Phala Phala allegations spark non-stop online campaign to stoke dissent against Ramaphosa

Explosive allegations by Arthur Fraser that President Cyril Ramaphosa had covered up a multimillion-rand robbery at his Phala Phala farm in 2020 have sparked a sustained online conversation that shows no sign of abating.

While Ramaphosa clearly has to answer to a slew of allegations, the Centre for Analytics and Behavioural Change (CABC) analysed the online conversation which revealed inauthentic behaviour and a coordinated effort at narrative manipulation. The key accounts driving the narrative were first encountered during the CABC’s analysis of the RET online network in March 2021 and the July 2021 unrest in KwaZulu-Natal and Gauteng. 

It appears the network aims to discredit, stoke negative sentiment and manufacture online dissent against Ramaphosa. It also appears to dominate the online conversation to crowd out organic conversation. This is narrative manipulation and an abuse of free speech which undermines the ability of other citizens to engage in constructive discourses. 

The analysis of the online Phala Phala conversation from 1 June to 15 September 2022 found:

• The #PhalaPhalaFarmGate hashtag has been responsible for sustained anti-Ramaphosa sentiment since the beginning of June, and has remained a top-10 hashtag within South Africa’s online conversation about democracy;


• The volume of the conversation around #PhalaPhalaFarmGate saw a number of peaks between 1 June and 15 September. While the posts within these peaks correlate with news events, the CABC detected some instances where Twitter users deliberately used #PhalaPhalaFarmGate – and related hashtags – to keep the conversation trending;


• A group of suspicious accounts were found to be unusually active in promoting the hashtag. These accounts were analysed and indicated a very high probability of inauthentic activity;


• This group of Twitter accounts represented just 0.2% of the unique authors engaged in the conversation but were responsible for nearly 20% of the posts;


• Proponents of the RET Twitter network, first identified by the CABC in a report on the RET Network in May 2021, and then re-encountered in the Dirty Dozen report on the July 2021 unrest, are behind the #PhalaPhalaFarmGate online conversation; and


• Accounts such as @_AfricanSoil and @LandNoli have been central to the network. @_AfricanSoil generates the content while @LandNoli is key to its distribution.

The analysis focused on Twitter content and online media coverage. Twitter has outsized influence compared with other social media platforms as most politicians have accounts and all media houses make extensive use of the platform.

Key insights into the conversation about the Phala Phala farm robbery from 1 June to 15 September 2022.

The numbers

During the period, more than 1.39 million mentions about the Phala Phala scandal were created by almost 103,000 unique authors. Total retweets stand at more than 1.22 million, resulting in a retweet percentage of 87% for the conversation. Such a high retweet percentage indicates fewer individuals partaking in the conversation with their own thoughts, opting instead to retweet the views of others. A very high retweet percentage, as is the case for this conversation, casts doubt on the authenticity of the conversation as it may point to coordination by a group of tweeters to amplify the content.

Posts containing #PhalaPhalaFarmGate – and related hashtags – received 696,873 mentions between 1 June and 15 September, while the conversation about the Phala Phala incident received 686,682 mentions within the same period. 

A total of 27,031 articles related to the Phala Phala scandal were published by digital media outlets worldwide. The highest peak of 177,183 mentions was recorded between 27 June and 3 July 2022. These posts contain the hashtag #PhalaPhalaFarmGate and related hashtags.

A number of spikes within the conversation are noted. While most of these spikes correlated with news events around the scandal, researchers also noted instances where some Twitter users made deliberate attempts to keep the hashtag among the top trending topics.

Read in Daily Maverick: “Phala Phala dollars came from animal sales, not money laundering, Ramaphosa tells MPs”  

There was a spike in the online conversation on 2 June, just after Fraser laid a criminal complaint against Ramaphosa. There were peaks a few days later when the EFF released visual “evidence” of the robbery and after Ramaphosa suspended the public protector who had launched a probe into the incident. Other spikes coincided with the release of the final Zondo Commission report. Twitter users randomly tweeted #PhalaPhalaFarmGate to keep the conversation at the top of the trending list, receiving more than 30,000 mentions on one day.

Top 10 hashtags in the conversation. #cr17bankstatements was the seventh-most popular hashtag.

The @DknMohammed account has been instrumental in spreading and creating online “breaking news: allegedly” around the farm robbery. The account, with a Twitter bio that states “EDITOR IN CHIEF-TWITTER NEWSROOM” was created in March 2018, and is influential with more than 20,000 followers.

Examples of the “breaking news” shared by @DknMohammed include details of the March on Luthuli House calling for the suspension of Ramaphosa, developments around the President appearing before the ANC integrity committee, and the suspension of the Public Protector.

@MzwaneleManyi’s post, using the hashtag #phalaphalafarmgate encourages Twitter users to keep the Phala Phala robbery at the top of the trending list. With 2,815 retweets, this Tweet became the most retweeted in the conversation.

A tweet by @ModibeModiba alleges that “Ramaphosa has revealed in an affidavit that he reached a secret deal with Deputy Public Protector Kholeka Gcaleka to extend the deadline for the 31 questions on #PhalaPhalaFarmGate to 18 July without informing the nation on such a crucial burning issue”, and was the second-most retweeted post with 1,716 retweets. 

https://www.dailymaverick.co.za/article/2022-08-15-daily-maverick-wins-defamation-case-as-court-slaps-guest-contributor-modibe-modiba-with-r100000-damages/

Authenticity of accounts

A total of 172 accounts were identified to have used #PhalaPhalaFarmGate more than 500 times from 1 June to 15 September 2022. Each account averaged 1,020 tweets using the #phalaphalafarmgate hashtag or its variations, ranging from one tweet to 782 tweets a day by the most active account (@Marumofase77) on June 27. 

All accounts were analysed using TruthNest, Botometer and Anansi, software developed by the CABC, to determine their level of inauthentic behaviour. The average TruthNest bot indicator percentage was 60%. Of these 172 accounts, 13 returned a bot indicator of 100%. This indicates generally suspicious activity such as a significant difference between following/followed, only posting retweets, too many tweets per day or a combination of such activity. 

Botometer was especially useful in that it categorised these identified accounts in terms of the bot-like activity of the account, which should not be confused with confirming an account is a bot. In this instance, the bot type is merely a description of how a particular account behaves. More than 60% of accounts behaved as echo chambers – accounts that engage in follow-back groups and share political content in high volume. Echo chambers reinforce existing group opinions and often shift the entire group’s ideology to the extremes, causing polarisation and division. 

Historical involvement in other conversations

The drivers of the #PhalaPhalaFarmGate narrative are the same core group of accounts first identified in the CABC’s Online RET Network Analysis report as well as the now infamous Dirty Dozen report on the tactics employed online at the time of the July 2021 unrest. 

At least 10 accounts that were previously identified by the CABC in the Online RET Network Analysis report are key accounts within the #PhalaPhalaFarmGate conversation. They are:

@_AfricanSoil, @LandNoli, @Gentlements, @mytouchrecords, @mmodiba10, @ThatNigga_Bongz, @stumbue, @Botik61945648, @Jamnandasgodan and @ThobaneMazibuko. 

Similarly, at least three accounts highlighted as being part of the Dirty Dozen accounts in July 2021 are focal accounts within the #PhalaPhalaFarmGate conversation. They are:

@mytouchrecords, @Botik61945648 and @07372145stix.

@gentlements is also among the most mentioned tweeters.

The overarching theme for this networked faction is die-hard support for Jacob Zuma and the ANC’s RET faction. They primarily use the same hashtags and memes, often retweeting each other’s content, as seen in the network analysis of the accounts that used #PhalaPhalaFarmGate at least 500 times since 1 June.

Network analysis

Network analysis diagram of the most active accounts that used #PhalaPhalaFarmGate (or its variations) more than 500 times from 1 June to 15 September 2022.

Well-documented accounts such as @_AfricanSoil and @LandNoli play central yet different roles in the network. The darker the shade of green of the account, the higher the retweet percentage. The larger the size of the account, the higher the number of accounts within the network engaging with it. The positioning of the accounts depicts its centrality in the network, with a more central position indicative of accounts having greater influence on the network – that is, a mention (tweet or retweet) from a central node is likely to have a greater spread through the network. 

Three types of accounts have been identified. 

First, content creator nodes are characterised by low retweet percentages (pale green) and a central position. These accounts are responsible for producing original content for the network. An example of a content creator is @_AfricanSoil. This account was uncovered as Zamaswazi Zinhle Majozi. 

Second, large central distribution accounts are characterised by high retweet percentages (very limited original content, darker green colour) and by a large number of accounts in the network retweeting them, hence the larger node. An example of a central distribution account is @LandNoli. 

Last, amplification nodes, which occur along the outer circle of the network, have smaller sizes and high retweet percentages (darker green). These are essentially amplification accounts for the large central distribution accounts. An example of an amplification account is @mytouchrecords. While these accounts may have a smaller influence on this network, they often have large follower bases and are critical in amplifying the message into the larger twittersphere. They also add the appearance of the same message coming from multiple sources which makes the messaging appear more organic and the sentiments more widely felt.

Network analysis diagram showing @_AfricanSoil’s influence.

The network depicts the accounts most engaged with @_AfricanSoil. Thick lines denote more direct relationships with @ThabaneMazibuko, @mxo1, @mytouchrecords, @Gentlements, @Jamnandasgodan and @stumbue. These same accounts have been identified by the CABC as being influential in previous RET campaigns, as well as #PhalaPhalaFarmGate. 

To further understand the influence that the 172 high-tweeting accounts had on the conversation when it peaked in the week from 27 June to 3 July 2022, we removed their Twitter handles from our search and observed a drop of 28.6% from 177,178 to 126,533 mentions of the hashtag. This means that the 172 accounts tweeted or retweeted #phalaphalafarmgate – and related hashtags – nearly 50,645 times in one week, making up nearly one-third of all posts using the hashtag on Twitter.

Read in Daily Maverick: “What lies beneath — excavating Phala Phala investigations (and their runup) from mud and murk”

Almost 20% of the entire conversation on Twitter about Phala Phala was driven by these 172 accounts. This is highly significant considering that the 172 authors only make up 0.2% of the more than 103,000 unique authors that engaged in the conversation. 

On 27 June 2022, the most active account on Twitter using the Phala Phala hashtag or its variations, @marumofase77, tweeted 879 times between 7am and midnight. To tweet 879 times in 17 hours, one would need to tweet every 70 seconds.

@Marumofase77 scored 80% for Truthnest’s Bot Indicator and a 3.4 out of five Botometer score. There is a high probability that this account is either being controlled by software, operated by multiple users or a combination of both

Total mention volume by hour on 27 June 2022 by @Marumofase77.

A series of peaks are observed during the 17 hours. At the height of activity, at 12.27pm, this user tweeted 13 times a minute, averaging a tweet every 4.6 seconds. At 12.31pm the user tweeted 12 times a minute, again tweeted 12 times in a minute at 12.34pm, followed by 11 tweets in a minute at 12.37pm and another 11 tweets in a minute at 12.38pm.

The CABC regards a high number of tweets per minute to be highly suspicious.

Most commonly used hashtags by user @AZANIA_magwala from 1 June to 15 September 2022.

Truthnest rated @AZANIA_magwala with a 100% probability of the account being operated by a bot. This rating is based on the user taking no rest during the day, posting almost only retweets and tweeting too many times during the day.

Attempts to drown out the noise of constructive debates with one-sided narratives limits access to reliable, balanced and accurate information. It is also an abuse of free speech. 

The top hashtags in the Phala Phala conversation are most likely inorganic, derived from the coordinated retweeting of the hashtag from the online network. DM

Disclosure: The CABC, Daily Maverick and City Press are currently involved in legal proceedings initiated by Sphithiphithi Evaluator (@AfricanSoil), Thabo Makwakwa (@ThaboMakwakwa), Modibe Modiba (@mmodiba10) and Izwe Lethu (@LandNoli) who seek to review and set aside two reports: Online RET Network Analysis; and The Dirty Dozen & the Amplification of Incendiary Content during the Outbreak of Unrest in South Africa in July 2021. These proceedings are opposed and the CABC, Daily Maverick and City Press seek to have them set aside with costs.