ANALYSIS: No, that is not Duduzane Zuma’s Twitter account. Right here’s why
A Twitter account impersonating former South African president Jacob Zuma’s son, Duduzane Zuma, usually dupes folks into believing it’s the 36-year-old businessman’s official account.
Nevertheless, proof gathered utilizing on-line instruments factors on the contrary. The @Duduzane__Zuma account was initially referred to as “Bantukazi Biko”, and had ties to the Black First Land First (BLF) political occasion shortly after it was created. The account solely rebranded to the @Duduzane__Zuma persona someday between 22 August 2017 and 24 February 2018.
The truth that each Duduzane’s twin sister and Jacob Zuma himself have mentioned that the account is doubtful hasn’t prevented it attracting over 113 ,000 followers.
Many customers steadily mistake the account as Duduzane’s official Twitter account. However, with a little bit of Twitter sleuthing, it’s clear that the account began out with hyperlinks to the pro-Zuma BLF. There may be additionally proof of curious interactions with notorious sock-puppet accounts: the Guptabots.
Smoke and mirrors
The account presents itself as that of Duduzane Zuma, the son of former president Jacob Zuma. He was additionally a detailed enterprise affiliate of the now “expatriated” Gupta household, three brothers who used their political proximity to the Zumas to reap rewards within the type of state contracts. The Saxonwold compound of brothers Atul, Ajay and Tony had been raided the identical day that former president Jacob Zuma introduced his resignation, however by then the Guptas had already skipped the nation.
The profile image and a Twitter bio entry gives the look that it’s Duduzane’s official account. Coupled with the way in which the account frames its tweets, this impression is definitely entrenched.
For instance, the account steadily refers to Jacob Zuma as “my father” and tweets pictures and movies that make it seem as if the account is de facto run by Duduzane himself.
A better inspection reveals that, regardless of these efforts, Duduzane is probably going not the individual behind the account. A reverse picture search reveals that the account’s profile and banner photos might be simply discovered and copied on-line. Though the account tweets “authentic” content material that appears to originate from Duduzane, digging a bit deeper reveals that is smoke and mirrors.
A current instance of that is the video congratulating (now suspended) Zandile Gumede after she was sworn in as a provincial member of parliament in KwaZulu-Natal. A extensively circulated video of Duduzane congratulating Gumede was tweeted by @Duduzane__Zuma at 14:22 on 22 August 2020. However on the time it was posted, the video had been circulating on social media for nearly 24 hours.
Below the hood
Our first step was to take a peek below the hood of the @Duduzane__Zuma account and decide two issues: when the account was created and what consumer ID was assigned to it.
The date a consumer joined Twitter might be decided simply by trying on the “be part of date” of the consumer’s profile, utilizing the Twitter API or one among a number of free on-line instruments. On this case, we will see the account was created in August 2016, and the Twitonomy software helps us nail down the precise day: 31 August 2016.
Subsequent we went searching for the account’s consumer ID. It is a distinctive identification quantity that Twitter assigns to every account when it’s created. The consumer ID is the first manner Twitter identifies how completely different accounts work together. The quantity stays the identical even when a consumer modifications their profile image, show identify or Twitter deal with. This ensures historic dialog threads are saved intact, even when everybody modifications their consumer handles.
The consumer ID isn’t seen straight on a profile. It may be discovered utilizing on-line instruments, the Twitter API and even the web page supply code itself by means of your browser.
This consumer ID is important in establishing whether or not a number of accounts was the identical. It’s a helpful option to verify whether or not an account has ever modified its consumer deal with. Within the case of the @Duduzane__Zuma account, the consumer ID is 771031898592280576.
Now that we’ve got the be part of date and consumer ID, we will zoom again to the account’s first tweets. Since we all know the account’s be part of date, we will use Twitter’s superior search choice to point out us solely tweets from the primary week or month after the account was created. These typically give away very important details about an account, particularly if we suspect that show names or consumer handles had been modified. Importantly, if an account was replied to or talked about in a tweet by others, it will possibly present any of the previous usernames utilized by the account.
In @Duduzane__Zuma’s case, the primary 4 tweets all talked about @blackfirstlandfirst, the now-suspended account previously belonging to the political occasion led by Andile Mngxitama. These early mentions and follows of BLF-linked accounts change into extra essential later.
The BLF had been staunch supporters of the Guptas, to the extent that they picketed and defaced the home of former Tiso Blackstar editor-at-large Peter Bruce’s home for reporting critically on the household. The occasion has additionally steadily appeared at courtroom hearings involving the Zumas, comparable to Duduzane’s culpable murder trial in mid-2018.
We will additionally see who the account adopted early on, since Twitter shows accounts adopted by a consumer within the order by which they had been adopted. We will see from @Duduzane__Zuma’s following checklist that a few of the very first accounts it adopted had been additionally linked to the BLF.
This gives a reasonably clear indication that, in its early days, the account had a definite connection or was at the very least excited about BLF.
From the identical early tweets, we will determine a number of replies to @Duduzane__Zuma that steadily point out one other mysterious account. Replies to @Duduzane__Zuma despatched from @Vodacom, in addition to a number of different customers, all characteristic a distinct account within the “replying to” discipline.
That is the primary trace of @Duduzane__Zuma’s authentic username: @BlackSista1. The previous username crops up due to how Twitter makes use of the consumer ID to hyperlink these conversations and replies. As a result of the username has since modified, it generally reveals the previous consumer deal with as an alternative of the brand new one.
Utilizing Twitter’s Superior Search characteristic once more, we this time appeared for tweets mentioning @BlackSista1 across the identical time. It confirmed that in this time the account was steadily talked about in tweets alongside different BLF Twitter accounts, a few of which had been authored by accounts recognized because the so-called “Guptabots”.
It additionally presents a paradox: though @Duduzane__Zuma and @BlackSista1 was the identical account, a distinct @BlackSista1 account is at present lively on Twitter. We’ll clarify why under.
However first, to verify that @Duduzane__Zuma and @BlackSista1 was the identical account, we’d like proof that their inner consumer IDs match. To do that, we relied on internet archiving instruments to search out previous copies of the Twitter accounts as they appeared manner again in 2016.
Archive.org and Archive.is are two web sites that consistently trawl the web to save lots of “snapshots” of webpages as they seem at the moment. If an account is well-liked, or immediately goes viral, there’s a probability it might have been archived by one among these websites. Google may also generally present the same cached model of a webpage, however is much more risky and fewer dependable.
Utilizing both of those archiving websites is simple: merely enter the web site URL you’d wish to examine for archived variations, and it’ll give you a listing of dates on which snapshots for that URL had been taken.
Checking for archived tweets by @BlackSista1 throughout this precedent days reveals that we’re in luck: a number of tweets by @Blacksista1 had been archived from the account’s early days.
The one catch right here was that these archived pages had been captured in JSON format, which is a knowledge format typically seen when working with Twitter’s API. That is nonetheless invaluable data, simply introduced in a a lot much less consumer pleasant format than the standard Twitter interface.
This offered the affirmation we required: the consumer ID of @BlackSista1 on 1 July 2017 matched the consumer ID of the @Duduzane__Zuma account seen at this time. It additionally gives us with the account’s authentic show identify, “Bantukazi Biko”.
However how can an account referred to as @BlackSista1 at present exist concurrently @Duduzane__Zuma?
These are literally two separate Twitter accounts (as evidenced by the separate consumer IDs) that each used the identical Twitter consumer deal with however at completely different instances. After the unique @BlackSista1 account modified its username to @Duduzane__Zuma, the @BlackSista1 consumer deal with turned out there once more.When the present @BlackSista1 account was created on 16 October 2018, the deal with was out there to be used.
So the place do the Guptabots slot in? The Guptabots had been scores of misleading accounts first seen in mid-2016 that pretended to be South Africans. In actuality, these accounts had been principally being coordinated from India. Such accounts, often called “sockpuppets”, use misleading practices to faux they’re somebody, or one thing, they aren’t.
The Guptabots attacked customers essential of the Gupta household, and amplified the Gupta-linked disinformation web sites comparable to WMCLeaks.com and Voetsekblog that had been created to distract from the Gupta household’s doubtful status. Additionally they confirmed vital help for the BLF and its chief, Andile Mngxitama.
These web sites and sockpuppet accounts went silent on 31 December 2017, nearly as if somebody flicked a swap.
When taking a look at @Duduzane__Zuma’s previous tweets one among them stood out: it acquired 21 retweets, however curiously the tweet attracted no likes in any respect.
A evaluate of those 21 retweets makes it clear why: the majority of the retweets had been by accounts recognized as Guptabots, lots of them coming from the very first few accounts recognized in early November 2016.
The @Duduzane__Zuma Twitter account would possibly seem like that of former president Jacob Zuma’s son, however open supply proof factors on the contrary.
The account was first created below the identify “Bantukazi Biko” in August 2016 and seems to have interacted with BLF accounts and networks. It was repurposed to imagine the individual of Duduzane round early 2018.
With no parody labels, a large following and a transparent political slant, the account’s tweets ought to be learn with circumspection.
Jean le Roux is a former forensic investigator, investigative journalist and disinformation researcher with the Digital Forensic Analysis Lab.
© Copyright Africa Verify 2020. Learn our republishing pointers. It’s possible you’ll reproduce this piece or content material from it for the aim of reporting and/or discussing information and present occasions. That is topic to: Crediting Africa Verify within the byline, preserving all hyperlinks to the sources used and including this sentence on the finish of your publication: “This report was written by Africa Verify, a non-partisan fact-checking organisation. View the unique piece on their web site”, with a hyperlink again to this web page.