Daily Maverick
Dailymaverick logo

South Africa

South Africa

Afrophobic SA Twitter account connected to nationalist political party

Afrophobic SA Twitter account connected to nationalist political party
The South African First political party frequently retweeted @uLerato_pillay’s tweets promoting the political party. (Source: @uLerato_pillay/archive)
Tessa Knight and Jean le Roux for DFRLab
By Tessa Knight and Jean le Roux for DFRLab
12 Jul 2020
Facebook
0
A popular anonymous Twitter account that promotes South African nationalism, particularly via dedicated Afrophobic hashtag campaigns, appears to be connected to the South African First (SAF) political party. SAF promotes the closing of South Africa’s borders and removal of foreign nationals from the country – a stance the account @uLerato_pillay stands firmly behind.

South Africa has a long history of violence against foreigners, particularly black Africans from north of the country’s borders. Describing the difference between xenophobia and Afrophobia, University of South Africa (Unisa) Professor Rothney Tshaka said, “Xenophobia is fear of the other; Afrophobia is fear of a specific other – the black other from north of the Limpopo River.” 

This Afrophobia has a real-world impact as well. In September 2019, for example, 12 people were killed after foreign-owned businesses were attacked in Durban and Johannesburg, which resulted in the Nigerian government offering hundreds of expatriates free passage back to Nigeria. 

In Cape Town, a contingent of refugees set up camp in the city center in October 2019, claiming South Africa is not safe for asylum seekers. On Facebook, news reports about the refugees were frequently filled with hateful comments and Afrophobic vitriol.

While the DFRLab’s investigation did not unmask the individual behind the @uLerato_pillay account, it did reveal several links to another account named @SfisoGwala_SA that identifies itself as a member of South African First.

Who is @uLerato_pillay?

Anti-immigrant hashtags trended across South African Twitter throughout June and early July, periodically kickstarted by an anonymous Twitter account called @uLerato_pillay. Amid a shrinking economy and an increasing unemployment rate, the hashtags #PutSouthAfricansFirst, #ZimbabweansMustFall, #NigeriansMustGo, and #InfluxOfImmigrantsMustStop took root online, with many social media users blaming foreigners for taking away South Africans’ jobs.



The account participated in multiple follow-back campaigns from the time it joined Twitter in an attempt to build its number of followers. These campaigns allow users to bloat their follower counts artificially, as participants in a Twitter thread all follow each other. 

At the time of analysis, @uLerato_pillay had 57,847 followers. On multiple occasions, the account posted images saying it had reached its follow limit and would resume following accounts at a later stage. It also used the trending Afrophobic hashtags to promote follow-back campaigns in order to grow its follower count still further, and encouraged its followers to use the hashtags similarly as a means to grow their own follower numbers.

The account posted screenshots indicating that it had maxed out its follower count due to its participation in follow-back campaigns and continued to participate in — and even start — follow-back campaigns based on the trending Afrophobic hashtags. (Source: Twitter, left; @uLerato_pillay/archive, top right; @uLerato_pillay/archive, bottom right)



There have been multiple attempts to unmask the operator of the @uLerato_pillay account by other Twitter accounts. The most prominent involved screenshots of a Facebook user account that allegedly posted identical content as the @uLerato_pillay account –  in particular, a post threatening to expose a politician named Naledi Chirwa for alleged fraudulent citizenship –  to his personal Facebook profile a day earlier. 

The DFRLab investigated the Facebook profile in question and found no evidence to corroborate the allegations. While the Facebook account did post the threat to expose Chirwa, he did so approximately 90 minutes after the @uLerato_pillay account did – not before. 

The DFRLab found no other instances of amplification of the @uLerato_pillay account on the Facebook account’s timeline, suggesting that it was a one-off post. As there was no apparent connection between the Twitter and Facebook accounts, the DFRLab is refraining from exposing the latter, given it appears to be a personal account.

The Facebook post, anonymised by the DFRLab, and @ulerato_pillay’s post were created 90 minutes apart, with the Facebook post crediting ‘Lerato Pillay’. (Source: Facebook, left; @uLerato_pillay/archive, right)



Since it was first created, the @uLerato_pillay account posted multiple images taken from other Twitter accounts, but revealed no information about its owner and operator. A 2 November post to the account contained a selfie, allegedly that of the account owner. The DFRLab performed a reverse image search using Yandex and found a similar image, posted by a Twitter account called @lvteef. The DFRLab searched through @lvteef’s profile and found that @uLerato_pillay had stolen the image from @lvteef, who had originally posted it almost five months earlier.

The selfie posted by @uLerato_pillay (who was still @Sfiso82648954 at the time) was lifted from the account @lvteef. (Source: @uLerato_pillay/archive, left; @lvteef/archive, right)



Looking back at the account’s original posts, it is clear that it did not always go by the handle @uLerato_pillay. The DFRLab found an archived version of a tweet from 2 November, the day after the account was created, indicating its original user handle was @Sfiso82648954. Source code from the archived tweet shows that both @uLerato_pillay and @Sfiso82648954 have the same user ID, meaning @Sfiso82648954 changed its account handle at some point after 2 November.

A comparison of the current version of a tweet from the @Lerato_pillay account (right) against an archived version of the tweet (left) indicated the account previously went by the handle @Sfiso82648954. (Source: @Acco_Ntanjana/archive)



A search of @uLerato_pillay’s account for “sfiso” returns multiple results. Noticeably, on 23 April 2020, the account posted a link to a change.org petition, asking for DStv, a paid television subscription service, to lower their prices during the Covid-19 pandemic. The petition was created by a user named Sfiso J Gwala. In a response to the original tweet, @uLerato_pillay said the petition was created by an account called @SfisoGwala_SA.

The account @uLerato_pillay created a post linking to a petition by Sfiso J Gwala, then sub-tweeted that the petition had been created by the account @SfisoGwala_SA. (Source: @uLerato_pillay/archive)



When the DFRLab searched for “sfisogwala_sa” the search returned replies to an account called @HisMaineN, rather than @SfisoGwala_SA. The name appears to be a play on @HermaineM, a popular South Africa Twitter account.

A search for sfisogwala_sa returned replies to an account called @HisMaineN. (Source: Twitter)



Accounts @HisMaineN and @SfisoGwala_SA have the same user IDs. (Source: @awildknight/DFRLab via @HisMaineN/archive, top; @SfisoGwala_SA/archive, bottom)



Like @uLerato_pillay, the now-suspended @SfisoGwala_SA account also shared a link to the change.org petition created by Sfiso J Gwala. A look at the source code of a cached version of @SfisoGwala_SA’s tweet indicated it was created at 09:58 on 23 April. But the @uLerato_pillay account had tweeted a link to the petition at 09:45 the same day, meaning @uLerato_pillay tweeted about the petition created by Sfiso J Gwala before the @SfisoGwala_SA account did.

Timestamps (in red) from the page source code for the Change.org petition (top left), reveal that @uLerato_Pillay tweeted (top right) a link to the petition within two minutes of its creation, and several minutes before its alleged creator @SfisoGwala_SA (bottom left). (Source: @jean_leroux/DFRLab)



The two accounts – @uLerato_pillay and @SfisoGwala_SA – consistently interacted with one another before @SfisoGwala_SA was suspended. They appeared to share the same viewpoints, and both promoted staunch nationalist messages encouraging the removal of foreign nationals from South Africa and the closure of the country’s borders. Although the accounts did have some interactions that would lead users to believe they were not connected – @SfisoGwala_SA, for example, asked to purchase @uLerato_pillay’s account at one point – the two likely have some connection.

Although the two accounts shared interactions that might indicate they were not connected, the DFRLab believes they are. (Source: @uLerato_pillay/archive, left; @SfisoGwala_SA/archive, top right; @SfisoGwala_SA/archive, bottom right)



The DFRLab also found limited evidence that the @uLerato_pillay account used an email address that contains the words “sfiso gwala”, although the evidence was uncorroborated.

Putting South Africa first

On 11 April 2020, @uLerato_pillay shared a glimpse of a political manifesto for an organisation called South African First (SAF), an anti-immigrant political party started by Mario Khumalo that was first registered with South Africa’s Electoral Commission in 2016. A news article shared on the South African First website claims foreign nationals would have 48 hours to leave South Africa if the SAF were to be voted into power.

The manifesto that @uLerato_pillay shared on 11 April was subsequently shared by @SfisoGwala_SA on 16 April under the caption: “Time has come for South Africans to reclaim their Country from Foreigners, who came to destroy South Africa.”

Cached copies of the @SfisoGwala_SA account’s bio indicates it identified as a member of the South African First party, which may be how the account had access to the document.

@SfisoGwala_SA identified as a member of the SAF. (Source: @SfisoGwala_SA/archive)



It was two days later, on 18 April, when the official South African First Twitter account (@SAF_RSA) first shared a link to the manifesto, indicating @uLerato_pillay’s early enthusiasm and access to the document. The @SAF_RSA account regularly shares content from @uLerato_pillay, which has expressed its support for the small political party. (At time of analysis, @SAF_RSA was temporarily restricted due to unusual activity.)

The South African First political party frequently retweeted @uLerato_pillay’s tweets promoting the party. (Source: @uLerato_pillay/archive)



Conclusion

Although the DFRLab was not able to identify the person operating the @uLerato_pillay account, there are clear connections between the account and another Twitter account, @SfisoGwala_SA, as well as the South African First political party. 

The @uLerato_pillay account, which engaged in deceptive behavior by claiming other people’s images as its own and artificially bloating its follower count, has been instrumental in amplifying Afrophobic hashtags on South African Twitter. 

Its connection to a political party that is built on removing foreign nationals from South Africa is of concern in the wider Afrophobic context that plagues our country. DM

Tessa Knight is a Research Assistant, Southern Africa, with the Digital Forensic Research Lab.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.

The DFRLab team in Cape Town works in partnership with Code for Africa.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.

This article was first published on Medium here: 

Daily Maverick asked South African First to respond to this article. This is their reply: 

Daily Maverick gave the right of reply to South African First founder Mario Khumalo. 

Khumalo said he is aware of the @uLerato_Pillay account, has interacted with the Twitter account, but denies owning it and says he doesn’t know who is behind it. 

Regarding Sfiso J Gwala who owns the @SfisoGwala_SA account, Khumalo said he doesn’t know who he is, neither is he a member of the South African First Party

“We don’t have a member like that in our organisation and we are willing to disclose membership if we have to,” said Khumalo during a telephonic interview. 

Categories:

Tags: