The Unisa employee who manufactures fake news to divide SA

November 15, 2018

On September 26, 2018, a Twitter account @Mzansistories tweeted a link to an article on its website. The tweet, pictured below, featured the face of a black man next to a crying white girl under the headline: “Meet a man who raped a 6 years old girl at Dros silverton, Pretora in man’s toilet.”

The underlying racial inferences was clear from the tweet: a black man raped a white girl.

Yet a short while later it would be revealed that a 22-year old white man stood accused of the rape of the girl.

A News24 investigation can now reveal that William Mahlatse Ramatseba (29) an office administrator at University of South Africa (UNISA) Sunnyside campus, is the author of Mzansistories.com, Allnews.co.za and several other disinformation websites. Ramatseba and his sister, Grace, use several Facebook groups to distribute the fake stories found on their websites.

The brother-and-sister duo, hailing from the town of Tzaneen in Limpopo, have been operating these and similar disinformation websites from at least early 2016.

DrosRape Tweet

Undermining credibility

The DrosRape tweet was later deleted and replaced with a new article and tweet featuring the accused. But the damage had been done.

Twitter users were quick to screenshot the original tweet, and amidst the storm of the media’s alleged reticence to name the man, it was used as “proof” that the media was biased along racial lines in its coverage of rape allegations.

Some media houses were also guilty of this.

Daily Dispatch, an East London-based publication, came under fire after one of their journalists used an image of a pair of black hands behind bars next to an article about the arrest of the alleged rapist. While the image was replaced and the tweets removed, Twitter was quick to call out the subtle racism behind the images.

But Mzansistories went further. Beyond claiming that people could “meet” the rapist, alongside a black face, the website wrote several fake news stories capitalising on the incident.

Unlike the Daily Dispatch, Mzansistories.com does not have an editor who can be contacted and does not belong to the Press Council. There is no recourse for the aggrieved and the authors of stories are not even provided.

The particular tweet showcases how a fake news website can have a very real impact on the credibility of traditional media.

“The long-term danger of online disinformation is the erosion of trust. Instead of critically appraising news, people start disbelieving everything they read. Traditional media, for all its faults, gets lumped into the same basket as the disinformation sites, though it has accountability structures – unlike these unscrupulous sites”, said Anim van Wyk, Chief Editor at Africa Check.

Media Monitoring Africa’s William Bird says that incidents like these highlight the need for credible media. Beyond the racist implications of the fake post, he says there are very real dangers to identifying people in a circumstance where real harm my come to them.

“This isn’t to say that people should be protected if guilty, but we need to know at least that the correct suspect is shown. It also shows just how little value these sites really offer.  While perhaps not disinformation, which seeks to cause harm through spreading false information this is certainly misinformation that is done to make money on the basis of others misery. ”

 

Faked: “She didn’t look like virgin.” 

The stories contained on Mzansistories.com and Allnews.com bear the usual hallmarks of fake news websites: sensational headlines, emotive and often highly divisive content and very little evidence provided. The page is awash with fake celebrity deaths, stories involving sex (sometimes including minors) and popular stories plagiarized from other publications.

But both websites went further than just simply getting the identify of the perpetrator, and as the #DrosRape story developed it also published obscene and insensitive articles featuring both the alleged rapist and the victim.

For example, in the days following the alleged Dros rapist’s arrest Mzansistorie.com published a fabricated article claiming that his parents blame their black neighbors for “bewitching” their son. It also falsely claimed that the accused told investigating officers that he raped the girl because he thought she was older and didn’t “look like a virgin”.

The clicks generate an income from the traffic by using a combination of Google Ads and a smaller advertising platform called MGID. These platforms “place” ads on the websites without the knowledge of the advertisers.

During News24’s recent visit to the websites, Takealot, one of News24’s sister companies, was found advertising on the site. Despite providing Takealot with a list of dodgy sites, including Mzansistories.com and Allnews.co.za, during an earlier investigation into the funding of fake news websites, their ads were still displayed on the website.

At the time of writing, Takealot had still not responded to enquiries regarding steps they have taken to avoid this. Their adverts are also still being displayed on the website.

 

Digital breadcrumbs

A graphical summary of the links can be found at the end of this article.

News24’s investigation into the owners of Mzansistorie.com and Allnews.co.za started earlier this year as part of a much broader investigation into the originators, enablers and funders of fake news websites in South Africa.

Ironically, it was the very fact that Ramatseba wanted to make money from his website that revealed his identity. It was also the same social media used by Ramatseba to distribute his fabrications that proved instrumental in identifying him.

Each publisher making use of Google Adsense is provided a unique identifier. This “Adsense ID” allows any other websites, using the same Adsense ID, to be identified. Because the Adsense ID determines where any advertising revenue will be allocated, it is a pretty good indicator of who derives an income from the sites. In essence, all the websites making use of the same cookie jar were identified.

The same Adsense ID was used on 14 different websites, including Mzansistories and Allnews.co.za. By combining this with several other websites sharing the same Google Analytics ID, a separate but similar identifier used to track traffic to each site, a list of 15 websites sharing the same digital fingerprints was identified.

Most of these websites hid their registration records behind “privacy proxies”, a service that hides the identity of the owner for a fee.

However, one of the websites, Allnews1.com, still had a historic record reflecting its registrant as “William Mahlatse Ramatseba”. It appears that Ramatseba allowed the website to expire, resulting in the registration records being made public long enough for an online database to scrape the information.

WHOIS

A search on social media revealed several links between these websites, Ramatseba and his sister. Gracy Rams, presumably shorthand for Ramatseba, congratulated her brother with his birthday on 28 September this year, providing a useful link between the two profiles.

William Ramatseba’s Facebook account shared several of the fabricated articles from his sites to Facebook. Specific examples of him sharing articles from Bestnews.co.za and Allnews.co.za were found. In one instance, he posted a request that other users “like our page”, directing users to the Allnews.com Facebook page.

Allnews Like

Allnews - Mzansi link

The Gracy Rams account frequently posted links to various public discussion groups and pages on Facebook, over a period of two years. She shared links to articles on Mzansistories.com, Bestnews.co.za, Allnews.co.za, Allreport.co.za and Gautengpraise.com on these groups, hoping to drive traffic to the sites.

All of these websites can be traced to her brother, William Ramatseba.

William and Grace Ramatseba also operated a number of Facebook pages. These included “Imzansi Extreme” and “Allnews”, both of which were frequently used as platforms to publish links to the stories. A page called “Diary of a Rural Girl” still has a link using the images of the black mand and white girl featured in the deleted tweet, alongside a link to the Mzansistories website.

Moving across to Ramatseba’s Google Plus account revealed it showed several posts linking to websites Gautengpraise.com, Allnews.co.za and Bestnews.co.za. All of these websites shared the same Adsense ID.

Google Plus

Even Ramatseba’s Twitter account (@wizbaz) directly shared several links to articles published on Mzansistories.com.

 

With the details obtained from his social media accounts, News24 could track down Ramatseba’s contact numbers, addresses and employment details. Ramatseba’s Youtube channel posted a video of filming the UNISA grounds on October 10, 2014. Numbers provided on credit records also reflected that Ramatseba provided UNISA’s contact number as his work telephone earlier this year.

After lodging a Promotion of Access to Information Act (PAIA) request, UNISA confirmed that Ramatseba was employed by them as an office administrator since December 2009.

Ramatseba was requested to provide comment on the story prior to publication. Despite several requests, Ramatseba could not be reached. Whatsapp messages sent to Ramatseba via Whatsapp were read and then ignored, despite him being online during this period.

NB: News24 has removed the name of the Dros rape accused because he has not yet pleaded in the matter. The presiding magistrate ruled that photographs of him could be taken, so these were left unchanged.