Hidden hand drives social media smears

There appears to be a renewed social media campaign to smear Finance Minister Pravin Gordhan and several senior journalists as being agents of white monopoly capital.

Driven entirely on social media, the campaign is orchestrated by an intricate web of spoof social media accounts and appears to be linked to manipulation of the Wikipedia entries about Gordhan and former public protector Thuli Madonsela.

The campaign follows a similar previous one, defending the Gupta family in the aftermath of the release of the public protector report on state capture.

Last November, several suspicious Twitter accounts were identified as part of a expansive sock-puppet web.

Sock puppet refers to a situation in which a person is in control of an account but disguised as someone else — often a single account operating a number of others. When the main account retweets, all the puppets follow.

These Twitter accounts, by retweeting tweets that were either critical of Madonsela’s State of Capture report and major media outlets covering the story, or in support of the Gupta family and their company, Oakbay Resources, created or perpetuated a perception that there was popular support for the beleaguered family.

With the web of fake accounts exposed, an iteration of what is known as #PaidTwitter seemed to die down over the festive period.

But on January 20 this year, several “spoof” accounts surfaced. They closely resembled the legitimate media accounts of Radio 702, The Huffington Post, the Daily Maverick and the Sunday Times. They used an almost identical Twitter name and profile picture, the same images on the profile page and even the same biography entries, save for the addition of the words “parody account”. They included: @dailymaevrick, @Radio 702, @SundayTimessZA, @BiznewzCom and @HuffPostSA.

The Huffington Post has managed to ensure that the account spoofing it has been suspended but the rest remain in operation.

Running the spoof accounts and their legitimate counterparts through the Twitter Archiving Google Spreadsheet — which analyses Twitter activity — the following activity emerges.

Between January 15 and 24 this year, the legitimate accounts tweeted hundreds of times and their tweet patterns are not consistent. But the spoof accounts showed a marked spike — the bulk of their activity occurred on the same day.

All the spoof accounts were created on January 3 but only started tweeting in earnest on January 20. In addition, the spoof 702 and Sunday Times accounts started tweeting quickly after their inception, but seemed to favour international news.

The spoof 702 account also had several retweets of official ANC-linked accounts featuring photographs of former government spin doctor Mzwanele Jimmy Manyi.

A word count analysis indicated that the most used words were “Oakbay”, “Gordhan” and “OakBay”.

Despite a paucity of followers, many of the tweets had many retweets, but it was unclear whether this was as a result of the spoofing — members of the Twitterverse erroneously thinking that these were legitimate accounts — or actual support of the tweets. A familiar pattern emerged after further analysis of these retweets.

Using the prevalence of “retweet only” timelines as a determining factor, the spoof account retweets were scrutinised for suspicious accounts. What emerged was, once again, a controlling hand behind a number of puppets. Using a single tweet, two “clusters” could quite quickly be identified, with a very definite pattern.

The second cluster showed another set of deviations. This probably points to a third as yet undiscovered cluster of sock puppets.

During the investigation into the fake accounts in November last year, it was relatively easy to spot the dubious accounts — a generic profile picture and lack of any biographical entries made identifying them relatively easy. But identifying the controlling handle was harder, because of the use of privacy settings.

This time round, biographies had been added. The accounts are being hidden, being made more inconspicuous and more believable.

But, with a minor bit of research, it quickly became clear that the creators were now copying and pasting Twitter biographies from other users to populate their own.

The word count analysis of these “new” accounts showed a clear pattern — Gordhan was mentioned so often that the algorithm was unable to fit Gordhan in the word cloud, because it would leave too little space for any of the other words. The finance minister was mentioned 499 times, with Absa being the runner-up (361). Davos, white and WMC (white monopoly capital) feature heavily.

Compared with the earlier campaign, the ire of the fake Twitter accounts was increasingly directed at white monopoly capital, Gordhan and Absa, presumably following the public protector’s leaked lifeboat report on Bankorp and Absa.

Besides retweeting, the sock-puppet accounts also had access to the same pool of photos as the spoof accounts. This included an image of “presstitutes” — names and photos associated with the media houses targeted by the spoof accounts:
the Daily Maverick, the Sunday Times, BizNews.com, Radio702 and Ferial Haffajee (now with The Huffington Post).

Last weekend it emerged that the Wikipedia entries of Madonsela and Gordhan were edited.

The Gordhan edit was made in 2012 but the others were recent — in November last year, when the first surge of fake accounts was identified.

Wikipedia tracks edits to any of its entries in an attempt to discourage abuse. The edits were easily tracked but they cannot be traced back to the real people.

On November 18 last year, the Wikipedia entry for Madonsela was briefly changed. Between 6.36pm and 6.39pm, an unidentified user amended her page to reflect that Madonsela was a member of the Democratic Alliance from 2016 onwards. Mysteriously, they undid their changes and left the page as is.

The same user, identified by the IP address as residing in the Pietermaritzburg area, returned to the Wikipedia entry on November  24 at 5.01am. By 5.07am, the page had been amended to reflect not only that she was a member of the DA but also that this had been confirmed by the Western Cape provincial DA.

Similarly, billionaire businessman Johann Rupert’s Wikipedia entry was edited to include several “controversies”. Wikipedia user SouthAfricanWisher created a profile on November 17 2016 at 7.55pm. By 8.11pm, entries had been made claiming that Rupert had been accused of exploiting blacks under the apartheid regime, had close business relations with Gordhan and that the Black First Land First (BLF) movement had accused him and his associates of plundering the state.

The entries use media articles, which, in some cases, are press releases by the BLF, as proof for the amendments.

Comparing the November surge with the recent one, what started out as a few fake accounts retweeting tweets to prop up a narrative has now evolved into a more complex system of “spoofing” legitimate news sources in an attempt to discredit government officials, organs of state and the fourth estate, and even to produce fake news.

When these fake narratives are identified, perpetrators adapt their tactics to avoid detection. The fake accounts do not disappear — they get updated with biographies and profile pictures.

So far, #PaidTwitter in South Africa has been associated with an anti-Gordhan, pro-Gupta narrative. But this week reports emerged of a R50-million campaign purportedly overseen by the ANC in the run-up to the local government elections, which included alleged fake news sites.

Jean le Roux is an independent freelance investigator and researcher. After qualifying as lawyer, he joined the public protector’s office until early 2015

These are unprecedented times, and the role of media to tell and record the story of South Africa as it develops is more important than ever. But it comes at a cost. Advertisers are cancelling campaigns, and our live events have come to an abrupt halt. Our income has been slashed.

The Mail & Guardian is a proud news publisher with roots stretching back 35 years. We’ve survived thanks to the support of our readers, we will need you to help us get through this.

To help us ensure another 35 future years of fiercely independent journalism, please subscribe.


Coalition politics and law: The fight over Tshwane

With coalition politics on the rise, particularly in local government, this kind of court case is likely to become more common

High court declares Dudu Myeni delinquent

Disgraced former SAA chairperson Dudu Myeni has been declared a delinquent director by the...

SANDF inquiry clears soldiers of the death of Collins Khosa

The board of inquiry also found that it was Khosa and his brother-in-law Thabiso Muvhango who caused the altercation with the defence force members

No back to school for teachers just yet

Last week the basic education minister was adamant that teachers will return to school on May 25, but some provinces say not all Covid-19 measures are in place to prevent its spread

Press Releases

Road to recovery for the tourism sector: The South African perspective

The best-case scenario is that South Africa's tourism sector’s recovery will only begin in earnest towards the end of this year

What Africa can learn from Cuba in combating the Covid-19 pandemic

Africa should abandon the neoliberal path to be able to deal with Covid-19 and other health system challenges likely to emerge in future

Coexisting with Covid-19: Saving lives and the economy in India

A staggered exit from the lockdown accompanied by stepped-up testing to cover every district is necessary for India right now

Covid-19: Eased lockdown and rule of law Webinar

If you are arrested and fined in lockdown, you do get a criminal record if you pay the admission of guilt fine

Covid-19 and Frontline Workers

Who is caring for the healthcare workers? 'Working together is how we are going to get through this. It’s not just a marathon, it’s a relay'.

PPS webinar Part 2: Small business, big risk

The risks that businesses face and how they can be dealt with are something all business owners should be well acquainted with

Call for applications for the position of GCRO executive director

The Gauteng City-Region Observatory is seeking to appoint a high-calibre researcher and manager to be the executive director and to lead it

DriveRisk stays safe with high-tech thermal camera solution

Itec Evolve installed the screening device within a few days to help the driver behaviour company become compliant with health and safety regulations

The best local and international journalism

handpicked and in your inbox every weekday