The recent spate of bomb scares in Durban, KwaZulu Natal had the media, public, and security establishment astir. In a statement to parliament, the investigative unit has linked the ten incendiary devices placed around the city in May and July of this year to the same perpetrator or perpetrators. Apart from this acknowledgment, police hold other information close to their chest but have made no arrests, and it is unclear how the investigation progresses. What is clear, whether the bomb scares may or may not be terror-related, terrorist groups are shifting more focus and resources to activities in Southern Africa, including recruitment, fundraising, and training.

In the past two years, the Thulsie twins’ arrest and murder of Rodney and Rachel Saunders are a stark reminder that South Africa is on the radar of terrorists and has a role to play in their aspirations. The SA government has mostly taken a laissez-faire approach to terrorism, ignoring or downplaying its potential significance locally. Perhaps it is time to sharpen the pencils and recognize that public safety could become increasingly in jeopardy, not only from elevated crime rates, organized crime, gang violence, farm murders, and public dissidence, but from groups exploiting the vacuum of public order and swift action while those in power are distracted by their own needs.


The Thulsie Twins

The Thulsie twins, 23-year-old Brandon-Lee and Tony-Lee, were arrested at their homes in Johannesburg on July 9, 2016, and accused of planning attacks on Jewish and American interests in the country. Facing 11 counts related to terrorism and one of fraud for unlawfully presenting Lesotho passports under different names in the Free State, there were also allegations that they attempted to travel to Syria to join Islamic State.


Photo presented in court as part of digital evidence collected by the Hawks. Source: Court evidence supplied


According to their indictment, in August 2015 Tony-Lee participated in a series of telegram chats with Abu Fidaa, the highest ranking IS spokesman in Africa and other unknown persons. He was allegedly instructed to commit various crimes which included attacking US, British, and
French interests in SA. Evidence found at their residence revealed a list of alleged targets:

  • Attack the best targets involving “US/Brit/French interest in SA.”
  • Kill cartoonist Zapiro, who drew the Messenger of Allah cartoon.
  • Kill Jews who fight in Israel and return to South Africa.
  • Kill affluent Jews.
  • Kill a gay imam “as yet unidentified”.
  • King David High School in Linksfield, Johannesburg.
  • The UK High Commission.
  • The US and Russian embassies.
  • The first secretary to the French mission.
  • Jewish investment banker Roy Topol.
  • The SA Zionist Federation Telfed.
  • State-owned arms manufacturer Denel.
  • Jewish community events.
  • Foreign interests at airports.

Prosecutors alleged that Tony-Lee discussed terrorist plans with an undercover US Federal Bureau of Investigation (FBI) agent between May and June 2016, which led to his arrest. He believed the agent was an ISIS operative, based in the US. Fatima Patel and her brother Ebrahim were previously arrested at their home in Azaadville in 2016 during police raids on the West Rand that also led to the arrest of the Thulsie twins. The siblings appeared in court at the time on charges of possession of unlicensed ammunition and explosives and were released on R5 000 bail.


Fatima and Ebrahim Patel during a court appearance. Source: Siphiwe Sibeko


The Kidnapping and Murder of Rodney and Rachel Saunders

Two renowned British botanists who have lived in Cape Town for about 30 years, Rodney (74) and Rachel Saunders (63) were looking for rare plant seeds in a remote nature reserve near the Bivane Dam and the oNgoye Forest on the outskirts of Vryheid in KwaZulu-Natal province when they were last seen on February 10, 2018.

The badly decomposed body of Rodney Saunders was found by fishermen on the banks of the Tugela River on February 17, a week after the alleged killing and identified several weeks later. His wife’s body had been found months later in a morgue as part of a police search for unidentified bodies. Analysts made a positive identification on June 13. Reports are that the missing couple had been placed in sleeping bags and thrown into the water.

Rodney and Rachel Sanders. Source: Zululand Observer supplied


Sayfydeen Del Vecchio (38) and Fatima Patel (27) were detained in a raid on a house near Mtunzini, a small coastal town 30km (18 miles) from the oNgoye forest on February 16, 2018. They face charges of kidnapping, murder, and robbery. A third man, their neighbor, Thembamandla Xulu (19), was found in possession of the couple’s mobile phones. He was sentenced to a suspended three-year sentence on May 25 after reaching an agreement with prosecutors. After a month-long manhunt for the fourth suspect in the case, Malawian national Ahmed Jackson Mussa (36), known as “Bazooka,” was arrested on March 22, 2018. According to court evidence, communications showed that, on February 9, there were discussions between Del Vecchio‚ Patel and Mussa of “preparing to kill the kuffar (non-believer)
and abduct their allies‚ to destroy infrastructure and to put fear into the heart of the kuffar.”

After the British couple disappeared, Del Vecchio and Patel withdrew R734 000 from their accounts and purchased items, which included items found included a drone, camping equipment, two generators, and paintball equipment using Rachel’s bank card. On February 18,
police recovered their Toyota Land Cruiser in Verulam. A forensic examination revealed blood marks in the cargo area. It emerged in court that Del Vecchio and Patel had been under the Hawks' surveillance for two years. The surveillance began after Del Vecchio was seen snooping around King Shaka International Airport on a quad bike.
Patel comes from a conservative Muslim family in Azaadville. Her father is a well-known Moulana (Muslim priest). She was home-schooled and met Vel Deccio on social media. Del Vecchio is an Italian-born national who moved to South Africa as a child. He completed his schooling at Northwood School in Durban North. Sources believe that he converted to Islam in 2003.

Kenyan and Dutch Connections

According to reports that surfaced from August 27, a 29-year-old Dutch jihadist, only identified as Mohammed G., is believed to have been involved in the kidnapping of the Saunders’ couple and of contacting Adu Fidaa, a top Islamic State group official operating an ISIS cell in Kenya. Mohammed G, from the Limburg province in the south of the Netherlands, briefly appeared in
the Rotterdam District on charges of belonging to or providing aid to a terrorist organization. Dutch prosecutors alleged he tried to buy bitcoins using Rachel Saunders' credit card details and worked with Del Vecchio, Patel, and a Somali-based suspect to raise funds to set up a training camp in Somalia and buy weapons. They also used social media accounts to advise prospective jihadis wanting to travel to Libya.


The Verulam Mosque Attack

Returning to the planting of a series of incendiary devices in Durban in 2018, on Thursday, May 10, three men armed with knives and guns stormed the Shia-sect mosque and slit the throat of Abbas Essop, 34, after duct-taping his mouth. Two others, the mosque’s Moulana, Ali Nchinyane and the caretaker, Muhammad Ali, had also been stabbed in the throat but survived. Ali opened the gate for the attackers shortly after midday prayers after they said they wanted to pray. Essop, who was across the road at the time when the attack started, rushed inside the mosque when he heard screams. During the attack, they set several rooms alight, including firebombing the kitchen and library, before fleeing in a white Hyundai Getz with no number plates.

Verulam Mosque. Source: Donald Lobelo, ENCA


Three days later, on Sunday, May 13, a group of worshippers who had concluded their prayers, noticed a suspicious device on the pulpit. On examination, bomb technicians confirmed that an undetonated incendiary device was found, placed beneath the Moulana’s chair. The device consisted of a piece of white PVC pipe affixed to a Nokia cell phone with wires.

It is not clear when or who placed the device, but forensic experts did not discover it during a thorough search on Friday. Investigators revealed that it was designed to burn rather than explode if detonated. It is unclear whether perpetrators planted the bomb during the previous attack and police forensic investigators who had examined the crime scene overlooked it, or someone else placed it afterward.

Explosive device found at Verulam Mosque. Source: Jeff Wicks, The Witness supplied

The suspects of the original attack are still unidentified and at large. According to the mosque’s chairperson Azad Seedat, the attackers had visited the mosque three times before the attack when it was quiet, prayed, and taken literature and books.

Imam Hussain is one of only three Shia mosques in South Africa, the others being the Ahlulbait mosque in Cape Town and another in Edenvale, Johannesburg. The Shia community represents around three percent of the Muslim community in South Africa.

More Incendiary Devices Found in Durban 

Locations of explosive devices. Source: Joan Swart

Between July 5 and 19, police investigated ten incendiary devices discovered around Durban. Two caused small fires after detonation, while the others were found and destroyed or disabled before they could be set off.


The Gateway Mall and Pavilion Woolworths Stores

The Woolworths store at the Pavilion Shopping Mall was set on fire at 1:30 AM on Wednesday night, July 5 by a device filled with propellant attached to a cell phone with wires. The device appeared to have been hidden among men’s shirts at the store. The automatic sprinkler system extinguished the fire.

Device that started the fire in Woolworths Gateway. Source: Sowetan Live supplied

Later the same morning, Thursday, July 5, a similar device planted in the pocket of a jacket on a clothing rack caused a small fire and an evacuation of the Woolworths shop in Gateway.

Two days later, on Saturday morning, July 7, yet another similar incendiary device was found among cushions on sale in the Woolworths outlet at the Gateway Mall. The Explosives Unit of the SAPS safely removed the device.

None of the incidents caused any injuries.

Second suspicious device found in Woolworths Gateway. Source: Jeff Wicks, IOL supplied.

On Monday morning, July 9, a manager noticed a suspicious device with wires protruding from it in the corner of an underground parking lot in the Pavilion Shopping Centre, a part of which was evacuated and cordoned off. Police later reported that the suspicious item was a security tag used on appliances to prevent theft.

Avondale Road

Police found and conducted a controlled detonation of two incendiary devices among parked cars near the Vodacom Durban July on Saturday night, July 7. The first, at Gladys Mazibuko Road, was found just after 10:00 PM beneath a vehicle. The second was set off just after 11:00 PM at Avondale and Milner Road, also next to a parked car.

A device placed under one of two vehicles near the Greyville Racecourse. Source: Vusi Batefane, ENCA supplied


Wentworth Spar

Police found a similar incendiary device at the Wentworth Spar on Monday evening, July 9, after a 10-year old boy handed the manager on duty a brown envelope containing a handwritten letter and a 9mm-bullet. The note instructed the manager to put money inside a bag outside the supermarket and not to call the police, otherwise, a bomb set inside the store would explode.

The manager took the letter personally to the Wentworth police station accompanied by the boy, who said that an unknown male gave him the envelope outside the store and told him to give it to the manager. Police evacuated the store, and, with the help of a search dog, the Bomb Disposal Unit found a black plastic packet at the entrance near the cashier tills and destroyed it with a controlled detonation. There were no injuries or damage to property.


Woolworths CBD & Ilala Ridge Convenience Store

Woolworths confirmed the discovery of a device at its Dr. Pixley kaSeme (West) Street branch around midday on Thursday, July 19. A staff member, who was assisting a customer, found the suspicious device inside a coat pocket after noticing the unexpected weight and bulk. The staff member removed the coat from the store and hanged it near a pillar on a concrete off-ramp leading out of the parking lot.

A staff member removed the jacket with the suspicious device from the Woolworths CBD store and left it on the street outside. Source: Zainul Dawood, IOL


On the same day, a staff member noticed a suspicious parcel at the Ilala Ridge Engen Garage and Woolworths Convenience Store and notified the police. According to a police spokesman, the packet contained old fireworks.

On August 16, Hawks Head Godfrey Lebeya told Parliament’s Police Portfolio Committee at least 10 of the incidents in which bombs were found in Durban in May, June and July have been conclusively linked, including the Verulam Mosque bomb.


An Unrelated Hoax Bomb?

Heinrich Holtzhausen, a 36-year-old man, is believed to have left what appeared to be a homemade explosive device behind in a bag after attending a prayer service at the Masjid Taqwa in Roshnee, Vereeniging on July 31. He was apprehended when he arrived for another service the next day. He appeared in the Vereeniging Magistrate’s Court on August 23 for a formal bail application, which he withdrew, and the court remanded the case to November 16. Holtzhausen was previously diagnosed with schizophrenia and lived with his parents in a flat in Vereeniging.

Police claimed that Holtzhauzen lived in Verulam at one stage. After testing, however, the device in question was revealed not to be an explosive device. However, prosecutors still entered a charge of “possession of a hoax bomb.” Despite speculations, there is no evidence that the incident is linked to the previous bomb scares, and it is highly likely that it is unrelated.


Abu Fidaa and the East Africa Connection – The Common Denominator?

Ali Mohamed Abdi aka Abu Fidaa, a medical intern at the Wote Hospital, allegedly ran an ISIS cell operating in Malindi, a town 120 kilometers northeast of Mombasa in Kenya. Kenyan authorities arrested Fidaa on April 29, 2016, on suspicion that he was a member of a terrorist cell of the Islamic State terror group that was involved in the radicalization and recruitment of students at the Moi University in Eldoret, as well as planning large-scale attacks including a biological attack in Kenya using anthrax. Local police also arrested his wife and another accomplice about the case, but they have since been released.

Together, they were greatly involved in the recruitment, facilitation of travel and dissemination of terror-related materials to other adherents and probable recruits. At the time of their arrest, they were mobilizing funds to fulfill their attack plans. According to authorities, more suspects are still on the run. According to Dutch prosecutors in the Mohammed G. case, Fidaa received direct instructions from ISIS top management in Syria.

Although Fidaa remains in detention, and several co-conspirators and other al-Shabaab-linked operators were arrested in the past year, recruiters and cells continue to operate in Kenya, with indications of exporting their activities, especially funding and recruitment drives to Southern Africa, more specifically Mozambique and South Africa.


Compiling a Basic Suspect Profile

The Devices

Most of the devices found are similar, consisting of a cell phone connected with wires to a small, sealed piece of PVC pipe, and containing a low(ish)-grade propellant. Although the design method appears to be somewhat sophisticated, there appears to be design flaws that causes a fire rather than an explosion. Although the design can be inherently lethal or cause significant damage and injuries, the perpetrator(s) seem to have taken care to place the devices so that they can be detonated when no one is around.

From the images and scene descriptions available, Ed Nordskog, an arson/bomb investigator and profiler for the Los Angeles Sheriff’s Department and consultant in hundreds of serial cases worldwide, sees the design as more of an explosive device than an incendiary as all the elements are there for a properly functioning “pipe bomb.” He pointed out that, although PVC doesn’t provide as much confinement and therefore not as violent explosions as their metal cousins, but they are nonetheless lethal.

It is likely that the propellant is ordinary black powder extracted from fireworks. Black powder, also known as gunpowder is the propellant in fireworks and bullets. This substance consists of an oxidizer (potassium nitrate), a fuel (carbon), and an accelerant (sulfur). For every 270 grams of black powder used, 132 grams of carbon dioxide is created, the rest of it turning into potassium sulfide and nitrogen, causing a release of energy and an expansion of gases, but is more effective as a propellant than an explosive. Black powder produces about 0.3 liters (L) of gas per gram, and to release about 0.7 (or less) Kcal of thermal energy per gram. Put in terms of capacity, or the product of the gas volume produced times the heat energy generated, black powder yields 0.21.

As per the relative effectiveness (RE) factor, which relates an explosive’s demolition power to that of TNT, in units of the TNT equivalent/kg (TNTe/kg), black powder has one of the lowest RE factors, half that of TNT and about 60% lower than TATP, an explosive often used in suicide bombs.

Nordskog explained that “too much explosive powder in any pressure device without proper confinement will actually turn an intended ‘bomb’ into an incendiary by default.  The PVC in the photos is lighter gauge than most irrigation-type PVC and does not have the strength as thicker PVC.

Although the use of too much explosive material cannot be completely ruled out without further evidence, Willem Els, a senior training coordinator at the Institute for Security Studies with an extensive experience in bomb disposal and investigation at the South African Police Service, pointed out that such a miscalculation is rare in practice. In the vast majority of cases where unintended deflagration happens the charge has not been sufficiently confined.

Typically, one (or both) of the end caps is not sealed properly, which causes premature failure, that is, before reaching the desired internal pressure for detonation. This becomes the path of least resistance and a flame is released in a torch effect. When the initiator triggers and the PVC fractures, all the powder will deflagrate (burn) as opposed to detonate (explode).

Therefore, the PVC pipe design and utilization will not cause a pressure differential sufficiently significant to contribute to an effective explosion. Based on the few available photos, I think it is reasonable to assume that there may have been an excessive amount of powder within these items to create the intended detonation, but, more likely, the construction was not sturdy enough to withhold the pressure needed, or a combination of these design issues.  

On that account, at face value, these are simple devices except for applying the cell phone as the switch or timer.  Such an execution constitutes a higher degree of sophistication than most bombers have. Knowing how the devices are initiated, and whether there is a second power source (i.e. battery) that is not visible, should provide a more definitive analysis.

Lastly, because of the apparent international terror aspect of these events, and the combination of apparent design sophistication but lack of effective execution, it is likely the offender(s) copied the design from a website or written instructions.  There appears to be no “signature” aspect to the design. As few arson/bomb events anywhere do not display some form signature behavior, a revelation of more detailed evidence on the device construction is expected to reveal more about the bombmaker.


The Locations and Targets

Two locations stand out regarding behavioral significance, the Verulam Mosque, as the first known incident in the series, and multiple Woolworths stores, as disproportionate rather than random (or convenient) targets. The first event in a criminal series often reveals something personal about an offender. Perhaps he/they frequented the mosque and became angry or discontented by someone or their viewpoints there or felt personally insulted. Alternatively, he/they could have targeted the establishment for ideological reasons, in which case they have probably scouted the place before placing the device.

In the past four years, Woolworths has come under repeated pressure for supporting Israel by selling several products from Israeli producers, especially from pro-Palestine activists and movements such as Boycott, Divestment and Sanctions SA (BDS SA)’s boycott campaign. However, this campaign ended in the second half of 2016, announcing several achievements. Instead of an ideological grievance, a perpetrator may be a disgruntled former employee or job applicant (or a family member of such a person) or believe to have been wronged as a customer.


Temporal and Spatial Data

In geographical profiling, the significance is placed on the distribution of locations in the order in which serial offenses have taken place. The presence of a buffer zone is common – an area among or adjacent to the locations that the perpetrator(s) avoid, typically for fear of being identified, often where their place of residence, work, or frequent travel routes are. The location of the first crime scene also often holds special significance for the perpetrator(s) in terms of being more personal or linked to their daily lives.

The distribution of the ten crime scene locations might suggest that the offender(s) base is somewhere in Durban North, although the distance between the northern-most (Verulam mosque) and southern-most location (Wentworth Spar) is relatively small – about 30 km as the crow flies. It is also interesting to note, but perhaps not probative, that the sequence moved from north to south over time, except the last incident (Ilala Ridge).

I suspect that the perpetrator(s) are familiar with the Verulam Mosque and may have frequented it before. Assuming the placement of the device was separate from the physical attack, the person(s) also blend into this environment.

The temporal data suggests the perpetrator(s) may have placed all devices outside working hours, in the evening, or just before store closure. The timing may be an indication that the perpetrator(s) are occupied or employed during the day but may also point to attempts to cause a fire when nobody is around. It is also worthy to note that only two devices detonated before discovery, which could point to another design issue in addition to those already mentioned.


The first device was placed almost two months before the main series of eight known incidents, which took place over two weeks with no further devices found for the past month-and-a-half. The reason for the first gap may be the attention that the lethal attack attracted to the area and manhunt in general. The perpetrator(s) probably ceased or desisted from further offenses after July because of heightened public awareness and security measures, hopefully not to go back to the drawing board. However, a crime series usually does not end without good reason, e.g., apprehension of the suspect (or death), diversion to other interests or duties, physical relocation, or a hiatus to regroup, train, or rethink strategy.


The Perpetrator(s)

According to a source close to the investigative team, the devices are very similar, but with two slightly different “signatures” suggesting a pair of bomb-builders or a learning curve. It is, therefore, reasonable to assume that two perpetrators work together. They can be friends, siblings, or relatives. From the behavioral evidence, they are probably males in their early twenties. There may be three to four people in the group. They share common interests and ideology and come from a similar background and culture. Such a dynamic is commonly known as a lone wolf pack as they operate quite independently, that is, not under the formal command and control structure of a terrorist or other organized criminal group.


Evidence does not support them receiving much operational or financial support, probably only ideological encouragement from a handler or recruiter. Their intelligence likely falls into the average range. They are more passive, or passive-aggressive. They are impressionable and susceptible to external influence and likely driven by a combination of seeking excitement, justice, and acceptance.

Their motivation is probably two-fold, namely financial – to try and extort money from targeted companies, and ideological – to avenge a grievance against a former employer, bad customer experience, or institution that is seen to further the cause of the enemy.


As Woolworths stores were disproportionately targeted, it is reasonable to assume that the company is a deliberate target. Woolworths has come under fire in the past four years from pro-Palestine movements for supporting Israel by importing products from the country.

The perpetrators are not violent but may escalate with encouragement from their influencers. They likely do not have a mental illness (e.g., depression, anxiety, or PTSD) or personality disorder such as antisocial personality disorder. There may be a dominant and submissive partner (e.g., older/younger), but the control differential does not appear to be pronounced.


They have likely never been personally exposed to traumatic experiences, such as armed conflict or murder. They are probably not directly connected to a criminal gang or established terror network. They probably acquired most of their information online, e.g., explosive devices, wireless detonators, but may frequent a local mosque, if their activities are, at least in part, terror-linked. They may be unemployed or partly employed, but are mobile, i.e., possess or have access to a vehicle.


Their behavior appears almost juvenile in its naivete, lack of planning and follow-through. The shifts in modus operandi suggest their plans do not have the intended results. Despite the relative sophistication of the bomb design, it appears to lack effectiveness due to construction flaws. They probably enjoyed the thrill of the media attention, but heightened awareness and security measures could have made them reassess their approach and refrain from another attack, at least for a while.


Final Thoughts

The profile rests on the assumption that the ten bomb scares mentioned are linked to the same perpetrator(s) as announced to parliament by the head of the Hawks, the directorate for priority crime investigation. All information utilized are in the public domain.

While it seems reasonable to assume that the Thulsie, Saunders, and Durban bomb scare cases have a common link in the involvement of East African terror groups in the recruitment and other operational activities in South Africa, only more evidence and investigative progress will confirm (or disprove) such conjecture conclusively. However, what is blatantly clear, is that Southern Africa has become an attractive haven and operational theatre for groups extending their reach further into the continent.


Published By:

September 29, 2018

Durban Bomb Series and the East African Connection

Introduction The recent spate of bomb scares in Durban, KwaZulu Natal had the media, public, and security establishment astir. In a statement to parliament, the investigative […]

Get updates Every Sunday

Subscribe to our newsletter.