A South African digital forensic expert told the special court in Juba on Friday that suspended First Vice President Dr. Riek Machar declined to provide passwords for his electronic devices, complicating efforts to extract crucial data.
Ratlhogo Peter Calvin Rafadi made the remarks during the 71st session of the trial at Freedom Hall, where judges questioned him on the handling of digital evidence linked to Machar.
Judge Stephen Simon Isaac asked Rafadi why he had not extracted an article from one of Machar’s devices.
Rafadi explained that Machar had not complied with investigators’ requests for the passwords, which prevented access to the data.
“The password was not provided and I kept them sealed all the time. Those articles were inside sealed evidence plastic bags. I didn’t want to tamper with them to protect the integrity of the data in those phones and laptop,” Rafadi said.
He told the court that Machar’s devices had built-in security systems that could result in permanent data loss if accessed improperly.
“They operate with protected built-in security features such as Knox. If interrogated with investigative tools, you are more likely not to recover any data,” he explained.
When asked by Judge Simon who was expected to provide the passwords for Machar’s two devices, Rafadi replied: “The rightful owner is supposed to comply with the investigating officer in providing the password.”
Rafadi added that he had not asked the investigating officer to obtain the passwords from Machar.
He said he initially believed the devices had already been unlocked, as they were received in sealed evidence bags.
He further stated that the investigating officer also did not have the passwords, prompting him to explore alternative technical solutions.
The 40-year-old investigator revealed that he consulted a private digital forensic expert, who informed him that no available tool could unlock the latest Samsung and MacBook devices used by Machar.
Presiding Judge James Alala Deng questioned whether the devices may have been tampered with and expressed concern over the scope of the analysis.
Rafadi assured the court that the devices had not been altered, adding that he only worked on items physically presented to him.
The judge also asked whether any extracted messages suggested that any of the accused had ordered the Sudan People’s Liberation Army-in-Opposition (SPLA-IO) and the White Army to attack the army garrison in Nasir.
“There were various communications with SPLA-IO and there were also calls made by some of the accused. There were also coded languages such as ‘we baptized five of them and we welcome them with songs,’” Rafadi said.
Defence lawyer Kur Lual Kur requested a one-week adjournment to prepare the accused for questioning by the judges and asked that the next session be broadcast live on the South Sudan Broadcasting Corporation (SSBC).
Lead prosecutor Ajo Onyo’Ohisa Issa opposed both requests.
He argued that the questioning would be conducted by the judges rather than the defence and should proceed without delay.
He also warned that live broadcasting could be used to mobilise supporters and pose security risks.
Judge James Alala Deng adjourned the proceedings until Monday, April 27, when the panel is expected to rule on the defence application.
Machar, 73, who is currently under house arrest, faces charges including murder, conspiracy, terrorism, treason, and crimes against humanity.
His co-accused remain in detention under the National Security Service.
Prosecutors allege that forces of the Sudan People’s Liberation Army-in-Opposition (SPLA-IO), allied with the White Army militia, killed 257 South Sudan People’s Defence Forces soldiers — including commander David Majur Dak — and destroyed or seized military equipment worth about $58 million during an attack on a garrison in Nasir in March 2025.
The seven co-defendants are: Puot Kang Chuol (40), Mam Pal Dhuor (37), Gatwech Lam Puoch (66), Lt. Gen. Gabriel Duop Lam (53), Camilo Gatmai Kel (47), Mading Yak Riek (45), and Dominic Gatgok Riek (27).
