The widely followed account displayed Afrophobic sentiment through hashtags and promoted content from the South African First party

A popular anonymous Twitter account that promotes South African nationalism, particularly via dedicated Afrophobic hashtag campaigns, appears to be connected to the South African First (SAF) political party. SAF promotes the closing of South Africa’s borders and removal of foreign nationals from the country, a stance the account @uLerato_pillay stands firmly behind.

South Africa has a long history of violence against foreigners, particularly Black Africans from north of the country’s border. Describing the difference between xenophobia and Afrophobia, University of South Africa (Unisa) Professor Rothney Tshaka said, “Xenophobia is fear of the other; Afrophobia is fear of a specific other — the black other from north of the Limpopo River.” (The Limpopo River flows along South Africa’s border with Zimbabwe and Botswana.)

This Afrophobia has a real-world impact as well. In September 2019, for example, 12 people were killed after foreign-owned business were attacked in the Durban and Johannesburg metropoles, which resulted in the Nigerian government offering hundreds of expatriates free passage back to Nigeria. In Cape Town, a contingent of refugees took up camp in the city center in October 2019, claiming South Africa is not safe for asylum seekers. On Facebook, news reports about the refugees were frequently filled with hateful comments and Afrophobic vitriol.

While the DFRLab’s investigation did not unmask the individual behind the @uLerato_pillay account, it did reveal several links to another account named @SfisoGwala_SA that identifies itself as a member of South African First.

Who is @uLerato_pillay?

Anti-immigrant hashtags trended across South African Twitter throughout June and early July, periodically kickstarted by an anonymous Twitter account called @uLerato_pillay. Amid a shrinking economy and an increasing unemployment rate, the hashtags #PutSouthAfricansFirst, #ZimbabweansMustFall, #NigeriansMustGo, and #InfluxOfImmigrantsMustStop took root online, with many social media users blaming foreigners for taking away South Africans’ jobs.

According to Twitonomy, the anonymous @uLerato_pillay account was created on November 1, 2019, with the user ID 1190345631812014081.

The account participated in multiple follow-back campaigns from when it joined Twitter in an attempt to build its number of followers. These campaigns allow users to bloat their follower counts artificially as participants in a Twitter thread all follow each other. At time of analysis, @uLerato_pillay had 57,847 followers. On multiple occasions, the account posted images saying it had reached its follow limit and would resume following accounts at a later stage. It also used the trending Afrophobic hashtags to promote follow-back campaigns in order to grow its follower count still further and encouraged its followers to use the hashtags similarly as a means to grow their own follower numbers.

There have been multiple attempts to unmask the operator of the @uLerato_pillay account by other Twitter accounts. The most prominent involved screenshots of a Facebook user account that allegedly posted identical content as the @uLerato_pillay account — in particular, a post threatening to expose a politician named Naledi Chirwa for alleged fraudulent citizenship — to his personal Facebook profile a day earlier. The DFRLab investigated the Facebook profile in question and found no evidence to corroborate the allegations. While the Facebook account did post the threat to expose Chirwa, he did so approximately 90 minutes after the @uLerato_pillay account did, not before. The DFRLab found no other instances of amplification of the @uLerato_pillay account on the Facebook account’s timeline, suggesting that it was a one-off post. As there was no apparent connection between the Twitter and Facebook accounts, the DFRLab is refraining from exposing the latter, given it appears to be a personal account.

Since it was first created, the @uLerato_pillay account posted multiple images taken from other Twitter accounts but revealed no information about its owner and operator. A November 2 post to the account contained a selfie, allegedly that of the account owner. The DFRLab performed a reverse image search using Yandex, however, and found a similar image, posted by a Twitter account called @lvteef. The DFRLab searched through @lvteef’s profile and found that @uLerato_pillay had stolen the image from @lvteef, who had originally posted it almost five months earlier.

Looking back at the account’s original posts, it is clear that it did not always go by the handle @uLerato_pillay. The DFRLab found an archived version of a tweet from November 2, the day after the account was created, indicating its original user handle was @Sfiso82648954. Source code from the archived tweet shows that both @uLerato_pillay and @Sfiso82648954 have the same user ID, meaning @Sfiso82648954 changed its account handle at some point after November 2.

A search of @uLerato_pillay’s account for “sfiso” returns multiple results. Noticeably, on April 23, 2020, the account posted a link to a change.org petition, asking for DStv, a paid television subscription service, to lower their prices during the COVID-19 pandemic. The petition was created by a user named Sfiso J Gwala. In a response to the original tweet, @uLerato_pillay said the petition was created by an account called @SfisoGwala_SA.

When the DFRLab searched for “sfisogwala_sa” the search returned replies to an account called @HisMaineN, rather than @SfisoGwala_SA. The name appears to be a play on @HermaineM, a popular South Africa Twitter account.

A further comparison of an archived tweet from @SfisoGwala_SA and a different archived tweet from @HisMaineN shows that the two accounts shared the same user ID of 1241459415695360002.

Like @uLerato_pillay, the now-suspended @SfisoGwala_SA account also shared a link to the change.org petition created by Sfiso J Gwala. A look at the source code of a cached version of @SfisoGwala_SA’s tweet indicated it was created at 9:58 a.m. on April 23. But the @uLerato_pillay account had tweeted a link to the petition at 9:45 a.m. the same day, meaning @uLerato_pillay tweeted about the petition created by Sfiso J Gwala before the @SfisoGwala_SA account did.

The two accounts — @uLerato_pillay and @SfisoGwala_SA — consistently interacted with one another before @SfisoGwala_SA was suspended. They appeared to share the same viewpoints, and both promoted staunch nationalist messages, encouraging the removal of foreign nationals from South Africa and the closure of the country’s borders. Although the accounts did have some interactions that would lead users to believe they were not connected — @SfisoGwala_SA, for example, asked to purchase @uLerato_pillay’s account at one point — the two likely have some connection.

The DFRLab also found limited evidence that the @uLerato_pillay account used an email address that contains the words “sfiso gwala,” although the evidence was uncorroborated.

Putting South Africa first

On April 11, 2020, @uLerato_pillay shared a glimpse of a political manifesto for an organization called South African First (SAF), an anti-immigrant political party started by Mario Khumalo that was first registered with South Africa’s Electoral Commission in 2016. A news article shared on the South African First website claims foreign nationals would have 48 hours to leave South Africa if the SAF were to be elected into power.

The manifesto that @uLerato_pillay shared on April 11 was subsequently shared by @SfisoGwala_SA on April 16 under the caption: “Time has come for South Africans to reclaim their Country from Foreigners, who came to destroy South Africa.”

Cached copies of the @SfisoGwala_SA account’s bio indicates it identified as a member of the South African First party, which may be how the account had access to the document.

It was two days later, on April 18, when the official South African First Twitter account (@SAF_RSA) first shared a link to the manifesto, indicating @uLerato_pillay’s early enthusiasm and access to the document. The @SAF_RSA account regularly shares content from @uLerato_pillay, which has expressed its support for the small political party. (At time of analysis, @SAF_RSA was temporarily restricted due to unusual activity.)

Conclusion

Although the DFRLab was not able to identify the person operating the @uLerato_pillay account, there are clear connections between the account and another Twitter account, @SfisoGwala_SA, as well as the South African First political party. The @uLerato_pillay account, which engaged in deceptive behavior by claiming other people’s images as its own and artificially bloating its follower count, has been instrumental in amplifying Afrophobic hashtags on South African Twitter. Its connection to a political party that is built on removing foreign nationals from South Africa is of concern in the wider Afrophobic context that plagues the country.

Tessa Knight is a Research Assistant, Southern Africa, with the Digital Forensic Research Lab.

Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab.

The DFRLab team in Cape Town works in partnership with Code for Africa.

Follow along on Twitter for more in-depth analysis from our #DigitalSherlocks.