In February this year, Rafadi conceded that attempts to unlawfully access Machar’s devices did not succeed after failure to break the password and gain access to the information on the devices, prompting a request for the devices to be sent to Asia.
Testifying before a three-judge panel on Monday, however, the expert said assertions that he was unable to unlock Machar’s MacBook and Samsung device were inaccurate and misrepresented the standards governing digital forensic investigations. Instead, he stressed that any limitations encountered were deliberate and necessary to preserve the integrity of potential evidence.
“I didn’t fail to further interrogate the MacBook and Samsung… the limitation is to protect the integrity because if I failed to protect the integrity, the whole data will be wiped off,” Rafadi told the court.
He explained that digital forensic work requires strict adherence to procedures designed to prevent tampering, corruption, or loss of data. Attempting to bypass security protections without proper authorisation or credentials, he warned, could irreversibly damage crucial evidence and undermine the entire investigation.
However, Rafadi’s testimony went beyond technical clarification, introducing a significant legal dimension to the case. He reiterated his earlier recommendation that Machar face additional criminal charges, citing what he described as a refusal to provide passwords necessary to access the devices under investigation.
According to Rafadi, such non-cooperation may constitute obstruction of justice under applicable cybercrime laws.
“This was based on the cybercrime act, wherein if any person refused to provide support, such as a password, to a criminal investigator of law enforcement, this amounted to defeating the end of justice,” he said, adding that the interpretation ultimately depends on the jurisdiction.
He further noted that courts have the authority to direct accused persons to cooperate with investigators, including voluntarily providing passwords. Failure to comply, he added, could amount to contempt of court and strengthen the prosecution’s case.
The forensic findings are part of a broader case linked to the March 2025 Nasir incident, which resulted in the killing of 257 soldiers from the South Sudan People’s Defence Forces and the destruction of military equipment valued at approximately $58 million. The prosecution alleges that Machar and his co-accused played a role in the violence.
During cross-examination, defence lawyer Anis Tombe Augustino challenged Rafadi’s conclusions, particularly his recommendation for prosecution. The defence has sought to cast doubt on both the methodology and implications of the forensic report.
Rafadi, however, maintained that his position was grounded in both digital forensic principles and legal provisions governing cybercrime investigations. He added that where access to devices is restricted due to missing passwords, investigators may, in some cases, refer the matter to manufacturers for technical assistance—though this process can be complex.
The proceedings are being presided over by James Alala Deng, alongside Judges Stephen Simon Isaac and Pur Majok. The court adjourned the matter to Wednesday, April 15, 2026, when Rafadi is expected to continue his cross-examination.
The high-profile trial involves eight accused individuals, including Machar, and has drawn significant public and political attention. The prosecution team, comprising senior legal figures such as Counsel General Deng Achuil Adija, Dr Sabri Wani Lado, Serafino Simon Mizan, and Filberto Mayuot Mareng.
They are supported by a team of advocates and legal officers, including Ajo Onyo Issa, Gabriel Mading Apach, Deng Mabior Deng, Philip Anyang Ngong, Ajak Mayol Bior, Martha Jobet Jermaiha, James Bone Michael, Peter Garang, and Butrouse Yai Adhiew.
The defence team consists of six lawyers: Dr Geri Raimondu Lege, Kur Lual Kur, Anis Tombe Augustino, Deng John Deng, Warnyang Kiir Warnyang, and Regina Akeriaw Deng.
Major General Basile Thomas Wani leads the prosecution’s investigations, assisted by Brigadier General John Dak. Captain Richard Gachi Apollo of the Internal Security Service is listed as the complainant in the case.
The eight accused persons are Puot Kang Chuol, 40; Mam Pal Dhuor, 37; Gatwech Lam Puoch, 66; Lt. Gen. Gabriel Duop Lam, 53; Dr Riek Machar Teny, 73; Camilo Gatmai Kel, 47; Mading Yak Riek, 45; and Dominic Gatgok Riek, 27.
