How far would you go to deflect allegations of your involvement in state-level corruption, or ‘state capture’? If you or your co-accused were in control of a media empire, would you harness that empire to support a counter-narrative that undermines your enemies? Would you recruit a radical political movement to help create a strawman bogeyman through a mix of Twitter and fake news that shifts attention away from your own alleged crimes?
Fake news is big business these days after all. Some even credit Donald Trump’s win to the proliferation of misleading news and South Africa is not immune to the phenomenon either (see for example here and here).
In this post, I’ll unpack some of the patterns that I’ve observed in recent Twitter data that seem to imply that the Gupta media houses, ANN7 and The New Age, might be working with the Black First Land First (shortened to ‘BLF’ for some grammar-defying reason) party to embed a pro-Gupta, pro-Zuma narrative in our national discourse that runs counter to the current state capture discussions taking place. At the very least, the data shows that their narratives are uncannily aligned and stand in isolation to the rest of South Africans on Twitter, regardless of political allegiance. In addition, we know that there is cross-pollination of individuals between the Gupta and BLF camps through direct working relationships. Take a look at the evidence below and decide for yourself how deep the rabbit hole goes.
How would you go about deflecting perceptions and allegations about your alleged involvement in state-level corruption, or ‘state capture’?
I’ve posted a few times (see posts here, here and here) about the weird Gupta-BLF community that has been putting out pro-Zuma, anti-Pravin Gordhan/Thuli Madonsela/Mcebisi Jonas messaging and that attempts to shift the narrative away from the activities of President Zuma and the Guptas to the role of “white monopoly capital” in “capturing” our state. I’ve long had the suspicion that that community’s activity is being boosted by a ‘botnet’ of fake Twitter accounts that work in unison to amplify their message, and I have been collecting data to investigate this. It turns out though that I wasn’t the only one who noticed the weird behaviour of some of the accounts in this community. You can read in the Sowetan and Daily Maverick about how local digital sleuths uncovered a botnet of the fake accounts in this community. Rather than throw out the work that I’d done already, I thought that I’d further elaborate on their research to paint a more complete picture of the botnet’s activities.
The Gupta-BLF disinformation ecosystem
Before we go any further, let’s take a step back and remind ourselves of the greater political milieu that this community of fake accounts is trying to inject its narrative into. Here’s a reminder of the main communities evident in the 180,000 tweets about the Public Protector that I analysed in my earlier post here. Take note of the orange community labeled Gupta media & Black First Land First (BLF):
I pointed out in my previous post that, despite coming from a variety of different political backgrounds, the various communities discussing the Public Protector all voiced unanimous praise for former Public Protector, Thuli Madonsela, and skepticism towards newly installed Public Protector, Busisiwe Mkhwebane. That is, except for one community: what I’d labeled the Gupta media & Black First Land First community because it contained the Gupta-owned ANN7 satellite news channel and The New Age newspaper accounts along with the official accounts of the BLF and its leaders. This is what that community looked like in that dataset when isolated:
Our community detection algorithms identified the Gupta media and BLF accounts as belonging to the same community because those accounts interact more with each other than with other groups in the data: BLF members, for example, retweet ANN7 and The New Age more than other news sources, and the BLF leader, Andile Mngxitama, is regularly invited on as an “expert commentator” on ANN7.
The community stood at odds with the rest of South African Twitter because the content it shares and the narrative that it buys into stands in stark opposition to pretty much the rest of South African Twitter who, even if they sit on opposite sides of the socialist-neo-liberal divide, still broadly agree on a few things: the need to protect our institutions and hold government accountable. Those ideals don’t seem to hold as much appeal for the Gupta-BLF community. For example, the most retweeted content in that community relating to the past and present Public Protectors subtly cast doubt on the morals and ethics of Madonsela while praising Mkhwebane:
@PublicProtector Thuli
Madonsela leaves behind a R750 000 debt owed to G-Fleet for repairs to a state vehicle crashed by her son in 2012. pic.twitter.com/SjeCGmgy8C— The_New_Age (@The_New_Age) October 14, 2016
@mailandguardian @ANN7tv great decision to change from Rupert TV eNDA to Ann. Wow she's on fire. Best of luck new #PublicProtector
— Bongile Lovina (@LovinaBongile) October 21, 2016
Indeed, this community uses Twitter to share content that pushes a pro-Zuma, pro-Gupta message, and a particular sub-group within it also appears to be using a network of fake accounts, or a ‘botnet’, to amplify this narrative in an effort to embed it into the broader South African zeitgeist. The botnet is intertwined with the BLF party’s accounts in particular. The BLF appears to have created an ecosystem of accounts on Twitter that espouse a pro-Zuma, pro-Gupta and anti-Gordhan/Madonsela/state capture report narrative. Some of the content coming out of this ecosystem is real, organic discussion generated by human users that likely really believe this narrative but some of it also appears to be generated and amplified by fake accounts acting as a co-ordinated botnet.
The botnet appears to use the BLF’s own ‘news’ websites as touchpoints for the content that it pushes. I am aware of at least two BLF-affiliated websites that post ‘news’ content that is then shared via the botnet (see this tweet from a fake account for example): Black Opinion operates as a news site and the personal blog of BLF leader, Andile Mngxitama, and Uncensored Opinion seems to act similarly as a mouthpiece for writer and activist, Pinky Khoabane. Here are a few examples of the type of content that they generate and that gets shared via the botnet along with other commentary:
It’s very easy to see when a tweet contains their content because they have coined a few hashtags that only they use. These hashtags are all aimed at undermining the enemies of the Guptas and President Jacob Zuma. They include #PravinMustGo (aimed at finance minister, Pravin Gordhan), #JonasIsALiar (aimed at whistleblower, Mcebisi Jonas), #RealStateCapture (aimed at deflecting attention from state capture under President Zuma and the Guptas to ‘white monopoly capital’ as personified by Johan Rupert; indeed, they are also the main users of the #JohannRupert hashtag).
This community uses Twitter to share content that pushes a pro-Zuma, pro-Gupta message, and it appears that they also use a botnet to amplify this narrative in an effort to embed it into the broader South African zeitgeist.
Isolating the botnet
To separate out the core of their messaging from the rest of Twitter, I collected a second dataset of over 6,000 tweets that contained hashtags and terms seemingly unique to their narrative (including #PravinMustGo, #JonasIsALiar, #RealStateCapture and mentions of Johan Rupert) as well as tweets mentioning the key influencers in the community – Mngxitama and Khoabane – between 2-10 November 2016. I wanted to see who was seeding these hashtags and who was sharing them further. It came as no surprise to find the fake botnet accounts embedded within this dataset which we’ll discuss in more detail shortly, but first, this is what the interaction network looked like specifically around those hashtags and related terms:
…and here are some examples of the types images being shared by this community that push the white monopoly capital narrative and undermine the prevailing state capture narrative:
A list of fake, botnet accounts had already been published in the Sowetan and Daily Maverick but I set out to independently corroborate this list. My starting point was the members of the Gupta-BLF community from the Public Protector dataset above. I took the names of all users that were identified by our algorithms as part of the community and I plotted how many of those users’ accounts were created in the last few months. What I found was a few spikes on specific days. For example, 73 accounts within this community were created on the 1st of September 2016, 23 on the 22nd of July and another 14 on the 16th of October:
Thus, to create my list I started with the accounts that were all suspiciously created on the same day. If we look at these accounts in more detail, we find that they have all posted similarly high numbers of tweets in a very short time period. Here are the top 20 most prolific posters to give you a feel for the regularity of the data that is so characteristic of fake accounts:
Armed with this list of usernames, I was able to similarity isolate them within the hashtag network above. They turned out to represent the orange community at the top of that network, which I’ve isolated here:
The ‘shape’ of this community is interesting. I’ve come across similarly shaped ‘spambot’ networks in past research. What characterises such shapes is the hub-and-spoke pattern that emerges around a centralised “control” account that is retweeted independently by “child” accounts, without the child accounts further interacting with each other or with others in the organic manner that occurs in networks of human users.
So just who exactly has been interacting with these fake accounts? To find out, I filtered the above network on the combined “ego networks” of ten of the most prominent fake accounts in the network above. An ego network starts with a specific account and includes the other accounts that are within one degree of separation from it. Given that our networks are based on who has interacted with whom (either by retweeting or @mentioning that account), the combined ego network around the fake accounts tells us who interacted with those accounts through retweets and @mentions. Here we see that a few prominent players, including Andile Mngxitama and Pinky Khoabane, as well as the official BLF account, @black1stland1st, have interacted with the fake accounts (it’s important to note that we can’t say from this network whether or not they knowingly interacted with the accounts or were unwittingly duped into interacting with their content):
@abrahamcpt19 appears to be one of the main control accounts. It is one of the few that generates original, ‘seed’ tweets. Most of the other fake accounts simply retweet @abrahamcpt19 and other accounts that share similar content. Here’s a taste of the kind of content that @abrahamcpt19 seeds and that is then shared by the other fake accounts:
It's a sign blacks must know Their place. And whites don't need law to teach us.#HandsOffBrianMolefe
— abraham (@abrahamcpt19) November 11, 2016
The Guptas disturbed the White monopoly capitalist and they are using medias to get rid of their threat.#StateCaptureReport @cooltrolldad1
— abraham (@abrahamcpt19) November 9, 2016
Why did @ThuliMadonsela3 Rush to release #StateCaptureReport pic.twitter.com/2xFTDGYwHX
— abraham (@abrahamcpt19) November 11, 2016
So there you have it: there is a single community on Twitter that pushes a counter-narrative that differs from all other communities on Twitter. This community includes prominent accounts such as those of the Gupta media properties, ANN7 and The New Age, as well as the Black First Land First (BLF) party. The BLF has created multiple news sites that publish pro-Gupta, pro-Zuma articles of dubious veracity. These article get shared on Twitter via a network of fake accounts. In addition, these fake Twitter accounts also push a narrative around ‘white monopoly capital’ as the real source of ‘state capture’. Finally, some of the content that is shared by the botnet originates from the personal ‘news’ websites of BLF leader, Andile Mngxitama (Black Opinion) and writer-activist, Pinky Khoabane (Uncensored Opinion). In addition, we can see from the ego networks that they have both further interacted with these fake accounts on Twitter.
What does one make of this? Clearly, the BLF is pushing a narrative that seeks to undermine the current state capture discussions which are so critical of the Guptas and President Zuma, and they are attempting to shift attention to white monopoly capital instead. Given that the BLF has close ties to the Gupta media houses through its leader, Andile Mngxitama, that they are both aligned on their messaging, and that our algorithms identify them as belonging to the same community, is this enough to infer that they are working to working together to undermine their enemies and are using any technological means at their disposal to do so?
Kyle Findlay heads up a data science team for a large, international market research firm. This post originally appeared on his personal blog, Superlinear, and is republished here with the permission of the author.
