In April 2021, a coordinated campaign targeting two South African banks surfaced on Twitter. While superficially taking aim at systemic racism in South Africa’s banking sector, beneath the #RacistBanksMustFall hashtag’s altruistic veneer were the vested interests of Sekunjalo Independent Media, owners of South Africa’s third largest news organization.

Key amplifiers of this hashtag, and several related ones, were journalists and organizations with links to Sekunjalo. The network used a combination of paid influencers and sockpuppet accounts to amplify #RacistBanksMustFall and #HandsOffAYO throughout April 2021, although evidence of earlier campaigns dating back to August 2020 could be found. This was shortly after one of the banks informed Sekunjalo it intended to sever their business ties.

The co-opting of racialized narratives is a common tactic in the South Africa information ecosystem. In 2016, this was exploited as part of a brief on behalf of the politically-connected Gupta brothers by the now-defunct PR firm Bell Pottinger ; Bell Pottinger set up “white monopoly capital” as a racialized scapegoat to distract from various controversies surrounding the family. More recently in July 2020, the DFRLab identified a government official using similar tactics to amplify traffic to his website.

South Africa’s massively inequal society is still haunted by the specter of Apartheid. Nearly three decades after the end of Apartheid, income disparities mostly coalesce along racial lines, which makes racialized narratives particularly effective as a backdrop for disinformation operations.

Dependent media

At the heart of this narrative sits the Sekunjalo group, a holding company for Iqbal Surve, a South African businessman. The Sekunjalo group is also the owner of Independent Media, publishers of an array of print and online news platforms, which has several of its journalists on the payroll of sister company AYO Technology Solutions Limited.

Sekunjalo and companies linked to it are mired in legal processes by the South African government’s Public Investment Corporation in an attempt to claw back R4.3 billion (approximately $300 million USD) of public worker’s pensions invested in the company. Surve has appeared before parliamentary inquiries regarding this “investment.” As a part of these efforts, AYO executives and Surve himself appeared before a Commission of Inquiry in 2019.

As media coverage of this Commission of Inquiry increased, a cluster of fake accounts began targeting journalists reporting on the proceedings with obviously pro-AYO narratives. More recently, Independent Media published an investigation using “cutting edge AI” to claim it was the target of a sophisticated social media campaign.

Timeline

In April 2021, the hashtag #RacistBankMustFall gained significant traction on at least four occasions. One of these periods also coincided with #HandsOffAyo, a hashtag supporting AYO Technologies. These hashtags were prompted after it surfaced that two commercial banks, ABSA (Amalgamated Banks of South Africa) and First National Bank (FNB), intended to sever their business relationships with Sekunjalo’s companies. ABSA informed Sekunjalo of its intentions in August 2020, and FNB followed suit more recently on April 15, 2021.

Shortly thereafter, mentions of both #RacistBanksMustFall and #HandsOffAYO saw a proportional spike on Twitter.

What sets this campaign apart from legitimate concerns around the transformation of the banking sector is the specific banks being targeted. Of the Big Four Banks in South Africa — ABSA, FNB, Nedbank, and Standard Bank — only ABSA and FNB drew the ire of this network. Incidentally, these were also the only two banks that severed their ties with Sekunjalo’s companies.

Ode to Iqarus

A network graph comprising of tweets containing #racistbanksmustfall over this period revealed that the bulk of the conversation centered around journalists linked to Independent Media, and a cluster of influencers and digital marketers who aggressively amplified the hashtag alongside them.

As is also frequently seen, a small group of user accounts used the popularity of the hashtag to market goods and services.

The coordination becomes even clearer when one filters the network graph to identify accounts with high amounts of interconnectedness, i.e., accounts that engaged with multiple other accounts in the same network. Filtering by this measure, known as the “k-core” value, more clearly shows the interconnectedness of these accounts. Using this filter, a cluster of 36 accounts were found to engage with at least 25 other accounts using the #RacistBanksMustFall hashtag over this period.

A key amplifier in these communities is @mmodiba10, co-founder of an alternative media platform and a journalist affiliated with Independent Media. Several of the most engaged-with tweets during this period originated from his account.

Despite not being officially employed by Independent Media, both Modiba and his Insight Factor co-founder Thabo Makwawa frequently feature on the front pages of various newspapers within the Independent Media stable.

In addition to these accounts, there is also clear coordination among a small number of accounts with high followings, all of which appear to be paid influencers or digital marketers, as evident from the accounts’ bio entries or from their timelines.

Déjà vu

A number of the same influencer accounts seen so prominently in the network graph for #RacistBanksMustFall were also engaged with the #HandsOffAYO hashtag referred to earlier. This hashtag mainly saw use on April 16, 2021, a day after news broke that FNB would sever ties with Sekunjalo. These hashtags were used both in isolation and in tandem with #RacistBanksMustFall.

An additional link between these hashtags and the Independent Media is the extended coverage provided by its publications on these closures. Twitter accounts for Weekend Argus, The Star, Sunday Tribune, and Sunday Independent — all part of the Independent Media stable of publications — published links to the story on Independent Media’s main platform alongside the #HandsOffAYO and #RacistBanks hashtags.

Sockpuppets and NGOs

There is also evidence that suggests sockpuppet accounts were used to amplify content supporting Independent Media and Surve, albeit to a lesser extent.

A highly active account within the dataset was that of @Thabo56024390, an account that almost exclusively engages with Independent Media content. During April, the account used the #racistbanksmustfall hashtag a total of 77 times and engaged with many of the other influencers using the hashtag. The account also used its associated Facebook page to share pro-Sekunjalo and pro-Surve links to various groups as far back as August 2019.

But the account is not what it appears to be. The profile picture used on both the Facebook and Twitter accounts for “Thabo Molefe” belong to a U.S.-based podiatrist and social media influencer, Dr. Ron Williamson. The image in questions was featured in a men’s catalog as far back as 2014.

The “Thabo Molefe” account was only the most active out of a number of these sockpuppet accounts, and several others amplifying the #RacistBanksMustFall hashtag were equally suspect. These include recent, seemingly batch-created accounts that were amplifying posts using these hashtags, “duplicated” accounts, and accounts that recently resurfaced after long periods of inactivity.

A social media campaign amplified by journalists with links to Independent Media, clusters of sockpuppets, and a network of paid social media influencers targeted two South African banks. On the surface, this was framed as a call for transformation in the broader banking sector, when in reality the campaign targeted the two banks that severed ties with the embattled Sekunjalo group.

For not the first time in South Africa, the language of racial inequality and transformation was appropriated to further a commercially motivated agenda instead of the altruistic activism the hashtags implied.

The DFRLab team in Cape Town works in partnership with Code for Africa.

Cite this case study:

Jean Le Roux, “Paid influencers and sockpuppets drove social media campaign targeting South African banks,” Digital Forensic Research Lab (DFRLab), July 1, 2021, https://dfrlab.org/2021/07/02/paid-influencers-and-sockpuppets-drove-social-media-campaign-targeting-south-african-banks/.