Israeli Military Monitors Social Media, Blogs and Forums in Search of 'Security Leaks'

HAARETZ – The Israel Defense Forces’ information-security department has for two years now been monitoring a long list of social media and other sites, according to a document obtained by Haaretz.

The list includes social media posts, blogs, articles and forums involving public figures, social affairs groups, companies that supply cloud services, and the websites of soccer fans and satirists.

In late 2015, a Defense Ministry website posted that the IDF’s information-security department was inviting bids to supply internet monitoring services. According to the document, the services would “locate leaks of security information on news sites, social media and forums in the public domain.”

The document includes a “list of sources to be monitored” including about 100 sites that don’t seem to have a direct security context. One site is the website of MK Shelly Yacimovich (Zionist Union), chairwoman of the Knesset State Control Committee, which deals with security issues. Yacimovich also uses the site to discuss various issues with the public and posts information about her political activities in the Knesset.

Other sites appear to have less of a security context. These include Black Labor, which promotes a social-democratic welfare state; Rabbis for Human Rights; Cloud 24/7, a Microsoft-authorized company that provides cloud computing services; a site that posts death notices; and Port2Port, a website aimed at businesses that ship by sea or air.

The list also includes most Israeli news sites, the women’s website Salona run by journalist Shira Margalit, the blog Velvet Underground by journalist Dvorit Shargal, and even websites for sports fans, tourism and finance like the tax-news site Portal-Misim.

The army confirmed that after publication of the document in late 2015, it was decided to publish the invitation of bids, and in 2016 an outside company began the surveillance work for the IDF.

The winning bidder would be under contract for three years. The supplier must be able to carry out, in “near real time,” “independent monitoring and oversight … for the purpose of identifying market trends and analyzing influential factors.”

The supplier would have to be able to monitor relevant information from a variety of genres – blogs, articles, forums and social media in Hebrew, Arabic and English.

The supplier would also have to provide all relevant information starting in 2014, according to the time frame specified in the search – whether the past 24 hours, the past week, the past three weeks, the past month, the past three months, the past six months and the past year, or on a specific date or within a range of dates.

The results would be exported to files containing the date, user’s name (if it exists), website name, link to the post, text and link to the section on the website containing the information. The findings would be presented in percentages and quantities over the time frame.

The information would have to be sorted using various parameters; for example, from newest to oldest and vice versa, relevance, subject, number of responses, number of participants in a discussion, and number of likes and shares. The system would be required to produce graphic displays of the findings.

The IDF’s information-security department also required the system to be able to save the results on either a local computer or in a file in the monitoring system. The information unearthed by the system would be made available only to selected subscribers.

The IDF responded: “The IDF information security department continuously monitors the open internet to fulfill its purpose of preventing leaks of classified material. The list of sites is general and standard, and is updated from time to time as needed as per recommendations of sites where security issues are discussed.”

According to the IDF, “Specific individuals are not monitored, but rather key words that could indicate that classified materials are on the internet.”

It added that “the document in question is from 2015. After a number of changes a tender was issued that led to a contract with one of the companies in this area, which provides this service to the IDF.”