On September 26, 2018, a Twitter account @Mzansistories tweeted a link to an article on its website.
The tweet featured the face of a black man next to a crying white girl under the headline: "Meet a man who raped a 6 years old girl at Dros silverton, Pretora in man's toilet." (sic)
The underlying racial inferences was clear from the tweet: a black man had raped a white girl.
Yet a short while later, it would be revealed that a 22-year-old white man was accused of the rape of the girl.
A News24 investigation can now reveal that William Mahlatse Ramatseba (29), an office administrator at the University of South Africa's (Unisa) Sunnyside campus, is the author of Mzansistories.com, Allnews.co.za and several other disinformation websites.
Ramatseba and his sister, Grace, use several Facebook groups to distribute the fake stories found on their websites.
The siblings, who hail from Tzaneen in Limpopo, have been operating these and similar disinformation websites from at least early 2016.
The Dros rape tweet was later deleted and replaced with a new article and tweet featuring the accused. But the damage had already been done.
Twitter users were quick to take a screenshot of the original tweet and amid the storm of the media's alleged reticence to name the man, it was used as "proof" that the media was biased along racial lines in its coverage of rape allegations.
Some media houses were also guilty of this.
Daily Dispatch, an East London-based publication, came under fire after one of their journalists used an image of a pair of black hands behind bars next to an article about the arrest of the alleged rapist. While the image was replaced and the tweets removed, Twitter was quick to call out the subtle racism behind the images.
But Mzansistories went further. Beyond claiming that people could "meet" the rapist, alongside a black face, the website wrote several fake news stories capitalising on the incident.
Unlike the Daily Dispatch, Mzansistories.com does not have an editor who can be contacted and does not belong to the Press Council. There is no recourse for the aggrieved and the authors of stories are not even provided.
Erosion of trust
The particular tweet showcases how a fake news website can have a very real impact on the credibility of traditional media.
"The long-term danger of online disinformation is the erosion of trust. Instead of critically appraising news, people start disbelieving everything they read. Traditional media, for all its faults, gets lumped into the same basket as the disinformation sites, though it has accountability structures - unlike these unscrupulous sites", said Anim van Wyk, chief editor at Africa Check.
Media Monitoring Africa's William Bird adds that incidents like these highlight the need for credible media. Beyond the racist implications of the fake post, he says there are very real dangers to identifying people in a circumstance where real harm may come to them.
"This isn't to say that people should be protected if guilty, but we need to know at least that the correct suspect is shown. It also shows just how little value these sites really offer. While perhaps not disinformation, which seeks to cause harm through spreading false information, this is certainly misinformation that is done to make money on the basis of others' misery. "
Faked: "She didn't look like virgin."
The stories published on Mzansistories.com and Allnews.com bear the usual hallmarks of fake news websites: sensational headlines, emotive and often highly divisive content and very little evidence provided. The page is awash with fake celebrity deaths, stories involving sex (sometimes including minors) and popular stories plagiarised from other publications.
Both websites went further than just simply getting the identity of the perpetrator wrong. As the #DrosRape story developed it also published obscene and insensitive articles featuring both the alleged rapist and the survivor.
For example, in the days following the alleged Dros rapist's arrest Mzansistorie.com published a fabricated article claiming that his parents blame their black neighbours for "bewitching" their son. It also falsely claimed that the accused told investigating officers that he raped the girl because he thought she was older and didn't "look like a virgin".
The clicks generate an income from the traffic by using a combination of Google Ads and a smaller advertising platform called MGID. These platforms "place" ads on the websites without the knowledge of the advertisers.
During News24's recent visit to the websites, Takealot, one of News24's sister companies, was found advertising on the site. Despite providing Takealot with a list of dodgy sites, including Mzansistories.com and Allnews.co.za, during an earlier investigation into the funding of fake news websites, their ads were still displayed on the website.
At the time of writing, Takealot had still not responded to enquiries regarding steps they have taken to avoid this. Their adverts are also still being displayed on the website.
News24's investigation into the owners of Mzansistorie.com and Allnews.co.za started earlier this year as part of a much broader investigation into the originators, enablers and funders of fake news websites in South Africa.
Ironically, it was the very fact that Ramatseba wanted to make money from his website that revealed his identity. It was also the same social media used by Ramatseba to distribute his fabrications that proved instrumental in identifying him.
Each publisher making use of Google AdSense is provided a unique identifier. This "AdSense ID" allows any other websites, using the same AdSense ID, to be identified. Because the AdSense ID determines where any advertising revenue will be allocated, it is a pretty good indicator of who derives an income from the sites. In essence, all the websites making use of the same cookie jar were identified.
The same AdSense ID was used on 14 different websites, including Mzansistories and Allnews.co.za. By combining this with several other websites sharing the same Google Analytics ID, a separate but similar identifier used to track traffic to each site, a list of 15 websites sharing the same digital fingerprints was identified.
Most of these websites hid their registration records behind "privacy proxies", a service that hides the identity of the owner for a fee.
However, one of the websites, Allnews1.com, still had a historic record reflecting its registrant as "William Mahlatse Ramatseba". Its appears that after Ramatseba allowed the website to expire, resulting in the registration records being made public long enough for an online database to scrape the information.
A search on social media revealed several links between these websites, Ramatseba and his sister. Gracy Rams, presumably short for Ramatseba, congratulated her brother on his birthday on September 28 this year, providing a useful link between the two profiles.
William Ramatseba's Facebook account shared several of the fabricated articles from his sites. Specific examples of him sharing articles from Bestnews.co.za and Allnews.co.za were found. In one instance, he posted a request that other users "like our page", directing users to the Allnews.com Facebook page.
The Gracy Rams account frequently posted links to various public discussion groups and pages on Facebook, over a period of two years. She shared links to articles on Mzansistories.com, Bestnews.co.za, Allnews.co.za, Allreport.co.za and Gautengpraise.com on these groups, hoping to drive traffic to the sites.
All of these websites can be traced to her brother, William Ramatseba.
William and Grace Ramatseba also operated several Facebook pages. These included "Imzansi Extreme" and "Allnews", both of which were frequently used as platforms to publish links to the stories. A page called "Diary of a Rural Girl" still has a link using the images of the black man and white girl featured in the deleted tweet, alongside a link to the Mzansistories website.
Ramatseba's Google Plus account showed several posts linking to websites Gautengpraise.com, Allnews.co.za and Bestnews.co.za. All of these websites shared the same AdSense ID.
Even Ramatseba's Twitter account (@wizbaz) directly shared several links to articles published on Mzansistories.com.
With the details obtained from his social media accounts, News24 could track down Ramatseba's contact numbers, addresses and employment details.
Ramatseba's YouTube channel posted a video of the Unisa grounds on October 10, 2014. Numbers provided on credit records also reflected that Ramatseba provided Unisa's contact number as his work telephone number earlier this year.
After lodging a Promotion of Access to Information Act (PAIA) request, Unisa confirmed that Ramatseba was employed by it as an office administrator since December 2009.
Ramatseba was asked to provide comment on the story prior to publication.
Despite several requests, he could not be reached. WhatsApp messages sent to him were read and then ignored, even though he was online during this period.
NB: News24 has removed the name of the Dros rape accused because he has not yet pleaded in the matter.