Hidden hand drives social media smears

There appears to be a renewed social media campaign to smear Finance Minister Pravin Gordhan and several senior journalists as being agents of white monopoly capital.

Driven entirely on social media, the campaign is orchestrated by an intricate web of spoof social media accounts and appears to be linked to manipulation of the Wikipedia entries about Gordhan and former public protector Thuli Madonsela.

The campaign follows a similar previous one, defending the Gupta family in the aftermath of the release of the public protector report on state capture.

Last November, several suspicious Twitter accounts were identified as part of a expansive sock-puppet web.

Sock puppet refers to a situation in which a person is in control of an account but disguised as someone else — often a single account operating a number of others. When the main account retweets, all the puppets follow.

These Twitter accounts, by retweeting tweets that were either critical of Madonsela’s State of Capture report and major media outlets covering the story, or in support of the Gupta family and their company, Oakbay Resources, created or perpetuated a perception that there was popular support for the beleaguered family.

With the web of fake accounts exposed, an iteration of what is known as #PaidTwitter seemed to die down over the festive period.

But on January 20 this year, several “spoof” accounts surfaced. They closely resembled the legitimate media accounts of Radio 702, The Huffington Post, the Daily Maverick and the Sunday Times. They used an almost identical Twitter name and profile picture, the same images on the profile page and even the same biography entries, save for the addition of the words “parody account”. They included: @dailymaevrick, @Radio 702, @SundayTimessZA, @BiznewzCom and @HuffPostSA.

The Huffington Post has managed to ensure that the account spoofing it has been suspended but the rest remain in operation.

Running the spoof accounts and their legitimate counterparts through the Twitter Archiving Google Spreadsheet — which analyses Twitter activity — the following activity emerges.

Between January 15 and 24 this year, the legitimate accounts tweeted hundreds of times and their tweet patterns are not consistent. But the spoof accounts showed a marked spike — the bulk of their activity occurred on the same day.

All the spoof accounts were created on January 3 but only started tweeting in earnest on January 20. In addition, the spoof 702 and Sunday Times accounts started tweeting quickly after their inception, but seemed to favour international news.

The spoof 702 account also had several retweets of official ANC-linked accounts featuring photographs of former government spin doctor Mzwanele Jimmy Manyi.

A word count analysis indicated that the most used words were “Oakbay”, “Gordhan” and “OakBay”.

Despite a paucity of followers, many of the tweets had many retweets, but it was unclear whether this was as a result of the spoofing — members of the Twitterverse erroneously thinking that these were legitimate accounts — or actual support of the tweets. A familiar pattern emerged after further analysis of these retweets.

Using the prevalence of “retweet only” timelines as a determining factor, the spoof account retweets were scrutinised for suspicious accounts. What emerged was, once again, a controlling hand behind a number of puppets. Using a single tweet, two “clusters” could quite quickly be identified, with a very definite pattern.

The second cluster showed another set of deviations. This probably points to a third as yet undiscovered cluster of sock puppets.

During the investigation into the fake accounts in November last year, it was relatively easy to spot the dubious accounts — a generic profile picture and lack of any biographical entries made identifying them relatively easy. But identifying the controlling handle was harder, because of the use of privacy settings.

This time round, biographies had been added. The accounts are being hidden, being made more inconspicuous and more believable.

But, with a minor bit of research, it quickly became clear that the creators were now copying and pasting Twitter biographies from other users to populate their own.

The word count analysis of these “new” accounts showed a clear pattern — Gordhan was mentioned so often that the algorithm was unable to fit Gordhan in the word cloud, because it would leave too little space for any of the other words. The finance minister was mentioned 499 times, with Absa being the runner-up (361). Davos, white and WMC (white monopoly capital) feature heavily.

Compared with the earlier campaign, the ire of the fake Twitter accounts was increasingly directed at white monopoly capital, Gordhan and Absa, presumably following the public protector’s leaked lifeboat report on Bankorp and Absa.

Besides retweeting, the sock-puppet accounts also had access to the same pool of photos as the spoof accounts. This included an image of “presstitutes” — names and photos associated with the media houses targeted by the spoof accounts:
the Daily Maverick, the Sunday Times, BizNews.com, Radio702 and Ferial Haffajee (now with The Huffington Post).

Last weekend it emerged that the Wikipedia entries of Madonsela and Gordhan were edited.

The Gordhan edit was made in 2012 but the others were recent — in November last year, when the first surge of fake accounts was identified.

Wikipedia tracks edits to any of its entries in an attempt to discourage abuse. The edits were easily tracked but they cannot be traced back to the real people.

On November 18 last year, the Wikipedia entry for Madonsela was briefly changed. Between 6.36pm and 6.39pm, an unidentified user amended her page to reflect that Madonsela was a member of the Democratic Alliance from 2016 onwards. Mysteriously, they undid their changes and left the page as is.

The same user, identified by the IP address as residing in the Pietermaritzburg area, returned to the Wikipedia entry on November  24 at 5.01am. By 5.07am, the page had been amended to reflect not only that she was a member of the DA but also that this had been confirmed by the Western Cape provincial DA.

Similarly, billionaire businessman Johann Rupert’s Wikipedia entry was edited to include several “controversies”. Wikipedia user SouthAfricanWisher created a profile on November 17 2016 at 7.55pm. By 8.11pm, entries had been made claiming that Rupert had been accused of exploiting blacks under the apartheid regime, had close business relations with Gordhan and that the Black First Land First (BLF) movement had accused him and his associates of plundering the state.

The entries use media articles, which, in some cases, are press releases by the BLF, as proof for the amendments.

Comparing the November surge with the recent one, what started out as a few fake accounts retweeting tweets to prop up a narrative has now evolved into a more complex system of “spoofing” legitimate news sources in an attempt to discredit government officials, organs of state and the fourth estate, and even to produce fake news.

When these fake narratives are identified, perpetrators adapt their tactics to avoid detection. The fake accounts do not disappear — they get updated with biographies and profile pictures.

So far, #PaidTwitter in South Africa has been associated with an anti-Gordhan, pro-Gupta narrative. But this week reports emerged of a R50-million campaign purportedly overseen by the ANC in the run-up to the local government elections, which included alleged fake news sites.

Jean le Roux is an independent freelance investigator and researcher. After qualifying as lawyer, he joined the public protector’s office until early 2015

Subscribe to the M&G

These are unprecedented times, and the role of media to tell and record the story of South Africa as it develops is more important than ever.

The Mail & Guardian is a proud news publisher with roots stretching back 35 years, and we’ve survived right from day one thanks to the support of readers who value fiercely independent journalism that is beholden to no-one. To help us continue for another 35 future years with the same proud values, please consider taking out a subscription.

Related stories

Fake trafficking news targets migrants

Exaggerated reports on social media of human trafficking syndicates snatching people in broad daylight legitimate xenophobia while deflecting from the real problems in society

‘We don’t want to be shot to death’

Nigerian protesters have taken to the streets to protest the police’s brutal special anti-robbery unit, which they say profiles tech-savvy youths

‘He ain’t heavy, he’s a policeman and he’s paying . . .’

The story behind Ugandan photojournalist Nicholas Bamulanzeki’s iconic picture of the policeman in the floods

Campaigning together, but on their own

Social media is driving a new – largely anonymous – form of protest in Zimbabwe and Zambia

Facebook threatens ban on Australians sharing news in battle over media law

Australians would be stopped from posting local and international articles on Facebook and Instagram, the company said, claiming the move was "not our first choice" but the "only way to protect against an outcome that defies logic".

Protecting South Africa in the digital information and entertainment age

The Films and Publications Amendment Act aims to protect citizens, but new technology requires that the regulations and guidelines are updated

Subscribers only

SAA bailout raises more questions

As the government continues to grapple with the troubles facing the airline, it would do well to keep on eye on the impending Denel implosion

ANC’s rogue deployees revealed

Despite 6 300 ANC cadres working in government, the party’s integrity committee has done little to deal with its accused members

More top stories

Eastern Cape universities concerned by rising Covid cases

Fort Hare says 26 more students have tested positive while Walter Sisulu University says some of its students have been admitted to hospital.

SAA in talks to recoup R350-million in blocked funds...

The cash-strapped national carrier is in the process of recouping its blocked funds from Zimbabwe, which could go towards financing the airline’s business rescue plan

NSFAS’s woes do not help its mandate

Nehawu wants the scheme’s administrator, Randall Carolissen, to be removed

Unions cry foul over SABC dismissal costs and retrenchments

Broadcaster bodies say claims that a recent skills audit is unrelated to retrenchments are ‘irrational’

press releases

Loading latest Press Releases…

The best local and international journalism

handpicked and in your inbox every weekday