When the Land Bank first acknowledged trouble in January, it described a “temporary disruption” affecting certain internal IT systems.
That was true, in the narrowest possible sense.
Only later, through a parliamentary answer, did the public learn that ransomware operators had exploited a vulnerability in an internet-facing server.
Sure, the Land Bank reported the incident to the police, the Information Regulator, the Prudential Authority and the State Security Agency. The authorities who needed to know were told, all the boxes were checked.
But the public account emerged piecemeal, and only under pressure. There was no coherent explanation of what had happened, how far the damage had spread, how recovery had gone and what would change as a result.
Had this been an outage at AWS or Google Cloud, customers would have demanded a proper post-incident report, and they'd have got it. Because the cloud or SaaS provider who fails to properly account for failure quickly sees its most risk-averse, big-enterprise customers disappear.
Citizens, of course, don't have the option of going to a competitor who takes failure seriously.
The Land Bank incident comes to mind as an example of systemic threat, but the everyday example is Home Affairs. “Our computers are offline” may be the closest thing it has to a government catchphrase, for some reason always delivered only after you have travelled far, found the correct queue, and spent long enough in it to raise a family.
Not everyone at the receiving end will want the fine technical details, but everyone deserves access to those details. Was it the SITA network, ageing local infrastructure, a central application, a database, or a supplier? Is it the third recurrence of the same issue? If so, who is getting fired?
Government departments are already supposed to ask what went wrong. There is just no requirement that they tell us.
In April, Parliament’s Home Affairs committee received briefings from SITA and the CSIR specifically about reducing downtime. The committee said the problem was causing long queues, while the CSIR had produced six recommendations.
The minister said the downtime was largely linked to poor infrastructure.
That is more information than the person standing in the queue usually gets.
Home Affairs is not alone. In May 2025, an ICT outage affected every service offered by the Department of Employment and Labour. The department said it had identified and resolved the root cause, but did not say what that root cause was. Meanwhile, the consequences of the Department of Justice’s 2021 cyber incident were still being felt in July 2026, when Statistics South Africa finally resumed publishing insolvency figures after a disruption of nearly five years.
A right to ask is not a duty to tell
South Africa is not ideologically hostile to open information. Quite the opposite.
The constitutional right of access to state-held information is given practical effect through the Promotion of Access to Information Act. South Africa is a member of the Open Government Partnership, with its current commitments including wider access to budget information and a framework for open data at national and municipal level.
Even deep within the machinery of government IT, there are mandatory standards intended to make systems and data interoperable rather than trapping them inside incompatible departmental silos.
That commitment is real. But there is a difference between a state that permits information to be forced out of it and one that requires its officials to publish uncomfortable information without first being asked.
A mandatory post-mortem regime for IT failures would be horrible for the technologists and managers who would be forced to – proactively – air their dirty laundry. That is exactly why it is so important. We don't need the stuff they like to talk about; we need the information that is likely to embarrass the department, its political leadership, its suppliers, or all three. And we need to give the technocrats who would like to provide that information (and they're there) the power to do so, by not giving them a choice.
Estonia is getting there
I have yet to come across a government that does this properly, but Estonia is a useful case study. Every government outage there does not prompt some enormous independent inquiry, but its Information System Authority publishes regular summaries of incidents and their effects.
In October 2025, for example, it reported that the Population Register had been disrupted from 10.07am to 11.03am, affecting dependent services, including emergency-call processing and identity documents. The cause was identified as a technical database failure.
The kind of detail a large cloud provider would offer in an incident dashboard, for instance.
The same monthly report recorded a separate interruption at an emergency response centre, including when it began, how calls were redirected, when normal operations resumed and that a failed network device was responsible.
We know how to do this. What stopped working? When? Who was affected? Why did it happen? What happened next? Now tell everyone who cares to know, as quickly as possible.
That would already be a considerable advance on “our computers are offline”.
Not every crashed laptop
A public post-mortem should not be required every time a printer jams or an official forgets a password.
The trigger should be public impact – which is absolutely not the same thing as a department choosing to declare an ICT disaster. A public report with a clear deadline should be mandatory whenever an incident seriously interrupts an essential public service, or creates significant safety or financial risks.
(The outage need not be long. A department should not escape scrutiny merely because its system collapses for an hour every Tuesday rather than for a full week once a year.)
As much as the departments will argue otherwise, this is trivial to define. So are the measures that will be required to protect sensitive information; every department should know exactly when and how to redact information that would prejudice an active criminal investigation or that would aid future attackers.
All we need is the timeline, services affected, scale of the impact, contributing technical and managerial factors, performance of backup and continuity arrangements, dependencies on suppliers, and corrective actions with named owners and deadlines.
The machinery for this already exists.
The Department of Public Service and Administration (DPSA) already has a Determination and Directive on Public Service ICT Service Continuity, issued under the Public Service Act and applicable to national and provincial departments.
It already requires the head of a department to ensure the ICT disaster-recovery team conducts a “post-implementation review” after a disaster.
In other words, government departments are already supposed to ask what went wrong. There is just no requirement that they tell us.
The Presidency could fix that as part of the broader digital transformation programme. Get the DPSA to publish a template and a requirement that the report be released within 30 days of an incident, and it is done.
Ideally the DPSA should maintain a central repository, but there are enough vendors and public interest organisations to carry that weight, and who would like to draw conclusions and make recommendations – and watch that commitments are delivered on.
If that does not help stabilise Home Affairs, then nothing will.
Share
