But whistleblowing also brought down a president

Mafole’s story is not the only story. And it’s important that it isn’t.

In 2017, two anonymous whistleblowers — known only as “Stan” and “John” — handed a human rights lawyer named Brian Currin a set of hard drives. Those drives contained 300,000 emails detailing what the Zondo Commission would later describe as the corrupt relationship between the Gupta family, the Zuma family, cabinet ministers, and the CEOs of state-owned enterprises. The full architecture of State Capture. Documented. Deliverable.

Stan and John knew the risks. Corruption had penetrated law enforcement deeply enough that they didn’t trust official channels. They went to the media instead — Daily Maverick and amaBhungane — who spent months analysing the emails before publishing. The whistleblowers were relocated before the story broke. They got out safely.

What followed was the most significant accountability moment in post-apartheid South Africa. The Zondo Commission. The fall of Jacob Zuma. Billions in irregular expenditure exposed. Prosecutions ongoing.

Two people. Two hard drives. Three hundred thousand emails. And the courage to hand them over knowing what it might cost.

What whistleblowing actually achieves

The personal cost of whistleblowing is real and well documented. But so is the benefit — to individuals, to organisations, and to the country.

For individuals: Whistleblowers who come forward through protected channels gain legal protection against dismissal and occupational detriment under the Protected Disclosures Act. They also gain something harder to quantify — the ability to sleep at night knowing they did the right thing. Cynthia Stimpel, the SAA Group Treasurer who flagged a R256 million irregular contract in 2016, paid a significant personal price. She was suspended, then left. But the contract didn’t go through. And she has since become one of South Africa’s most respected voices for accountability and governance reform.

For organisations: Internal whistleblowing is one of the most effective early warning systems available. The Association of Certified Fraud Examiners consistently finds that tips — most of them from employees — are the number one method for detecting fraud, ahead of internal audits, management review, and external audit combined. Organisations with functioning, trusted reporting channels lose significantly less to fraud than those without. A whistleblowing culture isn’t a reputational risk. It’s a financial control.

For SOEs and government: The Zondo Commission estimated that State Capture cost South Africa between R500 billion and R1 trillion. Eskom alone lost hundreds of billions to corrupt procurement. PRASA. SAA. Transnet. The damage was compounded by a culture of silence — one where people knew, but felt either too afraid or too powerless to speak. Every rand of that damage is an argument for building better whistleblower systems now.

How to blow the whistle safely in South Africa

This is the section that matters most. Because courage without a plan is just exposure. Here’s how to do it properly.

Step 1: Document everything before you say a word. Gather evidence — emails, documents, financial records, dates, names, amounts. Be specific. Vague allegations are easily dismissed and leave you exposed without the protection of a verifiable disclosure. The more detail you have before you speak, the stronger your legal standing.

Step 2: Know your legal protection. The Protected Disclosures Act of 2000 protects employees who make disclosures in good faith about criminal conduct, failure to comply with legal obligations, miscarriage of justice, or danger to health and safety. The Companies Act extends protection to directors, auditors, and company secretaries. The Labour Relations Act protects against unfair dismissal as a result of a protected disclosure. Know which law covers you before you act.

Step 3: Choose your channel carefully. This is the most critical decision. Internal reporting — to a line manager or ethics hotline — is appropriate when you trust that your employer will act on the information and that the wrongdoing doesn’t implicate senior leadership. When it does implicate leadership, or when you have reason to believe internal channels are compromised, go external immediately.

Step 4: Use independent anonymous channels. South Africa has several:

Step 5: Protect your digital trail. If you are reporting sensitive information, use a secure, non-work device. Don’t use your work email, work phone, or work computer to research whistleblowing channels or draft reports. Use a personal device on a personal network. Consider a VPN. If the disclosure is high-risk, PPLAAF offers specific digital security guidance.

Step 6: Get legal advice before you act. The South African Human Rights Commission and several public interest law firms offer guidance to whistleblowers. Knowing your rights before you speak significantly reduces your exposure. The proposed Whistleblower Protection Amendment Bill, currently working through the legislative process, would establish a fund to assist whistleblowers with legal costs — but until it passes, budget for this yourself if you can.

The framework is imperfect. Use it anyway.

South Africa’s current whistleblower protection regime has real gaps. The Protected Disclosures Act leaves whistleblowers vulnerable to intimidation, job insecurity, and threats to their physical safety. It doesn’t mandate confidentiality of identity. It doesn’t cover volunteers or independent contractors. Reform is coming — but it isn’t here yet.

That’s the honest picture. And it doesn’t change the fundamental truth: the alternative to imperfect protection is silence. And silence, as Mpho Mafole’s story and the State Capture decade both prove, is always more expensive than speaking.

Mafole had a mandate. He had a policy. He had 14 years of experience and the full authority of his role. He published his findings through the proper channels on a Thursday. He was gone by Monday evening.

Stan and John had nothing but courage and a good lawyer. They changed the country.

The difference between those two outcomes wasn’t luck. It was the channel they chose, the anonymity they maintained, and the support structure they used. That’s what this article is for. And it’s what the Easy Institute whistleblowing module unpacks in full.