As the deadly rockets fell and Israeli cities began their descent into chaos, a network of former Israeli army intelligence officers went to work.
They had picked up their digital spying skills in the service while monitoring Palestinian society, years of duty spent scanning the web, lurking on social media and infiltrating messaging groups.
Now, these former offers were training their civilian keyboards on a different target: Israeli extremists.
It was around noon on Wednesday when the picture began coming into focus. Members of various far-right movements were chatting on Telegram and WhatsApp. They were talking about the Jewish victims of the prior day’s riots and about exacting revenge by finding Arabs to terrorize.
The online exchanges grew increasingly specific. Soon after 3 p.m., someone finally spelled out almost exactly what would happen a few hours later.
Using formal language and no punctuation, a user named “Yossi” wrote out an invitation for Jews to join a “mass brawl” or “attack” against Arabs. Converge at 6 p.m. at the boardwalk in the coastal town of Bat Yam, he wrote.
“Please bring the proper equipment: brass knuckles, swords, knives, sticks, rocks, pistols,” Yossi wrote. He asked that people who come wear kippot and tallit — Jewish religious garb that, in this case, would become the uniform of an armed street gang. “Today, we bring Jewish honor back,” Yossi wrote.
The former intelligence officers, who now belong to civilian watchdog groups like FakeReporter and Democratic Bloc, watched in horror. They collected the information and alerted the police.
“It was written plain and simple in so many Telegram groups and we sent the info to police, and we talked to them and they did nothing,” said Ori Kol, an activist who’s not a former intelligence officer himself but acts as an organizer and spokesperson for the effort. The ones doing the online research, who learned habits of secrecy during their time in the army, are maintaining anonymity for reasons of personal safety.
Indeed the police were nowhere to be seen when an armed mob roamed the streets of Bat Yam Wednesday evening. In live footage broadcast on Israeli television, extremists could be seen dragging an Arab man out of a car and beating him. “We’re watching a lynching in real-time,” a reporter can be heard saying. “There are no police here.”
Kol and his group felt helpless at that moment. “It was just incredible last night to sit at home in front of the computer with these 30 Telegram groups open and watch Jewish nationalists armed posting videos of them walking around with weapons in our streets, and just beating people up,” Kol said. On Thursday, he added, citing press reports, that police did appear to dispatch at least some officers to spots his group had flagged.
This online monitoring of Israeli extremists is being carried out by a new group called FakeReporter, which describes itself as “Israel’s Disinformation Watchdog,” and by the slightly more established left-wing group Democratic Bloc, which investigates extremist activities and funding sources.
FakeReporter was launched at the start of this year and was shaped by the Jan. 6 attack on the U.S. Capitol. As the press revealed in the days that followed, the siege was organized by extremists in an online ecosystem where wildly false information spreads, helping recruit new people into the cause.
“What we saw in January, we’re deathly afraid of — the Capitol riots basically gave us a taste of our worst nightmare, for Israeli democracy,” Kol said. “We might be experiencing something worse than that right now, but it’s still early to say.”
What Kol and the FakeReporter activists saw in recent days looked a lot like some of the pictures that emerged after the Capitol riot of participants posing with their preparations.
“This is nationalistic toxic masculinity that just feeds off itself online in these photos,” Kol said. “It’s like jihadist groups, basically. You take a weapon, you take a picture with a flag of Israel—with no face obviously in the picture—and you upload it to the group. And it’s like a sign of you being, you know, a real OG. And it’s crazy because later they go out and sometimes they use those weapons.”
Mob violence driven by online hatred is in some ways only the latest manifestation of an increasingly broken information environment in Israel. While the country doesn’t suffer from the hallmark vaccine hesitancy of the United States, political lies spread rapidly and have played a role in the fracturing of Israel’s political system over the past few years.
Veterans of Israel’s intelligence agencies are known for starting tech companies and striking gold with multimillion-dollar investments from foreign venture capitalists. But among the technically savvy are many civically minded individuals as well. They usually hail from the well-heeled parts of Israel, especially the Tel Aviv area, and expect to live in a country that abides by liberal norms.
With those norms not seen as a priority of the country’s leaders, some of those techie vets are turning indignant and brandishing military-grade digital skills. They know how to build web platforms for gathering and disseminating information, and they are masters of an increasingly important field known as OSINT, or open-source intelligence, which means cleverly combing the internet for information.
“Sometimes it’s a Google trick like Google Advanced Search,” Kol said. “Sometimes it’s just like knowing where to look and knowing the context, and knowing who to ask. And sometimes it’s infiltrating — using covert identities to enter extreme far-right groups online.”
In addition to work by their affiliated experts, FakeReporter tries to tackle the problem by crowdsourcing reports of disinformation and incitement to violence. The solicit submissions on a website and through social media.
Thousands of reports have come in from ordinary Israelis through this system, Kol said, and they use the information to generate press coverage while also contacting social media companies and government authorities directly to request action. On Friday, the FakeReporter reported on Twitter that an extremist Telegram group called “Army of Citizens” had been blocked following complaints.
In the current internet era, ordinary civilians all over the world play an important role in tracking extremist activity, exposing dangerous individuals, and alerting the public, according to Oren Segal, the head of Center on Extremism at the Anti-Defamation League, which itself does this kind of work.
Civilian sleuthing is quite common, he said, and there are good reasons why it should not be the sole purview of law enforcement.
“It’s not necessarily something that law enforcement can always do,” Segal said. “The idea of private conversations being monitored by law enforcement—no matter how nefarious those conversations are—it’s gonna raise serious civil liberties concerns. There’s a tension between law enforcement overreaching and the need to be in online spaces to see where the threats are coming from.”
Segal also warned of risks, both due to accidents and foul play, when trying to counter disinformation. This is particularly true when it comes to identifying individuals.
“Somebody may get some information wrong—misidentify somebody or not have the full picture,” he said. “There should be some caution in those engaging in this to make sure that they get it right. Or it can be weaponized by those who don’t have pure intentions. Some people might intentionally miss identifying something, which ultimately results in, you know, doxing someone or making their life miserable.”
FakeReporter does not run this risk, because, at least for now, it’s not interested in the work of identifying extremists, according to Kol. The focus is on anticipating violence and intercepting false information.