As the man calling himself “Jorge” shook hands with two prospective clients, he joked: “You saw what it says on the door, right? It says nothing. That’s who we are. We are nothing.”
He was smartly dressed with an expensive watch, flashier than the consultants – who were in fact undercover reporters – had expected. It was late December and despite several online meetings, this was the first time the consultants had seen the man they had been communicating with. He had kept his camera off in each of the five previous video calls.
And now a warm, disarming greeting, but still no name.
Flanked by two of his colleagues, Jorge launched into a demonstration on a wall-hung screen. It was similar to the ones the consultants had been shown in the Zoom meetings: a presentation of how, so Jorge boasted, he had manipulated more than two dozen elections around the world through hacking, the spread of disinformation and subterfuge.
What Jorge and his team did not know, as he bragged about how he could get into a target’s Gmail account undetected, was that his demonstration was being secretly filmed by undercover reporters.
Three journalists – Gur Megiddo of TheMarker, Frédéric Métézeau of Radio France, and Omer Benjakob of Haaretz – had been on the tails of Jorge for more than six months, posing as consultants working on behalf of a businessman who wanted to delay an election in a large and unstable country in Africa.
It was an elaborate undercover operation intended to shed light on disinformation providers, a growing industry that operates in the shadows.
The Guardian and Observer have partnered with an international consortium of reporters to investigate global disinformation. Our project, Disinfo black ops, is exposing how false information is deliberately spread by powerful states and private operatives who sell their covert services to political campaigns, companies and wealthy individuals. It also reveals how inconvenient truths can be erased from the internet by those who are rich enough to pay. The investigation is part of Story killers, a collaboration led by Forbidden Stories, a French nonprofit whose mission is to pursue the work of assassinated, threatened or jailed reporters.
The eight-month investigation was inspired by the work of Gauri Lankesh, a 55-year-old journalist who was shot dead outside her Bengaluru home in 2017. Hours before she was murdered, Lankesh had been putting the finishing touches on an article called In the Age of False News, which examined how so-called lie factories online were spreading disinformation in India. In the final line of the article, which was published after her death, Lankesh wrote: “I want to salute all those who expose fake news. I wish there were more of them.”
The Story killers consortium includes more than 100 journalists from 30 media outlets including Haaretz, Le Monde, Radio France, Der Spiegel, Paper Trail Media, Die Zeit, TheMarker and the OCCRP. Read more about this project.
Investigative journalism like this is vital for our democracy. Please consider supporting it today.
Megiddo, an investigative reporter, had been told by his source about a shady company in Modi’in, Israel, that worked on disinformation in elections. He did not know the name, and said the whole operation, including the individuals involved, guarded their anonymity.
But while Jorge had been operating under the radar for more than two decades, using multiple email accounts and a phone registered in Indonesia for calls with prospective clients, the man behind the pseudonym was Tal Hanan, a seemingly ordinary businessman in his 50s, with LinkedIn accounts, who was an expert on security and explosives and had even been quoted in the Washington Post in 2006.
For all his boasts about his skills at deception and secrecy, however, Jorge did not suspect an undercover trap. And as he had rattled through presentations he had left a trail that provided clues to his true identity.
In earlier meetings recorded by the reporters, Jorge had referred to a former US assistant secretary of state for western hemisphere affairs named Roger Noriega, who served under George W Bush and is known as a hardline conservative.
A biography of Hanan had appeared on Visión Américas, Noriega’s Washington DC consulting firm, which also listed him as an associate.
When contacted by the Guardian, Noriega declined to comment on the identity of Jorge. “I haven’t worked for or done any work on behalf of any political campaign (foreign or otherwise) with Tal Hanan or anyone else,” he said. There is no suggestion Noriega had any knowledge of or involvement in Hanan’s disinformation and hacking operation.
Hanan’s biography on Noriega’s company website named him as chief executive of Demoman, an Israel-based company that claimed to have trained US and European security and intelligence agencies and briefed members of the US House of Representatives in improvised explosive devices and urban warfare.
A LinkedIn account for Hanan referenced a company, Sol Energy, in Kensington, Maryland, so when the undercover reporters spotted its logo on a whiteboard in the nondescript office in December they had a moment of excitement.
What is this undercover footage?
Disinformation operatives work under the radar. To find out more about 'Team Jorge', an Israel-based unit selling hacking and social media manipulation services, three journalists went undercover. They posed as consultants, working on behalf of a client in a politically unstable African country who wanted to delay a forthcoming election. The reporters secretly filmed several meetings with the group's leader, Tal Hanan, who uses the alias 'Jorge', and his associates between July 2022 and December 2022.
Who is in the footage?
The footage captures Hanan, as well as his brother, Zohar Hanan, and other associates of Team Jorge. Faces of reporters have been blurred. The meetings took place on video calls, when Hanan and his colleagues gave slideshow demonstrations of their services, and in person, at Team Jorge's office in an industrial park 20 miles outside Tel Aviv.
Who did the secret filming?
It was secretly filmed by three reporters from media outlets working in a consortium investigating disinformation: Gur Megiddo (TheMarker), Frédéric Métézeau (Radio France) and Omer Benjakob (Haaretz). The video was then shared with more than 25 other media outlets in the consortium, including the Guardian and Observer. While the Guardian and Observer were not involved in the undercover filming, they are publishing the material because of the strong public interest justifications for doing so.
What is Team Jorge's response?
Tal Hanan did not provide a detailed response to questions from the Guardian. He said: 'To be clear, I do deny any wrongdoing.'
It felt as if the search was closing in. But back in December, as the undercover reporters left the Modi’in office, they still had not definitely cracked the single most important question: who was Jorge? They now had a face and lots of clues, including an anonymous source that linked Jorge, the man they had met in the office, to Tal Hanan. But, frustratingly, it was not enough to conclusively unmask the fast-talking man full of bravado.
The idea that Hanan would answer the question himself seemed extremely unlikely. (Later, when asked for comment, Hanan did not respond to detailed questions, but said simply: “I deny any wrongdoing.”)
The final clue came from a claim by Jorge, thrown in at the end of the meeting with the undercover reporters. In a throwaway boast, Hanan had claimed a past link to the notorious but now defunct consultancy Cambridge Analytica.
The brag was to finally unstick the mystery. Buried in leaked Cambridge Analytica emails was a question. It turned out reporters were not the only ones who had sought answers about the mysterious Israeli. Alexander Nix, the chief executive of Cambridge Analytica, had asked a colleague: “What is Jorge’s (from Israel black ops co) surname please and also the name of his company.”
His colleague responded a day later: “Tal Hanan is CEO of Demoman International.”
