By the time Lieutenant Colonel Charl Kinnear – a key member of the police’s Anti-Gang Unit – was murdered outside his home in Cape Town, the cellphones he carried had been illegally tracked thousands of times.
His death revealed a murky spy world where cellphone tracking technology, meant to be the exclusive preserve of law enforcement, was used to track hundreds of people illegally.
The man thrust into the spotlight in this previously opaque realm is Zane Kilian – one-time rugby star turned debt collector – whose fall from grace has seen him charged with the murder of the decorated career policeman.
Kilian is alleged to have used Location Based Services, technology whereby a cellphone number can be used to track the location of the phone, to stalk Kinnear over a period of six months more than 2 400 times – up until just minutes before he was killed.
Using this technology, signals were clandestinely sent to Kinnear’s phone and his location, linked to the cell tower nearest him, was beamed back, much like a sonar pulse. This is called a “ping”.
Through well-placed sources, News24 obtained a trove of ping data believed to be linked to Kilian.
In its unprocessed form, the data set reads as a Byzantine list of thousands of cellphone numbers and the location information associated with them when the pings were executed.
For six weeks, we trawled through the list in an effort to identify those who had been spied on.
The data revealed that, in 17 months, Kilian used a software platform on his phone to track as many as 680 people, using 5 308 pings.
Among them were key police officials in the Anti-Gang Unit (AGU) Detective Team C, including Kinnear’s partner.
He monitored businessmen, doctors, and bankers.
He tracked politicians, civil servants, and lawyers. He also kept tabs on notorious gangsters and high-profile figures in the underworld.
His activity on the platform suddenly stopped on the day Kinnear was murdered.
These cellphone pings were weaponised, not only to illegally monitor movement, but allegedly to threaten, extort, and intimidate. Some of those he tracked survived attempts on their lives, others have been killed.
Each pulsing green dot denotes a singular ping which turns red as the number of pings at the same location increases. Nearly all were illegal. This is how Zane Kilian became a spy.
These are all real locations of people Kilian tracked in Johannesburg...
And in Cape Town...
And more than 2 400 times Kilian tracked Kinnear...
5 308 pings, 688 people tracked. Most were illegal.
Over 17 months, Zane Kilian unlawfully tracked hundreds of individuals. He claims he is innocent.
Murder accused Zane Kilian not only monitored the movements of slain top cop Charl Kinnear, but also high-ranking Western Cape police officers and members in the Anti-Gang Unit, including Kinnear's partner.
A News24 investigation has revealed the extent to which Kilian abused the system - setting his sights on the gangbusters.
The AGU is a police unit, formed in November 2018, aimed at combating the illicit activity of violent gangs and organized crime syndicates that have operated in the Western Cape for decades.
Of Killian’s 5 308 pings, 2 442 were dedicated to finding Kinnear using three different cell phone numbers.
Kilian’s tracking of Kinnear first began on 3 March, when he executed a ping on the cellphone issued to the detective by the police. Our analysis indicates that Kinnear was tracked using three separate cellphones up until the day he was killed.
News24 reported this week that Kilian had been paid at least R2.3-million over the same time period he was conducting unlawful pings on Kinnear and other underworld figures.
Interviews with and documents from sources close to the investigation around Kinnear’s murder revealed that Kilian has also allegedly named his paymaster, which his family denies.
The person, whose identity is known to News24 and is named in documents only as Mr X, cannot be named as they are yet to be arrested or charged.
An analysis of Kilian's pining shows how he tracked Kinnear on multiple trips to Johannesburg, where Kinnear was in the grips of a massive firearms licensing fraud case that has resulted in the arrest of several underworld figures and high-ranking police officers.
Cutting off a steady supply of guns and ammunition to the underworld had, a police source said, been a hammer blow. This had made Kinnear and enemy of corrupt cops, and those who stood to gain from the weapons pipeline
At 15:25 on 18 September, minutes after an unknown gunman had opened fire on Kinnear as he sat behind the wheel of his car, Zane Kilian executed his final ping on a cellphone number he had tracked in minute detail for more than five months.
On the day of the murder, Kilian first tracked Kinnear with a ping at 02:32, which placed him at his home. He would go on to track the cop 38 times on that day, following him from his office to central Cape Town for a provincial command meeting, and back again, before he headed homeward.
According to our analysis of Kilian’s ping history, he is alleged to have targeted the following SAPS officers:
- Major General Jeremy Vearey, head of detectives in the Western Cape. Vearey was tracked only once, on 15 September, three days before Kinnear was killed.
- AGU boss Major General Andre Lincoln’s movements were monitored on 58 separate occasions, starting on 5 June. Finally, his phone was pinged three times times on 17 September, the day before Kinnear was murdered
- Sergeant Letitia van der Horst, Kinnear’s partner, had her movements monitored with 70 individual pings. She was first tracked on 5 May. The last ping executed was on September 17.
- Captain Althea Jeftha, another ranking officer in the AGU, was tracked four times between June and August.
- Constable Filton Abrahams, understood to be a detective in the AGU, was subjected to the most intensive spying after that of Kinnear, with his phone tracked on 103 separate occasions. He was first tracked on 15 June and the last ping of his number was on September 12.
“The illegal surveillance of members of law enforcement is of huge concern,” said Gareth Newham, senior researcher with the Institute for Security Studies.
"It suggests that organised criminal networks have become, and are becoming, increasingly sophisticated and are able to access technology to track the movements of those in the state who are dedicated to fighting crime and gangsterism."
Newham said that key in dismantling gang and organized crime networks was an intelligence capability, with the death of Kinnear exposing a critical dearth.
“The basic counter-intelligence approach would be to see what these crime networks are doing and develop the capability to frustrate this, or at least prevent it from becoming a severe threat which we now know it is, because it appears to have been used in the assassination of a key police official,” Newham said.
Beyond members of the AGU, Kilian also cast his net wider, and evidence shows that he tracked the comings and goings of Kinnear’s wife, Nicolette.
Her number was pinged once on April 20 at 17:37.
Through sources with proximity to the investigation in Kinnear’s murder, News24 obtained a trove of ping data believed to be linked to Kilian.
The dataset, in its unprocessed form, read as a list of thousands of cell phone numbers and the location information associated with them when the pings were executed.
For six weeks, we trawled through the list in an effort to identify those who had been spied on.
In understanding how Zane Kilian became a spy using only a cell phone, it is important to start at the beginning.
The 39-year-old is an enigmatic character. In his youth, he made a name for himself as a sturdy prop forward for provincial rugby sides Valke and Griquas.
But when the star of his rugby career waned – amid a steroid scandal which saw him serve a three month ban for using a controlled substance – Kilian had turned to debt collecting and car repossessions as his new trade.
He had worked as a debt collector without being registered with Council for Debt Collectors. He also posed as a private investigator without being registered with Private Security Industry Regulatory Authority.
In ferreting out those who had reneged on payment agreements or those who had spirited away cars he was tasked to find; his panacea was cell phone pings.
Pinging a cell phone determines its location with reasonable accuracy, returning the latitude and longitude of the device real time in real time.
In terms of the Regulation of Interception of Communications and Provision of Communication-Related Information Act, any ping without the express consent of the person being tracked is deemed as unlawful. But this appears to have been cast aside.
“It was common knowledge that Zane could ping phones,” his father, Hein Kilian, told News24.
“He used pings to repossess cars when people didn’t pay their bills. He would ping people who reneged on payments agreements…sometimes if he went to go and find a car I would go with him and he pinged while I drove,” the elder Kilian, a former policeman himself, said.
His foray into the world of pings began in April 2019, when he turned to Bradley Goldblatt; an ex-policeman turned tech privateer who was an agent of a company called 1Track Solutions.
1Track Solutions offered access to a software platform called LAD, which allowed users to purchase pings in bulk. Using the access point to cell networks, a number could be punched into an interface and the location – in GPS coordinates – of that cell phone pushed back.
Once access was purchased and a user profile was generated, Kilian was able to use the software on his cell phone to key in any number and instantly see where the phone was, and thereby track the person carrying it.
Goldblatt, according to impeccable sources, had warned top police management that Kinnear’s phone was being tracked nearly two weeks before he was killed.
Now as a cooperating witness in the case against Kilian, Goldblatt emerged unscathed after a drive-by shooting at his house two weeks ago.
Underworld figures in Kilian's crosshairs
According to our analysis of Kilian’s ping data, the first person he tracked was his wife, Nicolene, on April 30, 2019. The last person he pinged was Charl Kinnear. After his final ping on 18 September, Kilian suddenly stopped using the platform.
In as much as Kilian is alleged to have surveilled key law enforcement officials, News24’s investigation revealed that those who have often found themselves on the wrong side of the law were targeted too.
Chief among them was Jerome “Donkie” Booysen, long rumoured to be at the apex of the Sexy Boys gang.
According to the data set, Kilian tracked Booysen 193 times, developing a stark picture of his movement over the course of four months, beginning on 6 June.
He is also understood to have tracked Booysen’s brother – Colin Booysen – and his son, Joel.
Repeated efforts to contact the three by phone were unsuccessful at the time of publishing.
Kilian too had his sights on other figures who are thought to be actors in the underworld:
Ernie “Lastig” Solomon: On May 29, shortly after noon, Kilian executed one ping on a number that News24 understands was in use by the gang boss.
Solomon, a former leader of the 28s, was gunned down in dramatic fashion in Reiger Park in the eastern expanses of Johannesburg last month.
While driving with his family, gunmen peppered his car with bullets, and he died at the scene.
Nafiz Modack: Long thought to be a power broker in the underworld, he styles himself more as a flamboyant businessman and philanthropist.
Kilian attempted to track Modack’s phone on eight separate occasions, despite the two sharing a cosy relationship.
On March 5, a Facebook profile thought to be controlled by Modack posted that debt collections in Johannesburg should go through Kilian.
Modack said that he and Kilian had a business relationship based on the latter’s prowess as a debt collector.
“Zane came highly recommended and I decided to use him. Our relationship was solely professional. His success rate was very high, there I had recommended him to various lawyers, doctors and so forth to collect their debt,” he said.
On Kilian’s pinging of his number, Modack proffered an explanation that the debt collector worked as a free agent.
“It’s highly likely that a rival may have requested to ping my number, as previously stated in court by his counsel, Zane did not care who he had to ping as long as he was being paid for it.”
“Not that this concerns me in anyway, whoever wanted to come for me must come,” Modack added.
Andre Naude: The former boss of bouncer company Specialized Protection Services (SPS) and a key figure in the security and protection scene in Cape Town, was pinged by Kilian on five separate occasions, thrice in March and twice again on September 5.
In 2014, he was wounded in a dramatic shootout in Belville.
“He wanted to kill me,” he said, responding to questions on why Kilian was tracking his phone.
He did not provide evidence of this claim.
“I have all my hope in the authorities to get to the bottom of this and find out who is behind this. I was warned long ago that my phone was being tracked, not only by Zane.”
“Right after Rashied Staggie was murdered I was told to watch my back,” he said.
On whether the dates of the pings bore any significance, Naude said that on September 5 he hosted a family gathering at his home.
Mark Lifman: Controversial Cape Town businessman and suspected underworld player Mark Lifman was pinged by Kilian on five occasions between March and August.
Lifman said he was aware Kilian had pinged his cell phone, and was aware that another person, whose name is known to him, pinged his cell phone on 3 February 2019, the day he was shot at while playing golf in the Cape suburb of Belville.
When contacted for comment around Kilian’s pings, Lifman said he had passed this information on to the relevant law enforcement authorities, including information on the pinging of his cell phone last year by another individual.
Lifman said the case he registered was closed by police, but he had requested it be reopened in light of new evidence around the pinging of his phone.
Civil servants, politicians tracked
Also featuring on Kilian’s ping list is JP Smith, a Democratic Alliance politician who has acted as a mayoral committee member responsible for safety and security in the Cape Town city council.
Smith was pinged only once by Kilian on 14 September, four days before Kinnear was murdered.
“I have filed an affidavit on this matter which I have submitted to the police pointing out that I was tracked without my consent. Hopefully this will bolster the National Prosecuting Authority’s case against him,” he said.
“It’s of grave concern that he could lay his hands on this technology, the uncontrolled and unregulated use of such needs to be explored,” adding that “the extent to which cell phone service providers may be aware or complicit also warrants exploring.
“This is a breach of the constitution and we hope that this investigation will expose this,” Smith added.
Another critical civil servant who was pinged by Kilian is acting Home Affairs Director General, Jackie McKay.
Diving into the data, it has been revealed that Kilian pinged McKay twice on 30 August between 19:55 and 20:05.
McKay was approached for comment. He did not respond.
While Kilian is facing charges relating to the murder of Charl Kinnear, he has also been charged with attempted murder, conspiracy to commit murder and the illegal interception of communications after a hit attempt on criminal defence attorney William Booth.
Booth survived an attack at his home in Higgovale in the City Bowl on 9 April.
According to an analysis of the Kilian’s ping profile, Booth’s cellphone was tracked 658 times.
The surveillance of Booth began on 6 March with a single ping on that day, exactly five minutes after he pinged Jerome Booysen for the first time.
For several weeks, Booth’s number was the first to be pinged by Kilian each day. Moreover, News24 can reveal that Kilian was also tracking the movements of Booth’s wife Nicolette. She had been pinged twice.
The surveillance of Booth by Killian became fervent in the days leading up to the attack at his home and continued until Kilian abandoned the platform after Kinnear was gunned down.
Debt collector – bloody pigs and threats of violence
While most of Kilian’s surveillance appears clandestine, there were individuals – leaders in business – who knew he was monitoring their movements.
The businessmen had been told this by Kilian himself, and they allege that this was a tool to inspire fear, and one he used to ensure they complied with his demands to pay debts.
Some spoke to News24 about their brushes with Kilian, others remain cowed by fear of recrimination.
“He was tracking me, I know because he told me,” Karl Kebert, a founding director of Starlite Aviation told News24.
Kebert’s phone had been tracked 24 times by Kilian in July and August and preceded what he called a barrage of threats from the former sportsman over a mystery $1-million debt.
“Apparently he was instructed by someone who said I owed them money. He threatened me and swore at me and I put the phone down, and then he continued the harassment on WhatsApp. He said he was in front of my gate and that I could not hide from him forever,” Kebert said.
"He sent me pictures of a pig covered in blood, he sent me pictures of my two cars and my number plates and said that he knew when I came and went. He also threatened my daughter, saying that if I wouldn’t speak to him, he would speak to her."
The supposed debt, Kebert surmised, arose from a jilted investor who lost money in an attempt to buy out the firm. After they went to court for a protection order against the investor, who he refused to name, the threats from Kilian stopped.
Another businessman, who deals in commodities and requested anonymity for fear of reprisal, said that he too was threatened by Kilian.
“He was looking for my business partner because apparently we owed someone money, we could not understand how bouncers got involved,” he said.
“He told me that he was watching my every move, that he knew where I lived and that he would get me,” the businessman added.
At a meeting – one which Kilian did not attend – the businessman was confronted by a group of “very large men” led by someone they called “The Don”.
He would not be drawn on how the confrontation ended.
Andre Botes, a Director of African Mining and Commodities, was too surveilled by Kilian. Botes’ phone was pinged 20 times.
While he was not certain what Kilian was after, he opined that it could have been borne out of a business deal that never came to fruition.
“My privacy has been invaded, there is no question about it. At a stage with Covid-19 we tried to get into the PPE industry, and we were supposed to supply a company in Pretoria with product, but we couldn’t because there was no product available,” he said.
When the deal soured before it started, Kilian made contact.
“He said he was close to me and I was puzzled. He said that he knew where I was at that moment and it showed what he could do, he could track me if he wished,” Botes said.
While there was no overt threat, Botes surmised that Kilian had changed tack and tried to offer his services “in case there was ever a need”.
“I don’t do business like that, I don’t try and get money out of people by force and threats,” he added.
News24 reached out to a handful of the estimated 688 people tracked by Kilian. Anti-surveillance activist Murray Hunter described the scale of Kilian’s surveillance and tracking as “unbelievable”.
“Of course, we have to wonder, if a single player could be doing this much spying, how many other private operators are doing the same?” he questioned.
“The privacy implications are huge for ordinary people who might be targeted, but there's also a serious security risk for police investigators, government officials, and whistleblowers as well.”
“It's a pay-as-you-go spy scheme, the phone networks can't keep pretending this issue will go away. We should be seeing an industry-wide inquiry and testimony before Parliament.”
“How many companies did they sell their customers' location data to? How many dodgy private operators bought their way in? How many people have been tracked?”
In the days after Charl Kinnear was killed, network operators Vodacom and MTN moved to close off their systems, which they acknowledge were abused by Kilian and others. While both operators have launched far-reaching forensic investigations, they have been mum on which companies they had contracted with for access.
A Vodacom spokesperson said: “Vodacom can confirm that the independent audit is ongoing and that we are fully committed to taking appropriate action once the process is completed, including any necessary steps in terms of the Protection of Personal Information Act (POPIA).”
MTN spokesperson Jacqui O’Sullivan said their investigation was extensive and required an audit not only of their own systems, but of all the companies who had bought access.
“The forensic investigation has reached its final stages. We remain committed to completing our forensic investigation as efficiently and as comprehensively as possible, so we are giving the investigators the time they require, to achieve that,” she said.
“While MTN has acted swiftly to investigate the matter and to deal with all parties involved, only once the investigation has been concluded will we better understand the scale and scope of any problem. We will then determine any remedial actions that may be required.”
Last month, News24 submitted promotion of access to information act requests in a bid to understand how many clients of MTN and Vodacom were illegally tracked. Vodacom this week refused to divulge this information, and MTN has asked for a two-week extension to consider our request.
A family affair
For Kilian’s wife Nicolene, if her husband was a spy, he was an unwitting one.
“Everyone knew he could ping, and he would get requests from people he didn’t know, and he would just help. Maybe he didn’t know who he was tracking,” she said.
“I feel like he was used. Whoever asked him to do all these pings has thrown him under the bus and now he is the one taking the fall,” Kilian said.
According to our analysis, she too was pinged 135 times on her two phones. But for this, she said, her husband had her blessing.
“As a medical rep I travel quite a lot and if I was on the road to a hospital that is far away and I forgot to tell him I arrived; he would ping me to make sure that I was safe,” she said.
“Zane is very naïve…I am not just saying this because he’s my husband. He had no idea that pinging people was illegal, he bought it thinking it was it was perfectly legal.”
Kilian would not be drawn to comment on allegations that her husband was quick to make threats of violence, or to intimidate those he intended collecting money from. The image of Zane as portrayed by the media, she said, was grossly inaccurate. "Zane is a big teddy bear. He is a different person when he’s out there doing collections. I just see the man who comes home to me. I am sure he has made enemies. Debt collecting is not a nice thing to do and I think it's expected that he would step on toes."
“I married a man who picks flowers from the pavements when we go for walks… I know the soft Zane. I don’t know the man who I read about and it’s not him. He’s sitting in jail crying his eyes out, he’s depressed, everyone thinks he’s a monster.”
Detailed allegations were put to Kilian’s lawyer, Eric Bryer, who said that until the entire database of Kilian’s pings were put before him, he could not confirm nor deny anything.
While lamenting that this information had been requested from the team leading the investigation, Bryer moved to call into question that authenticity of the evidence Kilian will have to overcome.
“According to my knowledge only two persons had access to pull all the information [together]… the state witness created and knew the login details [of Kilian],” he said.
“How reliable is the information… could the data be altered easily to blame one person and hide the fact that several people did in fact do the pinging,” he added.
He also fired allegations at Goldblatt: “His platform gave access to several questionable people... the whole story is only one sided.”
Bryer will be representing Kilian again when his bail application is scheduled to be heard on 15 December.
The death of Charl Kinnear has drawn back the veil on a murky spy world, and exposed actors who had abused it.
The killing revealed far-reaching surveillance of hundreds of South Africans and shone the light on how access to spy technology – and its use – had become widespread. This investigation shows the prolific abuse of just one of hundreds of individuals who had access to similar LBS platforms.
Zane Kilian was not the man who pulled the trigger that claimed Kinnear's life, but his wanton surveillance is key to the assassination.
Kilian’s attorneys have already explained that Kilian did not know who he was tracking, but our investigation suggests otherwise.
Charl Kinnear was pinged to death. Kilian did the pinging. Now it is for the police to find his paymaster.