How Israel is using technology to guard its election

(Oct. 27, 2026 / JNS)

A week before Israel’s Oct. 27 election, the Shin Bet (Israeli Security Agency) announced that accounts used in a “foreign influence campaign” had been removed from social media in a joint effort with the State Attorney’s Office Cyber Department and the Central Elections Committee (CEC).

The agency did not identify the foreign actors responsible, the platforms involved or the technologies used to detect the accounts. However, it was reported soon afterward that other suspected foreign-linked accounts remain active.

On Tuesday, Israelis will vote using paper ballots. But the electoral process relies on digital systems, and voters naturally absorb political information online.

As the country heads to the polls for the first time since the Hamas-led terrorist attacks in southern Israel on Oct. 7, 2023, government cybersecurity teams, technology platforms and independent researchers are monitoring threats, investigating suspicious networks and responding to attempts to disrupt or manipulate the electoral process.

Election Shield: Protecting the infrastructure

In October, the Israel National Cyber Directorate (INCD) and the CEC announced “Election Shield.” According to the official announcement, the two bodies prepared for about three months and conducted an exercise simulating cyberattacks.

A dedicated Cyber Situation Center will operate on Election Day to consolidate threat information, identify suspicious activity and coordinate responses to incidents. The scenarios include intrusions, website disruptions, impersonation of public institutions, phishing, account takeovers and false claims that election systems were breached.

In addition, the CEC and Survey of Israel have developed a GovMap-based system to display aggregate election turnout rates geographically, including at individual polling stations, with interactive mapping of results expected after voting concludes.

New findings from Israeli cybersecurity company Check Point already illustrate the threat environment these preparations are designed to address.

According to Israeli media reports, in early October Israeli government organizations experienced an average of approximately 2,300 cyberattacks per organization each week, an 82% increase over the comparable period last year.

Check Point also identified 87 verified cyberattacks against Israeli targets since early October, primarily website disruptions and defacements.

These figures concern cyber activity against Israeli targets generally, not confirmed compromises of election systems.

“Voting in Israel is conducted using paper ballots, but behind the electoral process lies an extensive digital infrastructure that must be protected against cyber threats,” INCD Director General Yossi Karadi said in an official statement.

The Directorate declined, however, to identify specific defensive technologies.

“For security reasons, we do not disclose details about the specific technologies, tools, or methods used to protect election-related systems,” Libi Oz told JNS on behalf of the Directorate.

Following the digital footprints

Beyond official election infrastructure, Israeli researchers are using technology to identify attempts to manipulate political discourse online.

An Oct. 22 report published by the Institute for National Security Studies (INSS), in collaboration with Israeli watchdog FakeReporter, examined foreign influence operations ahead of the election. Using collection tools from Israeli company Xpoz, researchers tracked an Islamist influence network known as “Isnad” on X. Xpoz provides structured access to social media data across platforms including X, Instagram, Reddit and TikTok. Its documented contribution to the INSS investigation was data collection.

The report describes Isnad as a volunteer-based group identified with the Muslim Brotherhood and led by an Egyptian opposition activist operating from Turkey. While no state involvement is known, its messaging attempted to undermine trust in institutions and the credibility of the election.

INSS also cites research by the firm Golden Owl, which identified about 150 Hebrew-writing personas on X tied to Iran through location data or use of the Iranian version of the app.

Israeli cybersecurity company ClearSky also released an October report outlining a Russian influence campaign in Israel. The campaign, known as “The Double” or Doppelgänger, “spreads false and misleading messages built on parts of real publications, while impersonating well-known media outlets,” according to its executive summary.

Accounts checked by INSS had been suspended as of Oct. 19, but the think tank was blunt about the limitations. Most content reaches audiences only when real Israelis share it, usually unaware of its origin. The apparent aim is to erode trust rather than sway votes, and the immediate threat from Isnad appears limited, with no evidence that voters have changed their views as a result.

From detection to intervention

It is one thing to detect malicious activity, but without a way to act, meaningful intervention may be limited.

Earlier in October, the CEC announced enhanced cooperation with Meta, Google, TikTok and Microsoft following a meeting hosted by President Isaac Herzog at the President’s Residence. The agreement includes improved reporting channels and prioritized consideration of election-related requests. Since the CEC has no general authority to remove online content, it must refer relevant concerns to the platforms, which apply their own rules.

Their contributions vary. Google requires Israeli election advertisers to verify their identities and identify who pays for their advertisements, with spending information available through its political advertising transparency system. It will also help voters locate polling stations on Election Day.

Meta, which owns Facebook, Instagram and WhatsApp, operates systems to detect coordinated inauthentic behavior and says dedicated security teams are prepared to respond to election-related threats.

Microsoft has confirmed its participation in the coordination effort through “a professional dialogue” with the CEC but has not publicly identified specific technologies deployed for Israel’s election.

TikTok has published more detailed figures about its election-related enforcement in Israel. Its transparency report shows that it removed more than 45,000 videos between June 7 and Sept. 5 under its election integrity, misinformation and misleading AI content rules, as well as 1,431 accounts impersonating candidates or officials.

It also introduced an in-app “Election Center,” providing authoritative voting information and tips for identifying misinformation.

The test ahead

Detection tools can show behavior. They do not necessarily show intent, however explicit it may appear, and certainly not persuasion.

Coordinated activity can be human, automated, domestic or foreign. Israel introduced a disclosure requirement for election campaigning featuring digitally created or altered people, events or documents.

But those seeking to cause disruption can exploit existing divisions or spread misleading narratives without creating deepfakes. Such labels would also do nothing about authentic content amplified by fake accounts, or satire that may look like manipulation to an algorithm. Authorities and private platforms must therefore strike a careful balance between protecting election integrity and preserving freedom of expression.