Scores of sockpuppet accounts from India participated in an unprecedented disinformation campaign aimed at vindicating the beleaguered Gupta family. These accounts, which would later be colloquialized as the "Guptabots" consisted of hundreds of fake accounts masquerading as South Africans.
Their goal was simple: divert the focus of social media discussions away from media coverage critical of the Guptas, and to aim it at "white monopoly capital" and its poster-boy, Johann Rupert.
The fake accounts were bolstered by fake articles published on anonymous websites. These sites painted the Guptas as martyrs in the fight against WMC, with claims that the #GuptaLeaks were manufactured on instruction of the elite in Stellenbosch.
The campaign only came grinding to a halt at the end of December 2017. As if a contract had suddenly expired, the last tweets and articles on the website were posted on 31 December 2017, after which the entire WMCLeaks campaign came to an end.
While the true nature and origins of the Guptabots likely disappeared with them, clues in the GuptaLeaks provide a plausible timeline for their inception and creation.
In April 2013, shortly after the Waterkloof-landing was revealed, the Guptas paid a Chennai, India based company called "Virtual Social Media" an amount of $12 000 (R121 000 at the time) in cash for "assistance" with its online image. VSM’s brief consisted of creating several "African-sounding" names to scour the Internet and attempt to drown-out negative publicity on social platforms with their comments.
The Guptaleaks also detail the humorous near panic when the Gupta bagman accidentally paid VSM too much cash, resulting in a furious exchange of e-mails as Ashu Chawla attempted to secure the change.
Their first foray into social media manipulation was no success, and the Guptas canned the project after only 6 months.
Fast forward to January 2016, and Bell Pottinger has entered the fray. The UK based PR agency was a slicker, more expensive operation than the initial crude attempts by the VSM.
Bell Pottinger streamlined the Gupta family’s website, optimised the way in which search engines displayed information about them, and even proposed changes to their Wikipedia pages. These suggestions had to be e-mailed to Sahara employees to prevent Wikipedia from catching a whiff that the British PR firm was editing the Wikipedia entries.
Bell Pottinger employee and former South African Jonathan Lehrle later admitted to creating the website www.voetsekblog.com, an anonymous disinformation website leveraging heavily on the "white monopoly capital" and "economic emancipation" themes put forward by Bell Pottinger.
Bell Pottinger would also later set up and create the @atulgupta Twitter account. One of the last Bell Pottinger reports contained in the Guptaleaks lauded the engagement created by Atul's personal twitter account, and strongly suggested that the family take a more "pro-active approach" to social media. A few weeks later we saw what appeared to be the prototype for the Guptabot campaign rear its head.
In February 2016, a website, www.truthbyconnormead.co.za, surfaced alongside a Twitter account called Connor Meade @KjbJohn832. The account’s very first tweet was
retweeted by Oakbay boss Jacques Roux, Optimimum Mine CEO George van der Merwe and even Atul Gupta himself.
The "Truth by Connor Meade" website later published information which the Guptaleaks show was circulated only days before amongst Gupta-employees. The same set of "facts" were later printed verbatim in the Gupta's The New Age newspaper. Several Gupta-employees, including the author of the document on which the information was based, shared the information without questioning how confidential information was "leaked" to an apparent outsider.
Yet despite the prophetic nature of these words, it appears even Bell Pottinger were unaware of the Guptabots.
The appearance of the Connor Mead account and website caused Bell Pottinger to caution the Guptas, telling the family that such campaigns could hamper Bell Pottinger's efforts. Atul Gupta was specifically told to not engage with the Connor Meade account on Twitter.
A few months later, a group of Twitter users began identifying several suspicious accounts displaying peculiar activity. In November 2016, a group of 106 fake accounts were identified. Twitter user @arfness and social media analytics blog @superlinearza later identified several hundred more, culminating in more than 800 of these sockpuppet accounts.
The WMCLeaks site began in April 2017, in what appears to be an attempted counter to the Guptaleaks trove of documents from within the heart of the Gupta business empire. It operated as the main driver of the disinformation campaign.
Articles published by its anonymous authors smeared journalists, businesspeople and politicians critical of the Gupta family, and scores of Guptabots amplified these hit-pieces were amplified. This extended the reach of the campaign by exploiting how Twitter's algorithms determine what appears on your Twitter feed.
The website was convincingly, if not conclusively, linked to the Gupta family.
A Daily Maverick investigation revealed that a PDF file uploaded to the website, containing an "expose" of an extra-marital affair by former Business Day editor Peter Bruce was created in India, and linked the document with Saurabh Aggarwal, a family member and former employee of the Guptas.
A subsequent investigation by News24 linked the WMCLeaks.com website to at least 14 other websites using digital fingerprints contained in the Google adverts on the site. Twelve of these websites were registered by Kapil Garg, an IT guru from Saharanpur in India, who also registered the atulgupta.info and ajaygupta.info.After months of distributing disinformation, WMCLeaks.com and the Guptabots fell silent on 31 December 2017. Days after the ANC elective conference saw their preferred candidate Nkosazana Dlamini-Zuma lose out to Cyril Ramaphosa, the entire WMCLeaks campaign ground to a halt.