The situation
It almost never starts with one post.
Most enquiries reach us after a week or two of sensing that something is off. The same claim turns up in three places with no visible connection between them. A website nobody has heard of publishes a piece about the company. A long-standing client calls to ask whether what he read is true.
By that point it is no longer criticism. It is planned activity, and someone is spending time and money on it.
When we open a file, the working assumption is that there is an identifiable party behind the publications. Sometimes a competitor. Sometimes an employee dismissed a year ago. Sometimes a supplier left with an unpaid balance. Not every file ends with a name, and we say so at the start rather than at the end.
Signals
When to pick up the phone
- The same wording, almost word for word, across accounts that supposedly do not know each other
- A wave of reviews that accumulates within a few days
- A page or profile impersonating the company or one of its executives
- A cloned website, or a domain that differs from yours by a single letter
- An internal document circulating in a group or reaching clients
- A demand for payment in exchange for taking a publication down
- An anonymous approach that lands specifically with your suppliers and your bank
- Your lawyer asking for an evidentiary basis before filing
Sequence
Five stages, in this order.
The order is not a matter of convenience. Preservation carried out after the content is gone is worth less, and attribution attempted before the events are understood leads easily to the wrong person.
- 01Preservation
Before anything else, capture. Addresses, timestamps, page source, file hashes. Material online disappears quickly, and usually just as questions start being asked.
- 02Mapping
What was published first, where, and what followed. The stage ends with a timeline and a closed list of accounts, sites and domains.
- 03Attribution
The technical side. Domain registration, hosting, security certificates, analytics identifiers, code repeated across sites, archived versions. This is where the connections the other side did not think about come out.
- 04Assessment
Every conclusion is graded: confirmed, highly likely, likely, weak. A name does not go into a report on the strength of a hunch.
- 05Handover
Report, evidence annex, and a working session with your lawyer. From there the decision returns to you.
Deliverable
What the file contains
- A written investigation report with a full timeline of the incident
- A link map connecting the accounts, sites and domains
- A preserved evidence annex with file hashes and timestamps
- A confidence grade for every attribution finding
- An affidavit from the investigator where proceedings require one
- Continued support to counsel as the matter develops
Legal ground
Why the file is built this way
A file built to be shown to a client looks different from a file built to be filed. We build the second one.
Israeli defamation law treats an online post as a publication in the full sense, and section 7A allows damages without proof of loss, doubled where the publication was made with intent to harm. The distinction between the two is largely evidentiary. A finding that twenty accounts acted inside the same window and with the same wording goes directly to that question.
A cloned site or a look-alike domain brings the Commercial Torts Law into play. Publishing a photograph or personal details engages the Protection of Privacy Law.
On anonymity: an Israeli court has no power to order an internet service provider to disclose a user identity. That is the Rami Mor precedent, and no statute has changed it since. Anyone who wants to know who is behind the account has to reach him another way. That is our work.
Boundaries
What we will not do
- We do not delete reviews and we do not work on search results
- We do not open fictitious accounts and we do not run counter-campaigns
- We do not enter accounts, devices or mailboxes
- We do not buy information from anyone who obtained it unlawfully
- We do not present a theory as evidence
The firm is licensed under the Private Investigators and Security Services Law and operates subject to the Protection of Privacy Law. Legal steps are taken by your lawyer and public response by your communications adviser. We bring the facts. Nothing here constitutes legal advice.
Questions
Asked before every engagement
Can you find out who is behind an anonymous account?
Sometimes. Identification rests almost entirely on the other side making mistakes: a handle reused elsewhere, an image that has appeared online before, an address left in registration data, a recognisable turn of phrase. After the preliminary check we tell you what the odds are. If they are poor, you hear that too.
The posts have already been taken down. Too late?
Not necessarily. Web archives, caches, shares and other people replying all remain, and so does the technical infrastructure behind the site. Earlier is better, but we open files months after the fact as well.
How long does it take?
Urgent preservation, one to three days. A full attribution investigation, two weeks to a month depending on scope.
Will the evidence hold up in court?
Documentation follows digital evidence preservation practice and is accompanied by an affidavit. Admissibility is decided by the court. Our part is making sure there is nothing to attack in how the material was captured.
Do you work with our lawyer?
In most files yes, and it works better that way. Some material is gathered differently when the cause of action is known in advance.