Analysis: Israel underestimated Hamas while overestimating its own capabilities
January 10, 2024 Leave a comment
The OSINT factor in Hamas’ operational success and Israel’s intelligence failure
December 5, 2023 1 Comment
IT HAS BECOME CLEAR that Hamas had up-to-date intelligence on Israeli targets prior to the attack on October 7, 2023, the largest and most devastating terrorist attack in Israel’s history. Hamas did not have access to clandestine information sources but rather relied on open-source intelligence (OSINT) to understand the structure and weaknesses of Israel’s defense system along the border fence. In addition to publicly available maps, Hamas meticulously gathered online intelligence about specific sites within the Israeli communities near the Gaza Strip.
It is also possible that some of the intelligence came from human intelligence (HUMINT) sources, largely through Gazan workers who were employed in Israel. Moreover, Hamas had access to constant Israeli media broadcasts, which supplied them with invaluable intelligence on the border communities and adjacent military facilities, as well as on communities that were located further to the north and east. Although the Israeli state exercises censorship in the 
interests of national security, the public’s ‘right to know’ purview is substantial. Thus, significant amounts of information are available online.
In assessing the behavior of Hamas in recent years, one can observe that it did not act as a terrorist group for quite some time. Rather, it operated as a government organization, while monitoring its enemy and waiting patiently for an opportune moment to attack. Simultaneously, Hamas utilized disinformation tools to conceal its attack plans. It trained its fighters within commando units that employed information effectively and relied on actionable intelligence, rather than chance. This can be observed from interrogations of Hamas members who were detained by Israeli authorities after October 7. In one example, Hamas used detailed maps of Israeli communities near the Gaza border, which are available on Google Earth, to plan its attacks of October 7. Printouts of these maps were found among the belongings of Hamas assailants that were killed during the attacks.
Some in Israel are now advocating for increased protection of OSINT, particularly for Israeli sites related to security, including civilian first-response units, defense systems guarding settlements, and civil technological assets. However, implementing such measures within the current framework of Israel’s open society seems challenging. Despite the known importance of OSINT to Hamas and its potential risk to Israel’s security, significant changes in this regard may not occur, as they could impact the country’s democratic values. However, it is still possible to improve the quality of security censorship regarding sensitive civilian information that can be used by adversaries. Such moves would include protecting databases, limiting information relating to the addresses of senior officials, or putting in place stricter policies on the movement of Gazan workers in Israel.
Contrary to Hamas’, Israel’s OSINT systems underperformed in the run-up to the October 7 attacks. That was so especially after the central OSINT unit of 
the Israeli Military Intelligence was dissolved, for reasons that remain to be investigated. CNN was among many news outlets that have revealed how Hamas advertised its military drills on social media, but somehow Israeli intelligence failed to pay attention to them.
When Hamas openly declared its intention to attack communities near the Gaza border, and trained its units for that purpose, the Israeli intelligence community, including the IMI and the Israel Security Agency (ISA), underestimated its real attack capabilities based on OSINT materials. This miscalculation stemmed from incorrectly assessing Hamas’s capabilities and overestimating the Israel Defense Forces’ ability to swiftly respond and prevent the attack on civil and military targets. Unfortunately, this assessment proved to be a significant mistake.
The effective use of OSINT lies at the heart of Hamas’ operational plan to attack simultaneously several Israeli targets and to cause extensive damage. It appears that Hamas was able to utilize the OSINT factor to its maximum extent, thus adding significant value to the success of the attack.
► Author: Dr. Avner Barnea | Date: 05 December 2023 | Permalink
Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).
Analysis: Israel’s misjudgment of Hamas caused the October 7 intelligence failure
November 10, 2023 6 Comments
SINCE OCTOBER 7, WHEN Hamas launched its surprise attack on Israel, many more details about the intelligence failure have emerged. It appears that Israeli intelligence officials have warned for years about military exercises held by Hamas in the Gaza Strip, which have included practice raids on cities deep inside Israel. However, the Israel Military Intelligence (IMI) did not heed to the warnings, because it considered Hamas operationally incapable of carrying out such raids. Instead, the IMI estimated that the Hamas leadership aimed to arrive at a settlement with Israel. That seems like the result of a highly successful disinformation operation, which added significantly to the effectiveness of the sudden attack on Israel on October 7.
It now appears that several months after the Israel Defense Forces (IDF) Operation Guardian of the Walls, which targeted Hamas in the Gaza Strip in May of 2021, Hamas began to train for a large-scale operation against Israel. However, the IMI estimated that Hamas was not capable of attacking a
large number of settlements simultaneously. It also believed that such an operation would go against the spirit of Hamas leadership’s spirit intention to settle with Israel.
As early as 2022, the IMI had analyzed videos of Hamas’ military exercises, which Hamas itself had made available on social media networks. Meanwhile, the intelligence information that emerged from the Gaza Strip showed that the professionalization of Hamas’ military arm, the Izz ad-Din al-Qassam Brigades, was improving. However, IMI officials rejected the need to build an operative response to the mass-attack scenario that these exercises pointed to, because they saw them simply as exercises.
Israeli intelligence also analyzed the communications discourse between the commanders of Hamas, which it had acquired through intercepts. It purportedly indicated that Hamas intended to carry out raids on Israeli communities located near the fence between Israel and Gaza, but also on targets located deeper inside Israel. The communications discourse also indicated that such attacks could occur, not only using tunnels, but with incursions above ground and even through aerial methods.
One of the methods that Hamas trained on, and one that was known to Israeli intelligence, focused on disabling the highly sophisticated observation posts, sensors and remote-controlled machine guns, which Israel has installed along the border fence with the Gaza Strip. The purpose of these exercises was to enable an attack on the fence and overtake it these sophisticated tools with Hamas operatives, thus effectively blinding the Israeli forces. However, Israeli authorities made no effort to prepare for such a scenario by protecting these installations.
The broad picture that is emerging raises serious questions about why the IDF did not take a reasonable course of action against Hamas’ operational plan —and why it failed to do so despite being aware of the intensity of the Hamas exercises, and despite being aware of the group’s stated intentions. 
Indeed, a preventive course of action should have been in place even in the absence of specific intelligence warnings —if only to enable the IDF to repel a surprise attack by Hamas. There was no need to estimate what Hamas would do in order to prepare for a surprise attack.
Yet it is now patently obvious that there was ample intelligence about Hamas’ intentions. The latter were both apparent and known. Even without the wisdom of hindsight, it is clear there was enough intelligence to enable Israel to act in a timely manner against Hamas’ plan. Yet Israel severely misjudged Hamas’ intentions. In retrospect, it appears that ample intelligence about Hamas’ intentions had been gathered, that the IMI and Shin Bet were severely underprepared for a surprise attack, that the precise details of Hamas’ attack were missed, and that Hamas’ intentions were misjudged. These are the reasons why Israel was caught unprepared and suffered a catastrophic surprise on October 7.
► Author: Dr. Avner Barnea | Date: 10 November 2023 | Permalink
Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).
Analysis: How Israeli Intelligence Failed to Anticipate the Hamas Attack
October 16, 2023 1 Comment
SEVERAL DAYS HAVE PASSED since October 7, the day when Hamas stunned Israel with a surprise attack against several settlements near the Gaza border. It is now clear that Israeli intelligence was in possession of warning indicators about the attack, and that these indicators were misjudged.
The IMI and ISA Assessment
It is important to note that the intelligence division of the Israel Defense Forces (IDF), known as Israeli Military Intelligence (IMI), and the Israel Security Agency (ISA), have been monitoring Hamas for years. These two agencies are believed to have conducted a situation assessment approximately two weeks before the October 7 attack. The assessment concluded that Hamas was deterred and had no interest in changing the status quo by attacking Israel in the short run. This assessment was communicated to Prime Minister Benjamin Netanyahu and Minister of Defense Yoav Gallant.
It appears that this assessment was not supported by concrete intelligence. The agencies that produced it relied primarily on monitoring the recent behavior of Hamas, including the fact that it was allowing Palestinians living in Gaza to work inside Israel. Additionally, the assessment noted the fact that Hamas was receiving funds from Qatar to help the poverty-stricken residents of Gaza. In retrospect, this assessment appears to have been based on wishful thinking.
The Egyptian Warning
It is now known that Abbas Kamel, Director of the Egyptian General Intelligence Directorate, sent a warning to Israel a few days before Hamas’ attack. Kamel allegedly warned of “something unusual, a terrible operation”, which was about to take place from the direction of Gaza. The warning was 
forwarded to Prime Minister Netanyahu’s office. The Israeli newspaper that published this report, Yedioth Ahronot, is known for its serious reputation and quality sources inside the Egyptian establishment. According to the report, Kamel was told by the Israelis that they were focused on preventing terrorist attacks in the West Bank.
Yet, in a speech that Netanyahu delivered immediately after the October 7 attack broke out, he denied claims about the Egyptian warning and claimed that they were fake news. However, American Congressman Michael McCaul, Chairman of the House Foreign Affairs Committee, said on October 11: “We know that Egypt […] warned the Israelis three days prior that an event like this could happen”. Speaking to reporters following a closed-door intelligence briefing on the crisis for American lawmakers, McCaul added: “I don’t want to get too much into classified [details], but a warning was given”. An Egyptian government source also asserted that Egyptian intelligence officials warned their Israeli counterparts that Hamas was planning “something big” ahead of the October 7 surprise onslaught. But this intelligence appears to have been ignored. Read more of this post
Analysis : Attack on Israel Points to Systemic Failure at All Levels
October 11, 2023 4 Comments
THE COMPARISON BETWEEN THE October 2023 attack on Israel and the Yom Kippur War is reasonable. We still have an obscured perspective on what happened on October 7. But even this partial picture makes it possible to draw a preliminary comparison. Undoubtedly, there is no precedent for such a monumental failure in the history of Israeli intelligence.
The most striking difference between the two case studies is that in 1973 the system as a whole did not fail. The failure was personal, on the part of several key people, who did not perform according to expectations. The events of 2023 point to a systemic failure at all levels, not personal mistakes. The failure is at the level of intelligence warning, the military response to the attack, and even the actions of Israel’s political leadership.
An Intelligence and Military Failure
In 1973, the intelligence-gathering system was working well, and Egypt’s war intentions were known. Thousands of reports from observations along the Suez Canal spoke of the Egyptian preparations. The wireless transmissions that were issued testified to preparation for war in the Egyptian army. All this did not translate into a warning of war, due to the failed performance of some senior officers in the Israeli Military Intelligence (IMI), who stuck to their preconceived notions until the last moment.
In 2023, the failure is systemic. It involves both the level of collection and at the level of assessment. It relates both to the IMI and the Israel Security Agency (ISA). It has already become clear that the intelligence collection mechanisms failed to detect large-scale preparations for an all-out attack from the Gaza Strip. A massive intelligence system failed to detect the preparatory actions of the assailing forces.
When the perceived enemy is Palestinian civilians and when Israel Defense Forces (IDF) soldiers spend their time guarding settlements and worshipers, instead of engaging in hard training, the result is catastrophic. On October 7, we witnessed the operations of an army whose main mission is occupation. Given what we saw on that day, namely more than 1,000 civilian and military casualties and approximately 150 kidnapped Israelis, it is not clear how this army will be able to face the upcoming challenges in this war. The need 
for the professionalism and resilience of the IDF, which was there in 1973, continues to exist.
A Political Failure
The comparison between the political leadership of 1973 and 2023 is also discouraging. Back then, the root of the failure was that the intelligence information the leadership received from Eli Zeira, the director of IMI, who was the nation’s most senior intelligence officer, was distorted and false. It is now understood that the IMI’s assessments were based on the concept of reassuring the political leadership. Yet, Prime Minister Golda Meir and Minister of Defense Moshe Dayan were challenged after the war, and were eventually removed from their positions. However, they acted responsibly.
In contrast, there is not much to say about Israel’s current political leadership. It suffices to look at the composition of the Security Cabinet and the first leaks that have already begun to emanate from it, or at the surge of slander that members of the governing coalition have begun to heap on the finest of the IDF’s officers. It is nothing short of a disgrace and a disaster.
This war has just begun. It is still too early to draw conclusions. But we can examine the conclusions from the Yom Kippur War and assess their relevance to today. When Israeli Prime Minister Benjamin Netanyahu talks about revenge, it is advisable to remember those lessons. The conflict with the Palestinians is long and bitter. They will not give up their ambition for their state. It is now time to comprehend the full cost of the continuation of the conflict.
► Author: Avner Barnea | Date: 11 October 2023 | Permalink
Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).
Alleged Israeli spies with Russian citizenship arrested in Lebanon
September 4, 2023 Leave a comment
LAST WEEK, LEBANON’S GENERAL Security Directorate charged two Russian citizens with spying for Israel. The two Russians, who appear to be legally married to each other, were detained by authorities at Beirut’s Rafic Hariri International Airport as they were attempting to leave the country. The detentions were reported by the Lebanese newspaper Al-Akhbar, which is affiliated with the Lebanese militant group Hezbollah.
According to the Al-Akhbar report, one of the suspects admitted that he had been recently recruited into Israeli intelligence. He also reportedly admitted that, as part of his espionage activities, he received maps of sites and instructions about gatherings at facilities in Lebanon belonging to the Hezbollah organization. He added that he had been instructed to access, inspect and, if possible, photograph these facilities. He also reportedly admitted that he had visited southern Lebanon and entered Hamas-controlled areas of southern Beirut, where he had collected data and verified it against the information available to his handlers.
The report added that the suspect’s wife, who was also arrested, admitted under interrogation that she was aware of her husband’s work and that she had assisted him in his tasks. According to the report the General Security Directorate had suspected the Russian citizen, because he had traveled in southern Lebanon several times. Lebanese authorities were able to track his movements and connections, eventually tracing his place of residence. He was arrested along with his wife soon after being notified by his handlers that he should leave the country immediately.
Al-Akhbar added that, prior to the arrest, the General Security Directorate had informed the Russian Embassy in Beirut of its intention to arrest the Russian citizens. The agency’s Director, Elias Elbisri, said following the arrest: “A spy ring for the benefit of the Israeli enemy was foiled at the Beirut airport, consisting of two people who tried to leave Lebanon”. According to Elbisri, “we carried out the necessary investigations; this cell posed a threat to Lebanon”.
Israeli authorities did not respond to news about the incident. It should be noted that, if Russian citizens were indeed recruited and employed by Israeli intelligence, this development could further-damage the relationship between Israel and Russia, which is already fragile due to ongoing developments in Syria and Ukraine. Israel regularly launches attacks on Iranian facilities and equipment in Syria —a Russian ally. Israel is also believed to provide security assistance to Ukraine, which is engaged in a bloody war over territory with Russia.
In recent days, there have been leaks in Israel that an intense debate took place in the Israeli Security Cabinet, following the rise in Palestinian acts of terrorism in Israel, which, according to Israeli security agencies, are guided by Hezbollah and Hamas. As a result, Hamas operatives in the Gaza Strip are taking protective actions, fearing the renewal of targeted killings by Israeli forces. Salah al-Aruri, commander of Hamas’ Izz ad-Din al-Qassam Brigades, who is directing his forces against Israel from abroad, could also be a target for the Israeli intelligence community.
► Author: Avner Barnea | Date: 04 September 2023 | Permalink
Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).
U.S. charges Greek businessman with smuggling military and dual-use goods to Russia
May 22, 2023 Leave a comment
The United States Department of Justice has charged a Greek national with wire fraud and smuggling sensitive military-grade and dual-use goods from the United States to Russia. The suspect, Dr. Nikolaos “Nikos” Bogonikolos, 59, was arrested in Paris, France, on May 9, at the request of the United States, and is currently in custody pending extradition proceedings.
Bogonikolos is a mathematician and self-described “serial entrepreneur”, with business activities dating back to 1987. He has authored and co-authored academic articles, holds a number of patents, and has published a book entitled Total Process Security Reengineering. Following the ECHELON revelations in the late 1990’s, he authored a report (.pdf) entitled “The Perception of Economic Risks Arising from the Potential Vulnerability of Electronic Commercial Media to Interception” as part of a study for the European Parliament.
In 2005, Bogonikolos received his PhD from the Kharkov National Economic University in Ukraine, focusing on applications of artificial intelligence in the field of economics. According to his own claims, he has been active as an entrepreneur or researcher in some 40 countries, including Russia. Bogonikolos is the founder of a Greek-based company called Aratos Group. In 2016, Aratos Systems BV was registered as legal entity in The Netherlands. Since 2020, the company has been located in the town of Rijen, which is also home to the main operational military helicopter base of the Royal Netherlands Air Force.
Aratos Systems BV describes itself on its website (currently offline) as an “independent and leading member of the Greek Aratos Group”. Its activities, as declared to the Netherlands chamber of commerce, are “the collection, processing, protecting, and selling of earth observation data to public and private parties”. Aratos Systems also “owns and runs a fully equipped Satellite Ground Station constantly connected with EUMETSAT” —the latter being the European operational satellite agency for monitoring weather, climate and the environment from space.
Last week, the Netherlands Public Prosecution Service and the Fiscal Information and Investigation Service raided the Aratos Systems offices in Rijen. According to the unsealed complaint (.pdf) it is believed that Bogonikolos was contacted in December 2017 by representatives of an illicit Russian procurement network that acquires sensitive military-grade and dual-use technologies, under the direction of Russia’s Foreign Intelligence Service (SVR). Elements of that network are often referred to by Western government officials as “the Serniya Network” or “Sertal”, among other names. In December 2022 the United States charged five Russian nationals, including a suspected intelligence officer, believed to be part of that network, as well as two United States nationals.
In December 2017, Bogonikolos allegedly accepted an invitation to travel to Moscow alone for a meeting. The complaint cites an email exchange between senior members of Sertal and Serniya Network, including Yevgeniy Grinin and Aleksey Ippolitov, who are both wanted by the FBI. In the email exchange, it is suggested that Bogonikolos is a “supporter of the Orthodoxy” and that he sees it as “the basis of friendship with Russia”.
Probing the intelligence failure behind the assassination of Israeli PM Yitzchak Rabin
November 23, 2022 3 Comments
LAST WEEK, THE CHAIRMAN of the Israeli Religious Zionist Party, Bezalel Smotrich, who will soon be appointed as a cabinet minister, alleged that the Israel Security Agency (ISA) encouraged the killer of the late Israeli Prime Minister, Yitzhak Rabin. Smotrich’s allegation shocked many Israelis, because of the unfortunate timing —it was uttered close to the annual Remembrance Day for Prime Minister Rabin, who was assassinated by radical rightwing activist Yigal Amir 27 years ago. But also because of the unacceptable content, which echoes conspiracy theories that have accompanied Rabin’s assassination for many years. To counter these conspiracy theories, it is fitting to discuss the failure to defend Rabin that did occur under the responsibility of the ISA.
The failure that caused Rabin’s assassination was investigated by a National Inquiry Commission (known as the Shamgar Commission), which found the ISA responsible. In fact, it was deemed a double failure: the first by the personnel of the VIP Security Unit of the ISA, and the second by the intelligence personnel of the ISA, whose job it was to thwart in advance murderous intentions by extreme rightwing elements in Israel. The intelligence failure was not investigated in depth by the Shamgar Committee. It dealt mainly with the security failure and only partially with the intelligence failure. Its investigation focused on the activities of ISA agent Avishi Raviv (code name CHAMPAGNE) who was tasked by the 
ISA to infiltrate extreme rightwing groups. The Committee did not ask: could the ISA’s intelligence have prevented the murder?
It is also possible to ask: why was the mandate of the Shamgar Committee limited to investigating the area of security, and not intelligence? And why did its members refrain from extending their investigation to the issue of the intelligence failure? There are no answers to this question, even in the autobiographical book of the Committee’s chairman, the late Supreme Court Chief Justice Meir Shamgar.
A Key Piece of Intelligence
Smotrich referred to agent Raviv, who was indeed run in a deficient and unprofessional manner. Yet no malicious intentions can be attributed to the ISA. In any case, Raviv’s defense attorney convinced the court that Raviv did not know about the assassin’s intentions before the murder. The key piece of intelligence, which the ISA had received six months before Rabin’s murder, regarding Amir’s intentions, was handled extremely poorly: an asset of the IDF Central Command’s intelligence department told his commander that he had heard “a small, rotund and armed Yemeni” speaking at a bus stop about his intention to assassinate Rabin. The intelligence was immediately passed on to the head of the appropriate department in the ISA. Unfortunately, however, instead of the source being interrogated by trained ISA personnel, a police investigation was conducted that did not reveal any significant additional information. Read more of this post
A dramatic kidnap case in Malaysia may point to changes in Mossad’s tactics
October 24, 2022 2 Comments
REPORTS FROM KUALA LUMPUR SUGGEST that Malaysian agents operating in the service of Israeli intelligence carried out the kidnapping of a Palestinian engineer, Omar al-Balbaisi, on September 28. According to the Malaysian newspaper The Straits Times, the kidnap operation was orchestrated by the Israeli external intelligence agency, the Mossad.
Omar al-Balbaisi completed a bachelor’s degree in computer science at the Islamic University in Gaza, where he allegedly joined the Izz-ad-Din Al-Qassam Brigades, specializing in hacking mobile phones. In or around 2020, al-Balbaisi left the Gaza Strip for Istanbul, where, according to reports, a Hamas secret intelligence and cyber unit was established in 2020. The unit allegedly operated on instructions from the Hamas leadership in Gaza, without the knowledge of the Turkish authorities.
When al-Balbaisi was kidnapped, he was reportedly returning from lunch with another Palestinian expatriate. According to the report, a white van drove toward the two men. Four people emerged from the van, grabbed al-Balbaisi and dragged him into the vehicle, while yelling at him: “our boss wants to talk to you”. The other Palestinian tried to help al-Balbaisi, but was warned to stay away from the scene. He subsequently filed a report at a police station, reportedly about 40 minutes after his friend was kidnapped.
According to the reports, the kidnapped Palestinian was taken bound and blindfolded to a safe house, where his Malaysian captors tied him to a chair. They then called two men, allegedly Israelis, who told the abductee: “you know why you are here”. According to another report, al-Balbaisi was interrogated, allegedly by two Israelis, believed to be Mossad agents, via a video call. However, the video call was disconnected when Malaysian police officers broke into the safe house.
Upon receiving the information about the kidnapping, Malaysian police immediately sought to locate al-Balbaisi. They subsequently managed to raid the house where the Palestinian was being held, while his interrogation was underway. A source told the Malaysian newspaper that “the Israelis wanted to know about [al-Balbaisi’s] experience in the field of software, about the strengths of Hamas in this field, and the members of the Izz ad-Din al-Qassam Brigades that he knew”. Read more of this post
Dutch intelligence disrupts Russian effort to infiltrate International Criminal Court
June 16, 2022 1 Comment
ON JUNE 16, THE Dutch General Intelligence and Security Service (AIVD) announced that it prevented a Russian military intelligence officer from gaining access as an intern to the International Criminal Court (ICC) in The Hague. The ICC is of interest to the GRU because it investigates possible war crimes committed by Russia in the Russo-Georgian War of 2008 and more recently in Ukraine.
The GRU officer reportedly traveled from Brazil to Schiphol Airport in Amsterdam in April 2022, using a Brazilian cover identity, making him a so-called “illegal”. This means the intelligence operative was not formally associated with a Russian diplomatic facility. He allegedly planned to start an internship with the ICC, which would have given him access to the ICC’s building and systems. This could have enabled the GRU to collect intelligence, spot and recruit sources, and possibly influence criminal proceedings inside the ICC.
On his arrival at Schiphol, the AIVD informed the Dutch Immigration and Naturalization Service (IND), after which the officer was refused entry to the Netherlands and put on the first plane back to Brazil as persona non grata. The AIVD assessed the officer as a “potentially very serious” threat to both national security and the security of the ICC and Holland’s international allies, due to his access to the organization.
In a first-ever for the AIVD, the agency also released the contents of a partially redacted 4-page document that describes the “extensive and complex” cover identity of the officer. It was originally written in Portuguese, “probably created around mid-2010” and “likely written” by the officer himself. According to the AIVD, the information provides valuable insight into his modus operandi. The cover identity hid any and all links between him and Russia. According to the AIVD, the construction of this kind of cover identity “generally takes years to complete”.
In the note accompanying the document, the AIVD says that Russian intelligence services “spend years” on the construction of cover identities for illegals, using “information on how other countries register and store personal data”. Alternatively, they illegally procure or forge identity documents. Information in the cover identity “can therefore be traceable to one or more actual persons, living or dead” as well as to forged identities of individuals “who only exist on paper or in registries of local authorities”.
► Author: Matthijs Koot | Date: 17 June 2022 | Permalink
Several EU member states expel dozens of Russian diplomats for suspected espionage
April 4, 2022 1 Comment
A WEEK AFTER POLAND announced the expulsion of 45 Russian diplomats, the foreign ministries of Belgium, the Czech Republic, Ireland and the Netherlands announced on March 29, 2022 that they would expel Russian diplomats. A day later, Slovakia followed up by announcing it will expel 35 Russian diplomats. On Monday, April 4, France, Germany and Lithuania followed suit with dozens of expulsions.
The German federal government announced it will expel 40 Russian diplomats who, according to minister of foreign affairs Annalena Baerbock, “worked every day against our freedom and against the cohesion of our society”, and are “a threat to those who seek our protection”. The persons involved have five days to leave Germany. Later that day, France announced it will expel “many” Russian diplomats “whose activities are contrary to our security interests”, adding that “this action is part of a European approach”. No further details are known at this time.
Furthermore, Lithuania ordered the Russian ambassador to Vilnius to leave the country, and announced their ambassador to Ukraine will return to Kyiv. In an official statement, foreign minister Gabrielius Landsbergis said Lithuania was “lowering the level of diplomatic representation with Russia, this way expressing its full solidarity with Ukraine and the Ukrainian people, who are suffering from Russia’s unprecedented aggression”. Meanwhile, Latvian minister of foreign affairs Edgars Rinkēvičs announced in a tweet that Latvia will “limit diplomatic relations” with the Russian Federation “taking into account the crimes committed by the Russian armed forces in Ukraine”, and that “specific decisions will be announced once internal procedures have been complete”.
The Czech Republic, which in 2021 called on the European Union (EU) and the North Atlantic Treaty Organization (NATO) to expel Russian diplomats in solidarity against Moscow, announced the expulsion of one diplomat from the Russian embassy in Prague, on a 72-hour notice. In a tweet, the Czech ministry of foreign affairs stated that “Together with our Allies, we are reducing the Russian intelligence presence in the EU”.
Belgium has order the expulsion of 21 diplomats from the Russian embassy in Brussels and consulate in Antwerp. Minister Sophie Wilmès said the measure was taken to protect national security and was unrelated to the war in Ukraine. “Diplomatic channels with Russia remain open, the Russian embassy can continue to operate and we continue to advocate dialogue”, Wilmès said.
The Netherlands will be expelling 17 diplomats from the Russian embassy in The Hague. According to minister Wopke Hoekstra, the diplomats were secretly active as intelligence officers. Hoekstra based this on information from the Dutch secret services AIVD and MIVD. The Russian embassy in The Hague has 75 registered diplomats, of which 58 will remain. Hoekstra says the decision was taken with “a number of like-minded countries”, based on grounds of national security. Like his Belgian colleague, Woekstra adds he wants diplomatic channels with Russia to remain open.
Ireland will be expelling four “senior officials” from the Russian embassy in Dublin, for engaging in activities “not […] in accordance with international standards of diplomatic behaviour”. They were suspected of being undercover military officers of the GRU and were already on the radar of Garda Síochána, the Irish national police and security service, for some time.
Dutch intelligence disrupt large-scale botnet belonging to Russian spy agency
March 7, 2022 Leave a comment
ON MARCH 3, 2022, Dutch newspaper Volkskrant reported that the Dutch Military Intelligence and Security Service (MIVD) took action in response to abuse of SOHO-grade network devices in the Netherlands. The attacks are believed to have been perpetrated by the Main Intelligence Directorate of the General Staff of the Russian Armed Forces (GRU) Unit 74455. The unit, which is also known as Sandworm or BlackEnergy, is linked to numerous instances of influence operations and sabotage around the world.
The devices had reportedly been compromised and made part of a large-scale botnet consisting of thousands of devices around the globe, which the GRU has been using to carry out digital attacks. The MIVD traced affected devices in the Netherlands and informed their owners, MIVD chief Jan Swillens told Volkskrant. The MIVD’s discovery came after American and British [pdf] services warned in late February that Russian operatives were using a formerly undisclosed kind of malware, dubbed Cyclops Blink. According to authorities, the botnet in which the compromised devices were incorporated has been active since at least June 2019.
Cyclops Blink leverages a vulnerability in WatchGuard Firebox appliances that can be exploited if the device is configured to allow unrestricted remote management. This feature is disabled by default. The malware has persistence, in that it can survive device reboots and firmware updates. The United Kingdom’s National Cyber Security Centre describes Cyclops Blink as a “highly sophisticated piece of malware”.
Some owners of affected devices in the Netherlands were asked by the MIVD to (voluntarily) hand over infected devices. They were advised to replace the router, and in a few cases given a “coupon” for an alternative router, according to the Volkskrant. The precise number of devices compromised in the Netherlands is unclear, but is reportedly in the order of dozens. Swillens said the public disclosure is aimed at raising public awareness. “The threat is sometimes closer than you think. We want to make citizens aware of this. Consumer and SOHO devices, used by the grocery around the corner, so to speak, are leveraged by foreign state actors”, he added.
The disclosure can also be said to fit in the strategy of public attribution that was first mentioned in the Netherlands’ Defense Cyber Strategy of 2018. Published shortly after the disclosure of the disruption by MIVD of an attempted GRU attack against the computer network of the OPCW, the new strategy included the development of attribution capabilities, as well as the development of offensive capabilities in support of attribution. It advocates the view that state actors “that are [publicly] held accountable for their actions will make a different assessment than attackers who can operate in complete anonymity”.
► Author: Matthijs Koot | Date: 07 March 2022 | Permalink
Dutch intelligence service warns public about online recruitment by foreign spies
February 15, 2022 Leave a comment
LAST WEEK, THE DUTCH General Intelligence and Security Service (AIVD) launched an awareness campaign dubbed ‘Check before connecting’. The purpose of the campaign is to inform the Dutch public about risks of foreign actors using fake accounts on social media, in efforts to acquire sensitive business information. According to the AIVD, such online campaigns frequently target and recruit employees of Dutch private sector companies. The awareness campaign is carried out via Twitter, Instagram and LinkedIn. It is aimed at raising awareness in society at-large. The AIVD will publish a number of fictitious practical examples over time, in order to educate the public.
AIVD director-general Erik Akerboom told Dutch newspaper Het Financieele Dagblad that Dutch and other Western secret services have been surprised by the sheer number of cases in which private sector employees disclosed sensitive information, after being blackmailed or enticed with money to share information. After foreign intelligence operatives make initial contact with their target via LinkedIn, the relationship quickly turns more “personal”, according to Akerboom. The new contact acts flatteringly about the unsuspecting target’s knowledge and competence. “You are asked to translate something. This can be followed by a physical meeting”, he says.
Potential targets are “ranked” by their position in an organization, position in a business network, and level of access to sensitive information. “The rankings determine which persons are prioritized for recruitment attempts”, according to Akerboom. This sometimes involves the creation of fake human resource recruitment agencies, as British, Australian and American intelligence agencies have warned about in the past.
While not a new phenomenon, the scope and effectiveness of foreign infiltration attempts have now reached a scale that has prompted the AIVD to warn the public. China and Russia have made attempts to acquire advanced technology in Western countries, including the Netherlands, via corporate takeovers, digital espionage, and human intelligence operations. Last year, the Netherlands expelled two Russian spies who successfully recruited employees at a number of Dutch high-tech companies. One of the Russians created fake profiles posing as a scientist, consultant and recruiter. The AIVD did not disclose the names of these companies. Read more of this post
Year in review: The biggest spy-related stories of 2021, part 3
December 31, 2021 Leave a comment
Since 2008, when intelNews was launched, it has been our end-of-year tradition to take a look back and highlight what we believe were the most important intelligence-related stories of the past 12 months. In anticipation of what 2022 may bring in this always timely and highly volatile field, we present you with our selection of the top spy stories of 2021. They are listed below in reverse order of significance, starting from 10 and leading up to 1. This is the third part in a three-part series. Part one is available here and part two is here.
04. FBI built a fake phone company in massive global wiretapping operation. The United States Federal Bureau of Investigation built a fake telephone service provider for a secret worldwide operation that officials described as “a watershed moment” in law enforcement history. The operation, known as TROJAN SHIELD, involved over 9,000 law enforcement officers in 18 countries around the world. When the existence of TROJAN SHIELD was announced in a series of official news conferences in June, officials said the operation had “given law enforcement a window into a level of criminality [never] seen before on this scale”.
03. US spied on some of its closest European allies with the help of Denmark. The first claims of an alleged secret collaboration between the signals intelligence agencies of the United States and Denmark surfaced in November of 2020. By January of 2021, it was clear that the Danish government would, sooner or later, need to deal with the fallout of its controversial spy deal with Washington, under which Denmark enabled the US to spy on some of its closest European allies. Still, the news in June that Denmark helped the US spy on countries such as Germany, France, Sweden and Norway, was nothing short of remarkable, and has a huge symbolic significance that cannot be overlooked.
02. For the first time, Chinese and North Korean spies were tried in the US. For the first time, an alleged Chinese spy was tried—and convicted—in the United States. According to prosecutors Yanjun Xu, also known as Qu Hui or Zhang Hui, was a deputy division director in the Ministry of State Security (MSS)—China’s intelligence agency. His conviction was described by observers as a “seminal moment” for American counterintelligence. Also for the first time, an alleged intelligence officer of North Korea, Mun Chol-myong, was tried in a US court. A North Korean citizen based in Singapore, Mun had tried to defraud international banks and launder money though the US financial system, allegedly for the benefit of North Korean spy agencies.
01. At least 14 heads of state were targeted through controversial phone spyware. At least 14 current or former heads of state were among 50,000 individuals worldwide whose personal telephones were allegedly compromised through a controversial surveillance software, known as Pegasus. The spyware is marketed by NSO Group Technologies, an Israeli digital surveillance company based near Tel Aviv. Pegasus can install itself on targeted telephones without requiring their users to click a link, or download an application. The list of the spyware’s targets allegedly contains telephone devices belonging to three presidents, France’s Emmanuel Macron (pictured), South Africa’s Cyril Ramaphosa, and Iraq’s Barham Salih. The devices of three current prime ministers, Morocco’s Saad-Eddine El Othmani, Egypt’s Mostafa Madboul, and Pakistan’s Imran Khan, are also on the list. There are countless others. As a result of these revelations, the US Department of Commerce placed the NSO Group Technologies on a sanctions list in November 3.
This is part three in a three-part series. Part one is available here. Part two is available here.
► Author: Joseph Fitsanakis and Ian Allen | Date: 31 December 2021 | Permalink
intelNews.org 
Analysis: Israel underestimated Hamas while overestimating its own capabilities
January 10, 2024 10 Comments
In the eyes of the Israeli generation of the Yom Kippur War, the possibility of such a failure happening again was unthinkable. Yet there is a significant difference between the events of 1973 and the events of last October 7. In 1973 the intelligence failed, but the IDF reacted quickly and acted efficiently. This
time, in the first two days of the conflict the IDF was confused and acted without direction, in the apparent absence of relevant action plans for what to do in the event of a massive invasion. The IDF was clearly not ready for such a scenario.
Recently, another important piece of information about the intelligence failure of October 7 was revealed. It was reported that, two months before the surprise attack by Hamas, information was received from an agent handled by the Israel Security Agency (ISA) in Gaza, with a “very high” reliability level. The agent allegedly reported that Hamas was planning “a major move in the week after Yom Kippur”. Yet that warning was not marked as significant; the assumption was that, if the warning materialized, it would be corroborated with additional intelligence. It was thus kept from higher levels of command and from Israeli Military Intelligence (IMI). The ISA did not deny the report, saying instead in a statement: “Focusing on one specific piece of news or another does not reflect the intelligence picture at the time”.
Given the high number of casualties and the horrendous destruction that resulted from the October 7 attack, many Israelis, including some in the security establishment, feel that it is far too long to wait until a commission of inquiry is established and publishes its conclusions. It will likely take at least two years
for those conclusions to become public. What is to be done in the meantime? There is public pressure to launch the inquiry soon.
Recently the State Comptroller of Israel, Matanyahu Engelman, announced that he has begun to investigate the intelligence failure. This is an appropriate move. However, with all due respect to the state comptroller’s inquiries, we know from previous experience that his findings have no teeth. For instance, in the context of Hamas, the state comptroller’s review of Operation TZUK EITAN (the 2014 Gaza War) was published in early 2017. It revealed serious instances of misconduct in the intelligence community dating several years prior to the operation. Yet this severe criticism passed below the public’s radar and was practically ignored, while no actions were taken against IDF and ISA security personnel that were shown to have acted irresponsibly.
I would like to point to a number of stronger factors that led to the tragic complacency of October 7, drawn from the field of psychology. It relates to how a country (mainly through its intelligence analysts) perceives its enemies and how this affects the evaluations of said enemies. We know that there was a conception on the Israeli side that Hamas had no interest in attacking Israel at this stage. It seems that the State of Israel underestimated Hamas and its leader, Yahya Sinwar, based on the available evidence of Hamas and Sinwar. Read more of this post
Filed under Expert news and commentary on intelligence, espionage, spies and spying Tagged with 2023 Israel-Hamas War, Analysis, Avner Barnea, Hamas, Israel