The message from Israel arrived on an otherwise unremarkable afternoon for 36-year-old Beau Villereal.
At his family’s sprawling 42-acre property outside Live Oak in Florida’s rural north, Villereal sat alone in his bedroom trawling for news about Donald Trump to share on the rightwing Facebook page he runs with his mother and father.
The messenger, who gave her name as Rochale, asked Villereal to make her an editor of Pissed off Deplorables, a self-described “pro-America page” that feeds its thousands of followers a steady diet of pro-Trump, anti-Islam content.
“I totally understand you,” she wrote. “I’m from Israel and this is ... really important to me to share the truth.
“Please give me a chance for a day.”
About 1,000 miles north in Staten Island, New York City, Ron Devito was tapping away on his laptop to the 20,000 followers of his pro-Trump Facebook page, Making America 1st, when he received a similar message, this time from someone using the name Tehila.
“She pitched to me that she was a good editor, she could provide some good content to increase likes and views on the page,” Devito told the Guardian. “Could I just give her a chance and let her post her stuff, right? So I figured, ‘What the heck, give it a shot’.”
Villereal and Devito weren’t the only ones. Over the past two years, a group of mysterious Israel-based accounts has delivered similar messages to the heads of at least 19 other far-right Facebook pages across the US, Australia, the UK, Canada, Austria, Israel and Nigeria.
How we cracked a far right network
A Guardian investigation can reveal those messages were part of a covert plot to control some of Facebook’s largest far-right pages, including one linked to a rightwing terror group, and create a commercial enterprise that harvests Islamophobic hate for profit.
This group is now using its 21-page network to churn out more than 1,000 coordinated faked news posts per week to more than 1 million followers, funnelling audiences to a cluster of 10 ad-heavy websites and milking the traffic for profit.
The posts stoke deep hatred of Islam across the western world and influence politics in Australia, Canada, the UK and the US by amplifying far-right parties such as Australia’s One Nation and vilifying Muslim politicians such as the London mayor, Sadiq Khan, and the US congresswoman Ilhan Omar.
The network has also targeted leftwing politicians at critical points in national election campaigns. It posted false stories claiming the UK Labour leader, Jeremy Corbyn, said Jews were “the source of global terrorism” and accused the Canadian prime minister, Justin Trudeau, of allowing “Isis to invade Canada”.
The revelations show Facebook has failed to stop clandestine actors from using its platform to run coordinated disinformation and hate campaigns. The network has operated with relative impunity even since Mark Zuckerberg’s apology to the US Senate following the Cambridge Analytica and Russian interference scandals.
When the Guardian notified Facebook of its investigation, the company removed several pages and accounts “that appeared to be financially motivated”, a spokesperson said in a statement.
“These pages and accounts violated our policy against spam and fake accounts by posting clickbait content to drive people to off-platform sites,” the spokesperson said. “We don’t allow people to misrepresent themselves on Facebook and we’ve updated our inauthentic behaviour policy to further improve our ability to counter new tactics.”
But this comes too late for some of the network’s victims. Australia’s first female Muslim senator, Mehreen Faruqi, felt the full force of the network in August last year, when 10 of its pages launched coordinated posts inciting their 546,000 followers to attack her for speaking in parliament against racism.
The posts prompted what Faruqi described as a “horrific feeding frenzy of racism, fake news and hate”, soliciting vile comments like “put your burka on – and shut the fuck up!”, “deport the whining bitch” and “Revoke citizenship and Deport”.
Faruqi said the network represented a “new level of far-right organisation and coordination”, and she places the blame squarely on social media companies.
“By allowing racist and misleading posts, social media giants like Facebook … are profiteering from the proliferation of hate speech and abuse,” Faruqi said.
“Facebook could do much more and shut these pages down but so long as they continue to profit from the reach and engagement, they don’t seem to be interested in decisive action.”
A spokesperson for Facebook told the Guardian: “Nobody can advocate or advertise hate or violence on Facebook and we remove any violations as soon as we become aware.”
‘The perfect foot soldiers’
It begins with a single post, curated by Israel-based administrators.
The post typically has an attention-grabbing headline and links to an article that mimics the style of a legitimate news story.
It employs a blend of distorted news and total fabrication to paint Muslims as sharia-imposing terrorists and child abusers, whose existence poses a threat to white culture and western civilisation.
It is then published almost simultaneously to the network’s 21 Facebook pages, which have a combined 1 million followers across the globe.
The content is so predictable that even Devito once complained to his Israeli counterpart. “I told her flat out, ‘you’re a one-trick pony’,” he said. “It’s Islam, Islam, Islam, Islam and more Islam. Like, enough with the Islam already, we get it.”
The Guardian conducted an analysis to confirm the extent of coordination across the network, checking where posts were identical in content and similar in publication time across different pages.
The network published 5,695 coordinated posts at its height in October 2019, receiving 846,424 likes, shares or comments in that month alone.
In total, the network has published at least 165,000 posts and attracted 14.3 million likes, shares or comments. The content is amplified further by other far-right Facebook pages, including those run by the rightwing UK Independence party (Ukip), who share it organically.
The posts link back to one of 10 near-identical websites masquerading as news sites with generic titles like “The Politics Online” and “Free Press Front”. Ad-heavy and poorly designed, the websites feature “stories” that usually combine slabs of copied text intermingled with unsourced opinion and graphic imagery.
The Guardian worked with researchers from Queensland University of Technology’s digital media research centre, who conducted an analysis of the order in which identical posts appeared across the 21 Facebook pages.
Their analysis indicates a single entity is coordinating the publication of content across the Facebook pages, likely using automatic scheduling software, and that a single entity controls the websites that receive traffic from the posts.
“It’s very obvious looking at the websites, the way that they’re structured, the way that they’re sharing design and code, and the way they share Google site IDs, that they’re all interconnected with each other,” said QUT professor Axel Bruns, one of Australia’s leading internet researchers. “They’re just cheap sites to set up, cheap sites to run … It’s not very sophisticated and it’s just brute force, to push all this stuff out.”
Bruns and his colleagues believe the motivation is commercial, and that hatred, division and political influence may be byproducts of the pursuit of profit.
“Here’s a bunch of people who – they’re not stupid but they’re highly prone to clicking on content that reflects their already held beliefs, especially content that is highly emotive and contains polarising and extreme material,” said Timothy Graham, a senior lecturer on social network analysis at QUT.
“These people are great for business. If you get them to come to your website, they’re not going to [look closely at] the content, they’re going to click through and keep [sharing] it. They’re the perfect foot soldiers.”
‘You’re the one profiting’
The network wasn’t always so extensive. The delivery of coordinated content began in 2016 through just a few pages in Israel and the US.
From 2018 onwards, the network began approaching the administrators of large, pre-existing Facebook pages across Australia, Austria, Canada, the US and the UK, promising content that would help grow their audiences.
In March 2018, the network gained access to a Canadian pro-Israel page dubbed Never Again Canada, which has 232,000 followers. A previous BuzzFeed News investigation into Never Again Canada showed it was regularly sharing content about the Jewish Defence League, an FBI-designated rightwing terror group, and coordinating content with other pages.
The network reached its peak in October this year with coordination across 21 pages. Each time a local page-owner agrees to let one of the Israeli administrators in, they become unwitting though not necessarily unwilling participants in the globally coordinated distribution of online hate.
Some page-owners, like Villereal, who runs Pissed off Deplorables, had no idea their new Israeli counterparts were making money from the following they had built.
“It’s a little disheartening to sit here and think I’ve been doing this for two years and I haven’t made a dime, and I allowed someone to come in who’s built the little back channel but they’re going to use my clientele to make money,” he said. “You know, it’s like I own the store, I built it and everything like that, and you’re the one profiting.”
Those behind the network went to great lengths to hide their identities, concealing personal information from websites and using different Facebook profiles when contacting the owners of existing far-right pages.
But by following a trail of digital breadcrumbs, the Guardian’s investigation traced the network back to a key player: a man going by the username Ariel1238a.
Finding Ariel
In December 2017, Ariel1238a made a seemingly benign request for help on an obscure search engine optimisation forum.
“I’m looking for more ways to monetize my site,” he wrote. “My niche is about politics.”
For the past two years, the same username has popped up regularly on similar web forums.
Writing in broken English, Ariel1238a frets about drops in his click-through rate, the inability to host “violent content” alongside advertising sourced through Google AdSense, and the low revenue return per-click on native advertising site Taboola. “I’m not satisfied with the profits they bring,” he told one forum.
He also complains about Facebook’s efforts to crack down on “fake news”. When the social media giant announced in April that it would step up its efforts to combat misinformation on the site, Ariel wrote: “Facebook has released another step on the way to its end, matter of time.”
Ariel1238a is not a web expert. He asks rudimentary questions including how to set up a business email domain and increase traffic to his sites. Yet his websites, he tells the forums, serve “leading countries” including the UK, US, Australia and Canada and have, he boasts, “somthing like 1m pageviews per month”.
The posts give no suggestion that Ariel1238a will become a driving force behind a wave of anti-Islamic hate across Facebook.
In fact, online profiles linked to Ariel1238a betray no political or ideological position at all. Instead, his digital footprint suggests that before he turned to exploiting the far-right’s obsession with Islam for profit, he had for years engaged in a number of unsophisticated online money-making schemes.
A now dormant account on a blog-publishing service links him to a “free sex dating” site, a “religious dating” site and a fan page for the fourth season of the Israeli Big Brother television series. He has dabbled in online directories for gyms in Tel Aviv, Botox injections, an online sim card store and a site described simply as “Online sex | Camera sex”.
Using web archiving services and domain registry information, the Guardian has been able to confirm the username Ariel1238a belongs to Ariel Elkaras, a 30-something jewellery salesman and online operator living on the outskirts of Tel Aviv.
Soon after the Guardian contacted Elkaras for comment, several of the network’s websites were either taken down or had large amounts of content removed. The public posts on his Facebook profile were also removed.
Elkaras did not respond to multiple requests for comment via email and phone, but the Guardian was able to track him down.
When we turned up at his apartment in a town near Tel Aviv in Israel, an older woman answered the door. She called out to Elkaras, who arrived wearing a T-shirt and sweatpants.
Through a translator, Elkaras denied knowledge of or involvement in the network but said he had once been “included in a group, something about Israel”. He refused to answer questions about his job, other than to confirm he dealt with computers. “Yes, but it’s not your business,” he said. “[The network] is nothing related to me.”
When the Guardian asked about the username Ariel1238a, he said: “I don’t know.” He closed the door, but shortly after followed a reporter out on to the street and demanded to know how the Guardian had found him.
Elkaras was the only real person the Guardian was able to connect to the operation. We were unable to verify whether Rochale, Tehila, or the other names used by the Facebook profiles that contacted page administrators, were the names of real people.
Messages obtained by the Guardian show Rochale telling a local page administrator she doesn’t know how to make money online and that she doesn’t know who runs the websites she sources her content from.
“I only share posts on your page because this topic is important to me,” she wrote.
While initially describing Tehila as “a Pam Geller type”, Devito later admitted he had never actually seen or spoken to her. Asked how he knew she was real, he said: “We don’t, to be brutally honest.”
Of the page administrators who returned requests for comment from the Guardian, only one claimed to have physically seen Tehila via Skype but declined to provide evidence. Asked how he knew he was speaking to a woman, the administrator, who declined to reveal his identity, said: “It sure looked like one.”
None of the page administrators the Guardian spoke to for this story were aware that the Israeli group was making money from the scheme, or that their pages were part of a larger network.
“They weren’t upfront about it because as much as I saw in the message ... there was no talk about making money,” a pro-Trump page administrator based in Nigeria told the Guardian.
Political influence and Facebook’s failures
In April last year, Zuckerberg sat before an army of cameras and offered a mea culpa to the world.
Facebook, still reeling from the Cambridge Analytica scandal, had failed its users, Zuckerberg said. The company had struggled to stop its platform being used for coordinated political interference and the spread of disinformation and hate.
“It’s clear now that we didn’t do enough to prevent these tools from being used for harm,” Zuckerberg said. “We didn’t take a broad enough view of our responsibility, and that was a big mistake. And it was my mistake.”
Two months later, the Israeli-based network gained access to its 13th far-right Facebook page, expanding the already sizeable audience for its disinformation.
The network has operated with relative impunity for almost two years.
“Believe it or not she hasn’t done anything to get the page in trouble,” Devito said of his Israeli administrator. “I haven’t gotten anything from Facebook that ‘you’ve been posting inappropriate content that’s violated our community standards’ or anything of the sort. I’ve been very fortunate in that regard.”
As the network grew, so did its ability to influence the thinking of voters. By the time the Australian election came around in May, the pages were providing a significant platform for far-right candidates, including One Nation and Fraser Anning, a senator widely condemned for calling for a “final solution” to immigration.
The network boosted Anning and One Nation with 401 posts in the lead-up to the election, which attracted 82,025 likes, 18,748 comments and 33,730 shares.
A One Nation spokesman, James Ashby, said the network would not benefit the party, and engagement on leader Pauline Hanson’s personal page was far greater. “I would suggest the 401 posts you refer to has attracted a nanoscopic number of likes, comments and shares in comparison,” he said.
A spokesman for Anning said he was previously unaware of the network and did not believe it had helped his campaign.
It was a similar story in Canada. In the lead-up to the October election, the network pushed out 80 coordinated posts critical of Trudeau that were liked, shared or commented on 30,000 times.
In the UK, the network has savaged Corbyn. More than 510 coordinated posts have attacked the Labour leader since mid-2016, attracting 15,384 likes, 17,148 comments and 16,406 shares.
Facebook’s own definition of “coordinated inauthentic activity” reads like a blueprint for the network the Guardian has uncovered.
“Coordinated inauthentic behaviour is when groups of pages or people work together to mislead others about who they are or what they’re doing,” Facebook’s head of security policy, Nathaniel Gleicher, explained last year. “We might take a network down for making it look like it’s being run from one part of the world, when in fact it’s being run from another.
“This could be done for ideological purposes or it could be financially motivated. For example, spammers might seek to convince people to click on a link to visit their page or to read their posts.”
But Villereal said he had not heard from Facebook since the Israel-based administrator began distributing content from his page.
“I haven’t had no notifications from Facebook or anything like that about the content they’re posting: like spam risk or fake accounts or community violations or anything like that.”
Faked news, real consequences
In March this year, a 55-year-old Donald Trump supporter from upstate New York, Patrick Carlineo, placed a call to the office of Minnesota Democrat Ilhan Omar.
After getting through to a staff member, he accused Omar of being a terrorist before saying: “Why are you working for her, she’s a [expletive] terrorist. Somebody ought to put a bullet in her skull. Back in the day, our forefathers would have put a bullet in her [expletive].”
Carlineo, who pleaded guilty to placing the call last month, had for years been allowed to post violent and racist content to Facebook. In April, the Guardian revealed how he had frequently used the platform to taunt Muslims, attacking them with racist slurs and saying he wished he could confront a group of Muslim politicians with “a bucket of pig blood”.
The call was not an isolated attack. A Somali American, Omar, 37, is one of the first Muslim women in Congress and the first to wear a hijab in the House chamber. Since her election, she has been a lightning rod for attacks from the right.
Political opponents have pushed conspiracy theories and shared violent content about her on social media. In April the congresswoman said she faced an increase in death threats after Donald Trump accused her of downplaying the September 11 attacks.
She is also the most frequent target of the network. In the past two years, the Israeli group has pushed out more than 1,400 posts targeting Omar across the 21-page network which in turn have been “shared” more than 30,000 times.
“I’ve said it before and I’ll say it again: Facebook’s complacency is a threat to our democracy,” Omar told the Guardian. “It has become clear that they do not take seriously the degree to which they provide a platform for white nationalist hate and dangerous misinformation in this country and around the world. And there is a clear reason for this: they profit off it. I believe their inaction is a grave threat to people’s lives, to our democracy and to democracy around the world.”
In November, a major study into Islamophobia from Charles Sturt University in Australia found a significant jump in the number of violent attacks against Muslim people, particularly women wearing head coverings.
Faruqi, a frequent target of abuse on and offline, said the far-right was relying on social media to “legitimise their hate and recruit”.
“Muslim women politicians tick both of their misogyny and racism boxes, so I end up as a target of a lot of their racist content,” she said.
“I’ve experienced a huge increase in racist and abusive social media comments, emails, phone calls and even handwritten letters since I’ve been in the public eye. There’s no doubt in my mind that many of the people behind these vile messages are emboldened by others on social media and Facebook pages like this.”