Earlier this week, Prime Minister Benjamin Netanyahu warned of Iranian cyber attacks carried out against Israel "on a daily basis."
Vocativ, which was founded by Israeli entrepreneur Mati Kochavi, noted an increasing presence of bots operating from Iran that automatically respond to events by posting on social media in an effort to influence the discourse in Israel.
The company contacted the social networks and asked them to stop what appears like an organized Iranian move.
According to Vocativ's analysts, there are at least 350 fake Iranian accounts operating on Facebook, Twitter and Telegram, whose posts have the potential of reaching some half a million Israelis every month.
Over the past few months, Vocativ used an intelligence system to scan the web to search for keywords based on the geographic location they originated from as well as ties between bots, leading them to the fake profiles.
Their algorithm determined whether the profile was real or fake by, inter alia, examining whether the profile was posting in regular intervals or at an unusual pace.
The algorithm, they said, could also uncover who was behind the bots, with most of the tweets and posts posted by the fake accounts traced back to an Iranian English-language website called Countdown 2040, which claims Israel will cease to exist by 2040.
The investigators told Ynet that in previous months, the bots engaged in matters concerning internal Israeli affairs but in recent weeks, due to senior Israeli official’s proclamations on Iran, the bots have been engaged in matters concerning Iran’s entrenchment in Syria.
The report states that the bots were initially used to enflame the Israeli-Palestinian conflict but once elections were announced, they have been set to focus on influencing their outcome. Analysts noted a 783% increase in bot accounts activity since elections were declared. Of the 350 Iranian bot accounts identified, only 50 were active prior to the elections announcement.
Method of operation
After the analysts discovered the fake accounts, they began to examine their method of operation and found that they operated very similarly. First the Iranians opened fake accounts under the guise of seemingly legitimate news websites such as “The Hot News” or “Uncensored News.”
They then set up a network of dozens of bot accounts pretending to be random individuals whose goal was to share, spread and bolster the information being spread by the fictitious news sites. The next step involved following prominent Israelis in the hope that they would follow them in return.
Afterwards, they opened Telegram group chats with thousands of Israeli users with the goal of identifying hot topics worth focusing on in order to manipulate.
Often, the Iranians would use genuine news headlines and rephrase them in a controversial manner in order to instigate divisive discourse around the issue. According to US intelligence agencies, the same method of operations was used by ostensibly Russian agents ahead of the 2016 elections in order to undermine the nation’s social fabric as well as democratic institutions and norms.
Following right wing personalities
The bots focused primarily on right wing trend setters and spread tweets designed to provoke responses from the electorate on the right. Among others, they followed the accounts of popular Twitter personalities such as Dery Azoulay, Delilah Moore, Ronit HaBibistit and Israel Bond. Often, legitimate users share and unknowingly aid the spread of Iranian disinformation.
The Iranians also opened Facebook fictitious accounts through which they developed contacts with Israelis and added them as friends, thereby legitimizing their fake accounts. They then joined politically focused Facebook groups where they advanced their divisive agenda.
The bots zeroed in on issues of controversy that are often used to defame Israel such as sexual harassment, articles criticizing Netanyahu, wealth inequality, anti-democratic legislation, poverty in Israel, matters of divorce, domestic violence the undermining of the Supreme Court and others.