I

t’s been three months since I joined up with a discreet group of web activists whose goal is to identify and expose fake profiles on social networks. The list of bogus personas they have uncovered keeps getting longer.

This collective of troll hunters has declared war on the sharers of fake news and incitement – the so-called “super-spreaders” or “sockpuppets” – whose sole function is to echo and share often false and misleading posts on social networks, thereby flooding them and the consciousness of their surfers at the same time. Some of these messages and arguments are those that elected officials and public figures, for example, don’t always feel comfortable (for the time being) uploading themselves, but have no problem liking, sharing, retweeting or even regurgitating, knowingly or not, in television interviews or the Knesset as “facts” to which they were exposed on the internet.

“This new machine is so sophisticated, and requires the investment of so much time, and has so many details, that it’s bordering on trade secrets,” the media strategist of a senior Likud official tells Shomrim, referring to the indirect ways in which politicians disseminate their messages on social networks.

Some of the fake profiles have names that appear easy to categorize as suspicious, while others use a profile picture that a simple Google search quickly reveals as belonging to someone else, or that may even have been created by an artificial intelligence system. Some will have shoddily woven identifying features that include follows of various pages and organizations, a random place of residence, and a list of friends that includes other profiles suspected of being bogus. Others may be soft-spoken and seemingly innocent, sharing Shabbat Shalom posts with pictures of a random landscape. And some profiles feature posts written in the garbled hand of a bot, based on Google Translate, and spend their free time liking and commenting on posts written by other profiles, either authentic or fake.

“This new machine is so sophisticated, and requires the investment of so much time, and has so many details, that it’s bordering on trade secrets,” the media strategist of a senior Likud official tells Shomrim, referring to the indirect ways in which politicians disseminate their messages on social networks.

There’s something about hunting for fake profiles that messes with your head; all those involved in the activity speak of a situation in which these networks are no longer a social surfing experience to enjoy during one’s spare time; they have, instead, become an oppressive experience at the heart of which lie falsification and special interests. It happened to me too: One night, while on the trail of a profile I suspected of being fake, I came across an English-speaking couple who immediately turned into suspects themselves in my discerning eye. I spent hours sifting through their profiles, their lists of friends, the generic photos of landscapes from around the world, the political posts they shared, the ‘Likes’ they gave to others, trying to figure out if the two individuals I was looking at were simply a likable couple with fixed political views – a perfectly legitimate state of affairs – or if I had stepped deep into the rabbit hole and was dealing with two fake profiles, controlled by an invisible hand, in an attempt to influence the discourse on social media.

“Hunting a fake profile is complicated,” says one of the activists in the group I hooked up with. “The people behind these profiles know what they’re doing. They build personas and try to create authenticity so that the surfers truly believe they’re interacting with ‘Moshe from Kiryat Malachi, who’s into gardening,’ for example. They build an entire persona around this individual who likes pages about gardening, and it’s legitimate after all for someone to be pro-Bibi or a Likud supporter. Unfortunately, most people surf the networks without a discerning eye that casts doubt. They would be well advised to adopt a more skeptical worldview when they’re there.”

How can you tell?

“It takes practice, and I’m not going to reveal all the methods. But you can keep an eye out, for example, if someone chooses to frame their profile picture with an image of a landscape or has never changed it. It’s worth looking into what they take the trouble to talk about all the time. There’s no magical method for identifying all the bots and fake profiles all at once. If there were, it would save us a lot of headaches.

“As far as I’m concerned,” she adds, “right-wing or left-wing views have nothing to do with my fight against the fake profiles. Personally, I hold very right-wing views on some issues, even more so than many Likud supporters who’ll read this article. Left and right are irrelevant terms for this type of activism. The ideal guiding me and all those involved in the issue is the ideal of truth and a better society.”

“Hunting a fake profile is complicated,” says one of the activists in the group I hooked up with. “The people behind these profiles know what they’re doing. Unfortunately, most people surf the networks without a discerning eye that casts doubt. They would be well advised to adopt a more skeptical worldview when they’re there.”

Why are you afraid to reveal your identity? You're not doing anything illegal. On the contrary, you’re exposing wrongdoing.

“There’s a sense that we’re taking a big risk on a personal level as well. I think it’s very likely that we’ll be silenced in one way or another. I know it may sound conspiratorial, but there’s a sense that this [fake account] activity is part of the organized echoing of posts and messages. It’s another arm. I’m a law-abiding person; I have no intention of crossing the line in this activity either. The only thing that matters to me is living in a better country, a country with decent values, and I have no intention of bending the law to expose the truth. It’s plain to see and should be voiced. The problem is that no one gets punished for spreading fake profiles; there’s no deterrence and no punishment.”

Exposing the mechanism

She’s not the only one who’s afraid to be identified. Many of the activists we spoke to believe that behind the fake profiles, for the most part, are forces a lot bigger and far more powerful than meets the eye. And the companies that run these platforms – Facebook and Twitter in particular – come under fierce criticism for accepting the current situation, or at least not doing enough to clean up their networks.

“I’ve always been wary of the media and social networks,” the activist says. “I only joined Facebook after numerous attempts by friends to persuade me to do so. I’d always take screenshots of profiles that appeared unauthentic, not necessarily political ones, just profiles of all kinds that sent me friend requests. I’d report them to Facebook, but I’d always get an automated response saying they hadn’t found anything that violated their policies, even when the profiles were clearly fake. I realized at some point that there was nothing I could do about it. Even when I turned to the media, I was told that the information had been passed on to their tech writer and that’s where it ended.”

Do you come across fake profiles on both sides of the political spectrum?

“Most of the fake activity I encounter is from the right, and if I do come across fake activity from the left, it’s usually a profile of someone who purports to be a leftist and is uploading posts that cast doubts on the left-wing camp. For example, there’s someone we’re monitoring now whose profile picture is actually of a journalist from New York; she has three profiles and has also opened left-wing groups. She’s suspected of being fake.

“Unlike other activists involved in exposing fake profiles, my agenda is completely political,” says a second activist, who also wishes to remain anonymous. “I’m not here to clean up the world; I’m here to rid it of incitement, hatred, the destruction of democracy, and the altering of consciousness. The thing that motivates me is the possibility that the regime in Israel is creating profiles and engineering consciousness by using a very large number of fake profiles that influence the discourse. I can’t tackle fake profiles from other countries that are on the social networks, or profiles from Iran; that’s not my job as a citizen. I think there should be an entity that assumes responsibility for this kind of thing, but there isn’t one,” she says.

“I’ve always been wary of the media and social networks,” the activist says. “I only joined Facebook after numerous attempts by friends to persuade me to do so. I’d always take screenshots of profiles that appeared unauthentic, not necessarily political ones, just profiles of all kinds that sent me friend requests. I’d report them to Facebook, but I’d always get an automated response saying they hadn’t found anything, even when the profiles were clearly fake.”

Meanwhile, until such an entity exists, this activist has stepped up and contributed significantly to the establishment of a new platform that could revolutionize the struggle: FakeReporter.net, a Hebrew-language website designed to collect and analyze information about fake profiles and networks of such profiles. It is open to the public at large and is operated by a collective of volunteers.

The system can be fed with links to suspicious profiles, inflammatory profiles or profiles that spread fake news, with the objective being to take all the long lists of suspicious profiles accumulated in the Excel reports of the various troll-hunter groups and to connect the threads using informational and programming tools, thereby obtaining a clear picture of the links between the bogus personas – or in other words, exposing the mechanisms behind them. Keep in mind, fake profiles aren’t always about political activity, on which we’ve focused in this report; they also serve commercial purposes and have even served the Ministry of Aliyah and Integration in its campaign to encourage immigration.

“I've been doing this intensively during my free time for eight months now,” the activist involved in the establishment of FakeReporter tells us. “The platform we’ve built is open to anyone who wants to use the data, so it was right for us set it up outside of the official bodies, which would have kept the data to themselves. The idea behind the platform is that the data is collected without anyone taking credit for it.

“We want to raise awareness about the issue of identifying fake profiles, to create a pool of volunteers to help us bring down these networks with the help of our research people, who’ll find the connections and map the networks. From there, it’ll be our responsibility to actively pursue the issue. We’ll work to bring down the fake profiles and the networks of fake profiles, and we’ll use Facebook to give us a broad picture, so we can demonstrate how disinformation works on the social networks.”

Where is the project today in terms of your vision?

“At this stage, the system is just a platform for collecting the information. Not everything that’s fed into it is necessarily fake. We’re going to have to work very hard to find the connections so that we can accumulate enough material on the fake profiles the next time they spread incitement on the web.”

How did you get involved in the first place?

“There’s one particular Facebook profile that made me put a hold on my life and dedicate myself to this activity; I won’t reveal the name because we’re still trying to dig up more information about him. The profile is a particularly inciteful one and is probably fake, and most of his friends are fake Facebook profiles. He has a matching Twitter persona too, under a different name. This particular profile caused me to begin questioning social media networks. In another instance, there was a Twitter user who was engaging in incitement and political activity, which I caught red-handed; he changed his name while I was checking out his profile; I saw it happening in front of my eyes.”

On the trail of the super-spreaders

So, how does it work? We took a close look at profiles suspected by the activists of being fake. Some have slightly different names on Facebook and Twitter but are easily linked; others take on amusing nicknames and go to great lengths to create a persona behind them. There are some profiles, for example, that present themselves as run-of-the-mill Likud supporters and that popped up simultaneously in recent years on the various social networks. Ever since, they’ve been generating content in which much time and effort has been invested, content that has the potential to go viral, including graphics, stickers and video clips. These profiles, or “super-spreaders” as the activists call them, are suspected of being operated by one or more individuals.

The suspicious signs include the fact that the profile’s activity is focused exclusively on political issues, with the posts shared conveying unambiguous messages that are then echoed by officials and politicians, accounts belonging to the political parties, Knesset members and government ministers, or influencers who also share the uploaded content.

Often, these are profiles that upload content on which they leave their distinguishing mark, “the credit.” Profiles suspected of being fake also frequently post videos from events such as demonstrations but are never seen or heard speaking in the clips – another sign that raises questions regarding their authenticity.

Another telltale sign is when the posts and messages of suspected fake profiles change all of a sudden during the course of their activity. For example, one of the profiles that the activists believe is bogus embarked initially on a campaign to delegitimize Blue and White leader Benny Gantz in the run-up to the elections; thereafter, the profile focused on recruiting people for demonstrations against Attorney General Avichai Mandelblit; and since the outbreak of the coronavirus crisis, the same profile has been focusing on the protests by the so-called “anarchist left” and glorifying the prime minister. Profiles suspected of being fake also echo posts that delegitimize media outlets, using disparaging epithets and slurs.

The practicalities that concern the profile hunters revolve around how the messages are echoed. They look into how the profiles share their posts in dozens of online groups (usually groups associated with the political right), how they respond to live Facebook broadcasts by right-wing or left-wing activists, and how they respond to the posts of others, and try to figure out which of the suspected profiles are connected to one another. This method of operation ensures significant exposure for their posts.

It’s hard to know who is behind those suspicious profiles. Online investigations and inquiries usually yield nothing; profiles that go by a particular name don’t appear in telephone directories or online searches, but that doesn’t mean they aren’t real individuals and that they’re involved in illegitimate activities. For the most part, the activists look for profiles whose posts they view as offensive or inflammatory, or those that spread fake news.

Sometimes, you’ll find the profile pictures used by the suspicious profiles in image databases, which clearly labels them as fictitious, but that’s not always the case, and the profile pictures can appear authentic. You can also trace the ‘Likes’ received by the suspicious profiles to ascertain whether they’re coming from profiles believed to be bots or other profiles suspected of being fake.

Some of the profiles that the activists have tagged as fictitious are probably just regular people hiding behind a fake name simply to spread their messages freely, but the activists believe the profiles are often maintained by this or the other entity with political interests, official or not. Nothing is being ruled out.

Almost all of the data, the activists explain, remains exclusively in the hands of Facebook and Twitter, and without access to this data, it’s very difficult to uncover the true identities behind the fake profiles. The activists also note that Facebook’s new interface makes it harder for them to hunt down the fake profiles because they can’t trace the profiles’ timelines and access various other particulars about their activities.

Fake profile, real death threat?

If one were to point to one particular incident that kickstarted the activities of the fake-profile hunters, it would have to be the case of “Dana Ron,” a profile that last July posted an inciteful, violent and reprehensible comment against Prime Minister Benjamin Netanyahu, writing that “dictators are removed only with a bullet to the head.” The post was re-tweeted by the prime minister’s official profile as an example of incitement by leftists to murder, before spreading like wildfire through social networks and being picked up and echoed by all the mainstream media outlets.

Yossi Dorfman, who’s become the face of the fight against fake profiles, dissected Dana Ron's profile in a manner that cast doubt on its authenticity, leading eventually to an official Facebook response confirming the profile as bogus and its removal from the social network. A subsequent Israeli police investigation found that the individual behind the profile was posting from Australia.

“Following the exposure [of Dana Ron], a team started coming together,” Dorfman tells Shomrim. “People approached me on their own initiative, others joined up in various other ways, and we started working. Some of them want to remain anonymous, and they have their reasons, and we work together as another branch of protest. It’s a fluid collective, with everyone contributing whatever they wish. The objective is to reveal the truth behind the lies with which the networks are flooded and expose the patterns of behavior.”

Yossi Dorfman, who’s become the face of the fight against fake profiles, dissected Dana Ron's profile in a manner that cast doubt on its authenticity, leading eventually to an official Facebook response confirming the profile as bogus and its removal from the social network. A subsequent Israeli police investigation found that the individual behind the profile was posting from Australia.

‍

In Dorfman’s view, “fake news all over the internet is designed to make us stop believing in anything at all. It’s a very salient characteristic of the post-truth era. The public expanse is flooded with information and some people out there are promoting disinformation. What we’re left with is a situation in which a vast quantity of truth is up against a vast quantity of lies. This serves various interests, especially those of individuals or entities that wish to control public consciousness. When you can’t believe anyone any longer, then maybe you need to believe in the most authoritative figure. It’s a characteristic of a dystopian era, but we shouldn’t agree to live in such an era.”

Gilad Bihari, a 41-year-old Modi’in resident, is the man behind the development of the FakeReporter website. He says that he, too, fell victim to incitement on social networks, when he was running for a seat on the city’s municipal council. “I’ve been involved with networking platforms and the fight against incitement and fake news and promoting social issues for many years,” Bihari says. “In the past, I developed the system that placed observers at the polling stations during elections to prevent any fraud. I developed additional tools for other struggles. I was also active in the 2011 [social justice] protests. I specialize in developing database systems, together with bringing people together and helping them to take action.”

How would you describe the organized troll-hunting campaign?

“I was approached by a number of activists who are involved in this campaign. Over the past few months, with all the demonstrations that have been happening, there’s been a dramatic spike in incitement and the dissemination of fake news using various fake profiles. It’s very hard to handle using the regular tools with which we’re familiar, via specific reports to Facebook and Twitter, as they’re just a drop in the ocean. We needed to harness the power of the network of users and activists to create a central reporting system, to provide us with insights and let us to conduct comprehensive research on the links between the profiles. When we have the results, we will share them with the public.”

Tell us about an instance in which fake activity influenced Israeli society?

“There was the case in which the police echoed a post uploaded by a fake profile that was passing itself off as the [anti-Netanyahu] Crime Minister organization. The fake page urged demonstrators to use stun guns and pepper spray against the police. A senior officer sat there, live on Channel 13 News, and read out the post from a Facebook page that had just eight followers and two posts. You don’t have to be a genius to recognize that as a fake page. We’re also familiar with examples of politicians sharing fake profiles. It reaches the highest levels, and it’s very serious.”

No funding, no leaders

A recently released report by the Berl Katznelson Foundation on “hate speech against the Black Flags and anti-Netanyahu demonstrators” notes that, during the period from May to October, some 87,000 posts containing incitement and verbal violence against the protestors were uploaded to the internet. Most of the discourse was conducted on social media, mainly Twitter, and it included slurs and harsh language, likening the demonstrators to Nazis, spreaders of COVID-19 and more; it seeped down from the highest-ranking public officials into various groups, primarily on the right of the political spectrum.

“The fake profiles, and the anti-protest campaign we’ve witnessed in recent months as a whole, are part of an orchestrated campaign designed to undermine the legitimacy of the protest,” says Ori Kol, founder of Mehazkim, a left-wing organization with close to 130,000 Facebook followers and a partner in the FakeReporter project. “It's one of their best tools. The system is designed to suppress political activists. It spreads homophobia and racism, hatred and incitement. The war against fake profiles is a continuation of the demonstrations in the street. When lies are spread, not only about the protesters but also about the handling of the coronavirus crisis, or ‘achievements’ made by the government, it’s part of the brainwashing mechanism they’re trying to put people through.

In Dorfman’s view, “fake news all over the internet is designed to make us stop believing in anything at all. It’s a very salient characteristic of the post-truth era. The public expanse is flooded with information and some people out there are promoting disinformation. What we’re left with is a situation in which a vast quantity of truth is up against a vast quantity of lies.

“We are witnessing the corruption of political discourse, the violent nature of online debates, lies and fabricated stories that reach millions of people every day. We’re hoping to mobilize citizens, everyone together, regularly to monitor what is happening online – and to report. The protests are not for the streets only; to reach people, you also need to get your message across on the internet.

“The activists tackling the fake profiles are very internet-literate. They’re very interested in information and knowledge; they love to read of course, and they’re inquisitive. They’re truth-seekers too, naturally, and a little obsessive. They have to be like that; I’m one of them too.”

Another prominent member of the group is a high-tech entrepreneur who’s been a social activist for years and brings his technological knowhow to the table. “The first part of our activity focuses on the whole world of fake profiles and bots,” he says, clarifying some of the terminology. “Avatars are fake profiles with a real person behind them, a private individual perhaps, or maybe someone who’s planting the content deliberately. A bot, unlike an avatar, is a fake account that’s operated by an automated system that routinely distributes content. Bot activity is significant because it increases the exposure of content.

“The second part of our activity focuses on everything related to online incitement associated with real people. The problem with the social networks is that the algorithm is designed obviously to show you the things in which you’ve shown the most interest, and if you add a lot of fake profiles that spread hatred or incitement or fake news into this activity, it floods the user’s feed, even though the world is much broader.”

Where does the money for the activity come from?

“There’s no funding for our activities; we’re all volunteers. There’s no single person who’s at the center of things either. It’s simply a group of people who’ve banded together to try to solve these problems, problems that influence our social discourse. It’s a collection of people, some from the IT world, some statisticians, and various other volunteers. I contribute mainly to the technology side of things.

“The fake profiles, and the anti-protest campaign we’ve witnessed in recent months as a whole, are part of an orchestrated campaign designed to undermine the legitimacy of the protest,” says Ori Kol, founder of Mehazkim, a left-wing organization with close to 130,000 Facebook followers and a partner in the FakeReporter project.

“We put in a lot of time, for example, when there’s an investigation to confirm whether a profile is fake or not, and there are all sorts of little signs and small errors the profile has made and can prove that it’s bogus. We have WhatsApp groups and Zoom meetings, and we maintain very open and free lines of communication. It’s not a very organized activity, but more along the lines of civic activism. Surprisingly, it’s a very tight-knit and strong unit.”

According to the same activist, he’s not actually focused at this stage on the people behind the fake profiles. “I don’t look into who’s behind them because our capabilities are limited,” he says. “At the moment, we’re concentrating only on identifying the profiles and their patterns. For example, if we are looking into the profile of someone who comes across as a left-wing extremist, but then changes his name on Facebook, we can follow the previous name and see if he’s also a member of a whole bunch of right-wing groups. We’ve come across that kind of thing too.

“We don’t have the tools the police have, such as the ability to demand an IP address, and even if we did, the profile may be using an IP address via a VPN or external server. That’s why we’re working on cataloging, tagging and disclosure.”

And then what?

“And then, when someone comes along and posts content, we can say that we’re familiar with this profile, and here’s all the truth behind it. We can also present Facebook or Twitter with an organized database and say to them: Here, these are profiles suspected of being fake and attempting to influence the Israeli agenda and political discourse.”