A toxic mix of hate and misinformation sent waves of xenophobic violence across Gauteng this week. The police's response to the violence, which kicked off in earnest in Johannesburg, last Sunday, was largely reactive.They rounded up and arrested hundreds, and engaged in running battles with angry mobs in Johannesburg, parts of the East Rand and Pretoria. By the time the violence subsided, 10 people were dead. But a confidential briefing document News24 has seen, shows the many warnings available to the government and law enforcement authorities that attacks were being planned, and that something deadly was brewing. This, combined with other news sources, shows how xenophobic threats spread on social media in the lead-up to the attacks. The police told News24 that they believed the attacks, which began on September 1, were triggered by a spontaneous fire, that could not have been prevented with intelligence, and that the incidents were mainly criminal in nature, and not necessarily xenophobic. But the document and publicly available evidence raises critical questions about how much the country's law enforcement and intelligence agencies knew about the wave of attacks, and why they seemed unable to prevent it. READ: Gauteng xenophobia attacks akin to 2008 crisis - Institute of Race Relations The briefing document also shows that the government believes more violence could be coming.The document sets out the background to the attacks, the key influence of social media, an assessment of the current situation, a prognosis and also mitigating measures. It concludes that the key drivers of anti-migrant sentiment are that migrants are involved in crime, allegations of the illegal occupation of RDP houses, the employment of migrants instead of locals, the dominance of migrant-owned "tuckshops" in informal settlements and the influence of social media. 'Not conclusive' that attacks were xenophobicPolice spokesperson Brigadier Vishnu Naidoo told News24 that much of the violence was opportunistic and criminal, not necessarily xenophobic. "It is not conclusive that these attacks were motivated by anti-foreigner sentiments. "On the contrary, of the seven people that died during the violence, no more than two were of foreign nationality, the rest were South Africans. So could this be xenophobic?" Naidoo said that while intelligence could not have helped the police pre-empt the violence, they were able to prevent further violence thanks to intelligence gathering. READ: SA man shot dead in Springs during looting of foreign-owned shop"The violence which erupted in and around Johannesburg since Sunday, September 1, 2019 was spontaneous and it stemmed from a flat that was burnt by a jealous lover. Those that were involved in the violence were none other than opportunistic criminals. This is not a situation that the intelligence environment could have anticipated. "Having said that, due to rapid intelligence gathering when the violence erupted the Johannesburg area, within over 90 people were arrested within hours of the violence erupting and the arrests continued. Furthermore, it was also purely due to intelligence we were able to contain violence within the trucking industry as well as arrest over 20 suspects in KwaZulu-Natal."There has been continuous multi-disciplinary integrated consultation with representatives in the trucking industry as well as with communities through various community structures," Naidoo said. A timeline leading up to the violence Two migrants were among the 10 people killed in the attacks in the past week, as confirmed by President Cyril Ramaphosa in an address on Thursday night. He also confirmed that 423 people were arrested in Gauteng in connection with the violence. The briefing document sets out a timeline of events leading up to the attacks this week. As indicated in the document, it can be summarised as follows:April 2019: threats by migrants to retaliate against attacks, indicating that attacks were already taking place;August 1, 2019: social media messages distributed, calling on the army to be brought in to start a five- to six-year operation to rid the country of illegal immigrants;August 7, 2019: messages calling for South Africans to meet in Joubert Park, Johannesburg, as the country is "under siege" by migrants;Voice notes calling for migrants to meet at 15 destinations across Johannesburg and Pretoria on August 30, 2019 (the purpose of the meetings is not known and they did not materialise);August 29, 2019: Nigerians marched on the High Commission in Pretoria asking for protection from their government against attacks;Flyers circulating, threatening the stoppage of trucks driven by migrants on September 1 and protests planned for the following day;A strike planned for September 1 by the All Truck Drivers Forum threatening the closure of 8 ports of entry to truck drivers, which did not materialise;Messages on social media indicating which companies would not be targeted by the looting because they had employed 90% locals (it is not clear when these messages were circulated);Messages threatening that anyone who did not support the truck strike on September 1 in the Knights, Jerusalem and Angelo squatter camps' homes would be burnt down, and that migrants must "fokof or face what's coming". There was a request that police in Boksburg be put on alert.READ | Misleading social media posts fuel tensions over xenophobic violence gripping SA What isn't in the documentThe violence that began on September 1 appears to have been triggered by two events: in Tshwane, migrant-owned shops were looted and set alight when a taxi driver was shot dead, allegedly by a drug dealer; and in Johannesburg, the first reported incidents of looting took place in the early hours of Sunday, September 1, after an abandoned building burnt down in the city centre, killing three people. (It is this fire which the police said started the "spontaneous" violence.) The looting quickly took on a xenophobic character as it spread to other parts of Johannesburg, Tshwane, and Ekurhuleni, particularly in areas where there were a high number of migrants.Curiously, these events are not mentioned in the briefing document. It is not clear whether the document was written retrospectively or whether this was information available to law enforcement agencies at the time. But it shows what law enforcement agencies now know: there were many warnings of the violence to come.For example, the document details a march and a plea by Nigerians to their high commission in Pretoria for protection, just days before the September 1 and 2 attacks.READ: Nigerian president to visit SA to smooth over diplomatic tensionsThe document notes xenophobic attacks going back to 2005, and traces their development through the notorious 2008 killings, to the flare-ups in 2015 and 2018. It shows the spread of hate on social media and WhatsApp in the last few weeks. One interpretation of the document is that, at the very least, law enforcement officials should have been on high alert throughout the month of August.The information missing from the document is almost as important as the information it contains.For example, it also does not mention a warning to police in Tembisa that a pamphlet was circulating, promising that migrants would be attacked, also days before the first high-profile incidents.But there were more warnings that anti-migrant sentiment was brewing that the document does not mention.The document makes no mention of the attacks on migrants in Johannesburg and Tshwane in August, that took place in tandem with police raids on shops and informal traders. "We can't co-govern with criminals, especially migrants who want to turn our country into a lawless banana republic" These were also xenophobic in nature, stoked by anti-migrant rhetoric, linking migrants to inner-city criminality and the sale of counterfeit goods, as reported by New Frame.New Frame reported that Gauteng Community Safety MEC Faith Mazibuko said: "We can't co-govern with criminals, especially migrants who want to turn our country into a lawless banana republic."The raids, and the violence, continued in Tshwane.Xenowatch, a xenophobic monitoring tool developed by the African Centre for Migration & Society (ACMS) at the University of the Witwatersrand, also notes a number of other attacks leading up to the September break out.Xenowatch's data and news reports, although by no means an exhaustive list, point to several other attacks and brewing anti-migrant sentiment:July 19, 2019: reports of looting of migrant-owned shops in Ivory Park;August 7 and 8, 2019: reports of looting and attacks on migrants in Johannesburg;August 14: reports of looting of migrant-owned shops in White City, Moletsane, Mdeni, and Zola;August 15: reports of looting of migrant-owned shops in Orlando, Pimville, and Diepsloot;August 18: reports that locals went on a "rampage" in Orange Grove, Johannesburg, chasing migrants from their homes and vandalising their belongings. This was reportedly over allegations that used coffins were being resold to funeral parlours in the area;August 29, 2019: a letter inviting South Africans to join the Sisonke People's Forum to "get rid of foreigners". A shutdown was planned for September 2, and protests were planned for Tembisa and other areas. Xenowatch's project manager, Lindile Mlilo, confirmed to News24 that this threat was verified and reported to Tembisa police, with a request for the police to monitor the area.But Naidoo said that this was one of many social media threats which was found to "have no substance"."The warning that is being referred to [in Tembisa], I am told, [was] no different to the multiple messages that were being circulated on several social media platforms, including WhatsApp and Twitter. Such messages were indeed followed up and found to have had no substance. Unfortunately, the same messages were being repeated on the same platforms compounding the situation," he said.READ | Fake, old or not from SA: Don't believe '99%' of the viral Xenophobic messages, police warnNaidoo also said that a number of arrests had been made on a variety of charges."I can confirm that an additional seventy-four (74) persons were arrested in Katlehong last Thursday, bringing the total to four hundred and ninety-seven (497) arrests since the violence erupted in Johannesburg just under a week ago. In the meantime, the 22 people that were arrested in Tshwane over a week ago were released pending further investigation as per instruction of the court."The charges ranged from public violence, arson, malicious damage to property, theft and possession of stolen property, possession of unlicensed firearms and ammunition, attempted murder and murder."It is also our view that the collaboration with other law enforcement agencies, government and political leaders, community leaders, the taxi industry, Izinduna, and other key stakeholders in the province, Crime Intelligence has managed to restore a sense of stability in the province."While there has been a significant decline in the number of incidents, security forces remain on high alert and are closely monitoring all hotspot areas in the province to ensure that further violence does not erupt. Prognosis of the situation It's apparent that law enforcement's assessment is that the anti-migrant sentiments will continue "due to a multiplicity of factors" and that things could get worse as retaliation is likely. "The injuring or fatal shooting of locals by migrants who attempt to protect their property, holds the potential for wider actions being taken against migrants," it warns."In the event that migrants are targeted, it is anticipated that there will be some form of retaliation on the part of migrants. Once such events occur in the informal settlement and other areas, it is likely that the incidents will spread to neighbouring areas in a similar fashion to that experienced in 2008."The document also stresses that the dissemination of social media messages threatening migrants or demanding that they leave, will exacerbate the situation as it drives fear and intimidation. It also issues an ominous warning of the impact of the attacks on South Africa's socio-political and economic position."The ongoing incidents where trucks are targeted allegedly due to the fact that they are driven by migrants has the potential of having a far wider socio-economic impact if not contained."A separate high-level document was also presented to the National Joint Operational and Intelligence Structure and the Justice, Crime Prevention and Security Cluster.It outlines an ambitious six-pillar approach from the government.