I’m shocked to hear that God’s chosen ones would ever do something dishonest.
A team of Israeli contractors who claim to have manipulated more than 30 elections around the world using hacking, sabotage and automated disinformation on social media has been exposed in a new investigation.
The unit is run by Tal Hanan, a 50-year-old former Israeli special forces operative who now works privately using the pseudonym “Jorge”, and appears to have been working under the radar in elections in various countries for more than two decades.
He is being unmasked by an international consortium of journalists. Hanan and his unit, which uses the codename “Team Jorge”, have been exposed by undercover footage and documents leaked to the Guardian.
Hanan did not respond to detailed questions about Team Jorge’s activities and methods but said: “I deny any wrongdoing.”
Tal Hanan
The investigation reveals extraordinary details about how disinformation is being weaponised by Team Jorge, which runs a private service offering to covertly meddle in elections without a trace. The group also works for corporate clients.
Hanan told the undercover reporters that his services, which others describe as “black ops”, were available to intelligence agencies, political campaigns and private companies that wanted to secretly manipulate public opinion. He said they had been used across Africa, South and Central America, the US and Europe.
One of Team Jorge’s key services is a sophisticated software package, Advanced Impact Media Solutions, or Aims. It controls a vast army of thousands of fake social media profiles on Twitter, LinkedIn, Facebook, Telegram, Gmail, Instagram and YouTube. Some avatars even have Amazon accounts with credit cards, bitcoin wallets and Airbnb accounts.
The consortium of journalists that investigated Team Jorge includes reporters from 30 outlets including Le Monde, Der Spiegel and El País. The project, part of a wider investigation into the disinformation industry, has been coordinated by Forbidden Stories, a French nonprofit whose mission is to pursue the work of assassinated, threatened or jailed reporters.
The undercover footage was filmed by three reporters, who approached Team Jorge posing as prospective clients.
In more than six hours of secretly recorded meetings, Hanan and his team spoke of how they could gather intelligence on rivals, including by using hacking techniques to access Gmail and Telegram accounts. They boasted of planting material in legitimate news outlets, which are then amplified by the Aims bot-management software.
Much of their strategy appeared to revolve around disrupting or sabotaging rival campaigns: the team even claimed to have sent a sex toy delivered via Amazon to the home of a politician, with the aim of giving his wife the false impression he was having an affair.
The methods and techniques described by Team Jorge raise new challenges for big tech platforms, which have for years struggled to prevent nefarious actors spreading falsehoods or breaching the security on their platforms. Evidence of a global private market in disinformation aimed at elections will also ring alarm bells for democracies around the world.
The Team Jorge revelations could cause embarrassment for Israel, which has come under growing diplomatic pressure in recent years over its export of cyber-weaponry that undermines democracy and human rights.
Hanan appears to have run at least some of his disinformation operations through an Israeli company, Demoman International, which is registered on a website run by the Israeli Ministry of Defense to promote defence exports. The Israeli MoD did not respond to requests for comment.
The undercover footage
Given their expertise in subterfuge, it is perhaps surprising that Hanan and his colleagues allowed themselves to be exposed by undercover reporters. Journalists using conventional methods have struggled to shed light on the disinformation industry, which is at pains to avoid detection.
The secretly filmed meetings, which took place between July and December 2022, therefore provide a rare window into the mechanics of disinformation for hire.
Three journalists – from Radio France, Haaretz and TheMarker – approached Team Jorge pretending to be consultants working on behalf of a politically unstable African country that wanted help delaying an election.
The encounters with Hanan and his colleagues took place via video calls and an in-person meeting in Team Jorge’s base, an unmarked office in an industrial park in Modi’in, 20 miles outside Tel Aviv.
Hanan described his team as “graduates of government agencies”, with expertise in finance, social media and campaigns, as well as “psychological warfare”, operating from six offices around the world. Four of Hanan’s colleagues attended the meetings, including his brother, Zohar Hanan, who was described as the chief executive of the group.
In his initial pitch to the potential clients, Hanan claimed: “We are now involved in one election in Africa … We have a team in Greece and a team in [the] Emirates … You follow the leads. [We have completed] 33 presidential-level campaigns, 27 of which were successful.” Later, he said he was involved in two “major projects” in the US but claimed not to engage directly in US politics.
It was not possible to verify all of Team Jorge’s claims in the undercover meetings, and Hanan may have been embellishing them in order to secure a lucrative deal with prospective clients. For example, it appears Hanan may have inflated his fees when discussing the cost of his services.
Team Jorge told the reporters they would accept payments in a variety of currencies, including cryptocurrencies such as bitcoin, or cash. He said he would charge between €6m and €15m for interference in elections.
This is going to get less coverage than East Palestine.
It’s shocking the Guardian is even mentioning it (although they do tend to be a lot better about these things than the New York Times, which does not have a big story up about this).
tldr; Team Jorge are a 1-stop-shop of influence & psyops
Their business model: disinformation-as-a-service, or DaaS.
Their software: AIMS, an advanced system for creating and deploying fake accounts without detection #TeamJorge @FredMetzo @GurMegiddohttps://t.co/gWboysUP1M
— Omer Benjakob (@omerbenj) February 15, 2023
The long story: @FbdnStories follows up on the work of journalists that are threatened or killed. They decided to bring together reporters from across the world to investigate the shady disinformation-for-hire industryhttps://t.co/4APpmfTWhM
— Omer Benjakob (@omerbenj) February 15, 2023
The project, if anyone was crazy enough to take it on: Postpone an election in an African country without any reason.
And the disinfo industry said: HOLD MY BEER#TeamJorge @FredMetzo @GurMegiddo
— Omer Benjakob (@omerbenj) February 15, 2023
.@FredMetzo played a mild-mannered French consultant
I played the neurotic American@GurMegiddo the ex-Israeli
More calls were made. After one key introduction, we were told to call Jorge. https://t.co/7eEoKacwYb
— Omer Benjakob (@omerbenj) February 15, 2023
Over the course of Zoom meetings, Team Jorge pitched their bundle of services. First, you collect “active intelligence on your targets” – this includes hacking into email and messaging accounts. These can later be leaked. #TeamJorge @FredMetzo @GurMegiddo pic.twitter.com/3vaoH5v7Yg
— Omer Benjakob (@omerbenj) February 15, 2023
Some were playing out in front of our very eyes. We were shown the live Telegram account of a senior Kenyan official, now a serving minister. Jorge showed us how he could send messages from his target’s phone. #TeamJorge @FredMetzo @GurMegiddohttps://t.co/P53riNhH65 pic.twitter.com/h1w9YCaTCC
— Omer Benjakob (@omerbenj) February 15, 2023
The fake accounts are grouped and AIMS’ avatar management dashboard boasts: “African, Arabian, Armenian, Brazilian, Canada, European (mix), Philippines, Russia, Senegal, South America, Ukraine, USA and Zimbabwe.”#TeamJorge @FredMetzo @GurMegiddohttps://t.co/gWboysUP1M pic.twitter.com/Bx7cTMGWSm
— Omer Benjakob (@omerbenj) February 15, 2023
All the avatars have SMS verified emails. After they are created, the system can register them to other websites – from Amazon to Discord and even Airbnb. Some, Jorge claimed, even had crypto wallets #TeamJorge @FredMetzo @GurMegiddo https://t.co/gWboysUP1M pic.twitter.com/O8ATPxVmgX
— Omer Benjakob (@omerbenj) February 15, 2023
To “groom” their avatars – an industry term for non-nefarious activity intended to make the fake accounts look human – they post generic viral content like Buzzfeed or NatGeo#TeamJorge @FredMetzo @GurMegiddo
https://t.co/Bp61KH6J4A pic.twitter.com/yMpEg9Bz7X
— Omer Benjakob (@omerbenj) February 15, 2023
After the Zoom meetings, Jorge offered to meet. @GurMegiddo and I came to his office and managed to get shots of the real Jorge – Tal Hanan – his brother – Zohar – and others #TeamJorge @FredMetzo https://t.co/bLAQYlnimN pic.twitter.com/8lDyyCZzbw
— Omer Benjakob (@omerbenj) February 15, 2023
Team Jorge, we discovered, are not new. They’ve been around for a while and even worked alongside Cambridge Analytica. #TeamJorge @FredMetzo @GurMegiddohttps://t.co/HV7oMI24e3
— Omer Benjakob (@omerbenj) February 15, 2023
This is just the first day of the investigation. There’s a string of exposes into disinfo ops and those selling them #TeamJorge @FredMetzo @GurMegiddohttps://t.co/aqKv3pUS8J
— Omer Benjakob (@omerbenj) February 15, 2023