ORGANISED: Police response to ruthless cash-in-transit gang rampage inadequate, says UCT academic in a study that reveals 29 guards killed in three months…
By Monk Nkomo
The spate of brazen cash-in-transit robberies – perpetrated by ruthless armed gangs in South Africa – are calculated, highly sophisticated operations carried out with utmost prudence by disciplined criminal syndicates.

This is the assessment by academic Annie Kok, who recently obtained her PhD from the University of Cape Town with her thesis: ‘’ Dark networks: a South African cash-in-transit crime case study.’’
These networks, she says, are not run by the stereotypical kingpin sitting in a smoky backroom calling the shots. Instead, they are spearheaded by what she terms “criminal cooperatives” – smaller, densely connected clusters – which form around a “nucleus” (core) for a specific heist and then dissolve and reassemble in different configurations for the next job.
“Leadership is situational and determined by access to information and critical resources – human or otherwise. Cohesion is maintained through multiple overlapping relationships, known as multiplex ties, and through `gatekeepers’ who link otherwise separate clusters.’’
Kok says it was easy to mistake the chaos of a cash-in-transit (CIT) heist for disorder. The screech of tyres, the gunfire, the explosions – it all suggested recklessness.
However, behind the smoke and twisted metal was something far more calculated: a disciplined, adaptive network that operated with utmost prudence and the resilience of a living organism. “Organised criminal networks are deeply ingrained in South Africa, yet little is known about their empirical structure.”
Kok added that cooperation with security firms that had access to relevant information was also patchy and was hindered by distrust. Policing alone would not solve the problem. CIT robberies was a symptom of deeply rooted and systemic issues, all of which was the collective responsibility of South Africa’s citizens.
The challenge in dealing with CIT robberies was compounded by public and political pressure. These robberies were spectacular crimes, often violent and public. The response tends to be equally spectacular: paramilitary-style raids and high density policing operations. These yielded dramatic images for television, satisfied the demand for visible action and could produce a flurry of arrests.
Kok warned, however, that these were counterproductive actions in the long run. “These quick wins actually make the networks more resistant to attacks. Every time you disrupted them without breaking up the structure, they adapted, evolve and become harder to eradicate.’’
Random arrests, which often happened in reality , barely made a dent in dismantling the broader network. She suggested that if the law enforcement agencies strategically targeted certain people, probably the masterminds, the network’s ability to coordinate would collapse much faster. This kind of intelligence-led policing would generally yield good results.
Without political will, investment and a shift in policing approach, the country will keep fighting the same battles with the same results, Kok said.
Her interest sharpened during the 2018 wave of CIT robberies when a parliamentary hearing laid bare how little was understood about the extensive networks behind these attacks. Understanding the network itself, not just the heist, was essential to tackling the problem.
Cash-in-transit heists in South Africa were carried out by heartless armed gangs who normally travelled in several vehicles, one or two of which is used to ram into the security vans carrying money. These attacks, including the bombing of these vans, occurred during the day and even on busy roads by men armed with automatic weapons. Security guards are usually robbed of their weapons and even murdered or seriously injured.
Statistics released by the South African Police Services have revealed that Gauteng and KwaZulu-Natal were the provinces with the highest number of CIT robberies. According to the Cash-in-Transit Association, about one hundred incidents were reported countrywide during the first six months of this year. According to the police statistics, a total 29 cash-in-transit heists were recorded in the country between October and December last year. Nearly twenty security guards employed by these companies, had been killed in the past three years during these attacks.
A seminar by Dr Peter Klerks of the Netherlands Police Academy on social network analysis provided the spark that Kok needed to unravel the hidden mechanics of one of South Africa’s most violent criminal enterprises. What emerged from her work was a portrait of a criminal ecosystem as fluid as it was formidable.
“Leadership is situational and determined by access to information and critical resources – human or otherwise. Cohesion is maintained through multiple overlapping relationships, known as multiplex ties, and through ‘gatekeepers’ who link otherwise separate clusters.”
Kok says a CIT cooperative was a resilient structure. This flexibility was a defining feature, allowing the network to adapt and persist despite arrests or other disruptions, making these networks difficult to dismantle. Even after disbanding, the relationships forged within a cooperative invariably seed future collaborations.
Recruitment into these cooperatives was not about family loyalty or lifelong bonds. It was about reputational trust. A bomber or driver might never have met the group’s nucleus before, but if they had a proven record of skill and reliability in the criminal economy – and could be vouched for by a trusted intermediary – they were in.
“That is the value of reputational trust. It allows them to integrate highly skilled strangers while keeping the operation secure and efficient. This helps facilitate a successful heist and reduces the risk of including an informant.”
This balance between operational efficiency and maintaining security against disruption was referred to as the “security-efficiency trade-off”. The cooperatives remained small and cohesive enough to limit the flow of sensitive information yet sufficiently connected to execute complex robberies.
Kok used social network analysis to also identify the most strategically important individuals – for example those who bridged otherwise disconnected clusters – and then ran simulations to see what would happen if those individuals were removed. Although not surprising, the results were conclusive. She found that South Africa’s law enforcement currently struggled to generate and act on these insights. The SAPS and Directorate for Priority Crime Investigation were under- resourced, their analysts were siloed from detectives and their systems were fractured.
She noted that many developed countries faced high rates of CIT crime, although the level of violence in South Africa was extreme. “Each country has its own unique set of circumstances and challenges and many countries have come up with bespoke solutions. What we need here is intelligence-led policing at a scale that is well-resourced, long-term and targeted.”
Her findings revealed that there was no short-term fix. Every disruption eventually led back to recruitment, with death or retirement the only permanent exits. “Many CIT robbers see themselves as professionals. They consider this to be a legitimate career like any other. So, although we need appropriate policing interventions to stem the tide, stopping the next generation from continuing the cycle requires a societal shift.”
Kok provides the following recommendations:
• She called for the national integrated cash services robbery intervention strategy to be released and implemented without further delay.
• advocated for a data-sharing framework between law enforcement and independent researchers, with pathways that fed expert analysis directly into operational planning.
• Called for proper recruitment and upskilling of crime analysts, competitive salaries and the end of siloed operations.
• A move away from politically – driven “quick results” towards sustained, intelligence-driven interventions that targeted the network’s structural vulnerabilities.
The methods used by Kok could also be applied beyond CIT crime. “Any organised crime market from trafficking to illegal mining – is built on the same principles of connections between individuals based on their value and trust.
In fact, there is much overlap between these seemingly ‘different’ criminal networks. But if we know how to best dismantle one type of network, we can apply that knowledge to similar network configurations.”
Kok’s thesis could offer both a blueprint and a warning. It showed in analytical detail how a CIT network formed and functioned and where they could be hardest hit.
“We absolutely must move with the times. Complex problems require subtle, evidence-based approaches, like network analysis. We need to embrace data and analytics, utilise those who can extract insights from it and give them access to the required resources’’.




























