South Africans need to be extremely vigilant in the upcoming 2019 general elections which are fast approaching. We’ve already seen how local actors such as the Guptabots have effectively changed our national conversations. There’s no reason to believe that this won’t continue to happen in the next election, as it has around the world. This article is an investigation into the political interference that has already occurred on South African Twitter between 2014 and 2018. I’ve specifically taken a look at how many accounts Twitter has suspended across 28 datasets relating to politics, social unrest and race relations in South Africa to quantify the extent of suspicious activity and to generate some hypotheses around who might be involved and what their agendas are.

I’ve been studying South African Twitter since 2011. In that time, I’ve taken a look at how reactions to political and social events within our country have manifested on that platform. The results have been fascinating and I’ve shared many of them on this blog. This post however represents the single largest investigation that I have undertaken to date. I’ve been chipping away at it for a few months now and the data is so vast and so complex that there is still much work that could be done. Be that as it may, I’ve had to draw the line somewhere and what I present to you here are my initial results identifying the possible actors using under-handed means to affect our discourse on Twitter. This is important because, as we know from the Guptabots period, what happens on Twitter has a way of bleeding into the rest of our country’s conversations. Twitter has doubled down on its efforts to clean up the platform in recent months. According to the Washington Post, the platform enacted its largest ever user cull between May and June 2018 when it removed ~70 million fake and malicious accounts. Twitter removed accounts that demonstrated suspicious patterns of behaviour such as tweeting too frequently or accumulating followers too quickly as well as accounts that had been reported many times by other users. And, while May and June 2018 represented the platform’s largest user culling periods to date, Twitter has been consistently removing accounts over the past year. For example, they removed 1.2 million on 7 Dec 2017 and they continued removing 1 million per day into July 2018. Twitter had 336 million active users in Q1 2018 which puts the scale of the recent culls into perspective.

This period of intense user culling presents us with a unique opportunity to quantify the presence of suspicious and malicious accounts in older datasets. What my initial, far from exhaustive, results have found is that there appears to be three main groups that Twitter has suspended for suspicious activity in South African Twitter: pro-EFF, pro-Radical Economic Transformation (RET) and the International Far Right (or whoever is behind them).

Pro-EFF content was reshared in many of the datasets by suspended accounts with South African user locations. It is not clear to me whether or not these are real users that are being suspended for their divisive content or orchestrated fake accounts. It is difficult to tell because, unlike bots seen in other studies, these suspended users mostly have South African user locations. This means that they are either real people or they are custom-created fake accounts for the South African market. If the latter is true, this would imply that they are more sophisticated, homegrown fake accounts than the ones used by the pro-RET group, which appears to temporarily ‘hire’ fake accounts off the international black market.

The pro-RET group focuses on a variety of issues including attacks on the Ramaphosa faction of the ANC, state capture-related topics such as state-owned enterprises (SOEs) and race relations.

The International Far Right on the other hand focuses on issues relating to white fear such as farm killings and land expropriation, and they conveniently conflate the international definition of “white genocide” (i.e immigration supposedly pushing whites into the minority in their traditional homelands and race mixing that dilutes “pure” white genetics) with a special South African spin on the concept (that a majority black society is strategically persecuting vulnerable white farmers as the vanguard attempt to incite a race war). They fan the flames around these issues ostensibly in solidarity with white, generally Afrikaans-speaking South Africans, but the narrative they spin neatly slots into the global far right agenda of “white genocide” and white nationalism. This makes me think that the situation of white South Africans is merely a sideshow spun to support their global narrative. To that extent, we are but a pawn in their global strategy, and the interference that does take place appears to be primarily for the consumption of the international market. You can read my previous analysis about the relationship between the South African and International Right communities here.

It’s worth keeping in mind that there is much speculation, and some evidence, as to the real players behind the US-focused Far Right push. Reports have pointed towards US homegrown fake news purveyors as well as the role of Russia. Is South Africa just a convenient talking point in this larger strategy? I did look for the 2,848 known Internet Research Agency (IRA – a Russian organisation accused of interfering in the 2016 US elections) in these datasets. While they appear in a handful of tweets here and there, they have no noteworthy presence.

The above insights into the likely bad actors in a South African context are based on a high level analysis of the 28 datasets mentioned above and an in-depth analysis of the three datasets with the largest volumes of interference, and two interesting outliers:

1. The ANC’s 54th National Elective Conference in December 2017 where Cyril Ramaphosa’s ANC faction narrowly beat the RET faction’s candidate, Nkosazana Dlamini-Zuma, to become our next president and, in the process, effectively drove a spoke into the wheel of the State Capture Project (that project is well-summarised in the Betrayal of the Promise report)
2. The storm that erupted in March 2017 around former DA leader and current Western Cape Premier, Helen Zille’s “legacy of colonialism” tweet
3. The discussions around the #BlackMonday protest march against farm killings in October 2017
4. Discussions around the recent North West province protests to unseat then provincial premier, the ANC’s Supra Mahumapelo, who is accused of corruption and mismanagement on a grand scale
5. A dataset combining various “white fear” issues including farm killings, white genocide and land expropriation without compensation (LEWC)

Identifying the ‘bad actors’

In an attempt to identify the malicious accounts that were removed, I collated numerous datasets covering events in South Africa between 2014 and 2018. These datasets covered protests, race controversies, political events and more. In addition, I included a few control datasets for comparison. For each dataset, I checked whether or not each account that had authored or retweeted a tweet had subsequently been deleted or suspended by Twitter. This was a lengthy process that took weeks as I worked with Twitter’s system (“API”) to check each profile’s status.

There are many reasons why a user account might be deleted (e.g. the account might have been deactivated by the actual user or the username might have been changed by a real user or a bot owner) but only one reason why a user might have been suspended: for bad behaviour. I have therefore focused this investigation on suspended users, which likely gives us a conservative indication of the malicious accounts present in each dataset. Twitter has said that they focused on the most egregious violators which means that they might only have removed the tip of the iceberg. There is some evidence to support this assumption as a recent Knight Foundation report found that Twitter’s removal efforts are far from comprehensive. While most of the known sockpuppet accounts associated with the Russian Internet Research Agency (IRA) have been suspended, many more accounts associated with spreading fake news in the 2016 US elections are still active. Thus, while suspended accounts don’t give us the full picture of malicious activity, we can still start to gain some insight into the scale of interference and the areas that possible interference might focus on, which can, in turn, give us some direction as to who might be behind it.

Types of interference

There are three types of ‘bad actors’ that often get conflated in discussions of propaganda and disinformation on social media: bots, sockpuppets and trolls.

Bots are automated accounts that are controlled by computers, algorithms and rules. They tend to be used to ‘boost’ the content of other accounts controlled by real people. Someone might author a tweet and then point their swarm of bot accounts at that tweet to retweet it. In doing so, they do not increase the chances of the tweet being seen in real users’ timelines because most people don’t follow bots. However, when a real user shares said tweet with their followers, the tweet will appear to have more social credibility due to its already-high number of retweets. This in turn increases its chances of being further retweeted by real users. Automated bots have been surprisingly easy to spot in this project as many have US-based locations (this location information is typed in by users and so can say whatever the account owner wants it to), which is unusual given that our data is highly South Africa-specific and foreigners are unlikely to be familiar with the intricacies of our day-to-day political reality. However, this makes sense because the US is the main market for bot ‘services’ and it doesn’t make sense for bot owners to temporarily re-purpose thousands of accounts’ user information to reflect South African data when they are just ‘hired out’ temporarily to ‘clients’ in South Africa.

Sockpuppets are accounts controlled by real people pretending to be something they are not in order to advance an agenda. It is this class of bad actor that so much of the media’s attention has focused on, such as in the case of the Russian IRA sockpuppets where 2,848 known accounts were found to be controlled by a team within the roughly 400-strong, Moscow-based Internet Research Agency (see this New York Times video on how the IRA operates).

South Africa is no stranger to the power of sockpuppets. The so-called ‘Guptabots’ famously popularised the term ‘white monopoly capital’ and helped to poison race relations. The Guptabots were a collection of roughly 800 known accounts controlled by a much smaller group of human handlers likely based in India and likely funded by the Guptas (see ANCIR’s Manufacturing Divides report and News24’s fantastic summary of the network’s WMC Leaks campaign for more details) to advance the State Capture Project under the veil of the Radical Economic Transformation (RET) ideology of the Zuma-faction of the ANC.

The below diagram from the Manufacturing Divides report summarises how the RET network employed bots and sockpuppets in combination with real influencers to boost their message and narrative. It’s a good summary of the rough process followed around the world. The process consists of a fake (‘guru’) account seeding the content (either by resharing from a website or authoring a tweet), and bots (“fake account”) boosting that content by retweeting it to give it social credibility. The content is then picked up by a real influencer and injected into that influencer’s community (although sometimes the guru and real influencer accounts are one and the same):

Trolls are the the final type of malicious account. They are what most people think of when it comes to bad actors that spread disinformation on social media even though they are actually the least relevant when it comes to organised disinformation campaigns. Trolls are real people that post content in order to get a rise out of other users. Bigots, racists, mysognists and generally disagreeable users also fall into this category. When the media talks about “trolls” and “disinformation” in the same sentence, they usually mean “sockpuppets”. It’s important to highlight that much of my observations below relate to bots retweeting users. These are the easiest to spot in the data because when a swarm of bots retweets a specific user, this appears as multiple copies of the same tweet in the data. Sockpuppets, who act like real users, are far more difficult to spot because the users controlling the sockpuppet accounts generate real content that is often difficult to distinguish from other users’ content. Thus, this investigation over-emphasises bot activity given my time constraints.

The data

28 datasets of tweets form the heart of this investigation. These datasets were collected over the past several years as noteworthy social and political events occurred. They form the basis of my extensive research into the South African Twittersphere. I chose these particular datasets for the diversity of topics that they cover. Each dataset was collected either via Twitter’s public REST API, public Streaming API or a third party social listening platform by defining a list of keywords in order to isolate tweets containing those keywords. For example, if I was interested in a dataset about former finance minister, Nhlanhla Nene, I would create a search query containing relevant terms such as “nhlanhla nene, #NhlanhlaNene, #NeneGate, etc.” in order to isolate a dataset of tweets containing these terms.

Here’s a breakdown of the 28 datasets:

Quantifying the interference

Finally, we get to the actual results. Between 1% and 9% of tweets were authored by suspended users in each dataset. When we add in retweets of suspended authors’ tweets, their ‘footprints’ ranged from 2% to 18% of tweets in a given dataset. While a minority in each case, these could have been enough to sway the tide of conversation as in the case of the Guptabots and the Russian IRA sockpuppet accounts. Here are the datasets ranked by the number of suspended and deleted users in each:

This chart doesn’t show the full picture yet though. We first need to take into account how many users there were in each dataset overall to get an accurate idea of how prevalent suspended users were. I therefore created the below chart where I calculated the number of suspended users per 1,000 users (y-axis). I have also ordered the datasets from oldest to newest (x-axis) so that we can take a look at activity over time. Finally, bubble size represents the suspended users’ footprint in each dataset (i.e. percentage of tweets that were authored by suspended accounts and retweets thereof). This gives us an idea of the overall presence they had in each conversation (the largest footprint was 17.5%). I’ve also somewhat arbitrarily distinguished between datasets with more/less than 40 suspended users per 1,000 based on the observation that most control datasets sit below this line (with a few notable exceptions that I will briefly touch on below):

So what does this chart tell us? Well, the first thing that it tells us is that there are clear differences between datasets. This is best illustrated by the fact that our control datasets (green) are lower than many other datasets as we would expect (although not quite as low as initially expected) and similarly, the datasets collected around the time of the major May-June 2018 cull and after are mostly much lower than the other datasets (with the exception of the Patricia de Lille dataset which bears further investigation).

The Super Bowl 2017, Mandela Day 2016 and Telecoms brands general datasets are interesting exceptions as control datasets. I had initially thought that the Super Bowl dataset, being an apolitical event, would score low on suspended accounts. However, given that it is probably one of, if not the, biggest event on Twitter each year it’s probably also the biggest spam event of the year with a vertiable tsunami of bots hashjacking its conversations. Thus, the Super Bowl probably represents the high-water mark that we should be comparing other datasets to.

The Mandela Day 2016 dataset contains many retweets by suspended international accounts posting inspirational quotes by Mandela. It appears to be generic spam content; much of it from South America.

The Telecoms brand general dataset relates to South African telecommunications brands such as Vodacom, MTN, Telkom and Cell C. Entertainingly, it turns out that all the suspicious activity in that dataset relates to a single disgruntled user who brought a botnet to bear on the @TelkomZA support account out of frustration around getting their issue resolved. Interference levels would actually be quite low were it not for this user.

The remaining datasets that score high in terms of suspended users relate to the following themes:

• Politics: 2014 general elections and the ANC’s 54th national elective conference
• Protests: Rhodes Must Fall, Fees Must Fall and North West protests
• Xenophobic racism: including xenophobic attacks and the march by local foreign nationals against such attacks
• White racism and fear: the Black Monday march against farm killings, “white genocide” and land expropriation discussions
• Helen Zille’s “legacy of colonialism” tweet which touches on multiple areas including politics and race relations

Isolating the agenda(s)

We now have an idea of the themes that interference focused on. In order to make some inferences about who might be interfering with our Twitter discussions and why they might be doing so, I calculated how many suspended users each pair of datasets has in common (i.e. suspended users that appear in both datasets). This gives us the below network where each node is one of the 28 datasets and the thickness of the link between each pair of datasets tells us how many suspended users those two datasets have in common. I’ve only shown the connection between datasets when they have at least 100+ suspended users in common. The assumption is that whoever is interfering with our politics will use the same accounts to interfere with the themes that they care about. Thus, datasets will be connected when the same groups are interfering with them:

The following dynamics stand out for me in this network: Firstly, the control datasets do not have any connections between them which is what we would expect. This corroborates the hypothesis that certain datasets have coordinated activity around an agenda while others do not. Secondly, we see clear community structure across four clusters of datasets in yellow, green, pink and blue. These datasets cover topics relating to elections, protests, xenophobia, white fear, white racism (sometimes perceived and sometimes real) and Helen Zille/the DA. These are likely all part of multiple overlapping agendas because the themes involved appear across all four communities. 

Why does our community detection algorithm recognise them as four separate clusters then? It appears to relate to the age of each dataset. On closer inspection, one can see that the yellow community covers datasets from 2014-2015, the green covers 2016-2017, the pink covers 2017-2018 and the blue covers just 2018. I think that these communities represent the activities of the same groups of bad actors over time. As vitriolic users or the ‘stocks’ of automated bots get suspended by Twitter (or if bad actors change bot suppliers), the specific accounts that weigh in on specific topics change over time.

A deeper dive into some of the datasets highlights three groups within these four communities that weigh in on discussions in different combinations. For example, these are the main types of boosted content in the following datasets:

• ANC54 dataset: RET- and EFF-related
• Helen Zille ‘legacy of colonialism’ tweet dataset: RET-related
• Black Monday farm killings march dataset: EFF- and International Far Right-related
• North West protests dataset: EFF-related
• White genocide, farm killings & land expropriation dataset:EFF- and International Far Right-related

Thus, we appear to have three players:

1. Pro-EFF actors, with a focus on perceived and real white racism, and anti-ANC protests (such as around service delivery in the North West, with a focus on unseating of Zuma-backer, Supra Mahumapelo
2. Pro-Radical Economic Transformation actors, with a focus on race relations and political advancement
3. International Far Right, with a focus on driving white fear and race-based division, which plays into both the US far right and Russian narratives. This group is focused on generating South Africa-themed content for consumption by their local markets. We do not appear to be their direct target.

I have not had a chance to look into which group(s) is associated with the student protests and xenophobia yet. In future investigations, it will also be worth further unpacking why certain datasets share so many suspended users, including Super Bowl 2017 & Xenophobia, Helen Zille “legacy of colonialism” tweet & Xenophobia foreigner march, and Black Monday farm killings march & Fees Must Fall 2017. Unfortunately, this falls outside of the scope of this current investigation. Let’s now take a closer look at a few in-depth case studies, starting with the three datasets that demonstrated the highest levels of interference: ANC54, Helen Zille’s “legacy of colonialism” tweet and the #BlackMonday farm killings march.

Case study: ANC54

South Africa’s ruling party, The African National Congress’ (ANC) held its 54th annual elective conference where the party’s leaders were chosen in December 2017. This was possibly the most bitterly contested congress in the party’s history. Going head to head were two factions: the incumbent “Radical Economic Transformation” (RET) faction headed by then-president, Jacob Zuma, who had spearheaded the State Capture Project that had seen our country’s institutions fundamentally undermined in order to facilitate classic rent seeking enrichment. Their candidate was Nkosana Dlamini-Zuma (NDZ), an experienced politician within the ANC and the AU. She is also Jacob Zuma’s ex-wife. The other faction was headed by veteran politician and businessman, Cyril Ramaphosa, who espoused a reformist agenda focused on squashing corruption and cleaning up government. The stakes couldn’t have been higher. Whoever won at ANC54 would govern the country.

These were the most active suspended users involved and the users whose content they ‘boosted’ the most:

What is clear from this dataset is that a large amount of interference occurred. Most of it was the ‘boosting’ of content through bots retweeting other users (73% of tweets by suspended users were retweets of other users). The majority of suspended user activity focused on promoting the RET/NDZ camp while undermining the Ramaphosa camp.

Below is what the network of conversations around ANC54 looked like (based on a 100,000 random sample of the almost 1 million tweets that I collected). Each Twitter user is represented as a node and users are connected together when they retweet or @mention each other. You can scroll back and forth between the main communities involved (highlighted in different colours based on a community detection algorithm) and a view that shows where the suspended accounts (green) cluster. I’ve highlighted some individual users in grey whose tweets were boosted by bots (bear in mind that this is not to say that those users knew that their tweets were being boosted):

As we can see, suspended accounts are dotted throughout the network. However, they are clustered with greater density within the RET and @adamitv communities to the left of the network. Below are a few example extracts from tweets made by suspended accounts. I’ve focused on the accounts that they retweeted the most . This gives us an idea of the agenda being push. There are a few VERY IMPORTANT caveats to keep in mind as you read through these examples though, including:

• I have focused on examples where users were retweeted often by suspended accounts because this is the easiest to spot in the data. There are also ‘original’ tweets authored in the data by trolls and possibly sockpuppets. These are more difficult to identify.
• We have no way of knowing whether or not the users that were retweeted by suspended authors knew that their tweets were being artificially boosted. Just because an author was retweeted by many suspended accounts does not mean that they were in on the game. Suspended accounts could have retweeted them simply because their content aligned with the bad actors’ agendas.

The single most retweeted user in this dataset is @adamitv. Their tweets are boosted by accounts with US-based locations which is unusual given the very-South African nature of the topic. Indeed, we are not the first to report on @adamitv’s interference around ANC54. The DFR Lab reported about it at the time. Notice that most of the suspended accounts had user-defined locations set to US locations, likely because they were temporarily ‘rented’ from the international black market, where the main market for their ‘services’ is the US. It is not worth a botnet owner’s time to temporarily repurpose his bot accounts with South African-specific meta data.

We similarly see numerous other RET-aligned individuals being retweeted by suspended users with US-based locations, including the BLF (its official account, @Black1stLand1st, that of its leader, @mngxitama, and his blog @BlackOpinion2), @G_XCON (leader of the Patriotic Alliance), Gupta media (including former ANN7 journalist, @KaldenOngmu, newspaper, @The_New_Age, and subsequent owner, @MzwaneleManyi), @Kenny_T_Kunene (and his @WeeklyXpose property which ‘broke’ the Ramaphosa blesser “scandal”), @kimheller3 and Guptabot property, @WMCLeaks, amongst others.

The disproportionate boosting of RET influencers is a clear indication that there was a fair amount of pro-NDZ interference around the ANC54 conference. Clearly someone threw everything that they had at swaying the outcome in their favour. In addition, popular, EFF-aligned influencers, @AdvBarryRoux and Tumi Sole also feature highly; however, the suspended users retweeting them had SA-based locations. Thus, these suspended users are either regular trolls suspended for their vitriolic content or they are homegrown sockpuppets and bot accounts as opposed to the US-based ones used by the RET faction.

Case study: Helen Zille’s “legacy of colonialism” tweet

In March 2017, former Democratic Alliance leader, Helen Zille, visited Singapore where, amongst other things, she inspected that country’s economic strategy and recovery from its period as a British colony. On her way home from that country, she tweeted her thoughts on what South Africa might learn from Singapore’s experiences. Her famous tweet, usually shown in isolation, was actually the final tweet in the below thread (I’ve included a few user tweets to give you an idea of what she was responding to):

The response to her final tweet was unprecedented. The tweet generated thousands more tweets and much conversation in response. It would appear that when they smelt blood in the water, the bots pounced as this dataset included one of the highest volumes of suspended accounts per 1,000 users. Most of those suspended accounts were boosting others’ content (73% of suspended users’ tweets were retweets) rather than generating content themselves. These were the most active suspended users and the people whose content they were boosting (i.e. retweeting) the most:

Immediate standouts for me include @itv5 and @adamitv, who appear to be related given the similar usernames. @itv5 was involved in the boosting of 119 individual tweets including the boosting of many of @adamitv’s tweets. Below are a few examples where @itv5 and @adamitv have interacted in the past. Are they controlled by the same person?

Here’s what the network of conversations looked like. Again, you can scroll back and forth between a community view to see the groups involved and a suspended users view (with users in green) in order to see which communities suspended users came from:

Again we see a high density of suspended users around @adamitv and the accounts that @itv5 boosted (with or without those accounts’ knowledge). @itv5’s consistent presence in almost all of the boosted tweets makes me wonder whether this was part of some automation strategy whereby @itv5 would retweet a user and the bots would follow suit? Here are some tweet extracts:

Case study: Black Monday farm killings protests

Many South Africans took to the streets on the 30th October 2017 to protest the killing of farmers in what has become an incredibly divisive issue in South Africa. Proponents of the movement say that (mostly white) farmers are disproportionately likely to be attacked and/or killed while the movement’s critics claim that pushing for special recognition of farm killings amounts to racism as it unfairly elevates the interests of a minority group over other South Africans despite statistics showing that their situation is no more dire than any other group’s in South Africa.

The issue has been further complicated due to the International Far Right’s investment in the topic as a poster-child issue for the global “white genocide” narrative. South Africans have thus found themselves pawns in an international narrative that is less about us than about supporting the global White Right’s agenda. The most prominent accounts in this conversation were a mix of EFF- and RET-aligned influencers, as well as International Far Right influencers such as @LadyAodh and Michael Cernovich. The vast majority of suspended users’ activity was around the boosting of such influencers’ content:

Here’s what the network looks like. We can see pockets of interference all over the place. @adamitv has a dense cluster of suspended users around him in the middle-right of the network, while the official BLF account has a similar cluster on the middle-left of the chart. The stand out pattern though is the dense presence of suspended users in the International Far Right communities in the bottom right. Indeed, where the Far Right goes, bots and sockpuppets seem to follow, whether controlled by Far Right users, Russia, Iran or someone else:

Here are some example tweets being boosted by suspended accounts. Remember, just because a user was boosted by suspended accounts doesn’t mean that they were aware or, or party to, this activity:

Case study: white genocide, farm killings & land expropriation

Finally, I took a look at one of the datasets that falls into the blue community in our ‘agenda network’. This dataset covers discussions about “white genocide”, farm killings and land expropriation without compensation between the 27 March and 2 June 2018. As such, it’s not based around a specific event. From the below charts, we can see that the main activity by suspended accounts was split between pro-EFF accounts and the Far Right, both local and international. It’s important to point out though that much of the International Far Right discussions were around “white genocide” and much of it was not within a South African context:

Here’s what the network looks like for this dataset specifically:

And here are some example tweets by suspended users:

The conclusion

Phew, and thus we come to the end of this (rather long) investigation. It’s taken an inordinate amount of time to assemble this data and find the patterns in it, and there is still much work to be done. It’s important to remind readers that the ‘evidence’ presented here is mostly circumstantial. Regardless, it is very clear that there has been substantial interference within South African politics and this analysis allows us to formulate some hypotheses. For example:

The pro-RET actors are prolific. They seem to have their hands in ANC factionalism, anti-DA events and race division. They appear to be running a divide and conquer strategy. Or is it a distraction from State Capture strategy?  Likely both.

The pro-EFF actors are an interesting bunch. Either the EFF’s followers are particularly active, vitriolic and organised (which seems plausible, perhaps through WhatsApp groups); or, they have their own homegrown botnet of accounts with South African meta data. It’s difficult to tell but they emerge when issues of real and perceived white racism come up, thus further dividing our country.

The Far Right group, which has some local representation, but which really seems driven by the International Far Right, focuses on stoking white fears and the further polarisation of society. Much of this group’s activities aren’t really focused on the South African ‘market’. Rather we are being used as pawns to feed the global “white genocide” narrative. Despite the facts not lining up as neatly as they should, this group is happy to perpetuate their own version of reality to make South Africa a poster-child for their race-based, nationalistic agenda. It’s not really about us.

Finally, this investigation shows that there is definitely interference in South African politics on Twitter, both by local and international actors. However, the interference does not yet appear to be on the scale experienced in some countries. For example, we see that the Super Bowl 2017 dataset still exhibits much more interference than any of the South African datatsets, and when we see the International Far Right wade into a local discussion, the number of suspended users in their communities exceeds what we see in our local communities. US discussions are still ground zero for interference it would seem. However, if you take into account South Africa’s smaller Twitter population compared to the US where 2,848 known sockpuppet-accounts had some impact on their politics, the number of suspended accounts (which includes trolls, sockpuppets and bots) present in the ANC54, Helen Zille and Black Monday datasets start to loom larger.

We know that the interference that we’ve already experienced via the roughly 800 Guptabots has changed our national debates so we South Africans need to be extremely vigilant in the upcoming 2019 general elections. Local actors have years of experience in manipulating our social media discussions already and there is no reason to believe that they will slow down anytime soon. If anything, their attempts will just increase in volume and sophistication, perhaps as more players get in on the action.

Acknowledgements

I’d like to thank the following people for helping with the code required to produce this analysis, sifting through the findings and/or thoughts on interpretation: Steven Smit, Ray Joseph, Andrew Fraser, Jean le Roux and Richard Barnett.