Manipulation, Disruption & Espionage: the 2019 Israeli Elections


On Tuesday 9 April 2019 Israel will be holding early legislative elections for members of the 21st Knesset, the unicameral national legislature which holds 120 seats. The elections are of significant importance at both national and regional levels and are highly likely to have attracted the attention of various cyber actors. Various operations are likely to be conducted, with manipulation, disruption and espionage that promise to be at the forefront of the electoral race.

An attractive election

Incumbent Prime Minister Benjamin Netanyahu has been in office since March 2009, but has recently been indicted on bribery and corruptions charges, threatening to undermine his chances. Netanyahu is the chairman of the right-wing Likud party. His Likud party’s greatest challenger is the Blue and White political alliance, led by right-wing candidate and relative newcomer General Benjamin Gantz.

Political developments within Israel, particularly during this turbulent election period, are likely to be of significant interest to a number of neighbouring governments. The elections are therefore likely to attract both information gathering and influence campaigns from foreign powers. Indeed, Israeli media announced in January that a majority of Israelis feared the elections would be manipulated through cyber attacks. On 10 March 2019, it was also reported by the Time of Israel that officials had met with representatives of polling companies to discuss how to prevent hacking threats.

Espionage and disinformation: state interest in the elections

On 14 March 2019, a breaking news report by journalist Amit Segal of Israel’s Channel 12 came out stating that Iran had hacked the personal mobile phone of Gantz.  Gantz was reportedly informed of the breach by officials from the Israel Security Agency known as Shin Bet. The breach allegedly happened during the election campaign with Iranians having accessed sensitive information stored on the device. Although Gantz’s party refused to make a comment, they put into question the timing of the report so close to the elections.

In January 2019 the US media company Vocativ issued a report claiming that it had observed an increasing number of bots attempting to influence national discourse in Israel. These bots have been attributed (with varying confidence) to Iran, Saudi Arabia and Russia, all countries with geopolitical interest in future of Israel and/or history of election interferences. Hundreds of fake social media accounts including Facebook, Twitter and Telegram were found spreading disinformation attempting to spread right wing ideologies.  The spread of disinformation has been a global concern since the Russian interferences in the 2016 US elections.

Disinformation campaigns do not extend just to meddling foreign powers. Israel is assessed to have highly advanced cyber capabilities, playing host to highly advanced government and private industry organisations.  This capability, primarily in the private sector could be employed by candidates, or their supporters, to run campaigns designed to alter public discourse. Indeed, it was reported on 2 April 2019 that social media bots had already been seen spreading messages in support of Netanyahu. Although the Big Bots Project, responsible for the research, found no direct link between the bots and the Likud Party or Netanyahu, the network of accounts has worked with Likud’s election campaign.

Hacktivist disruption

Nation states are not the only entities with interests in the Israeli election. Hacktivism has been a prominent factor in Israeli life for some time, usually being used to draw attention to the Palestinian cause. Israeli organisations have often been subject to defacements and distributed denial of service (DDoS) attacks, usually launched by pro-Palestinian groups such as the Gaza Cybergang or during campaigns by the Anonymous collective. With both Likud and Blue and White having rejected basic principles of peace with Palestine and the elections being a time of heightened media and international attention, hacktivists, especially pro-Palestinian ones, will have significant interest in launching cyber attacks to bring attention to their ideological objectives.

Some media reports have stated that a major cyber attack on Israel is expected to take place on 7 April 2019; members of Anonymous have already posted material to that effect on several social media platforms. The group is likely to engage in DDoS and defacement attacks on government websites and to seek to disrupt the elections. The Israeli cyber security firm ClearSky reported that it discovered 120 Israeli websites which hackers had already compromised which were likely to be employed during this operation. However, given the robust countermeasures already put into place by Israeli organisations, which have been facing annual bursts of activity from operations such as OpIsrael, hacktivist activity is unlikely to result in any genuine disruption.

Anonymous member announcing OpIsrael attacks on 7 April


The 2019 Israeli Elections will almost certainly coincide with cyber operations by numerous different threat actors. Ahead of the elections, we can expect foreign advanced persistent threats to attempt to influence the outcome and conduct espionage campaign. Beyond external threats, we assess that domestic actors are also likely to want to manipulate the public through disinformation in favour of their preferred candidate. On 7 April 2019, there are likely to be disruptive attacks, largely targeting government sites. The election day itself is also likely to be eventful and, while no preparatory activity has been observed by researchers, attempts to disrupt or alter the election process cannot be fully dismissed.

Camille Bigot
Cyber Threat Intelligence Analyst

Subscribe to receive free updates

If you'd like to be kept updated on our blog, why not subscribe?

We will never give away, trade or sell your email address. You can unsubscribe at any time.