Hamas -- notes

Inside Hamas's intelligence: How did they know so much about us on the way to October 7th The intelligence success of Hamas stands in complete contradiction to the blindness that has blinded Israel In recent years, the IOF, the Mossad and the Shin Bet have begun to recognize an awakening in Hamas in all that concerns the field of intelligence gathering. As time went by, it seemed that Hamas, which has always sought to obtain as much information as possible about Israel, aims to increase its speed in the field. In recent times, the Israeli intelligence community has been closely following elements of Hamas's central intelligence body, the "Military Intelligence Department" who went to meetings abroad, including in Turkey, where they met with contacts from Iran and Hezbollah. Special project: Behind the invasion on the seventh of October was a chain of commanders and leaders who were mainly responsible for the attack. These provided them with knowledge, equipment and training in the fields of observation, eavesdropping and cyber, in what was supposed to significantly improve the relatively outdated intelligence gathering capabilities of Hamas. For a moment it seemed that the small and not very sophisticated intelligence department of Hamas was trying to resemble its main rival from the other side of the border - the large and advanced intelligence wing of the IOF. The one who trusts the army to research the intelligence capabilities of the adversary is the information security system, a unit that operates within the AMAN. The members of the unit, under the command of Colonel G, felt that they were relatively in control of Hamas' intelligence strengthening processes and knew them well. In the intelligence parlance, this is called "grasp" - to identify the movements, infrastructure and intentions of the other side, and monitor them closely. During the past two years, Israel has also carried out several operational actions, some of them abroad, to disrupt Hamas's intelligence efforts. Most of these actions are still prohibited from publication, and it is highly doubtful that they will ever become known to the public. Few of the intelligence personnel of Hamas's military arm in Gaza, certainly did not stop them completely. Only after the IOF forces raid the Gaza Strip and enter the offices of the Hamas Military Intelligence, the server farms that Hamas has set up underground and the computers connected to them - will the true scope of capabilities be revealed Hamas in the field of intelligence gathering, what was discovered there left the intelligence personnel in Israel speechless. In recent weeks, the intelligence community in Israel is beginning to understand that they have only "held" Hamas at the tip of the iceberg. Only in retrospect does it become clear that in the last two years, the Hamas Military Intelligence, with chilling efficiency and Iran's backhanded spirit, wrote the intelligence chapter in Hamas's major operative plan: the October 7 operation. just the tip of the iceberg Getting access to the cameras in the envelope One of the most alarming examples of the "underestimation" of Hamas concerns the organization's ability to penetrate webcams inside Israel. AMAN's information security system has known for a while now that Gaza police officers are searching the Internet in Israel for IP addresses known to be associated with cameras. Hamas bombers connected to these IP addresses, hoping that whoever installed the camera did not change the manufacturer's original password. In other cases, the hackers managed to trick the security mechanism of the cameras and take control of them. After breaking into them, Hamas members were able to watch unhindered the cameras, that broadcast directly to them from settlements, roads, and even houses inside Israel. Hamas's eye was open. The main focus of Hamas was, naturally, on the Gaza Envelope. After the "Black Sabbath" it was revealed, in the most gruesome way, to what extent the kibbutzim near the border with Gaza are networked with cameras, which observe, among other things, the S.G. area, the perimeter fence, the security facilities and the sensitive areas within the kibbutzim - exactly the areas that are of most interest to the enemy. Now it turns out that Hamas had access to dozens of these cameras before October 7, and some of them were even used by its people while fighting in the settlements in the following days. The senior members of Hamas' Military Intelligence. As mentioned in Israel, they knew that Hamas had the ability to penetrate network cameras, but it was only after entering Gaza that the enormous scope of this intelligence project was revealed. The army now admits that the camera issue was identified in advance, but was not dealt with intensively enough. Another area where Hamas' capabilities were only discovered in retrospect is cyber. Hacking soldiers’ mobile phones In recent years, the IDF has identified many attempts by Hamas Military Intelligence to hack into soldiers' cell phones through "spoofing operations". The modus operandi is familiar: a handsome "girl" makes contact with a soldier on social networks, and as their relationship progresses, the requests from the girl begin to increase. This can, for example, offer the soldier to take a picture of himself, extract details from him regarding his role in the army, or ask him to download a certain chat application, which will later be revealed as a malicious rogue. In AMAN they call this "activated conversation" and "throwing dishes" into the phone. As mentioned, the field security formation of AMAN identified extensive Hamas activity in the field of phone hacking, and even revealed it to the public from time to time, as part of media campaigns designed to increase awareness of the issue among soldiers. The levy, which was sent to all reserve personnel in the IDF. The video, which shows such a "funny operation" in a Hollywood and rhythmic way, ends with the words: "Remember, the enemy is always watching." The IDF identified not only the attempts by Hamas to hack into the phones of its soldiers, but also some of the means that made this possible. One of them was an extensive cyber infrastructure that built malicious code, which was implanted in false applications and enabled the penetration of the phones. The army worked to remove the capabilities of this infrastructure, and succeeded. But even in this case, only after entering Gaza and seizing Hamas servers in the tunnels did it become clear that this was only the tip of the iceberg. The military now understands that there were infiltration attempts by Hamas that were not detected in real time, and that despite the organization's relatively limited cyber capabilities, the intelligence information that Hamas extracted from the phones it did manage to break into served it well on October 7. This glimpse also illustrates how the IOF was secretly exposed to Hamas intelligence, and how it misinterpreted its intentions . A senior official at a civilian cyber security company, which has been following Hamas for several years, claims that a careful examination of the videos released by the IDF from the Hamas server farms in Gaza shows that some of the equipment in these farms came from Israel, where a large market for "second-hand" server equipment has been operating for several years. According to him, "Hamas' cyber capabilities are limited. It was relatively easy for them to take control of soldiers' cell phones and obtain information that is not strategic but tactical, and also penetrate network cameras, such as those found in kibbutzim around Gaza. You don't need to be a skilled attacker to achieve these achievements. In this aspect, they do not have a tie breaking weapon in hand. It seems that the cyber capabilities of the Gazans are limited, especially when you compare them to Iran. Most of the Hamas military intelligence collection methods may be relatively primitive or based on open source information, but that does not make them any less effective. Underestimating Hamas While Israeli intelligence focused on Iran and Hezbollah, Hamas managed, almost unhindered, to collect huge amounts of valuable intelligence. "The perception in Israel was that Hamas is not Russia or China," claims Dr. Nathaniel (Nati) Palmer, a senior lecturer in the Middle East Studies department at Bar-Ilan University, whose story about Hamas's intelligence war in Israel will soon be published by Cambridge University Press. that they don't have serious intelligence agencies and that at most they can 'pick up binoculars' and observe from afar. "This is a very big mistake, which I try to explain in my research over the years. Hamas has high-quality intelligence bodies, but the meaning of the intelligence threat was not sufficiently assimilated into Israel's security systems. October 7 put these things on the table." The intelligence success of Hamas on that catastrophic day stands in complete contradiction to the blindness that blinded the intelligence community in Israel. "It's unpleasant to say, but they did a much better job than us," says Lt. Col. Dr. Eyal Pinko, an expert in intelligence, cyber and national security. The person responsible for this intelligence chess is, as mentioned, the "Military Intelligence Department" of Hamas, a body that on the eve of the war included 2,100 operatives (a few percent of the personnel in the Amman), who dealt in five main areas: observations, cyber, signals (SigINT), open source information (Osint) and activation of agents. The department's specialty is to collect a great many seemingly marginal items of information, put them together layer upon layer, and thus build a broad and in-depth intelligence picture. - Maps, aerial photographs, training booklets and operational orders - that reached Hamas forces in the field. Such intelligence aids have been abundant since October 7. The information obtained helped Hamas members in the field. How is the intelligence information collected? The emerging understanding is that most of the aids are based on about ten layers of information, most of which came from open sources. The IDF also understands that their ability to control the distribution of open source information This one, part of which is public and appears in a short internet search - is almost hopeless. "You take the aerial photograph of the Reim base from Google Earth, send a worker from Gaza who works in Israel to report how many soldiers there are in the Gaza Strip, and to that you add the way the IDF exposes itself, through the media or with the help of videos that soldiers upload to TikTok ", explains Dr. Pinko. "There is a systematic, orderly work here, which also succeeds in fusing all the information into a single intelligence picture that is effectively transmitted to the field. Hamas has a very fine intelligence system, unfortunately."Intelligence of Hamas works differently than intelligence of a country," Dr. Palmer agrees. "What for you may be negligible and unimportant information, is of great value to Hamas. Take for example the Roa-Yura (a remotely controlled firing system placed on the border line with Gaza, Israel), a system that Israel has been publicizing since 2009, emphasizing how important it is in our system. Then the first thing Hamas does On October 7, it is to drop charges from drones on the 'Roa-Yura' and disable it. "The problem is that information that for us is on the fringes of the secret, is for the enemy valuable information. Hamas often does intelligence that is not advanced, not sophisticated, not 8200 - but good enough for the needs of Hamas. This is how a small organization works. From every smallest piece of information it makes excuses and draws lessons micro-tactical. When you put all those pieces together, you get October 7." Understanding the enemy Gathering "positive" intelligence Already in the founding charter of Hamas, published in August 1988, there is a reference to the great importance of knowing the Israeli enemy. However, at the beginning of its journey, Hamas invested less energy in gathering intelligence on Israel, and concentrated mainly on "thwarting intelligence", that is, one that tries to prevent the enemy from penetrating its ranks. "This is the fundamental mission that Sheikh Yassin instituted," says Dr. Michael Milstein, a senior researcher at Tel Aviv and Reichman Universities and a former senior member of the AMAN. "Yassin claimed that if there is anything that will bring down Hamas, it is collaboration and information leakage." "The Foundation Mission". Dr. Milstein, Yehoshua Yosef "The Foundation Mission". Dr. Milstein, photo: Yehoshua Yosef Loyal to the spirit of their founder, already in the 1980s the members of the military wing of Hamas established the "Al Majd" mechanism, of which Yahya Sinwar was one of the most prominent factors, and which was primarily intended to thwart Israeli espionage. Dr. Michael Milstein: "Hamas' military intelligence is a multidimensional body, which is responsible for what we do with several separate bodies. In Hamas, everything is concentrated in one place - gathering intelligence, recruiting agents, information security and matters of fraud and psychological warfare" While Hamas's thwarting intelligence remains centralized and controlled by the organization's senior officials, Hamas initially left the "positive" intelligence - that is, gathering information about the adversary - in the hands of the field ranks only. "In the early years of Hamas, the gathering of intelligence for an attack was done on the basis of the squad," says Dr. Palmer. "The members of the squad would themselves conduct observations, gather visible intelligence and more, and then go on the attack. There was no central body that managed the intelligence." Active gathering of intelligence along the borders The observation system is undoubtedly one of the most developed in the Hamas military intelligence department. "Most of Hamas' visual gathering is done around the contact line," says Guy Aviad, the organization's researcher and author of the book "Hamas Lexicon." "After a solid cliff, they paved a road parallel to the Hoovers axis (the axis paved by the IDF along the border fence, AA), called the 'Jakar' axis. They set up quite a few posts and observation towers along it, which can watch over the fence. The best example That's why it's in Moshav Netiv Hassara. Towers were built there right next to the border wall." Also, Hamas has placed observation posts on tall buildings in the Gaza Strip, from which there is a direct line of sight to the depth of Israel. In real time they turned to the IDF and warned that the observation towers near the Moshav were intended to gather intelligence, but nothing was done. The position was finally destroyed by the IDF only many weeks later, and was immediately renovated. It is likely that observations conducted with its help helped the Hamas members to penetrate the Entira route on October 7, among other things using paragliders. Researcher Guy Aviad: "When you are constantly watching the fence with sophisticated binoculars, observation towers and camouflaged positions, you know when a battalion changes and what the routine of the battalions is. In the exercises carried out by Hamas, you can see the analysis of the area, including the yellow gates in the kibbutzim." "When you are on constant alert 24/7, with a sufficiently good observation array, with sophisticated binoculars, observation towers and camouflaged positions, and you are constantly watching the fence - you know very well when a battalion changes and what the routine of the BTS is. The IDF was well aware of the surveillance capabilities of Hamas. In fact, the army knew this system so well that it feared it very much. As we revealed here two weeks ago, when the information about the activation of SIM cards by Hamas members in the Gaza Strip reached the Chief of Staff Halevi on the night of October 7, he ordered to operate without Hamas detecting the IDF's activity, and this in order not to burn intelligence sources. . "Even a tank that is not in its place arouses suspicion." As mentioned, the IDF had information on the location of a significant portion of the Hamas cameras that watched over the border, the same cameras that knew how to detect any movement of the IDF forces along the line of contact. The IDF even had plans to destroy these cameras, which were sitting in a drawer and waiting for the right timing. Hamas's observation array was not limited to binoculars or cameras. In recent years, the organization has developed an industry of UAVs, which are able to hover over the territory of the Gaza Strip and from there provide a diagonal photograph of the depth of Israel's territory. From there, the path to developing these aerial photographs and printing them on sheets, just as is done in the IDF, is very short. Towers and observation posts. Signal Intelligence gathering Another capability that Hamas had on the evening of October 7 is related to Signal Intelligence, "Sigint". The IDF and the Shin Bet knew very well that the Hamas military intelligence regularly listens to the visible IDF communication networks, mainly in the training areas of the Western Negev, which are a few kilometers away from the Gaza Strip. It is likely that one of the places they listened to in Hamas with great attention is the Tzalim base, due to it being the largest training center of the land army, where, among other things, the ground maneuver that is currently taking place in Gaza was practiced. This time, too, the technology in the hands of Hamas was not too sophisticated - all in all frequency scanners that are effective for a few tens of kilometers and know how to overcome the communication channels of the IDF - which in training often uses an unencrypted connection, along with many ears that listened to these frequencies. In the Gaza Division, on the other hand, the forces used encrypted means of communication and landline phones, which apparently prevented Hamas from listening to them. Hamas tried to acquire additional siginit capabilities in order to monitor the aerial image over Gaza and identify the location of the Israeli Air Force planes in the vicinity. "Deep technological understanding" Back to cyberspace. In 2021, after the Guardian of the Walls, Hamas released a video that was defined as a tribute to Jumaa Takhla, who was the head of Hamas's cyber system and was eliminated in an operation in which all senior members of Hamas' technological system were killed. In the video you can see a squad of Hamas members, equipped with computers, stationed in the Gaza Strip, in front of Kibbutz Meflasim. The members allegedly infiltrate the kibbutz's electrical grid from afar and disable it. In the video you can see how the light in the levels supposedly went out as a result. Agents Indeed, even when it comes to the field of operating the agents, Hamas has capabilities. In recent years, several cases have been published in which the Shin Bet arrested Israeli citizens who were employed by Hamas, some while taking advantage of the opportunity to enter and leave the Gaza Strip, where they have family members. These agents were sometimes equipped with SIM devices and photographic equipment, and were asked to pass on intelligence information about IDF facilities to Hamas. "Lime from the territory of Israel. The popular explanation is that some of the thousands of Gazan laborers who entered Israel every day in the period leading up to October 7, were also engaged in gathering intelligence from the Israeli settlements where they were employed. The intelligence gathering of Hamas serves it even now, in its war against the IDF forces who are maneuvering in Gaza: one of the areas in which Hamas excels is the gathering of technological intelligence, which investigates the Israeli means of warfare and tries to locate their weak points. Deep intelligence understanding and knowledge of the enemy Thus, for example, in the past instruction booklets were found in Gaza explaining how to fire an RPG missile against the Mayil Rukh defense system, and in 2017 a training booklet was printed in Gaza detailing the technical capabilities of the Namir troops carrier, the main armored vehicle used by the IDF forces in maneuvers. "There is a technological understanding here A very deep understanding of how our defense systems work, and how the other side makes them ineffective," says Dr. Eyal Pinko. "We see collection efforts over time from the IDF's military equipment that has been forgotten, stolen, etc. Some of these things go to Iran, and there they undergo an engineering reconstruction." Dr. Eyal Pinko: "You take the aerial photograph of the Reim base from Google Earth, send a worker from Gaza to report how many soldiers there are in the Gaza Strip, and to that you add the way the IDF exposes itself, through the media or with the help of videos that soldiers upload to tiktok" "Culture of keeping the secret" Another area in which the Hamas Military Intelligence shows impressive capabilities is the "osint", intelligence from visible sources. Dr. Palmer presents an example of a pamphlet seized in Gaza as early as 2007, on the cover of which is stamped the symbol of the "Military Intelligence Department" of Hamas. The booklet, revealed here for the first time, contains a weekly intelligence report in which hundreds of articles published that week in the Israeli media are translated and summarized. The report refers to military information, such as the pace of equipping IDF brigades with defense systems and the delay in the construction of the fence on the Egyptian border, along with a lot of information about the political system in Israel, high school recruitment data, information about the mood surrounding the struggle for the return of Gilad Shalit (who was in captivity at the time), and even a parashat Sexual harassment of a well-known rabbi. A pamphlet captured in Gaza in 2007, on its cover is stamped the symbol of the "Military Intelligence Department" of Hamas, from Hamas videos The booklet seized in Gaza in 2007, on the cover of which is stamped the symbol of the "Military Intelligence Department" of Hamas, photo: from Hamas videos "Hamas invests a lot of resources in reading articles," Palmer sums it up. "From morning to night they sit on every peep that moves in the visible media, from mainstream channels to esoteric websites. They translate what we publish all day long, carry out situation assessments and issue neat reports." Dr. Nathaniel Palmer: "What for you may be negligible information, is of great value to Hamas. Take for example Roa-Yura, which Israel has been publishing in Rosh Hutzot since 2009. And then the first thing Hamas does on October 7 is drop charges on it from drones." But the truth is that to get open information about the IDF you don't have to go too far. It's enough to go to TikTok. A clear example of this was received when the IDF forces raided Shifa Hospital in the center of Gaza City, and there they found a video of female soldier Uri Magidish on one of the computers, who was abducted to Gaza from the Nahal Oz outpost. The video, it seems, came to Hamas from social networks, and it is not the only one. Uploading videos to TikTok from the army bases, and even from the military bases of the bases in the Gaza Strip, has apparently become a trend that the IDF has stopped trying to combat. In fact, until October 7, the Nahal Oz commander had an official TikTok account, and he was not the only commander in the sector who did so. There are those in the IDF who admit that the army's ability to keep its secrets has become much more complex in recent years. "The issue of secrecy and the culture of secrecy in the IDF has seen better days than these," says a source familiar with the matter. The subject of the culture of secrecy and its preservation was also included in the series of investigations that the IDF began to carry out last week, on the orders of Chief of Staff Halevi. The systematic study of society and politics in Israel, as well as Hamas's in-depth look into the insiders of the army, obviously made it easier for Hamas to carry out the brilliant deception exercise that "sedated" the IDF and the political echelon in the run-up to October 7th, an exercise that the Military intelligence members were undoubtedly a part of . "For the weak player in an asymmetric campaign, deception is a very important tool," explains Dr. Palmer. "Hamas, as the weakest force militarily in the campaign against Israel, understood this from quite early stages of its activity." According to Palmer, despite its weakness in the face of Israel's intelligence superiority, on October 7 Hamas managed to bridge the gap through a carefully calculated and planned plan. "The attack clearly illustrates the importance of awareness among intelligence officials and decision-makers and the fact that on the other side there are people who think they are acting with sophistication, and that the possibility that they are leading us astray is a reasonable possibility that must be taken into account in the assessment of the intelligence and the decisions made as a result," he says. "It's easy and material when history shows that the other player uses it well for his needs."