Inside the $46.5 million Clock Tower X campaign to seed the online information environment with pro Israel narratives that search engines and artificial intelligence systems may retrieve, cite and eventually absorb
When somebody asks an artificial intelligence chatbot whether Israel is a good ally, whether its conduct in Gaza complies with international law, or whether reports of famine and civilian suffering can be trusted, the answer may appear to emerge from a neutral machine weighing the available evidence.
That impression is dangerously incomplete.
AI systems do not discover truth independently. They generate answers from information created by people, institutions, publishers, corporations and governments. Some systems draw upon material incorporated during training, while others search the live web and assemble a response from pages selected in real time. Both routes create opportunities for organised political influence.
An Israeli government funded campaign led by Clock Tower X, the company run by former Donald Trump campaign manager Brad Parscale, has been designed to exploit those opportunities. Its stated purpose is not simply to persuade human readers through conventional advertising. Publicly filed contracts explicitly call for the deployment of websites and content intended to produce what they describe as “GPT framing results” in chatbot conversations.
The scale of the programme was brought into sharper focus by a 28 July investigation by Nick Cleveland-Stout for Drop Site News, followed on 4 August by a video explainer from content creator Wally Rashid. Rashid said he learned search engine optimisation while building a website for a plant business he started after leaving medical school. Drawing upon that experience, he walked viewers through the mechanics of the operation and showed how apparently obscure websites can gain visibility with search engines and AI answer tools even when very few people visit them directly.
The technique is best understood as a campaign to alter the information environment around the machine. Clock Tower X cannot simply enter a control room at ChatGPT, Gemini, Copilot or Perplexity and rewrite an answer. It can, however, manufacture large quantities of searchable, machine readable and carefully framed material, increase the visibility of that material, and make it more likely that an AI system will encounter, retrieve or cite it.
That distinction matters, but it does not make the campaign less serious. It reveals a new frontier in state propaganda: the attempt to shape not only what people see on their screens, but what the systems answering their questions come to treat as credible knowledge.
The contract says plainly what the campaign is meant to do
Clock Tower X was contracted through Havas Media Germany, which was working on behalf of the State of Israel. In public filings made under the United States Foreign Agents Registration Act, the programme is formally described as a nationwide campaign to combat antisemitism.
The operational details go considerably further.
The Clock Tower X statement of work filed with the US Department of Justice required at least 100 original creative assets each month, 5,000 monthly variants, monthly search engine optimisation campaigns using the Market Brew AI platform, and at least 20 new pages a month targeting priority search terms. Eighty per cent of the content was to be tailored to Generation Z, while paid media was expected to deliver at least 50 million impressions every month.
Among the listed deliverables was one unusually candid line: “Deployment of websites and content to deliver GPT framing results on GPT conversations.”
The initial arrangement provided $1.5 million a month for four months, or $6 million, before an additional $3 million was added to the budget. By June 2026, a further FARA filing listed digital advertising charges of $4.5 million a month from April through October. Drop Site and the Quincy Institute’s wider investigation into Israel’s influence spending put the full Clock Tower X engagement at $46.5 million, making it the largest active Israeli contract disclosed under FARA.
The money covers a much broader campaign than AI influence alone. The contracts include audience research, narrative testing, creative production, advertising, distribution, conservative media integration, data analysis and performance reporting. It would therefore be inaccurate to say that Israel paid $46.5 million solely to alter chatbot answers. It is accurate to say that influencing search and generative AI responses is an explicit part of a wider $46.5 million communications operation.
A network whose most important readers may be machines
Drop Site identified ten websites in what it called the Clock Tower network. Each presents itself as an information or educational resource, and each concentrates on a distinct element of the Israeli government’s preferred narrative. Its Common Crawl review produced the following snapshot for January through June 2026:
| Website | Principal theme identified by Drop Site | Common Crawl captures reported |
|---|---|---|
| PaxPoint | Israel as a nation committed to peace | 220 |
| Allyvia | Strategic, economic and military value of the US and Israel relationship | 158 |
| FactSignal | Rebuttal of what it calls anti Israel misinformation | 108 |
| Cognitura | Hamas, terrorism and extremist organisations | 106 |
| Justorium | Claims that Israeli military conduct complies with international law | 93 |
| Culturavia | Cultural connections between Israel and the United States | 76 |
| Compassion Pulse | Israeli humanitarianism and civilian protection | 57 |
| Econora | Trade and economic ties | 49 |
| InnovaScope | Technology and innovation partnerships | 45 |
| Feeding You Fiction | Claims that footage and accounts from Gaza are staged or misleading | 1 |
The sites carry the disclosure required of foreign informational material. At the foot of an Allyvia article, for example, readers are told that the material is distributed by Clock Tower X on behalf of the State of Israel and that further information is available from the Department of Justice.
The problem is that an AI system may extract a paragraph, a bullet point or a conclusion without reproducing that disclosure. A user can therefore receive the substance of a state funded argument without being told who commissioned the source.
Drop Site reported that when it asked chatbots about recent material on PaxPoint, Perplexity and Microsoft Copilot did not alert the user to the Israeli government connection, although Claude, ChatGPT and Gemini did. In another test, Perplexity answered “Yes” when asked whether closer military cooperation with Israel would benefit the United States, and listed Allyvia as its leading source. Copilot also cited pages from the Clock Tower network.
Those tests do not prove that every answer from those systems has been altered, and results can change with time, wording, location, product settings and updates to a search index. They do establish the essential point: the campaign’s pages are eligible to be found and cited by widely used AI tools.
The first route into an AI answer: real time search
The most immediate mechanism is retrieval.
Many modern chatbots can search the web while answering a question. The system translates the user’s prompt into one or more searches, retrieves pages that appear relevant, selects passages and then uses those passages to construct a response. The model is not necessarily recalling the material from its original training. It may be reading it moments before answering.
This creates a new contest sometimes called generative engine optimisation, or GEO. Traditional search engine optimisation attempts to make a page rank prominently in Google or Bing. GEO attempts to make information easy for an AI answer engine to locate, parse, quote and synthesise.
Wally Rashid’s explainer focused on the structure of Allyvia articles. Pages use descriptive headlines, frequent subheadings, “Key Takeaways” sections, short declarative claims, question and answer sections, bullet points and lists of references. An article entitled “The Unsinkable Aircraft Carrier: Why Israel Has Become America’s Most Important Strategic Ally,” for example, is built around phrases likely to match questions about whether Israel benefits American security.
Another Allyvia article about moving “from aid to alliance” contains a frequently asked question using almost the exact form a chatbot user might type: “How will technology collaboration between the U.S. and Israel benefit both nations?” It then provides a compact list of asserted benefits involving missile defence, cyber security, employment and research investment.
That does not mean a heading automatically overrides an AI system’s judgement. Search and answer engines use complex and largely undisclosed ranking systems. Yet clear HTML, direct topical language and passages that answer foreseeable questions make a page easier to crawl and retrieve. Clock Tower’s own technology partner, Market Brew, told Axios that tightly organised, sourced material written in a factual tone was more likely to become eligible for inclusion in AI answers. Axios reported in April that the team had created websites designed around how AI platforms select information and had tested the approach using a simulated AI system.
During his video demonstration, Rashid used the third party Semrush platform to examine Allyvia’s visibility. He said the domain’s search presence had risen steeply since May, that it was ranking for more than 800 search terms, and that Semrush recorded appearances in answers from several AI services. He also found an Allyvia result while searching Google for terms related to an Israel alliance. These are point in time estimates from an optimisation platform rather than internal data from Google or the chatbot companies, but they support his central observation that the site was moving from obscurity into machine discovery systems.
The method is subtle because the content does not need to persuade the chatbot in any human sense. It needs to appear relevant to the query and usable as evidence. If the model is asked for competing views, even a partisan page can enter the response as one side of the debate. If the system does not adequately assess ownership and provenance, foreign government messaging can be flattened into the same category as independent research.
The second route: search authority, links and an artificial ecosystem
Publishing a page is not enough. A new domain with no reputation, no inbound links and little history may never rank highly enough to be retrieved. The campaign therefore also needs signals that make its sites appear established and relevant.
Rashid highlighted backlinks, meaning links from other sites pointing towards the Clock Tower network. Search engines have historically treated links as one of many signals that a page may carry authority. Modern systems also examine the relevance and quality of those links and try to detect manipulative link schemes, but acquiring mentions on older or more visible domains can still increase discovery.
One example is an April 2026 article published by TechBullion, credited to James Andrew. The article discusses the decline in American support for Israel and repeatedly presents Allyvia as an organisation working to fill an information gap. It links directly to the site.
Rashid argued that this was a paid placement designed to strengthen Allyvia’s search authority. The link undeniably performs that technical function, but the public article does not establish who commissioned it or whether money changed hands. Without a contract, invoice, disclosure or confirmation from those involved, the allegation of payment should be treated as Rashid’s interpretation rather than a verified fact.
The wider strategy does not depend upon any single backlink. A group of related websites can cite one another, publish around the same cluster of keywords and attract links through advertising, outreach, syndication and media placement. In Rashid’s description, the result resembles a spider’s web: a manufactured ecosystem that can create the appearance that multiple independent sources are reinforcing the same conclusion.
Search companies say they actively fight such manipulation. Google explains that its crawlers discover and index pages automatically, while its ranking and spam systems attempt to distinguish helpful material from content created primarily to game visibility. Those defences are important, although the Clock Tower campaign illustrates the difficulty of identifying politically motivated material that is polished, sourced and legally disclosed, but constructed to advance a government narrative.
The third route: entry into future training data
The slower and potentially more durable route runs through the datasets used to train later generations of language models.
Large models are commonly trained on enormous collections of text assembled from books, code, reference material, licensed data and the open web. One important web archive is Common Crawl, a nonprofit repository containing hundreds of billions of pages. Common Crawl material is filtered, deduplicated and processed before model training, and not every archived page reaches a final model. Nevertheless, its collections have formed a major component of many influential training datasets.
Drop Site reported that the ten Clock Tower sites appeared 912 times in Common Crawl snapshots between January and June 2026. The rate increased from two captures in January to 376 in May, and Drop Site said it manually checked a sample of 50 archived addresses without finding errors. Across roughly 900 identifiable pages and other pathways in the network, it calculated an archive rate of about 85 per cent.
That is evidence that the material has entered a widely used data reservoir. It is not proof that the material has been included in the private training set of ChatGPT, Gemini, Claude, Copilot or any other particular product.
The distinction is confirmed by an April 2026 study from the Atlantic Council’s Digital Forensic Research Lab. Studying Russian and Chinese influence networks, the researchers found that inclusion in Common Crawl did not guarantee ingestion by a model because developers apply their own filtering, quality scoring and deduplication. Even attempts to reproduce memorised text cannot reconstruct a proprietary training dataset with certainty.
Drop Site’s own tests reached a mixed conclusion. Its investigators found indications that material from the Clock Tower network could be reproduced or surfaced by Gemini and Copilot, with some indication of ingestion by Perplexity. They did not find comparable evidence that Claude or ChatGPT had been trained on those sites, although both could locate the pages through live web search.
This is why the phrase “training ChatGPT to be pro Israel” should be used with care. The campaign is openly trying to influence the sources available to AI systems, and some systems have cited its pages. There is no evidence that Israel or Clock Tower has access to the internal training process of OpenAI, Google, Microsoft, Anthropic or Perplexity, nor that any of those companies agreed to modify its model on Israel’s behalf.
Is this really “LLM poisoning”?
Critics describe the operation as large language model poisoning because it deliberately introduces strategically framed material into an environment used by AI systems. The phrase conveys the seriousness of attempting to corrupt the informational inputs upon which automated answers depend.
In computer security research, however, data poisoning has a narrower meaning. It usually involves manipulating training data to trigger a defined harmful behaviour. An October 2025 study by Anthropic, the UK AI Security Institute and the Alan Turing Institute found that as few as 250 malicious documents could implant a simple backdoor in experimental models ranging from 600 million to 13 billion parameters.
That research is relevant because it demonstrates that a comparatively small number of carefully constructed documents can matter. It does not prove that several hundred political articles will make a frontier chatbot adopt a particular view of Gaza. Anthropic’s test involved a controlled trigger designed to make a model produce gibberish, not the far more diffuse task of altering its political judgement. The researchers themselves warned that it was unclear whether the result would extend to larger models or more complex behaviour.
A more precise description of Clock Tower’s public method is state funded generative engine optimisation combined with an attempt to influence future training corpora. “Poisoning” is a defensible critical characterisation, but it should not be mistaken for proof that a specific model has been technically compromised.
Why measured language may be more effective than crude propaganda
The network’s material often looks less like a slogan and more like a policy explainer. This is part of its strength.
Drop Site quoted Alice Lee of NewsGuard, who observed that the sites use bullet points, summaries, extensive sourcing and digestible presentation, all features likely to make passages attractive to AI retrieval systems. Hervé Letoqueux of the disinformation research organisation Check First said that a softer approach can exploit the tendency of chatbots to present a balanced answer. A partisan claim wrapped in moderate language can be repeated as a legitimate alternative interpretation even when the underlying issue involves disputed facts or profound asymmetries in evidence.
This is particularly important for questions that cannot be filtered through a simple true or false test. Whether an alliance is “beneficial,” whether military conduct is “proportionate,” or whether a state has gone “above and beyond” its legal obligations all involve framing, selection and judgement. As Lee told Drop Site, it is harder to build guardrails around opinion.
The network can therefore acknowledge limited criticism, cite recognised institutions and then guide the reader towards its desired conclusion. The appearance of nuance may make the source seem more credible to both human readers and automated systems than material that reads like an official government statement.
The disclosure exists, but the machine may leave it behind
FARA provides the public with a paper trail. The Clock Tower sites disclose their relationship with the State of Israel, and the contracts reveal goals, budgets and deliverables that would otherwise remain hidden.
Yet disclosure at the bottom of a webpage is not the same as disclosure inside an AI answer. When a chatbot extracts a few relevant paragraphs, the ownership statement may be outside the selected passage. When a model paraphrases material learned during training, the user may receive no source at all. Once a narrative is absorbed into the statistical patterns of a model, its institutional origin can become almost impossible to identify.
The remedy is not to ban governments or advocacy groups from publishing their case. The problem is undisclosed provenance at the moment an answer is delivered. AI companies should identify state funded sources prominently, incorporate ownership into ranking and citation systems, preserve foreign agent disclosures when summarising pages, and give users a clear view of why a particular source was selected.
They should also audit politically sensitive training data, maintain blocklists and provenance records for documented influence networks, test whether networks of related domains are being counted as independent corroboration, and publish meaningful transparency reports about state sponsored attempts to shape model outputs.
Wally Rashid’s warning and the unequal contest for visibility
Rashid approached the story partly through his own project, VoteLog, which records US congressional action and politicians’ voting histories on Israel. He explained that a small independent publisher can optimise headings, organise data for crawlers and contact journalists, but it cannot easily match a state backed operation with millions of dollars for advertising, content, technical optimisation and distribution.
His broader appeal was for journalists, researchers and independent publishers to make reliable evidence easier to find and cite. That does not mean imitating a propaganda network or flooding the web with repetitive claims. It means publishing primary documentation, using clear descriptions, maintaining accessible archives, linking to high quality independent research and ensuring that accurate material is technically available to search and AI systems.
The comparison exposes the structural issue at the heart of the story. AI answers may feel frictionless, but the information market behind them is not equal. Visibility can be purchased, engineered and repeated. A government with a $46.5 million communications contract can create more pages, conduct more tests, obtain more distribution and adapt faster than an independent researcher working alone.
The danger is not that one Allyvia page will suddenly command every chatbot to praise Israel. It is cumulative. If enough strategically written pages enter search indexes, receive links, appear in retrieved answers and survive into future training datasets, they may gradually influence which arguments a machine presents, which facts it foregrounds and which sources it treats as representative.
That is the real answer to the question posed by Rashid. Israel is not directly programming the world’s leading chatbots. Through Clock Tower X, it is attempting to program the environment from which those chatbots learn and retrieve information.
In the age of generative AI, power increasingly belongs not only to those who control the message, but to those who can make their message easiest for the machine to find.
Sources and attribution
This feature is based on the transcript of Wally Rashid’s video, “What Exactly Does Israel Do To Influence AI Bot Responses?”, published on 4 August 2026, and gives primary investigative credit to Nick Cleveland-Stout’s reporting for Drop Site News and the Quincy Institute. Financial and contractual details were checked against public FARA filings. Claims about individual payments or undisclosed sponsorship were excluded or explicitly attributed where the available evidence did not independently establish them.