J-SOC: how Israel’s Diaspora Ministry tracks protests abroad.

One week’s forecast: 20 listings, 15 of them rated low risk

The forecast for 27 February–5 March 2026 has five detailed entries on pages 1–2 and 15 low-risk listings on page 3. These are events the forecast expected, not a record of protests that took place.

The detailed entries have fields for coordinates, proximity to Israeli assets, risk rating and online reach, though some are left blank. The low-risk list has far less detail.

Entries include a boycott campaign involving Teva in Madrid, and a Melbourne event where Students for Palestine groups and Free Palestine Melbourne are named as posting sources. Being named as a posting source doesn’t mean a group organised the event or did anything wrong.

Page 4 sets out the rating criteria: location, proximity, a group’s history, rhetoric and engagement. The report gives no weighting and no reasons for individual ratings.

The report is marked “Restricted”, but the Ministry published it openly on its own website.

S56

2,259 listings from 70 reports

The collection has 2,336 rows taken from 70 of the Ministry’s reports, and every one links to its original on gov.il. The listing count for each report matches the spreadsheet. We also checked a random sample of 100 listings against the originals and found one transcription error. This is not a count of separate protests, because the same event can appear in several reports.

Compiled by Wallface. See also Wallface’s related research post, which credits the work but isn’t a substitute for the original reports.

Two editions of the October anniversary report overlap: 77 rows come from the earlier one and 119 from the later one. Leaving out the earlier edition gives the 2,259 listings used in our counts, which can still include a few repeats. Listings dated in the future are forecasts, not events that happened.

Every listing keeps its spreadsheet row, source filename and page number, with a link to the original report on gov.il. A few originals contain their own errors, such as a Belfast address listed under Ecuador; we copy those as printed. Risk ratings are the Ministry’s, not our assessment.

We withhold the names of private individuals, shown as “individual (name withheld)”. Organisations, elected officials and well-known public figures are shown as the reports list them. The Ministry’s originals, linked from each listing, are unedited.

By type, the spreadsheet holds 1,143 detailed entries, 991 short low-risk entries, six special entries and 196 anniversary-table entries. Event dates run from 19 December 2024 to 14 October 2026. Where a printed date has no year, we took the year from the report’s date range.

Download every listing (JSON) · CSV · List of the 70 reports

A named manager, and reports that go to security bodies

In November 2024, Shlomit Hammer told a Knesset committee that she manages the monitoring centre. In January 2025, Hadas Maimon described its reports going to security bodies, ministries and partners.

S13 S01

Lotan is the named supplier on the order to run the monitoring centre

Lotan Group International Ltd (514236637) is the supplier on Diaspora Ministry order 4502542354. In the Q4 2025 disclosure, the order’s description translates as “operating the Mashlat”. Earlier and later snapshots describe it as research services. Its recorded value is ₪151,162.72.

The service term ran from 10 December 2024 to 10 December 2025. Later invoices don’t show whether it was renewed.

These figures come from our earlier copy of the Ministry’s spreadsheets. We couldn’t download fresh copies for this edition.

Jewish Onliner and StopAntisemites repeated J-SOC alerts

On 21 August 2025, Jewish Onliner published an article that linked directly to a J-SOC alert about protests planned across Australia. Its description of the 24 August rally at Sydney’s Hyde Park at 1:00 PM matches the Ministry’s alert and listing F27-E021 in the forecast index.

On 12 November 2024, StopAntisemites publicly passed on a Diaspora Ministry alert.

These show the alerts being cited and shared in public. They don’t show routine access to the forecasts, payment or government direction.

S65 S66 S53

Italy: a formal Senate question names J-SOC

On 25 September 2025, Senator Giuseppe De Cristofaro put written question 4-02415 to Italy’s Foreign Affairs, Interior and Defence ministers. It names J-SOC and the Diaspora Ministry, raises concerns about the reporting on protests, and asks what the government knew, how rights are being protected and what diplomatic steps it will take.

The question shows the concerns were formally raised; it isn’t a finding that unlawful surveillance took place. We haven’t seen an Italian ministerial answer.

S57

The European Commission replied without making a finding on J-SOC

MEP Mimmo Lucano tabled question E-003735/2025 on 25 September 2025, and Kaja Kallas answered for the Commission on 13 November 2025.

The answer covers member states’ responsibility for internal security, the rights to free expression and assembly, and opposition to foreign interference, threats and intimidation. It doesn’t confirm the monitoring, announce an investigation into J-SOC or say the activity was unlawful.

S58 S59

What the financial terms mean

Order value or ceiling: the maximum amount recorded or authorised. Cumulative invoices: the total invoiced on an order by a given reporting date. Period invoices: the amount reported for that period alone. Reported receipt or disbursement: money a filer declares it received or paid. A filing is the filer’s own declaration, not an audited bank record.

We don’t add successive snapshots together, or a budget to its receipts, or an approval to an earlier notice of intent. Shekel and dollar amounts are kept apart. A figure revised downward isn’t proof of a refund, and a zero invoice applies only to the record and period examined.

Spreadsheet creation and edit dates tell you about the file, not necessarily when the figures took effect. Descriptions and column positions change between releases, so we match rows by purchase-order number and column heading.

For public accounts, we distinguish between posts picked for sharing, sources cited, alerts passed on, organisations’ own statements and financial records. An account appearing here doesn’t mean J-SOC paid, controlled or directed it. These are selected cases, not a full list of accounts or spending.

Sources, and what we could check

The source list gives each source’s original web address and the page or record to look at. We include copies of selected documents, each with a SHA-256 checksum so you can confirm it hasn’t been altered. An archived web page shows what was there on the day it was captured, not later versions. Organisations’ statements are labelled as theirs, and reproduced documents are credited to the site that hosts them.

For this edition we rechecked the GenTruth protocol and the main FARA financial pages. We couldn’t download the Ministry’s spreadsheets again, so figures from our earlier copies are kept and labelled as such, rather than presented as newly checked. New spreadsheet figures from the wider research are held back until the source can be recovered and reconciled.

How the forecast index was compiled and checked is set out above, in the forecast section.

What we still don’t know

We haven’t found the command post’s statement of work or any renewal after Lotan’s service term ended; the company supplying its technology; who receives its non-public reports; why some procurement figures were restated; whether the GenTruth commitments were signed; or where money passed through intermediaries finally ended up.

Avricon, VALOP International and Yifat come up in the wider procurement research, but a label like “research services” or “media monitoring” doesn’t identify the J-SOC platform. VALOP’s company filings show that it exists as a company, not what any contract covers. We don’t claim that any of them runs or took part in the command post.

Keshet David is an older lead on monitoring. Past similarities don’t show that it runs the current command post, and newer financial claims about it need records we can access before we publish them.

S64

About us

WhoFundedGenocide is published by Archive Genocide. This investigation was put together by our team from public records: the Ministry’s own publications, Israeli procurement disclosures, US foreign-agent (FARA) filings and parliamentary records. The forecast collection was compiled by Wallface.

If the Ministry, a company or anyone named here wants to respond or point out an error, contact us on Telegram. We will publish responses and note any correction.

What is Words of Iron?

Words of Iron was presented as a volunteer project that gathered pro-Israel material and organised sharing it online. It was a separate content-and-sharing initiative, not another name for J-SOC.

A CTech interview published on 12 October 2023 names its founder as Shaked Lokits, a Tel Aviv software engineer with a background in advertising, who set it up in the first two days after the 7 October attacks.

According to the profile, volunteers collected material, moderators reviewed it, and content briefs went out for wider distribution. It put the number of volunteers at about 500 at the time.

CTech places the project within IsraelTechGuards, which it describes as a joint initiative of the National Information Directorate, the Diaspora Ministry, other government offices and tech companies. That is a reported institutional link, not a contract or a payment to any social-media account.

S02

What the homepage asked users to do

An archived copy from 14 November 2023 shows two options. The first showed users selected pro-Israel posts and gave them a ready-made comment to paste under each one, presenting more comments as a way to boost a post’s reach.

The second asked users to report content it called “false or anti-Israeli”. That is the project’s own label, not a finding that the content was false or broke platform rules. The archive shows what users were asked to do, not how many reports were filed or whether anything was removed.

S50

Why Words of Iron is in this investigation

Its archived Twitter-share feeds show which posts it picked: four by Visegrad24 and one by StopAntisemites, listed below. Picking a post for others to share doesn’t mean its author was paid, took part or was directed by J-SOC.

So there are two separate pieces of evidence: a reported link between the project and a government-linked initiative, and archived records of the posts it chose. Neither shows money going to the named accounts.

See the five archived posts below · Archived homepage

S23 S24 S47 S50

Five Visegrad24 and StopAntisemites posts picked for sharing

Words of Iron’s archived feeds include four Visegrad24 posts and one StopAntisemites post, listed below by post ID.

Where Jewish Onliner, AMCHA and StopAntisemites appear

A FactSignal article filed by Clock Tower X links to and credits Jewish Onliner, and its footer says it was distributed on behalf of the State of Israel. Another filed explainer cites AMCHA’s page on BDS. And on 12 November 2024, StopAntisemites publicly passed on a Diaspora Ministry alert.

These are cases of citing a source or passing on an alert. The imagery guide cited in one filing belongs to the Antisemitism Policy Trust, a different organisation from Campaign Against Antisemitism.

FactSignal’s use of Jewish Onliner’s Iran analysis in February 2026 credits Jewish Onliner and carries Clock Tower X’s disclosure that it was distributed on behalf of the State of Israel. That shows source use and a disclosed distribution role. It doesn’t make Jewish Onliner the registered agent, or J-SOC the client.