financial Sanctions Operational Framework (TFSOF) regime; improving access to Beneficial Ownership Information (BOI); and strengthening the capability and capacity of law enforcement and other role-players in order to effectively detect, investigate and prosecute TF offences. 

NATIONAL CYBERSECURITY STRATEGY

Today, every aspect of our lives relies on digital systems, which are increasingly vulnerable to malicious actors. Consequently, nations globally have made cybersecurity as a top priority, and South Africa is no different. As South Africa’s digital economy rapidly transforms and expands, it increases vulnerabilities and provides more entry points for increasingly sophisticated cybercriminals, hackers, and state-sponsored actors. 

During our budget vote debate last year, we communicated that we are finalising consultations on the draft National Cybersecurity Strategy. Considering the feedback from the consultative sessions and the growing number of cyberattacks affecting multiple sectors and causing significant disruptions, it is imperative to develop a comprehensive strategy that transcends traditional defensive measures and focuses on resilience.

To achieve digital resilience, we are prioritising cyber resilience, the ability to anticipate, withstand, respond to, and recover from cybersecurity incidents. A significant amount of work has already been completed, and the revised National Cybersecurity Strategy should be adopted in the next quarter.

THE NCIC AS THE STRATEGIC NERVE CENTRE

Intelligence coordination is central pillar to intelligence success. In the 2024/ 25 financial year, we finalised and brought into implementation, the Regulations for Intelligence Coordination and that effort strengthened the effectiveness of nation intelligence structures. This term, we finalised the establishment of the National Centre for Intelligence Coordination, (NCIC). Since the dawn of democracy there has been just the Office of the National Coordinator for Intelligence and the National Intelligence Coordinating Committee (NICOC) without the structure to support the work. In this regard, we have sought to implement the recommendations of the 2006 Task Team on the Review of Intelligence-Related Legislation, Regulation and Policies. The Task Team had recommended that there be a distinction between the Office of the Coordinator, the NICOC principals and the staff supporting the work of intelligence coordination. As such we established and launched the National Centre for Intelligence Coordination.  

This body represents the final piece of the puzzle in our quest for a unified national security picture and strategic reforms. The NCIC serves as the daily integration hub where NICOC (the Committee ie. Heads of SAPS-CI, DI, SAI and SAIS) regularly meets to synthesize raw data into actionable wisdom for the Executive and execution. It is through the full functioning of the NCIC that we are finally breaking down the silos that once allowed organized crime and sabotage to flourish in the gaps between departments. This centre ensures that our response to national threats is no longer reactive but is instead guided by a single, coherent narrative of the risks facing our nation.

As we meet today, we are delighted to indicate that the 2026 National Intelligence Estimates are awaiting the National Security Council (NSC) approval. This work of the NCIC and NICOC is pivotal in focusing the attention of our national intelligence structures to key intelligence priorities that ought to be addressed in a financial year.

TECHNOLOGICAL ENABLEMENT

In today’s rapidly evolving digital landscape, communications have fundamentally transformed. Criminal networks, organised-crime syndicates, and national security threats actors increasingly operate across encrypted platforms, data-driven applications, and borderless digital environments. These actors continue to exploit advanced technologies to operate with greater sophistication and anonymity.

Traditional methods of investigation, lawful interception and surveillance are therefore no longer sufficient on their own. As a country, we must ensure that our capabilities evolve at the same pace as the threats confronting us.

The operations of the OIC and the NCC are currently constrained by aging infrastructure, challenges relating to reliability, maintenance, scalability, and increasing technological obsolescence amid rapid advancements in telecommunications.

It is therefore imperative that the OIC and NC prioritise the modernisation and strengthening of its interception and surveillance capabilities to ensure that law enforcement agencies are equipped with lawful, reliable, and effective tools to fulfil their constitutional mandates. This modernisation will enhance system stability, minimise downtime, and establish a sustainable technical environment capable of meeting future operational demands. Furthermore, investment in sovereign interception technologies is critical to ensure that sensitive data remains protected, managed within national jurisdiction and aligned with applicable legal and regulatory frameworks. Financial resources have been appropriately ring-fenced to enable the OIC to respond rapidly to technological changes introduced by Electronic Communications Service Providers (ECSPs). Given the dynamic nature of the telecommunications environment, OIC systems must remain agile, adaptive, and continuously modernised.

Cloud computing is no longer optional, it is essential. The volume, velocity, and variety of data associated with modern communications require scalable, flexible, and resilient infrastructure. Investment must therefore prioritise robust cybersecurity and data protection measures to ensure that sensitive information remains secure. Priority will therefore be given to investment in state-of-the-art technologies capable of supporting operations complemented by advanced data analytics capabilities to proactively identify and respond to emerging threats.

MODERNISING FOR RESILIENT INTELLIGENCE SERVICE

During the previous Budget Vote, we reflected extensively on the transformation currently underway within the State Security Agency and reaffirmed the commitment of the Agency’s leadership to implement the recommendations of the High-Level Review Panel as part of a broader programme of renewal and repositioning. That commitment remains and progress firmly underway.
A key priority over the medium term is the implementation of human resource strategies and policies that improve the organisational framework and strengthen alignment between skills and functional requirements across the organisation. This will ensure that skills are aligned to roles in a manner that supports effective delivery of the Agency’s mandate. 
The process is guided by the developed business model, capability models, operational models, and capacity requirements which provide clarity on what the organisation must deliver, the capabilities required, and how these should be structured and deployed. These models also inform how technology must be leveraged to enhance specific components of the operational model, enabling improved efficiency, integration, and responsiveness. 
In the 2026/27 financial year we will prioritise the disestablishment of the State Security Agency and the establishment of the South African Intelligence Agency (domestic) and the South African Intelligence Service (foreign). Work is already underway to prepare for the proclamation of the GILAA (General Intelligence Laws Amendment Act, No. 37 of 2024) including the articulation of functions and structures for the reconfigured intelligence services, as well as the finalisation of the Regulations, which are a key requirement for the implementation of the GILAA.
To support the effective functioning of the civilian intelligence services within the allocated resource framework, I have approved the Shared Services structure, which will provide integrated corporate support services across the intelligence environment. This model will support key legislated entities, including the Office for Interception Centres, the Office of the Inspector-General of Intelligence, and the newly established National Centre for Intelligence Coordination.
These institutional reforms are not taking place in isolation. They are being driven by the nature of the threats confronting the Republic today.
AFRICA AND THE REST OF THE WORLD

Honourable House Chairperson,

The global security environment is undergoing a period of intense geopolitical tensions and conflicts, which threaten and disrupt supply chains and the overall business environment.

South Africa remains a key financier and strategic country within the Southern African Development Community (SADC) region to advance regional integration and cohesion.
However, SADC faces a myriad of threats which impede the advancement of the priorities of the Medium-Term Development Plan 2024-2029. Inclusive economic growth and job creation cannot materialise, if political instability and conflict in the region continues to exert pressure on South Africa’s bilateral relationships. As the Chair of the SADC, South Africa will not only seek to strengthen existing partnerships toward diversifying its trade and commercial relations but will also champion regional integration and rapid industrialization to advance regional security.

The State Security Agency (SSA) continues to closely monitor developments in the North and Horn of Africa, regions whose instability carries implications for South Africa’s national security. In Sudan, the ongoing civil war and escalating drone attacks have worsened the humanitarian crisis, with ongoing mass displacements and arms proliferation. Moreover, terror activity such as espoused by Al-Shabaab in Somalia, coupled with transnational organised crime, further threaten the Horn’s stability. In North Africa, the ongoing Western Sahara dispute delays the final chapter of decolonisation in Africa. The SSA will intensify its focus on providing timely threat, risk, and opportunity assessments to support South Africa’s work in the African Union Peace and Security Council and bilateral diplomacy, enabling Government to safeguard our national interests and advance African-led solutions.

The situation in the Middle East remains tense due to the long-standing Israel-Palestine conflict as violence continues, exacerbating a severe humanitarian crisis and mass displacements in Gaza. A fragile ceasefire between the United States (US) and Iran continues to threaten global energy security and food security in the African continent, with severe implications on livelihoods and economic stability.

INTELLIGENCE ACADEMY

The evolution of the intelligence environment demands for continuous alignment of skills, knowledge and tools, matching them with the ever-changing cutting-edge technologies used by potential adversaries. It is upon this premise that the South African National Intelligence Academy (SANAI) is utilising its convenience to foster business optimisation through the alluded technically inclined intelligence production.

As the Minister in The Presidency, I have directed that the Agency must optimise its business by leveraging the power of data by establishing a Data Institute. The Data Institute would then serve as a dedicated hub for research and development, and would foster data-driven innovation, develop data capabilities through training and continuous professional development in support of data-related technologies for the intelligence community and other interested parties to advance South Africa’s national security and national interests.

The Data Institute will attract and house experts in the fields of data science, cybersecurity, machine learning (ML), artificial intelligence (IA), geospatial technologies, amongst others. These experts will then collaborate on complex data challenges, ensuring governance, security and integrity of data, and in creating advanced solutions that can transform SSA’s operations across all business functions.

The Geospatial Information Dashboard is another innovation intended to help reorient functions of the SSA towards geospatial technology inclined intelligence collection, analysis and dissemination. Through the Academy, the SSA entered into an MOU with the South African National Space Agency (SANSA) in 2024, the scope of which makes provision for collaboration in various areas encompassing training and provision of access to data platforms.

The Academy has embarked on a Project to register as a Higher Education Institution (HEI) with the Department of Higher Education and Training (DHET), which will also include accreditation with the Council for Higher Education (CHE). A HEI Project Task Team was established, consisting of various expertise within the Academy and across other structures of the Agency. An application has already been submitted to the Department of Higher Education and Training.

In support of this strategic repositioning, the Agency is also strengthening the Academy’s role as a centre for research, innovation and future-oriented capability development. As part of this process, the Research and Development function currently residing within National Communications will be transitioned to the Academy in order to consolidate institutional research capability, enhance collaboration, and create an integrated environment for advanced intelligence learning, innovation and technology development. This repositioning will further support the Academy’s evolution into a strategic intelligence and knowledge hub aligned to emerging national security demands. These initiatives are designed to accelerate the Agencies advancement in AI and Data Science.

CONCLUSION

The State Security Agency is at the moment, an organisation in transition and every effort is being made to ensure that we are building for resilience and positioned to confront multiple futures in the horizon. We are not just observers of the change happening around us, but we are active shapers of our nation’s destiny.

I table Vote 8: National Treasury (State Security Agency) for your support to enable us to deliver on our mandate.

I thank you/// 

#GovZAUpdates