Academics say burglaries and data theft point to an orchestrated intimidation campaign against those investigating service delivery protests.
A mysterious series of thefts has raised the question of whether a group of university researchers is being targeted for its investigation of service delivery protests.
The researchers from the University of Johannesburg include sociology professor Peter Alexander, who is the South African Research Chair in Social Change at the university. He discovered the second killing site at Marikana, where 14 workers were shot and killed in August 2012.
The researchers released the findings of their investigation into service delivery protests at a media briefing on February 12 this year.
Their research showed that protesters were not part of some third-force agenda aimed at destabilising the government. There was very little correlation between the elections and the number of protests, and the protests were for the most part not politically orientated.
"Such characterisation of these protests serves to delegitimise the grievances and agency of ordinary working-class people," one of the researchers, Dr Carin Runciman, wrote in their research paper.
Top five grievances
According to the research, the top five grievances were about service delivery in general: housing, water and sanitation, political representation and electricity. The research was presented at metalworkers' union Numsa's political school recently.
The day after the media briefing, on February 13, Runciman arrived at her office to find the security gate propped open. The front door and another internal door were open. Colleagues recalled locking them the night before, but they did not think much of this incident.
On February 19, the electric fence at Alexander's home was cut. The incident seemed minor and was not reported to the police.
Later that same day, Alexander's laptop was stolen from the boot of his car. The incident was reported to the police. Then, in the early hours of February 23, Runciman's laptop and cellphone were stolen from her cottage. The thief appeared to have entered the cottage through Runciman's bedroom window, and the police were notified.
The following day, Runciman and two colleagues could not access the security gate at their university office because the lock had been tampered with.
That same day, on February 24, Runciman discovered she could no longer access the unit's service delivery project account on file hosting service Dropbox.
The password recovery details no longer defaulted to Runciman's Gmail account, but to an unknown cellphone number that did not belong to any of the research team.
The Dropbox account contained crucial audio recordings of interviews conducted with protesters.
Researchers and IT experts can only speculate about the apparent sabotage.
Dominic White, the chief technology officer for SensePost, said that someone could have had access to the machine Runciman was working on, or she could have logged into Dropbox from another machine, and forgot to log out. It could be the result of a malware attack.
"The fact that the Gmail account was taken over makes me think it was a little more targeted than just an attempt to gather intelligence," White said. "Somebody with espionage purposes would rather just take the information and run. Why take over the account?"
State intelligence agencies probably would not be involved in something like this, given that they are trained not to leave a trace.
"Hacking a Dropbox account is a crime across countries, and intelligence services are a little bit more savvy than that," White said.
Campus security said it was unaware of any incidents besides the one on February 24, and it was not investigating further.
For Alexander, there were simply too many incidents, in short succession, to be classified as "normal" criminal activity, especially as some of them did not result in theft.
"We spoke to a few people who had experience of this kind of thing, and they confirmed our suspicion that this was probably some kind of state harassment," he said.
"Data gathering may have been an added benefit, but the consensus was that whoever was responsible could have obtained anything they wanted without leaving a trail. We can only guess why we might have been targeted. Perhaps it was because we revealed reports of 43 protesters killed by the police since 2004."
Alexander said researchers should not be intimidated.
"This shouldn't happen in a democratic society where academic freedom is enshrined in the Constitution and where the police are supposed to be fighting crime. If our data can be stolen, so can doctors' records. The lesson we've learnt is that researchers need to be less naive, and more vigilant."