It’s easy to mistake the chaos of a cash-in-transit (CIT) heist for disorder. The screech of tyres, the gunfire, the explosions – it all suggests recklessness. However, if you ask University of Cape Town (UCT) PhD graduate Annie Kok, behind the smoke and twisted metal is something far more calculated: a disciplined, adaptive network that operates with utmost prudence and the resilience of a living organism.
“Organised criminal networks are deeply ingrained in South Africa, yet little is known about their empirical structure,” Kok says. Her interest sharpened during the 2018 wave of CIT robberies when a parliamentary hearing laid bare how little is understood about the extensive networks behind these attacks. “Understanding the network itself, not just the heist, is essential to tackling the problem.”
A seminar by Dr Peter Klerks of the Netherlands Police Academy on social network analysis provided the spark. Kok realised this was the tool she needed to unravel the hidden mechanics of one of South Africa’s most violent criminal enterprises. What emerged from her work is a portrait of a criminal ecosystem as fluid as it is formidable.
These networks, she explains, are not run by the stereotypical kingpin sitting in a smoky backroom calling the shots. Instead, what she terms “criminal cooperatives” – smaller, densely connected clusters – form around a “nucleus” (core) for a specific heist and then dissolve and reassemble in different configurations for the next job.
“Leadership is situational and determined by access to information and critical resources – human or otherwise,” she says. “Cohesion is maintained through multiple overlapping relationships known as multiplex ties – and through `gatekeepers’ who link otherwise separate clusters.
“A CIT cooperative is a resilient structure,” Kok continues. “This flexibility is a defining feature allowing the network to adapt and persist despite arrests or other disruptions, making these networks difficult to dismantle. Even after disbanding, the relationships forged within a cooperative invariably seed future collaborations.”
Recruitment into these cooperatives is not about family loyalty or lifelong bonds. It’s about reputational trust.
A bomber or driver might never have met the group’s nucleus before, but if they have a proven record of skill and reliability in the criminal economy – and can be vouched for by a trusted intermediary – they’re in. “That’s the value of reputational trust,” Kok says. “It allows them to integrate highly skilled strangers while keeping the operation secure and efficient. This helps facilitate a successful heist and reduces the risk of including an informant.”
This balance between operational efficiency and maintaining security against disruption is referred to as the “security-efficiency trade-off”, she explains. The cooperatives remain small and cohesive enough to limit the flow of sensitive information yet sufficiently connected to execute complex robberies.
Kok’s work doesn’t stop at describing the structure.
She used social network analysis to also identify the most strategically important individuals – for example, those who bridge otherwise disconnected clusters – and then ran simulations to see what would happen if those individuals were removed. Although not surprising, the results were conclusive.
“Random arrests, which often happen in reality, barely make a dent in dismantling the broader network,” she says. “But when you strategically target certain people, the network’s ability to coordinate collapses much faster. This kind of intelligence-led policing generally yields good results.”
However, she found that South Africa’s law enforcement currently struggles to generate and act on these insights. The SAPS and Directorate for Priority Crime Investigation are under-resourced, their analysts are siloed from detectives, and their systems are fractured. Cooperation with private security firms that have access to relevant information is also patchy and hindered by distrust.
“Monitoring these networks is labour-intensive and requires highly skilled analysts,” she says, “but these analysts are underpaid, undervalued, and in short supply. We’re simply not set up to compete with networks that can reorganise overnight.”
This challenge is compounded by public and political pressure.
CIT robberies are spectacular crimes, often violent and public. The response tends to be equally spectacular: paramilitary-style raids and high-density policing operations. These yield dramatic images for television, satisfy the demand for visible action, and can produce a flurry of arrests. But Kok warns they are counterproductive in the long-run. “These quick wins actually make the networks more resistant to attacks,” she says. “Every time you disrupt them without breaking up the structure they adapt, evolve, and become harder to eradicate.”
What might surprise many is that this is not a uniquely South African story. Kok notes that many developed countries face high rates of CIT crime – although the level of violence here is extreme.
“Each country has its own unique set of circumstances and challenges, and many countries have come up with bespoke solutions,” she says. “What we need here is intelligence-led policing at scale that is well-resourced, long-term, and targeted.”
Her findings are sobering; there is no short-term fix. Every disruption eventually leads back to recruitment – with death or retirement the only permanent exits. “Many CIT robbers see themselves as professionals,” she says. “They consider this to be a legitimate career like any other. So, although we need appropriate policing interventions to stem the tide, stopping the next generation from continuing the cycle requires a societal shift.”
Kok provides concrete recommendations, firstly calling for the national integrated cash services robbery intervention strategy to be released and implemented without further delay. She advocates for a data-sharing framework between law enforcement and independent researchers with pathways that feed expert analysis directly into operational planning. She also argues for proper recruitment and upskilling of crime analysts, competitive salaries, and the end of siloed operations. Above all, she urges a move away from politically driven “quick results” towards sustained, intelligence-driven interventions that target the network’s structural vulnerabilities.
The methods used by Kok can be applied beyond CIT crime.
“Any organised crime market – from trafficking to illegal mining – is built on the same principles of connections between individuals based on their value and trust,” she says. “In fact, there is much overlap between these seemingly ‘different’ criminal networks. But if we know how to best dismantle one type of network, we can apply that knowledge to similar network configurations.”
Kok’s thesis offers both a blueprint and a warning. It shows in analytical detail how a CIT network forms and functions – and where they can be hit hardest. But it also makes clear that without political will, investment, and a shift in policing approach the country will keep fighting the same battles, with the same results.
“We absolutely must move with the times,” she says. “Complex problems require subtle, evidence-based approaches like network analysis. We need to embrace data and analytics, utilise those who can extract insights from it, and give them access to the required resources. There is also an urgent need for more research on this topic since the case study considered in my thesis is only one part of a much larger picture.”
For all its scientific rigour, Kok’s work carries a distinct human undertone.
She speaks of offenders who consider themselves beyond rehabilitation, of communities where crime has become an acceptable livelihood, and of police officers, security personnel, and many others who remain deeply committed to addressing CIT crime despite immense obstacles.
“Policing can’t fix this problem alone,” she says. “It’s a symptom of deeply rooted, systemic issues, all of which is our collective responsibility.”
Her thesis, titled “Dark networks: a South African cash-in-transit crime case study,” was supervised by Elrena van der Spuy, an emerita professor in the Department of Public Law at UCT. She received her PhD in Criminology on 9 September 2025.