South Africa


Meet the instigators: The Twitter accounts of the RET forces network that incited violence and demanded Zuma’s release

Meet the instigators: The Twitter accounts of the RET forces network that incited violence and demanded Zuma’s release
A business premises ablaze during widespread looting and protests in Durban, 12 July 2021. (Photo: EPA-EFE / STR)

In less than a month, 12 Twitter accounts became central to the instigation that caused mayhem and destruction as they spearheaded the call to release Jacob Zuma from prison.

The Centre for Analytics and Behavioural Change (CABC) is a non-profit organisation based at UCT’s Graduate School of Business. It was established to track and counter mis- and disinformation, fake news and divisive and polarising rhetoric that is promulgated online to undermine social cohesion, democratic integrity and the stability of nation-states.

Accounts belonging to the RET forces network have been discovered in the top 12 accounts responsible for inciting violence on social media during the recent unrest in South Africa — initiated by calls for former president Jacob Zuma to be released from prison.

The top 12 accounts — four of which belong to the RET forces network — repeatedly retweeted hashtags intended to incite an uprising and bring the economy to a standstill as protests escalated into a mass looting spree in Gauteng and KwaZulu-Natal.

Top twelve accounts chart


Through a combination of desktop research and social media analytic tools, the Centre for Analytics and Behavioural Change (CABC), based at the University of Cape Town, identified a number of hashtags intended to cause unrest, through, among other strategies, calling for shutdowns across South Africa.

The hashtags generated a total of 1.29 million mentions since the beginning of July, with a volume of more than one million retweets.

The CABC also identified the top authors using these hashtags, refining the results through researching elements of misinformation and disinformation, incitement of violence, as well as alarmingly high tweet volumes.

The top 12 authors were found to have accounted for more than 13,000 mentions within the incitement of violence hashtags:

Tweet activity of the 12 accounts using the incitement of violence hashtags:


Among the most commonly used hashtags were those calling for Zuma’s release, and to shut down Gauteng and KwaZulu-Natal.

Top 10 hashtags used by the 12 accounts in July:

The use of these hashtags, and others similar to them, peaked on 12 July, when Zuma asked the Constitutional Court to rescind his sentence. This was also the same time that protests peaked in Gauteng, resulting in the looting of several shopping malls and extensive damage to property.

Incitement to violence hashtag mentions up to 23 July:

 In May, the CABC released a report that identified 51 inauthentic accounts operating within another organised network to spread online disinformation in support of politicians facing corruption charges — including Zuma and ANC Secretary-General Ace Magashule.

That network organised itself under the banner of the Radical Economic Transformation policy, but the content it distributed had little to do with transforming the economy — and much to do with fighting the cause of those facing corruption charges outside the courts, instead of inside them.

The CABC identified clear links between the 12 top accounts engaging with violence-inciting hashtags and the “RET” network of 51 accounts.

RET network account mapping:

 Four of the 12 accounts — @StheBiyela, @Botik61945648, @iamIQILI and @mytouchrecords — are part of the RET network which had been identified in this report.

@Tellunknown, an account that used hashtags connected with incitement to violence 1,577 times this month, was created in December last year and has only 352 followers.

This account was found to be engaging with the @_AfricanSoil account — previously identified as the content-generating account within the RET forces network.

@tellunknown most retweeted users:

These are the most retweet accounts by @tellunknown. It is a common tactic to rope in sometimes innocent users to gain traction. These accounts do not necessarily support incitement to violence. Some content that was retweeted was unrelated to incitement such as content from @LukhanyoV.

Most of the content posted by the top 12 accounts within the incitement-to-violence conversation was not original content.

More than 90% of the 12 accounts’ tweets are retweets of other Twitter users who support Zuma.

Frequent interactions were also identified between accounts such as @07372145stix (in the top 12) and RET network accounts such as @Gentlements, @_AfricanSoil and @ComradeMDU.

More links were found between @Mason0070 (top 12 account) and @_AfricanSoil, @Bongikocy, and @Landnoli (identified under the RET forces network.

@Mason0070’s users most retweeted:

More than 80% of @TellUnknown’s recent 3,000 tweets are retweets — which pales in comparison to accounts such as @Botik61945648, an account with a daily median tweet volume of 353,  where 100% of the latest 3,000 tweets are retweets.

On a broader scale, more than 90% of all content generated by the top 12 accounts this month were retweets from other users who support Zuma and criticise President Cyril Ramaphosa and the media.

With a daily median tweet volume of 826, @Azania_kal (the account with the second-highest mentions of the incitement to violence hashtags) tweets from 7am, to get traction for the day, and up to 7pm, to engage people after work. More than 90% of its recent 3,200 tweets are retweets.     

 Among the biggest hashtags used in the account’s recent 3,200 tweets were those relating to shutting down the country and releasing Zuma.

@Azani_kal hashtag cloud:          

In less than a month, these 12 accounts became central to the instigation that caused mayhem and destruction, as they spearheaded the call to release Zuma from prison.

Their lack of original content, high tweet volume, their constant engagement with the RET forces network and the use of sophisticated tactics to produce and distribute content in a strategic manner suggests a high level of organisation and social media expertise.

As long-standing tensions in South Africa’s social fabric threaten to tear the nation apart, it is apparent that unseen hands are organising themselves behind the scenes and working together on social media to foment social discord. DM


Comments - Please in order to comment.

  • Chris 123 says:

    At what point do Twitter and Facebook close these accounts? Surely they have analytical programs to pick up key words and block them? News 24 certainly does.

    • Alley Cat says:

      Just proves once again that our so-called intelligence service is completely useless. Why can they not track these tweets and identify the individuals concerned? Sigh!

      • Paddy Ross says:

        It has been suggested that there are members of the so-called Intelligence Services who were involved in these incite full tweets etc.

    • Johan Buys says:

      “ At what point do Twitter and Facebook close these accounts?”

      At what point do we require the platforms that earn tens of billions of dollars to do something basic like client identity validation and basic KYC procedures that even a small financial services company must comply with under penalty of tremendous consequences???

      Twitter and Facebook make their money from advertising but face none of the legal liability for content that a publisher like Daily Maverick or NYT does.

      The platforms are publishers and have the money and technology to police their clients and content

  • Dennis Bailey says:

    But names please

  • Ian Gwilt says:

    I hope someone has told the cat with the hat

  • Dellarose Bassa says:

    Why have all these tweeters & re-tweeters not been rounded up & arrested? They should face the full might of what’s still left of the law in SA AND class action civil lawsuits. It seems to me that Bell Pottinger has been resurrected.

    • Nancy Brindley says:

      I totally do agree, that Bell Pottinger has been resurrected, or probably never left !!! I watched the video “Inelligence” offered last week to view for free to insiders, and its indisputable that companies are operating in the political affairs of countries around the world. South Africa stands out like a sore thumb for dasterdley agents to grab and persuade our already named culprits, via The Zondo Commission. Who it seems will sell the nation, and cripple its economy, bring anarchy of the un- educated masses, into doing the work for them, so that their crimes will never be accounted for, due to the scale of things to come.
      Next will be, and already begun, Racial Clashes, and intimidation that may just push SA to the brink.
      The Maverick team are up there trying to unravel this quagmire, they all have my deepest gratitude for the risks they take. We really need to get much more support in helping them to unravel the truth, and guide us to understand daily what is happening in what once was ” Our Beloved Country”.

  • Charles Parr says:

    South Africans have to realise that the ANC will never hand over senior people and, when they’re forced to do something, they’ll get some small fry to take the rap. I’m afraid this is already lost in the hive of dishonesty of this government.

  • Lisa Kane says:

    This smacks of a Bell Pottinger style onslaught all over again. Nation states at the mercy of savvy social media warfare by anyone with cash and a grudge.
    Brexit, Zuma, Trump…all from the same handbook.

    Global leadership needed on this one…but the truly wise in our world give Twitter, FB etc a big swerve.

    Wise leaders are blind to the insidious power of tech. Tech leaders are not wise.

    Where now?

  • Paula Thomson says:

    Love to know what our “intelligence branch are doing”? So many untouchables in The ANC, cant see a silver lining, with the real criminals brought to book.

  • Ger pig says:

    I’m sure these murderous thugs learned a lot from Bell Pottinger circa 2016 (commissioned by none other than our esteemed former president and these cronies of his). BP might no longer exist, but SA and her people are subject to the reaping of what they sowed every single day. This is nothing short of treason, a word that seems to have been struck out of the government’s vocabulary. A real tragedy.

  • Sandra Goldberg says:

    Surely with this level of expertise and identification of the instigators, affected people and businesses could mount civil action claims , along the lines of the horrid BellPottinger episode?If a whole number of people pulled together and enjoyed good legal representation, could this not be the way to go forward?

  • Jane Crankshaw says:

    This exposure is amazing – what will or can the powers that be do with this information? The sophistication of the network points to outside influence controlling political manipulation here…if we know who is doing this perhaps we can cut it off from the knees as well as funding that is being used to destabilized South Africa through various political parties. The consensus seems to be that it is coming from Russia – the second homeland of various ANC stalwarts….and where Zuma spent a lot of his time in exile. Time will tell….hopefully!

  • David Le Page says:

    Some of the accounts involving in instigating this violence were tweeting hundreds of times a day. Twitter could fix this kind of problem just by limiting how times people tweet. Who really needs to tweet 300x a day!?
    A few years ago, people were talking quite a lot about “slow food”, food that is produced carefully and with love. We need to return to “slow news”, news that is produced carefully, thoughtfully and respectfully.
    The social networks can assist this just by slowing things down, and the fact that they don’t/won’t strongly suggests they just don’t give a **** about how their utilities are abused.

  • jacki watts says:

    So… Who are they?

Please peer review 3 community comments before your comment can be posted


This article is free to read.

Sign up for free or sign in to continue reading.

Unlike our competitors, we don’t force you to pay to read the news but we do need your email address to make your experience better.

Nearly there! Create a password to finish signing up with us:

Please enter your password or get a sign in link if you’ve forgotten

Open Sesame! Thanks for signing up.

[%% img-description %%]

The Spy Bill: An autocratic roadmap to State Capture 2.0

Join Heidi Swart in conversation with Anton Harber and Marianne Merten as they discuss a concerning push to pass a controversial “Spy Bill” into law by May 2024. Tues 5 Dec at 12pm, live, online and free of charge.

A South African Hero: You

There’s a 99.8% chance that this isn’t for you. Only 0.2% of our readers have responded to this call for action.

Those 0.2% of our readers are our hidden heroes, who are fuelling our work and impacting the lives of every South African in doing so. They’re the people who contribute to keep Daily Maverick free for all, including you.

The equation is quite simple: the more members we have, the more reporting and investigations we can do, and the greater the impact on the country.

Be part of that 0.2%. Be a Maverick. Be a Maverick Insider.

Support Daily Maverick→
Payment options