Anti-Netanyahu Activists Say This False Flag Campaign Is an Attempt to Kill Their Protest

Activists say they have uncovered at least three suspicious accounts, and are investigating over a dozen more, which they charge are part of an operation to turn the public against the anti-Netanyahu protests

Omer Benjakob
Send in e-mailSend in e-mail
The Facebook profile of Nehorai Yossef, which was taken down by the social media website.
The Facebook profile of Nehorai Yossef, which was taken down by the social media website.Credit: Yossi Dorfman
Omer Benjakob

At the beginning of August, a Facebook user called Nehorai Yossef posted an image of a young Benjamin Netanyahu giving a passionate speech, his arm extended in what looked like a Nazi salute.

To drive the point home, Yossef juxtaposed the image with one of Adolf Hitler, his arm also raised in the infamous salute. “We will keep fighting for our Israel, forever. This is a battle for our lives,” Yossef wrote, tagging more than 10 other users in the post.

Yet while all of those tagged were real people – almost all of them leaders or vocal supporters of the anti-Netanyahu protest movement – Yossef probably wasn’t.

Anti-Netanyahu activists claim that Yossef is one of a number of suspicious social media profiles being used to slander and undermine the protest movement, which has attracted thousands to Saturday evening rallies outside the prime minister’s official residence in Jerusalem, as well as in Tel Aviv and on bridges and intersections across the country, for the past 11 weeks.

Some of the tweets that anti-Netanyahu activists claim are from fake users, including one that the prime minister himself amplified.
Some of the tweets that anti-Netanyahu activists claim are from fake users, including one that the prime minister himself amplified. Credit: Screenshots from Twitter

Similar language, graphics and images

Yossi Dorfman, a media consultant who specializes in digital campaigns and who leads a team of volunteers tracing such accounts, labels these posts a “false flag” operation. He says he and fellow activists have found what he terms a “campaign” comprising at least three Facebook accounts similar to Yossef’s that he believes are fake. They’re currently examining at least a dozen more.

Facebook has since taken the accounts down, but they all used similar language and graphics, he says. All of them also shared similar images of Netanyahu as a Nazi and compared the protesters to children in the Holocaust. Two of the three had even infiltrated activists’ closed social media groups. Their goal, Dorfman believes, was to cast the protest as violent, even dangerous.

According to two researchers who spoke with Haaretz, proving definitively that these – or indeed any – accounts are fake is almost impossible. Both agree, though, that the behavior described by Dorfman is in line with that exhibited by fake accounts.

“We have recently seen use, for example, of synthetic, computer-generated images on Facebook profiles of supposed leftists who suddenly realized the error of their ways and became Netanyahu supporters,” says Inbal Orpaz, a former journalist who now works as a researcher focusing on disinformation at the Institute for National Security Studies.

She’s referencing an investigation by Israeli media watchdog site the Seventh Eye, which unearthed a group of fake Israeli profiles on Facebook pushing out pro-Netanyahu political messaging. All of these users were purported leftists who had “changed” their political affiliation due to the supposedly violent nature of the protests.

“Since 2016, we’ve seen a rise in activities on social media undermining our ability to differentiate between truth and falsehoods, and between reality and what’s fake,” Orpaz says. “One such technique is using networks of fake users to lead influence campaigns.

“Only a few years ago, simple automatic bots were enough to do that on social media, amplifying certain messages as posts or by responding automatically to discussions inside groups,” she says. “However, social media platforms have gotten better at spotting them, and now more complex mechanisms are being used – and they’re even harder to identify.”

Anti-Netanyahu protesters outside the prime minister's private residence in Caesarea, September 5, 2020.
Anti-Netanyahu protesters outside the prime minister's private residence in Caesarea, September 5, 2020.Credit: Rami Shllush

She continues: “Many times, these are the types of bots we see in political campaigns, but not only during elections. You could create a fake user with a fake profile picture, and all the content they post could make them look like a protest supporter – only to then start posting racist or violent content that would harm the protest and make it be perceived in a negative light,” she explains.

Anat Ben-David, a senior lecturer in the Department of Sociology, Political Science and Communication at the Open University of Israel and head of its Open Media and Information Lab, says that “researchers can never unequivocally say that any specific user is fake for certain. Rather, there are cues that can give us that indication, and the more cues there are, the more likely it is the user is not authentic.”

She is quick to add, though, that “there is a certain balance between the affordances made by the social media platforms and the array of information that can be gleaned from them. Not being able to discern beyond a shadow of a doubt whether a user is authentic or not is in itself an affordance built into these social media platforms, and this serves agents of disinformation who know how to use them to conceal themselves.”

Ben-David also notes that “agents of disinformation will always use any feature that allows them to hide their identity – and this is true on every platform. When that fails, they create new users or new accounts that can serve those purposes.”

Hotbed of fanatics

Screenshots of comments and posts like those found by Dorfman, supposedly coming from within the protest movement itself, were shared and spread through right-wing circles, where they served as fodder for those looking to disparage the demonstrations as a hotbed for fanatics. That narrative jibes with Netanyahu’s oft-stated claim that the protests are being led by violent anarchists out to get him and his family.

Protesters being detained by the police at an anti-Netanyahu protest in Jerusalem, August 29, 2020.
Protesters being detained by the police at an anti-Netanyahu protest in Jerusalem, August 29, 2020. Credit: Tomer Appelbaum

On one occasion, Netanyahu even amplified a user whose posts have aroused suspicion. On July 29, the prime minister shared a screen capture on his personal Twitter account of an interview with one of the protest movement’s lawyers.

The screenshot showed a user with the generic Jewish-Israeli name “Dana Ron” responding to the interview with the following comment: “Bibi can be taken down only by force. Dictators are ousted only with a bullet to the head.” The post suggested there were protesters who were willing to take up arms to oust Netanyahu.

However, a closer examination led Dorfman to suspect that the account could be fake. It too has since been taken down. He explains that such accounts are relatively easy to spot, noting that “anyone who works in social media will notice in a second.”

For example, he says, Dana Ron’s original name on Facebook was Dana Levi, and the user had few if any real friends. They had also changed their biographical details twice in the 48 hours prior to their rebranding, Dorfman notes. The Israeli police later stated that the account was traced to an Israeli who has been living in Australia since the 1980s, but did not provide that person's real name. 

Identifying Yossef as a seemingly fake user was relatively easy too, Dorfman says, because the URL on his Facebook profile revealed its original name: Waleed Al Khaibari. The email associated with the profile, Dorfman says, was registered in Latvia.

This is why Dorfman says he’s so concerned by the phenomena. “We’ve discovered a concerted campaign,” he claims. “If it’s real and these users are actually inciting violence against the prime minister, the police and Shin Bet security service need to investigate it. If they’re fake, then it’s a false flag operation and they also need to investigate it, to find out who’s trying to undermine Israeli society.”

Orpaz agrees that although it’s impossible to know for sure whether the accounts are fake, “sometimes a simple search on the profile picture will reveal that it’s a fake picture. Only recently it was revealed that the profile picture of one suspect account – an alleged leftist who had suddenly become pro-Netanyahu – was actually lifted off the Wikipedia page for ‘human image synthesis,’ which is the technology used to create fake but original faces for these profiles.”

Dorfman claims that he and his fellow volunteers have also thwarted further attempts to denigrate the protests. For example, after the three suspicious accounts were found, the activists reached out to protest organizers and asked them to search their closed groups for posts written by these avatars. They found incitement-filled posts that were pending approval by the group’s administrators (some closed Facebook groups require approval before posts can go live).

These posts never made it online, but Dorfman says they were also intended to create screen captures that would seemingly show the violent anti-Netanyahu sentiment festering within the protest organizers’ ranks.

The Israel Police refused to comment on whether they’re investigating the allegations or looking into any such alleged activity on social media. In response to this article, they said they would investigate any complaint filed to them in accordance with Israeli law.

Dorfman’s group say they have complained to the police but have yet to receive any follow-up from them. In the meantime, they continue to investigate suspicious accounts, and Dorfman says he found another one last week.

This belonged to a “Nadav Brickman,” who identified as a leftist and whose Twitter bio described him as a Yale graduate who served in an elite Israel Defense Forces unit and now works at the Israeli Embassy in Brazil. He tweeted in support of violence against the police during the protests outside the prime minister’s residence. A few days later, one of Dorfman’s fellow cybersleuths noticed that the user had changed his name and was now “Omer Ginor.” Twitter has since taken down that account, too.

Dorfman notes that when such accounts are flagged, Facebook and Twitter – which is becoming increasingly popular in Israel – generally move quickly to shut them down.

White supremacist posts

Similar cases have also been reported in the United States, seemingly following the same modus operandi. For instance, Facebook posts allegedly posted by Antifa groups calling for violence were revealed by Reuters to be fake accounts tied to white supremacists. Screen captures of the posts were widely circulated in America, too.

Facebook told the news agency that the goal of such content is not to win thousands of followers, but to plant a single false flag that can be used to sow distrust about the target group.

For Dorfman, the issue is much wider, touching on an entire political culture of “fakery” that he and fellow activists charge is being pushed by Netanyahu and his supporters.

“I hate to sound conspiratorial, but there is a symbiotic nature to the real and digital worlds. The fakes online get amplified in the real world, and vice versa,” Dorfman says. “The issue of fake users and political propaganda in Israel requires regulatory intervention.”

Comments