Spreading hate online

The Twitter account @uLerato_pillay is one among many that spreads xenophobic sentiments on social media via various hashtags. How did it start and how does it do its dirty work?

In 2016, South Africa had its first glimpse of how social media can be weaponised to spread digital propaganda. Scores of sock-puppet accounts based in India rallied to the defence of the Gupta family. These accounts, presenting as and pretending to be those of South Africans, came to be known as the Guptabots.

In recent years, these campaigns have become more sophisticated. The perpetrators have learnt to manipulate social media platforms to get hashtags and topics trending, most often by using hashtags sitting at the centre of such a campaign.

Since late June, the Digital Forensic Research Lab (DFRLab) of the Atlantic Council, an American think-tank based in Washington DC, has been monitoring hashtags that spread xenophobic sentiments online. The DFRLab’s purpose is to identify, expose and explain disinformation, and uses open source investigation techniques track  and trace propaganda and hate speech.

Related article:

Several Twitter users requested the DFRLab to investigate several suspect hashtags and the main account orchestrating them: @uLerato_pillay. This culminated in an article published on 3 July 2020 looking at the origins of the account and its links with the nationalist South African First party.

Hashtags are the main way of distributing @uLerato_pillay’s xenophobic narratives, and our analysis starts with the most prominent: #PutSouthAfricansFirst. 

Zooming out

The DFRLab found that there have been almost 600 000 mentions of #PutSouthAfricansFirst on Twitter since 1 November 2019, when the @uLerato_pillay account was created. The account has authored 1 883 of these tweets to date. This was concurrent with the findings of a recent report by the Centre for Analytics and Behavioural Change (CABC).

Although significantspikes in volumes were seen around 22 May, 8 June and 7 July 2020, the biggest single point of engagement with this hashtag remained the very first tweet on 27 April, when it had nearly 25 000 mentions on the day.

An analysis using Brandwatch showing the sudden and marked increase in the #PutSouthAfricansFirst hashtag.
An analysis using Brandwatch showing the sudden and marked increase in the #PutSouthAfricansFirst hashtag.

The first use of the hashtag was in a tweet taking a swipe at the EFF’s Julius Malema. The @uLerato_pillay account used the hashtag 170 times on this day – 22 times in replies, 145 times in retweets and the balance in replies to others. 

Apart from this hashtag, the account is also responsible for a much larger swathe of anti-migrant posts, as are the users who amplify its content. As seen in the CABC report, and additional reporting and analysis by Superlinear, @uLerato_pillay frequently proposes hashtags that the account’s followers then replicate. 

Further evidence of the manipulation of Twitter’s algorithms were found among @uLerato_pillay’s tweets,A  phenomenon known as brigadingis used by the @ulerato_pillay account to game Twitter’s algorithms into flagging these hashtags as trending, and basically entails calling on its followers to spam certain hashtags to get in to trend. In other examples, @uLerato_pillay planned certain hashtags for late in the evening or early in the morning, when low user numbers make it easier for content to trend.

https://twitter.com/uLerato_pillay/status/1280077265179721733
https://twitter.com/uLerato_pillay/status/1280441199950692358
https://twitter.com/uLerato_pillay/status/1280228944692883458

The DFRLab investigation considered the three largest hashtags used in conjunction with #PutSouthAfricansFirst. Between the creation of the account and 21 August 2020, @uLerato_pillay authored about 2 150 original tweets containing one or more of these hashtags:

HashtagOriginal TweetsRetweets and RepliesTotal
#PutSouthAfricanFirst5971 2861 883
#ForeignersVacateOurJobs255580
#OpenRefugeeCamps196483
#InfluxOfImmigrantsMustStop2487111

Over the same period, these hashtags were mentioned a total of 624 963 times by 70 446 different Twitter users. The @uLerato_pillay account’s centrality in this hashtag network can be seen from its vast number of mentions by other accounts during this time: @uLerato_pillay was mentioned more than 86 000 times alongside these hashtags. This means users were either replying to the account or tagging it in tweets containing these hashtags. For the same reason, @myANC and @CyrilRamaphosa also feature quite high here as users were tagging them quite often.

An analysis using media monitoring tool Brandwatch that juxtaposes tweets authored by @uLerato_pillay (top) versus tweets authored by all users (bottom) showing the correlation between @uLerato_pillay’s tweets and the spike in the use of the hashtag.
An analysis using media monitoring tool Brandwatch that juxtaposes tweets authored by @uLerato_pillay (top) versus tweets authored by all users (bottom) showing the correlation between @uLerato_pillay’s tweets and the spike in the use of the hashtag.

By plotting the tweets authored by @uLerato_pillay that contain these hashtags, we can see a correlation between the number of mentions of the hashtag by other users (the bottom graph) and the number of mentions by the @uLerato_pillay account. 

For reference, #InfluxOfImmigrantsMustStop (red) peaked on 25 June, whereas  #ForeignersVacateOurJobs did so on 4 August and #OpenRefugeeCamps on 12 August. Most of these were also used in conjunction with #PutSouthAfricansFirst.

In all three cases, @uLerato_pillay was either the initiator of the hashtag or an early adopter. There are also indications that the account was gaming Twitter’s algorithms to get these hashtags to trend, as mentioned above.

Screengrabs from tweets by the @uLerato_Pillay account using these hashtags, in most cases these were the earliest or one of the earlier tweets.
Screengrabs from tweets by the @uLerato_Pillay account using these hashtags, in most cases these were the earliest or one of the earlier tweets.
https://twitter.com/uLerato_pillay/status/1276019138113220610
https://twitter.com/uLerato_pillay/status/1293299945181716482
https://twitter.com/uLerato_pillay/status/1290360751501213698

The spreaders of hate 

A disproportionately large part of the conversation around these hashtags was driven by only a fraction of the accounts using these hashtags. The four hate-filled hashtags were used almost 700 000 times between November 2019 and August 2020, consisting of tweets and retweets from over 70 000 unique users. 

But the top 20 most vocal accounts, or less than 0.003% of the accounts,  were responsible for 7.5% (or 56 885) of these mentions. 

If we exclude retweets and replies, the top 20 most vocal accounts (0.16%) authored 17.6% (10 622) of the 60 085 original tweets using the hashtag.

A visualisation showing the relative differences between the volumes of the top 20 most active accounts and the rest of the dataset. The top 20 accounts vastly outperform their relative size in users.
A visualisation showing the relative differences between the volumes of the top 20 most active accounts and the rest of the dataset. The top 20 accounts vastly outperform their relative size in users.

What this shows is that a disproportionate amount of the conversation is being driven by a small number of accounts, likely being manufactured and manipulated by a group or groups with vested interest in making the trend look like an issue that thousands of people find important. 

Analysing @uLerato_pillay’s nearly 60 000 followers by checking their account creation dates shows that a large number of these accounts was created this year, mostly in March and April. This is not necessarily indicative of coordinated inauthentic behaviour, though, as it could also be attributed to people creating accounts and following it in response to the rise of the hashtag and its sentiments.

A graph showing the creation month and year for each of @uLerato_pillay’s nearly 60 000 followers. A large number of these accounts were created between January and April 2020.
A graph showing the creation month and year for each of @uLerato_pillay’s nearly 60 000 followers. A large number of these accounts were created between January and April 2020.

Although there is some indication that suspicious accounts are following @uLerato_pillay, it does not appear that these accounts are amplifying its content by any large degree, and it is unlikely that these are so-called bots.

It would appear that this is a small group of real individuals who are abusing Twitter’s algorithms to get nationalist hashtags trending. This populism is then co-opted by die-hard xenophobes who rally around the hashtags.

Who #PutSouthAfricans first?

The question of who coined the phrase has been ventilated before. On 7 August, the account @DJNewAfrica posted a tweet asking this exact question. Only one of the 63 responses credited former Johannesburg mayor Herman Mashaba with the hashtag. Another user indicated the African Transformation Movement (ATM) came up with the slogan first and that it was “hijacked by the enemy” – the enemy being Mashaba. 

The ATM was indeed first: the slogan “Put South Africa First” was used as part of its 2019 election campaign messaging, but the hashtag was first used and popularised by @uLerato_pillay. The ATM did not leverage the slogan on social media until after @uLerato_pillay used it On 27 April 2020. 

Similarly, Mashaba only started using the hashtag about two hours and 18 minutes after @uLerato_pillay as part of a thread in which he advertised his new movement, The People’s Dialogue.  

Over the following few weeks, Mashaba used the #PutSouthAfricansFirst hashtag on several occasions, but his engagement with it gradually declined. He also began to include other hashtags more relevant to The People’s Dialogue in his tweets.

An analysis using Brandwatch, indicating the mentions of #PutSouthAfricansFirst by Herman Mashaba between 1 April 2020 and 21 August 2020.
An analysis using Brandwatch, indicating the mentions of #PutSouthAfricansFirst by Herman Mashaba between 1 April 2020 and 21 August 2020.

uLerato_pillay and Mario Khumalo

Since these early interactions with politicians, the #PutSouthAfricansFirst brigade has courted several political parties. South African First (SAF) party founder Mario Khumalo frequently retweets @uLerato_pillay’s tweets, despite previously telling the Daily Maverick he does not know who is behind the @uLerato_pillay account and that this person, whoever it is, is not a member of his party. 

These denials notwithstanding, the earlier DFRLab piece linked @uLerato_pillay to another account called @SfisoGwala_SA, and showed how @uLerato_pillay used to be known as @Sfiso82648954. The @SfisoGwala_SA account claimed he was a member of the SAF before his account was suspended. The @uLerato_pillay’s account also first interacted with SAF in a series of 17 tweets and retweets on 11 April In which the account shared the party’s manifesto and introduced Mario Khumalo as the movement’s leader. @uLerato_pillay denied being a part of the SAF.

https://twitter.com/uLerato_pillay/status/1249016547642953729
https://twitter.com/uLerato_pillay/status/1276054867157622785
A Brandwatch analysis showing the mentions of @mariokhumalo by @uLerato_pillay between 1 April 2020 and 21 August 2020.
A Brandwatch analysis showing the mentions of @mariokhumalo by @uLerato_pillay between 1 April 2020 and 21 August 2020.
A Brandwatch analysis showing the mentions of @SAF_RSA by @uLerato_pillay between 1 April 2020 and 21 August 2020.
A Brandwatch analysis showing the mentions of @SAF_RSA by @uLerato_pillay between 1 April 2020 and 21 August 2020.

A notable tweet during this time was the apparent endorsement of @SAF_RSA and The People’s Dialogue by the @uLerato_pillay account. After the @SAF_RSA account was suspended, @uLerato_pillay retweeted a request from the new @SAF_SouthAfrica account to follow it in the suspended account’s stead.

Since May, it seems that @uLerato_pillay’s political allegiance has shifted yet again, this time in favour of the ATM and SAF. In August, after the Daily Maverick’s publication of the CABC report, the @SAF_SouthAfrica account tweeted its support of @uLerato_pillay.

https://twitter.com/uLerato_pillay/status/1263752890226802690
https://twitter.com/uLerato_pillay/status/1289979893036457984

Gaming and mobilisation

Although these interactions occur in the digital sphere, there has been definite spillover into the real world in the form of marches and protests organised by these accounts. 

The @uLerato_pillay account was quite vocal in the #WeStandWithSATruckDrivers hashtag, and again displayed evidence of gaming Twitter’s algorithms and organising Twitter “follow” trains – in which accounts follow whoever retweets their content – along the same lines.

A march organised for 29 August is also in the pipeline, on the same day that Mashaba will be launching his own party. 

The first mention of this #29AugustProtest from the @uLerato_pillay account was on 28 July 2020 when it retweeted a tweet by @landback_ mentioning this hashtag. This changed into #29AugustCitizensMarch on 9 August, again aggressively pushed by the @uLerato_pillay account.

Hinting at violence

The account did not appear to directly encourage its followers to enact violence on migrants, but instead served as a beacon for those who did. While a handful of tweets could be interpreted as encouraging violence – such as the image associated with this tweet or the call to use “any means necessary” to get South Africa back – the account was more likely to resort to name-calling or implying that migrants would be removed.

In some cases, the @uLerato_pillay account went as far as copying and pasting content from old articles published on digital media platforms for their xenophobic rhetoric. These were published as “current” events, despite the fact that the articles were several years old.

Screengrabs from tweets by the @uLerato_pillay account that were copied verbatim from reportin by mainstream media outlets. These articles were months, and even years old.
Screengrabs from tweets by the @uLerato_pillay account that were copied verbatim from reportin by mainstream media outlets. These articles were months, and even years old.

While the account did not necessarily post significant amounts of original content inciting violence, it did amplify content promoting violence against migrants to its followers. In several instances the account referred to foreign nationals as leeches, and it retweeted content promoting violence against migrants and calling them “evil” or “animals”. 

https://twitter.com/uLerato_pillay/status/1248555894545231873
https://twitter.com/uLerato_pillay/status/1290217112712048640

Accounts such as @uLerato_pillay skirt social media platforms’ rules against hate speech and hateful conduct carefully, instead using their large followings, their knowledge of Twitter’s algorithms and inflammatory language to urge their less scrupulous followers to do the dirty work. 

Meanwhile, @uLerato_pillay hides behind his perceived anonymity, safe from the repercussions of these hashtags as they play out in the streets of Thokoza.

If you want to republish this article please read our guidelines.