German intelligence agencies discuss ongoing espionage and hybrid challenges

Conference AgendaTHE 5TH SYMPOSIUM ON the Law of Intelligence Services (Symposium zum Recht der Nachrichtendienste) took place in Berlin, Germany, on March 21-22. In view of the public criticism that German intelligence agencies have faced in recent times, it was probably a relief for their officials to be able to talk more-or-less among themselves for once.

The event (see agenda in .pdf) was organized by the Federal Ministry of the Interior and the Federal Chancellery Office. This year’s topic was: “Intelligence Agencies and Armed Conflicts”. It included the tried and tested mix of academics —predominantly legal scholars—, practitioners and heads of various government authorities. The majority of the external experts discussed the complicated and, in Germany, arduous parliamentary procedures that would arise in the event of a war.

In view of the controls increasingly being placed on German intelligence agencies by various bodies and authorities —which were also represented at the symposium— a certain discrepancy became apparent repeatedly in the presentations: How can the German intelligence agencies react adequately and quickly to hybrid threats when these types of threat do not concern themselves with administrative-legal subtleties and parliamentary procedures? Although the concept of hybrid threats was generally taken for granted and therefore hardly discussed in terms of content, those present agreed at a minimum that disinformation is part of it. All the more worrying was the statement by one speaker who explained that there was no official definition of disinformation within the German security authorities’ legal codes.

In the discussion, the panel moderated by Center for Intelligence Service Training and Further Education (ZNAF), the common training and study location of the Federal Intelligence Service (BND) and the Federal Office for the Protection of the Constitution (BfV), clearly stood out and underscored that this relatively new institution has made a name for itself in the academic intelligence landscape since its establishment in 2019.

However, the symposium also showed that the German security bureaucracy tends to reach its limits when it comes to current developments in the unconventional domain. This was demonstrated, for example, by a speaker’s demand that hybrid risks ought to be assigned to a “state area of responsibility”. The problem, however, lies precisely in the statelessness of hybrid risks. The existing regulations are also proving to be counterproductive, in view of the challenges: there would simply be highly heterogeneous participants in the so-called Cyber Defense Centre, which would also include police authorities. However, due to the strict separation in the legal domain, personal data cannot simply be passed on from the BND to the Federal Police, for example. Read more of this post

Tradecraft observations on the Reichenbach/Fischer espionage case

Germany ReichstagSEVERAL CASES OF CHINESE espionage have been announced recently in Europe. Thomas Reichenbach and Herwig and Ina Fischer —a married couple— were arrested on April 22, 2024, for illegal exports of dual use technology with military (naval) applications.

Reichenbach lists himself as a contract marketing manager for the Hong Kong Trade Development Council. He studied at Peking University in the mid-1980s. He worked in China, speaks Mandarin, and has a Chinese wife.

Herwig and Ina Fischer own a small engineering consulting company named Innovative Dragon in Duesseldorf. Both have travelled extensively in China. Innovative Dragon contracts for technical research with universities. Herwig studied mechanical engineering and aircraft and spacecraft construction at the Rhine-Westphalia Higher Technical School, focusing on guidance technology and composite fiber materials. The company headquarters are in London and there are offices in Duesseldorf and Shanghai (Donghua University Science and Technology Park). The London office does not appear to have a functioning telephone number.

Reichenbach is suspected of having been recruited by the Ministry of State Security (MSS) in China. The German government has accused the trio of having illegally exported dual use technology since at least 2022. At the time of the arrests, the suspects were in negotiations on additional research projects useful for expanding the combat strength of the Chinese People’s Liberation Army Navy.

Status: Alleged

Tradecraft observations:

  1. Use of a potential front company in London to facilitate allegedly illegal exports.
  2. Use of third countries to facilitate allegedly illegal exports.
  3. Reichenbach allegedly recruited Herwig and Ina Fischer and handled them as in-country assets.
  4. It is alleged that the MSS probably recruited Reichenbach in China.
  5. An MSS officer allegedly handled Reichenbach from China (linear control).
  6. The MSS allegedly funded the operation through front companies.

Author: Nicholas Eftimiades* | Date: 03 May 2024 | Permalink

* Nicholas Eftimiades is a Senior Fellow at the Atlantic Council. He retired from a 34-year government career that included employment in the United States Central Intelligence Agency, the Department of State, and the Defense Intelligence Agency. He held appointments on the Department of Defense’s Defense Science Board and the Economic Security Subcommittee of the Department of Homeland Security’s Homeland Security Advisory Council. He is an advisor to the United States Intelligence Community. Eftimiades authored numerous works on China’s espionage methods. His books, Chinese Intelligence Operations (1994) and Chinese Espionage: Operations and Tactics (2020) are examinations of the structure, operations, and methodology of China’s intelligence services. They are widely regarded as seminal works in the field.

Notes on the assassination of Iranian IRGC Commander Hassan Mahdawi

IRGC - ABTHE TARGETED KILLING OF Hassan Mahdawi, a high-ranking member of Iran’s Islamic Revolutionary Guards Corps (IRGC) and the commander of the Quds Force in Syria and Lebanon, was carried out by Israel on April 1, 2024. The actual assassination was based on precise operational intelligence, while Israel’s assessment of Iran’s response was wrong.

On the day of the attack, a building adjacent to the Iranian Embassy in the Syrian capital of Damascus was attacked with rockets. The attack killed seven IRGC members: General Muhammad Reza Zahedi, also known as Hassan Mahdawi, his deputy, and five additional officers. Mahdawi is the most senior Iranian commander to be killed since the assassination of IRGC Quds Force Commander Qasem Soleimani by the United States in 2020.

Mahdawi had close ties with Hezbollah. He maintained a close relationship with Hezbollah Secretary-General Hassan Nasrallah and was perceived by Israel to be directly coordinating the military attacks on Israel from Lebanon and Syria. In Tehran’s collective memory, Israel’s history of attacks against it includes numerous strikes on Iranian nuclear sites, assassinations of scientists within Iran, and actions against Iranian proxies in Syria, Lebanon, Iraq, and Yemen. Traditionally, these attacks have been invariably met with attacks by Iran’s proxies in the region.

This time, it was different. Iran recognized Mahdawi’s assassination as a direct attack on Iran that it could not tolerate, and had to respond to differently. Just days following Mahdawi’s assassination, Iran attacked Israel. According to the Israel Defense Forces, 99 percent of the more than 330 weapons fired at Israel (including at least 185 drones and 110 surface-to-surface missiles) were intercepted, mostly over the territory of countries adjacent to Israel. Iran’s attack on Israel was unprecedented. It was launched directly from Iranian territory in contrast to prior cases, when Iran has used its proxies, supposedly leaving its hands clean.

Israel could not tolerate such a blatant infringement on its sovereignty. After Israeli officials vowed a response to the Iranian attack, the Jewish State counter-attacked, causing minor damage to the Eighth Shekari Air Base in northwest Esfahan, a dozen kilometers from the Natanz nuclear facility. It was a calculated response designed to deliver a message to Iran that Israel could and would respond to an attack. Following Israel’s counterattack, the tensions between Iran and Israel have subsided for the time being.

While the attack on General Mahdawi was based on excellent operational intelligence, it became evident that the Israeli assessment regarding a possible Iranian response was erroneous. The Israeli assessment was that the Iranian response would be similar to what occurred in the past —namely limited attacks by Hezbollah on northern Israel and attacks on the Golan heights by Iranian proxies in Syria. Israel simply did not anticipate a direct Iranian attack on Israel from Iranian territory.

It seems that Israeli senior analysts were entangled in a conception of Iran’s past behavior and anticipated that Tehran’s response would be similar to prior cases, namely utilizing Iran’s proxies. Israel did not pay enough attention to the difference between Mahdawi’s assassination and previous attacks against Iran. This time, the attack targeted the Iranian embassy in Damascus and the target was a very senior official, who was close to Iran’s Supreme Leader Ali Khamenei.

It appears that Israel’s assessment of the Iranian response to Mahdawi’s assassination was a strategic failure. It appears more likely that the Israeli War Cabinet was provided with an incorrect assessment by the nation’s intelligence community, and less likely that it was provided with an incorrect assessment, which it then decided to ignore. There is concern in Israel that the intelligence assessment was once again wrong, after the colossal failure to anticipate the October 7 attack on Israel by Hamas.

Author: Avner Barnea | Date: 26 April 2024 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

Austria: Arrest raises broader questions about counterintelligence capabilities

BVT AustriaON GOOD FRIDAY, MARCH 29, Egisto Ott, a former member of Austria’s now-dissolved domestic intelligence agency, the Federal Office for the Protection of the Constitution and Counterterrorism (BVT), was arrested in his house in Carinthia, Austria’s southernmost state. Ott had frequently been at the center of media attention in the past year, in connection with the network surrounding the fugitive financier and alleged spy Jan Maršálek, as well as alleged misconduct relating to carrying out illegal investigations of persons. Ott also seems to have been involved in an alleged attempt to create an intelligence unit, or even an entire shadow intelligence service, embedded inside Austria’s foreign ministry. Now the veteran police and intelligence officer stands accused by the state attorney of abusing his authority and of being part of an “intelligence activity to the disadvantage of Austria” —the only form of spying that is illegal under § 256 of the Austrian criminal code.

Ott’s arrest came several years after intelligence was first shared with Austria by Western partner services —allegedly the Central Intelligence Agency— that reportedly date from as early as November 2017. Back then, Ott allegedly received classified material from his service’s email address to his personal Gmail account. However, Peter Gridling, director of the BVT from 2008 until its dissolution in 2021, stated in a recent interview that the ensuing investigations did not yield actionable results that could be used in criminal proceedings. This statement is highly interesting, as Gridling filed accusations about Ott with the State Prosecutor’s Office himself, and would hardly have done unless he had access to hard evidence. Ott was consequently removed from the BVT and placed in Police Academy Austria (SIAK), which is responsible for training police officers and conducts research related to police and domestic security.

Nevertheless, according to media reporting, Ott seems to have kept and illegally used certain forms of identification that presented him as a police officer. He is also alleged to have maintained access to several police databases and to have retained his network of trusted informants that provided him with intelligence. These included contacts in friendly foreign police services, whom Ott knew from his time as a liaison officer in Italy and Turkey. According to Gridling, these contacts were unaware that Ott had been removed from the BVT under suspicion of being unreliable and potentially even working for Russia. They therefore continued to help him when asked. Ott allegedly deceived his contacts by claiming that he needed information on cases relating to different kinds of extremism. As it turned out, according to the leaked arrest warrant, several of the individuals referred to by Ott as “suspects” in terrorism investigations were in fact Russian dissidents or intelligence defectors who were living as protected persons in Austria and elsewhere outside Russia.

It appears highly probable that Ott also had people inside the Austrian bureaucracy, including former colleagues in the BVT, who continued to provide him with information and assistance, even after the first allegations against him arose in 2017. As of now, at least one other officer from LVT Vienna (the state unit of the BVT) has been found to have illegally provided Ott with Information. It is likely, given the publicly available descriptions of Ott’s activities, that other individuals may be implicated. It also remains to be seen whether individuals involved in this case were able to join the BVT’s successor agency, the new Directorate of State Protection and Intelligence (DSN). Read more of this post

Interview reveals state of mind of Israeli intelligence prior to October 7 attack

Israeli General Staff MilitaryON MARCH 23, CHANNEL 12 of Israeli television aired a remarkable interview with Sassi Elya, the former director of technology at the Israel Security Agency (ISA). Better known by the acronyms Shin Bet or Shabak, the ISA is Israel’s domestic security service. The interview had initially been scheduled for broadcast as part of the evening news on October 7, 2023. However, its airing was canceled due to the attack on Israel by Hamas, which occurred that morning.

But on March 23, after about 5 months, Channel 12 aired the original interview with Elya. The retired official spoke with glee about the advanced technological capabilities developed by the ISA in order to prevent terrorist attacks against Israel. Elya said Israeli intelligence had built a unique system, known as “the Tool”, which allegedly provided intimate knowledge about the life of every Palestinian living in the West Bank and Gaza. This technologically advanced surveillance system allegedly monitored every move of its targets, all for the purpose of preventing potential terrorist attacks against the Jewish state. Elya claimed that, as a result of this advanced technological system, there was no chance that Israel would be surprised by Palestinian militants. This system was so advanced, he said, that intelligence agencies from all over the world were coming to Israel to learn about it.

Thanks to Channel 12, we can now examine Elya’s interview retrospectively, and especially in light of the ISA’s poor performance on October 7, as well as its failure to warn Israeli authorities about Hamas’ preparations for the attack. Notably, Elya was interviewed again for the same television program. Predictably, he admitted that his prior assessment had been wrong and regretted being so overly confident about the technology.

This case demonstrates the overestimation by Israeli intelligence of its own capabilities, because of arrogance and over-confidence. This approach refutes the basic premise of intelligence work: be skeptical and be modest. Furthermore, this case highlights that Israeli intelligence agencies overly relied on technology (SIGINT) in the lead-up to October 7, while seemingly neglecting the low-tech activity of gathering information through human intelligence (HUMINT).

The system that Elya described in his initial interview as the ultimate counterintelligence tool was reportedly criticized internally by some in the ISA for gathering huge amounts of information without offering sufficient analytical capability. This imbalance between collection and analysis can render an entire surveillance system practically useless. The bottom line is that, almost by accident, we are now aware of the state of mind that the ISA was in before the sudden attack by Hamas on October 7, which cost so many lives as a result of the ISA’s complacency.

► Author: Avner Barnea | Date: 01 April 2024 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

Opinion: Five months into the war, Israeli intelligence failure looks even worse

Israel Hamas warSINCE OCTOBER 7, 2024, when Israel was caught off guard by a sudden and highly damaging attack from Hamas, more information has surfaced regarding why there was no prior warning about the attack and the failures of Israeli intelligence in this regard.

It has become clear that Israeli intelligence miscalculated Hamas’s intentions. The Israeli security concept, spearheaded by the Israel Military Intelligence (IMI) and the Israel Security Agency (ISA), was that: (a) Hamas had been deterred from launching large-scale attacks; and (b) Hamas was focused on carrying out terrorist attacks against Israelis in the West Bank and not on Israel proper. This flawed security concept, which had been fully adopted by the Israeli cabinet and the Israel Defense Forces (IDF) was proven to be groundless. In fact, Hamas successfully exploited it in order to develop and accelerate its attack strategy.

One significant reason for the failure of the IDF, both in the area of intelligence collection and operationally, was its underestimation of the capabilities of Hamas and the intentions of its leader, Yahya Sinwar. There was also an overestimation by many in Israel, including the security establishment, of Israel’s own intelligence Q Quotecapabilities. Another important insight is that the counterintelligence structures inside Hamas were successful in preventing Israeli intelligence from recruiting agents who were close enough to Sinwar to be able to alert Israel about the impending attack. Furthermore, Israel’s collection and analysis of signals intelligence was unproductive, possibly because Hamas was successful in countering Israel’s ability to produce effective intelligence from signals intercepts.

As the IDF moved deeper into Gaza, and as more information was collected from Hamas facilities, it became clear that there were significant gaps in information regarding the preparations for the attack by Hamas inside Gaza. These preparations lasted for a long time and involved numerous operatives who remained undetected by Israeli intelligence. It looks like the compartmentation system inside Hamas, based on a need-to-know only model, was highly effective.

The IDF attacked the Gaza Strip in 2014 in Operation Protective Edge. Its mission was to destroy Hamas’s ability to carry out assaults against Israel through tunnels dug deep inside Gaza and crossing the border into Israel. Indeed, about 20 such tunnels were destroyed during that operation. Later, Hamas built 250 miles of new tunnels in Gaza that were aimed at defense and to hide combatants when Israel attacked. It has been suggested that this construction project was funded by cash sent to Gaza by Qatar, with Israel’s approval —though Qatar denies this claim. Read more of this post

Russian intelligence services intensify efforts to ‘liquidate’ defectors: report

Maksim KuzminovTHE RUSSIAN INTELLIGENCE SERVICES have been “bolstering the[ir] architecture” aimed at stopping potential defectors and “liquidating” those who have already defected and are living in exile, according to a new report. In a leading article published on Sunday, The Wall Street Journal said that the list of “unsolved deaths” of the Kremlin’s Russian critics is “lengthening” and may have surpassed 50, according to some accounts.

Since the current phase of the invasion of Ukraine, which began in February 2022, Russian defectors and other critics of Russia’s ongoing war have “died in unusual circumstances on three continents”, according to the New York-based newspaper. Most deaths have occurred inside Russia, but several have occurred in countries such as India, France, and Spain. In the most recent case, Maksim Kuzminov, a Russian helicopter pilot, who defected to Ukraine in August 2023, was gunned down in Villajoyosa, Spain, last month, in what The Journal described as a “mafia-style assassination”.

The paper notes that very few of these killings or suspicious deaths can be directly attributed to the Kremlin. It adds, however, that the Russian government has ordered a redoubling of coordinated anti-defector operations by the country’s three main intelligence agencies —the Federal Security Service (FSB), the Foreign Intelligence Service (SVR), and the Main Intelligence Directorate of the General Staff of the Russian Armed Forces (GRU). In their effort to prevent defections and punish defectors, these agencies have blurred their operational boundaries,  “making it more difficult to know which is responsible” for anti-defector operations, says The Journal.

Russian anti-defector operations are also increasingly involving third-country nationals —operatives who have no official connection with Russia, or with the country in which they are operating on behalf of Russian intelligence. In one recent example from last August, authorities in Britain arrested three Bulgarian citizens with spying for Russia. According to British government prosecutors, the suspects possessed forged passports and identity cards for Spain, France, the United Kingdom, Croatia, Italy, Greece, Bulgaria, the Czech Republic, and Slovenia.

Author: Joseph Fitsanakis | Date: 04 March 2024 | Permalink

Netanyahu ignored calls to disrupt Hamas finances, claims ex-Mossad official

Udi LevyA RETIRED SENIOR MOSSAD official has alleged that Israeli Prime Minister Benjamin Netanyahu repeatedly ignored, and even frustrated, efforts to stop the flow of hundreds of millions of dollars to Hamas. This inaction may have enabled the Palestinian militant group to plan, organize and execute Operation Al-Aqsa Flood, which killed over 1400 Israelis on October 7, 2023, and sparked the current war between Israel and Hamas.

The allegation was made by Udi Levy, a 30-year veteran of the Israeli intelligence community, who served as an intelligence officer in the Israel Defense Forces before being appointed to head the Economic Warfare Division of the Mossad, Israel’s external intelligence agency. During his tenure in the Mossad, which ended with his retirement in 2016, Levy was a member of Task Force Harpoon, which aimed to disrupt the flow of funds to militant Palestinian groups, including Hamas.

Last week, Levy told the BBC’s flagship investigative television program Panorama that Task Force Harpoon had identified around 40 companies in the Middle East and North Africa, which were part of Hamas’ investment portfolio. These companies, based in countries such as Sudan, Algeria, Turkey, Saudi Arabia, and Qatar, were active in the areas of real estate, mining, construction, and tourism, among others. Some of the companies were even directly controlled by Hamas, said Levy.

The income from these financial investments allowed Hamas to use “billions, not millions” of dollars to build its military infrastructure in the Gaza Strip, according to the former Mossad official. That investment income was supplemented with direct cash infusions from Iran and Qatar, which in some cases arrived monthly through special envoys, according to Levy. He added that Turkey was “a critical focal point” in Hamas’ money network, as it served as a financial hub for the militant group’s holdings.

Levy told the BBC that he personally advised Netanyahu to “target Hamas’ finances” and explained to him that “Israel had the means to crush Hamas by using only financial tools”. However, Levy claims that, not only did the Israeli prime minister ignore Levy’s advice, but he proceeded to shut down the Mossad’s Task Force Harpoon. This is not the first time that Levy has made these claims. In December 2023, he told The New York Times that Task Force Harpoon analysts were so frustrated with the Israeli government’s inertia, that they resorted to “uploading some documents to Facebook” in hopes that the Israeli authorities would be forced to take action once details about Hamas’ finances were disclosed.

Author: Joseph Fitsanakis | Date: 26 February 2024 | Permalink

Analysis: Israel underestimated Hamas while overestimating its own capabilities

IDF IsraelTHE OCTOBER 7 ATTACK on Israel was a total surprise. There was no warning. There were very few signs of a possible attack. Israeli intelligence evaluated these signs as elements of a routine military exercise by Hamas, and even assessed them as parts of an imaginary scenario. It therefore gave no warning to those Israeli Defense Forces (IDF) units that were stationed on the border with Gaza. Meanwhile, what we know about the intelligence failure of October 7 will likely pale before what the commission of inquiry will reveal once it is established. That was precisely what happened in the case of the Agranat Commission of Inquiry, which made significant revelations while investigating the intelligence failings of the IDF in the run up to the 1973 Yom Kippur War.

In the eyes of the Israeli generation of the Yom Kippur War, the possibility of such a failure happening again was unthinkable. Yet there is a significant difference between the events of 1973 and the events of last October 7. In 1973 the intelligence failed, but the IDF reacted quickly and acted efficiently. This Q Quotetime, in the first two days of the conflict the IDF was confused and acted without direction, in the apparent absence of relevant action plans for what to do in the event of a massive invasion. The IDF was clearly not ready for such a scenario.

Recently, another important piece of information about the intelligence failure of October 7 was revealed. It was reported that, two months before the surprise attack by Hamas, information was received from an agent handled by the Israel Security Agency (ISA) in Gaza, with a “very high” reliability level. The agent allegedly reported that Hamas was planning “a major move in the week after Yom Kippur”. Yet that warning was not marked as significant; the assumption was that, if the warning materialized, it would be corroborated with additional intelligence. It was thus kept from higher levels of command and from Israeli Military Intelligence (IMI). The ISA did not deny the report, saying instead in a statement: “Focusing on one specific piece of news or another does not reflect the intelligence picture at the time”.

Given the high number of casualties and the horrendous destruction that resulted from the October 7 attack, many Israelis, including some in the security establishment, feel that it is far too long to wait until a commission of inquiry is established and publishes its conclusions. It will likely take at least two years Q Quotefor those conclusions to become public. What is to be done in the meantime? There is public pressure to launch the inquiry soon.

Recently the State Comptroller of Israel, Matanyahu Engelman, announced that he has begun to investigate the intelligence failure. This is an appropriate move. However, with all due respect to the state comptroller’s inquiries, we know from previous experience that his findings have no teeth. For instance, in the context of Hamas, the state comptroller’s review of Operation TZUK EITAN (the 2014 Gaza War) was published in early 2017. It revealed serious instances of misconduct in the intelligence community dating several years prior to the operation. Yet this severe criticism passed below the public’s radar and was practically ignored, while no actions were taken against IDF and ISA security personnel that were shown to have acted irresponsibly.

I would like to point to a number of stronger factors that led to the tragic complacency of October 7, drawn from the field of psychology. It relates to how a country (mainly through its intelligence analysts) perceives its enemies and how this affects the evaluations of said enemies. We know that there was a conception on the Israeli side that Hamas had no interest in attacking Israel at this stage. It seems that the State of Israel underestimated Hamas and its leader, Yahya Sinwar, based on the available evidence of Hamas and Sinwar. Read more of this post

Analysis: Israel underestimated Hamas while overestimating its own capabilities

The OSINT factor in Hamas’ operational success and Israel’s intelligence failure

Hamas GazaIT HAS BECOME CLEAR that Hamas had up-to-date intelligence on Israeli targets prior to the attack on October 7, 2023, the largest and most devastating terrorist attack in Israel’s history. Hamas did not have access to clandestine information sources but rather relied on open-source intelligence (OSINT) to understand the structure and weaknesses of Israel’s defense system along the border fence. In addition to publicly available maps, Hamas meticulously gathered online intelligence about specific sites within the Israeli communities near the Gaza Strip.

It is also possible that some of the intelligence came from human intelligence (HUMINT) sources, largely through Gazan workers who were employed in Israel. Moreover, Hamas had access to constant Israeli media broadcasts, which supplied them with invaluable intelligence on the border communities and adjacent military facilities, as well as on communities that were located further to the north and east. Although the Israeli state exercises censorship in the Q Quoteinterests of national security, the public’s ‘right to know’ purview is substantial. Thus, significant amounts of information are available online.

In assessing the behavior of Hamas in recent years, one can observe that it did not act as a terrorist group for quite some time. Rather, it operated as a government organization, while monitoring its enemy and waiting patiently for an opportune moment to attack. Simultaneously, Hamas utilized disinformation tools to conceal its attack plans. It trained its fighters within commando units that employed information effectively and relied on actionable intelligence, rather than chance. This can be observed from interrogations of Hamas members who were detained by Israeli authorities after October 7. In one example, Hamas used detailed maps of Israeli communities near the Gaza border, which are available on Google Earth, to plan its attacks of October 7. Printouts of these maps were found among the belongings of Hamas assailants that were killed during the attacks.

Some in Israel are now advocating for increased protection of OSINT, particularly for Israeli sites related to security, including civilian first-response units, defense systems guarding settlements, and civil technological assets. However, implementing such measures within the current framework of Israel’s open society seems challenging. Despite the known importance of OSINT to Hamas and its potential risk to Israel’s security, significant changes in this regard may not occur, as they could impact the country’s democratic values. However, it is still possible to improve the quality of security censorship regarding sensitive civilian information that can be used by adversaries. Such moves would include protecting databases, limiting information relating to the addresses of senior officials, or putting in place stricter policies on the movement of Gazan workers in Israel.

Contrary to Hamas’, Israel’s OSINT systems underperformed in the run-up to the October 7 attacks. That was so especially after the central OSINT unit of the Israeli Military Intelligence was dissolved, for reasons that remain to be investigated. CNN was among many news outlets that have revealed how Hamas advertised its military drills on social media, but somehow Israeli intelligence failed to pay attention to them.

When Hamas openly declared its intention to attack communities near the Gaza border, and trained its units for that purpose, the Israeli intelligence community, including the IMI and the Israel Security Agency (ISA), underestimated its real attack capabilities based on OSINT materials. This miscalculation stemmed from incorrectly assessing Hamas’s capabilities and overestimating the Israel Defense Forces’ ability to swiftly respond and prevent the attack on civil and military targets. Unfortunately, this assessment proved to be a significant mistake.

The effective use of OSINT lies at the heart of Hamas’ operational plan to attack simultaneously several Israeli targets and to cause extensive damage. It appears that Hamas was able to utilize the OSINT factor to its maximum extent, thus adding significant value to the success of the attack.

► Author: Dr. Avner Barnea | Date: 05 December 2023 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

Analysis: Israel’s misjudgment of Hamas caused the October 7 intelligence failure

Gaza StripSINCE OCTOBER 7, WHEN Hamas launched its surprise attack on Israel, many more details about the intelligence failure have emerged. It appears that Israeli intelligence officials have warned for years about military exercises held by Hamas in the Gaza Strip, which have included practice raids on cities deep inside Israel. However, the Israel Military Intelligence (IMI) did not heed to the warnings, because it considered Hamas operationally incapable of carrying out such raids. Instead, the IMI estimated that the Hamas leadership aimed to arrive at a settlement with Israel. That seems like the result of a highly successful disinformation operation, which added significantly to the effectiveness of the sudden attack on Israel on October 7.

It now appears that several months after the Israel Defense Forces (IDF) Operation Guardian of the Walls, which targeted Hamas in the Gaza Strip in May of 2021, Hamas began to train for a large-scale operation against Israel. However, the IMI estimated that Hamas was not capable of attacking aQ Quote large number of settlements simultaneously. It also believed that such an operation would go against the spirit of Hamas leadership’s spirit intention to settle with Israel.

As early as 2022, the IMI had analyzed videos of Hamas’ military exercises, which Hamas itself had made available on social media networks. Meanwhile, the intelligence information that emerged from the Gaza Strip showed that the professionalization of Hamas’ military arm, the Izz ad-Din al-Qassam Brigades, was improving. However, IMI officials rejected the need to build an operative response to the mass-attack scenario that these exercises pointed to, because they saw them simply as exercises.

Israeli intelligence also analyzed the communications discourse between the commanders of Hamas, which it had acquired through intercepts. It purportedly indicated that Hamas intended to carry out raids on Israeli communities located near the fence between Israel and Gaza, but also on targets located deeper inside Israel. The communications discourse also indicated that such attacks could occur, not only using tunnels, but with incursions above ground and even through aerial methods.

One of the methods that Hamas trained on, and one that was known to Israeli intelligence, focused on disabling the highly sophisticated observation posts, sensors and remote-controlled machine guns, which Israel has installed along the border fence with the Gaza Strip. The purpose of these exercises was to enable an attack on the fence and overtake it these sophisticated tools with Hamas operatives, thus effectively blinding the Israeli forces. However, Israeli authorities made no effort to prepare for such a scenario by protecting these installations.

The broad picture that is emerging raises serious questions about why the IDF did not take a reasonable course of action against Hamas’ operational plan —and why it failed to do so despite being aware of the intensity of the Hamas exercises, and despite being aware of the group’s stated intentions. Q QuoteIndeed, a preventive course of action should have been in place even in the absence of specific intelligence warnings —if only to enable the IDF to repel a surprise attack by Hamas. There was no need to estimate what Hamas would do in order to prepare for a surprise attack.

Yet it is now patently obvious that there was ample intelligence about Hamas’ intentions. The latter were both apparent and known. Even without the wisdom of hindsight, it is clear there was enough intelligence to enable Israel to act in a timely manner against Hamas’ plan. Yet Israel severely misjudged Hamas’ intentions. In retrospect, it appears that ample intelligence about Hamas’ intentions had been gathered, that the IMI and Shin Bet were severely underprepared for a surprise attack, that the precise details of Hamas’ attack were missed, and that Hamas’ intentions were misjudged. These are the reasons why Israel was caught unprepared and suffered a catastrophic surprise on October 7.

Author: Dr. Avner Barnea | Date: 10 November 2023 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

Analysis: How Israeli Intelligence Failed to Anticipate the Hamas Attack

Hamas GazaSEVERAL DAYS HAVE PASSED since October 7, the day when Hamas stunned Israel with a surprise attack against several settlements near the Gaza border. It is now clear that Israeli intelligence was in possession of warning indicators about the attack, and that these indicators were misjudged.

The IMI and ISA Assessment

It is important to note that the intelligence division of the Israel Defense Forces (IDF), known as Israeli Military Intelligence (IMI), and the  Israel Security Agency (ISA), have been monitoring Hamas for years. These two agencies are believed to have conducted a situation assessment approximately two weeks before the October 7 attack. The assessment concluded that Hamas was deterred and had no interest in changing the status quo by attacking Israel in the short run. This assessment was communicated to Prime Minister Benjamin Netanyahu and Minister of Defense Yoav Gallant.

It appears that this assessment was not supported by concrete intelligence. The agencies that produced it relied primarily on monitoring the recent behavior of Hamas, including the fact that it was allowing Palestinians living in Gaza to work inside Israel. Additionally, the assessment noted the fact that Hamas was receiving funds from Qatar to help the poverty-stricken residents of Gaza. In retrospect, this assessment appears to have been based on wishful thinking.

The Egyptian Warning

It is now known that Abbas Kamel, Director of the Egyptian General Intelligence Directorate, sent a warning to Israel a few days before Hamas’ attack. Kamel allegedly warned of “something unusual, a terrible operation”, which was about to take place from the direction of Gaza. The warning was forwarded to Prime Minister Netanyahu’s office. The Israeli newspaper that published this report, Yedioth Ahronot, is known for its serious reputation and quality sources inside the Egyptian establishment. According to the report, Kamel was told by the Israelis that they were focused on preventing terrorist attacks in the West Bank.

Yet, in a speech that Netanyahu delivered immediately after the October 7 attack broke out, he denied claims about the Egyptian warning and claimed that they were fake news. However, American Congressman Michael McCaul, Chairman of the House Foreign Affairs Committee, said on October 11: “We know that Egypt […] warned the Israelis three days prior that an event like this could happen”. Speaking to reporters following a closed-door intelligence briefing on the crisis for American lawmakers, McCaul added: “I don’t want to get too much into classified [details], but a warning was given”. An Egyptian government source also asserted that Egyptian intelligence officials warned their Israeli counterparts that Hamas was planning “something big” ahead of the October 7 surprise onslaught. But this intelligence appears to have been ignored. Read more of this post

Analysis : Attack on Israel Points to Systemic Failure at All Levels

Hamas Israel - BarneaTHE COMPARISON BETWEEN THE October 2023 attack on Israel and the Yom Kippur War is reasonable. We still have an obscured perspective on what happened on October 7. But even this partial picture makes it possible to draw a preliminary comparison. Undoubtedly, there is no precedent for such a monumental failure in the history of Israeli intelligence.

The most striking difference between the two case studies is that in 1973 the system as a whole did not fail. The failure was personal, on the part of several key people, who did not perform according to expectations. The events of 2023 point to a systemic failure at all levels, not personal mistakes. The failure is at the level of intelligence warning, the military response to the attack, and even the actions of Israel’s political leadership.

An Intelligence and Military Failure

In 1973, the intelligence-gathering system was working well, and Egypt’s war intentions were known. Thousands of reports from observations along the Suez Canal spoke of the Egyptian preparations. The wireless transmissions that were issued testified to preparation for war in the Egyptian army. All this did not translate into a warning of war, due to the failed performance of some senior officers in the Israeli Military Intelligence (IMI), who stuck to their preconceived notions until the last moment.

In 2023, the failure is systemic. It involves both the level of collection and at the level of assessment. It relates both to the IMI and the Israel Security Agency (ISA). It has already become clear that the intelligence collection mechanisms failed to detect large-scale preparations for an all-out attack from the Gaza Strip. A massive intelligence system failed to detect the preparatory actions of the assailing forces.

When the perceived enemy is Palestinian civilians and when Israel Defense Forces (IDF) soldiers spend their time guarding settlements and worshipers, instead of engaging in hard training, the result is catastrophic. On October 7, we witnessed the operations of an army whose main mission is occupation. Given what we saw on that day, namely more than 1,000 civilian and military casualties and approximately 150 kidnapped Israelis, it is not clear how this army will be able to face the upcoming challenges in this war. The need for the professionalism and resilience of the IDF, which was there in 1973, continues to exist.

A Political Failure

The comparison between the political leadership of 1973 and 2023 is also discouraging. Back then, the root of the failure was that the intelligence information the leadership received from Eli Zeira, the director of IMI, who was the nation’s most senior intelligence officer, was distorted and false. It is now understood that the IMI’s assessments were based on the concept of reassuring the political leadership. Yet, Prime Minister Golda Meir and Minister of Defense Moshe Dayan were challenged after the war, and were eventually removed from their positions. However, they acted responsibly.

In contrast, there is not much to say about Israel’s current political leadership. It suffices to look at the composition of the Security Cabinet and the first leaks that have already begun to emanate from it, or at the surge of slander that members of the governing coalition have begun to heap on the finest of the IDF’s officers. It is nothing short of a disgrace and a disaster.

This war has just begun. It is still too early to draw conclusions. But we can examine the conclusions from the Yom Kippur War and assess their relevance to today. When Israeli Prime Minister Benjamin Netanyahu talks about revenge, it is advisable to remember those lessons. The conflict with the Palestinians is long and bitter. They will not give up their ambition for their state. It is now time to comprehend the full cost of the continuation of the conflict.

► Author: Avner Barnea | Date: 11 October 2023 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

Alleged Israeli spies with Russian citizenship arrested in Lebanon

Rafic Hariri International Airport Beirut LebanonLAST WEEK, LEBANON’S GENERAL Security Directorate charged two Russian citizens with spying for Israel. The two Russians, who appear to be legally married to each other, were detained by authorities at Beirut’s Rafic Hariri International Airport as they were attempting to leave the country. The detentions were reported by the Lebanese newspaper Al-Akhbar, which is affiliated with the Lebanese militant group Hezbollah.

According to the Al-Akhbar report, one of the suspects admitted that he had been recently recruited into Israeli intelligence. He also reportedly admitted that, as part of his espionage activities, he received maps of sites and instructions about gatherings at facilities in Lebanon belonging to the Hezbollah organization. He added that he had been instructed to access, inspect and, if possible, photograph these facilities. He also reportedly admitted that he had visited southern Lebanon and entered Hamas-controlled areas of southern Beirut, where he had collected data and verified it against the information available to his handlers.

The report added that the suspect’s wife, who was also arrested, admitted under interrogation that she was aware of her husband’s work and that she had assisted him in his tasks. According to the report the General Security Directorate had suspected the Russian citizen, because he had traveled in southern Lebanon several times. Lebanese authorities were able to track his movements and connections, eventually tracing his place of residence. He was arrested along with his wife soon after being notified by his handlers that he should leave the country immediately.

Al-Akhbar added that, prior to the arrest, the General Security Directorate had informed the Russian Embassy in Beirut of its intention to arrest the Russian citizens. The agency’s Director, Elias Elbisri, said following the arrest: “A spy ring for the benefit of the Israeli enemy was foiled at the Beirut airport, consisting of two people who tried to leave Lebanon”. According to Elbisri, “we carried out the necessary investigations; this cell posed a threat to Lebanon”.

Israeli authorities did not respond to news about the incident. It should be noted that, if Russian citizens were indeed recruited and employed by Israeli intelligence, this development could further-damage the relationship between Israel and Russia, which is already fragile due to ongoing developments in Syria and Ukraine. Israel regularly launches attacks on Iranian facilities and equipment in Syria —a Russian ally. Israel is also believed to provide security assistance to Ukraine, which is engaged in a bloody war over territory with Russia.

In recent days, there have been leaks in Israel that an intense debate took place in the Israeli Security Cabinet, following the rise in Palestinian acts of terrorism in Israel, which, according to Israeli security agencies, are guided by Hezbollah and Hamas. As a result, Hamas operatives in the Gaza Strip are taking protective actions, fearing the renewal of targeted killings by Israeli forces. Salah al-Aruri, commander of Hamas’ Izz ad-Din al-Qassam Brigades, who is directing his forces against Israel from abroad, could also be a target for the Israeli intelligence community.

Author: Avner Barnea | Date: 04 September 2023 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).