How Israeli hackers hit William Ruto's campaign team

Israeli hackers accessed emails and private chats of two of President William Ruto's aides before and after last August's General Election, an investigation has shown.

The investigation, which involved more than 100 journalists from 30 media organisations, showed a hacker accessing Gmail and Telegram accounts belonging to Energy Cabinet Secretary Davis Chirchir and key Ruto strategist Dennis Itumbi.

The hacker in question has been identified as Tal Hanan, a 50-year-old former Israeli special forces operative who now works privately using the pseudonym 'Jorge' and leads a group of contractors.

Reports by media organisations involved in the investigation reveal that Hanan offered three undercover journalists a demo as he hacked into the Telegram accounts of Chirchir and Itumbi in July 2022, reading their personal chats and files, including a polling survey related to the presidential election.

The Israeli national also demonstrated his ability to pose as Itumbi, sending texts to unsuspecting targets as part of an intelligence-gathering and disinformation campaign against Ruto's campaign team.

In one of the demos, he sent a text to one of Itumbi's contacts that read '11'. The recipient of the said text was tracked by the journalists, confirming he had seen it.

"I know in some countries they believe Telegram is safe. I will show you how safe it is," The Guardian quotes him as saying.

In other instances, Hanan deleted texts he had sent to Itumbi's contacts.

Itumbi was Ruto's digital strategist, with Chirchir serving as the chief of staff in the deputy president's office.

The investigative journalists verified five email and Telegram accounts belonging to Kenyan targets who worked in Ruto's campaign team.

Hanan made the demonstration to journalists claiming to be intermediaries seeking the delay of Chad's presidential election, which had been scheduled for last year.

The three undercover journalists were from TheMarker, Radio France and Haaretz. They were part of a collaborative investigation called Story Killers, which was coordinated by Forbidden Stories.

Forbidden Stories is an international consortium of investigative journalists that pursue the work of journalists who have been killed or work under threat.

Hanan told the journalists that the going rate for his services in a presidential campaign was 15 million euros (more than Sh2 billion).

He said that he was working on an African election, showing evidence that it was the Kenyan presidential election, which Ruto won against his main rival Raila Odinga.

It was, however, unclear to the journalists who hired Hanan and Team Jorge, as his team of contractors, who also include his brother Zohar Hanan, is known.

Raila recently said that he had enlisted the services of foreign 'ethical hackers' to uncover 'the truth' of the 2022 presidential election.

"There are those who hack for the purpose of stealing and others do so to uncover the truth ... they (hackers) found out the truth, which we withheld," Raila said on Ramogi TV on Monday, adding that the hackers' alleged finding and the alleged whistleblower account, found him in an official trip to South Africa.

"I told our people that I would speak once I returned (to Kenya), he said in Luo.

In a demonstration on August 9 of Itumbi's Telegram, the Israeli national revealed to the undercover journalists a link to an internal website of the United Democratic Alliance used to monitor the results of the presidential elections.

"They have their own system," Israeli publisher Hareetz reports Hanan as saying. "We found their own internal website. They have created their own platform ... That's the level of 'live intelligence' you can get, and this is just an example."

He would also claim that his hacking had established that Ruto had a source in Raila's camp, which he said was within State House, who shared intel with Ruto's campaign team.

Hanan told the journalists that he was pleased with his group's work in Kenya. Undercover footage shows Hanan claiming to have manipulated more than 30 elections around the world using hacking, sabotage and automated disinformation on social media.

Two-thirds of the presidential campaigns the Israeli team has interfered with are reportedly in Africa, with the hackers also manipulating campaigns in Europe, Latin America, Southeast Asia and the Caribbean.

"We like to be behind the scenes, and this is part of our power-that the other side does not understand we exist," the Organized Crime and Corruption Reporting Project quotes Hanan as saying.

He said that his services were available to intelligence agencies, political campaigns and private companies that wanted to manipulate public opinion.

Among the tools Team Jorge deploys is a software package, Advanced Impact Media Solutions, which controls thousands of fake social media profiles.

The investigation also showed that Hanan had previously worked alongside British consultancy firm Cambridge Analytica on the Nigerian presidential election of 2015. Cambridge Analytica had a significant part in former President Uhuru Kenyatta's campaigns in 2013 and 2017. Hanan's pitch to work for the British firm in 2017 in Kenya was rejected.

Hanan and his brother, Zohar, denied any wrongdoing.

"I have been working all my life according to the law!" The Guardian quotes Zohar as saying.

Hacking, as well as disinformation, are some of the dirty tricks that have been used in Kenyan politics.

Reports published by Mozilla Foundation and Code for Africa, among others, highlight coordinated disinformation campaigns during the election period in Kenya.

Especially on Twitter, influencers act like guns for hire for politicians to create and spread disinformation to discredit opponents or attack their credibility. In a number of instances, disinformation actors have manipulated the front pages of daily newspapers to target audiences with false information.

An investigation by journalist and data scientist Odanga Madung' into a wave of Twitter attacks on judges involved in the Building Bridges Initiative (BBI) case found that they were the target of a coordinated campaign to discredit them.

The investigation found that the Twitter campaigns were being used to inauthentically promote the BBI to citizens and attack prominent civil society activists who voiced their opposition to it.

"Furthermore, they sought to discredit CSOs and activists, portraying them as villains who were being funded by Kenya's Deputy President William Ruto. Ruto is known to oppose the BBI process," Madung and Brian Obilo say in their report looking at disinformation attacks in Kenya.

A similar campaign took place around the election period in Kenya, with political players sponsoring hashtags to amplify their messaging and attack their opponents.