Skip to main content

Israel amps up cyberwar on Palestinian Facebook posts

To fight the Palestinian attacker 2.0, the IDF and Shin Bet are increasing cyber efforts to detect internet posts by potential assailants.
Israeli Prime Minister Benjamin Netanyahu gestures as he speaks at the Cybertech 2016 conference in Tel Aviv, Israel January 26, 2016. REUTERS/Baz Ratner - RTX242M5

The Facebook page of Muhammad Taraiyre, 17, from the West Bank village of Bani Na’im, who murdered Hallel Yaffa Ariel, 13, in her bed in the neighboring settlement of Kiryat Arba June 30, has set off a war between the State of Israel and the Facebook empire. Public Security Minister Gilad Erdan, who has accused the management of the popular social network of failing to cooperate with the State of Israel in monitoring inflammatory content, told my colleague Ben Caspit in an interview with Al-Monitor, “The Taraiyre case is a classic example [of Facebook posts that] should have been monitored in time, and [the murder] should have been averted.” The youth wrote on his page that “death is a right,” before breaking into Kiryat Arba and murdering the girl. He added a sentence to his post that leaves no room for doubt about his heartfelt desire: “Grave, where are you, aren’t you asking about me? Angel of death, have you not missed me?”

One can assume that the new cyber units in the intelligence branch of the Israel Defense Forces (IDF) and Shin Bet have conducted a thorough investigation to examine why Taraiyre’s post slipped through their monitoring gatekeepers. These agencies will have to figure out how a publicly posted message that was supposed to set off alarm signals managed to sneak under the virtual defense fence erected by Israeli intelligence.

“This is indeed a classic case of a post that indicates harmful intent,” Nimrod Kozlovski, a world-renowned expert on cybersecurity, the internet and cyber law, told Al-Monitor. Regardless of the immense progress made by Israel since the start of the current terror cycle, cyberwarfare does not guarantee total success. Despite developing monitoring engines, upgrading algorithms, constantly adding new data and allocating vast resources for a state-of-the-art, digital-era intelligence system, the huge volumes of traffic on the internet cannot ensure total control by the world’s intelligence services. It is only the managers of the social networks — Facebook, Twitter and others — who have the appropriate tools for comprehensive monitoring that could, perhaps, prevent the next terror attack.

In the past, for example during the second intifada (2000-2005), Israel’s counterterrorism intelligence network was mostly based on information gleaned from intercepting electronic signals, intercepting communications between people and running agents and collaborators in the field. This time around, due to the nature of this intifada and the different profiles of the assailants — independent and spontaneous rather than organized and premeditated — these methods of intelligence collection are less effective.

The “individual intifada,” a term coined for the terror attacks of recent months, has presented Israel’s intelligence community with more complex and complicated challenges than infiltrating the clandestine cells of Hamas or other armed Palestinian organizations. While in the past one could target such organizations, today every Palestinian male and female aged 13-30 can be considered a potential terrorist. This age group consists of more than 1 million people, and no intelligence service can monitor such masses with guaranteed success.

“We can identify a profile of freely expressed enthusiasm and overexcitement on social networks, which are often followed by a call to action,” said Kozlovski. That social networks are open and almost all their members can be identified by name and even located enables the collection of a lot of high-quality, current intelligence data in real time, he said. In this regard, Kozlovski stated, “We understand the groups being formed, understand the geography of the cells being organized, know what their hierarchical structure looks like, who has viral and influential impact on all the members of the active group and the resonance they create.”

Kozlovski added that there are advanced technologies, which are activated according to certain indices, that can predict with a high degree of certainty whether the resonance of a certain post is likely to result in violence. “It can be a violent expression on the web, which is considered incitement to commit a terror attack, or an expression of an imminent physical action. There are algorithms that can make an almost exact prediction,” he said.

The IDF and Shin Bet cyber units, which were recently significantly expanded, have not taken the place of the veteran intelligence networks. Due to the nature of the current intifada, however, they are spearheading the intelligence efforts, and their development is now a top priority. These units employ dozens of experts who invest most of their efforts in developing monitoring engines capable of scanning thousands of messages a second. These engines are fed thousands of key words and verbal codes in order to scan traffic on social networks. They identify unusual activity in the content itself as well as significant increases in message traffic.

Virtual warriors, agents whose job it is to collect intelligence information, infiltrate active social media groups and glean priceless information. “It’s quite common to activate avatars on the web using a fake identity,” Kozlovski revealed. “They infiltrate an active group, pick up information, learn the composition of the group and identify the most active members.”

The social profiles of every terrorist who carried out an attack in Israel in the recent cycle of violence have been thoroughly studied, and the key words they used on Facebook have been loaded into the monitoring engines. Thus, for example, Ibrahim Alan and Hussein Abu Ghosh, the two men who killed Shlomit Krigman in the West Bank settlement of Beit Horon, wrote on Facebook that they intended to “hunt porcupines.” Four days before the murder, Alan wrote, “I feel like sampling the taste of a porcupine,” adding that he would go hunting on Monday, the day the attack occurred.

The word “porcupine” was fed into the monitoring engines on the assumption that some young people might gain inspiration from the popular post and emulate its phrasing. It is safe to assume that the intelligence agencies will be apprised of the words used by Taraiyre, the killer from Bani Na’im. His name will be included in the database so that anyone citing it or the words he wrote will set off a warning signal. Nonetheless, all the monitoring engines in the world cannot thwart the motivation for terrorism. That is something Israel will have to deal with using other means.

More from Shlomi Eldar