ANALYSIS | That’s not Duduzane Zuma’s Twitter account. Here’s why

02 September 2020 - 14:51

By Jean le Roux Africa Check

A Twitter account impersonating former president Jacob Zuma’s son, Duduzane Zuma, regularly dupes people into believing it’s the 36-year-old businessman’s official account.

However, evidence gathered using online tools points to the contrary. The @Duduzane__Zuma account was originally called “Bantukazi Biko”, and had ties to the Black First Land First (BLF) political party shortly after it was created. The account rebranded to the @Duduzane__Zuma persona sometime between August 22 2017 and February 24 2018.

The fact that both Duduzane’s twin sister and the former president himself have said the account is dubious hasn’t prevented it attracting more than 113,000 followers.

Many users frequently mistake the account as Duduzane’s official Twitter account. But, with a bit of Twitter sleuthing, it is clear the account started out with links to the pro-Zuma BLF. There is also evidence of curious interactions with infamous sock-puppet accounts: the Guptabots.

Smoke and mirrors

The account presents itself as that of Duduzane Zuma, the son of former president Zuma. He was also a close business associate of the now expatriated Gupta family, the three brothers who used their political proximity to the Zumas to reap rewards in the form of state contracts.

The Saxonwold compound of brothers Atul, Ajay and Tony was raided on the same day Zuma announced his resignation, but by then the Guptas had already skipped the country.

The profile picture and a Twitter bio entry gives the impression it is Duduzane’s official Twitter account. Coupled with the way the account frames its tweets, this impression is easily entrenched.

For example, the account frequently refers to the former president as “my father”, and tweets images and videos that make it appear as if the account really is run by his son.

A closer inspection reveals that, despite these efforts, Duduzane is likely not the person behind the account. A reverse image search shows the account’s profile and banner pictures can easily be found and copied online. Though the account tweets “original” content that seems to originate from Duduzane, digging deeper shows this is smoke and mirrors.

A recent example is the video congratulating (now suspended) Zandile Gumede after she was sworn in as a provincial member of parliament in KwaZulu-Natal. A widely circulated video of Duduzane congratulating Gumede was tweeted by @Duduzane__Zuma at 14:22 on August 22 2020. But at the time it was posted, the video had been circulating on social media for almost 24 hours.

Under the hood

Our first step was to take a peek under the hood of the @Duduzane__Zuma account and determine two things: when the account was created and what user ID was assigned to it.

The date a user joined Twitter can easily be determined by looking at the “join date” on the user’s profile, using the Twitter API or one of several free online tools. In this case, we can see the account was created in August 2016, and the Twitonomy tool helps us nail down the exact day: August 31 2016.

Next we went looking for the account’s user ID. This is a unique identification number Twitter assigns to each account when it is created. The user ID is the primary way Twitter identifies how different accounts interact. The number remains the same even if a user changes their profile picture, display name or Twitter handle. This ensures historical conversation threads are kept intact, even if everyone changes their user handles.

The user ID isn’t visible directly on a profile. It can be found using online tools, the Twitter API or even the page source code itself through your browser.

This user ID is essential in establishing whether one or more accounts used to be the same. It’s a useful way to confirm whether an account has ever changed its user handle. In the case of the @Duduzane__Zuma account, the user ID is 771031898592280576.

Backtracking

Now that we have the join date and user ID, we can zoom back to the account’s first tweets. Since we know the account’s join date, we can use Twitter’s advanced search option to only show us tweets from the first week or month after the account was created. These often gives away vital information about an account, especially if we suspect display names or user handles were changed. Importantly, if an account was replied to or mentioned in a tweet by others, it can provide any of the old usernames used by the account.

In @Duduzane__Zuma’s case, the first four tweets all mentioned @blackfirstlandfirst, the now-suspended account formerly belonging to the political party led by Andile Mngxitama. These early mentions and follows of BLF-linked accounts become more important later.

The BLF were staunch supporters of the Guptas, to the extent that its members picketed and defaced the house of former Tiso Blackstar editor-at-large Peter Bruce for reporting critically about the family. The party has also frequently appeared at court hearings involving the Zumas, including Duduzane’s culpable homicide trial in mid-2018.

We can also see who the account followed early on since Twitter displays accounts followed by a user in the order in which they were followed. We can see from @Duduzane__Zuma’s list that some of the first accounts it followed were also linked to the BLF.

This provides a pretty clear indication that, in its early days, the account had a distinct connection or was at least interested in the BLF.

Finding names

From the same early tweets, we can identify several replies to @Duduzane__Zuma that frequently mention another mysterious account. Replies to @Duduzane__Zuma sent from @Vodacom, and several other users, all feature a different account in the “replying to” field.

Guptabots

Where do the Guptabots fit in? The Guptabots were scores of deceptive accounts first seen in mid-2016 that pretended to be South Africans. In reality, these accounts were mostly being co-ordinated from India. Such accounts, known as “sockpuppets”, use deceptive practices to pretend they are someone, or something, they aren’t.

The Guptabots attacked users critical of the Gupta family, and amplified the Gupta-linked disinformation websites such as WMCLeaks.com and Voetsekblog that were created to distract from the Gupta family’s dubious reputation. They also showed significant support for the BLF and its leader, Mngxitama.

These websites and sockpuppet accounts went silent on December 31 2017, almost as if someone flicked a switch.

When looking at @Duduzane__Zuma’s old tweets, one stood out: it received 21 retweets, but curiously the tweet attracted no likes at all.

This provided the confirmation we required: the user ID of @BlackSista1 on July 1 2017 matched the user ID of the @Duduzane__Zuma account seen today. It also provides us with the account’s original display name, “Bantukazi Biko”.

Contradiction

But how can an account called @BlackSista1 exist at the same time as @Duduzane__Zuma?

These are actually two separate Twitter accounts (as evidenced by the separate user IDs) that used the same Twitter user handle but at different times. After the original @BlackSista1 account changed its username to @Duduzane__Zuma, the @BlackSista1 user handle became available again. When the current @BlackSista1 account was created on October 16 2018, the handle was available for use.

This is the first hint of @Duduzane__Zuma’s original username, @BlackSista1. The old username crops up because of how Twitter uses the user ID to link these conversations and replies. Because the username has since changed, it sometimes shows the old user handle instead of the new one.

Using Twitter’s Advanced Search feature, we looked for tweets mentioning @BlackSista1 around the same time. It showed that during this time, the account was frequently mentioned in tweets alongside other BLF Twitter accounts, some of which were authored by accounts identified as the “Guptabots”.

It also presents a paradox: although @Duduzane__Zuma and @BlackSista1 used to be the same account, a different @BlackSista1 account is now active on Twitter. We’ll explain why below.

Confirmation

To confirm that @Duduzane__Zuma and @BlackSista1 used to be the same account, we need proof that their internal user IDs match. To do this, we relied on web archiving tools to find old copies of the Twitter accounts as they appeared in 2016.

Archive.org and Archive.is are two websites that constantly trawl the internet to save “snapshots” of web pages as they appear at that time. If an account is popular, or suddenly goes viral, there is a chance it could have been archived by one of these sites. Google can also sometimes provide a similar cached version of a web page, but is a lot more volatile and less reliable.

Using either of these archiving sites is straightforward: simply enter the website URL you’d like to check for archived versions and it will provide you with a list of dates on which snapshots for that URL were taken.

Checking for archived tweets by @BlackSista1 during this earlier period shows several tweets by @Blacksista1 were archived from the account’s early days.

The only catch was that these archived pages were captured in JSON format, which is a data format often seen when working with Twitter’s API. This is still valuable information, just presented in a much less user friendly format than the usual Twitter interface.

Conclusion

The @Duduzane__Zuma Twitter account might appear to be that of the former president son, but open source evidence points to the contrary.

The account was first created under the name “Bantukazi Biko” in August 2016 and appears to have interacted with BLF accounts and networks. It was repurposed to assume the person of Duduzane around early 2018.

With no parody labels, a sizeable after and a clear political slant, the account’s tweets should be read with circumspection.

Jean le Roux is a former forensic investigator, investigative journalist and disinformation researcher with the Digital Forensic Research Lab.

This report was written by Africa Check, a non-partisan fact-checking organisation. View the original article on their website.