The Confessed Campaign - Decipon Insights

The Announcement

Ella Keinan did not try to hide what she was doing.

At the Global Jewish Summit in April 2026, the founder of BrightMind — a former Israeli intelligence officer and lawyer — described, in some detail, the operation she runs: more than 100,000 volunteers coordinated through closed Telegram and WhatsApp channels, receiving structured daily tasks, amplifying pro-Israeli content across platforms. Non-Jewish and non-Israeli influencers receive packages of pre-made videos, scripts, and images to publish as their own. Three billion views since October 2023.

“We are not defending,” she said. “We are attacking to define what the world talks about.”

The announcement was specific enough to function as a manual.

It was also calculated.

What the Structure Looks Like from Inside

From the inside, the operation is legible. Participants join closed digital communities, receive daily instructions, and publish or amplify content on schedule. BrightMind distributes media packages — videos, scripts, images — to creators outside the Jewish and Israeli communities specifically: people whose demographic distance from the campaign makes the content read as organic. The infrastructure includes Telegram bots for task distribution, OSINT-grade global trend monitoring, and cloud platforms for asset delivery.

The system is designed for scale. 100,000 participants don’t require individual management. The Telegram channel handles task assignment. The cloud platform handles content delivery. The participant contributes the account, the platform reach, and the appearance of independence from the source.

What It Looks Like from Outside

From the perspective of someone encountering the content on Instagram, TikTok, or YouTube, none of this is visible. What’s visible is: a travel creator discussing their experience in Israel. A lifestyle influencer sharing perspectives on the region. Voices that don’t carry the markers of official Israeli messaging, because they aren’t official.

They’re following a script delivered through a Telegram channel.

The coordination happened upstream of the post. The post itself looks authentic — because in a narrow sense it is. The participant believes what they’re publishing. The belief wasn’t manufactured. Only the content, the timing, and the reach were.

The Gap Between the Channels

Astroturfing usually produces fake grassroots: bots, paid accounts, manufactured personas. The BrightMind model is different. The participants are real people who genuinely believe what they’re publishing. That authenticity is not incidental. It is the point.

A genuine true believer amplifying centrally-produced content is more convincing than a paid troll amplifying the same content. The conviction reads as organic. They’ll defend the position when challenged. Their prior content has established them as credible, independent voices. The operation converts real belief into coordinated distribution. The belief isn’t faked. The coordination is invisible.

Influence laundering works the way money laundering works: you introduce clean material from a legitimate source — the genuine believer, the independent influencer — to process and deliver content that would be legible as propaganda if it arrived directly from its origin. The content exits the system looking like organic opinion because it was handled by someone who holds it as organic opinion. The handling is the tactic.

The influencer packages sent to non-Jewish and non-Israeli creators make the logic explicit. A non-Israeli creator publishing pro-Israeli content occupies a credibility position that an Israeli government spokesperson cannot. They’re not Israeli. They have nothing to gain from saying this. They’ve formed their own view.

Except the view was pre-written, the script was delivered via Telegram, and the apparent independence is engineered by a former intelligence officer who understood that the message would be more persuasive in that voice than in hers.

Attacking to Define

Keinan’s framing is worth taking seriously on its own terms: “We are not defending, we are attacking to define what the world talks about.”

This is an unusually precise application of agenda-setting theory as operational doctrine. Agenda-setting — the understanding that media influence is less about telling people what to think than about telling them what to think about — was articulated by political scientists in the 1970s. The influence operation that acts on this principle at scale doesn’t bother winning individual arguments. It controls which arguments exist.

Three billion views since October 2023 is not primarily a persuasion metric. It is a coverage metric. Coverage means the content existed in the information environment. Existence shapes relevance. Content that exists can be engaged with, shared, debated, and responded to. Content that doesn’t exist is absent from the conversation entirely.

The operation doesn’t need to change minds. It needs to make certain frames structurally present wherever someone searches for information on the topic. At scale, that ubiquity becomes agenda-setting: some conversations exist because this operation made them exist. Counter-conversations begin in response to content that was placed by coordination invisible to everyone except the participants receiving their daily tasks in the Telegram channels.

The Conference as Immunization

Most influence operations are exposed by researchers, journalists, or platform transparency reports. This one was explained — on stage, by its founder, at a public event — before any external exposure occurred.

That explanation is not transparency in the conventional sense. It is a strategic move.

When an influence operation is exposed covertly, the available narrative is: deception uncovered. The operation was hiding. Being found means being condemned. The exposure is the damage.

When an operation is described publicly by its architects, that frame isn’t available. You can’t call it deceptive if it was announced at a conference. The operation acquires the moral vocabulary of “public diplomacy,” “narrative management,” or “civic engagement” — labels that apply to the public admission while leaving the actual mechanics entirely unchanged. The closed coordination still happens in closed channels. The influencer packages still arrive without mandatory disclosure of origin. The 100,000 participants still receive their daily tasks through Telegram bots. The audience that encounters the content still sees nothing of this.

The conference description is the operation’s immunization. It converts the mechanism of exposure — “someone revealed they’re doing this” — into the mechanism of legitimacy. By announcing it first, the operation makes the future investigative story into a corroboration of what was already openly declared. The announcement is: this is something we are proud of and willing to describe. The audience for that announcement is not the target population of the influence operation. It is the critics, the researchers, the journalists who would otherwise frame the story as a revelation.

The conference was transparent. The operation it described is not.

One of these affects people who might hold the operation accountable. The other reaches the audience the operation is designed to influence. The speech changed nothing about the mechanics. It changed only the legal and political legibility.

What the NCI Protocol Sees

Coordinated Inauthentic Behavior is the foundational tactic. The participants are real people. The inauthenticity is not in them but in the appearance of independent, organic amplification. Coordinating real participants to produce the appearance of uncoordinated activity is the same technique whether those participants are bots or genuine believers. The output looks the same from the receiving end. The internal experience of participants doesn’t affect the epistemic distortion produced at the audience level.

Influence Laundering through Third-Party Distribution is the amplification mechanism. Pre-scripted content delivered to external creators without disclosure of origin. The creator’s demographic independence from the campaign is precisely what the distribution is purchasing. Their authentic reputation and established voice fund a message they didn’t author.

Agenda-Setting as Primary Objective distinguishes this from persuasion-oriented operations. The goal is not argument-winning. It is topic presence — making certain frames structurally available in the information environment, displacing counter-frames through volume and ubiquity. Three billion views is a coverage number, not a conversion number.

Public Disclosure as Legitimacy Capture is the novel tactical element. Voluntary public description of the operation’s mechanics converts it from “covert influence campaign” to “coordinated public diplomacy.” The conversion is rhetorical, not operational. The mechanics that produce epistemic distortion at the audience level are unchanged before and after the speech. The naming does the work of the immunization.

These four elements reinforce each other. Genuine believers provide authentic accounts that platform detection cannot flag. Third-party distribution makes the origin invisible to anyone who doesn’t know to look for it. Agenda-setting means the operation wins whether or not any individual piece of content persuades anyone. And the public admission preempts the exposure before it can be framed as a revelation.

The Detection Problem

Standard detection for coordinated influence operations works by finding the coordination signal: accounts posting identical content in tight time windows, follower patterns inconsistent with organic growth, infrastructure linking separate accounts to a common operator. These signals exist in this operation. But they’re harder to act on when the accounts belong to real people.

A bot flagged for coordinated behavior can be removed. A real person who received a Telegram task and published the content out of genuine conviction is, under most platform policies, a real user expressing their views. The coordination happened upstream of the post. The post looks authentic because it is authentic — the participant genuinely believes it, and has a real account with a real history. The scripted origin is upstream of what’s visible.

Platform detection methods weren’t designed for genuine participants. The operation exploits the gap between account authenticity and content authenticity.

The disclosure question — should influencers who receive BrightMind packages disclose the source? — is legally unresolved in most jurisdictions for non-commercial content. Paid political advertising has disclosure requirements in many countries. A Telegram channel distributing free scripts to volunteers who genuinely agree with the message occupies a different regulatory space. The ambiguity is exploitable by design.

The Part That Stayed Opaque

The speech was public. Its audience consisted of people already aligned with the campaign’s goals, journalists covering the conference, and researchers paying attention.

The content it described — the influencer packages, the daily tasks, the three billion views — arrives at its actual audiences without attribution to BrightMind, without disclosure of the coordination, and without any signal that what looks like a travel creator’s independent view originated as a media asset distributed through a cloud platform managed by a former intelligence officer who described the whole thing at a conference.

The conference reached the critics. The operation reaches everyone else.

The honest psyop and the covert psyop produce the same effect on the people they’re aimed at. The difference exists only for those who were already in the room.

This article is part of Decipon’s Manipulation Breakdowns series, which examines specific influence operations using the NCI Protocol framework.

Sources: