Home/Investigations/Canary Mission
FARA NOT REGISTEREDNot Registered — DOJ Investigation Requested (Feb 2, 2026)Doxxing / Political Influence Operation

Canary Mission

Canary Mission is an Israel-operated doxxing operation that targets Americans for pro-Palestine speech. 70 organizations have formally requested a DOJ FARA investigation.

Parent Company
Megamot Shalom (Israeli nonprofit / amuta)
Ultimate Owner
Unknown — Opaque funding structure
Israel
Headquarters
Operated from Israel (per Drop Site News investigation)

Corporate History

Canary Mission is a pro-Israel doxxing operation that has systematically targeted American students, professors, activists, and professionals for engaging in constitutionally protected speech critical of Israeli government policy. The operation compiles detailed dossiers on US residents, distributes these profiles to employers, universities, donors, and government actors, with the foreseeable and intended outcome of punishing and deterring lawful political advocacy.

Per a January 6, 2026 investigation by Drop Site News journalist Jacqueline Sweet, Canary Mission's operations are run out of Israel by a large Israeli team. Internal system timestamps correspond to Israeli time zones. The investigation uncovered over 100 gigabytes of data from Canary Mission's backend, including a secret internal website called "BlackNest" hosted on an intranet URL called "Kaloustropous."

BlackNest reveals Canary Mission as a disciplined, hierarchical, and professionalized operation. The site celebrates deportations, firings, and denials of entry as "company impact" metrics. A "Team Overview" page lists staff achievements, and a "Content Strategy Team" operates four sub-teams: profiles, editorial, reports, and social media, with a KPI of 5 posts per day.

A 21-page strategic planning document found on BlackNest outlines the group's mission to "fight those who hate the Jewish people" with a niche of "dismantle the anti-Israel network by attacking the messenger, not the message." Core targets from 2021-2024 included AMP, SJP, INN, JVP, CAIR, WOL, and FJP. For 2025, goals included 150 new profiles per week and sharing data with donors.

The operation's 2024 plan noted "facial rec software combined with scraping is efficiently producing named POIs" (persons of interest). Over 30 unique doxxers appear to have created fake Facebook and social media accounts to track targets, uploading information to a content management system using anonymous emails.

Unsealed court records from a 2025 federal trial revealed that U.S. Immigration and Customs Enforcement (ICE) officials and the Department of Homeland Security (DHS) relied extensively on Canary Mission's database when compiling dossiers on pro-Palestinian foreign students and academics for deportation and visa revocation. A DHS "tiger team" used data sourced from Canary Mission to identify more than 75% of the names targeted for enforcement actions.

On February 2, 2026, 70 organizations — Jewish, Christian, Muslim, Hindu, Unitarian, civil rights, academic, legal, peace, and human rights groups — submitted a formal request to the DOJ National Security Division's FARA Unit seeking an investigation into whether Canary Mission qualifies as an agent of a foreign principal under FARA.

The Israeli nonprofit Megamot Shalom has been reported to be running Canary Mission's operations for years. Israeli tech company Shefing (owned by French-Israeli Philippe Cohen, based in a Jerusalem WeWork) built code for both Canary Mission and a spinoff called the Museum of Online Antisemitism.

Public disclosures filed abroad reportedly show that Canary Mission received approximately $1 million in foreign donations in a single year — far exceeding what has been disclosed in U.S. tax filings. Investigative reporting by Jewish Currents documented substantial donations from individuals closely connected to major pro-Israel institutions, including Michael Leven, a hospitality executive who served on the boards of Birthright Israel.

Investigation Summary

Canary Mission is an Israel-operated doxxing operation that targets Americans for pro-Palestine speech. 70 organizations have formally requested a DOJ FARA investigation.

Key findings:

• Operated from Israel by large Israeli team — internal timestamps in Israeli time zones

• BlackNest internal site celebrates deportations, firings as "company impact" metrics

• DHS "tiger team" used Canary Mission data to identify 75% of deportation targets

• ~$1M in foreign donations in single year — far exceeds US tax disclosures

• 150 new profiles per week target (2025 strategic plan)

• Facial recognition + scraping to identify persons of interest

• 30+ anonymous doxxers using fake social media accounts

• 70 organizations requested DOJ FARA investigation (Feb 2, 2026)

• Megamot Shalom (Israeli nonprofit) runs operations

• Shefing (Jerusalem tech company) built technical infrastructure

• NOT FARA-registered despite operating from Israel to influence US policy

Unanswered Questions

Q1

Why has Canary Mission not registered under FARA despite operating from Israel to target Americans?

Q2

What is the full scope of Canary Mission's relationship with the Israeli government?

Q3

How much total funding has Canary Mission received from foreign sources?

Q4

Who are the American donors funding an Israeli operation that targets Americans?

Q5

How did DHS/ICE come to rely on an anonymous, unverified Israeli doxxing site for deportation decisions?

Q6

What is the relationship between Canary Mission and the Israeli Ministry of Strategic Affairs?

Q7

Are there connections between Canary Mission's operations and the Havas Media pipeline entities?

Q8

What legal liability exists for US-based donors funding foreign political operations targeting Americans?

Red Flags

Operated from Israel — targets Americans for constitutionally protected speech

NOT FARA-registered despite clear foreign principal indicators

DHS used unverified anonymous doxxing data for 75% of deportation targets

~$1M foreign donations undisclosed in US tax filings

Facial recognition + scraping to identify targets — surveillance operation

Celebrates deportations and firings as 'company impact' metrics

30+ anonymous doxxers using fake social media accounts

Pass-through funding structure designed to obscure sources

150 new profiles per week — industrial-scale targeting of Americans

Used by highest levels of Trump administration for enforcement actions

Corporate Structure

BlackNest
Internal operations/intranet site
Museum of Online Antisemitism
Abandoned spinoff Chrome extension
Kaloustropous
Intranet hosting URL

Know someone who needs to see this?

Share on X

SOURCE ATTRIBUTION: All information on this page is derived from publicly available records including FARA registrations filed with the U.S. Department of Justice, IRS Form 990 filings, state corporate records, SEC filings, and attributed news reporting. This analysis is provided for educational purposes by Americans For Non-Profit Transparency (AFNPT). See our Legal Framework and Editorial Standards.