Opening the Road for the Fall of Apartheid, from Alberta
In 1987, on the Tallcree reserve, just a few hundred kilometres north of Edmonton, a South African refugee and schoolteacher named Joe Pillay quietly became a node in Operation Vula. Vula means “open the road” in isiXhosa, a fitting choice for the African National Congress’s encrypted command-and-control network. Vula was the secret backbone that kept exiled leaders in Lusaka in touch with operatives inside South Africa and supporters in Europe, Africa, and Canada. Its hardware came from an Edmonton computer store.
Pillay’s path to northern Alberta was not one many people would choose. On February 17, 1981, four South African security agents broke into Joe’s home in Manzini, Swaziland. They told him, “You’re a terrorist, you’re a communist, we’ve come to take you,” and abducted him across the border. After three weeks of torture, he was released back to Swaziland, where he stayed four more years before claiming refugee status in Canada. He and his Canadian partner, Barbara, settled at Tallcree and went to work teaching.
In 1987, Joe’s brother Ivan — operating out of Zambia, deep inside ANC liberation work — flew to Alberta after an anti-apartheid conference in Toronto and asked Joe to join the operation. Joe joined Vula but kept the operation hidden even from Barbara.
Talking with Vula
One day, Joe visited a computer store in Edmonton and walked out with early laptops and modems he’d been instructed to purchase for Vula. Tim Jenkin, Vula’s architect, now best known for his 1979 prison break (Escape from Pretoria), came to Tallcree from London to train Joe how to set up and use the early encrypted email system he had devised.
Jenkins trained Vula’s network operators in manual one-time pad encryption. It was all ad hoc and experimental. Jenkin’s own self-taught efforts evolved from radio systems at first to personal computers when they became small and affordable.
Once Pillay was activated, encrypted messages flowed to and from northern Alberta: intelligence to Lusaka via London, coordination on Canadian divestment campaigns, recruiting notes, and, threaded through all of it, brothers asking each other about family.
In Talking with Vula, Jenkin describes the technical system as “rickety” and says he is still surprised it worked. He has noted that by 1989, the ANC was taking it for granted, and “none of us realised how dependent the entire operation had become upon it.” Computers were “eminently suitable for boring, repetitive tasks — and that’s what we had on our hands.”
Edge caching with human intelligence
In modern networking terms, Vula used London as a form of caching with edge intelligence. London functioned as a smart proxy that knows the policy of the origin server well enough to answer common queries without going to the origin. This reduces latency, reduces load on the slower link, and reduces the operational risk of waking up Lusaka unnecessarily. Jenkin’s network was doing what CDNs do, except the cache was a few people in a London flat who had internalized the ANC’s positions on many operational questions.
The CDN-like nature of Vula complicates the standard “hub-and-spoke” reading that Jenkin has expressed in interviews and documentaries. The network wasn’t merely shaped that way for traffic-routing efficiency — the hub was generative, producing answers, not just forwarding data. The trust delegated to the London station wasn’t just “you won’t betray us,” it was “you know the line well enough to speak for us.”
Joe Pillay, running the Alberta spoke, was doing something analogous on a smaller scale: not just relaying, but representing. Lobbying the Canadian government, recruiting Canadian sympathizers, feeding context up the line. The peripheral nodes in Vula weren’t dumb endpoints — they were doing local political work that the hub didn’t have to micromanage because the trust was already there.
Freeing Mandela while he was still in prison
The crowning moment, in Jenkins’ telling, was Mandela. He had no warning that Mandela’s reports were going to come through Vula — they arrived via lawyer-smuggled book covers. Mandela’s words were typed up and encrypted, finally appearing on Jenkin’s London screen. Mandela was negotiating the terms of his own release while the Apartheid regime believed he was isolated. According to Jenkin, the regime “thought they had Mandela nicely isolated in the prison and that the views he espoused were his own. Little did they know that everything he said was in fact the ‘party line.’” Vula prevented the separation that apartheid was trying to engineer between Mandela and the exiled leadership.
Sophie Toupin’s doctoral research on Vula — a dissertation that genuinely deserves to be a book — surfaces the Pillay family’s story and other Canadian histories like it. She frames Vula not just as communications technology but as a solidarity infrastructure: a system whose security model was, at heart, a network of deep human bonds.
The cryptography and tech story is fascinating all on its own. Tim Jenkin has open-sourced the codebase, and John Graham-Cumming has written publicly about helping decrypt the archive.
I came to this story through Graham-Cumming’s technical breakdown of the Vula codebase. The deeper I followed the threads — Toupin’s piece on hacking apartheid at Beautiful Trouble, her e-flux essay on the ANC’s internet, and Jenkin’s own articles and slides — the more it felt like a story everyone (especially Albertans) ought to know.
An Indigenous reserve in northern Alberta became a node in resistance against a state built on racial hierarchy and land theft.
Technical systems grounded in communities of trust
The contemporary parallel that comes to mind is the difference between a dumb VPN and a federated system like Mastodon or email — a Mastodon instance admin makes real moderation calls without checking in with a head office, and the network functions because trust has been delegated all the way to the edges.
Vula was doing this in 1988 with floppy disks, audio cassettes, early portable PCs, and an 1880s encryption method that still has a property no other system has: information-theoretic security, also called perfect secrecy, proven by Claude Shannon in 1949. One-time pads are not scalable to a modern network context, but they work in contexts like Vula: relatively short messages, low message volume, extremely high stakes, and a relationship between parties that justifies the courier overhead of pre-sharing pads. The Moscow-Washington hotline used OTP. Some diplomatic services (and spies) still do.
McLuhan called Canada the land of the DEW Line — a country on the periphery with a clearer view of the changes happening at the centre. The Distant Early Warning radar stations along the Arctic looked outward, watching for Soviet bombers that never came. Less remembered: in the late 1980s, another communications infrastructure was running through the Canadian north, focused in the opposite direction. Not surveillance from the periphery, but liberation traffic from it.
Why Vula Worked
Jenkin’s account points to several interlocking reasons, none sufficient on its own.
- The cryptography was unbreakable. Vula used one-time pad encryption — provably secure if implemented correctly — with floppy disks of random data as the key, and the keys were automatically wiped from the disks during encryption. The system was never cracked.
- The system hid in the open. Acoustic-coupler modem sounds were recorded onto cassette tape, played into a public payphone, and picked up by an answering machine in London. To South African telecom monitoring, what flowed across the wire sounded like a routine international call to an answering machine. Encrypted modem squeaks on tape are not particularly distinguishable from line noise unless you already know to look for them. The point of using London as the hub was precisely that traffic to and from London did not look suspicious; a direct line to Lusaka would have stood out.
- Topology over centralization. Vula was a hub-and-spoke network centred in London, with long-distance spokes to Canada, South Africa, and Zambia. Different nodes had different security postures — Tallcree, Amsterdam, and Yorkshire used ordinary commercial email with the same encryption program, since their security demands weren’t the same as the South Africa link. London, while central, was a laundering node. Senior operators based there, like Jenkin, could “short-circuit” many messages because they often knew the answer to questions an operative inside South Africa was sending up to Lusaka via London.
- Trust was hand-built, not algorithmic. Toupin’s “solidarity infrastructure” framing of the story rests on this: the people in the network were vetted by years of struggle, kinship, and political commitment. The cryptography secured the wire; trust secured the endpoints. Jenkin tends to undersell it in his technical writing, but everyone studying Vula has flagged Vula’s close human relationships as decisive.
- The state didn’t know to look for what it was seeing. Apartheid’s security apparatus was watching for couriers, radio transmissions, and dead drops — not for activists in suburban Johannesburg playing cassette tapes into payphones. Vula was illegible as a category to its adversary.
Would Vula Work Today?
Here’s where Jenkin himself gets honest about his limits. Asked by Michele Fossi in 2018 what tools resistance groups now use and how they compare to Vula, his answer was direct: “I’m afraid I can’t answer these two questions because I don’t know. In the 1980s, before the internet era, there were almost zero secure communication options, so you had to invent your own.”
“The new human occupation of the electronic age has become surveillance.“
The cryptographers and signals-intelligence community who’ve looked at the system since are blunter. Vula was novel and secure in the 1980s, but it would carry serious risks today.
The wire is no longer dumb. Modern telecom records every call’s metadata, and often the audio itself. An anomalous acoustic signal in a payphone call could be flagged within hours by the kind of pattern-matching that’s now routine.
Endpoints are no longer cold. Vula’s laptops were single-purpose devices that sat in a drawer between uses. A modern smartphone is a continuously leaking sensor with location, accelerometer data, ambient audio, contact graphs, and a supply chain users don’t control. An often-repeated cryptographer’s complaint applies — “the NSA doesn’t break your crypto, it goes around it.” Endpoint compromise is the threat model, not algorithmic weakness.
Metadata became the new content in the Internet and mobile phone era. Even with perfect encryption of message contents, the graph of who-talks-to-whom-when is itself revealing — sometimes more revealing than the messages. Vula’s hub-and-spoke topology would now be visible as a topology even if it remained unbreakable. London-as-hub worked partly because traffic analysis at scale wasn’t yet possible.
Air gaps are harder today as well. Antoinette Vogelsang flew Toshiba laptops between Amsterdam and Johannesburg in her flight bags, and the apartheid border security didn’t image them. Modern border searches at any major airport could. Vula’s logistics relied on the relative novelty and innocence of consumer hardware within the relative bluntness of state inspection. Both have flipped.
“Only the small secrets need to be protected. The large ones are kept secret by public incredulity.”
Lessons from Vula
- Use unsuspicious infrastructure rather than building obvious infrastructure. Vula didn’t run on its own network; it piggybacked onto the regular phone system. The contemporary equivalent is using whatever everyone else uses — Signal, mainstream messaging, normal-looking traffic patterns — rather than standing up something custom that lights up as unusual.
- Distribute trust through human bonds, not credentials. The kinship-and-commitment endpoints model is the part that scales least. Technology makes it worse, not better. AI-era authentication problems make Vula’s “we trust this person because we lived in exile/were in prison together for ten years” model look extremely robust by comparison.
- Solve the problem with the tools at hand, not the tools you wish you had. Jenkin’s modesty about the rickety system is the methodological point. He didn’t wait for ideal cryptographic primitives; he built digital one-time pads and distributed them on ubiquitous floppy disks.
- Hope is logistical. The Mandela channel worked because somebody doctored book covers, somebody else typed the notes up, and somebody else wiped the disks. The cryptographic work was the smallest part of the operation, in terms of the time it took people to perform.
Leave a Reply