In my latest for @DFRLab the man behind the xenophobic @ulerato_pillay Twitter account is revealed as a 32 year old former SANDF member: Sifiso Jeffrey Gwala.

Gwala used the account to foment violence against foreign nationals disguised as "nationalism". https://medium.com/dfrlab/xenophobic-twitter-campaigns-orchestrated-by-former-south-african-soldier-9e7702433176

This follows an earlier investigation by @awildknight and I that showed the account was linked to a person by the name Sfiso Gwala.

Our investigation stopped short of identifying Gwala personally at the time. https://medium.com/dfrlab/afrophobic-south-african-twitter-account-connected-to-nationalist-political-party-7e7205cc8987

In this investigation we found evidence linking Gwala to the account. User ID's for @uLerato_pillay and an archived version of @sfiso82648954 showed both used the same user ID.

In addition, a petition created by Gwala was shared by ULP less than 2 minutes after it was created.

Since then, Gwala has attempted to hide evidence linking him to the account.

"Sfiso J Gwala" was replaced as the author of the DSTV http://Change.org  by "Themba Mthiya".

But the website source code shows this is the same user as Sfiso J Gwala that created the petition.

An attempt was made by "Themba Mthiya" to delete the petition on 13 July, the same day that the Daily Maverick published our investigation.

This came shortly after a (later deleted) post by @uLerato_pillay claiming that Gwala never hid his identity.

Since http://Change.org  authenticates using Facebook, this meant that the FB account that created the petition was changed.

At the same time, a Facebook account for Gwala, found but unpublished during the earlier investigation, suddenly disappeared.

Gwala was kind enough to appear on a @Powerfm987 show on 2 May 2020. During the interview he made several statements that could be linked to earlier tweets by @uLerato_pillay.

These are detailed in the piece.

https://omny.fm/shows/power-podcasts/complains-and-frustrations-about-dstv-being-too-ex

As for his military background: it was clear from @uLerato_pillay's tweets that he knew the SANDF well.

Tweets by Gwala showed he knew the SANDF regalia and colours, had knowledge of their previous deployments and had inside knowledge of the SANDF.

In particular, he seemed to display inside knowledge of 121 SA Infantry Battallion, based in Mtubatuba near Richardsbay.

Several tweets by @uLerato_pillay also referenced the Richards Bay municipality and service delivery issues in the area.

His infamous attack on @NalediChirwa was based on her comments about the SANDF, and particularly the conduct of several soldiers during a UN deployment to the DRC in 2015.

@uLerato_pillay was especially fond of these repatriated soldiers...

...likely because, as court documents show, "Sifiso Jeffrey Gwala" was one of these 34 soldiers assigned challenging the SANDF's decision to repatriate and dismiss them.

What is more, Gwala's phone numbers and email addresses could be linked to the @uLerato_pillay and newer @Lerato_pillay Twitter account.

This created a web of interactions and links that goes way beyond mere coincidence.

Note: The current @uLerato_pillay Twitter account is a fake created in August 2020.

The original @uLerato_pillay changed its user handle to @PutSAnsfirst_ , claiming that someone else would be taking over the account.

The @PutSAnsfirst_ account has since been deactivated.