What still counts as proof?
One state's mercenary-cyber sector sells tools that, separately and on the record, can enter your device unseen, read your encrypted messages, post as you, and edit the footage of where you were. Set those capabilities side by side and a single hard question comes into focus — one we pose carefully, and refuse to answer for you.
What this hub is about
This hub assembles something we have documented piece by piece: the capabilities, overwhelmingly sold by a single state's surveillance industry, to watch a person, impersonate them, and alter the record of what they did. Every page here stands on its own sourcing — Microsoft, Citizen Lab, Recorded Future, Bloomberg, corporate and court records. What the hub adds is the stack: once you line the proven capabilities up, a question appears that no single page forces on its own. We pose that question and hold a hard line at it. The strength of this collection is the opposite of a conspiracy theory — every brick is a receipt, and the conclusion stays a question.
The stack, each layer a self-contained, graded investigation:
- Get in — through an ad you never clicked. The Advertising Weapon — an Israeli firm turned the ordinary online-ad system into a zero-click delivery pipe for spyware across 120,000 sites and 75,000 apps.
- Read everything — and become you. Devil's Tongue — Candiru's malware reads your Signal messages and, by Microsoft's own finding, signs into your accounts to send messages as you.
- Alter the record itself. Toka — an Israeli firm that sells governments the ability to add, delete, or change what a security camera recorded.
- Shape what you believe. The Foreign Agent — a registered operation to manipulate what AI assistants and search results say, piped through a trusted US media network.
- Sit inside the watchmen. Unit 8200 — the military signals-intelligence unit whose alumni became the founding class of the American cybersecurity industry.
- …and inside the government. Paragon — a surveillance firm run by Unit 8200 veterans, now embedded in US immigration enforcement.
- The pipeline that moves it all. Barak, Carbyne & the Israeli Tech Pipeline — how the people and money flow between the military, the startups, and US infrastructure.
- The practice ground. The Palestine Laboratory — the pattern of tools field-tested on a captive population and sold to the world. Devil's Tongue is a case in point: about half its known victims were Palestinian, by Microsoft's count.
OPENThe event that would change a grade: any forensically confirmed case of account-takeover spyware used to fabricate evidence against a specific person. We grade that use SOME SMOKE — a documented risk, posed, with no confirmed instance.
OPENThe money: who pays for the ad buys, the contracts, and the rehabilitation of blacklisted vendors — and how US export-control enforcement responds when a sanctioned firm is recalled by the state that hosts it.
OPENThe domestic mirror: how the same capabilities, and the same Unit 8200 pipeline, land inside American policing and immigration enforcement — the overlap with The Surveillance State(s).
This is a living record, and our readers make it stronger. If there is a thread here you want us to chase, or you have documents or firsthand knowledge that would sharpen a claim, send it to us. We read every lead.
The chain, and the question it forces
For most of modern life, a message in your name, a login from your account, or footage from a camera functioned as proof. Each layer of this stack erodes one of those proofs, and each is separately documented. Put two of them together — the power to post as you and the power to edit the camera footage — and both halves of a fabricated case against a chosen person demonstrably exist in one state's surveillance industry: one tool to manufacture the digital trail, another to manufacture the visual one. So the question is not rhetorical and it is not paranoid: if an actor can enter your device unseen, impersonate you, read your encrypted messages, and alter the record of where you were and what you did — what still stops a manufactured, “undeniable” case against anyone they choose? On the documented record, the honest answer is uncomfortable: mostly just whether they decide to.
- Capability is not proof of use. Everything here is a documented capability. We have no publicly confirmed case of these tools being combined to frame a specific person, and we assert none. We pose the question the capabilities force; the verdict stays open.
- This is not a people, and it is not a cabal. The subjects are named companies, a named military unit, and their documented products — the same lens we would put on any state's surveillance complex. “They secretly control everything” is the antisemitic canard; it is false, and we reject it. The power of this hub is that every brick is a citation.
- Oversight is the real story. The danger is not a cinematic plot; it is that tools this powerful operate with this little accountability — sold by firms a key ally blacklisted and the host state brought back. The fix is scrutiny, not a scapegoat.
The capability stack
Each is a self-contained, graded investigation. Read any one on its own; read them together and the stack is the argument.
Unit 8200: the Israeli military-intelligence unit that became the founding class of the American cybersecurity industry
Unit 8200 is the Israeli counterpart to the NSA. It conducts SIGINT, offensive cyber (broadly credited alongside NSA with Stuxnet), and the AI targeting systems reported in Gaza. Its alumni founded Check Point, Palo Alto Networks (via CTO Nir Zuk), CyberArk, NSO Group, Waze, Wix, Viber, Imperva, Cybereason, and Wiz. Google acquired Wiz for $32 billion in 2025. Palo Alto Networks acquired CyberArk for $25 billion in the same year. The Wall Street Journal covered the pipeline approvingly in 2024. Drop Site News (Murtaza Hussain, August 2025) is the rigorous public accounting to date. A separate policy-layer thread names Emi Palmor (Meta Oversight Board) and Shira Anderson (Meta AI Policy, now OpenAI) as verifiable placements, with the causal-mechanism claim graded PURE SPECULATION.
The Advertising Weapon
The Foreign Agent
The Palestine Laboratory: field-tested on Gaza, sold to the world
In 'The Palestine Laboratory' (Verso, 2023), journalist Antony Loewenstein documents how Israel's defense industry uses the occupied territories as a proving ground for weapons and surveillance, markets the results as 'combat-proven,' and exports them worldwide, making Israel a top arms exporter relative to its size. Israeli journalists at +972 Magazine and Local Call reported the AI targeting systems 'Lavender' (which flagged up to 37,000 Palestinians as suspected militants) and 'Where's Daddy?' (which tracked flagged men to their homes), citing six Israeli intelligence officers; the IDF disputes the characterization. Amnesty International documented the 'Red Wolf' and 'Blue Wolf' facial-recognition systems gating Palestinian movement at checkpoints. Israel's own defense ministry announced ~$19.2B in 2025 arms exports (a fifth straight record), with optical surveillance jumping from ~6% to ~22% of exports. The tools reappear at home: Elbit Systems built CBP's Integrated Fixed Towers on the Arizona border; Palantir (which announced a 2024 Israel MoD partnership) holds major U.S. immigration-enforcement contracts; and a House-passed defense measure would deepen U.S.-Israel AI/cyber/biotech/data integration. An AP investigation found detainees forced ahead of troops as human shields; the 2009 Abu Kabir admission (organs harvested without consent in the 1990s) is documented, while the recent 'bodies returned with organs removed' claim is contested and attributed. We grade the documented systems, contracts, and reporting as FACT; attribute the deliberate-experimentation framing and the disputed casualty ratios; grade the combined organ item SOME SMOKE; and pose — as questions, not findings — whether U.S./media reluctance to name a genocide protects the pipeline and whether the technology is being turned on Americans. This is NOT a claim about Jewish people, and we do NOT adopt the 'CIA-directed network' conspiracy framing that circulates around this material.
Devil's Tongue
Companion to The Advertising Weapon, and a deliberate exercise in posing the scary question without asserting it. FACT (Microsoft MSTIC + Citizen Lab, July 2021): an Israel-based private-sector offensive actor codenamed SOURGUM — identified as the spyware firm Candiru — and its malware DevilsTongue were exposed; Microsoft found 100+ victims (politicians, human rights activists, journalists, academics, embassy workers, dissidents), delivered via Windows zero-days and single-use links on apps like WhatsApp. FACT: the malware exfiltrates files and pulls messages out of encrypted apps including Signal Desktop (leaked Candiru material analyzed by Recorded Future's Insikt Group, 2025). FACT (capability): Microsoft documented that DevilsTongue uses stolen credentials and cookies to sign directly into the victim's own accounts (Facebook, Twitter, Gmail, and others), read their data, and send messages as the victim. SOME SMOKE (posed, not asserted): a tool that can post as you could plant a message, post, or file that looks like yours — a fabricated record hard to disprove; that is the serious documented risk of account-takeover spyware, but there is no publicly confirmed case of DevilsTongue being used to frame a specific person, and we assert none. FACT: of the 100+ identified victims, approximately half were in the Palestinian Authority (Microsoft), grounding the 'field-tested on Palestinians' argument in Microsoft's own victim data — with Microsoft's caveat carried that a victim's location doesn't prove the customer. FACT: Candiru was placed on the US Commerce Entity List in 2021, and in October 2023 Bloomberg reported Israel pulled blacklisted NSO and Candiru back 'into the fold' to help track hostages and Hamas in Gaza. The centerpiece is the capability stack — get in unseen (ads + messaging), read everything, become you, alter the record (Toka), shape belief (Clock Tower X), sit inside the watchmen (Unit 8200, Paragon), practice on a captive population — and the question it forces: if an actor can enter your device unseen, impersonate you, read your encrypted messages, and alter the record of where you were, what stops a manufactured, 'undeniable' case against anyone they choose? Hard fences held throughout: capability is not proof of use; the subject is named companies and a named military unit, not a people, and the 'they control everything' cabal canard is named and rejected; the real story is thin oversight — a vendor sanctioned by one government and recalled by another within a few years.
Toka: the Israeli firm that sells governments the ability to alter camera footage, and the American venture capital that funds it
Where Pegasus reads phones, Toka rewrites the visual record. Its internal pitch materials, reviewed by Haaretz in December 2022, carry the header 'Discover, Hack, Alter' and describe alteration capabilities that leave no forensic trace on the target device. Known customer states include Israel, the US, Germany, Australia, and Singapore. Marc Andreessen, whose firm led Toka's seed round, sits on Meta's board while Meta subsidiary WhatsApp is litigating against NSO Group. TechCrunch confirmed in December 2024 that Toka is actively pursuing US federal contracts. In February 2026, Haaretz reported Toka developed CARINT, a vehicle-hacking product with mic activation and dashcam access; Toka states the tool has been dropped from its plans for 2026.
Paragon Solutions: Ehud Barak's third surveillance venture, run by a former Unit 8200 commander, now inside US immigration enforcement
Paragon Solutions is an Israeli spyware firm founded in 2019 by former Unit 8200 commander Ehud Schneorson, CEO Idan Nurick, Igor Bogudlov, Liad Avraham, and former PM Ehud Barak (board). Its product Graphite is built to access encrypted messaging apps (WhatsApp, Signal, Messenger) rather than take over a whole phone. Battery Ventures invested $5-10M in 2021; the FT reported Paragon declined an Israeli request to swap Graphite into the Saudi armoury after Pegasus hit Khashoggi's associates. Biden's EO 14093 (2023) was read as carving out room for vendors like Paragon before the government purchase was banned; the second Trump administration reversed the pause and ICE now uses Graphite (acting director Todd Lyons confirmed to Congress in April 2026). In December 2024, US PE firm AE Industrial Partners acquired Paragon (via RED Lattice) for up to $900M. In January 2025, WhatsApp disclosed a Paragon campaign against ~90 journalists and civil-society figures; Citizen Lab forensically confirmed Graphite infections and suspected deployments in Australia, Canada, Cyprus, Denmark, Israel, and Singapore. An Italian parliamentary committee (COPASIR) confirmed the Italian government used Graphite against activists Luca Casarini, Giuseppe Caccia, and David Yambio while denying it hacked journalist Francesco Cancellato; Paragon says it cut ties with Italy in Feb 2025. Who ordered the Cancellato/Pellegrino journalist targeting is graded SOME SMOKE. The Unit 8200 command lineage is why this sits on the surveillance hub alongside Toka and Carbyne.
Barak, Carbyne & The Israeli Tech Pipeline
Ehud Barak's post-2015 correspondence with Epstein's staff. Carbyne (formerly Reporty), the 911-dispatch surveillance company Epstein backed and Barak chaired, whose original 2018 outside investor was Peter Thiel's Founders Fund (Andreessen Horowitz came later, in 2021-2022 rounds). The broader Israeli surveillance-tech pipeline running through Epstein's orbit.
Questions worth taking seriously
Isn't stacking these capabilities just a conspiracy theory?
It's the opposite, by construction. A conspiracy theory asserts a hidden plot and bends facts to fit it. We do the reverse: every capability here is separately documented by Microsoft, Citizen Lab, Recorded Future, Bloomberg, or the public record, and we refuse to claim the one thing that isn't proven — that these tools have been combined to frame a specific person. We pose that as the question the capabilities force, and we name and reject the “they control everything” canard explicitly. The discipline is the credibility.
Why is this focused on Israeli firms? Isn't that singling out one country?
Because that's where the documented trail leads for this particular cluster of tools — Candiru, NSO, Toka, the Unit 8200 pipeline — not because of who anyone is. We apply the same lens to any state's surveillance complex; our Surveillance State(s) hub covers American tools like Flock and Axon in exactly this way. The subject is named companies and a named military unit and their products. The moment an argument shifts from “these firms sell these tools” to “this people controls the world,” it has become the antisemitic cabal canard, which is false and which we refuse.
Has anyone actually been framed using these tools?
There is no publicly confirmed case, and we don't claim one. What's documented is the capability — Microsoft found Devil's Tongue can sign into victims' accounts and post as them; Toka sells footage alteration. Fabricating evidence is the recognized danger those capabilities create, which is why account-takeover spyware is treated as categorically worse than passive surveillance. But “could” is not “did.” We grade the capabilities FACT and the framing use SOME SMOKE, posed as a risk. If a confirmed case surfaces, the grade changes; until then, we hold the line.
If you are named on this page
If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.
This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.