Memos 
Live events & webinars 
Trend Reports
TEL AVIV – Foreign states and groups, primarily Iran, have been conducting for the past few years cyber campaigns designed to destabilize Israel and its institutions, with another such offensive exposed on Saturday. The latest campaign involved thousands of fake posts on Instagram revealing personal details of Israeli police officers and was disguised as an attack staged by Israel's anti-government protesters.
One of the pro-democracy activists used to expose the police officers was Nitzan Weisberg, who suddenly recognized her picture on a profile disseminating information that she had not posted. The Fake Reporter, an Israeli watchdog that researches and exposes false information, was quick to tweet an alert about the scam. Still, the impact of the warning was limited.
The affair made headlines only after Israeli National Security Minister Itamar Ben-Gvir took the bait. Ben-Gvir ignored the warnings and instead treated the posts as authentic, accusing the protest movement of posting photos of police officers, along with their personal phone numbers, in order to intimidate them and prevent them from carrying out their duties.
Israel and Iran are clearly in an undeclared state of war, but paradoxically, the interests of some groups on the opposing sides sometimes seem to overlap. As such, Ben-Gvir played into the hands of the false news campaign, fighting back as if these posts were real news and facts.
“This is a serious and dangerous crossing of a red line designed to harm the police officers and their families,” tweeted Ben-Gvir, chair of the Jewish Power party.
Ben-Gvir also posted photos of a designated Telegram channel called “Bogdim” ("Traitors"), ostensibly devoted to exposing the police officers. However, according to the assessment of the Shin Bet security agency and the police, the minister was taken in by false information spread by a foreign state, probably by Iranian hackers. The profiles of the users allegedly exposing the police had been taken over by hackers and used to post the information.
Ben-Gvir, the hard-line nationalist in charge of the Israel Police, was not too bothered by the experts’ opinion. His tweet remained online, although he did add a vague clarification. As far as he is concerned, the accusations against the protesters had achieved their purpose — to taint the persistent pro-democracy protest against the government’s planned judicial coup. If that means using Iranian disinformation, so be it.
The Fake Reporter called this strange collaboration between Ben-Gvir and the unknown foreign state – allegedly the Iranians - “virtual collusion.”
As mentioned above, Iran and Israel have been waging cyberwarfare on social and other media for years. In 2019, then-Shin Bet Chief Nadav Argaman warned publicly against "a foreign country” that intends to interfere in Israeli elections. It was believed at the time that Argaman was referring to Russia or Iran, or both. In recent years, Israel has exposed numerous fake profiles, bots, avatars and other agents of influence and chaos allegedly used by Iran to fuel domestic Israeli discord and unrest and influence processes such as elections and protests. These activities have usually been exposed in their early stages and nipped in the bud.
"The current operation, which most likely was planned and carried out by Iranian hackers, was a surprising success," an Israeli source with expertise in cyber affairs told Al-Monitor on condition of anonymity. It might well have remained just one more marginal hacking incident had Ben-Gvir not highlighted it, the source added.
"The goal was to inflame the public atmosphere and the political hawks over the legal reform," an Israeli monitoring source familiar with the case told Al-Monitor on condition of anonymity. Ben-Gvir's unexpected cooperation was an unexpected bonus for the hackers, being shared on thousands of networks, WhatsApp groups and profiles, including those affiliated with the right-wing political bloc.
"We are in an era where truth or facts don't matter, only the number of shares," a senior protest source told Al-Monitor on condition of anonymity.
The vigilance of the protest activists, who noticed this operation in its early stages and contacted the Shin Bet and the police, brought it to a halt shortly after it went online. The police posted the following tweet that evening: "In recent hours, thousands of tweets have been posted on social networks in which details of police officers were revealed, calling for action against them. According to the examination of security officials, there is a growing suspicion that this is in high probability a foreign country's campaign aimed at causing friction among the public."
The Israel Security Agency does not speak publicly on these issues, but according to sources, it believes that this operation falls under what security officials call FIMI, an acronym for Foreign Information Manipulation and Interference. Such operations succeed in creating real damage to the public discourse even when they are exposed at relatively early stages because there are always enough people willing to continue echoing the fake messages, whether unwittingly or on purpose to advance a political agenda.
