UNIVERSITY OF SOUTH AFRICA (UNISA)
College of Law
⋄
ASSESSMENT 02
Case Study: UbuntuTel Network Sabotage
⋄
Module Code: FOR3701
Module Name: Forensic Investigation
Assignment No.: Assessment 02
Due Date: 02 April 2026
Semester: Semester 1, 2026
Unique Number: 298986
Submitted in partial fulfilment of the requirements for FOR3701
at the University of South Africa.
,UNISA | FOR3701 Assessment 02 – Forensic Investigation
Question 1: The Forensic Science Laboratory and Investigation Management
1.1 The Role of the Forensic Science Laboratory
The Forensic Science Laboratory (FSL) is a critical resource within the South African Police
Service (SAPS) that provides scientific analysis of physical evidence to support criminal
investigations (SAPS, 2024). In the UbuntuTel case, where deliberate infrastructure sabotage
is alleged, the FSL could contribute in several important ways.
Physical evidence from the sabotage sites. The FSL would examine fibre cables that were
cut to determine the tool type used, the angle and technique of the cut, and whether tool
marks left behind match any implements found in the suspect’s possession. Tool mark com-
parison is a standard FSL discipline that can associate a specific instrument with physical
damage (Joubert, 2021). In this case, if Mr. Naicker S is linked to tools consistent with the cut
patterns, this constitutes corroborating physical evidence.
Fingerprint and DNA analysis. The FSL’s Biology Unit and Chemistry Unit could process sur-
faces at the tower sites, including exposed cable ends, reconfigured routers, and removed
modem housings, for latent fingerprints and biological material such as skin cells or sweat
traces. The FSL Biology Unit has the capacity to process low-template DNA samples and
compare them against the national forensic database or elimination samples taken from the
suspect (Olckers et al., 2013). A fingerprint or DNA match placing Mr. Naicker S at the exact
point of tampering would substantially strengthen the prosecution’s case.
Digital and electronic evidence analysis. The removed SIM-based remote-access modems
are electronic devices. The FSL would extract and analyse any residual data from these de-
vices, including configuration logs, last-used timestamps, and internal memory records, to
determine when they were last accessed and by whom (ACFE SA, 2015). This type of analysis
falls within the FSL’s Scientific Analysis Unit.
Analysis of WhatsApp evidence. The retrieved WhatsApp messages indicating a threatened
network shutdown would be processed by the FSL’s Question Document Unit to verify their
authenticity, confirm they were not altered after extraction, and establish a chain of custody
for their use as evidence in court proceedings (ACFE SA, 2015).
CCTV footage enhancement. Where CCTV footage is unclear or degraded, the FSL can apply
image-enhancement techniques to improve the resolution and clarity of vehicle identification
Page 1 of 15
, UNISA | FOR3701 Assessment 02 – Forensic Investigation
details, including licence plate numbers.
Report for court proceedings. Critically, the FSL produces formal forensic reports by qualified
forensic scientists who can testify in court as expert witnesses. Their evidence is presented
in a format admissible under the Criminal Procedure Act 51 of 1977 (CPA), and the courts have
repeatedly affirmed that FSL-produced scientific evidence carries substantial weight when
properly documented (Olckers et al., 2013).
Implementation Insight
In South Africa, the FSL currently operates under SAPS and is the only state-authorised
laboratory for criminal case work, as provided in section 212 of the Criminal Procedure
Act 51 of 1977. The investigator must ensure all evidence submitted to the FSL is ac-
companied by a proper exhibit register and chain-of-custody documentation to prevent
any challenge to the integrity of the results.
1.2 Two Management Principles Applicable to this Investigation
Effective forensic investigation depends on sound management principles that guide how the
investigation is planned, coordinated, and conducted (Joubert, 2021).
First principle: Coordination and communication. A complex infrastructure sabotage case
such as UbuntuTel involves multiple agencies and specialised units: the FSL, digital forensics
teams, CCTV analysts, the employer’s internal audit team, cellphone network providers, and
potentially the Hawks or SAPS Commercial Crime Unit. The principle of coordination requires
the lead investigator to establish clear communication channels between all parties, assign
defined roles to each team, and schedule regular progress briefings to ensure that evidence
streams are not worked in isolation (Joubert, 2021). Without coordination, duplicate work is
carried out, critical timelines become confused, and evidence may be inadvertently compro-
mised. In this case, the internal audit team’s findings about internal access routes must be
shared in a structured manner with the forensic team so that digital evidence collection is
directed effectively.
Second principle: Documentation and record-keeping. Every investigative step, from the ini-
tial site inspection at the sabotaged towers to the retrieval of WhatsApp messages and CCTV
footage, must be meticulously documented. Proper documentation includes dated notes, ex-
hibit registers, chain-of-custody forms, and photographic records. The management principle
of accurate record-keeping ensures that the investigation survives judicial scrutiny (Joubert,
Page 2 of 15
College of Law
⋄
ASSESSMENT 02
Case Study: UbuntuTel Network Sabotage
⋄
Module Code: FOR3701
Module Name: Forensic Investigation
Assignment No.: Assessment 02
Due Date: 02 April 2026
Semester: Semester 1, 2026
Unique Number: 298986
Submitted in partial fulfilment of the requirements for FOR3701
at the University of South Africa.
,UNISA | FOR3701 Assessment 02 – Forensic Investigation
Question 1: The Forensic Science Laboratory and Investigation Management
1.1 The Role of the Forensic Science Laboratory
The Forensic Science Laboratory (FSL) is a critical resource within the South African Police
Service (SAPS) that provides scientific analysis of physical evidence to support criminal
investigations (SAPS, 2024). In the UbuntuTel case, where deliberate infrastructure sabotage
is alleged, the FSL could contribute in several important ways.
Physical evidence from the sabotage sites. The FSL would examine fibre cables that were
cut to determine the tool type used, the angle and technique of the cut, and whether tool
marks left behind match any implements found in the suspect’s possession. Tool mark com-
parison is a standard FSL discipline that can associate a specific instrument with physical
damage (Joubert, 2021). In this case, if Mr. Naicker S is linked to tools consistent with the cut
patterns, this constitutes corroborating physical evidence.
Fingerprint and DNA analysis. The FSL’s Biology Unit and Chemistry Unit could process sur-
faces at the tower sites, including exposed cable ends, reconfigured routers, and removed
modem housings, for latent fingerprints and biological material such as skin cells or sweat
traces. The FSL Biology Unit has the capacity to process low-template DNA samples and
compare them against the national forensic database or elimination samples taken from the
suspect (Olckers et al., 2013). A fingerprint or DNA match placing Mr. Naicker S at the exact
point of tampering would substantially strengthen the prosecution’s case.
Digital and electronic evidence analysis. The removed SIM-based remote-access modems
are electronic devices. The FSL would extract and analyse any residual data from these de-
vices, including configuration logs, last-used timestamps, and internal memory records, to
determine when they were last accessed and by whom (ACFE SA, 2015). This type of analysis
falls within the FSL’s Scientific Analysis Unit.
Analysis of WhatsApp evidence. The retrieved WhatsApp messages indicating a threatened
network shutdown would be processed by the FSL’s Question Document Unit to verify their
authenticity, confirm they were not altered after extraction, and establish a chain of custody
for their use as evidence in court proceedings (ACFE SA, 2015).
CCTV footage enhancement. Where CCTV footage is unclear or degraded, the FSL can apply
image-enhancement techniques to improve the resolution and clarity of vehicle identification
Page 1 of 15
, UNISA | FOR3701 Assessment 02 – Forensic Investigation
details, including licence plate numbers.
Report for court proceedings. Critically, the FSL produces formal forensic reports by qualified
forensic scientists who can testify in court as expert witnesses. Their evidence is presented
in a format admissible under the Criminal Procedure Act 51 of 1977 (CPA), and the courts have
repeatedly affirmed that FSL-produced scientific evidence carries substantial weight when
properly documented (Olckers et al., 2013).
Implementation Insight
In South Africa, the FSL currently operates under SAPS and is the only state-authorised
laboratory for criminal case work, as provided in section 212 of the Criminal Procedure
Act 51 of 1977. The investigator must ensure all evidence submitted to the FSL is ac-
companied by a proper exhibit register and chain-of-custody documentation to prevent
any challenge to the integrity of the results.
1.2 Two Management Principles Applicable to this Investigation
Effective forensic investigation depends on sound management principles that guide how the
investigation is planned, coordinated, and conducted (Joubert, 2021).
First principle: Coordination and communication. A complex infrastructure sabotage case
such as UbuntuTel involves multiple agencies and specialised units: the FSL, digital forensics
teams, CCTV analysts, the employer’s internal audit team, cellphone network providers, and
potentially the Hawks or SAPS Commercial Crime Unit. The principle of coordination requires
the lead investigator to establish clear communication channels between all parties, assign
defined roles to each team, and schedule regular progress briefings to ensure that evidence
streams are not worked in isolation (Joubert, 2021). Without coordination, duplicate work is
carried out, critical timelines become confused, and evidence may be inadvertently compro-
mised. In this case, the internal audit team’s findings about internal access routes must be
shared in a structured manner with the forensic team so that digital evidence collection is
directed effectively.
Second principle: Documentation and record-keeping. Every investigative step, from the ini-
tial site inspection at the sabotaged towers to the retrieval of WhatsApp messages and CCTV
footage, must be meticulously documented. Proper documentation includes dated notes, ex-
hibit registers, chain-of-custody forms, and photographic records. The management principle
of accurate record-keeping ensures that the investigation survives judicial scrutiny (Joubert,
Page 2 of 15
