How son of DBE HR official was identified as key link in distributing the leaked examination papers

The chairperson of the National Investigative Task Team (NITT), Professor Chika Sehoole, has revealed that a departmental human resources official at the Department of Basic Education (DBE), whose son is a Grade 12 learner, has been identified as a source of the 2025 NSC examination paper leak.

Sehoole was briefing the media alongside Basic Education Minister Siviwe Gwarube on Friday afternoon following the release of the NITT’s interim report into the examination breach.

The leak has been confined to about 40 learners from eight schools in the Tshwane area. 

The DEB had previously interviewed 26 learners whose scripts were flagged during analysis. 

Investigations confirmed that these learners had prior access to examination question papers and marking guidelines.

Sehoole said the department was alerted after identifying an unusual similarity between a candidate’s responses and the official marking guideline for English Home Language Paper 2.

“This suggested an examination leak. Between December 2 and December 11, the department conducted its own investigation,” he said.

Twenty-six learners across seven schools were initially linked to the incident, and 21 of those learners were interviewed.

“The department established that the source of the leak was internal to the DBE National Examinations Office,” Sehoole said.

The NITT was appointed by the director-general on December 15 and held its inaugural meeting the following day. 

It was tasked with establishing both the source and the spread of the leak and reporting its findings to Umalusi by January 6, ahead of the release of results on January 13, 2026.

“We made it clear that we could not confirm anything without establishing both the source and the spread of the breach, as well as identifying learners who accessed the leaked material,” Sehoole said.

The task team aligned its work with DBE protocols used in previous investigations. 

These included forensic investigations, statistical analysis, investigative marking, interviews with learners, invigilators and chief markers.

He said to carry out its mandate, the NITT established six work streams: forensic investigation, statistical analysis, investigative marking, learner interviews, invigilator interviews and chief marker interviews.

“These work streams were guided by three questions: What is the source of the leak? What is the spread of the leak? And who are the candidates involved?” Sehoole said.

The forensic investigation focused on tracing the source of the breach. 

A private forensic firm was appointed to examine electronic devices potentially used in the leak, including cellphones, laptops, smartwatches and examination servers.

Sehoole said between December 12 and December 23, the forensic team imaged 11 devices, including desktops, laptops and exam servers. 

CCTV footage was also analysed, with further analysis ongoing.

The spread of the leak was primarily examined through statistical analysis. 

Initially, he said, 26 candidates across seven schools were identified. 

Following a whistle-blower tip-off, three schools in North West were added, bringing the total to 10 schools.

He said a statistical analysis was conducted to identify anomalous trends in learner performance, both at subject and learner level. 

The analysis was later extended to all schools in the province and nationally to identify unusually high average marks.

Sehoole said investigative marking and verification further assessed the spread of the breach. 

Trained markers examined scripts for identical or near-identical responses, verbatim reproduction of marking guidelines, common incorrect answers, and unusually high scores inconsistent with demonstrated understanding.

Investigative marking was conducted in three phases, he said.

The first focused on Physical Sciences, English Home Language, Life Sciences and Mathematics at seven schools in Tshwane and three in North West. Phases two and three expanded the investigation to additional centres and subjects.

In total, 17 centres were investigated. Subjects audited included Economics, Geography, Physical Sciences, Mathematics, Life Sciences and English Home Language papers 1, 2 and 3. 

He said between 17 and more than 200 candidates were reviewed per centre.

Learner interviews formed the third pillar of the investigation. 

Sehoole said the interviews included learners, parents and guardians and were conducted in phases, alongside administrative verification, invigilator interviews and content analysis of written learner statements.

“All candidates interviewed were required to submit written statements, which were analysed and cross-validated with other evidence,” Sehoole said.

He said interviews with invigilators and chief markers revealed unrelated irregularities but no evidence of further leakage.

According to him, through triangulation of qualitative and quantitative data, the NITT concluded that the leak originated from a secured examination unit within the DBE.

“A departmental HR official, whose son is a Grade 12 learner, has been identified as a source of the leak,” Sehoole said. 

“This was corroborated by learner interviews and statements. The official’s son was responsible for further distribution of the leaked material.”

He said the report confirms that the breach was localised and limited to 40 learners across eight schools in Tshwane.

While Umalusi reported seven schools, Sehoole said the breach actually involved eight schools in the Tshwane area.

Seven papers were confirmed as leaked: English Home Language Papers 1 and 2, Physical Sciences Papers 1 and 2, and Mathematics Papers 1 and 2.

He said while learners reported that additional papers - including CAT, Afrikaans First Additional Language, Geography and Economics - may have been circulated, these claims could not be corroborated by statistical analysis or investigative marking.

According to the NITT, one candidate acted as the primary distributor after the materials left the DBE. 

“Evidence shows the candidate received a USB containing question papers and marking guidelines from their mother, a DBE employee.”

Of the 21 candidate interviews and 17 written statements analysed, he said 40 learners were identified as implicated. 

He said methods of transmission included USBs, WhatsApp messages, screenshots, printed copies and messaging platforms. 

“Some candidates used AI tools, including ChatGPT, to structure responses based on leaked marking guidelines,” he added.

Earlier in the same media briefing, Gwarube announced that the results of the 40 implicated candidates will be temporarily withheld pending the outcome of formal irregularity hearings. 

Each learner will face an independent hearing.

He said candidates found guilty may have results in affected subjects being nullified and could be barred from writing the NSC examinations for up to three sessions. 

“Outcomes will be referred to provincial and national examination irregularity committees, with Umalusi serving as the final arbiter.”

Gwarube confirmed that suspected officials have been precautionarily suspended and that the matter has been reported to the South African Police Service (SAPS).

She said a forensic service provider has been appointed to expand the investigation and identify any additional suspects.

Earlier on Friday, Umalusi CEO Dr Mafu Rakometsi said the breach was localised and did not compromise the overall credibility of the 2025 NSC results.

“While the number of implicated learners currently stands at around 40, consequences will follow if further individuals are identified,” Rakometsi said.

The NITT presented its findings to Umalusi on January 6. He said in 2025, 204,957 learners wrote Physical Sciences, 254,413 wrote Mathematics and 135,090 wrote English Home Language. 

Rakometsi said Umalusi has the authority to cancel certificates even after issuance if irregularities are discovered. 

Learners whose certificates are cancelled must return them within three weeks or face possible fines or imprisonment of up to six months, he added.

simon.majadibodu@iol.co.za

IOL News