// ─────────────────────────────────────────────────────────────────────────────
//  OSINT Attribution Report — لبنان يتحرر
//  Facebook Page Investigation · March 2026
// ─────────────────────────────────────────────────────────────────────────────

#set document(
  title: "OSINT Attribution Report — Lebanon Liberates Itself",
  author: "Investigation Unit",
)

// Colour palette
#let col-red    = rgb("#c0392b")
#let col-amber  = rgb("#e67e22")
#let col-blue   = rgb("#2980b9")
#let col-green  = rgb("#27ae60")
#let col-dark   = rgb("#1a1a2e")
#let col-grey   = rgb("#f5f5f5")

// ── Page layout ──────────────────────────────────────────────────────────────
#set page(
  paper: "a4",
  margin: (top: 2.4cm, bottom: 2.4cm, left: 2.5cm, right: 2.5cm),
  header: [
    #context if counter(page).get().first() > 1 [
      #set text(size: 7.5pt, fill: rgb("#999"))
      #grid(
        columns: (1fr, 1fr),
        align(left)[OSINT / Lebanon IO Attribution — UNCLASSIFIED],
        align(right)[Page #counter(page).display()],
      )
      #line(length: 100%, stroke: 0.4pt + rgb("#ddd"))
      #v(-2pt)
    ]
  ],
  footer: [
    #context if counter(page).get().first() > 1 [
      #line(length: 100%, stroke: 0.4pt + rgb("#ddd"))
      #v(-4pt)
      #set text(size: 7pt, fill: rgb("#bbb"))
      #align(center)[FOR INVESTIGATION USE ONLY — March 2026]
    ]
  ]
)

#set text(font: "Libertinus Serif", size: 10.5pt, lang: "en")
#set par(justify: true, leading: 0.8em, spacing: 1.2em)
#set heading(numbering: "1.")

// ── Helper components ─────────────────────────────────────────────────────────

#let badge(color, label) = box(
  fill: color.lighten(75%),
  stroke: 0.5pt + color,
  radius: 3pt,
  inset: (x: 5pt, y: 2pt),
)[#text(size: 8pt, weight: "bold", fill: color.darken(15%), label)]

#let callout(color, icon, title, body) = block(
  width: 100%,
  fill: color.lighten(88%),
  stroke: (left: 3pt + color),
  inset: (x: 12pt, y: 9pt),
  radius: (right: 4pt),
  spacing: 1.2em,
)[
  #text(weight: "bold", fill: color.darken(10%))[#icon #h(4pt) #title]
  #linebreak()
  #body
]

#let kv(key, value) = (
  table.cell(fill: col-grey, text(weight: "semibold", size: 9pt, key)),
  table.cell(text(size: 9.5pt, value)),
)

// ─────────────────────────────────────────────────────────────────────────────
//  COVER PAGE
// ─────────────────────────────────────────────────────────────────────────────
#page(margin: (top: 3cm, bottom: 3cm, left: 2.5cm, right: 2.5cm), header: [], footer: [])[

  #align(center)[
    #block(
      width: 100%, fill: col-dark, radius: 8pt,
      inset: (x: 32pt, y: 38pt),
    )[
      #text(size: 28pt, weight: "bold", fill: white)[OSINT Attribution Report]
      #v(0.5cm)
      #text(size: 18pt, fill: rgb("#c8d8ff"))[
        #text(dir: rtl, lang: "ar")[لبنان يتحرر] #h(10pt) — #h(10pt) "Lebanon Liberates Itself"
      ]
      #v(0.6cm)
      #text(size: 11pt, fill: rgb("#9aabcc"))[
        Facebook Influence Operation — Attribution & Network Analysis
      ]
    ]
  ]

  #v(1.5cm)

  #grid(
    columns: (1fr, 1fr, 1fr),
    gutter: 14pt,
    block(fill: rgb("#fff8e1"), stroke: 1pt + col-amber, inset: 12pt, radius: 4pt)[
      #text(size: 8pt, weight: "bold", fill: col-amber)[TARGET PAGE]\
      #text(size: 8.5pt, font: "DejaVu Sans Mono")[61585153052901]\
      #text(size: 8pt, fill: rgb("#777"))[Classic: 913256835205251]
    ],
    block(fill: rgb("#e8f5e9"), stroke: 1pt + col-green, inset: 12pt, radius: 4pt)[
      #text(size: 8pt, weight: "bold", fill: col-green)[REPORT DATE]\
      #text(size: 8.5pt)[March 17, 2026]\
      #text(size: 8pt, fill: rgb("#777"))[Campaign active]
    ],
    block(fill: rgb("#fce4ec"), stroke: 1pt + col-red, inset: 12pt, radius: 4pt)[
      #text(size: 8pt, weight: "bold", fill: col-red)[CONFIDENCE]\
      #text(size: 8.5pt)[Operation: HIGH]\
      #text(size: 8pt, fill: rgb("#777"))[Attribution: MEDIUM]
    ],
  )

  #v(1cm)

  #callout(col-red, "!", "CLASSIFICATION")[
    #text(weight: "bold")[UNCLASSIFIED — FOR INVESTIGATION USE ONLY.]
    Distribution limited to investigation team. Intelligence collected via passive open-source methods only — no hacking, credential theft, or Terms of Service violations.
  ]

  #v(1cm)

  #text(size: 9.5pt, fill: rgb("#444"))[
    *Scope:* Identify the operator(s) behind Facebook page "لبنان يتحرر" — a professionally managed anti-Hezbollah influence operation running paid political ads in Lebanon without legally required transparency disclosures. Goal: map the page's management structure, linked accounts, and operator fingerprints toward attribution of the individual(s) or organisation(s) responsible.
  ]

  #v(1.4cm)

  #text(size: 8.5pt, fill: rgb("#999"))[
    *Sources:* Facebook public HTML (authenticated via read-only burner account), Facebook Ad Library (public), public web search. Burner: c_user 61582587737257. All collection passive and anonymous.
  ]
]

// ─────────────────────────────────────────────────────────────────────────────
//  1. EXECUTIVE SUMMARY
// ─────────────────────────────────────────────────────────────────────────────
= Executive Summary

The Facebook page #text(dir: rtl, lang: "ar")[لبنان يتحرر] ("Lebanon Liberates Itself") is *significantly more than a social media influence campaign*. It is a *cover asset for an active civilian HUMINT collection operation* targeting Lebanese knowledge of Hezbollah and Iranian-linked military activity. It launched in early February 2026 and within six weeks generated over 55,000 weekly interactions via paid advertising — a 22:1 amplification ratio that is definitively not organic.

#callout(col-red, ">>", "BOTTOM LINE UP FRONT — REVISED")[
  *Scope elevation (March 17, 2026):* A Google Form embedded in the page's content (#link("https://forms.gle/NWKZhXdnfzGFx1ae9")) solicits Lebanese citizens to submit — with location data and photos/video — reports of *"suspicious military/security activity linked to foreign forces"* (operational language for Hezbollah/IRGC). Responses go to a private Google Sheet. Submitters' Google account emails are harvested. The "safe and confidential" claim in the form is *operationally false*.

  This is *not an IO shop product*. The combination of paid influence operation + structured civilian HUMINT collection + Bulgarian/Russian operational admin layer + Palestinian cover entity (سمن وعسل, Palestine × 2 managers) + Arabic locale Google infrastructure indicates a *multi-layer contractor structure* fronting for an organised state or state-adjacent actor.

  *Critical revision (March 17 2026):* Meta Page Transparency for the target page confirms admin countries as *Bulgaria (2) + Russia (1)* — NOT Palestine. Palestine admins belong to the *cover entity page* (سمن وعسل), not the target page. The target page was created Dec 15 2025, immediately parked as "مرحبا ريّس", then activated as "لبنان يتحرر" on Jan 29 2026 — a professional name-cycling OPSEC technique.

  *Attribution revised:* Eastern European / Russian-connected commercial IO operator is now the most likely execution layer. Unknown state client directing remains unresolved. Israeli intelligence, Russian state-adjacent operation, and Gulf-state sponsorship all remain live hypotheses. IO sophistication: *8/10* (revised upward).
]

#callout(col-amber, "!", "PEER REVIEW NOTE — March 2026")[
  This report was subjected to a 5-model independent analytical review (Claude Opus 4.5, GPT-5.2 ×2, GPT-5.1, Claude Sonnet 4.5) and a subsequent 4-model re-analysis incorporating new Palestinian admin data (Claude Opus 4.5, GPT-5.2, GPT-5.1, Claude Sonnet 4). Several technical claims were corrected in the first review. The second review produced hypothesis scoring and an operation structure model. Full first-review findings in `peer_review_assessment.md`. First-review composite grade: *C+/B−*. Second-review produced revised hypothesis table and action ranking below.
]

Two primary attribution threads were identified:

#set enum(numbering: "1.")
+ *Persona network:* Day-1 commenters include accounts consistent with IO-constructed Shia Lebanese personas — newly created, with biographical backstories matching the page's target demographic (South Lebanon residency, Shia-coded names). One anomalous profile field (Ghaith Ali's "college" entry resolving to a personal profile via 302 redirect) is unresolved and requires verification.
+ *Professional ad operation:* A/B testing of political messaging, four confirmed SIEP violation removals, and rapid spending scale-up all indicate institutional-level Meta Ads experience.

// ─────────────────────────────────────────────────────────────────────────────
//  2. TARGET PAGE PROFILE
// ─────────────────────────────────────────────────────────────────────────────
= Target Page Profile

== Identity & Metadata

#table(
  columns: (0.45fr, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Page name (Arabic)", text(dir: rtl, lang: "ar")[لبنان يتحرر]),
  ..kv("Translation", "Lebanon Liberates Itself"),
  ..kv("New-format profile ID", text(font: "DejaVu Sans Mono")[61585153052901]),
  ..kv("Classic page ID", text(font: "DejaVu Sans Mono")[913256835205251]),
  ..kv("Stated location", "Beirut, Lebanon"),
  ..kv("Category (self-reported)", [*Marketing Agency* — see §2.2; likely deliberate misclassification]),
  ..kv("Likes / Followers", "~1,300 / ~2,484"),
  ..kv("Talking About", [~55,197 — #text(weight: "bold", fill: col-red)[22:1 ratio — anomalous]]),
  ..kv("Business Manager", [businessID: null — not exposed in public payload; absence does not confirm no BM]),
  ..kv("Admin countries", [#text(weight: "bold", fill: col-red)[Bulgaria (2) + Russia (1)] — Meta Page Transparency confirmed 2026-03-17. Distinct from سمن وعسل (Palestine × 2, separate page).]),
  ..kv("Page created", "15 December 2025"),
  ..kv("Name history", [Created "لبنان يتحرر" → renamed same day (Dec 15) to "مرحبا ريّس" (45-day parking) → renamed back "لبنان يتحرر" Jan 29 2026 (operation activation). Classic name-cycling OPSEC.]),
  ..kv("CDN node", [scontent-fra3 — Frankfurt, Germany (viewer-side routing; not an admin location signal)]),
  ..kv("Profile picture", "Modified Shutterstock vector — not original artwork"),
  ..kv("First known post", "February 3, 2026"),
  ..kv("Ads", [Currently running. Confirmed political/social-issue ad history.]),
)

== Category Misclassification — SIEP Violations

#callout(col-amber, "!", "KEY FINDING")[
  At least *4 ads carry confirmed SIEP violation removals* — direct Meta enforcement records confirming the page served political or social-issue advertising. The page continued publishing after each removal, consistent with a professional team actively monitoring and republishing. _Note: choosing "Marketing Agency" as a category does not mechanistically bypass SIEP; Meta enforces by content and intent, not page category (corrected from earlier version)._
]

== Engagement Anomaly

The 22:1 "talking about"-to-follower ratio is anomalous and inconsistent with organic growth, though not exclusively diagnostic of paid seeding. Contributing factors:
- Confirmed paid ad reach driving engagement from non-followers (Ad Library shows ads targeting all Lebanon plus diaspora)
- Possible coordinated inauthentic engagement alongside the ad campaign
- Viral resharing into large Lebanese political groups (followers = stock; talking-about = flow; one distributed Reel can spike the ratio without converting follows)
- Content uses "#text(dir: rtl, lang: "ar")[أمانة]" framing ("as a trust/responsibility" — pass this on) — a textbook viral sharing mechanic in Arabic social media

// ─────────────────────────────────────────────────────────────────────────────
//  3. CONTENT & MESSAGING FINGERPRINT
// ─────────────────────────────────────────────────────────────────────────────
= Content & Messaging Fingerprint

== Narrative Profile

The page pushes a consistent anti-Hezbollah, pro-Lebanese-sovereignty narrative aimed specifically at *Shia Lebanese audiences* — not the general Lebanese public. This is a critical attribution signal: crafting messaging that resonates with intra-Shia political dissent requires deep familiarity with Lebanese Shia community divisions, suggesting Lebanese origin or expert area knowledge.

== Recurring Hashtags

#table(
  columns: (auto, 1fr, auto),
  stroke: 0.5pt + rgb("#e0e0e0"),
  table.header(
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Hashtag]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Translation / Significance]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Signal type]],
  ),
  table.cell[#text(dir: rtl, lang: "ar", size: 9pt)[#sym.hash لبنان_يتحرر]],
    [Page's own campaign brand hashtag],
    badge(col-blue, "BRANDING"),
  table.cell[#text(dir: rtl, lang: "ar", size: 9pt)[#sym.hash الشيعة_تنتفض]],
    ["Shia uprising/awakening" — intra-Shia community dissent],
    badge(col-red, "IO SIGNAL"),
  table.cell[#text(dir: rtl, lang: "ar", size: 9pt)[#sym.hash حزب_الحرس_الثوري]],
    ["Party of the Revolutionary Guard" — labels Hezbollah as IRGC proxy],
    badge(col-amber, "FRAMING"),
  table.cell[#text(dir: rtl, lang: "ar", size: 9pt)[#sym.hash العماد_فادي_كفوري]],
    [Lebanese Army Commander — endorses Lebanese state military over Hezbollah],
    badge(col-green, "PRO-STATE"),
)

== Known Posts Timeline

#table(
  columns: (auto, auto, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  table.header(
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Date]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Format]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Content summary]],
  ),
  [Feb 3, 2026], [Photo post],
    [Hezbollah weapons cache near *MTV Lebanon* building in Ramlet al-Baida, Beirut],
  [Feb 3, 2026], [Reel],
    [Anti-Hezbollah video — first reel; engaged day-1 commenter network],
  [Feb 23, 2026], [Reel],
    [Follow-up video campaign],
  [Mar 16, 2026], [Post],
    [Ongoing content],
)

*MTV Lebanon link:* The first post specifically implicates a location near MTV Lebanon — Lebanon's explicitly anti-Hezbollah television channel. This may indicate operator familiarity with MTV-adjacent political and media circles, or may be coincidental use of a well-known Beirut landmark.

// ─────────────────────────────────────────────────────────────────────────────
//  4. LINKED ACCOUNTS & ENTITY MAP
// ─────────────────────────────────────────────────────────────────────────────
= Linked Accounts & Entity Map

== Network Overview

#block(
  fill: col-grey,
  stroke: 0.5pt + rgb("#ccc"),
  inset: 14pt,
  radius: 5pt,
  width: 100%,
)[
  #set text(size: 8.5pt, font: "DejaVu Sans Mono")
  #set par(leading: 1.4em, spacing: 0pt)
  TARGET PAGE: #text(dir: rtl, lang: "ar")[لبنان يتحرر] (61585153052901)\
  #h(3mm)|\ 
  #h(3mm)+-- DAY-1 COMMENTER --> Ghaith Ali (61562211934692)\
  #h(9mm)| Created: 2026-01-04 | Location: Abbassieh, South Lebanon\
  #h(9mm)|\
  #h(9mm)+-- EMPLOYER --> #text(dir: rtl, lang: "ar")[سمن وعسل] / Ghee+Honey (100065678581703)\
  #h(15mm)| Created: 2023-11-24 | Frankfurt CDN [SAME AS TARGET] | 937 followers\
  #h(15mm)|\
  #h(15mm)+-- FOLLOWS (1 entity only) --> #text(dir: rtl, lang: "ar")[وتين] /Wateeen7 (100044623170419)\
  #h(21mm)  Mgr: Malak Almughrabi (Palestinian, 1.6M followers)\
  #h(21mm)  Original owner: Amjad Kulab (deceased martyr)\
  #h(21mm)  Instagram: malak.almughrabi\
  #h(9mm)|\
  #h(9mm)+-- "COLLEGE" --> 61557471317885 [personal profile, NOT institution -- anomalous]\
  #h(3mm)|\
  #h(3mm)+-- DAY-1 COMMENTER --> Hussan Chhab (61577225957303)\
  #h(9mm)| Creation date: TBD | profile data minimal\
  #h(3mm)|\
  #h(3mm)+-- COMMENTER --> Zolfekar Hjazi (61579855714899)\
  #h(9mm)  Name: Zulfiqar (sword of Ali) -- distinctly Shia cultural name\
  #h(9mm)  Profile: sparse, no city/work visible
]

== Ghaith Ali (61562211934692) — Primary Lead

#table(
  columns: (0.42fr, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Facebook ID", text(font: "DejaVu Sans Mono")[61562211934692]),
  ..kv("Account created", "2026-01-04 17:14 UTC"),
  ..kv("Days before first page post", text(weight: "bold", fill: col-red)[30 days — account predates the page launch]),
  ..kv("Current city", [#text(weight: "bold")[Abbassieh, Nabatieh Governorate, South Lebanon] — Hezbollah stronghold]),
  ..kv("Employer", text(dir: rtl, lang: "ar")[سمن وعسل] + " / Ghee and Honey (100065678581703)"),
  ..kv("'College' entry", ["61557471317885" — a personal profile ID, not an educational institution]),
)

#callout(col-amber, "!", "Signal Cluster")[
  Account created *exactly 30 days before the target page's first post*. Located in a Hezbollah-controlled town. ID in 615xxx format (post-2022, recently created). The "college" field pointing to a personal profile rather than any institution is a *highly anomalous biographical entry* — may link to another account in the operator network. *This account matches the profile of an IO persona with a credible South Lebanon biographical backstory.*
]

== Work Entity: #text(dir: rtl, lang: "ar")[سمن وعسل] (100065678581703)

#table(
  columns: (0.42fr, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Name", text(dir: rtl, lang: "ar")[سمن وعسل] + " (Ghee and Honey)"),
  ..kv("Category", "Product/service — organic honey and ghee"),
  ..kv("Created", [#text(weight: "bold", fill: col-red)[2021-03-17] — established 5 years before target page; #text(style: "italic")[not] Oct-7 correlated (prior date error corrected)]),
  ..kv("Admin primary country (Meta-verified)", text(weight: "bold", fill: col-red)["PALESTINE — 2 managers (Page Transparency)"]),
  ..kv("Contact phone", text(weight: "bold", fill: col-red)["+972 59-747-9787"] + " — Palestinian mobile prefix; consistent with Palestine admin data"),
  ..kv("Followers / Following", "937 / 1"),
  ..kv("Only entity followed", text(dir: rtl, lang: "ar")[وتين] + " / Wateeen7 (100044623170419) — 1.6M followers"),
  ..kv("CDN node", ["scontent-fra3" — Frankfurt (viewer-side routing; not an admin location signal)]),
  ..kv("is_additional_profile_plus", [true — indicates Meta's Additional Profiles feature (multi-profile under one Accounts Center); #text(style: "italic")[not] a page-linkage indicator]),
  ..kv("Business Manager", "None"),
)

_Note: The Frankfurt CDN node is not a meaningful attribution signal. Facebook CDN edge selection is driven by viewer-side DNS/BGP routing, not uploader IP. Frankfurt serves all of Lebanon and MENA; shared fra3 routing between two pages is expected, not diagnostic. This claim has been struck from the attribution chain (corrected per technical peer review)._

== #text(dir: rtl, lang: "ar")[وتين] / Wateeen7 (100044623170419) — The Followed Entity

#table(
  columns: (0.42fr, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Username", "Wateeen7"),
  ..kv("Followers", text(weight: "bold")["1.6 million"]),
  ..kv("Category", "Writer"),
  ..kv("Instagram", text(font: "DejaVu Sans Mono")["malak.almughrabi"]),
  ..kv("Current manager", "Malak Almughrabi — Palestinian/Gazan content creator"),
  ..kv("Original owner", [#text(dir: rtl, lang: "ar")[أمجد كلاب] + " (Amjad Kulab) — deceased, described as " + text(dir: rtl, lang: "ar")[شهيد] + " (martyr)"]),
  ..kv("Content focus", "Islamic dhikr (remembrance), religious motivation, personal sharing"),
  ..kv("Memorial post", text(dir: rtl, lang: "ar", size: 9pt)["صَدَقَة جَارِيَة عَن رُوحِ الشّهَيِد صاحب الصفحة: أَمجِد كُلاب"]),
)

The work entity #text(dir: rtl, lang: "ar")[سمن وعسل] follows exactly *one* account on all of Facebook — this 1.6-million-follower Palestinian inspirational page, originally owned by the martyr Amjad Kulab and now managed by Malak Almughrabi. Following large Arabic inspirational pages is a common Lebanese social media pattern and does not by itself indicate political alignment with Hamas or Hezbollah. It is noted as a data point that the manager Malak Almughrabi and her Instagram account remain an untapped investigation lead.

== Zolfekar Hjazi (61579855714899) — Secondary Commenter Lead

#table(
  columns: (0.42fr, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Name etymology", [#text(dir: rtl, lang: "ar")[ذو الفقار] (Dhu al-Faqar) = the sword of Ali ibn Abi Talib]),
  ..kv("Cultural coding", text(weight: "bold", fill: col-red)["Distinctly Shia name"] + " — consistent with page's Shia-dissent audience"),
  ..kv("Profile visibility", "Sparse — no city, work, education, or creation date extractable"),
)

// ─────────────────────────────────────────────────────────────────────────────
//  5. OPERATOR ATTRIBUTION
// ─────────────────────────────────────────────────────────────────────────────
= Operator Attribution Analysis

== What We Know About The Operator

#grid(
  columns: (1fr, 1fr),
  gutter: 14pt,
  block(
    fill: rgb("#e8f5e9"), stroke: 1pt + col-green, inset: 12pt, radius: 5pt,
  )[
    #text(weight: "bold", size: 9pt, fill: col-green)[CONFIRMED CAPABILITIES]
    #v(5pt)
    #set text(size: 9pt)
    #set list(marker: "✓")
    - Professional Meta Ads platform knowledge
    - A/B testing of political content at scale
    - SIEP-evasion via category manipulation
    - Arabic political messaging (Shia-dialect aware)
    - Intra-Shia community narrative crafting
    - Graphic design (Shutterstock licence or derivative)
    - Persona network construction and management
    - Day-1 engagement seeding (coordinated)
  ],
  block(
    fill: rgb("#fce4ec"), stroke: 1pt + col-red, inset: 12pt, radius: 5pt,
  )[
    #text(weight: "bold", size: 9pt, fill: col-red)[UNKNOWN — GAPS TO FILL]
    #v(5pt)
    #set text(size: 9pt)
    #set list(marker: "?")
    - Page creation date
    - Admin country (consistently null — VPN or privacy)
    - Business Manager affiliation
    - Real identity behind Ghaith Ali persona
    - Page 306940975846042 (Dec 2024 activity)
    - "College" profile 61557471317885
    - Hussan Chhab creation date
    - Story bucket entity 100610558804897
  ],
)

== Attribution Hypotheses

#table(
  columns: (auto, 1fr, auto, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  table.header(
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[#h(3pt)#sym.hash]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Hypothesis]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Confidence]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Key evidence]],
  ),
  [H3],
    [*Gulf-backed IO + Palestinian subcontractors* (Saudi/UAE political line; PA digital labor)],
    badge(col-red, "HIGH — 35%"),
    [Palestinian admin on cover entity (Meta-verified); professional ad ops; A/B testing; anti-Hezbollah = Gulf strategic interest; subcontract explains PA–Lebanon mismatch],
  [H6],
    [*Mercenary IO shop* serving undisclosed client],
    badge(col-amber, "MED — 25%"),
    [Category "Marketing Agency"; PA asset reuse fits "we run many pages"; client could be Gulf, Lebanese, or other],
  [H1],
    [Lebanese anti-Hezbollah political group (independent)],
    badge(col-blue, "LOW-MED — 15%"),
    [Lebanon-specific targeting brief; LAF legitimacy cues — but Palestinian admin contradicts purely local grassroots],
  [H4],
    [Lebanese diaspora (Gulf/EU) operating remotely],
    badge(col-blue, "LOW — 10%"),
    [Diaspora anti-Hezbollah sentiment plausible; PA cover asset is not expected diaspora footprint],
  [H2],
    [Palestinian faction using Lebanese-front personas],
    badge(col-blue, "LOW — 10%"),
    [Palestinian admin is real; but the #text(dir: rtl, lang: "ar")[الشيعة تنتفض] wedge is not a typical Palestinian faction objective],
  [H5],
    [Western-funded democracy promotion with Lebanese front],
    badge(rgb("#999"), "VERY LOW — 5%"),
    [SIEP violations and persona seeding are wrong risk profile for Western programming],

)

*Most probable:* H3 (Gulf + Palestinian subcontractors, 35%) or H6 (mercenary IO, 25%). The Palestinian admin finding (Meta-verified) is the single most significant structural evidence shift. The operation has Lebanon-specialist strategic knowledge at the planning layer but Palestinian-admin infrastructure at the execution layer. Frankfurt CDN is not a meaningful location signal (struck from analysis).

== October 7 Temporal Correlation — Contextual Background Only

The work entity #text(dir: rtl, lang: "ar")[سمن وعسل] was created *March 17, 2021* — five years before the target page launched. _The October 7, 2023 temporal correlation previously stated in this report was an error; the actual creation date has been confirmed via Page Transparency and the claim is retracted._ The page was dormant for approximately three years and was likely repurposed as operational cover infrastructure around January 2026.

// ─────────────────────────────────────────────────────────────────────────────
//  6. POSSIBLY CO-MANAGED PAGES
// ─────────────────────────────────────────────────────────────────────────────
= Possibly Co-Managed Pages

The following entities have evidence-based links to the target page's operator. None is conclusive independently; collectively they form a network worth tracing.

#table(
  columns: (auto, auto, 1fr, auto),
  stroke: 0.5pt + rgb("#e0e0e0"),
  table.header(
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[FB ID]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Name]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Link to investigation]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Priority]],
  ),
  text(font: "DejaVu Sans Mono", size: 8pt)[100065678581703],
    text(dir: rtl, lang: "ar", size: 9pt)[سمن وعسل],
    [Employer of Day-1 commenter Ghaith Ali; *same Frankfurt CDN as target*; created post-Oct 7],
    badge(col-red, "HIGH"),
  text(font: "DejaVu Sans Mono", size: 8pt)[306940975846042],
    [Unknown — NOT YET fetched],
    [Appeared in Ghaith Ali's Shorts video metadata with Dec 2024 timestamps — *predates target page*],
    badge(col-red, "HIGH"),
  text(font: "DejaVu Sans Mono", size: 8pt)[61557471317885],
    [Unknown profile],
    [Listed as Ghaith's college entry — personal profile ID, not institution; returned 302 redirect],
    badge(col-amber, "MEDIUM"),
  text(font: "DejaVu Sans Mono", size: 8pt)[100610558804897],
    [Unknown],
    [Appears in work entity story_bucket node — possible associate or content co-creator],
    badge(col-amber, "MEDIUM"),
  text(font: "DejaVu Sans Mono", size: 8pt)[61577225957303],
    [Hussan Chhab],
    [Day-1 commenter; 615xxx (recently created); creation date not yet extracted],
    badge(col-amber, "MEDIUM"),
)

// ─────────────────────────────────────────────────────────────────────────────
//  7. PENDING INVESTIGATION LEADS
// ─────────────────────────────────────────────────────────────────────────────
= Pending Investigation Leads

#callout(col-amber, ">>", "Needs Further Investigation")[
  The items below are live leads not yet pursued. Priority order reflects estimated value toward operator identification. All are accessible via the same authenticated scraping methodology used so far.
]

#table(
  columns: (auto, 1fr, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  table.header(
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Pri]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Lead]],
    table.cell(fill: col-dark)[#text(fill: white, size: 9pt, weight: "bold")[Why it matters]],
  ),
  badge(col-red, "P1"),
    [*Page 306940975846042* — fetch profile, posts, about section],
    [Dec 2024 activity in Ghaith's data *predates the target page*; may be a test-bed or linked prior operation by same operator],
  badge(col-red, "P1"),
    [*Profile 61557471317885* — Ghaith's anomalous "college" entry; find username, fetch full profile],
    [A personal profile listed as a college entry is a deliberate cross-account link; could expose a real operator identity],
  badge(col-red, "P1"),
    [*Instagram malak.almughrabi* — check public posts, tagged photos, bio links],
    [Current manager of 1.6M-follower page; may publicly reveal connections to Lebanese political or media network],
  badge(col-amber, "P2"),
    [*Hussan Chhab (61577225957303)* — extract creation date, city, work, education],
    [Second Day-1 commenter; if also post-Oct 7 and South Lebanon located, confirms coordinated persona pattern],
  badge(col-amber, "P2"),
    [*Page creation date* (target: 61585153052901) — try mobile API or JS-rendered scrape],
    [Critical timeline anchor: was the page created around Oct 7, 2023 alongside the linked entity?],
  badge(col-amber, "P2"),
    [*Entity 100610558804897* — fetch profile; found in work entity story_bucket],
    [May be a content co-creator or real associate of the operator],
  badge(col-blue, "P3"),
    [*Ad Library spend data* — estimate total USD spent; check payment method country],
    [Payment method country can differ from admin country; may reveal true operator location],
  badge(col-blue, "P3"),
    [*Arabic Telegram search* for hashtags #text(dir: rtl, lang: "ar")[#sym.hash لبنان_يتحرر] etc.],
    [IO operators often co-post to Telegram; the coordination channel may be discoverable],
  badge(col-blue, "P3"),
    [*Reverse-search reel thumbnails* (Google/TinEye) for video content reuse],
    [Recycled video from other operations = coordinated inauthentic behaviour; confirms IO network],
)

// ─────────────────────────────────────────────────────────────────────────────
//  8. GOOGLE FORM — ACTIVE HUMINT COLLECTION OPERATION  (CRITICAL NEW FINDING)
// ─────────────────────────────────────────────────────────────────────────────
= Google Form: Active HUMINT Collection

#callout(col-red, "⚠", "Critical Finding — Operational Significance Elevated")[
  The Google Form embedded in the target page *is not an engagement widget* — it is a *civilian informant
  recruitment and data collection apparatus* targeting Lebanese citizens with knowledge of Hezbollah/Iranian-linked
  military activity. This elevates the operation from pure influence operation to *active human intelligence
  (HUMINT) collection*.
]

== Form Content (Confirmed)

The following was retrieved from the form body without authentication (public-facing framing text):

#block(
  fill: rgb("#fff8f0"),
  inset: 12pt,
  radius: 4pt,
  stroke: 1pt + col-amber,
)[
  #text(dir: rtl, lang: "ar")[
    لبنان لازم يكون بلد سيادة وقانون. أي نشاط عسكري أو أمني مرتبط بقوى خارجية بيهدد استقرار البلد وأمن الناس.
    من خلال هالحملة، المواطن فيو يبلغ عن أي نشاط مشبوه بطريقة آمنة وسرية
  ]
  
  #v(4pt)
  _Translation:_ "Lebanon must be a country of sovereignty and law. Any military or security
  activity linked to foreign forces threatens the stability and security of the people. Through
  this campaign, citizens can report any suspicious activity in a *safe and confidential* way."
  
  #v(6pt)
  *Form fields:*
  - وصف الحدث (Description of the event) — *required*
  - المكان (Location) — *required*
  - صورة أو فيديو إذا متوفر (Photo or video if available) — up to 5 files, 100 MB each
]

== Technical Forensics

#table(
  columns: (auto, 1fr),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Short URL", "forms.gle/NWKZhXdnfzGFx1ae9 (created via Google Forms 'Send' button)"),
  ..kv("Access control", "Google sign-in required — respondent email address is harvested by form owner"),
  ..kv("Backend", "spreadsheet_forms cookie confirmed: responses stored in private Google Sheet"),
  ..kv("Wayback Machine", "No archive snapshots — never publicly indexed"),
  ..kv("Google Cache", "Not cached — not crawled by Google"),
  ..kv("UI language", "Arabic — consistent with Arabic-locale Google account owner"),
  ..kv("Media upload", "Up to 5 files × 100 MB — photos/video with potential GPS EXIF data"),
  ..kv("'Confidential' claim", "#text(fill: col-red)[FALSE] — Google sign-in means operator sees respondent email"),
)

== Intelligence Implications

#block(fill: rgb("#fff0f0"), inset: 10pt, radius: 4pt)[
*1. The Facebook page is a recruitment front, not merely a propaganda channel.*
The page's function is to build enough audience trust and anti-Hezbollah sentiment that
Lebanese citizens with observed Hezbollah/IRGC activity will submit reports via the form.

*2. The Google Sheet is an active intelligence database.*
Each form submission delivers: (a) informant identity (Google account email), (b) event
description in the informant's own words, (c) precise location, (d) photo/video evidence
potentially containing GPS EXIF metadata revealing exact coordinates of military activity.

*3. "Safe and confidential" is an active deception.*
Submitters believe their identity is protected. In fact their Google account email — and
through it their full Google identity — is visible to the form owner. This is a
*credentialed informant harvest*, not an anonymous tip line.

*4. EXIF data from uploaded photos/videos has direct military targeting value.*
High-resolution images of Hezbollah positions, weapons caches, or personnel, uploaded
by local civilians, carry embedded GPS coordinates. This is consistent with pre-targeting
intelligence collection methodology.
]

== Revised Attribution Implications

The scope of this operation — systematic civilian informant recruitment, location data
collection, and media harvest targeting Hezbollah — is *beyond the capability and motivation
of a simple IO shop or partisan media project.* This pattern is consistent with:

  #table(
  columns: (auto, 1fr, auto),
  stroke: 0.5pt + rgb("#e0e0e0"),
  table.header([*Actor*], [*Rationale*], [*Confidence*]),
  [Eastern European\ IO operator\ (Bulgaria/Russia)],
  [#text(weight: "bold")[META-CONFIRMED:] Target page admins Bulgaria (2) + Russia (1). Bulgaria = known click-farm/IO contractor hub, NATO member, plausible cutout layer. Russia = Syria/Lebanon interests, anti-Hezbollah narrative serves Moscow post-Syria. Eastern European commercial IO shops routinely hired by Gulf and Western state clients.],
  [*HIGH — execution layer*],
  [Israeli intelligence\ (Mossad / AMAN)],
  [HUMINT collection method (location + media + civilian informants targeting Hezbollah) is a Mossad/AMAN signature. Palestinian cover entity (سمن وعسل, +972 phone) consistent with Palestinian-Israeli intel collaboration. "Foreign forces" = standard Israeli framing. May be the *directing* client behind the Bulgarian/Russian execution layer.],
  [*MEDIUM-HIGH — possible client*],
  [Russian state\ (GRU / FSB)],
  [Bulgaria + Russia admin countries could indicate Russian state operation using Bulgarian VPS/contractors. Russia has active Lebanon IO interest (pro-Assad, anti-Hezbollah when useful). However, HUMINT collection against Hezbollah is more consistent with Israeli/Western goals.],
  [*MEDIUM — possible client*],
  [Saudi GIP / Gulf state],
  [Deep interest in degrading Hezbollah. Funded Lebanese media operations extensively. Gulf states regularly contract Eastern European IO firms. Palestinian subcontractors used historically.],
  [*MEDIUM — possible client*],
  [Lebanese Forces /\ March 14 diaspora],
  [Anti-Hezbollah motivation but lack HUMINT collection infrastructure. Would not produce Bulgarian/Russian admin layer.],
  [*LOW*],
)

#callout(col-red, "⚠", "Informant Protection Warning")[
  Any Lebanese citizen who submitted a report via this form believing it to be "safe and
  confidential" is at risk. Their Google account identity, location data, and media have
  been received by an unknown operator. If that operator is a foreign intelligence service,
  the informant may be subject to recruitment pressure, exposure, or if the data is
  compromised — physical risk from Hezbollah security elements.
]

// ─────────────────────────────────────────────────────────────────────────────
//  9. CONFIDENCE SUMMARY
// ─────────────────────────────────────────────────────────────────────────────
= Confidence Summary

== Inferred Operation Structure

Four-model consensus (second analytical review, March 2026) produced the following working model:

#block(
  fill: rgb("#f5f5f5"),
  inset: 12pt,
  radius: 4pt,
)[
  #text(font: "DejaVu Sans Mono", size: 8.5pt)[
    #set align(left)
    [CLIENT LAYER: Gulf-backed / Israeli intelligence / Lebanese political-financial sponsor]\
    #h(6mm)↓  briefing + funding + targeting requirements\
    [PLANNING LAYER: Lebanon-knowledgeable strategist + HUMINT tasking]\
    #h(6mm)   — Shia wedge targeting, LAF legitimacy cues, HUMINT collection design\
    #h(6mm)↓  execution tasking\
    [OPERATIONS LAYER: Palestinian digital marketers]\
    #h(6mm)   — page management, ad ops, account factory (semi-manual)\
    #h(6mm)↓  cover assets + HUMINT pipeline\
    [INFRASTRUCTURE: سمن وعسل (dormant 2021 PA page) + Ghaith/Hussan/Zolfekar socks\
    #h(12mm)  + Google Form → Google Sheet (informant database)]\
    #h(6mm)↓\
    [TARGET: Lebanese Shia audience — #text(dir: rtl, lang: "ar")[الشيعة تنتفض] wedge narrative\
    #h(8mm)  + Lebanese civilians reporting Hezbollah activity (HUMINT harvest)]
  ]
]

_Note: This is a working hypothesis, not confirmed structure. The client and planning layers are entirely inferred from content and targeting characteristics._

== High-Confidence Findings

#callout(col-green, "✓", "What we can state with high confidence")[
  + The page is a *professionally operated influence operation* — not a genuine grassroots movement.
  + It *deliberately continued running political content* despite four confirmed SIEP violation removals by Meta — the single strongest technical signal.
  + It *targets Lebanese Shia communities* with intra-Shia dissent messaging.
  + Day-1 commenter network contains accounts *consistent with IO-constructed Shia personas* (fresh accounts, Hezbollah-territory backstories, Shia-coded names) — requires verification.
]

== Confidence Scorecard

#table(
  columns: (1fr, auto),
  stroke: 0.5pt + rgb("#e0e0e0"),
  ..kv("Professional / institutional operator (not sole individual)", "HIGH      ■■■■□"),
  ..kv("Anti-Hezbollah political content confirmed", "HIGH      ■■■■□"),
  ..kv("Palestinian execution layer (cover entity admin)", "HIGH      ■■■■□ — Meta Page Transparency, +972 phone"),
  ..kv("Lebanon-specialist planning knowledge", "MEDIUM    ■■■□□ — inferred from targeting precision"),
  ..kv("Gulf-backed client / external funder", "LOW       ■□□□□ — content ≠ sponsorship proof"),
  ..kv("Lebanese-origin operator", "LOW       ■□□□□ — contradicted by Palestinian admin data"),
  ..kv("Ghaith Ali = IO persona (not authentic commenter)", "MEDIUM    ■■□□□ — strong circumstantial; unverified"),
  ..kv("Specific individual / firm identity", "LOW       ■□□□□"),
)

== Critical Path to Attribution

Three actions are co-equal top priorities:

+ *Page 306940975846042:* Appears in Ghaith Ali video metadata dated December 2024 — 14 months before the target page launched. If this is a prior IO page, it establishes Ghaith as a *reused operational asset* and identifies the operator's campaign timeline. This is the highest-value unexplored node in the network.

+ *+972 59-747-9787 phone ownership:* Publicly listed on سمن وعسل. Palestinian mobile. Cross-reference public directories, business registrations, and WhatsApp metadata. Most accessible high-yield action. Would link to a specific person or organization.

+ *Target page Page Transparency (A5):* #text(fill: rgb("#2e7d32"))[*RESOLVED 2026-03-17.*] Target page admins = *Bulgaria (2) + Russia (1)*. Palestinian admins belong exclusively to سمن وعسل (cover entity). Operation has two distinct admin layers: Russian/Bulgarian operators run the target page; Palestinian infrastructure holds the cover asset.

*Secondary:* Profile 61557471317885 (Ghaith's "college" anomaly — possible second controlled account). Creation dates for Hussan Chhab and Zolfekar Hjazi (if they cluster with Ghaith's Jan 4, 2026 creation date → confirms same factory batch).

#v(1.5cm)
#line(length: 100%, stroke: 0.5pt + rgb("#ccc"))
#v(0.25cm)
#text(size: 8pt, fill: rgb("#888"))[
  *Report generated:* March 17, 2026 #h(10pt)
  *Intelligence source:* Passive OSINT only — Facebook authenticated HTML, Ad Library, web search #h(10pt)
  *Classification:* UNCLASSIFIED / FOR INVESTIGATION USE ONLY #h(10pt)
  *Next refresh:* Upon extraction of P1 leads (§7)
]