Anyone Can Spoof Israeli Government Emails, and a Cat-Picture Prank Just Proved It
A security researcher received emails appearing to come from official Mossad addresses demanding cat pictures - sent without breaching any server, simply by exploiting the absence of basic email authentication that Israeli government agencies were warned to fix nine years ago.
A security researcher received emails appearing to come from Mossad addresses - demanding cat pictures. No servers were breached; the sender simply exploited missing email authentication that officials were warned about nine years ago. Apparently the to-do list is very long.
Should government agencies face penalties for ignoring basic email security standards?
- Yes
- No opinion
- No
Email spoofing - forging the sender address of a message to impersonate a trusted organization - is one of the most common tools in phishing and social-engineering attacks. Defending against it is technically straightforward: standards such as SPF, DKIM, and DMARC allow mail servers to verify that a message genuinely came from the domain it claims to represent. According to Haaretz (EN), Israeli government agencies were officially warned about this gap nine years ago and have still not consistently implemented these protections. The cat-picture prank directed at a security researcher caused no classified breach, but it demonstrated that anyone with basic technical knowledge could send convincing emails appearing to originate from the Mossad or other sensitive state addresses. The practical risk goes well beyond pranks: the same technique could be used to trick government employees, contractors, journalists, or members of the public into acting on fraudulent instructions. Supporters of penalties for non-compliant agencies argue that voluntary guidelines clearly have not worked and that accountability is needed to force action. Opponents may argue that enforcement mechanisms add bureaucratic complexity, that agencies face competing resource pressures, or that regulation is a blunt instrument for what is ultimately a technical operations problem. The question of who bears responsibility - individual agencies, central IT authorities, or political leadership - is also unresolved.
Answering yes means you believe that financial, administrative, or other formal penalties are a necessary and proportionate tool to compel government agencies to adopt email authentication standards they have long been advised to implement. Answering no means you think penalties are the wrong approach - perhaps because you favor incentives, centralized mandates, or technical assistance over punishment, or because you doubt enforcement would be effective. The poll is trying to surface whether the public sees negligence on a security standard as something that should carry real consequences.