The Facebook posts posted by “Noa Shamir” on Holocaust Remembrance Day not long ago was especially shocking, even for her followers, who have grown accustomed to the vitriol emanating from her keyboard. “We already had one Holocaust, we don’t need another Holocaust…” she wrote in the post, along with the pictures, one next to the other, of Prime Minister Benjamin Netanyahu and Adolf Hitler.
A look at Shamir’s profile on Facebook shows what seems to be an active account linked to an activist from the Black Flags movement – one of the main groups leading the protests against Netanyahu. The purported young woman has shared video clips from the different protests and has even tagged well-known activists in them - as well as in her own anti-Netanyahu posts.
But a more in-depth look at her Facebook page reveals that this account is fake – it was opened only three months ago, and her profile picture and others were stolen from a real woman who is active on the Russian social media network VK – often called the Russian Facebook. Whoever is operating this fake account seems to be systematically trying to link the anti-Netanyahu protests to violence.
Yossi Dorfman, a digital activist and citizen journalist, has followed Shamir’s activities on social media for a number of months. Dorfman works to expose fake accounts: In July 2020 he exposed that the Facebook page belonging to “Dana Ron” – which also contained incitement to violence against Netanyahu, including: “Dictators can be removed [from power] only with a bullet to the head” – was fake. Netanyahu, who shared the threat on his page, filed a complaint with the police and Facebook removed the account. After the police’s elite antifraud unit opened an investigation, it discovered the account was run from outside of Israel. But the police did not release any findings that shed light on the identity of the person behind the dubious account.
In tandem with Dorfman's work, investigators from Fake Reporter, a platform intended to expose fakes active on Israeli social media, conducted their own examination. They looked into the account after receiving roughly 30 reports about the Shamir account. The examination showed that Shamir’s modus operandi is similar to that of other fake Facebook pages discovered over the past year.
Last week, Facebook reported that it had removed 29 accounts impersonating Black Flags activists, saying the network of accounts was operated against Israel from Iran. Shamir’s page was also removed this week by Facebook, raising suspicions her page was also operated by Iran.
- Facebook reveals: The real Iranian disinformation wars
- American Jews’ identities used in catfishing operation targeting anti-Netanyahu protesters
- Israel election, the day after: The right gears up for massive 'the left stole the vote' campaign
Dorfman and activists have for weeks if not months suspected that Shamir’s account was a fake, and reported it to Facebook. But Facebook did not delete the account until this week, and even responded to those who initially complained: “We examined the profile you reported and discovered that it does not violate any of the rules of our community.”
Dorfman's work reveals how profiles like these work and operate under Facebook's nose. According to Dorfman’s investigation, Shamir’s profile was updated for the first time on January 26, 2021. She turned to protest activists to add them to her list of friends. Within a few weeks she had collected over 3,350 friends.
Dorfman explains that along with the sharing posts related to the protests, Shamir’s account also contained personal pictures of a real woman and even those of beautiful scenes – all used to to create an impression of authenticity. These pictures were taken from the page of a VK user named Ksenia Zhuravleva, who lives in southern Russia. Shamir’s Facebook profile picture was originally posted to VK in 2017.
To further link Shamir’s page to the anti-Netanyahu protests in Jerusalem, “Shamir” began to tag protest activists in her posts. The page was built in such a way that after the post comparing Netanyahu to Hitler went up, anyone who saw the page would assume that behind it was an anti-Netanyahu protester, says Dorfman.
“There were a lot of questions about her among protest activists who wanted me to check the account,” Dorfman told Haaretz. “Her post from Holocaust Remembrance Day was very extreme. I realized that the person behind the image was now operating it for purposes of incitement.”
Poppies, hamburgers and Bibi
An analysis conducted by Fake Reporter of the different shares Shamir’s Facebook posts received shows it interacted and was amplified out by other fake accounts. They also found these are operated by a network from outside of Israel – and were also taken down by Facebook. For example, Shamir’s first profile picture received 11 responses from another fake account opened only a few days earlier – a common pattern of operation intended to give it “volume” of followers and responses to the new user.
An analysis of the dozens of photos and their captions shows how whoever is operating the account tried to manufacture and impression of authenticity. Over just three months, alongside the pictures of poppies and meals of hamburgers and fries, Shamir posted pictures with captions such as “Bibi Leave,” and violent video clips in broken Hebrew, that look as if they were translated into Hebrew using computerized translation such as Google Translate.
One of the posts had a cartoon in which water bursts out of a faucet that is compared to the state budget, while ultra-Orthodox receive a strong flow of the water, the nonreligious – who are represented by a soldier, doctor, worker and academic – look hung out to dry. The cartoon had a caption saying: “The state of a country with a Bibi government … It is in our hands … #Israel# Dictator#Haredim#Leave.”
Fake Reporter explains that in addition to adding protest activists to the list of friends of the fake accounts, the activists also received direct messages to their mailboxes, which were meant to gather information on them. Fake Reporter also investigated other accounts suspected to be fake, in an attempt to expose those behind them and discover the hidden interests, as well as the attempts to sow incitement among the public.