Mapping Qatar's Multi-Vector Influence Operation Through the Triangle of Perception
Interactive influence network. Drag nodes, hover for details, click to highlight connections.
Two parallel funding tracks routing Qatari money to Israeli operatives.
An analytical framework mapping three functionally distinct layers of the information environment
Eli Feldstein, PM spokesperson receiving approximately 40,000 shekels per month through the Qatar-to-Third Circle-to-Gil Birger company pipeline, occupied the apex of state communications. His position granted direct access to classified intelligence materials and control over the flow of information from the Prime Minister's office to the press.
Feldstein orchestrated the theft of a classified Hamas strategy document, routing it to Bild in Germany to circumvent the Israeli military censor. The document was published on September 6, 2024 with critical distortions that served Qatari diplomatic interests, reframing Hamas negotiating positions in ways favorable to Qatar's mediator narrative.
Germany appears as a common laundering jurisdiction across multiple pillars of the operation. The Bild leak exploited German press freedom to bypass Israeli censorship, while Wikipedia sockpuppet accounts used German residential proxy IPs. This pattern suggests deliberate jurisdictional selection.
Both Yonatan Urich and Eli Feldstein were detained for questioning in March 2025, suspected of contact with a foreign agent, fraud, money laundering, and bribery. The Shin Bet and Israel Police conducted coordinated arrests following months of surveillance.
Investigation of the official pro-Netanyahu loyalist Facebook group using Hebrew keyword searches revealed systematic amplification of Qatar-favorable narratives. The group's organic engagement patterns showed no awareness that content was planted by a foreign influence operation.
A complete trace was established showing how the planted narrative traveled from its origin in the PM's office through German media and into loyalist Facebook communities, demonstrating cross-pillar amplification from Traditional Media into Platforms.
ActiveInfo researchers identified approximately 20 Twitter accounts and 2 websites operating as part of Project Lighthouse, the international track of the influence operation. These accounts engaged in coordinated amplification of pro-Qatar messaging targeting international audiences.
Phase 1 (September 2024): initial amplification of planted narratives. By Phase 4 (October 2025), the same narratives had become "received wisdom" with zero attribution to Qatar, demonstrating complete narrative laundering through organic community adoption.
Wikipedia's Sockpuppet Investigation identified 19 compromised dormant accounts using German residential proxies from the 2a01:4c8 IP range. These accounts were used for coordinated editing of articles related to Qatar, Hamas, and Israeli politics.
The Wikipedia account Iamjosemom, identified as a TronFactor sockpuppet, created the article "Qatar role in Israel-Hamas war" in a single edit. This article was crafted to reshape the encyclopedic record of Qatar's involvement in the conflict.
A separate parallel operation involving 26 accounts engaged in defensive editing, systematically scrubbing criticism of Qatar from Wikipedia articles. This network operated independently from TronFactor but pursued complementary objectives.
German IPs from the 2a01:4c8 range edited Wikipedia articles, creating a cross-pillar pattern connecting database manipulation (Pillar 1) to the same German infrastructure used for the Bild document leak (Pillar 3).
Feldstein exploited the institutional credibility of his position as Prime Minister's spokesperson to operate as a conduit for Qatari interests within Israel's media ecosystem. The journalists who received information from Feldstein had no knowledge of the Qatari funding pipeline that sustained his dual role. They engaged with him as they would any senior government source, granting his planted narratives the full weight of official attribution.
The Bild leak mechanism revealed a sophisticated understanding of international media jurisdictions. By routing a classified Israeli document through a German newspaper, the operation exploited the gap between Israel's military censorship regime and Germany's press freedom protections. The distortions introduced into the document before publication served specific Qatari diplomatic objectives during a critical phase of hostage negotiations.
The credibility layer functions as the operation's primary legitimacy engine. Content that passes through traditional media acquires the presumption of editorial verification, making it exponentially harder to challenge downstream. Every subsequent citation, social media share, and database entry that references the original reporting inherits this presumed credibility.
Open-source intelligence analysis of Facebook communities revealed a troubling pattern: loyalist communities amplified planted narratives not because they were directed to, but because the narratives aligned with existing ideological commitments. The influence operation did not need to create new audiences; it leveraged pre-existing partisan infrastructure for distribution at scale.
The post-exposure persistence of these narratives proved to be the most significant finding. Even after the Qatargate investigation became public knowledge, the loyalist base continued to defend and amplify the planted narratives. The content had become identity-consistent belief, resistant to correction even when its foreign origin was exposed.
Platform distribution exploits a fundamental asymmetry: the cost of planting a narrative is orders of magnitude lower than the cost of correcting it. Once content enters the organic sharing ecosystem, the original source becomes invisible, replaced by the social proof of peer endorsement.
Wikipedia sockpuppet networks represent the most strategically significant vector identified in this investigation. Unlike traditional media manipulation or platform amplification, database manipulation targets the foundational layer of the information ecosystem, the reference material that journalists, researchers, and AI systems treat as ground truth.
The implications for large language model training data are particularly concerning. Content that enters Pillar 1 propagates into AI-generated outputs at scale, reaching users who will never encounter the original Wikipedia source. The sockpuppet-created article on Qatar's role in the Israel-Hamas war, once established in Wikipedia, becomes training data for systems that generate answers for millions of queries.
The objectivity layer is the long game of influence operations. While media placements and platform amplification have immediate impact, database manipulation shapes the informational substrate from which future understanding is constructed. This is influence at the infrastructure level.
Key events from 2019 to present.
Three messaging tracks targeting different audiences.
Principal actors in the influence network, grouped by role.