Analysis: How Israeli Intelligence Failed to Anticipate the Hamas Attack

Hamas GazaSEVERAL DAYS HAVE PASSED since October 7, the day when Hamas stunned Israel with a surprise attack against several settlements near the Gaza border. It is now clear that Israeli intelligence was in possession of warning indicators about the attack, and that these indicators were misjudged.

The IMI and ISA Assessment

It is important to note that the intelligence division of the Israel Defense Forces (IDF), known as Israeli Military Intelligence (IMI), and the  Israel Security Agency (ISA), have been monitoring Hamas for years. These two agencies are believed to have conducted a situation assessment approximately two weeks before the October 7 attack. The assessment concluded that Hamas was deterred and had no interest in changing the status quo by attacking Israel in the short run. This assessment was communicated to Prime Minister Benjamin Netanyahu and Minister of Defense Yoav Gallant.

It appears that this assessment was not supported by concrete intelligence. The agencies that produced it relied primarily on monitoring the recent behavior of Hamas, including the fact that it was allowing Palestinians living in Gaza to work inside Israel. Additionally, the assessment noted the fact that Hamas was receiving funds from Qatar to help the poverty-stricken residents of Gaza. In retrospect, this assessment appears to have been based on wishful thinking.

The Egyptian Warning

It is now known that Abbas Kamel, Director of the Egyptian General Intelligence Directorate, sent a warning to Israel a few days before Hamas’ attack. Kamel allegedly warned of “something unusual, a terrible operation”, which was about to take place from the direction of Gaza. The warning was forwarded to Prime Minister Netanyahu’s office. The Israeli newspaper that published this report, Yedioth Ahronot, is known for its serious reputation and quality sources inside the Egyptian establishment. According to the report, Kamel was told by the Israelis that they were focused on preventing terrorist attacks in the West Bank.

Yet, in a speech that Netanyahu delivered immediately after the October 7 attack broke out, he denied claims about the Egyptian warning and claimed that they were fake news. However, American Congressman Michael McCaul, Chairman of the House Foreign Affairs Committee, said on October 11: “We know that Egypt […] warned the Israelis three days prior that an event like this could happen”. Speaking to reporters following a closed-door intelligence briefing on the crisis for American lawmakers, McCaul added: “I don’t want to get too much into classified [details], but a warning was given”. An Egyptian government source also asserted that Egyptian intelligence officials warned their Israeli counterparts that Hamas was planning “something big” ahead of the October 7 surprise onslaught. But this intelligence appears to have been ignored. Read more of this post

Analysis : Attack on Israel Points to Systemic Failure at All Levels

Hamas Israel - BarneaTHE COMPARISON BETWEEN THE October 2023 attack on Israel and the Yom Kippur War is reasonable. We still have an obscured perspective on what happened on October 7. But even this partial picture makes it possible to draw a preliminary comparison. Undoubtedly, there is no precedent for such a monumental failure in the history of Israeli intelligence.

The most striking difference between the two case studies is that in 1973 the system as a whole did not fail. The failure was personal, on the part of several key people, who did not perform according to expectations. The events of 2023 point to a systemic failure at all levels, not personal mistakes. The failure is at the level of intelligence warning, the military response to the attack, and even the actions of Israel’s political leadership.

An Intelligence and Military Failure

In 1973, the intelligence-gathering system was working well, and Egypt’s war intentions were known. Thousands of reports from observations along the Suez Canal spoke of the Egyptian preparations. The wireless transmissions that were issued testified to preparation for war in the Egyptian army. All this did not translate into a warning of war, due to the failed performance of some senior officers in the Israeli Military Intelligence (IMI), who stuck to their preconceived notions until the last moment.

In 2023, the failure is systemic. It involves both the level of collection and at the level of assessment. It relates both to the IMI and the Israel Security Agency (ISA). It has already become clear that the intelligence collection mechanisms failed to detect large-scale preparations for an all-out attack from the Gaza Strip. A massive intelligence system failed to detect the preparatory actions of the assailing forces.

When the perceived enemy is Palestinian civilians and when Israel Defense Forces (IDF) soldiers spend their time guarding settlements and worshipers, instead of engaging in hard training, the result is catastrophic. On October 7, we witnessed the operations of an army whose main mission is occupation. Given what we saw on that day, namely more than 1,000 civilian and military casualties and approximately 150 kidnapped Israelis, it is not clear how this army will be able to face the upcoming challenges in this war. The need for the professionalism and resilience of the IDF, which was there in 1973, continues to exist.

A Political Failure

The comparison between the political leadership of 1973 and 2023 is also discouraging. Back then, the root of the failure was that the intelligence information the leadership received from Eli Zeira, the director of IMI, who was the nation’s most senior intelligence officer, was distorted and false. It is now understood that the IMI’s assessments were based on the concept of reassuring the political leadership. Yet, Prime Minister Golda Meir and Minister of Defense Moshe Dayan were challenged after the war, and were eventually removed from their positions. However, they acted responsibly.

In contrast, there is not much to say about Israel’s current political leadership. It suffices to look at the composition of the Security Cabinet and the first leaks that have already begun to emanate from it, or at the surge of slander that members of the governing coalition have begun to heap on the finest of the IDF’s officers. It is nothing short of a disgrace and a disaster.

This war has just begun. It is still too early to draw conclusions. But we can examine the conclusions from the Yom Kippur War and assess their relevance to today. When Israeli Prime Minister Benjamin Netanyahu talks about revenge, it is advisable to remember those lessons. The conflict with the Palestinians is long and bitter. They will not give up their ambition for their state. It is now time to comprehend the full cost of the continuation of the conflict.

► Author: Avner Barnea | Date: 11 October 2023 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

Alleged Israeli spies with Russian citizenship arrested in Lebanon

Rafic Hariri International Airport Beirut LebanonLAST WEEK, LEBANON’S GENERAL Security Directorate charged two Russian citizens with spying for Israel. The two Russians, who appear to be legally married to each other, were detained by authorities at Beirut’s Rafic Hariri International Airport as they were attempting to leave the country. The detentions were reported by the Lebanese newspaper Al-Akhbar, which is affiliated with the Lebanese militant group Hezbollah.

According to the Al-Akhbar report, one of the suspects admitted that he had been recently recruited into Israeli intelligence. He also reportedly admitted that, as part of his espionage activities, he received maps of sites and instructions about gatherings at facilities in Lebanon belonging to the Hezbollah organization. He added that he had been instructed to access, inspect and, if possible, photograph these facilities. He also reportedly admitted that he had visited southern Lebanon and entered Hamas-controlled areas of southern Beirut, where he had collected data and verified it against the information available to his handlers.

The report added that the suspect’s wife, who was also arrested, admitted under interrogation that she was aware of her husband’s work and that she had assisted him in his tasks. According to the report the General Security Directorate had suspected the Russian citizen, because he had traveled in southern Lebanon several times. Lebanese authorities were able to track his movements and connections, eventually tracing his place of residence. He was arrested along with his wife soon after being notified by his handlers that he should leave the country immediately.

Al-Akhbar added that, prior to the arrest, the General Security Directorate had informed the Russian Embassy in Beirut of its intention to arrest the Russian citizens. The agency’s Director, Elias Elbisri, said following the arrest: “A spy ring for the benefit of the Israeli enemy was foiled at the Beirut airport, consisting of two people who tried to leave Lebanon”. According to Elbisri, “we carried out the necessary investigations; this cell posed a threat to Lebanon”.

Israeli authorities did not respond to news about the incident. It should be noted that, if Russian citizens were indeed recruited and employed by Israeli intelligence, this development could further-damage the relationship between Israel and Russia, which is already fragile due to ongoing developments in Syria and Ukraine. Israel regularly launches attacks on Iranian facilities and equipment in Syria —a Russian ally. Israel is also believed to provide security assistance to Ukraine, which is engaged in a bloody war over territory with Russia.

In recent days, there have been leaks in Israel that an intense debate took place in the Israeli Security Cabinet, following the rise in Palestinian acts of terrorism in Israel, which, according to Israeli security agencies, are guided by Hezbollah and Hamas. As a result, Hamas operatives in the Gaza Strip are taking protective actions, fearing the renewal of targeted killings by Israeli forces. Salah al-Aruri, commander of Hamas’ Izz ad-Din al-Qassam Brigades, who is directing his forces against Israel from abroad, could also be a target for the Israeli intelligence community.

► Author: Avner Barnea | Date: 04 September 2023 | Permalink

Dr. Avner Barnea is research fellow at the National Security Studies Center of the University of Haifa in Israel. He served as a senior officer in the Israel Security Agency (ISA). He is the author of We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books, 2021).

U.S. charges Greek businessman with smuggling military and dual-use goods to Russia

Rijen NetherlandsThe United States Department of Justice has charged a Greek national with wire fraud and smuggling sensitive military-grade and dual-use goods from the United States to Russia. The suspect, Dr. Nikolaos “Nikos” Bogonikolos, 59, was arrested in Paris, France, on May 9, at the request of the United States, and is currently in custody pending extradition proceedings.

Bogonikolos is a mathematician and self-described “serial entrepreneur”, with business activities dating back to 1987. He has authored and co-authored academic articles, holds a number of patents, and has published a book entitled Total Process Security Reengineering. Following the ECHELON revelations in the late 1990’s, he authored a report (.pdf) entitled “The Perception of Economic Risks Arising from the Potential Vulnerability of Electronic Commercial Media to Interception” as part of a study for the European Parliament.

In 2005, Bogonikolos received his PhD from the Kharkov National Economic University in Ukraine, focusing on applications of artificial intelligence in the field of economics. According to his own claims, he has been active as an entrepreneur or researcher in some 40 countries, including Russia. Bogonikolos is the founder of a Greek-based company called Aratos Group. In 2016, Aratos Systems BV was registered as legal entity in The Netherlands. Since 2020, the company has been located in the town of Rijen, which is also home to the main operational military helicopter base of the Royal Netherlands Air Force.

Aratos Systems BV describes itself on its website (currently offline) as an “independent and leading member of the Greek Aratos Group”. Its activities, as declared to the Netherlands chamber of commerce, are “the collection, processing, protecting, and selling of earth observation data to public and private parties”. Aratos Systems also “owns and runs a fully equipped Satellite Ground Station constantly connected with EUMETSAT” —the latter being the European operational satellite agency for monitoring weather, climate and the environment from space.

Last week, the Netherlands Public Prosecution Service and the Fiscal Information and Investigation Service raided the Aratos Systems offices in Rijen. According to the unsealed complaint (.pdf) it is believed that Bogonikolos was contacted in December 2017 by representatives of an illicit Russian procurement network that acquires sensitive military-grade and dual-use technologies, under the direction of Russia’s Foreign Intelligence Service (SVR). Elements of that network are often referred to by Western government officials as “the Serniya Network” or “Sertal”, among other names. In December 2022 the United States charged five Russian nationals, including a suspected intelligence officer, believed to be part of that network, as well as two United States nationals.

In December 2017, Bogonikolos allegedly accepted an invitation to travel to Moscow alone for a meeting. The complaint cites an email exchange between senior members of Sertal and Serniya Network, including Yevgeniy Grinin and Aleksey Ippolitov, who are both wanted by the FBI. In the email exchange, it is suggested that Bogonikolos is a “supporter of the Orthodoxy” and that he sees it as “the basis of friendship with Russia”.

Read more of this post

Probing the intelligence failure behind the assassination of Israeli PM Yitzchak Rabin

Rabin ArafatLAST WEEK, THE CHAIRMAN of the Israeli Religious Zionist Party, Bezalel Smotrich, who will soon be appointed as a cabinet minister, alleged that the Israel Security Agency (ISA) encouraged the killer of the late Israeli Prime Minister, Yitzhak Rabin. Smotrich’s allegation shocked many Israelis, because of the unfortunate timing —it was uttered close to the annual Remembrance Day for Prime Minister Rabin, who was assassinated by radical rightwing activist Yigal Amir 27 years ago. But also because of the unacceptable content, which echoes conspiracy theories that have accompanied Rabin’s assassination for many years. To counter these conspiracy theories, it is fitting to discuss the failure to defend Rabin that did occur under the responsibility of the ISA.

The failure that caused Rabin’s assassination was investigated by a National Inquiry Commission (known as the Shamgar Commission), which found the ISA responsible. In fact, it was deemed a double failure: the first by the personnel of the VIP Security Unit of the ISA, and the second by the intelligence personnel of the ISA, whose job it was to thwart in advance murderous intentions by extreme rightwing elements in Israel. The intelligence failure was not investigated in depth by the Shamgar Committee. It dealt mainly with the security failure and only partially with the intelligence failure. Its investigation focused on the activities of ISA agent Avishi Raviv (code name CHAMPAGNE) who was tasked by the ISA to infiltrate extreme rightwing groups. The Committee did not ask: could the ISA’s intelligence have prevented the murder?

It is also possible to ask: why was the mandate of the Shamgar Committee limited to investigating the area of security, and not intelligence? And why did its members refrain from extending their investigation to the issue of the intelligence failure? There are no answers to this question, even in the autobiographical book of the Committee’s chairman, the late Supreme Court Chief Justice Meir Shamgar.

A Key Piece of Intelligence

Smotrich referred to agent Raviv, who was indeed run in a deficient and unprofessional manner. Yet no malicious intentions can be attributed to the ISA. In any case, Raviv’s defense attorney convinced the court that Raviv did not know about the assassin’s intentions before the murder. The key piece of intelligence, which the ISA had received six months before Rabin’s murder, regarding Amir’s intentions, was handled extremely poorly: an asset of the IDF Central Command’s intelligence department told his commander that he had heard “a small, rotund and armed Yemeni” speaking at a bus stop about his intention to assassinate Rabin. The intelligence was immediately passed on to the head of the appropriate department in the ISA. Unfortunately, however, instead of the source being interrogated by trained ISA personnel, a police investigation was conducted that did not reveal any significant additional information. Read more of this post

A dramatic kidnap case in Malaysia may point to changes in Mossad’s tactics

Kuala Lumpur MalaysiaREPORTS FROM KUALA LUMPUR SUGGEST that Malaysian agents operating in the service of Israeli intelligence carried out the kidnapping of a Palestinian engineer, Omar al-Balbaisi, on September 28. According to the Malaysian newspaper The Straits Times, the kidnap operation was orchestrated by the Israeli external intelligence agency, the Mossad.

Omar al-Balbaisi completed a bachelor’s degree in computer science at the Islamic University in Gaza, where he allegedly joined the Izz-ad-Din Al-Qassam Brigades, specializing in hacking mobile phones. In or around 2020, al-Balbaisi left the Gaza Strip for Istanbul, where, according to reports, a Hamas secret intelligence and cyber unit was established in 2020. The unit allegedly operated on instructions from the Hamas leadership in Gaza, without the knowledge of the Turkish authorities.

When al-Balbaisi was kidnapped, he was reportedly returning from lunch with another Palestinian expatriate. According to the report, a white van drove toward the two men. Four people emerged from the van, grabbed al-Balbaisi and dragged him into the vehicle, while yelling at him: “our boss wants to talk to you”. The other Palestinian tried to help al-Balbaisi, but was warned to stay away from the scene. He subsequently filed a report at a police station, reportedly about 40 minutes after his friend was kidnapped.

According to the reports, the kidnapped Palestinian was taken bound and blindfolded to a safe house, where his Malaysian captors tied him to a chair. They then called two men, allegedly Israelis, who told the abductee: “you know why you are here”. According to another report, al-Balbaisi was interrogated, allegedly by two Israelis, believed to be Mossad agents, via a video call. However, the video call was disconnected when Malaysian police officers broke into the safe house.

Upon receiving the information about the kidnapping, Malaysian police immediately sought to locate al-Balbaisi. They subsequently managed to raid the house where the Palestinian was being held, while his interrogation was underway. A source told the Malaysian newspaper that “the Israelis wanted to know about [al-Balbaisi’s] experience in the field of software, about the strengths of Hamas in this field, and the members of the Izz ad-Din al-Qassam Brigades that he knew”. Read more of this post

Dutch intelligence disrupts Russian effort to infiltrate International Criminal Court

International Criminal CourtON JUNE 16, THE Dutch General Intelligence and Security Service (AIVD) announced that it prevented a Russian military intelligence officer from gaining access as an intern to the International Criminal Court (ICC) in The Hague. The ICC is of interest to the GRU because it investigates possible war crimes committed by Russia in the Russo-Georgian War of 2008 and more recently in Ukraine.

The GRU officer reportedly traveled from Brazil to Schiphol Airport in Amsterdam in April 2022, using a Brazilian cover identity, making him a so-called “illegal”. This means the intelligence operative was not formally associated with a Russian diplomatic facility. He allegedly planned to start an internship with the ICC, which would have given him access to the ICC’s building and systems. This could have enabled the GRU to collect intelligence, spot and recruit sources, and possibly influence criminal proceedings inside the ICC.

On his arrival at Schiphol, the AIVD informed the Dutch Immigration and Naturalization Service (IND), after which the officer was refused entry to the Netherlands and put on the first plane back to Brazil as persona non grata. The AIVD assessed the officer as a “potentially very serious” threat to both national security and the security of the ICC and Holland’s international allies, due to his access to the organization.

In a first-ever for the AIVD, the agency also released the contents of a partially redacted 4-page document that describes the “extensive and complex” cover identity of the officer. It was originally written in Portuguese, “probably created around mid-2010” and “likely written” by the officer himself. According to the AIVD, the information provides valuable insight into his modus operandi. The cover identity hid any and all links between him and Russia. According to the AIVD, the construction of this kind of cover identity “generally takes years to complete”.

In the note accompanying the document, the AIVD says that Russian intelligence services “spend years” on the construction of cover identities for illegals, using “information on how other countries register and store personal data”. Alternatively, they illegally procure or forge identity documents. Information in the cover identity “can therefore be traceable to one or more actual persons, living or dead” as well as to forged identities of individuals “who only exist on paper or in registries of local authorities”.

► Author: Matthijs Koot | Date: 17 June 2022 | Permalink

Several EU member states expel dozens of Russian diplomats for suspected espionage

Russian Embassy PragueA WEEK AFTER POLAND announced the expulsion of 45 Russian diplomats, the foreign ministries of Belgium, the Czech Republic, Ireland and the Netherlands announced on March 29, 2022 that they would expel Russian diplomats. A day later, Slovakia followed up by announcing it will expel 35 Russian diplomats. On Monday, April 4, France, Germany and Lithuania followed suit with dozens of expulsions.

The German federal government announced it will expel 40 Russian diplomats who, according to minister of foreign affairs Annalena Baerbock, “worked every day against our freedom and against the cohesion of our society”, and are “a threat to those who seek our protection”. The persons involved have five days to leave Germany. Later that day, France announced it will expel “many” Russian diplomats “whose activities are contrary to our security interests”, adding that “this action is part of a European approach”. No further details are known at this time.
Furthermore, Lithuania ordered the Russian ambassador to Vilnius to leave the country, and announced their ambassador to Ukraine will return to Kyiv. In an official statement, foreign minister Gabrielius Landsbergis said Lithuania was “lowering the level of diplomatic representation with Russia, this way expressing its full solidarity with Ukraine and the Ukrainian people, who are suffering from Russia’s unprecedented aggression”. Meanwhile, Latvian minister of foreign affairs Edgars Rinkēvičs announced in a tweet that Latvia will “limit diplomatic relations” with the Russian Federation “taking into account the crimes committed by the Russian armed forces in Ukraine”, and that “specific decisions will be announced once internal procedures have been complete”.

The Czech Republic, which in 2021 called on the European Union (EU) and the North Atlantic Treaty Organization (NATO) to expel Russian diplomats in solidarity against Moscow, announced the expulsion of one diplomat from the Russian embassy in Prague, on a 72-hour notice. In a tweet, the Czech ministry of foreign affairs stated that “Together with our Allies, we are reducing the Russian intelligence presence in the EU”.

Belgium has order the expulsion of 21 diplomats from the Russian embassy in Brussels and consulate in Antwerp. Minister Sophie Wilmès said the measure was taken to protect national security and was unrelated to the war in Ukraine. “Diplomatic channels with Russia remain open, the Russian embassy can continue to operate and we continue to advocate dialogue”, Wilmès said.

The Netherlands will be expelling 17 diplomats from the Russian embassy in The Hague. According to minister Wopke Hoekstra, the diplomats were secretly active as intelligence officers. Hoekstra based this on information from the Dutch secret services AIVD and MIVD. The Russian embassy in The Hague has 75 registered diplomats, of which 58 will remain. Hoekstra says the decision was taken with “a number of like-minded countries”, based on grounds of national security. Like his Belgian colleague, Woekstra adds he wants diplomatic channels with Russia to remain open.

Ireland will be expelling four “senior officials” from the Russian embassy in Dublin, for engaging in activities “not […] in accordance with international standards of diplomatic behaviour”. They were suspected of being undercover military officers of the GRU and were already on the radar of Garda Síochána, the Irish national police and security service, for some time.

Read more of this post

Dutch intelligence disrupt large-scale botnet belonging to Russian spy agency

GRU KtON MARCH 3, 2022, Dutch newspaper Volkskrant reported that the Dutch Military Intelligence and Security Service (MIVD) took action in response to abuse of SOHO-grade network devices in the Netherlands. The attacks are believed to have been perpetrated by the Main Intelligence Directorate of the General Staff of the Russian Armed Forces (GRU) Unit 74455. The unit, which is also known as Sandworm or BlackEnergy, is linked to numerous instances of influence operations and sabotage around the world.

The devices had reportedly been compromised and made part of a large-scale botnet consisting of thousands of devices around the globe, which the GRU has been using to carry out digital attacks. The MIVD traced affected devices in the Netherlands and informed their owners, MIVD chief Jan Swillens told Volkskrant. The MIVD’s discovery came after American and British [pdf] services warned in late February that Russian operatives were using a formerly undisclosed kind of malware, dubbed Cyclops Blink. According to authorities, the botnet in which the compromised devices were incorporated has been active since at least June 2019.

Cyclops Blink leverages a vulnerability in WatchGuard Firebox appliances that can be exploited if the device is configured to allow unrestricted remote management. This feature is disabled by default. The malware has persistence, in that it can survive device reboots and firmware updates. The United Kingdom’s National Cyber Security Centre describes Cyclops Blink as a “highly sophisticated piece of malware”.

Some owners of affected devices in the Netherlands were asked by the MIVD to (voluntarily) hand over infected devices. They were advised to replace the router, and in a few cases given a “coupon” for an alternative router, according to the Volkskrant. The precise number of devices compromised in the Netherlands is unclear, but is reportedly in the order of dozens. Swillens said the public disclosure is aimed at raising public awareness. “The threat is sometimes closer than you think. We want to make citizens aware of this. Consumer and SOHO devices, used by the grocery around the corner, so to speak, are leveraged by foreign state actors”, he added.

The disclosure can also be said to fit in the strategy of public attribution that was first mentioned in the Netherlands’ Defense Cyber Strategy of 2018. Published shortly after the disclosure of the disruption by MIVD of an attempted GRU attack against the computer network of the OPCW, the new strategy included the development of attribution capabilities, as well as the development of offensive capabilities in support of attribution. It advocates the view that state actors “that are [publicly] held accountable for their actions will make a different assessment than attackers who can operate in complete anonymity”.

► Author: Matthijs Koot | Date: 07 March 2022 | Permalink

Dutch intelligence service warns public about online recruitment by foreign spies

AIVD HollandLAST WEEK, THE DUTCH General Intelligence and Security Service (AIVD) launched an awareness campaign dubbed ‘Check before connecting’. The purpose of the campaign is to inform the Dutch public about risks of foreign actors using fake accounts on social media, in efforts to acquire sensitive business information. According to the AIVD, such online campaigns frequently target and recruit employees of Dutch private sector companies. The awareness campaign is carried out via Twitter, Instagram and LinkedIn. It is aimed at raising awareness in society at-large. The AIVD will publish a number of fictitious practical examples over time, in order to educate the public.

AIVD director-general Erik Akerboom told Dutch newspaper Het Financieele Dagblad that Dutch and other Western secret services have been surprised by the sheer number of cases in which private sector employees disclosed sensitive information, after being blackmailed or enticed with money to share information. After foreign intelligence operatives make initial contact with their target via LinkedIn, the relationship quickly turns more “personal”, according to Akerboom. The new contact acts flatteringly about the unsuspecting target’s knowledge and competence. “You are asked to translate something. This can be followed by a physical meeting”, he says.

Potential targets are “ranked” by their position in an organization, position in a business network, and level of access to sensitive information. “The rankings determine which persons are prioritized for recruitment attempts”, according to Akerboom. This sometimes involves the creation of fake human resource recruitment agencies, as British, Australian and American intelligence agencies have warned about in the past.

While not a new phenomenon, the scope and effectiveness of foreign infiltration attempts have now reached a scale that has prompted the AIVD to warn the public. China and Russia have made attempts to acquire advanced technology in Western countries, including the Netherlands, via corporate takeovers, digital espionage, and human intelligence operations. Last year, the Netherlands expelled two Russian spies who successfully recruited employees at a number of Dutch high-tech companies. One of the Russians created fake profiles posing as a scientist, consultant and recruiter. The AIVD did not disclose the names of these companies. Read more of this post

Year in review: The biggest spy-related stories of 2021, part 3

End of Year ReviewSince 2008, when intelNews was launched, it has been our end-of-year tradition to take a look back and highlight what we believe were the most important intelligence-related stories of the past 12 months. In anticipation of what 2022 may bring in this always timely and highly volatile field, we present you with our selection of the top spy stories of 2021. They are listed below in reverse order of significance, starting from 10 and leading up to 1. This is the third part in a three-part series. Part one is available here and part two is here.

04. FBI built a fake phone company in massive global wiretapping operation. The United States Federal Bureau of Investigation built a fake telephone service provider for a secret worldwide operation that officials described as “a watershed moment” in law enforcement history. The operation, known as TROJAN SHIELD, involved over 9,000 law enforcement officers in 18 countries around the world. When the existence of TROJAN SHIELD was announced in a series of official news conferences in June, officials said the operation had “given law enforcement a window into a level of criminality [never] seen before on this scale”.

03. US spied on some of its closest European allies with the help of Denmark. The first claims of an alleged secret collaboration between the signals intelligence agencies of the United States and Denmark surfaced in November of 2020. By January of 2021, it was clear that the Danish government would, sooner or later, need to deal with the fallout of its controversial spy deal with Washington, under which Denmark enabled the US to spy on some of its closest European allies. Still, the news in June that Denmark helped the US spy on countries such as Germany, France, Sweden and Norway, was nothing short of remarkable, and has a huge symbolic significance that cannot be overlooked.

02. For the first time, Chinese and North Korean spies were tried in the US. For the first time, an alleged Chinese spy was tried—and convicted—in the United States. According to prosecutors Yanjun Xu, also known as Qu Hui or Zhang Hui, was a deputy division director in the Ministry of State Security (MSS)—China’s intelligence agency. His conviction was described by observers as a “seminal moment” for American counterintelligence. Also for the first time, an alleged intelligence officer of North Korea, Mun Chol-myong, was tried in a US court. A North Korean citizen based in Singapore, Mun had tried to defraud international banks and launder money though the US financial system, allegedly for the benefit of North Korean spy agencies.

01. At least 14 heads of state were targeted through controversial phone spyware. At least 14 current or former heads of state were among 50,000 individuals worldwide whose personal telephones were allegedly compromised through a controversial surveillance software, known as Pegasus. The spyware is marketed by NSO Group Technologies, an Israeli digital surveillance company based near Tel Aviv. Pegasus can install itself on targeted telephones without requiring their users to click a link, or download an application. The list of the spyware’s targets allegedly contains telephone devices belonging to three presidents, France’s Emmanuel Macron (pictured), South Africa’s Cyril Ramaphosa, and Iraq’s Barham Salih. The devices of three current prime ministers, Morocco’s Saad-Eddine El Othmani, Egypt’s Mostafa Madboul, and Pakistan’s Imran Khan, are also on the list. There are countless others. As a result of these revelations, the US Department of Commerce placed the NSO Group Technologies on a sanctions list in November 3.

This is part three in a three-part series. Part one is available here. Part two is available here.

► Author: Joseph Fitsanakis and Ian Allen | Date: 31 December 2021 | Permalink

Year in review: The biggest spy-related stories of 2021, part 2

Year in ReviewSince 2008, when intelNews was launched, it has been our end-of-year tradition to take a look back and highlight what we believe were the most important intelligence-related stories of the past 12 months. In anticipation of what 2022 may bring in this always timely and highly volatile field, we present you with our selection of the top spy stories of 2021. They are listed below in reverse order of significance, starting from 10 and leading up to 1. This is part two in a three-part series. Part one is available here. Part three is available here.

07. Iranian intelligence networks in Europe were decimated following failed operation. Four Iranian spies were tried in Belgium in February, after unsuccessfully trying to bomb an annual conference of Iranian expatriate dissidents. Conference attendees included the then-US President Donald Trump’s personal lawyer, Rudy Giuliani, who addressed the meeting. Stephen Harper, Canada’s former prime minister, also spoke at the conference. Even worse for Iran, a “green notebook” found in the car of one of the spies, allegedly contained “289 places across 11 European countries”, where Assadi is thought to have met with Iranian spies operating throughout Europe.

06. Russian spies allegedly funded one of Italy’s major political parties. An alleged employee of Russian intelligence was present at a secret meeting in Moscow, in which a plan was discussed to fund Lega Nord, Italy’s leading populist party. Established in 1991, the LN seeks greater autonomy for Italy’s northern regions, and opposes the country’s membership in the European Union. An Italian newspaper claimed in June that Andrey Yuryevich Kharchenko, an alleged employee of Russian intelligence, participated in a secret 2019 meeting in Moscow, in which Kremlin figures offered LN officials to enrich the their party’s election campaign coffers by nearly $70 million.

05. US Pentagon has an army of clandestine operatives that ‘dwarfs the CIA’. The US Department of Defense maintains a worldwide “secret army” of over 60,000 operatives, many of whom have fake identities and manufactured backgrounds, according to a report from Newsweek’s investigative journalist, William Arkin. Arkin claimed that the Pentagon force is “more than ten times the size” of the clandestine wing of the CIA, and is allegedly part of a wider US government effort known as “signature reduction”. The scheme provides undercover government operatives the ability to operate domestically and around the world without the fear of having their links to spy agencies or the military discovered by online sleuths.

This is part two in a three-part series; Part one is available here. Part three is available here.

► Author: Joseph Fitsanakis and Ian Allen | Date: 30 December 2021 | Permalink

Year in review: The biggest spy-related stories of 2021, part 1

End of Year ReviewSince 2008, when intelNews was launched, it has been our end-of-year tradition to take a look back and highlight what we believe were the most important intelligence-related stories of the past 12 months. In anticipation of what 2022 may bring in this always timely and highly volatile field, we present you with our selection of the top spy stories of 2021. They are listed below in reverse order of significance, starting from 10 and leading up to 1. This is part one in a three-part series. Part two is available here. Part three is here.

10. New book claims former Irish head of government was Provisional IRA informant. Controversy has always surrounded, Charlie Haughey—a towering figure in Irish politics. By 1992, when he retired after an illustrious 35-year career, he had served three times as Taoiseach (prime minister) and many more times as minister. Haughey’s critics have always suspected that he was sympathetic to the Provisional Irish Republican Army. If true, however, this latest revelation is nothing short of stunning: a new book by Kevin O’Connor, one of Ireland’s leading investigative reporters, claims that Haughey routinely shared classified information with the IRA, including warnings about British and Irish government spies that operated within the organization.

9. Unlike others, French spies anticipated the Taliban’s takeover of Afghanistan. August found Western nations scrambling to evacuate their citizens and embassy workers from Afghanistan, amidst the chaotic takeover of the country by the Taliban. France, however, began its evacuations at least two months in advance. By late August the French government was being praised from all sides for its “anticipatory planning”. Why was their response so different from those of other Western nations—notably Britain and the United States? Some observers claim that, unlike other Westerners, French spies maintained a “relative distance” from United States intelligence agencies, and were thus not influenced by American projections of what would happen in the war-torn country.

8. Czechs expelled Russian spies, accusing them of blowing up a munitions depot. The Czech Republic unceremoniously expelled a number of Russian diplomats in April, accusing Kremlin spies of being behind a mysterious explosion that leveled a munitions depot in 2014. According to Prague, a team of Russian operatives, posing as Tajiks and Moldovans, blew up a facility belonging to the Military Technical Institute of the Czech Ministry of Defense, killing two security guards and prompting hundreds of evacuations. The Russian operatives allegedly belonged to Unit 29155, a Russian elite spy outfit, whose goal is to subvert European political and economic systems and processes. Several diplomatic tit-for-tat expulsions followed from a number of European nations.

This is part one in a three-part series. Part two is available here. Part three is here..

► Author: Joseph Fitsanakis and Ian Allen | Date: 29 December 2021 | Permalink

Israel Security Agency uses Facebook to reach out to young Palestinians – report

Israeli West Bank barrier

AN ARTICLE PUBLISHED LAST month in one of Israel’s leading newspapers, Haaretz, shed light on how the Israel Security Agency (ISA) is using Facebook to combat militant groups in the Palestinian occupied territories, namely the West Bank and the Gaza Strip. According to the article’s author, Amira Hess, the ISA operates about 35 Arabic-language profile pages on Facebook, which are accessible in the various Palestinian areas under Israeli occupation.

ISA case officers (agent handlers) with Arabic monikers are in charge of various regions. For example, the officer in charge of the Hebron area is known as “Captain Eid”, the officer in charge of the Al-Amari refugee camp is known as “Captain Zaker”, and so on. Every Facebook profile page has a telephone number for users to send messages using WhatsApp. In addition, a general Facebook page of the ISA was opened under the heading in Arabic, “Badna Naish” (“Want to Live” in Arabic).

The transition to using Facebook pages is in the spirit of the times, and reflects the fact that many younger Palestinians receive their daily news through social networks, and not through traditional media, such as radio or television. The purpose of the ISA’s open-referral method using Facebook is to talk to the Palestinian population directly, and especially to the younger generation, who is very active on social networks. This also allows social media users to pass on security information to thwart terrorist attacks without disclosing their identity. The Facebook pages also serve the ISA as a tool for recruiting Palestinians who are willing to help Israel.

Additionally, the ISA uses Facebook’s pages to warn Palestinians who plan terrorist acts before they go into action. Here are some examples of the use of Facebook’s pages: In March of this year, an ISA case officer using the moniker “Captain Eid” wrote on his Facebook page covering the Hebron area that he called several masked men who fired shots in the air while welcoming the released terrorist Mahmoud Hushia, and warned them that their identities were known. “In their deeds, they will be punished. Please stay away from unnecessary problems”, wrote Captain Eid. Read more of this post

Book review of “We Never Expected That” by Avner Barnea

Barnea We Never Expected ThatIN HIS NEW BOOK, We Never Expected That: A Comparative Study of Failures in National and Business Intelligence (Lexington Books), Dr. Avner Barnea has coined two new terms in the field of strategic surprise. One is diffused surprise and the other is concentrated surprise, two terms that help us to better understand why intelligence failures occur. In a diffused surprise there is difficulty in identifying the intelligence target and therefore the chance of a surprise increases; while in a concentrated surprise the intelligence target is usually a recognized organization. At the same time, the mistake lies in the assessment of the target’s abilities and intentions.

To illustrate the difference between the types of strategic surprises in the two areas, the author analyzes these types of surprises through a discussion of four test cases. Two of them are from the field of national intelligence and two from the field of competitive intelligence. In the field of national intelligence, Barnea analyzes the surprise of the outbreak of the First Intifada (Palestinian uprising) in 1987 and the surprise of the attacks of September 11, 2001. The first Intifada was a strategic surprise for the State of Israel and broke out as a result of a popular uprising. Therefore Barnea defines it as a diffused surprise. The September 11 terror attack is defined by Barnea as a concentrated surprise, since the terrorist organization, al-Qaeda, which was known to American intelligence, initiated and carried out the terrorist attack. One of the reasons for the surprise was that the American intelligence agencies did not properly assess al Qaeda’s intentions and capabilities, nor did they share the intelligence information that had accumulated.

In competitive intelligence and the business world, units within an organization share intelligence information. One of the lessons of the September 11 surprise in the United States is that intelligence information needs to be shared between the various intelligence organizations. The test cases that Barnea discusses in the field of competitive intelligence include the process of deterioration of the IBM Corporation that almost led to its demise in 1993. This is a classic case of concentrated surprise. IBM’s board  of directors did not internalize the processes and transformations in the field of computer hardware, while competing companies like Dell, Toshiba, and others were aware of the changing needs of customers in this field and also offered customers appropriate solutions. As a result of this failure of a concentrated surprise, IBM’s revenue fell sharply and the company almost declared bankruptcy. The new CEO of IBM, who took office during the crisis, has since adapted the company to changes in the competitive environment. Read more of this post