Bad news: A common image used by the spoof accounts targets media personalities. But the number one enemy appears to be Finance Minister Pravin Gordhan. His name overwhelmed the search algorithm.
There appears to be a renewed social media campaign to smear Finance Minister Pravin Gordhan and several senior journalists as being agents of white monopoly capital.
Driven entirely on social media, the campaign is orchestrated by an intricate web of spoof social media accounts and appears to be linked to manipulation of the Wikipedia entries about Gordhan and former public protector Thuli Madonsela.
The campaign follows a similar previous one, defending the Gupta family in the aftermath of the release of the public protector report on state capture.
Last November, several suspicious Twitter accounts were identified as part of a expansive sock-puppet web.
Sock puppet refers to a situation in which a person is in control of an account but disguised as someone else — often a single account operating a number of others. When the main account retweets, all the puppets follow.
These Twitter accounts, by retweeting tweets that were either critical of Madonsela’s State of Capture report and major media outlets covering the story, or in support of the Gupta family and their company, Oakbay Resources, created or perpetuated a perception that there was popular support for the beleaguered family.
With the web of fake accounts exposed, an iteration of what is known as #PaidTwitter seemed to die down over the festive period.
But on January 20 this year, several “spoof” accounts surfaced. They closely resembled the legitimate media accounts of Radio 702, The Huffington Post, the Daily Maverick and the Sunday Times. They used an almost identical Twitter name and profile picture, the same images on the profile page and even the same biography entries, save for the addition of the words “parody account”. They included: @dailymaevrick, @Radio 702, @SundayTimessZA, @BiznewzCom and @HuffPostSA.
The Huffington Post has managed to ensure that the account spoofing it has been suspended but the rest remain in operation.
Running the spoof accounts and their legitimate counterparts through the Twitter Archiving Google Spreadsheet — which analyses Twitter activity — the following activity emerges.
Between January 15 and 24 this year, the legitimate accounts tweeted hundreds of times and their tweet patterns are not consistent. But the spoof accounts showed a marked spike — the bulk of their activity occurred on the same day.
All the spoof accounts were created on January 3 but only started tweeting in earnest on January 20. In addition, the spoof 702 and Sunday Times accounts started tweeting quickly after their inception, but seemed to favour international news.
The spoof 702 account also had several retweets of official ANC-linked accounts featuring photographs of former government spin doctor Mzwanele Jimmy Manyi.
A word count analysis indicated that the most used words were “Oakbay”, “Gordhan” and “OakBay”.
Despite a paucity of followers, many of the tweets had many retweets, but it was unclear whether this was as a result of the spoofing — members of the Twitterverse erroneously thinking that these were legitimate accounts — or actual support of the tweets. A familiar pattern emerged after further analysis of these retweets.
Using the prevalence of “retweet only” timelines as a determining factor, the spoof account retweets were scrutinised for suspicious accounts. What emerged was, once again, a controlling hand behind a number of puppets. Using a single tweet, two “clusters” could quite quickly be identified, with a very definite pattern.
The second cluster showed another set of deviations. This probably points to a third as yet undiscovered cluster of sock puppets.
During the investigation into the fake accounts in November last year, it was relatively easy to spot the dubious accounts — a generic profile picture and lack of any biographical entries made identifying them relatively easy. But identifying the controlling handle was harder, because of the use of privacy settings.
This time round, biographies had been added. The accounts are being hidden, being made more inconspicuous and more believable.
But, with a minor bit of research, it quickly became clear that the creators were now copying and pasting Twitter biographies from other users to populate their own.
The word count analysis of these “new” accounts showed a clear pattern — Gordhan was mentioned so often that the algorithm was unable to fit Gordhan in the word cloud, because it would leave too little space for any of the other words. The finance minister was mentioned 499 times, with Absa being the runner-up (361). Davos, white and WMC (white monopoly capital) feature heavily.
Compared with the earlier campaign, the ire of the fake Twitter accounts was increasingly directed at white monopoly capital, Gordhan and Absa, presumably following the public protector’s leaked lifeboat report on Bankorp and Absa.
Besides retweeting, the sock-puppet accounts also had access to the same pool of photos as the spoof accounts. This included an image of “presstitutes” — names and photos associated with the media houses targeted by the spoof accounts:
the Daily Maverick, the Sunday Times, BizNews.com, Radio702 and Ferial Haffajee (now with The Huffington Post).
Last weekend it emerged that the Wikipedia entries of Madonsela and Gordhan were edited.
The Gordhan edit was made in 2012 but the others were recent — in November last year, when the first surge of fake accounts was identified.
Wikipedia tracks edits to any of its entries in an attempt to discourage abuse. The edits were easily tracked but they cannot be traced back to the real people.
On November 18 last year, the Wikipedia entry for Madonsela was briefly changed. Between 6.36pm and 6.39pm, an unidentified user amended her page to reflect that Madonsela was a member of the Democratic Alliance from 2016 onwards. Mysteriously, they undid their changes and left the page as is.
The same user, identified by the IP address as residing in the Pietermaritzburg area, returned to the Wikipedia entry on November 24 at 5.01am. By 5.07am, the page had been amended to reflect not only that she was a member of the DA but also that this had been confirmed by the Western Cape provincial DA.
Similarly, billionaire businessman Johann Rupert’s Wikipedia entry was edited to include several “controversies”. Wikipedia user SouthAfricanWisher created a profile on November 17 2016 at 7.55pm. By 8.11pm, entries had been made claiming that Rupert had been accused of exploiting blacks under the apartheid regime, had close business relations with Gordhan and that the Black First Land First (BLF) movement had accused him and his associates of plundering the state.
The entries use media articles, which, in some cases, are press releases by the BLF, as proof for the amendments.
Comparing the November surge with the recent one, what started out as a few fake accounts retweeting tweets to prop up a narrative has now evolved into a more complex system of “spoofing” legitimate news sources in an attempt to discredit government officials, organs of state and the fourth estate, and even to produce fake news.
When these fake narratives are identified, perpetrators adapt their tactics to avoid detection. The fake accounts do not disappear — they get updated with biographies and profile pictures.
So far, #PaidTwitter in South Africa has been associated with an anti-Gordhan, pro-Gupta narrative. But this week reports emerged of a R50-million campaign purportedly overseen by the ANC in the run-up to the local government elections, which included alleged fake news sites.
Jean le Roux is an independent freelance investigator and researcher. After qualifying as lawyer, he joined the public protector’s office until early 2015