Two police officers and a DJ from KwaZulu-Natal have been linked to the fake news websites newsbru.net and newspage.co.za.
These sites published articles copied from other news sites, some dating as far back as 2010, as fresh news stories, and plagiarised content from others, including News24, The South African, IOL and Maroela Media.
News24 can now reveal that Gregory John Watson, 28, a graphic designer and disc jockey from Umhlanga Ridge, registered several websites with links to newsbru.net and newsbru.com (Newsbru).
Watson's associates are two police officers from Queensburgh, Anton Laas, 47, and his nephew, Jeandre Dawid Welgemoed, 27. Despite claims by Watson that he didn't know the two, photos posted on Laas' Facebook page show the three together at rugby matches in 2017.
During the investigation, the trio attempted to frame others and later resorted to intimidating, threatening and eventually attempting to extort the journalist conducting the investigation.
This News24 investigation will show how the Newsbru site plagiarised articles to attract viewers and derive advertising revenue from the traffic. By delving into the website source code, credit records and their social media profiles, links will be drawn between Watson, Laas, Welgemoed and the various sites and social media accounts that made up their disinformation network.
It will also reveal how Newsbru's owners attempted to frame a website developer from Stellenbosch and several fictitious people as the owner of their websites. When this didn't work, they used anonymous threats and tried to extort the journalist investigating them – using an email address that could be linked to the three.
Watson and Welgemoed denied their involvement with Newsbru, but had trouble explaining the links between themselves, Newsbru and other websites linking them to it. Laas refused to respond to any of News24's questions.
What makes Newsbru nonsense?
Newsbru's content consisted of plagiarised and outdated articles from online publications. Some stories posted as "breaking news" on the site date as far back as 2010.
For example, an article published on Newsbru December 8, 2018, claimed a southern Cape farmer and his son were charged with murder after killing a burglar on their farm. The original story, first published by IOL, is from June 2010.
Earlier in January 2019, both Newsbru pages were shut down and the sites have been replaced with a new domain, www.sauncut.com. However, the new website's source code still contains several references to Newsbru and uses the same Facebook group to distribute its content.
Linking Newsbru to old fake news sites
Newsbru was first noticed in August 2018 as part of News24's broader investigation into fake news. At the time, the site used two Facebook groups, Police Pics and Clips (PPAC) and SA Uncut, to distribute links.
It also contained a link to the Newspage website:
Newsbru provided no contact details and little information about its organisation or structure. It claimed to be a division of "Newsbull Ltd", but no such entity exists in company records. Website registration records revealed a privacy proxy was used to register the website, hiding the identity of the registrant.
Initially, the SA Uncut and PPAC Facebook pages displayed links to Newsbru in their "About" sections. These links were removed shortly after News24 contacted Watson with questions about Newsbru.
Archived copies of Newsbru showed that email@example.com was previously used as the contact email for the website. News24 recently learned that a suspected pseudonym, "Keith Butler", used that email address to solicit advertising for SA Uncut as recently as January 23 from a former client of Watson.
News24 also found a Twitter account, @policepicsclips, that shared links to Newsbru and Newspage along with links to the PPAC Facebook group. The Twitter account has been dormant since June 2018, but was deleted in December 2018 soon after questions about it were sent to Watson.
Although the owners of Newsbru took steps to hide their identities using privacy proxies, their websites and social media pages still contained enough digital breadcrumbs to lead the investigation to other websites operated by the same owners. Newsbru used two advertising platforms on its site to make money from the traffic it generated: Google Adsense and MGID.
News24 used both to trace other websites using the same advertising units, the rationale being that establishing which sites use the same adverts would determine a common beneficiary of the advertising revenue.
The Google Adsense ID used by Newsbru was traced to www.newspage.co.za, an older fake news website that followed a similar modus operandi to Newsbru. The site faced legal action in 2017 as a result of one of its fake news stories.
The common denominators
Because the advertising revenue would accrue to a common beneficiary across all the sites using the same advertising units, News24 could reliably link the owners of Newsbru, Newspage and PPAC.
Starting with Newspage, website registration records revealed it was registered to one Simon Davidson, a website developer from Stellenbosch. Davidson was quoted in a News24 article from June 2017, in which "he" claimed ownership of Newspage.
News24 has since established that Davidson was framed, and was impersonated in correspondence between attorneys and the owners of Newspage in 2017.
To hide the real owner's identity, Davidson's name was used to register Newspage, albeit with a Durban-based address and made-up phone number. Newspage's Whois records revealed that a firstname.lastname@example.org email address was used to register the website. The physical address provided was in Hillview Avenue, Malvern, Johannesburg, although Davidson was resident in Stellenbosch at the time.
The Hillview address is remarkably similar to Welgemoed's address in the same neighbourhood.
When contacted, Davidson denied any involvement with Newspage or Newsbru. Davidson provided emails predating our investigation by almost a year, in which he pleads with domain registration authorities to remove his name as the owner of Newspage.
Davidson provided News24 with the names of two people he believed were behind the site: Anton Laas and Jeandre Welgemoed. Davidson said Welgemoed contacted him in 2016, and discussed how he created the original PPAC group.
He also confirmed that he knew Greg Watson, a name News24 had already identified in respect of the second website linked to Newsbru, www.policepicsandclips.com .
While www.policepicsandclips.com itself has been shut down, historic DNS records showed that the site was hosted on a dedicated server with hosting company Hetzner, home to a small number of websites with links to Watson and his company, Native Solutions.
Most of these websites used a combination of Greg Watson's name, Native Solutions, or the company's email address, email@example.com. Two phone numbers belonging to Watson were also used to register several of these websites. This included a domain named "Southafricanbru".
Watson is a director of Native Solutions (Pty) Ltd alongside his roommate and high-school friend Dane Holmes.
The www.policepicsandclips.co.za website was also registered in the name of Greg Watson.
We now had three names to work with – two provided by Davidson, and another obtained through the DNS and Whois records of websites with links back to Newsbru.
News24 contacted Watson for comment on Thursday, December 20, 2018. At the time, Watson claimed he didn't know who was behind the Newsbru website, but confirmed the owners of the PPAC website were former clients of his. Watson could not provide details of these clients, claiming he had only corresponded with them via email using firstname.lastname@example.org.
Curiously, shortly after contacting Watson on December 20, the Newsbru website and its Facebook groups underwent several changes:
- By the next day after speaking to Watson, the SA Uncut and PPAC Facebook took down the links to Newsbru from their respective pages, after displaying these links as far back as August 2018;
- During the evening of December 20, the author of Newsbru suddenly renamed all his posts, replacing the anonymous "Admin" username used since the inception of the site with the name "Siv Medi"; and
- Later on the same day, Watson conveniently provided News24 with a "email@example.com" email address, which he claims belonged to the owners of the site.
News24 has been unable to find any trace of this email address on any platform, and Watson has refused to provide any details of where he found this email address.
A similar situation played out when Watson was informed of the @policepicsclips Twitter account mentioned earlier. At the time Watson was told that News24 knew of the account, it was already established that Watson's phone number, along with the firstname.lastname@example.org email address, was used to register the Twitter account.
The Twitter account was deleted less than an hour after Watson was asked if he knew the owner of the account.
Watson described the sudden deletion as a "mere coincidence". He later said the account may have been part of a website plugin that automatically tweeted new posts on his client's websites.
This does not explain why the account was sharing links to Newsbru when Watson claims it wasn't one of his. It also does not explain why the account was deleted with such alacrity after he was asked about it.
A more recent link between Watson and Newsbru surfaced in January this year. The www.sauncut.com website's source code referenced an advert located on www.salivemag.com.
Watson told News24 during a conversation on December 24, 2018, that the SALiveMag website is one of his websites too.
Welgemoed deactivated his Facebook account shortly after the first questions were sent to Watson, and he has not reactivated it. Screenshots provided by Davidson show Welgemoed used this Facebook account to discuss running the PPAC website as far back as 2016.
On Facebook, email@example.com was registered using a phone number ending with the same two digits as Welgemoed's phone number. By initiating the password-reset process, Facebook reveals redacted information used to open the account:
Performing the same checks on Gmail showed an email address that fits firstname.lastname@example.org perfectly was used as a recovery email for the email@example.com account. In turn, the firstname.lastname@example.org used a recovery email that aligns with the email address Welgemoed provided to News24.
While it could be attributed to happenstance, it would indeed be a remarkable coincidence if the person behind the email@example.com account shared such similarities with Welgemoed.
Responding to questions sent to him to the same email address, Welgemoed denied being involved with any of the websites, but did not answer specific questions related to his email address or phone number being associated with these accounts.
He also denied knowing anyone by the name of Greg Watson, which would later be revealed as a lie.
Welgemoed's uncle, Anton Laas, also briefly deactivated his Facebook account after News24 first contacted Watson. The account was reactivated just before Christmas.
Although most of Laas' Facebook posts have since been deleted, screenshots taken before he did so show he frequently shared content from Newsbru, Newspage and Police Pics and Clips.
Laas also shared a link to the SA Uncut Facebook page within hours after it was created on October 9, 2017, asking friends to like the page.
On December 16, 2015, Laas also shared a post with several screenshots revealing the option to "Comment as Police Pics and Clips" in the user interface. This means whoever took the screenshots was logged into the Police Pics and Clips account at the time.
His YouTube channel also contained links to the www.policepicsandclips.com website. The channel published videos of police chases and CCTV camera footage reminiscent of PPAC's content.
Laas renamed and attempted to disguise the "Anton Laas" YouTube channel shortly after he was asked to provide his contact details for our questions.
He also removed the channel's about section, which was copied verbatim from the PPAC Facebook page.
But the description of one of the videos on his channel still displayed a link to the www.policepicsandclips.com website, as well as the PPAC Facebook group. In the comments section of another video, Laas (now renamed to "Wild Horses") responded to another user by providing the firstname.lastname@example.org address as a contact detail for any copyright queries.
These pics don't lie
Watson continuously denied knowing Jeandre Welgemoed or Anton Laas, both in response to written questions and during a telephonic conversation on December 24, 2018. Welgemoed echoed Watson's denials, and claimed he didn't know anyone by the name of Greg Watson.
Yet Facebook posts made by Laas contradict their denials. Photos posted by Laas on August 8, 2015, place the three of them together during a rugby match at King's Park Stadium. Laas also tagged the pair in other Facebook posts.
Threats and Extortion
Shortly after News24 first contacted Laas, the email@example.com email address started sending intimidating messages and veiled threats to the reporter and then tried extortion to try to smother the investigation. The threats included claims that they knew where the journalist lives, and the make and model of his motorcycle.
When that failed, the trio claimed to have found "proof" that the journalist had made homophobic slurs in 2014. This appears to be based on a post on the News24 comments section by a user with the same name. The email was signed off by "Keith Butler", the same name used by firstname.lastname@example.org to solicit advertising.
In another perplexing coincidence, both Watson and "Keith Butler" signed off their emails to the journalist in a similar manner.
This is also the same email address identified at various other stages of the investigation:
- Laas provided this email to another user on his YouTube channel;
- The @policepicsclips Twitter account was registered using this email address;
- The Newspage website was registered using this email address;
- Watson claimed this email address belonged to one of his unidentifiable clients; and
- An email address matching Welgemoed's email was listed as a recovery email for this account
Laas refused to respond to any of News24's attempts to contact him.
Welgemoed was slightly more forthcoming, but failed to answer specific question regarding his email address being linked to the Newsbru website, before blocking his WhatsApps.
Watson has maintained that his only involvement has been registering the websites linked to Newsbru on behalf of clients of his, and maintains he cannot disclose their information.