The Bureau’s investigation began with a dataset of tweets promoting the “white monopoly capital” message. Between 12 July and 22 August we archived almost 18,000 tweets containing this phrase.

Our dataset threw up some immediate patterns. There was a core of ten accounts which pushed the message strongly and consistently, tweeting the phrase over a hundred times in the 40-day period. There were just under 200 accounts with a lesser but still consistent interest, using the phrase between ten and sixty times over the same period. And there were some 6,000 accounts which used the phrase only once.

South African cyber sleuths focused their attention on the most active accounts. Digital investigator Jean Le Roux identified hundreds of accounts posing as South African citizens, often tweeting 30 times a day, several of which were seemingly run from somewhere in India. These accounts promoted a group of websites with names like wmcleaks.com (using the acronym for white monopoly capital), wmcscams.com, whitemonopolyafrica.com and whitemonopoly.com. An investigation by News24 showed that these websites were linked to an Indian consultancy firm, CNET Infosystems. But after this the trail went cold.

The Bureau decided to focus on the other way in which the message was amplified: by hundreds of accounts tweeting it only once, rather than dozens tweeting it hundreds of times. Our dataset showed that, of these one-off accounts, a suspiciously high number were created on certain days. A popular moment was April 2014: 46 of them were created on 15 April 2014, 45 on 11 April, 41 on 13 April, 32 on 12 April and 29 on 14 April. Another 200-odd dated from June 2012.

While many of the most active accounts appear to have had human beings behind them – albeit human beings pretending to be someone else – the Bureau’s data suggested the more infrequent tweeters were automated accounts, or bots.

“All bots for sure,” said Jim Vidmar, a social media marketing expert based in Las Vegas, looking over a sample of the accounts that the Bureau provided. “All April 2014 and they have the tell tale signs.”

Vidmar knows because he’s in the business himself. “Usually when I buy accounts like that … that is what they look like,” he explained, pointing to their shared creation date, the random nature of their interactions and the low ratio of followers to number of accounts followed. “Real accounts don’t follow 1500 random people and have such low follow back percentage.”

Vidmar referred to a “secret world” of websites selling retweets, followers and other such services. The Bureau looked at several dozen such sites, competing to make their clients appear “important”, “more legit” or “loved by all”. One company offers 100 retweets for $1 and 5000 for $27. Another promises a hefty 500 retweets for $1 and an astounding 20,000 for $25. For the more longterm strategists out there, there are monthly plans: one service provider offers a package of 150 retweets and 95 likes per any number of tweets, along with random comments and mentions and a certain number of followers, all for $299 a month.

So where do these attentive followers, likers and retweeters come from? And how are the low prices they command economically viable?