As the man calling himself “Jorge” shook hands with two prospective clients, he joked: “You saw what it says on the door, right? It says nothing. That’s who we are. We are nothing.”
He was smartly dressed with an expensive watch, flashier than the consultants – who were in fact undercover reporters – had expected. It was late December and despite several online meetings, this was the first time the consultants had seen the man they had been communicating with. He had kept his camera off in each of the five previous video calls.
And now a warm, disarming greeting, but still no name.
Flanked by two of his colleagues, Jorge launched into a demonstration on a wall-hung screen. It was similar to the ones the consultants had been shown in the Zoom meetings: a presentation of how, so Jorge boasted, he had manipulated more than two dozen elections around the world through hacking, the spread of disinformation and subterfuge.
What Jorge and his team did not know, as he bragged about how he could get into a target’s Gmail account undetected, was that his demonstration was being secretly filmed by undercover reporters.
Three journalists – Gur Megiddo of TheMarker, Frédéric Métézeau of Radio France, and Omer Benjakob of Haaretz – had been on the tails of Jorge for more than six months, posing as consultants working on behalf of a businessman who wanted to delay an election in a large and unstable country in Africa.
It was an elaborate undercover operation intended to shed light on disinformation providers, a growing industry that operates in the shadows.
Megiddo, an investigative reporter, had been told by his source about a shady company in Modi’in, Israel, that worked on disinformation in elections. He did not know the name, and said the whole operation, including the individuals involved, guarded their anonymity.
But while Jorge had been operating under the radar for more than two decades, using multiple email accounts and a phone registered in Indonesia for calls with prospective clients, the man behind the pseudonym was Tal Hanan, a seemingly ordinary businessman in his 50s, with LinkedIn accounts, who was an expert on security and explosives and had even been quoted in the Washington Post in 2006.
For all his boasts about his skills at deception and secrecy, however, Jorge did not suspect an undercover trap. And as he had rattled through presentations he had left a trail that provided clues to his true identity.
In earlier meetings recorded by the reporters, Jorge had referred to a former US assistant secretary of state for western hemisphere affairs named Roger Noriega, who served under George W Bush and is known as a hardline conservative.
A biography of Hanan had appeared on Visión Américas, Noriega’s Washington DC consulting firm, which also listed him as an associate.
When contacted by the Guardian, Noriega declined to comment on the identity of Jorge. “I haven’t worked for or done any work on behalf of any political campaign (foreign or otherwise) with Tal Hanan or anyone else,” he said. There is no suggestion Noriega had any knowledge of or involvement in Hanan’s disinformation and hacking operation.
Hanan’s biography on Noriega’s company website named him as chief executive of Demoman, an Israel-based company that claimed to have trained US and European security and intelligence agencies and briefed members of the US House of Representatives in improvised explosive devices and urban warfare.
A LinkedIn account for Hanan referenced a company, Sol Energy, in Kensington, Maryland, so when the undercover reporters spotted its logo on a whiteboard in the nondescript office in December they had a moment of excitement.
It felt as if the search was closing in. But back in December, as the undercover reporters left the Modi’in office, they still had not definitely cracked the single most important question: who was Jorge? They now had a face and lots of clues, including an anonymous source that linked Jorge, the man they had met in the office, to Tal Hanan. But, frustratingly, it was not enough to conclusively unmask the fast-talking man full of bravado.
The idea that Hanan would answer the question himself seemed extremely unlikely. (Later, when asked for comment, Hanan did not respond to detailed questions, but said simply: “I deny any wrongdoing.”)
The final clue came from a claim by Jorge, thrown in at the end of the meeting with the undercover reporters. In a throwaway boast, Hanan had claimed a past link to the notorious but now defunct consultancy Cambridge Analytica.
The brag was to finally unstick the mystery. Buried in leaked Cambridge Analytica emails was a question. It turned out reporters were not the only ones who had sought answers about the mysterious Israeli. Alexander Nix, the chief executive of Cambridge Analytica, had asked a colleague: “What is Jorge’s (from Israel black ops co) surname please and also the name of his company.”
His colleague responded a day later: “Tal Hanan is CEO of Demoman International.”