A Twitter account impersonating former South African president Jacob Zuma’s son, Duduzane Zuma, regularly dupes people into believing it’s the 36-year-old businessman’s official account.
However, evidence gathered using online tools points to the contrary. The @Duduzane__Zuma account was originally called “Bantukazi Biko”, and had ties to the Black First Land First (BLF) political party shortly after it was created. The account only rebranded to the @Duduzane__Zuma persona sometime between 22 August 2017 and 24 February 2018.
The fact that both Duduzane’s twin sister and Jacob Zuma himself have said that the account is dubious hasn’t prevented it attracting over 113 ,000 followers.
Many users frequently mistake the account as Duduzane’s official Twitter account. But, with a bit of Twitter sleuthing, it is clear that the account started out with links to the pro-Zuma BLF. There is also evidence of curious interactions with infamous sock-puppet accounts: the Guptabots.
The account presents itself as that of Duduzane Zuma, the son of former president Jacob Zuma. He was also a close business associate of the now “expatriated” Gupta family, three brothers who used their political proximity to the Zumas to reap rewards in the form of state contracts. The Saxonwold compound of brothers Atul, Ajay and Tony were raided the same day that former president Jacob Zuma announced his resignation, but by then the Guptas had already skipped the country.
The profile picture and a Twitter bio entry gives the impression that it is Duduzane’s official account. Coupled with the way the account frames its tweets, this impression is easily entrenched.
For example, the account frequently refers to Jacob Zuma as “my father” and tweets images and videos that make it appear as if the account is really run by Duduzane himself.
A closer inspection reveals that, despite these efforts, Duduzane is likely not the person behind the account. A reverse image search shows that the account’s profile and banner pictures can be easily found and copied online. Although the account tweets “original” content that seems to originate from Duduzane, digging a bit deeper shows this is smoke and mirrors.
A recent example of this is the video congratulating (now suspended) Zandile Gumede after she was sworn in as a provincial member of parliament in KwaZulu-Natal. A widely circulated video of Duduzane congratulating Gumede was tweeted by @Duduzane__Zuma at 14:22 on 22 August 2020. But at the time it was posted, the video had been circulating on social media for almost 24 hours.
Our first step was to take a peek under the hood of the @Duduzane__Zuma account and determine two things: when the account was created and what user ID was assigned to it.
The date a user joined Twitter can be determined easily by looking at the “join date” of the user’s profile, using the Twitter API or one of several free online tools. In this case, we can see the account was created in August 2016, and the Twitonomy tool helps us nail down the exact day: 31 August 2016.
Next we went looking for the account’s user ID. This is a unique identification number that Twitter assigns to each account when it is created. The user ID is the primary way Twitter identifies how different accounts interact. The number remains the same even if a user changes their profile picture, display name or Twitter handle. This ensures historical conversation threads are kept intact, even if everyone changes their user handles.
The user ID isn’t visible directly on a profile. It can be found using online tools, the Twitter API or even the page source code itself through your browser.
This user ID is essential in establishing whether one or more accounts used to be the same. It’s a useful way to confirm whether an account has ever changed its user handle. In the case of the @Duduzane__Zuma account, the user ID is 771031898592280576.
Now that we have the join date and user ID, we can zoom back to the account’s first tweets. Since we know the account’s join date, we can use Twitter’s advanced search option to show us only tweets from the first week or month after the account was created. These often give away vital information about an account, especially if we suspect that display names or user handles were changed. Importantly, if an account was replied to or mentioned in a tweet by others, it can provide any of the old usernames used by the account.
In @Duduzane__Zuma’s case, the first four tweets all mentioned @blackfirstlandfirst, the now-suspended account formerly belonging to the political party led by Andile Mngxitama. These early mentions and follows of BLF-linked accounts become more important later.
The BLF were staunch supporters of the Guptas, to the extent that they picketed and defaced the house of former Tiso Blackstar editor-at-large Peter Bruce’s house for reporting critically on the family. The party has also frequently appeared at court hearings involving the Zumas, such as Duduzane’s culpable homicide trial in mid-2018.
We can also see who the account followed early on, since Twitter displays accounts followed by a user in the order in which they were followed. We can see from @Duduzane__Zuma’s following list that some of the very first accounts it followed were also linked to the BLF.
This provides a pretty clear indication that, in its early days, the account had a distinct connection or was at least interested in BLF.
From the same early tweets, we can identify several replies to @Duduzane__Zuma that frequently mention another mysterious account. Replies to @Duduzane__Zuma sent from @Vodacom, as well as several other users, all feature a different account in the “replying to” field.
This is the first hint of @Duduzane__Zuma’s original username: @BlackSista1. The old username crops up because of how Twitter uses the user ID to link these conversations and replies. Because the username has since changed, it sometimes shows the old user handle instead of the new one.
Using Twitter’s Advanced Search feature again, we this time looked for tweets mentioning @BlackSista1 around the same time. It showed that during this time the account was frequently mentioned in tweets alongside other BLF Twitter accounts, some of which were authored by accounts identified as the so-called “Guptabots”.
It also presents a paradox: although @Duduzane__Zuma and @BlackSista1 used to be the same account, a different @BlackSista1 account is currently active on Twitter. We’ll explain why below.
But first, to confirm that @Duduzane__Zuma and @BlackSista1 used to be the same account, we need proof that their internal user IDs match. To do this, we relied on web archiving tools to find old copies of the Twitter accounts as they appeared way back in 2016.
Archive.org and Archive.is are two websites that constantly trawl the internet to save “snapshots” of webpages as they appear at that time. If an account is popular, or suddenly goes viral, there is a chance it could have been archived by one of these sites. Google can also sometimes provide a similar cached version of a webpage, but is a lot more volatile and less reliable.
Using either of these archiving sites is straightforward: simply enter the website URL you’d like to check for archived versions, and it will provide you with a list of dates on which snapshots for that URL were taken.
Checking for archived tweets by @BlackSista1 during this earlier period shows that we are in luck: several tweets by @Blacksista1 were archived from the account’s early days.
The only catch here was that these archived pages were captured in JSON format, which is a data format often seen when working with Twitter’s API. This is still valuable information, just presented in a much less user friendly format than the usual Twitter interface.
This provided the confirmation we required: the user ID of @BlackSista1 on 1 July 2017 matched the user ID of the @Duduzane__Zuma account seen today. It also provides us with the account’s original display name, “Bantukazi Biko”.
But how can an account called @BlackSista1 currently exist at the same time as @Duduzane__Zuma?
These are actually two separate Twitter accounts (as evidenced by the separate user IDs) that both used the same Twitter user handle but at different times. After the original @BlackSista1 account changed its username to @Duduzane__Zuma, the @BlackSista1 user handle became available again.When the current @BlackSista1 account was created on 16 October 2018, the handle was available for use.
So where do the Guptabots fit in? The Guptabots were scores of deceptive accounts first seen in mid-2016 that pretended to be South Africans. In reality, these accounts were mostly being coordinated from India. Such accounts, known as “sockpuppets”, use deceptive practices to pretend they are someone, or something, they aren’t.
The Guptabots attacked users critical of the Gupta family, and amplified the Gupta-linked disinformation websites such as WMCLeaks.com and Voetsekblog that were created to distract from the Gupta family’s dubious reputation. They also showed significant support for the BLF and its leader, Andile Mngxitama.
These websites and sockpuppet accounts went silent on 31 December 2017, almost as if someone flicked a switch.
When looking at @Duduzane__Zuma’s old tweets one of them stood out: it received 21 retweets, but curiously the tweet attracted no likes at all.
A review of these 21 retweets makes it clear why: the bulk of the retweets were by accounts identified as Guptabots, many of them coming from the very first few accounts identified in early November 2016.
The @Duduzane__Zuma Twitter account might appear to be that of former president Jacob Zuma’s son, but open source evidence points to the contrary.
The account was first created under the name “Bantukazi Biko” in August 2016 and appears to have interacted with BLF accounts and networks. It was repurposed to assume the person of Duduzane around early 2018.
With no parody labels, a sizable following and a clear political slant, the account’s tweets should be read with circumspection.
Jean le Roux is a former forensic investigator, investigative journalist and disinformation researcher with the Digital Forensic Research Lab.
However, evidence gathered using online tools points to the contrary. The @Duduzane__Zuma account was originally called “Bantukazi Biko”, and had ties to the Black First Land First (BLF) political party shortly after it was created. The account only rebranded to the @Duduzane__Zuma persona sometime between 22 August 2017 and 24 February 2018.
The fact that both Duduzane’s twin sister and Jacob Zuma himself have said that the account is dubious hasn’t prevented it attracting over 113 ,000 followers.
Many users frequently mistake the account as Duduzane’s official Twitter account. But, with a bit of Twitter sleuthing, it is clear that the account started out with links to the pro-Zuma BLF. There is also evidence of curious interactions with infamous sock-puppet accounts: the Guptabots.
Smoke and mirrors
The account presents itself as that of Duduzane Zuma, the son of former president Jacob Zuma. He was also a close business associate of the now “expatriated” Gupta family, three brothers who used their political proximity to the Zumas to reap rewards in the form of state contracts. The Saxonwold compound of brothers Atul, Ajay and Tony were raided the same day that former president Jacob Zuma announced his resignation, but by then the Guptas had already skipped the country.
The profile picture and a Twitter bio entry gives the impression that it is Duduzane’s official account. Coupled with the way the account frames its tweets, this impression is easily entrenched.
For example, the account frequently refers to Jacob Zuma as “my father” and tweets images and videos that make it appear as if the account is really run by Duduzane himself.
A closer inspection reveals that, despite these efforts, Duduzane is likely not the person behind the account. A reverse image search shows that the account’s profile and banner pictures can be easily found and copied online. Although the account tweets “original” content that seems to originate from Duduzane, digging a bit deeper shows this is smoke and mirrors.
A recent example of this is the video congratulating (now suspended) Zandile Gumede after she was sworn in as a provincial member of parliament in KwaZulu-Natal. A widely circulated video of Duduzane congratulating Gumede was tweeted by @Duduzane__Zuma at 14:22 on 22 August 2020. But at the time it was posted, the video had been circulating on social media for almost 24 hours.
Under the hood
Our first step was to take a peek under the hood of the @Duduzane__Zuma account and determine two things: when the account was created and what user ID was assigned to it.
The date a user joined Twitter can be determined easily by looking at the “join date” of the user’s profile, using the Twitter API or one of several free online tools. In this case, we can see the account was created in August 2016, and the Twitonomy tool helps us nail down the exact day: 31 August 2016.
Next we went looking for the account’s user ID. This is a unique identification number that Twitter assigns to each account when it is created. The user ID is the primary way Twitter identifies how different accounts interact. The number remains the same even if a user changes their profile picture, display name or Twitter handle. This ensures historical conversation threads are kept intact, even if everyone changes their user handles.
The user ID isn’t visible directly on a profile. It can be found using online tools, the Twitter API or even the page source code itself through your browser.
This user ID is essential in establishing whether one or more accounts used to be the same. It’s a useful way to confirm whether an account has ever changed its user handle. In the case of the @Duduzane__Zuma account, the user ID is 771031898592280576.
Backtracking
Now that we have the join date and user ID, we can zoom back to the account’s first tweets. Since we know the account’s join date, we can use Twitter’s advanced search option to show us only tweets from the first week or month after the account was created. These often give away vital information about an account, especially if we suspect that display names or user handles were changed. Importantly, if an account was replied to or mentioned in a tweet by others, it can provide any of the old usernames used by the account.
In @Duduzane__Zuma’s case, the first four tweets all mentioned @blackfirstlandfirst, the now-suspended account formerly belonging to the political party led by Andile Mngxitama. These early mentions and follows of BLF-linked accounts become more important later.
The BLF were staunch supporters of the Guptas, to the extent that they picketed and defaced the house of former Tiso Blackstar editor-at-large Peter Bruce’s house for reporting critically on the family. The party has also frequently appeared at court hearings involving the Zumas, such as Duduzane’s culpable homicide trial in mid-2018.
We can also see who the account followed early on, since Twitter displays accounts followed by a user in the order in which they were followed. We can see from @Duduzane__Zuma’s following list that some of the very first accounts it followed were also linked to the BLF.
This provides a pretty clear indication that, in its early days, the account had a distinct connection or was at least interested in BLF.
Finding names
From the same early tweets, we can identify several replies to @Duduzane__Zuma that frequently mention another mysterious account. Replies to @Duduzane__Zuma sent from @Vodacom, as well as several other users, all feature a different account in the “replying to” field.
This is the first hint of @Duduzane__Zuma’s original username: @BlackSista1. The old username crops up because of how Twitter uses the user ID to link these conversations and replies. Because the username has since changed, it sometimes shows the old user handle instead of the new one.
Using Twitter’s Advanced Search feature again, we this time looked for tweets mentioning @BlackSista1 around the same time. It showed that during this time the account was frequently mentioned in tweets alongside other BLF Twitter accounts, some of which were authored by accounts identified as the so-called “Guptabots”.
It also presents a paradox: although @Duduzane__Zuma and @BlackSista1 used to be the same account, a different @BlackSista1 account is currently active on Twitter. We’ll explain why below.
Confirmation
But first, to confirm that @Duduzane__Zuma and @BlackSista1 used to be the same account, we need proof that their internal user IDs match. To do this, we relied on web archiving tools to find old copies of the Twitter accounts as they appeared way back in 2016.
Archive.org and Archive.is are two websites that constantly trawl the internet to save “snapshots” of webpages as they appear at that time. If an account is popular, or suddenly goes viral, there is a chance it could have been archived by one of these sites. Google can also sometimes provide a similar cached version of a webpage, but is a lot more volatile and less reliable.
Using either of these archiving sites is straightforward: simply enter the website URL you’d like to check for archived versions, and it will provide you with a list of dates on which snapshots for that URL were taken.
Checking for archived tweets by @BlackSista1 during this earlier period shows that we are in luck: several tweets by @Blacksista1 were archived from the account’s early days.
The only catch here was that these archived pages were captured in JSON format, which is a data format often seen when working with Twitter’s API. This is still valuable information, just presented in a much less user friendly format than the usual Twitter interface.
This provided the confirmation we required: the user ID of @BlackSista1 on 1 July 2017 matched the user ID of the @Duduzane__Zuma account seen today. It also provides us with the account’s original display name, “Bantukazi Biko”.
Contradiction
But how can an account called @BlackSista1 currently exist at the same time as @Duduzane__Zuma?
These are actually two separate Twitter accounts (as evidenced by the separate user IDs) that both used the same Twitter user handle but at different times. After the original @BlackSista1 account changed its username to @Duduzane__Zuma, the @BlackSista1 user handle became available again.When the current @BlackSista1 account was created on 16 October 2018, the handle was available for use.
Guptabots
So where do the Guptabots fit in? The Guptabots were scores of deceptive accounts first seen in mid-2016 that pretended to be South Africans. In reality, these accounts were mostly being coordinated from India. Such accounts, known as “sockpuppets”, use deceptive practices to pretend they are someone, or something, they aren’t.
The Guptabots attacked users critical of the Gupta family, and amplified the Gupta-linked disinformation websites such as WMCLeaks.com and Voetsekblog that were created to distract from the Gupta family’s dubious reputation. They also showed significant support for the BLF and its leader, Andile Mngxitama.
These websites and sockpuppet accounts went silent on 31 December 2017, almost as if someone flicked a switch.
When looking at @Duduzane__Zuma’s old tweets one of them stood out: it received 21 retweets, but curiously the tweet attracted no likes at all.
A review of these 21 retweets makes it clear why: the bulk of the retweets were by accounts identified as Guptabots, many of them coming from the very first few accounts identified in early November 2016.
Conclusion
The @Duduzane__Zuma Twitter account might appear to be that of former president Jacob Zuma’s son, but open source evidence points to the contrary.
The account was first created under the name “Bantukazi Biko” in August 2016 and appears to have interacted with BLF accounts and networks. It was repurposed to assume the person of Duduzane around early 2018.
With no parody labels, a sizable following and a clear political slant, the account’s tweets should be read with circumspection.
Jean le Roux is a former forensic investigator, investigative journalist and disinformation researcher with the Digital Forensic Research Lab.
Add new comment