By JOHANNESBURG — The Gauteng Provincial Legislature has taken a hard-line stance against the Department of e-Government, demanding sweeping transparency and an independent forensic investigation following a major security breach on the province’s flagship e-Panic Button platform.
During a tense joint sitting on Monday, 5 October 2026, the Portfolio Committee on e-Government and Research & Development alongside the Portfolio Committee on Community Safety expressed profound dissatisfaction with the department’s handling of the crisis.
The platform, which was designed to bridge public safety gaps and connect vulnerable residents to emergency responders, stands accused of exposing highly sensitive personal records, location histories, and detailed crime reports—including cases of domestic violence and assault.
Lawmakers criticized the Department of e-Government not only for the technical oversight but for a severe lapse in governance and communication. Although the department was alerted to the vulnerability on 21 September 2026, it failed to notify the legislative committees at the time.
Crucially, the Information Regulator was only notified on the morning of the joint committee meeting—roughly two weeks after the department became aware of the breach, raising critical questions regarding compliance with Section 22 of the Protection of Personal Information Act (POPIA).
Adding fuel to the fire, the external service provider responsible for developing and hosting the app appointed its own cybersecurity specialist to conduct a probe. The committees dismissed this internal arrangement as a conflict of interest, maintaining that an entity cannot objectively investigate flaws within its own infrastructure.
“A service provider cannot reasonably be expected to investigate a security failure involving its own system and then have the public accept that process as sufficiently independent.”
Lawmakers have insisted on a fully independent investigation uninfluenced by the service provider, with its comprehensive findings due alongside a preliminary report expected on 20 October 2026. Furthermore, the department has been given a strict seven-day deadline to submit:
- The precise volume of users, records, and images compromised based on the preserved database.
- Official proof of notification sent to the Information Regulator and impacted residents.
- A collaborative safety strategy, formulated alongside the South African Police Service (SAPS) and support structures, to safeguard victims of gender-based violence whose details were exposed.
- Relevant contractual clauses governing data security, liability, and incident reporting.
- Clear metrics on consequence management targeting officials accountable for lax contract oversight.
With public trust hanging in the balance, the committees stressed that the matter transcends a mere technical glitch, hitting at the heart of civic safety for vulnerable communities. While investigations proceed, oversight will remain unyielding to ensure that accountability reaches every corner—from negligent state officials to third-party contractors.
