Revealed: the hacking and disinformation team meddling in elections

A team of Israeli contractors who claim to have manipulated more than 30 elections around the world using hacking, sabotage and automated disinformation on social media has been exposed in a new investigation.

The investigation reveals extraordinary details about how disinformation is being weaponised by Team Jorge, which runs a private service offering to covertly meddle in elections without a trace. The group also works for corporate clients.

The consortium of journalists that investigated Team Jorge includes reporters from 30 outlets including Le Monde, Der Spiegel and El País. The project, part of a wider investigation into the disinformation industry, has been coordinated by Forbidden Stories, a French nonprofit whose mission is to pursue the work of assassinated, threatened or jailed reporters.

The undercover footage was filmed by three reporters, who approached Team Jorge posing as prospective clients.

In more than six hours of secretly recorded meetings, Hanan and his team spoke of how they could gather intelligence on rivals, including by using hacking techniques to access Gmail and Telegram accounts. They boasted of planting material in legitimate news outlets, which are then amplified by the Aims bot-management software.

Much of their strategy appeared to revolve around disrupting or sabotaging rival campaigns: the team even claimed to have sent a sex toy delivered via Amazon to the home of a politician, with the aim of giving his wife the false impression he was having an affair.

The methods and techniques described by Team Jorge raise new challenges for big tech platforms, which have for years struggled to prevent nefarious actors spreading falsehoods or breaching the security on their platforms. Evidence of a global private market in disinformation aimed at elections will also ring alarm bells for democracies around the world.

The Team Jorge revelations could cause embarrassment for Israel, which has come under growing diplomatic pressure in recent years over its export of cyber-weaponry that undermines democracy and human rights.

Hanan appears to have run at least some of his disinformation operations through an Israeli company, Demoman International, which is registered on a website run by the Israeli Ministry of Defense to promote defence exports. The Israeli MoD did not respond to requests for comment.

Given their expertise in subterfuge, it is perhaps surprising that Hanan and his colleagues allowed themselves to be exposed by undercover reporters. Journalists using conventional methods have struggled to shed light on the disinformation industry, which is at pains to avoid detection.

The secretly filmed meetings, which took place between July and December 2022, therefore provide a rare window into the mechanics of disinformation for hire.

Team Jorge told the reporters they would accept payments in a variety of currencies, including cryptocurrencies such as bitcoin, or cash. He said he would charge between ¤6m and ¤15m for interference in elections.

However, emails leaked to the Guardian show Hanan quoting more modest fees. One suggests that in 2015 he asked for $160,000 from the now defunct British consultancy Cambridge Analytica for involvement in an eight-week campaign in a Latin American country.

There is no evidence that either of those campaigns went ahead. Other leaked documents, however, reveal that when Team Jorge worked covertly on the Nigerian presidential race in 2015 it did so alongside Cambridge Analytica.

Demonstrating the Aims interface, Hanan scrolled through dozens of avatars, and showed how fake profiles could be created in an instant, using tabs to choose nationality and gender and then matching profile pictures to names.

The Guardian and its reporting partners tracked Aims-linked bot activity across the internet. It was behind fake social media campaigns, mostly involving commercial disputes, in about 20 countries including the UK, US, Canada, Germany, Switzerland, Mexico, Senegal, India and the United Arab Emirates.

This week Meta, the owner of Facebook, took down Aims-linked bots on its platform after reporters shared a sample of the fake accounts with the company. On Tuesday, a Meta spokesperson connected the Aims bots to others that were linked in 2019 to another, now-defunct Israeli firm which it banned from the platform.

One of the Telegram accounts he claimed to penetrate belonged to a person in Indonesia, while the other two appeared to belong to Kenyans involved in the ongoing general election, and close to the then candidate William Ruto, who ended up winning the presidency.

Hanan then demonstrated how access to Telegram could be manipulated to sow mischief.

Hanan suggested to the undercover reporters that some of his hacking methods exploited vulnerabilities in the global signalling telecoms system, SS7, which for decades has been regarded by experts as a weak spot in the telecoms network.