When Facebook finally took down an account that Israeli activists had been flagging as fake for over a year, they didn’t breathe a sigh of relief. The user, purportedly an Israeli woman named Noa Shamir, was only one out of a large web of fake accounts active on the social network that targeted the protest movement against Prime Minister Benjamin Netanyahu. Facebook is but one platform in the Israeli social media ecosystem – activists have long said that the fake account and others like it are also active on Twitter, Instagram and even Telegram, the closed messaging platform.
Facebook said the account was part of an Iranian-operated network of over 20 accounts pretending to be part of the Black Flag movement, which has been active in organizing the anti-Netanyahu demonstrations. The fake accounts pushed out violent and inciting posts intended to taint the protest movement.
Israel’s Iran-baiting could backfire on Bibi: Listen to Yossi Melman
Experts and activists who spoke with Haaretz repeatedly flagged the account and others affiliated with it over the last year, with some even suggesting in the past that it bore the markings of Russian tradecraft. Now that it has been removed and its alleged origin revealed, they warn that Israel has increasingly become a digital battleground, scene to political cyberattacks, foreign influence campaigns and complex disinformation operations.
“The Mueller Report found two types of systemic foreign intervention: One was to try to hack the Clinton campaign and leak information from it – like happened to John Podesta. Secondly, they tried to create fake personas on Facebook and other social media networks, worked to build a following for them and then deploy them for political ends,” explains Yossi Rachman, director of security research at Cybereason, an Israeli cyberdefense firm.
“Both of those techniques were attributed directly by America to the Russian intelligence services. I note this as we are now seeing these exact techniques being recreated here,” he adds.
In recent months, Haaretz has been reporting on different incidents leading up to the takedown of the Iranian accounts. This included attempts to use stolen identities of real Jewish American philanthropists who used the promise of donations to try to gain information on the anti-Netanyahu movement, alongside claims of other “false flag” operations in which fake accounts purporting to be part of the protests were used to try to cast them in a negative light.
The protest movement has even birthed its own fake news watchdog – Fake Reporter – that tracks fake accounts and disinformation and helped reveal the different operations. Fake Reporter were instrumental in flagging and countering what was termed an Israeli version of the “Stop the Steal” campaign.
- The truth behind the fake Facebook user that compared Netanyahu to Hitler
- Facebook reveals: The real Iranian disinformation wars
- Iranian attack on Israeli medical orgs proves there’s no vaccine for the cyber pandemic
“We’ve gone to the police a number of times, but nothing is being done,” says Yossi Dorfman, an activist and citizen journalist who also helps to track fake accounts.
Fake Reporter says they spent the past year mapping out the network and flagging it for the different parties, including social media platforms and even Israeli authorities. However, it is not clear what was done in wake of their investigation, highlighting how hard it is to counter such operations, even when a team of dedicated researchers is involved.
“The problem is that most of the solutions put in place in wake of 2016 and ahead of the 2020 U.S. presidential election aren’t effective enough,” says Rachman.
Inbal Orpaz, a disinformation researcher from Israel’s Institute for National Security Studies, notes that the fake Black Flag operation – stylized as BB (Black Banner) – also maintained a group on Telegram with a large number of users. There, alongside organic content lifted from real activist groups, content that aimed to incite against the police was prevalent in what she said was a classic example of an attempt to stir tensions.
On an INSS podcast dedicated to disinformation and Israeli national security, Dr. Raz Zimmt, an expert at the institute focused on Iran, told Orpaz and co-host Tomer Shadmy that the operation was “an attempt to enhance and amplify inherent weakness and schisms in Israeli society – which they know to be divided along political, ethical and religious lines.
“The logic is that the more divided Israeli society is, the weaker Israel will be. This is less complex than the operations we’ve seen from other countries, but this is in line with Iran’s interests: The goal is to weaken Israel from within – and not just externally through proxies” like Hezbollah.
“These are national security issues,” explains Orpaz. However, it falls on the social media platforms to stop them, she says. For example, Fake Reporter and others flagged the accounts to Facebook (which owns Instagram) and Twitter and they were eventually taken down. But no such action was taken on Telegram.
According to her, much of the disinformation in Israel has shifted away from social media and onto messaging platforms like Telegram, which do not have mechanisms in place to stop inauthentic behavior or foreign intervention. “Facebook has some solutions for these issues and it also has some contacts with Israel, but what’s happening on Telegram is taking place under the radar,” she says, noting the company is based in Dubai and was set up by a Russsian entrepreneur behind the Russian social media network VK. The photo used as the profile picture for Noa Shamir, which Facebook took down as part of the alleged Iranian network, was lifted from the account of a real woman active on VK.
Q makes aliyah
Yahoo News revealed this week that Russian and Chinese actors were helping push out content across the world related to QAnon. On Telegram, supporters of the conspiratorial movement have helped bring some of the wildly baseless conspiracies to Israel.
Anti-vax stories originating in the U.S. are being translated and pushed out to different closed Telegram groups in Israel, where claims of voter fraud circulated ahead of the election and far-right memes including Pepe The Frog are given a Hebrew flair.
Yahoo News worked with the disinformation think-tank The Soufan Center and found that though “Russian actors dominated the foreign QAnon space on Facebook… they have been overtaken in recent months by those based in China.” In Israel, the groups are a hodgepodge of different forces. For example, anti-Chinese propaganda linked to Falun Gong media outlets is as common as viral posts from Chinese social media claiming that American Big Pharma firms are behind the coronavirus.
Dr. Adam Klin-Oron, a researcher focused on conspiracy theories in Israel, told the Israeli podcast The Posthuman Condition that despite its right-wing origins, Israel’s Q culture is actually a mixed bag of “new age” spirituality and fringe elements in society, a form of what he termed “conspirituality.”
“If you go into anti-coronavirus lockdown groups, you will find people who are ‘spiritual’ alongside people who are conspiratorial, as well as people who are anti-Netanyahu and those who are pro-Netanyahu. The common denominator is people who believe there are hidden powerful forces controlling our world,” he said. He notes that “in contrast to QAnon supporters in the U.S., there are much more of this type of people in Israel, I would say tens of thousands of them.”
According to him, Israel’s “conspirituality” scene received “a massive boost with the coronavirus. This is almost a new identity, we are seeing people who used to talk about ‘love’ and ‘light’ standing shoulder to shoulder with those who believe there is a ring of pedophiles that drink the blood of babies.”
Without commenting directly on QAnon and its presence in Israel, Cyberreason’s Rachman notes what most disinformation researchers have long said: The real goal of state-backed disinformation campaigns, especially those attributed to Russia, is not to push any specific line of content, but rather to create chaos.
The Iranian group, Orpaz says, is a classic example since their attempt to shame the protest movement could actually be seen as helping Netanyahu. “But the idea is not to support any side but rather exploit existing schisms,” she says. As Prof. Yochai Benkler told Haaretz ahead of the 2020 election, the goal of political disinformation is to undermine our trust in fact-based institutions and create a world where everything is possible and nothing is true.
Alongside the threat of fake accounts operated from abroad and disinformation on closed Telegram groups, the threat of cyberattacks – political or otherwise – has also increased with the coronavirus.
Only this month a group of Iranian hackers was found to have tried to entrap Israeli researchers focused on media and health issues. The hackers were linked to Iran’s Islamic Revolutionary Guard Corps and according to the researchers who found them, their goal was likely to steal personal information about targets with value for Iranian intelligence.
“Another thing we are also seeing is ransom and cyberattacks focused on political actors or those with information that has political value,” Rachman explains. “One type of this is political campaigns actually being targeted and then facing what is called double extortion – meaning they are not just being pressed for money to get their stolen information back, but this information is also being leaked online, posing a double threat to those unwilling to pay.”
He also notes that activists and others have received phishing attempts via WhatsApp, all part of a wider attempt to either steal information or sow chaos in political arenas. The past year has seen a string of politically-motivated cybercrime, including identity theft, but also so-called instances of hacktivism – for example, attacks by Iranian hackers motivated not by financial goals but ideological ones, like the attack on Israel’s Shirbit Insurance.
Nonetheless, despite the repeated takedowns, cyberattacks and disinformation efforts, the reach of such operations seems somewhat limited.
“Many of the Iranian posts were in terrible Hebrew,” says Orpaz. “It is not that simple to target Israel because not that many [foreigners] speak Hebrew and because you need a lot of knowledge about local politics and culture to make a real dent.”
“The level of operational security we are seeing is indeed much lower in quality than what other countries are doing,” Rachman says. “So it could be one country or it could be another trying to incriminate another.” Others have also suggested that Iran may not be behind the Black Flag operation.
“This latest takedown shows just how hard it is to actually find out who is behind what,” says Orpaz. “We think it’s Iran because that’s what Facebook says, but it’s almost impossible to know the truth.”