The Shin Bet security service suspects two online groups trying to deepen conflicts around the judicial coup are connected to Iran, yet no steps have been taken against them. 'We have a plan and we’re looking for help,' wrote some users of right and left-wing groups
Alona (a pseudonym) thought her relationship with the foreign operatives behind the social media group No Voice was over. After last week’s report in Haaretz about the group, which revealed they were not Israelis but part of a foreign influence operation intended to stoke social divides in Israel, which had caused Alona to display a protest sign in her home, the network fell silent for about two weeks.
Their managers seemingly disappeared back into the digital world. But last week Alona received a notice from someone from the group again: It was the person who had presented herself by the name “Orly,” and who had caused her to display the sign in the first place.
“I’ll contact him,” Orly said of the Haaretz reporter behind the original report, adding that she planned to “discuss the incorrect things he published about us.” This was the first activity by the members of the network since they were exposed and went dark. Alona didn’t respond to the message, and the next day received another notice from Orly: “Did someone prevent you from hanging the sign?” Orly once again received no answer, and continued to try with two question marks, in order to clarify the urgency of her request.
In an interview with Haaretz, Alona said, “They want an answer.” “They,” believe defense officials in Israel are foreign groups, possibly Iranians, who want to drive a wedge in Israeli society. Their goal is to fan the flames of political conflict and to exacerbate the disputes, without supporting either the right or the left, neither the so-called Bibi-ists nor Anyone But Bibi groups, neither supporters of the judicial coup nor its opponents. To date, nobody from the defense or law enforcement establishment in Israel has contacted Alona.
With their return to activity, the members of the network also responded to requests from Haaretz for the first time. The replies of the user who presented himself as “Amit Pundak” – an identity stolen from a real lecturer at Tel Aviv University – were elusive, but made it clear that he was suspicious about answering questions. “The article about our groups was biased,” wrote a member of the network.
“You connected us to Iran, but didn’t provide specific reasons. We don’t understand the sensitivity, why? We understand that you’d like to write about our group, but please try to be more accurate and refrain from inappropriate stigmas in the future. We hope that in the future you’ll be able to write more accurate and professional articles. Please compensate. You should be aware of Netanyahu’s schemes and shouldn’t fall into his trap,” they wrote in awkward Hebrew.
The fake “Amit Pundak” disappeared after this conversation, but the lull in the activity of No Voice didn’t continue. Since last weekend, its members have posted many messages on Telegram in praise of the protest – from a prizewinning drone photo of the mass demonstration to an invitation to a demonstration in front of the prime minister’s official residence in Jerusalem.
The researchers of Active Info, who investigate foreign activity on social media, said this content was copied word for word from other organizations. At the same time, on the same day that the Hunters network, which targeted right-wing activists, resumed activity, so did the Traitors’ Trial (Mishpat Bogdim) network, which National Security Minister Itamar Ben-Gvir attributed to opponents of the judicial upheaval though the police had said they were actually a foreign group.
Avraham became Daniel
“I have to speak as friends,” wrote “Avraham,” manager of the Hunters group, on Saturday morning. “Unfortunately, several people and parties connect us and our activities to Iran or America, because they want to downplay our integrity among the right. Things happened to me that really depressed me, and unfortunately I can’t explain. I’ve come to ask you. If you want it and support it, I’ll continue to do exposés against the left. If not, I won’t work any more.” Another member of the group responded with an emoji of shock; another, who is also suspected of being a foreigner, asked the director to elaborate.
In a conversation with Haaretz, Avraham” said, “I was sad. I don’t know, suddenly lots of people saw my details on WhatsApp and cursed me and …” Here he stopped responding and asked for help in sending the messages: “”Never mind. I’ll start again, stronger than in the past. Only … you can help. Could you publish links of Hunters on WhatsApp and Telegram groups?” The next day he avoided another request, and replied: “I don’t feel good with you.” From there the connection was severed.
In a reply to the request of another Haaretz reporter, he asked to conduct the discussion on Telegram, and there he identified himself as “Daniel.” During the conversation he claimed that he lives in New York, and that the State of Israel is persecuting him and therefore he chooses to maintain anonymity.
Members of the Hunters group operate mainly on WhatsApp. According to Active Info researchers, several of them entered groups of Likud activists and there sent a link to their group, as well as questionnaires with the goal of collecting personal information. In the WhatsApp and Telegram groups they urged members – real Israelis unaware these users are fake – to confront the Israeli participants in the anti-coup demonstration planned for Ben Gurion International Airport on Monday.
Meta, the company that operates WhatsApp, didn’t respond to Haaretz’s question as to whether an Israeli official asked to block the numbers connected to the network, which the Shin Bet has confirmed are operated by a foreign entity.
Identifying the traitors
Last Monday “Avraham” asked in the What’sApp group if anyone had a new idea “for exposing leaders of the left or for dealing with them.” The next day he posted a video clip of burning tires and warned: “It’s heading towards violence. In that case we have to prove if we’re more violent, or the left.” An Israeli user in the group responded: “There’s no difference between you and the Arabs. The lies and the brainwashing. The hatred of Judaism, tradition, religious people. The rhythm of their songs even. Their video clips.”
The same user told Haaretz that he suspected that this was a fictitious group, but believed that those responsible for it are leftist demonstrators who are trying to besmirch the right – not foreign entities trying to undermine Israel’s already fragile social cohesion..
Later that evening, after a press conference convened by protest leaders, the Hunters group wrote: “The anarchist left intends to attack Ben Gurion International Airport on Monday. We have a plan and we’re looking for help – is there anyone who can help us?” Later they used more blatant language: “We recommend to the left to stay away from Ben Gurion on Monday, otherwise we’ll meet there.”
Those aren’t the only hints by the Hunters of their intention to resort to violence. The members of FakeReporters who spoke under a pseudonym with the user “Daniel” found he was linked to both the anti- and pro-protest groups.
On Saturday he turned to a FakeReporter researcher, who in the past asked to coordinate the delivery of a protest sign for hanging on one of the bridges, and told him that he had stopped hanging signs. He explained that he left the group because “our people torched, they destroyed, they take pictures.” But he asked, “What’s your idea for dealing with Bibi supporters?”
Later he explained, “I don’t think these protests will succeed. What can you do to help? I have lots of friends who have started to confront and identify the traitors. I think that’s a good thing and it has an effect.”
When the researcher asked what he meant by identifying the traitors, “Daniel” said: “Many people and groups told me that they’re willing to undertake difficult and dangerous activities in order to fight dictatorship. People are fighting for the country. Their names will go down in history. What was the effect of the quiet protests?”
Pro-Russian meddling
Alongside the two allegedly Iranian influence operations, an investigation by the private social media intelligence firm Intercept finds that at least two other operations, both likely foreign, were active on Twitter around the issue of the judicial coup. One of them, which investigators say is run by a pro-Russian entity, included over 100 fake accounts – some of them active since 2010 – and in the past had been involved in other influence operations.
Researchers at Intercept, who specialize in protection from hostile influence campaigns on social media, found that content dealing with what’s happening in Israel was disseminated by the network alongside messages showing Russia in a favorable light in the war in Ukraine and Kyiv in a negative light. In poor Hebrew, the operation joined the wider attempt to undermine the West’s support for Ukrainian President Volodymyr Zelensky and his government, in a manner resembling other campaigns discovered worldwide in recent months.
Like other pro-Russian influence campaigns, the content directed at Israel was supposed to stir tensions and fuel anger – in this case through memes and polarizing discussions of the judicial upheaval, the opposition to it and the conduct of the government, floating a possible civil war; to incite hatred against Arabs and the ultra-Orthodox, and to degrade the Ukrainians and Israel’s support for Ukraine against Russia.
Many tried to link the Israeli and pro-Russian themes and cast them as similar struggles: “Zelenskyism and Bibi-ism make it impossible to distinguish between good and evil.”
On the other hand, and also in line with past disinformation operations, the same network also incited against the opposition, claiming that it “is destroying the State of Israel with its own hands.” The criticism was directed in part at the “pilots of the opposition,” and asked whether they “are on our side or Iran’s?”
The second network disseminated only messages in support of the protest, and included about 50 accounts that pretended to be Israeli and used stolen photos of Israelis. They shared texts against the government and “dictatorship” in Israel, and usually attached pictures from the demonstrations. Since May they have sent an identical message: sharing a tweet that reads: “Bibi is an incompetent prime minister,” along with a call to send “Bibi and Ben-Gvir to Iran.”
One of the users using the alias Mayan Erlich, researchers claim, links the two networks. Both networks were also found to be connected to the Traitors’ Trial group.
A week after the Iranian operation was revealed, and as the pro-Russian network was exposed, FakeReporter CEO Achiya Schatz wrote this week to Prime Minister Benjamin Netanyahu, “We can’t accept the reality in which on the social media, the ‘public square’ for Israeli citizens, there are groups of thousands of users operated by hostile foreign entities bent on harming Israelis.” Schatz says that the organization’s investigators have recently identified an additional spike in the activity of the foreign networks.