Israeli influence operation highlights global disinformation industry

A mysterious Israeli political marketing firm with little online presence is at the heart of a government-led information operation targeting the United States and Canada.

Following the outbreak of war between Israel and Hamas in October, researchers began picking up signs of a coordinated influence campaign focused on promoting pro-Israel narratives about the conflict, disparaging Muslim communities in the United States and Canada, and commenting on the pages of media organizations, politicians and public figures in those two countries.

The bulk of the content and websites linked to by the network appeared to have a common objective: sowing discord and promoting tensions within domestic coalitions in North America that have rallied to the Palestinian cause, including the targeting of audiences in the United States by attempting to link the U.S. civil rights movement to support for Israel and Zionism. 

According to the New York Times, the operation was ordered by the Israeli Ministry of Diaspora Affairs, which dedicated at least $2 million to the effort and hired the political marketing firm STOIC. 

The Israeli Ministry of Diaspora Affairs did not respond to questions about the operation on Wednesday. 

A robust, complex commercial ecosystem of firms that carry out influence operations has in recent years emerged in Israel, a development that allows state clients to maintain a measure of plausible deniability between themselves and the propaganda operations they distribute, experts say. 

Often founded by former Israeli military officers, these companies operate in “a gray zone” where they advertise the technological capabilities of an influence-for-hire operation without spelling it out, said Alessandro Accorsi, a senior analyst for social media and conflict at the International Crisis Group.   

“Obviously, you don’t find out on the website that they run disinformation campaigns or influence campaigns, but it’s a pretty well-established industry,” he said.

Investigations by the news outlet Haaretz and nonprofit Forbidden Stories have identified numerous companies in Israel that carry out influence operations like the one linked to STOIC, as well as a parallel industry that offers sophisticated tools to scrape data on users and individuals on social media platforms without being detected.

The campaign operated by STOIC was flagged earlier this year by the independent researcher Marc Owen Jones and the Digital Forensic Research Lab, which identified a network of more than 160 accounts across Facebook, X and Instagram that appeared to be dedicated to boosting and amplifying an account dubbed United Citizens for Canada.

That account, which purported to represent concerned Canadian residents, aimed to foment anti-Muslim sentiment and called attention to what it described as “the increasing presence and support for anti-liberal, aggressive, and violent Islamic movements and organizations in Canada.” 

The account and its network spread false claims of Canadian Muslim immigrants and residents imposing Shariah law, manipulated photos and lobbied journalists to give the issue more coverage, often deploying near identical language in their posts.

The network showed signs of obvious inauthenticity, as many of the accounts, pages and websites involved were created around February. United Citizens of Canada’s Instagram page was created in 2019, but has undergone at least five username changes since then, a common tactic used by many sockpuppet accounts to rebrand around emerging or current events.

In a pair of reports last week, Meta and OpenAI traced much of that activity to STOIC, providing additional details about the operation’s presence across Facebook, X and YouTube and its use of generative AI.

Mike Dvilyanski, Meta’s head of threat investigations, told reporters that the company suspended or removed 510 Facebook accounts and 32 accounts on Instagram related to the campaign, but that the operation saw relatively little reach on those platforms.

According to Meta’s report, many of the accounts used North American proxy infrastructure to anonymize their activity and pose as locals, including as Jewish students, Black Americans and so-called “concerned citizens.” Those accounts also called for the release of Israeli hostages kidnapped by Hamas, criticized U.S. campus protests against Israeli military operations and attacked the United Nations Relief and Works Agency, the aid organization operating in Gaza that Israeli officials have tried to link to Hamas with little evidence.

Many of the accounts appeared to use AI tools to create profile photos and to create text for comments.

In an interview with CyberScoop, Jones said the use of AI in the campaign is reflective of how commercial companies can pitch and sell influence services to governments as cutting-edge technology, even when what they ultimately produce is “fairly generic content.” 

“I think it’s very easy for people to sell these products as if they’re some kind of miracle cure for bad publicity, when in reality I think they’re a little crude,” he said. 

Little is known about STOIC, which lists its headquarters in Tel Aviv. The company’s website advertises a range of services to political organizations, candidates and other organizations, including generative AI, data analysis and “content creation and distribution.” 

Efforts to reach STOIC executives for comment were unsuccessful. 

A Meta spokesperson told CyberScoop the company relied on “a combination of technical and behavioral indicators” to link the activity to STOIC but declined to offer further details, citing a desire to avoid revealing investigative details that might help bad actors evade detection.

The reported involvement of the Israeli government raises larger questions about the role that commercial disinformation-for-hire operations and democratic governments play in the disinformation ecosystem. David Agranovich, Meta’s senior policy director for threat disruption, noted that commercial marketing firms offer third parties an additional layer of obfuscation to attempt to manipulate public opinion without leaving any direct digital fingerprints.

“These services essentially democratize access to sophisticated influence or surveillance capabilities, while hiding the client who’s behind them,” Agranovich said.

Jones said that while authoritarian governments in the Middle East and other regions get plenty of scrutiny from Western media for their influence operations, those governments are often tapping expertise from U.S. and European companies to conceive and carry out specific campaigns. 

Jones described the Israeli government’s brazenness running information operations against allies as of a piece with its desperation to counter international blowback from the war being waged in Gaza. 

“When it comes to the perceived existential threat to Israel, the rules go out the window and behaviors we might normally attribute to authoritarian regimes become, not necessarily acceptable, but we see this kind of tactic being used,” he said.

The operation mounted by STOIC relied on notorious spreaders of online disinformation. A website run as part of the operation — Non Agenda — linked to content posted by Visegrád 24, a highly influential account on X that has emerged as a key purveyor of pro-Israel narratives on the platform in the aftermath of Oct. 7. Non Agenda is also linked to the online persona known as Radio Genoa, which promotes anti-immigrant and far-right narratives in Europe.

By linking to such content, STOIC may have attempted to capitalize on existing political movements sympathetic to their messaging. The websites all “had a clear focus on anti-Muslim propaganda, trying to dismiss or attack any solidarity coalition with the Palestinian movement, with the feminist movement and queer movements, Black-minority movements,” Accorsi said.