Iran accused of sowing Israel discontent with fake Jewish Facebook group

A suspected Iranian disinformation unit ran an elaborate network on Facebook targeting nationalist and ultra-religious Jews in Israel in an attempt to stoke division and inflame tensions with Palestinians, according to research shared exclusively with the BBC.

The alleged foreign interference campaign ran across multiple social media platforms posing as an ultra-Orthodox Jewish news group supportive of extreme right-wing groups.

Its goal was to help fuel "religious war" by amplifying "fear, hatred and chaos", according to the Israeli disinformation watchdog FakeReporter, which uncovered the group's suspected Iranian origin.

It is the latest sign of a growing disinformation battleground on social media and messaging apps in Israel. The network became active after last year's flare-up in sectarian violence in the country.

In one case, the network reposted a video of a confrontation between a far-right MP, who was carrying a gun, and a Palestinian car parking attendant, adding the comment: "It's a shame he didn't give him one in the head."

Facebook and Twitter deactivated the group's pages and associated profiles after being approached by FakeReporter. The network remains active on the messaging channel Telegram.

Facebook says the accounts were part of attempts to reappear after it took down "a small Iranian influence operation" last March. The company sees Iran-based groups as persistent and well-resourced in trying to exploit social media platforms.

The BBC approached the groups' administrator pages, asking their location and why they used copied content but they did not respond.

The Iranian embassy in London did not respond to requests for comment.

The "Aduk" - or "strictly religious" - group was created as a Hebrew acronym of "Virtual religious union for the religious community". It recirculated articles and posts supporting far-right politicians, encouraged protests and cultivated anti-government and anti-Arab sentiment. One of its profiles gathered thousands of followers.

"We see this network rise up following the events in May, when Israel was at one of the lowest points in its history in the relations between Jewish and Arab citizens," says FakeReporter chief executive Achiya Schatz.

An Israeli security source said the online profiles had similar characteristics to Iranian activity that previously took place on the platforms.

The network went to extensive lengths to look genuine, creating a page for a fictitious bakery in an ultra-Orthodox Israeli town, and in another case stealing the online identity of an ultra-religious Jewish man from Russia who died four years ago. On learning of the fake profiles his sister told the BBC that the social media platforms should be shut down (read her story below).

"It's something that we haven't seen before, creating such a backstory," says Mr Schatz.

"It's another concern because these networks are becoming more and more developed, to see them connecting with such extremists and violent groups... they're very fluent in Israeli politics," he adds.

The group repeatedly backed an ultra-nationalist Israeli MP, Itamar Ben Gvir, a follower of an outlawed, racist movement which called for the expulsion of Arabs from Israel.

Other posts by the suspected Iran-based network and its administrators included:

Analysts draw comparisons with previous foreign interference campaigns designed to destabilise and amplify divisions in the US and Europe.

When Olga Veshueva got a message from her brother Reuven she broke into a broad smile as she clicked open the photo.

It was a picture of him wearing the expensive hat he had saved for weeks to buy. He had planned to wear it proudly among friends at the Jewish religious seminary he attended in St Petersburg.

But that moment in 2017 is now a tragic memory for Olga. A few days later, Reuven, still in his 20s, died suddenly of heart failure. Olga cherishes the picture - the last one of Reuven ever taken.

She could not have predicted the bitter blow that would come four years later. Without the family's knowledge, the picture and others were taken from Reuven's social media profile - copied by disinformation operatives believed to be in Iran to become the online face of a man calling himself "Ariel Levi", the administrator of the "Aduk" news network.

Reuven's stolen identity has now appeared to thousands of Israeli social media users in posts on the group supporting extreme right-wing politicians and inflaming tensions between Jews and Arabs.

Olga wept when she saw how her brother's photos had been used for the false persona on Facebook for the last eight months.

"He left his mark as a kind, gentle person. He was the greatest brother, a loving person," she told the BBC, speaking from her home in Kazakhstan.

"But what can I do? I have no power. All these social networks should be shut down," she added.

Some young ultra-Orthodox Israelis may be more vulnerable to foreign interference due to low "digital literacy", suggests Tehilla Shwartz Altshuler of the Israel Democracy Institute think tank, who says many more are now experiencing the internet for the first time.

"This community is very conservative and doesn't have the experience of 70 years of TV," she says. "Any resentfulness towards Israeli society, or far-right extremism, or anti-Arab, anti-Muslim feeling [can be exploited]. This kind of community is not prepared to cope with fake news or digital manipulation."

The "Aduk" network used a scattered approach to try to gain traction. Pages on some platforms were barely active and many posts gained few comments. However, the Facebook page for "Aduk" administrator "Ariel Levi" had almost 3,000 friends.

This foreign interference pattern has been seen in other countries, says Simin Kargar, a non-resident fellow at the Atlantic Council's Digital Forensic Research Lab. She suggests Iran benefits from its opponents observing the disinformation campaigns themselves.

"Since the presidential elections in the US we've seen Iranian tactics getting more diverse, part of a broader and more complicated playbook... They see they're being noticed and feared," she says.

Erez Kreimer, former head of the cyber division at Israel's Shin Bet domestic security agency, describes the "Aduk" network as "unprofessional but efficient", adding that Iran sees Israel as "a prime target in its cyber efforts".

The case is the latest in a broader series of alleged interventions in Israel.

Last month, security agencies made several arrests and the government warned about Iranian attempts to lure ordinary Israelis into low-level spying. Since late 2020, at least five cases have come to light of suspected Iranian interference on messaging apps to infiltrate and foster anti-government protests in Israel.

Ms Kargar at the Atlantic Council links the attempts to the Middle East's wider shadow war, pointing to the assassination of Iran's chief nuclear scientist and mysterious explosions at its nuclear facilities. Many have attributed them to Israel, but it has never acknowledged any involvement.

"For Iran, a way of getting back at Israel is doing these more subversive campaigns or cyberattacks in order to show they're not staying silent and they're also doing things to mitigate the threat," she says. "But obviously at a lower cost because the bar for entry is much lower in this [cyber] space."

Tehilla Shwartz Altshuler of the Israel Democracy Institute describes this as a cheap form of foreign intervention. "It costs more to send missiles to Lebanon than digital bytes [to Israel]," she says.

Meanwhile, FakeReporter's researchers are calling for more robust monitoring by social media platforms.

Mr Schatz says: "We need to understand that if countries and the social networks, the big techs, won't step forward and increase security and defend the rights of users online, we are going to see more infiltration of politics and distrust between people."

Facebook's parent company, Meta, says its actions against alleged Iranian foreign intervention have "slowed this campaign down each time and helped to keep them from rebuilding their audience on our platform".

"Given the adversarial nature of this space and knowing that these malicious actors will always try to come back, we'll stay vigilant and take action as necessary."

A spokesman for Twitter says: "The accounts referenced were permanently suspended for violating our platform manipulation and spam policy".

Telegram did not respond to requests for comment.