And while the probe stalls, fresh leaks of more emails have thrown into sharp relief the danger posed to Ramaphosa, as his private communications are seemingly still in the public domain.

News24 has obtained several new emails from the "secure" alexio.online email server, set up by the shadowy cyber security consultant, Alexio Papadopulo.  

The latest leaked emails between Ramaphosa and his advisors centre around discussions of day-to-day matters.  

It is, however, clear that Ramaphosa used the alexio.online email account to communicate for several months after taking up this first term in office.

Meanwhile, it is understood that the Presidency has refused a request by Hawks cybercrime investigators to hand over laptops and other electronic devices used by Ramaphosa's campaign managers to access the alexio.online server, which was set up specifically for his successful ANC presidential campaign in 2017.

Instead, long-time Ramaphosa confidante and advisor Donné Nicol asked for the Hawks to wait until Ramaphosa's judicial review of Public Protector Busisiwe Mkhwebane's report into a R500 000 donation to the CR17 campaign by the late corruption accused Bosasa boss, Gavin Watson, was finalised.

Nicol made the request during a telephone call with the acting head of a division of the Hawks – referred to as the Priority Crime Specialised Investigation – Brigadier Piet Pieterse.

This is despite a warning from Hawks investigators that waiting too long could hinder forensic efforts to identify potential intrusions into the alexio.online email server used by the CR17 campaign leaders.

News24 asked Presidency spokesperson Khusela Diko to comment on the matter twice last year, in October and again in December. Diko did not acknowledge receiving the messages.

A senior member of the CR17 campaign did meet with News24 about this matter, also in December. But after promising to provide feedback, did not do so.

The Presidency was asked in particular whether it was concerned that emails from the alexio.online server were still being leaked, and whether it had taken any steps to secure the server.  

Hawks spokesperson Brigadier Hangwani Mulaudzi confirmed in December that an investigation was ongoing. He said he was not at liberty to discuss any details surrounding the case, as the Hawks "only account to the complainant".

He confirmed on Friday that this remained the Hawks' position.

It has now been almost six months since it first emerged, in Mkhwebane's report, that Ramaphosa's emails had been compromised.

She referred to the emails in vague terms, but used them to conclude that Ramaphosa had lied to Parliament about the R500 000 donation, and further was not honest when he claimed to have had no involvement in fundraising for the campaign.

Unidentified whistleblower

News24 also found Ramaphosa's continued claims that he was not involved in fundraising to be questionable, after obtaining copies of the leaked emails.

Just days after News24 reported the content of the leaked emails, the head of the SAPS Presidential Protection Unit, Major General Wally Rhoode, asked the Hawks to investigate the leak and "possible hacking" of the president's private communications. Ramaphosa has also contended in court papers, filed as part of his legal review of Mkhwebane's report, that she obtained the emails illegally and called on her to explain how she obtained them.

Mkhwebane made reference to an unidentified whistleblower in her report, but kept details about the emails vague. She found that there was "prima facie" evidence of money laundering in how the campaign handled just over R300m in donations, and that the emails were a key component used to reach a finding that Ramaphosa deliberately misled Parliament in November 2018. 

News24 previously reported that cybersecurity consultant Alex Papadopulo, who worked for the CR17 campaign, was suspected of being the leak. However, in interviews with senior police officials close to the investigation, it was revealed that Papadopulo was not a suspect. Papadopulo, who has links to the State Security Agency and SAPS Crime Intelligence, is a shadowy figure who was brought on board the CR17 team by Rhoode. Little is known about his background and training.

News24 obtained a "Server Report" that Papadopulo, who is cooperating with the investigation, authored. It claims that the alexio.online email server remains secure and that the emails were likely obtained through a "front end intrusion". The report claims that the emails were accessed from several IP addresses, including an IP address News24 traced to an internet service provider in India. This means that a laptop, cellphone or tablet used by one of the advisors was compromised and access gained to the emails on that person's device or devices.

A close look at the original leaked emails reveals a URL at the bottom of the page – which is common when an email is printed from an online login portal.

Papadopulo left the Ramaphosa orbit after a falling out with Rhoode in late 2018.

Ramaphosa's review of Mkhwebane's report is expected to be heard in the Gauteng High Court in Pretoria later this year.  

News24