By Kevin Nguyen and Michael Workman, ABC Investigations
Sydney university student Benjamin Cohen was falsely accused of the Bondi Junction stabbings. Photo: Supplied/Facebook
For 14 hours over the weekend, Sydney university student Ben Cohen was one of the most reviled men on the internet after he was falsely accused of being the knifeman who went on a stabbing rampage in a Sydney shopping centre, killing six people.
The ABC has pieced together how anti-semitic and pro-Kremlin accounts turned Cohen into an internet villain.
The trail was uncovered using social media analysis, datasets provided by disinformation experts, archives provided by anti-fascist research group the White Rose Society, as well as interviews with Cohen, his family and the accounts spreading false claims about him.
"It's extremely disappointing to see thousands of people mindlessly propagating misinformation without even the slightest thought put to fact-checking or real-life consequences," Cohen told the ABC.
"And then using that information to push an agenda and spread hatred."
Here's how the falsehoods - later amplified by 7 News, which has since blamed "human error" for its role in spreading misinformation - unfolded.
Saturday
4:30pm
NSW Police confirms it has received multiple reports of people being stabbed at the Westfield shopping centre at Bondi Junction, in Sydney's east.
Images of an unidentified man in a green Australian Kangaroos jersey roaming the centre with a knife start circulating online.
He is shot dead by a senior police officer and video is published on social media of his body on the floor outside a tailoring shop.
Images of the attacker, later identified as 40-year-old Joel Cauchi, started circulating online on Saturday afternoon. In this screenshot from a video posted online, a man - later identified as Damien Guerot - fends him off with a bollard. Photo: Screenshot
Over the next hour, many accounts on X (formerly known as Twitter) post blurry photos of the offender online, falsely claiming he is of Middle Eastern heritage and accusing him of being an Islamic jihadist.
5:43pm
Pro-Putin influencer Simeon Boikov, who goes by the moniker Aussie Cossack, posts that "Jimmy the Junkie" - a character from the television show Housos - is responsible.
Boikov has been hiding inside the Russian consulate in Sydney for more than a year to avoid an arrest warrant for alleged assault. He has requested political asylum to live in Russia.
A dataset analysis provided to ABC Investigations by Marc Owen Jones, a digital disinformation expert from Qatar's Hamad Bin Khalifa University, reveals Boikov was one of the key figures spreading Cohen's name in relation to the attack.
6:19pm
NSW Police Assistant Commissioner Anthony Cooke tells a press conference that authorities have not confirmed the identity of the killer.
"I do not have information in relation to the offender," he says. "I do not know at this stage who he is."
6:59pm
An account called "Sonny Dan", which has 37 followers and has a history of reposting anti-Jewish images and content from self-described misogynist Andrew Tate, makes a false and racist claim.
"Unconfirmed report- Terror attack in Bondi. Terrorist name is BENJAMIN COHEN. A radical Jew from Bondi Sydney," the account posts.
"Only a Jew would stab a baby. Making sense now."
The account did not respond to the ABC's questions.
Jones, who is forensically examining the false claims around the Bondi attack, says there are several signs that "Sonny Dan" was part of a broader propaganda operation, which typically uses unknown accounts to give desired political outcomes the "veneer of an authentic grassroots" effort.
These indicators included the account's low follower count, lack of authentic connection to any location, and a limited post history.
"Random anonymous accounts are sometimes set up for the purposes of implementing influence operations," Jones says.
"[An entity] starts seeding the narrative through these burner accounts then have them picked up by large accounts."
7:20pm
Benjamin Cohen is mentioned as a "Jew extremist" by a second account with fewer than 90 followers called "wasted_97", without any evidence.
7:32pm
A third account with fewer than 100 followers named AnonEx19 repeats the claim that the attacker is Jewish claiming, without evidence, that "police sources say it was a Jew" named Benjamin Cohen.
8:08pm
Julia Hartley-Brewer, a conservative British radio broadcaster, posts a tweet attributing the attack to "another Islamic terrorist". The tweet is viewed more than nine million times.
In response, dozens of accounts, many of which are verified on X, respond by falsely claiming "Ben Cohen" is the real culprit.
Hartley-Brewer issues an apology a day later, saying she did not correct her mistake earlier because she was "busy".
Photo: Supplied/X
10:03pm
Simeon Boikov falsely claims that NSW Police Commissioner Karen Webb has confirmed "Jimmy the Junkie" as the killer. He mocks pro-Israeli accounts for falsely claiming the killer was a Muslim.
Around this time, Cohen says he notices his name has been mentioned a few times online, but he isn't concerned.
10:05pm
An Australian pro-Palestinian account tweets at Boikov, claiming there are "unconfirmed reports" that the assailant is a "radical Jew from the local area" named Benjamin Cohen.
10:30pm
Late Saturday evening, the Benjamin Cohen theory goes viral.
Simeon Boikov posts to his Telegram followers: "The Sydney Bondi mall attacker has been identified by our subscribers as Benjamin Cohen."
He says he is "awaiting confirmation" and then, in coded anti-semitic language, questions the ethnic origin of the name "Cohen".
10:51pm
Boikov posts a screenshot of Ben Cohen's Linkedin.
"Unconfirmed reports identify the Bondi attacker as Benjamin Cohen," he writes.
11:00pm
In a post viewed more than 400,000 times, Boikov cites "unconfirmed reports" that Benjamin Cohen is the attacker.
"Cohen? Really? And to think so many commentators tried to initially blame Muslims."
Jones, who has analysed thousands of X posts about the Bondi attack, singles out this tweet as the moment when the name "Benjamin Cohen" goes from obscure to the global stage.
According to data Jones shared with ABC Investigations, the mentions of Benjamin Cohen in relation to the Bondi attack suddenly took off after Boikov posted this tweet.
11:03pm
Boikov posts to his Telegram followers about an "unconfirmed report about the real identity" of the Bondi attacker.
He then names "David B. Irvine" as the potential attacker and posts a photo of a bearded man. ABC Investigations has traced the photo shared by Boikov to a picture on a porn site. It is unclear who the man is.
11:16pm
Boikov again posts an image of Cohen's Linkedin on his Telegram, which includes details of his workplace and where he studies.
This time he includes Cohen's page next to a photo of the real Bondi killer, Joel Cauchi.
"What do the experts in the comments section think? Is it Ben Cohen?," he asks his 62,000 followers.
"Why don't the NSW Police just release his name to stop the public speculation?"
11:26pm
Maram Susli, a Syrian-Australian conspiracy theorist that goes by "partisangirl" retweets Boikov's mention of Benjamin Cohen.
"If this is true it would explain why I thought he looked Israeli," she says in a now-deleted tweet.
11:40pm
Boikov posts photos of Cohen and Cauchi side by side again and accuses NSW Police of intentionally withholding the killer's identity. He makes the same post to his Telegram.
"He might not be Benjamin Cohen but he certainly looks like him! What do the experts in the comments section say?"
Cohen told ABC Investigations that at this point he began receiving "thousands" of connection requests on Linkedin, adding he was relieved that his social media accounts were already set to private before the attack.
Sunday: 'It didn't blow over'
Overnight, several far-right and white supremacist personalities in Australia and worldwide start sharing Cohen's photo and name. Earlier in the day, many of these accounts had falsely claimed the attacker was Muslim.
According to anti-fascist research group the White Rose Society's analysis of activity on X, the mentions of Benjamin Cohen went from 125, to more than 72,000 mentions. Many of these mentions were those trying to debunk the false claim.
"Benjamin Cohen" begins to trend on Twitter.
Cohen recalled waking his mother around 1am on Sunday and telling her he was concerned about how fast his name and photo was circulating online.
"I was really hoping it would blow over in the morning. It didn't," Cohen says.
1:11am
A pro-Kremlin account with 220,000 followers on X posts that it was "being reported that the Bondi attacker could be Benjamin Cohen!" while posting a photo of his Linkedin.
This tweet from a pro-Kremlin account accusing Benjamin Cohen of the Bondi Junction stabbings received more than 250,000 views. Photo: Supplied/X
3:00am
Matt Wallace, a far-right influencer and cryptocurrency personality, shares the false theory that Benjamin Cohen is the killer. According to X's own statistics, his post is viewed more than six million times.
6:15am
The Benjamin Cohen theory breaks into the mainstream.
In now-deleted videos and articles, 7 News names "Benjamin Cohen" as the "40-year-old lone wolf attacker". Shortly after, screenshots of the report naming Benjamin Cohen are widely shared, with those claiming the brief mention is confirmation of both an anti-semitic conspiracy to suppress the real killer's identity and evidence of Zionist links to a mass casualty event.
The 7 News report misidentifying Cohen as the attacker is also embedded in overseas media reports on the attack.
7 News has previously come under fire for misidentifying the wrong suspect. In 2021 it was forced to apologise to Nyamal man Terrance Flowers after incorrectly broadcasting his photo in a news report about the abduction of Cleo Smith in Western Australia.
A WA judge later ruled in favour of Flowers in a defamation case against the broadcaster, which was ordered to pay a confidential amount.
6:58am
Ben Cohen's father Mark Cohen goes online to begin defending his son from false accusations and anti-semitic abuse. Over the next few hours he sends out two dozen tweets, trying to refute the claims.
Mark later tells ABC Investigations he initially assumed the screenshot of the 7 News article naming his son was fake or photoshopped. He said he couldn't find the original reference on 7 News' articles or on YouTube (it had been changed by this point).
"Also, why would 7 News have something that the NSW Police had not confirmed yet?" Mark Cohen says.
8:16am
Sulsi (partisangirl) tweets screenshots and links to the 7 News online article and Sunrise broadcast that named Benjamin Cohen as the Bondi attacker, commenting:
"BONDI ATTACKER WAS JEWISH, NAME CONFIRMED AS BENJAMIN COHEN"
Meanwhile, other Twitter users continue to circulate the screenshot of the 7 News article wrongly naming Benjamin Cohen as the killer.
8:38am
NSW Police confirm the identity of the Bondi killer as Joel Cauchi, a 40-year-old man from Queensland.
8:45am
Susli (partisangirl), who earlier gloated she was right for saying the attacker "looked Israeli", questions why 7 News has removed its mentions of Benjamin Cohen from its YouTube description.
9:12am
Boikov posts on Telegram that police have formally identified Joel Cauchi as the real killer. He issues an apology to everyone he suggested might be the attacker.
"Previous unconfirmed reports speculating the possible identity of the man as David Irvine or Ben Cohen were not confirmed. Apologies."
9:28am
The Twitter account that was the first to misname Benjamin Cohen as the attacker shared a screenshot of a 7 News report naming Benjamin with the caption:
"CONFIRMED HE WAS A JEW!!!"
9:35am
Around this time, 7 News removes the online article and video that mentioned Benjamin Cohen.
10:12am
A 7 News spokesman responds to ABC Investigations questions about its reporting of Benjamin Cohen.
"The mistake was human error and it has been rectified. Seven sincerely apologises for the error."
The spokesman does not answer questions about where it sourced the name Benjamin Cohen, what verification process it undertook, or if it had been in contact with Cohen's family.
Senior analyst for extremist research think tank Institute for Strategic Dialogue (ISD), Elise Thomas, says there had been a personal and professional risk to Cohen's safety.
"There was a very serious risk to his personal safety and to him receiving personal harassment," Ms Thomas says.
"7 News has not covered themselves in glory ... and there are also a lot of people who jumped on this who should have known better."
She says the saga demonstrated how much X had become a "cesspool" and an "engine for harassment".
12:29pm
Cohen gives his first media interview, telling news.com.au it has been a "hectic night and morning".
"People don't really think too hard about what they're posting and how it might affect someone. It's very dangerous how people could just make stuff up and destroy people's lives," Ben tells news.com.au.
His father, Mark Cohen, said his family had been inundated with calls from loved ones:
"Everyone's asking what's going on, people asking if it's true. Of course it's not true, he's not even a politically motivated person. He's just a normal kid who now has got to deal with this," Mark said.
6:24pm
When ABC Investigations calls Boikov for comment, he records the conversation and later posts snippets of it online.
He defends himself as an "independent journalist", arguing his reporting was responsible because he used the word "unconfirmed" when referring to Cohen and David Irvine. He says he merely observed the "swirling speculation" he saw.
While he did eventually apologise to Cohen and others, he deflected responsibility to the NSW Police for not publicly identifying Joel Cauchi earlier.
Boikov posted a recording of his interview with ABC journalist Kevin Nguyen online. Photo: Supplied/X
Musli is also a party to the call between Mr Boikov and the ABC.
The ABC has contacted her for comment separately. This morning she tweeted that she was just reposting what was reported by 7 News.
"The truth is I made the mistake of trusting the mainstream media," she said in a lengthy post on X.
"I am truly sorry for this error and any hurt it may have caused. I didn't mean to spread incorrect information, but I was deceived like thousands of Australians by Channel 7 News who owe Benjamin Cohen an apology."
8:27pm
Ben Cohen and his father Mark speak with ABC Investigations about their ordeal.
The family say 7 News had contacted them to apologise, explaining that a junior social media editor had made the error.
Benjamin's father Mark Cohen characterises 7 News' response to the family as subpar, telling the ABC "they haven't measured up on any front".
He says the 7 News report gave others the confidence to regurgitate the falsehoods online, evident by how regularly a screenshot from their website was shared to name his son.
"The blast radius is absolutely immense from what they did," he says.
The Cohen family say Boikov was yet to contact them.
While the exact reason for Ben's name first entering the online discourse remains unconfirmed, the Cohens believe the name being Jewish was no accident.
"I think there's just a very clear agenda being shown, you know?" Ben says.
"I would look at the messages and the words they used before I would even entertain the idea that it was just an unfortunate name," Mark says.
The Cohens say they are still deciding whether to pursue legal action.
Where to get help:
Need to Talk? Free call or text 1737 any time to speak to a trained counsellor, for any reason.
Lifeline: 0800 543 354 or text HELP to 4357
Suicide Crisis Helpline: 0508 828 865 / 0508 TAUTOKO (24/7). This is a service for people who may be thinking about suicide, or those who are concerned about family or friends.
Depression Helpline: 0800 111 757 (24/7) or text 4202
Samaritans: 0800 726 666 (24/7)
Youthline: 0800 376 633 (24/7) or free text 234 (8am-12am), or email talk@youthline.co.nz
What's Up: free counselling for 5 to 19 years old, online chat 11am-10.30pm 7days/week or free phone 0800 WHATSUP / 0800 9428 787 11am-11pm Asian Family Services: 0800 862 342 Monday to Friday 9am to 8pm or text 832 Monday to Friday 9am - 5pm. Languages spoken: Mandarin, Cantonese, Korean, Vietnamese, Thai, Japanese, Hindi, Gujarati, Marathi and English.
Rural Support Trust Helpline: 0800 787 254
Healthline: 0800 611 116
Rainbow Youth: (09) 376 4155
OUTLine: 0800 688 5463 (6pm-9pm)
If it is an emergency and you feel like you or someone else is at risk, call 111.
This story was originally published by the ABC.