South African Twitter accounts gamed trending algorithms to promote prank political hashtags
Mischievous hashtags turned sour when one
South African Twitter accounts gamed trending algorithms to promote prank political hashtags
Mischievous hashtags turned sour when one was co-opted to distribute political disinfo targeting President Cyril Ramaphosa
Several anonymous South African Twitter accounts gamed Twitter’s algorithms to get certain hashtags onto local trending lists. In the early morning hours of July 23, 2020, when most South Africans were asleep, these accounts managed to trick Twitter’s algorithms into flagging the hashtag #RamaphosaResigns as trending. By the time regular users woke up, the hashtag made it appear as if South African President Cyril Ramaphosa had resigned, which was entirely untrue. A week earlier, meanwhile, a similar hashtag prank alleged that firebrand Economic Freedom Fighters leader Julius Malema had returned to the African National Congress after having been expelled nearly a decade ago.
While the hashtags initially appeared to have been nothing more than a prank, they were quickly co-opted by others as they went viral. What started as a joke escalated to political points scoring after a prominent but anonymous Twitter account amplified the #RamaphosaResigns hashtag among calls for Ramaphosa to resign for real. In addition to this, commercial-minded “hashjackers” tapped into the free advertising offered by the viral hashtags to tout their goods and services, while others used the hashtags to promote follower-trains and fake giveaways meant to artificially increase their followings. Both of these emergent behaviors generated engagement feedback loops, whereby interactions would push the hashtags higher up the trending lists, earning it more exposure and more interactions and so forth.
The gaming of platform algorithms is a technique frequently deployed by disinformation actors to amplify their content. Variations of this technique on Twitter were seen as far back as 2017, and a study by the Oxford Internet Institute last year showed how junk news sites gamed search engine algorithms to drive more traffic to their websites.
#RamaphosaResigns
The #RamaphosaResigns hashtag trended on July 23, insinuating that South African president Cyril Ramaphosa had resigned. The first mention of the hashtag was tweeted by parody Twitter account Jan Van Potgieter (@SciTheComedist) in the early morning hours.
Although @SciTheComedist later deleted this tweet, cached and archived copies of his tweet were still found online. An analysis using social media monitoring tool Brandwatch identified some 37 replies and retweets that mentioned @SciTheComedist between 2:33 a.m. and 5:00 a.m. local time. Several of these “orphaned” replies could still also be identified on Twitter, left in limbo after responding to the now non-existent tweet.
The hashtag winded its way through the colloquially termed “Midnight Twitter,” managing 557 mentions from 322 authors by 5:00 a.m. While this was not a lot of mentions, low user numbers and traffic in the early hours meant this was sufficient to place the hashtag onto trending lists by the time other South Africans woke up.
The tone of the original tweet containing the hashtag and the initial responses indicated this was meant as a socially engineered prank on the president, and implied more mischief than malice.
The #RamaphosaResigns hashtag was kicked into overdrive after @advovolicious, a parody account of another popular South African parody account, tweeted the hashtag to its nearly 40k followers shortly after 05:00 AM.
Until then, the hashtag had been mentioned around 557 times; in the first 12 hours after @advovolicious’ tweets, it was mentioned 10,280 times, and in another 12 hours, it was repeated 16,730 times in total. This is a marked increase in volume attributable to the combination of the @advovolicious account and the increased number of users during regular hours.
These tweets steered away from the social prank started by @SciTheComedist, taking swipes at President Ramaphosa’s political leadership and spreading false claims that he was resigning. For example, a national address scheduled by President Ramaphosa for the evening of July 23, 2020 to provide an update on the South African government’s COVID-19 response was intentionally misconstrued as a televised announcement of Ramaphosa’s resignation instead.
The account also shared links to an article on a monetized junk news site that was based on its own tweets, in essence quoting a publication that quoted itself as a way of lending credibility to the calls for Ramaphosa to resign.
Mapping the network
To investigate the spread of the hashtag and the main actors driving it, the DFRLab constructed a social network graph using tweets mentioning #RamaphosaResigns between 02:00 a.m. local time July 23, 2020 and July 31, 2020 at 6:15 p.m. This revealed a network of interactions (edges) consisting of the retweets, replies and mentions between the various Twitter accounts (nodes) in the network.
The full network of accounts mentioning the #RamaphosaResigns hashtag revealed several communities that made use of the hashtags for their own ends.
The clustering of these accounts identified distinct communities that engaged with the hashtags, and upon deeper inspection, each of these could be further dissected. Several groupings of commercial “hashjackers” or opportunists seeking to gain followers used the hashtag during this time.
The “Early Adopter” community, marked dark blue, were the accounts responsible for sharing the mischievous initial conversation around the hashtag that was spread until around 5 a.m on July 23, 2020. The @SciTheComedist account that started the hashtag forms a part of this community. When juxtaposed next to the four largest communities (together comprising 49 percent of the network), the relatively tiny footprint of the Early Adopter network becomes clearer.
This also highlights the centrality of the @advovolicious account in disseminating the hashtag. It is the single largest node in the network, indicating that it was the most prominently retweeted, mentioned, and replied to account, and its community cluster was also the largest at around 14.7 percent of the entire network.
Get on the Brandwagon
The trending nature of the hashtag also attracted Twitter accounts hoping to piggyback on the virality of the hashtag to gain exposure for themselves, their products or those of their clients.
The first, used by @dj_maphorisa_ and @dj_maphorisaa in the light blue community, used a follower-giveaway scam that requested Twitter users to follow the account and retweet it to stand a chance of winning R3000 (about USD $200). The tweet is frequently deleted and reposted.
There are indications that the account uses the automation software Socinator to schedule its tweets and automate responses to users that participate in the giveaway.
Another method, prominently seen in the purple cluster, was a practice known as “hashjacking.” This consists of tagging a trending hashtag to unrelated tweets, marketing a product or service. This ensured that these posts, and the brands they promoted, would be noticed by users seeing the trending hashtags on Twitter. These accounts were indiscriminate, and used multiple hashtags appearing on Twitter’s trending list that day.
Because of how extensively the accounts in the purple hashjacker network retweeted and quote-tweeted each other as a way of cross-amplifying the content they promoted, the network was very tightly knit.
It should be noted that this was not the only community doing so, just the most prominent, and other accounts engaged in similar behavior. For example, the @diegochuene account marketed clothing, using the #RamaphosaResigns hashtag, among the other hashtags mentioned above.
The prominence of President Ramaphosa’s account is attributable to brigading by the adjacent account @diegochuene, which orchestrates promotions for cash, presumably involving tweets directed sent out to its 101,000 followers.
In this case, it urged its followers to retweet a tweet mentioning Ramaphosa “until he sees it.” The #RamaphosaResigns hashtag was used alongside several unrelated hashtags such as #bbnaijalockdown2020 and #alcoholban, which were simply added to the tweet to lean on those hashtags.
Déjà who?
The same tactic was seen a week earlier, when #MalemaReturnsToANC trended on July 16, 2020. Julius Malema, the commander-in-chief of South Africa’s Economic Freedom Fighters (EFF) political party, was expelled from the ruling African National Congress in 2012. Ever since, rumors of his return to the ANC have been greatly exaggerated.
In a manner similar to what was later seen in the #RamaphosaResigns hashtag, #MalemaReturnsToANC was started at an odd hour (11:51 p.m. local time) and several accounts amplified gamed Twitter’s algorithms to get the hashtag trending.
The hashtag was tweeted 9,138 times over this period, and prompted a response from Mbuyiseni Ndlozi, the party’s former spokesperson, who took to Twitter to allay the rumors.
Gaming social media algorithms in order to manipulate a favorable outcome can have several objectives. A hashtag intended as a mischievous prank can be exploited by a network of accounts seeking to leverage the exposure for financial and promotional benefits. Beyond money or mischief, political propaganda and disinformation can be distributed using the same trending topic.
These artificial engagements create a feedback loop that distributes this disinformation to a much broader audience along the way.
Jean Le Roux is a Research Associate, Southern Africa, with the Digital Forensic Research Lab and is based in South Africa.
The DFRLab team in Cape Town works in partnership with Code for Africa.
Follow along for more in-depth analysis from our #DigitalSherlocks.
