Just days before Israel’s election, the Israel Security Agency (Shin Bet) announced that, in a joint operation with the State Attorney’s Cyber Department and the Central Elections Committee, it had identified and taken down social media accounts used for foreign influence operations. Among them were two prominent X (formerly Twitter) accounts involved in the operations: Miriam Kozak, an Iranian profile with roughly 20,000 followers, and Ezzeldeen Devidar, an operator of the "Isnad" campaign attributed to the Muslim Brotherhood. This is an important step in safeguarding election integrity and public discourse against foreign interference attempts. But international experience shows that taking down accounts is not necessarily the end of the story.
For example, in the first half of 2026, Meta removed an Iranian influence network operating on Facebook and Instagram targeting audiences in the United States and Iraq. The network’s operators tried to rebuild the compromised infrastructure, this time using a different approach: instead of investing in developing detailed, credible fake personas, they switched to quickly creating a large number of accounts. Meta identified and removed those accounts as well.
In another case, ahead of the 2024 U.S. presidential election, authorities seized more than 30 domains used by the Russian influence campaign Doppelganger. Within 24 hours, approximately 12 new or restored websites were set up to replace the infrastructure that had been disrupted. A study by DFRLab found that content distribution continued at roughly the same pace as before the enforcement action.
In both cases, the operators showed that they could adapt to disruption efforts, restore compromised infrastructure, and even alter their operational patterns.
What Does This Mean for Israel?
A study by the Institute for National Security Studies (INSS) identified influence activity originating from Iran, the Isnad network, and the Russian influence operation Doppelganger. Such activity exploits election periods to deepen societal rifts and erode public trust in state institutions and the democratic process. Therefore, attempts to resume disrupted activity through alternative accounts, altered personas, or shifts to other distribution channels cannot be ruled out. However, in the absence of publicly available information about the operators of the accounts removed in Israel, it is impossible to attribute them to a specific foreign actor or to determine whether a direct Iranian response is expected.
The main challenge now is to ensure that the removal of accounts is not merely a one-off action, but part of a sustained effort to protect Israel's information space. Such an effort should rest on three complementary elements: continuous monitoring and early detection of suspicious networks and accounts; deepening cooperation among state bodies, platforms, and civil society organizations engaged in monitoring and research; and strengthening digital literacy and public awareness.
Removing these accounts is an important achievement, but protecting the democratic information space requires sustained effort, rapid detection of renewed activity, collaboration, and critical consumption of information.
Just days before Israel’s election, the Israel Security Agency (Shin Bet) announced that, in a joint operation with the State Attorney’s Cyber Department and the Central Elections Committee, it had identified and taken down social media accounts used for foreign influence operations. Among them were two prominent X (formerly Twitter) accounts involved in the operations: Miriam Kozak, an Iranian profile with roughly 20,000 followers, and Ezzeldeen Devidar, an operator of the "Isnad" campaign attributed to the Muslim Brotherhood. This is an important step in safeguarding election integrity and public discourse against foreign interference attempts. But international experience shows that taking down accounts is not necessarily the end of the story.
For example, in the first half of 2026, Meta removed an Iranian influence network operating on Facebook and Instagram targeting audiences in the United States and Iraq. The network’s operators tried to rebuild the compromised infrastructure, this time using a different approach: instead of investing in developing detailed, credible fake personas, they switched to quickly creating a large number of accounts. Meta identified and removed those accounts as well.
In another case, ahead of the 2024 U.S. presidential election, authorities seized more than 30 domains used by the Russian influence campaign Doppelganger. Within 24 hours, approximately 12 new or restored websites were set up to replace the infrastructure that had been disrupted. A study by DFRLab found that content distribution continued at roughly the same pace as before the enforcement action.
In both cases, the operators showed that they could adapt to disruption efforts, restore compromised infrastructure, and even alter their operational patterns.
What Does This Mean for Israel?
A study by the Institute for National Security Studies (INSS) identified influence activity originating from Iran, the Isnad network, and the Russian influence operation Doppelganger. Such activity exploits election periods to deepen societal rifts and erode public trust in state institutions and the democratic process. Therefore, attempts to resume disrupted activity through alternative accounts, altered personas, or shifts to other distribution channels cannot be ruled out. However, in the absence of publicly available information about the operators of the accounts removed in Israel, it is impossible to attribute them to a specific foreign actor or to determine whether a direct Iranian response is expected.
The main challenge now is to ensure that the removal of accounts is not merely a one-off action, but part of a sustained effort to protect Israel's information space. Such an effort should rest on three complementary elements: continuous monitoring and early detection of suspicious networks and accounts; deepening cooperation among state bodies, platforms, and civil society organizations engaged in monitoring and research; and strengthening digital literacy and public awareness.
Removing these accounts is an important achievement, but protecting the democratic information space requires sustained effort, rapid detection of renewed activity, collaboration, and critical consumption of information.