Counterintelligence is crucial to the activity of any VNSA, especially a terrorist organization waging an asymmetrical war against a more powerful state enemy that deploys advanced intelligence capabilities. Terrorist organizations must make a comprehensive and intense counterintelligence effort in order to guarantee the survival of their operatives and maintain the secrecy of the activities they are planning.Footnote 1
It is customary to distinguish between defensive and offensive counterintelligence.Footnote 2 This chapter focuses on Hamas’s defensive counterintelligence activities against Israel’s intelligence services over the years. The organization’s offensive counterintelligence activities are described in other chapters, in particular the topic of doubling agents (Chapter 2) and deception (Chapter 6).
Hamas’s Battle against the HUMINT Threat
From its inception, Hamas was characterized by secrecy. Its 1988 covenant stated that the group welcomes every Muslim who meets certain criteria, one of which was “keeping [its] secrets.”Footnote 3 In a 2004 interview for Israel’s Channel 10, reporter Shlomi Eldar asked Ismaʿil Haniyyah whether concealing the identities of the individuals appointed to replace Shaikh Yassin and al-Rantisi after the assassinations of the latter in March 2004 would prevent Israeli intelligence from getting to the new leaders. Haniyyah responded: “In principle, from the day it was founded, Hamas has been a secret movement. In other words, its leadership and institutions operate clandestinely, and in this there has been no change.”Footnote 4
Activity against Suspected Collaborators
Hamas’s first intelligence entity, called al-Majd (Munazamat al-Jihad wa-l-Daʿwa, literally “the glory”), was already in operation well before the founding of Hamas, working within the several Islamist entities that prefigured the organization. Its objective was to gather intelligence on people suspected of collaborating with Israel or of committing moral offenses such as drug use or prostitution.Footnote 5 To that end, its operatives conducted surveillance and forward observation. Dozens of members recruited by this apparatus surveilled suspects and documented their activities in formal reports that were subsequently submitted to their superiors in the organization. The reports not only compiled incriminating information about the suspects, but made note of suspects’ routines, so that the organization could choose the appropriate time and place to abduct and interrogate the suspects.Footnote 6 In these remarkably cruel interrogations, the operatives elicited confessions of questionable validity that the suspects were indeed collaborators with Israeli intelligence. At that point, the sentence – usually execution – would be carried out.Footnote 7
This activity was accompanied by an attempt to win over the hearts and minds of the Palestinian population, often by means of proclamations, the primary propaganda tool used at the time. One of the first proclamations issued by the organization that would become Hamas only a few weeks later – just before the start of the First Intifada, in late November 1987 – warned against collaboration with the Israeli intelligence services and proposed various strategies to combat their tactics.Footnote 8
From the early days of al-Majd, the organization’s interrogations of collaborators received a clear religious-legal imprimatur from Shaikh Yassin. Yassin ruled that a person who confessed to this transgression (or to involvement in prostitution) should be executed on the basis of Islamic law, although he emphasized the need to ascertain that the suspect had in fact done the deeds of which he was accused. Indeed, al-Majd operatives in the al-Burij refugee camp in the Gaza Strip put this ruling into practice. They arrested a man accused of collaborating with Israel and distributing pornography; the man was tortured and interrogated until he confessed. A recording of the confession was shown to Shaikh Yassin, who authorized the execution. This was the first instance of a lengthy campaign of intelligence collection, arrests, interrogations, and assaults on those suspected of collaborating with Israel, activity that continued into the First Intifada.Footnote 9 During this period, after receiving initial information about a suspect, al-Majd operatives would sometimes surveil the suspect for several days before abducting him.Footnote 10
Interestingly, many Hamas operatives who would later become senior figures in the organization started out as members of al-Majd. The first head of al-Majd was Sallah Shkhadah; after Shkhadah’s arrest in 1988, he was replaced by Nazar ʿAwadallah. Khalid al-Hindi, known by the code name “45,” was appointed to head al-Majd’s activity in the northern Gaza Strip, while Yahiya Sinwar – Hamas’s current leader in the Gaza Strip – held the same role in the south. Both regional leaders set up local cells to compile reports about Gaza Strip residents suspected of any type of crime and submit them using dead drops.Footnote 11 It seems that al-Hindi was the senior of the two, as he ultimately collected the reports gathered in both regions.Footnote 12 Ismaʿil Haniyyah, a former prime minister and currently the head of Hamas’s political bureau, was recruited to al-Majd in 1986, after representing the Muslim Brotherhood on the student council of the Islamic University.Footnote 13 Muhammad al-Shimali, a regiment commander in Rafah during Operation Cast Lead, became involved with Hamas as an al-Majd operative during the First Intifada.Footnote 14 ʿAbed al-Nasser Abu Shauka, head of the military wing in the central Gaza Strip until his death in 2004, began his career with Hamas when he was recruited to al-Majd sometime before 1987, as a student at the Islamic University in Gaza.Footnote 15 It is possible that the considerable power held by al-Majd operatives – not only to gather intelligence, but to accuse, convict, and even execute suspected collaborators – eventually paved their way into the Hamas elite.
As befits a security apparatus, al-Majd was fiercely protective of its information and activity, as evidenced by the culture of security it implemented among its operatives. The reports compiled by the organization’s operatives were passed on to senior figures using dead drops arranged in advance at the al-Haushi mosque in Shujaʿiyyah; maps marked with the locations of the dead drops were given to operatives by a cleric at the mosque. After the senior operatives read the collated information, it was then hidden at the Abu ʿOthman mosque in Shujaʿiyyah. Furthermore, meetings among the apparatus operatives were coordinated by leaving signs in neutral locations (e.g., youth clubs) without the use of telephones.Footnote 16 Even after the founding of Hamas in 1987, operatives remained meticulous in matters of secrecy. Coded messages continued to be transmitted via dead drops in central locations, particularly mosques; operatives went by code names. Furthermore, Hamas insisted on absolute compartmentalization; every operative knew only the members of his own cell and sometimes only their code names, thus preventing members from incriminating one another. Shaikh Yassin himself communicated with various organization functionaries through dispatches delivered by special couriers.Footnote 17
After the arrest of several Hamas leaders in August 1988, the leadership began to reorganize in September 1988 on the basis of directives sent by Shaikh Yassin from prison. In addition to a division of the Gaza Strip into seven geographical regions, Hamas set up three systems of activity: one dedicated to military action, one responsible for the coordination of intifada activity, and one to serve as security. This latter security system gathered intelligence about intifada incidents while continuing its counterintelligence operations against suspected collaborators with Israel and entities operating counter to the “spirit of Islam.” The security wing was headed by Ismaʿil Ashqar and Nabil Sawalha.Footnote 18
After another round of arrests in May 1989, Hamas was forced to reorganize again, this time with the help of American Hamas members such as Musa Abu Marzuk. The Gaza Strip was redivided into five regions, and several new mechanisms were established. It was decided that the security apparatus, charged with gathering intelligence on suspected collaborators with Israel and with preventing the penetration of collaborators into the organization, would continue its operations. The information gathered by the security apparatus enabled Hamas’s executive arm to enforce the directives issued by the organization, interrogating, attacking, and often killing suspected collaborators.Footnote 19 It is worth noting that several months after his appointment as Hamas commander in the Gaza Strip in September 1988, Ismaʿil Abu Shanab received a report from the security apparatus stating that two suspected collaborators had been killed. Consequently, it occurred to Abu Shanab that Hamas may have been going too far with its executions, and he requested that future executions be performed only after consultation with the organization’s leadership. Likewise, he instructed the regional commanders to verify suspicions leveled against suspects before subjecting them to harm; apparently his instruction went unheeded, as acts of violence against suspected collaborators persisted.Footnote 20
It seems that from its reorganization in September 1989 until the next round of arrests at the end of 1990, Hamas’s security apparatus functioned in a relatively orderly fashion and with a clear hierarchy. Its responsibilities included preventing the infiltration of collaborators, as well as gathering intelligence about suspected collaborators, IDF activities and residents’ contacts with Israeli army representatives, and other Palestinian organizations such as Fatah. An example of the organization’s systematic operations can be found in the apparatus’s activity in the northern part of the Gaza Strip. Every operative had a specified area, generally a single street, for which he was responsible. There, he would gather intelligence about suspected collaborators, potential moral violations, and IDF activity. For instance, ʿAbed al-Naji al-Rantisi was in charge of Ul Street in the Shaikh Radwan district of Gaza City. Every two weeks, he wrote and submitted reports to Mahmud Abu Wasfa, his neighborhood commander; Abu Wasfa would read and annotate these reports, then compile all the neighborhood reports he received into a single summary document. He would then submit the latter document to the commander of the northern part of the Gaza Strip, who in turn passed it along to Sufian Abu Samara, the head of Hamas’s security apparatus. Abu Samara would bring these summaries to the “Committee of Three,” which alongside Abu Samara included Muhammad Habub, head of the security apparatus in the southern part of Gaza City, and Ramadan Yazuri, regional commander for the southern Gaza Strip. The committee would discuss the reports and translate them into operational instructions, such as assaulting, threatening, or interrogating suspected collaborators or moral transgressors.Footnote 21
In principle, in keeping with the division of responsibility that characterized Hamas operations at this time, directives were transferred to the executive arm for implementation. However, in practice, this division of responsibility was not maintained. This is evident from the activity of the security apparatus in the northern Gaza Strip, and that of ʿAlaʾ Muhammad al-Aʿrij, its head from August 1990 to January 1991. The area overseen by al-Aʿrij was likewise divided neatly into subsectors, but the instruction to operatives was not merely to gather intelligence; rather, it was to carry out interrogations of collaboration suspects and morality offenders themselves.Footnote 22 It must be noted that Hamas’s action against collaborators during the First Intifada did not take place in a vacuum. In those years, an internal war raged within Palestinian society, in which the elimination of suspected collaborators by multiple factions became an ever-growing phenomenon in the Gaza Strip. In 1988, the numbers were still relatively small, with only a handful of victims; by 1989, the number was about 90, and in 1990 about 110.Footnote 23 Palestinian sources claimed that about 750 individuals were killed as suspected collaborators over the course of the intifada, although it was obvious that at least 80 percent of them had never met a member of the Shin Bet in their lives.Footnote 24 At that time, the concept of “collaborator” had taken on many meanings, and did not exclusively indicate someone who passed on intelligence or security information to Israel.Footnote 25 Nonetheless, in some cases, actual collaborators – people who were in some way or another Israeli agents – were in fact identified and killed. For example, in 1988, Hamas operatives abducted a man suspected of collaborating with the Shin Bet. He was beaten and tortured until he lost consciousness. The Hamas operatives in charge mistook him for dead and got rid of the body; a passerby found him and his life was saved. The man had indeed been giving intelligence to Shin Bet agents for several years before his abduction.Footnote 26
Once the ʿIzz al-Din al-Qassam Brigades were founded in the early 1990s, they joined Hamas’s activities against collaboration suspects. Some even argue that the new group simply replaced al-Majd, which in turn continued to operate within Hamas as the organization’s General Security apparatus. Before late 1991, the Brigades carried out close to twenty killings of this type.Footnote 27 In early 1992, a cell under the command of Yahiya ʿAiyyash and other Hamas operatives convened a local security conference in Kufr Qarawat Bani Hassan in the Nablus region of the West Bank; the conference would focus primarily on punishing collaborators with Israel. Indeed, at the conference, the cell resolved to abduct and interrogate an individual suspected of significant collaboration. The cell split up into several task forces: one to deal with surveillance, one to perform the actual abduction, and one to find an appropriate hiding place and interrogate the suspect. The plan was put into practice, and the suspect was brought to a waiting car outside the village near an observation point where it was possible to make sure the road was clear. He was taken outside the village, on the assumption that his family would go looking for him. The cell interrogated the suspected collaborator for three days and ultimately elicited a confession of his activity with Israel; they continued to conduct similar missions for over a year.Footnote 28 In drawing conclusions from the activity, Jabarin notes that one of the challenges in missions of this kind is the need to carry out forward observation, surveillance, and intelligence gathering. He also notes that surveillance and patrols must be deployed in order to avoid military roadblocks and checkpoints when taking the suspect to the interrogation spot.Footnote 29
In its early years, Hamas maintained an important center in the United States after Israeli activity managed to cause significant damage to the organization. The overseas headquarters was also informed of suspected collaborators. For example, a 1993 report submitted by a Hamas commander in the Gaza Strip to Muhammad Sallah (Abu Ahmad), an envoy from the United States, stated that the Strip was rife with collaborators, and that Hamas was taking action against them: interrogating the suspects, eliciting videotaped confessions, and executing them. The report also stated that Hamas was reining in these executions so as not to harm the struggle for the return of those expelled to Marj al-Zuhour.Footnote 30
Even after the First Intifada and the signing of the Oslo Accords in September 1993, Hamas sustained its activities against suspected collaborators. After the Oslo Accords, there were many internecine murders in Palestinian society, not only over political rivalry, but as the result of business conflicts, drug and weapons deals, protection payments, and so on. Some voices within Palestinian society called for an end to these killings. One such individual was Taufiq Abu Hosa, a leader of the intifada from Fatah. In response to his plea to cease the slaughter, members of the ʿIzz al-Din al-Qassam Brigades murdered two suspects just outside Hosa’s front door.Footnote 31 In February 1994, a young Israeli man from Herzliya named Shai Shuker was murdered. An investigation by the Israeli security services led to the arrest of the murderer, Suliman Mahmud. Mahmud’s interrogation revealed that he had been a collaborator with Israel in the past. He had then expressed a desire to join Hamas; in order to cleanse himself of the stain of collaboration with Israel, he was told by a Hamas operative from Gaza that he had to carry out an attack against Jews. He drove to Tira, met Shuker, who was a drug dealer, and strangled him to death.Footnote 32
In May 1994, after Hamas murdered two suspected collaborators in Gaza, members of the Palestinian Authority, including General Nasser Yusuf, the commander of the Palestinian police force, addressed Hamas, asking the organization to put an end to independent executions and instead hand the suspect over to the PA. The general even met with Shaikh Ahmad Bakr, a Hamas member, and pled with him, saying that Hamas’s actions were not in line with the teachings of Islam; Hamas had to stop what it was doing and let the Palestinian police handle suspects through an organized legal process. In response to General Yusuf, Hamas distributed a proclamation on May 29, 1994, that stated: “The problem of the collaborators still exists, and their actions are still a danger. Hamas is leaving the handling of them to the Palestinian police and calls on its police officers to pursue collaborators day and night.”Footnote 33 However, it seems that Hamas did not operate according to this statement in practice. An example of Hamas’s continued activity against collaborators even after the establishment of the PA is the case of Yusuf Kenen, who was recruited in 1996 to Hamas’s security apparatus in the Gaza Strip. One of his tasks was to write reports about suspected collaborators and submit these reports to his handlers.Footnote 34
The initiatives by Hamas’s security apparatus against suspected collaborators extended even to the insides of various Israeli prisons where organization members were serving time. The security apparatus’s operatives in prison gathered intelligence and surveilled Hamas members inside the prisons, using sources planted among the inmates. The information they gathered was covertly documented by al-Majd members using code words. They interrogated suspected collaborators among the inmates, both identifying those who were suspected of collaboration during their prison term and “settling scores” with those who had worked for Israel before their arrest; their interrogations made use of violence and horrific methods of torture. The organization’s operating assumption was that there were many spies within its ranks providing information to Israel – information that was then used to imprison hundreds of Hamas operatives and thwart attacks on Israel. Between 1993 and 1996, Hamas interrogated some 150 suspects sitting in Israeli prisons; many were accused despite their innocence. Of these 150, al-Majd killed 16. This operation, including much of the associated torture, continued into the late 1990s, when Maher Odeh was in charge of Hamas’s security wing in the prisons.Footnote 35
Hamas violence towards suspected collaborators continued into the 2000s, both in the Gaza Strip and West Bank and in the prisons. For example, Sallah Shaikh joined a Hamas cell in 2002 and participated in violent actions such as throwing Molotov cocktails. In 2004, his cell suspected a man from their area of collaboration with Israel, and subsequently attacked and beat him.Footnote 36 With regard to activity in prison, a senior Hamas operative, whose name remains classified, was in charge of Hamas security in the prison where he was serving his sentence; he interrogated suspected collaborators within the prison walls. His tenure in this role began in 2002 and continued for several years.Footnote 37
With Hamas’s institutionalization in the mid-2000s, the organization’s counterintelligence activities against the HUMINT threat took on a more official character. When Hamas seized control of the Gaza Strip in 2007, it also assumed control of the prisons. This included Gaza Prison, which held suspected collaborators with Israel arrested by the PA’s security apparatus, some of whom were on death row awaiting execution. In the chaos of the upheaval, the prisoners escaped; Hamas demanded that they had to return at once. Those who did not were brought back by force, and Hamas reconsidered the sentences they had received in the past – this time according to rules of jurisprudence based mostly on Islamic religious law (shariʿa). The man charged with running the prison on behalf of Hamas was Hassan al-Gamasi, who had himself been sentenced to more than 200 years in prison for killing suspected collaborators during the First Intifada, and who had been released in the 1990s as part of the Oslo Accords.Footnote 38
Well before Hamas’s seizure of the Gaza Strip, Hamas operatives began to understand the importance of agents’ activity in real time – in combat operations and targeted assassinations. According to Mahmud al-Zahar, a senior figure in Hamas, Hamas came to realize that the assassination of ʿAbed al-ʿAziz al-Rantisi was the result of a report by a collaborator who witnessed al-Rantisi move from car to car. This information was transmitted to spy planes flying above Gaza, and from there to planes that carried out the attack.Footnote 39 When Hamas took control of the Strip, it was able to combat this threat more effectively. For example, in a preparatory drill for an Israeli army incursion into the Strip in 2007, Hamas’s military wing also drilled a scenario in which a car was identified as containing someone suspected of collaboration with Israel during combat, and practiced handling such a case.Footnote 40
One of the systems established by Hamas in the Gaza Strip in approximately 2007 was its Internal Security Force (ISF), which has since led the fight against suspected collaborators at the behest of the Interior Ministry. In early 2009, immediately after Operation Cast Lead, Hamas commenced an intensive campaign to identify agents for Israel who had been active during the fighting. It arrested people that it claimed were members of a network operated by the PA security apparatus in the Gaza Strip to gather information on Hamas that would also be useful to Israel. Among those present at the announcement of the arrests was Abu ʿAbdullah, head of the Data Analysis Administration of the ISF. This declaration may indicate how concerns about collaboration may also serve political needs, as it came just before the start of the intra-Palestinian reconciliation talks between Hamas and Fatah in Cairo. Hamas was subsequently accused of fabricating these claims in order to score points before the negotiations.Footnote 41
In April 2009, the Hamas government was accused of putting more than thirty political opponents to death. In response, then Hamas spokesman Ayman Tah claimed that these were people who had been interrogated and sentenced by law for their crimes; some had collaborated with Israel.Footnote 42 In September 2010, the Gaza Strip Interior Ministry announced that it had managed to identify and arrest two individuals who had collaborated with Israel. At a press conference held by the Hamas government, the confessions of the two supposed collaborators were presented to the public. On this same occasion, a senior Interior Ministry official, Abu ʿAbdullah Lafi, also displayed technological devices and weapons provided by Israel to the collaborators to carry out their missions.Footnote 43 Another example occurred in July 2020. According to reports, a senior Hamas operative who had been in contact with Israel fled to Israel by sea. Consequently, Hamas’s security apparatus carried out a wave of arrests in the Gaza Strip. One detainee was Muhammad ʿAmar Abu Ajwa, a Hamas operative who, according to the claim, had worked for Israeli intelligence for about a decade. Abu Ajwa was a senior figure in Hamas’s security system and was in charge of the organization’s internal communications network.Footnote 44
In addition to its operations against collaborators, Hamas’s Interior Ministry ran a well-oiled propaganda machine exposing Israel’s modus operandi to the public at large. In May 2010, Hamas’s al-Aqsa TV channel broadcast a feature covering the ways in which Israel’s intelligence tries to recruit young Palestinians. In the piece, Interior Ministry spokesman Ihab al-ʿAsin discusses ways to confront the phenomenon.Footnote 45 Another example is a forty-five-minute film produced by Hamas and aired on the al-Aqsa channel in September 2012. Styled as a documentary, the movie aims to discourage collaboration and persuade those already caught in its grasp (“sunk in the mud,” as the program would have it) to repent and return to the bosom of the Palestinian people. The movie exposes the methods used by Israeli intelligence to recruit and operate agents. For example, it shows how Israel provides financial incentives and work permits in exchange for collaboration, or high-quality medical care for the agent or family members in exchange for aid in intelligence. The film also presents firsthand testimony by Israeli agents who had been caught, as well as documentation of conversations between Israeli handlers and Gaza Strip residents. At the end, the film calls on the citizens of the Gaza Strip to avoid cooperation with Israel; those already in contact with Israel are called on once again to reconsider.Footnote 46
In tandem with the institutionalized activities of Hamas’s apparatus in Gaza against suspected collaborators, a more decentralized form of the same activity also continued in the West Bank. For example, in 2009, Nur al-Din Hamdan, a Hamas operative from Bethlehem, formed a fireteam to carry out attacks against Israel. As its first action, it chose to target a certain suspected collaborator by the name of Sallah. The fireteam surveilled Sallah, in part through Jerusalem residents such as Hussain Abu Tir, and gathered information about him. Eventually, during the operation, in late 2009, when the fireteam members had already closed in on Sallah and were only a few feet away from him, Sallah was warned and fled.Footnote 47
Compartmentalization, Screening, and Document Security
Because Hamas was well aware of the intensive HUMINT activity conducted by Israel in its midst, it constantly screened its personnel and worked to maintain strict compartmentalization. From their inception, Islamic movements in Palestinian society, first and foremost Hamas, consisted of operatives whose motivation to work for them differed from the well-known national movements, especially Fatah. While the national movements comprised men looking for material gain, among other inducements, the Islamic movements drew men with a deep-seated religious ideology; this had a direct effect on the organization’s ability to run a secret, compartmentalized organization with strong internal discipline.Footnote 48
In the 1980s and 1990s, Hamas’s recruitment methods included significant field security procedures. First, there was the question of selecting candidates – primarily from the educational institutions run by the organization, from families whose members had been harmed by the IDF, and from competing organizations such as the Palestine Liberation Organization (PLO). Throughout the recruitment and training process, the candidates came under the strict scrutiny of the movement’s security apparatus. When they attended the cells’ weekly gatherings, there was an insistence on secrecy, manifested in the following ways: The missions were compartmentalized, that is, no cell member knew about the missions of the other members; the meeting place was entered one by one, not in groups; and every team member had to make sure that he was not under surveillance. At the site of the meeting, all windows and shutters would be closed, and at the end of the meeting, participants left one by one and went in different directions.Footnote 49 One of the reasons that Hamas did not join the united national headquarters during the First Intifada was the fact that the constituting organizations were large, making them easier for Israel to penetrate than Hamas. In the past, when Hamas had worked hand in hand with Fatah, many of its members were arrested. By contrast, Hamas allowed into its ranks only personnel who had passed a thorough screening process, including an in-depth assessment and ongoing surveillance.Footnote 50
As noted, after Israel arrested numerous Hamas operatives in 1988, Hamas organized itself anew. Shaikh Yassin, who feared that detainees would provide information about movement members and that Israeli intelligence operatives had been planted within the organization, rearranged and restaffed the various branches of the movement. The rules of compartmentalization continued to be very clear and very strict. Cell members knew only one another; all communication between cells was conducted by way of the security division’s staff, who served as couriers transmitting dispatches. Furthermore, dispatches were coded with letters indicating the cells and numbers indicating the numbers of cell members. In addition, the arrest of Khaled al-Hindi in November 1988 led to a large-scale change in Hamas’s procedure for dead drops. Hamas constructed a secret hiding place at Shaikh Radjwan’s mosque in the Gaza Strip to host an archive that would store all the information gathered by the members of the security division. In its next reorganization in September 1989, following another round of arrests, Hamas went to even greater lengths of compartmentalization, and the division of roles became much more specific. A round of arrests in late 1990 led the external leadership to rebuild the organization so that there would be no contact between the various regions. Each region would contact the external leadership directly to prevent any possibility of contact between one region and the next, which might lead to the transmission of information to Israel upon operatives’ arrest. Furthermore, the recruitment process became covert, using codes left at dead drops. Moreover, once clerics identified potential operatives for istishhad activities, they would be instructed to keep strictly to themselves and refrain from sharing the fact of their recruitment even with family members.Footnote 51
The expulsion of Hamas operatives to Marj al-Zuhour, Lebanon, in December 1992 led to an increase in the number of young men asking to enlist with Hamas. At that time, five men would vie for every opening. Hamas operated an extremely strict selection procedure that included a total ban on any operative with an arrest in his past and whose activity was known to Israel. In 1993, ʿIzz al-Din al-Qassam members operated in small groups with very few participants and strict compartmentalization. Any exposure to Israeli security forces led to heightened security and increased separation between operatives.Footnote 52 In April 1993, Major General Uri Sagi, then head of IDF Military Intelligence (AMAN), described the modus operandi:
They [Hamas] had a high level of compartmentalization. The ground here in Israel is divided into four or five headquarters that operate sub-organizations and cells. At the end of the chain, there’s one individual operating an armed team. He barely knows anyone else in the organization. There’s a very complex network of operators, sub-operators, fighters, and so on.Footnote 53
In September 1998, the Shin Bet identified brothers ʿAdel and ʿImad ʿAwadallah as key Hamas operatives in the West Bank. ʿAdel headed the organization’s military wing in Jerusalem, and together, the brothers ran a large terrorist infrastructure. After the Shin Bet tracked down and killed the brothers, findings discovered in their hiding place showed that they had run a large clandestine network for the manufacture of weapons used in attacks. Their crowning achievement was to have been the simultaneous detonation of five car bombs in major Israeli cities. An archive of the infrastructure’s activity, located by the Shin Bet, shows that contact among the members, some of whom were active during their jail terms in Israel’s Ashkelon Prison, was carried out via tiny letters hidden in the intimate orifices of couriers who carried them throughout the West Bank and in and out of prison. The infrastructure was also highly compartmentalized; operatives did not know one another or other commanders in the organization. In practice, only ʿAdel himself knew the whole picture. Moreover, members of the infrastructure, including the ʿAwadallah brothers, hid only in secure apartments. ʿAdel himself would go over the signed rental agreements with the owners to make sure that nothing in the contract identified his men. This incident reflects the high level of secrecy adopted by some Hamas personnel. The phenomenon was also noted by then chief of staff Shaul Mofaz, who stated to the Knesset Foreign Affairs and Security Committee: “Only now do we understand that we were aware of just 40 percent of the reach of Hamas’s infrastructure.”Footnote 54
In the 2000s, some Hamas cells in the West Bank also maintained strict compartmentalization, and their members would only meet in emergencies. They left their homes only rarely, and when they did so, it was for brief sojourns and directly related to their missions.Footnote 55 In this period, Hamas continued to ensure that its activities remained confidential and were exposed only on a need-to-know basis. For example, while coordinating his cell in March 2002, Muhammad ʿArman and his team members decided that a certain operative for an attack would be identified in a meeting at the mosque. The operative would wear clothing that distinguished him; ʿArman would ask him a prearranged question (“Where is the Education and Culture Ministry?”) and would wait for the correct answer (“In Bir Zeit.”) before proceeding.Footnote 56
Frequent clashes with Israel’s security forces also meant that Hamas had to prevent its documents from falling into Israeli hands, and had to maintain compartmentalization and security procedures with regard to documents too. In many cases, the organization failed in this mission, and entire archives would be intercepted by Israel. By the 1990s, however, documents were successfully destroyed in some cases. For example, an East Jerusalem cell headed by Ibrahim ʿAbbasi, which operated from 1997 to 1998 on the basis of directives from Hamas operatives held in Israeli prisons, was highly conscious of security. The sides therefore communicated through letters. Hamas operatives in prison would write letters and wrap them in plastic to look like candies, so that it would be possible to swallow them if necessary. For the most part, the operatives used code words whose meaning was known only to the two sides. Money was also transferred clandestinely using dead drops. On one occasion, a cell leader received a letter that instructed him to go to the al-Aqsa Mosque, go to the cupboard where the congregants placed their shoes, and take the bag that rested on top of the cupboard. The bag was filled with a plant used to make herbal tea; the money was concealed inside. Further evidence for the high awareness of security on the part of Hamas’s infrastructure is the fact that when ʿAbbasi saw soldiers going past his house just before his arrest, he burned the letters containing the information gathered, as he feared they might be found in his possession were his house to be searched.Footnote 57
In 2008, an internal publication of the Hamas military wing devoted an entire chapter to securing the organization’s documents of every type: papers, files, books, photographs, maps, disks, diskettes, videotapes, and so on. Operatives were provided with procedures for the proper handling of documents, from preparation to storage. For the preparation stage, operatives were told to create documents in a discreet location that would neither attract attention nor expose the documents’ contents. Operatives were further warned not to write documents on soft or delicate surfaces that might absorb pen impressions and thus reveal the contents. References to addressees and entities mentioned in the documents had to be made allusively and in code. All drafts and documents not in use had to be destroyed by various means – burning and flushing the ashes down the toilet, shredding and soaking the strips, and so forth. Operatives were asked to make note of devices that stored a copy of the written or photographed document, such as fax machines and printers; they were also instructed to destroy the film reels or erase the memory of those machines, as well as to remove identifying markers, such as fingerprints and ink type, so that these markers could not be used to trace them.Footnote 58
Before distributing any document, operatives had to title it with its correct level of classification: Top Secret, Secret, Confidential, Sensitive, and Unclassified.Footnote 59 Similarly, with regard to computer use, operatives were instructed to delete any document that was no longer necessary, and to use passwords and codes when accessing their computers. Physical documents were to be stored in secure locations that were known only to a few operatives and that could be wiped clean when necessary. Operatives were instructed to take inventory and make regular audits to ensure all documents were there; to avoid leaving documents in cars or other locations visible to others; to check their pockets to make sure that they were not accidentally carrying documents; to abstain from reading documents not immediately relevant to them; to keep a log of everyone who had seen sensitive documents; and to make a plan in advance for destroying the documents or removing classified elements from the documents in an emergency.Footnote 60 Warnings against the circulation of documents beyond their distribution list can be found in Hamas military texts from 2013. Instruction manuals for anti-tank weapons and for snipers, which contain the combat doctrine of ʿIzz al-Din al-Qassam in these areas, are inscribed with the following comment: “Esteemed brothers-in-arms will refrain from photocopying, publishing, and printing this manual without the express permission of the Instruction and Training Department.”Footnote 61
Stemming the Flow of Information from Operatives Detained by Israel
Hamas also tried to block Israeli access to intelligence derived from human sources (HUMINT) by attempting to prevent information leaks by operatives arrested and interrogated by Israel. In September 1988, using funds raised in the United States, Hamas representatives in Cyprus printed a sixteen-page instruction manual entitled “The Mujahid under Interrogations and Torture.” The booklet explains to operatives how Israel makes use of arrests to extract significant intelligence using various means, including physical force. Operatives are told in no uncertain terms that jihad does not end with one’s arrest, but continues into the interrogation room; they are informed of the dangers of giving up information on Hamas activities and fighters, as well as the benefit this may provide to Israel. With the help of numerous citations from the Quran and other Islamic literature, the manual stresses the responsibility of every operative to withstand torture and the rich rewards of keeping silent.Footnote 62
Since the organization’s inception and into the 1990s, Hamas’s front in the United States was the Islamic Center for Research and Studies. In addition to gathering OSINT,Footnote 63 the center collected information that included indictments and confessions of Hamas operatives arrested by Israel, submitted by attorneys retained to defend Hamas suspects. Examining these documents, the center assessed the damage wrought by revelations about other operatives, methods of action and communication, and money transfers. Hamas derived lessons from this data that had a practical impact on all the changes made to the organization’s operations from 1989 onward. In March 1991, members of Hamas’s political committee met at a Ramada Inn in Kansas City. The meeting was run by Muhammad Sallah and featured Najib al-ʿAush, a Palestinian MA student and longtime resident of the United States. During the meeting, al-ʿAush lectured the other attendees on a range of topics, including the interrogation practices of Israel’s intelligence.Footnote 64
At that time, Hamas undertook a damage assessment regarding information that operatives might have relinquished during interrogations in Israel. In the 1990s, documents detailing confessions made by organization members to the Israeli authorities and information on how these confessions were extracted were discovered in the possession of ʿAbed al-Halim Ashkar, a Hamas operative in the United States. Hamas had collected these documents in order to find out what Israel had learned about Hamas; this would almost certainly help the organization to change its modus operandi and implement future safeguards to increase the odds of missions’ success and decrease the odds of arrest.Footnote 65
Hamas’s training and instruction programs also emphasized this topic. A 2008 publication of the military wing, aimed at its operatives, stressed that many of Israel’s successes had resulted from confessions during operatives’ interrogations. The publication pointed out that even if an operative confesses, he will not admit it to his commander, so the organization does not know it needs to change its conduct. Therefore, operatives must do everything they can to avoid arrest; if they are arrested, they must behave according to the specified security procedures.Footnote 66 In 2008, Hitham Quran established an usrah, a study group for Islamic materials, in al-Birah. The aim of the usrah was to strengthen religious sentiment and support for Hamas in the region. Its curriculum, which focused on religious studies and espoused a worldview aligned with Hamas’s stances, also covered the Shin Bet’s interrogation practices.Footnote 67 An additional example is the Shabab al-Aqsa, Hamas’s extension on the Temple Mount. Its objective was to carry out activities on behalf of Hamas to strengthen Palestinian control, whether by propaganda or violence. Between 2014 and 2016, operatives received training on security arrests and the Shin Bet’s methods of interrogation, as well as recommended practices in case of arrest.Footnote 68
Hamas operatives were also briefed on the topic as part of their training in preparation for attacks. Ramiz Abu Salim, the suicide attacker who carried out the bombing of Café Hillel in Jerusalem in September 2003, underwent training before the bombing in which he received material on Shin Bet interrogations, probably in the event that he was caught.Footnote 69 In an additional example, after Ziʾad ʿAwar and his son ʿIzz al-Din al-Qassam successfully conducted an attack together in April 2014, Ziʾad instructed his son and partner on how to face interrogation by Israel’s security forces, based on the former’s own personal experience.Footnote 70
While many operatives nevertheless supplied high-value intelligence to Israel’s security forces, the tools Hamas provided its fighters to withstand interrogations in Israel did bear fruit in some cases. In 1995, Israeli security forces claimed that it had become extremely difficult to extract high-quality information about Hamas. Interrogations had become the primary channel of information, and they too had been rendered practically useless – “The terrorists have learned. They’re giving up information only after prolonged interrogation if at all, when the information they give is no longer relevant.”Footnote 71 A more recent example is the arrest of an operative connected to the planning of the Gilad Shalit abduction in June 2006 only a few days before the mission. The operative managed to withstand the interrogation long enough that the information he ultimately gave was no longer of any use in preventing the abduction, which was already underway.Footnote 72
Hamas’s Battle against the SIGINT Threat
Since its inception, Hamas has been aware of the risks inherent in the use of telecommunications. The organization’s first line of defense was to find indirect ways for operatives to stay in touch, mainly in the form of written dispatches. For example, Mazin Muhammad ʿAlian, a resident of the Gaza Strip, enlisted in Hamas in 1989. From then on, he contributed to the organization in various ways. He opened his house to members of the military wing, including Muhammad Daif, then its head in the Gaza Strip. Because he held an Israeli work permit, the organization used him to transmit a secret dispatch from a Hamas operative in Israel to the Gaza Strip. The dispatch was forwarded to Daif, who instructed ʿAlian not to give it to anyone else and to destroy all copies.Footnote 73 Nishat ʿAiyyash served as a Hamas operative starting in 1988; his role was also to carry dispatches. He eventually traveled to Lebanon for weapons training with Hizballah, and in 1995, when he returned, he brought a dispatch for Hamas operatives that was transmitted in 1996.Footnote 74
After the deportation of many Hamas operatives in late 1992, Hamas personnel in the United States smuggled equipment, money, and operational directives to the West Bank to rebuild the movement. In order to achieve this objective, they selected operatives who held US passports; who were, as far as they could tell, not known to Israeli intelligence; and who had relatives in the West Bank, so that they could conceivably use a visit to family as the cover story for their arrival.Footnote 75 Another method for the secure transmission of information by Hamas is evident from the following example. In the 1990s, in order to maintain contact between the West Bank and Syria, Hamas operatives would write messages on very thin paper, roll the messages up, and insert them into medical capsules or plastic cord. The courier would swallow the capsule before crossing the border, then vomit it up on the other side. Alternately, the message would be concealed inside the courier’s shoe.Footnote 76 Either way, the courier himself remained ignorant of the message’s content and was thus effectively compartmentalized.
In 1995, Ziʾad Hamad, a Hamas operative from the village of Silwad, traveled from Israel to the United States via Jordan. During this journey, he carried a message from Ibrahim Hamad, another Hamas operative, to a Hamas member in Jordan, ʿAbed al-Ghafur al-ʿAjuri. The meeting with al-ʿAjuri was arranged by means of code words received by Ziʾad from Ibrahim.Footnote 77 Likewise, in 1999, Ibrahim Zaharan, a resident of Dir Abu Mashal, was asked by ʿUdeh Zaharan, an operative from Hamas’s Jordanian headquarters, to help the Jordanian headquarters to transmit a message from a Hamas operative in the West Bank. Ibrahim was provided with a code word to identify himself to Hamas agents and receive the cue to embark on his mission. The message itself was rolled up and concealed inside a can of olives.Footnote 78
This sort of activity continued into the 2000s and after Hamas seized control of the Gaza Strip. In the early 2000s, Maher Husseini ʿAli Shafi ran a dead drop for Hamas, which he used to help transmit dispatches among organization members.Footnote 79 In 2008, Mahmud Nagar served as a courier in the engineering department of Hamas’s military wing to pass information between fireteams, apparently in an attempt to avoid wireless communications.Footnote 80 In March 2012, Musa Sarur worked as a courier, tasked with moving memory sticks from Hamas’s Ramallah headquarters to the organization’s Jordanian headquarters. To this end, his handlers in Ramallah equipped him with a dedicated cell phone for calling Hamas operatives in Jordan.Footnote 81 Bushra Tawil, who was eligible for money from Hamas because of her parents’ imprisonment, was in contact with Hamas to help move funds from Jordan. As part of this mission, she collected lists of other individuals eligible for financial assistance, which she sent by encoded email and in a written missive to the Hamas operatives with whom she was in contact.Footnote 82
Another method to circumvent the risk of interception was conversation in code. In the early 1990s, Hamas’s headquarters in the United States made use of this strategy: Phone calls between Hamas operatives (with the participation of ʿAbed al-Halim Ashkar) in the United States, and between the United States and other locations worldwide, were conducted in code.Footnote 83 In early 1993, when Hamas emissaries from the United States came to the West Bank, written instructions for paying operatives were encoded using the 1+X method (the numeral 2 was written instead of the numeral 1, the numeral 3 was written instead of the numeral 2, etc.) so that instructions intercepted by Israeli intelligence would not identify the operatives.Footnote 84
Code names were also used in letters from inside Israeli prisons to Hamas operatives at large. Hamas operative ʿAli Saʿid, imprisoned in the Ramon facility in 2008, aimed to carry out an attack in Israel. He contacted fellow inmate Mandhar al-Jaʿbah, knowing that the latter was in contact with operatives in the Gaza Strip. They agreed that when al-Jaʿbah was released, he would aid in the execution of the attack. In order to maintain communication, in August 2009 Saʿid asked al-Jaʿbah to send a letter to a Hamas operative he knew; the letter would contain information necessary for the attack, which was planned for December 14, the anniversary of Hamas’s founding. The two agreed on code names for further contact. Later, Saʿid sent encoded letters to other Hamas personnel containing additional code words relating to the operation. Saʿid was also given phone numbers in encoded form to contact Hamas operatives. In one incident, notes were smuggled to him in a bag of potato chips given to him by his wife.Footnote 85
Ahmad al-Jaʿbari is an example of a senior Hamas member who maintained strict secrecy for years following the attempt on his life in 2004. He rarely went out, and then only with multiple bodyguards; the bodyguards would sometimes go out without him to confuse observers. He made a point never to carry a mobile device on his person, and he used couriers to pass on commands and instructions, until, on the eve of Operation Pillar of Defense, he made a fatal error that cost him his life.Footnote 86
From the establishment of its military wing, Hamas began to use the systematic tables of code words known as lumʿi. Thus, for example, in 2007, Talʿat Maʿruf, the Hamas forward observer from Bait Lahiya mentioned in Chapter 1, was exposed to a communications instruction document for the ribat’s activities and forward observation activities. The document specified the code names of the posts used over com devices, as well as passwords for passing on reports, in a booklet called Kharitat lumʿi.Footnote 87 Documentation from 2009 of a Hamas forward observation team also demonstrates the use of lumʿi tables. The forward observer reports that “there’s a 2/2 lumʿi there and it’s 1/1 and in rapid motion.” The numbers used here reflect the use of the code table familiar to forward observers and the command rooms, adopted in case Israel is listening in on the reports. From the context, one can assume that 2/2 refers to some type of vehicle or force identified by the forward observer, and that 1/1 refers to some description of the object identified or action carried out.Footnote 88
An example of Hamas’s code document from 2009 is instructive in terms of the manner of use and content of lumʿi tables. This lumʿi table belongs to a regiment named for the shahid Nadal Nasser; based on the table’s content, the regiment appears to be part of the northern Gaza Strip brigade, responsible for the area around the Erez Crossing. The uppermost table on the page features columns and rows of words that may be combined to create coded messages. Possible messages include reports on raising the alert status to 1, 2, or 3; reports on Hamas rocket fire or the entrance of IDF special forces; updates on soldier abduction; tunnel use; detonating various explosive devices; setting ambushes; and reports on the presence of a suspicious vehicle. Furthermore, there are codes for requests, such as dispatching an ambulance or sending in the media and propaganda apparatus (presumably to document an incident). The second table on the page has names of places controlled by the regiment, including locations on the Israeli side of the border, such as the Erez post, and locations within the Gaza Strip, such as homes and lands belonging to Gaza residents.Footnote 89
In the West Bank, too, Hamas operatives continued to use code as a way to mitigate the risk of Israeli interception. For instance, a fireteam led by Rajib ʿIlawiyah, who carried out the attack in Bait Furik in October 2015 in which an Israeli couple was killed in front of their children, made plans to abduct an Israeli citizen. To this end, the fireteam arranged for the help of a local doctor; were someone to be hurt during the abduction, whether one of the attackers or the victim, they would alert the doctor using code words that would indicate a need for medical help, and he would come to the site.Footnote 90
Hamas upheld security protocols to reduce the risk of Israeli surveillance of operatives’ devices. Already in the 1990s, Hamas operatives, including senior figures, would use cheap burner phones only one time, so that Israeli intelligence would be unable to link a specific phone with terrorist activities. They worried that their homes were bugged, and they trained their families to take security precautions in order to safeguard against wiretapping.Footnote 91 As noted in Chapter 2, Nizmi Hussein, then a student in Romania, was recruited to Hamas in the early 1990s. He was sent to Turkey for training in 1994; there, he was instructed to conceal his real identity and refrain from revealing any detail of his training. Later on, Hussein tried to recruit his friend ʿAbd al-Islam Zidan to the organization. At the meeting in which Hussein reached out to Zidan, Hussein made sure to turn off his mobile phone and remove its battery. Throughout the time Hussein served as Zidan’s handler, the two were careful to uphold strict rules of secrecy. The two agreed to address one another only using nicknames. In the course of their training, both Hussein and Zidan received instruction on how to avoid detection, prepare dispatches, and encode information.Footnote 92
In the late 1990s, Ziʾad Hamad served as the go-between for Hamas operatives Ibrahim Hamad and Sharif Dudin. Dudin would contact the money exchange where Ziʾad worked and, using prearranged code words, give him a message to summon Ibrahim to the office, apparently on the understanding that it was a relatively clean phone line unlikely to be intercepted by the Israeli security services. In this way, they set up their meetings.Footnote 93
ʿAbbas al-Saʿid, a senior Hamas operative from Tul Karem, was among the ringleaders of the infamous 2002 attack on the Park Hotel in Netanya on the first night of Passover. The attack was preceded by a long period of preparations, including attempts to finalize the cell, attain explosives, and so on. Some of the members were arrested by Israeli forces in the summer of 2001, delaying the attack. Consequently, al-Saʿid went underground, where he stayed in contact with other Hamas operatives using text messages and dispatches placed in dead drops. Just before the attack, al-Saʿid, who was in charge of the operation, gave Fathi Hatib, the operative tasked with transporting the terrorist to the Park Hotel, a “clean” cell phone with which to submit real-time updates on the attack.Footnote 94
In 2009, Hamas senior operatives held extensive secret discussions on the establishment of a military academy, one of several lessons learned from Operation Cast Lead. The issue was never discussed over the phone. All talks were face-to-face, and the meetings prearranged. If any talk was to be done otherwise, it was via text message, using cell phones that were replaced every two or three months.Footnote 95 In October 2009, Murad Kamil traveled to Turkey to meet with Hamas personnel for whom he was working in Israel. He was instructed to call three different phone numbers on three different days and identify himself by a code name. He was also instructed to buy a cell phone with a new SIM card to use only for making these calls.Footnote 96 When Islam Marʾi, an Israeli citizen from Furadis who had been recruited to Hamas in 2010, met with Ahmad al-Huf, another Israeli whom Marʾi in turn wanted to recruit, Marʾi put his and al-Huf’s cell phones in a different vehicle to prevent interception.Footnote 97
In 2011, Jihad Atun, a Hamas operative from Sur Bahar, arranged to coordinate an attack in Jerusalem with a Gazan Hamas member named Saurhabil. Atun was told to buy a new SIM card and wait for encoded instructions by text message. In practice, the code word was sent in an email, appended to a seemingly innocent paragraph of text. All this was preliminary preparation for an attack that was never executed.Footnote 98 In March 2013, Hamas sent Salim Sharkas to Jordan, ostensibly for a family event. His senders gave him an alias and instructions for contacting the relevant Hamas operatives in Jordan. He was told to buy a cell phone and SIM card that would be destroyed after the mission was completed, in order to generate a new means of communication between Hamas personnel in Jenin and their counterparts in Jordan. Sharkas returned to Jordan about two weeks later, at which point Hamas members gave him a dedicated email address for communications.Footnote 99 In 2014, Hamas hired Ahmad Saʿidi, a Gazan fisherman, to smuggle goods necessary for the organization’s operations. When they met, before they started to discuss anything sensitive, the Hamas operatives took Saʿidi’s JawwalFootnote 100 device away from him, turned it off, and removed its SIM card.Footnote 101
Hamas also endeavored to encode online activity conducted via email and smartphones. In the 2000s, at least some communication between Hamas and the Syrian headquarters took place online, though from internet cafés rather than from operatives’ homes, making it difficult to pin down the entity that was in touch with Damascus.Footnote 102 In late 2010, Hamas operative Jihad Atun established contact with a fellow operative in Gaza in order to receive instructions for an attack. Some of their communication took place by means of encoded email.Footnote 103 In 2017, “F. F.” was asked by his brother, a Gaza Strip resident, and his half brother Muhammad, a Hamas operative, to buy a cell phone and SIM card and install an app for transmitting encoded messages. The device enabled F. F. to communicate with Muhammad in order to plan a revenge attack for the killing of a senior Gaza Strip Hamas leader, attributed to Israel.Footnote 104
In addition, Hamas remained aware of the danger of interception, and constantly worked to alert its operatives to the risk of using wireless devices. A 2005 Hamas publication first presents a schematic explanation of how the Jawwal network operates. Like every other mobile network, it relies on regional cells. When a device is in motion, it hops from one cell to another based on location. According to the schema, every time communication is bumped from one cell to another, considerable information about the device is transferred, including its type, date of manufacture, model, serial number, and card. This allows security agencies to make connections between different cards switched on the same device. Therefore, it is risky to maintain a card dedicated to covert operations in the same device that sometimes houses a card for civilian use. Additional data are transferred by means of reception sites, such as antennae and cell towers, near the user, making it is possible to identify the device’s location. For these reasons, Hamas recommended that its operatives get rid of their Jawwal devices. The same report states that when a device is off, it does not transmit data; therefore, there is no need to take the battery out of the device, as some operatives do. The writers of the report also point out the difference between non-content signalsFootnote 105 and conversation signals, and state that the device does not emit non-content signals when it is turned off.Footnote 106
The report also covers an incident in which Israel inserted listening devices in mobile devices belonging to Yasser ʿArafat and his aides; based on this episode, the reader is instructed neither to accept any phone as a gift nor to purchase one from anyone suspicious. Later on, the report cites example of words that, when uttered, mark the device as potentially suspicious and invite interception: jihad, ʿamaliya, istishhad, and names such as Daif (Muhammad Daif) or al-Rantisi (ʿAbed al-ʿAziz al-Rantisi). Moreover, the report notes, surveillance can be implemented for a specific phone number, enabling the investigation of that phone number’s communications – all incoming and outgoing conversations. It therefore recommends that operatives use cards bought with no proofs of purchase and replace them from time to time.Footnote 107
An internal Hamas publication from October 2013 further exemplifies the organization’s attempts to raise its operatives’ awareness of the dangers inherent in cell phone use. In a section devoted to security, the publication introduces a film from the Israeli media (the now-defunct Channel 2) that presents advanced interception technologies. The film shows these technologies in use, presenting a demonstration staged at Bar-Ilan University; it describes the advanced capacities they provide for the interception of conversations, as well as the information that can be elicited from access to cell phones.Footnote 108
Hamas’s Battle against the GEOINT Threat
At least since the mid-2000s, Gaza Strip residents have easily been able to identify the sound of the UAVs the IDF operates to gather intelligence. The UAV’s nickname in the Gazan dialect – al-zʿnana – is in fact derived from the buzzing sound it makes. The identification of UAVs was a sign that the IDF was gathering intelligence; louder buzzing indicated an increase in intelligence gathering.Footnote 109 Thus, for example, in 2005, Haytham Hilas and his comrades went out to place an IED for detonation against an Israeli bus. When they arrived at the site, they noticed an Israeli UAV and turned back.Footnote 110
Hamas worked hard to raise its operatives’ awareness and familiarity with Israel’s GEOINT capabilities. Complete issues within a series of publications named Know Your Enemy were devoted to the topic. For example, the first issue of the series, released in July 2007, addresses the topic of “Intelligence [Gathering] by Skylite Airplane”; it provides background on the drones’ importance for Israel’s intelligence-gathering purposes in general and against the Palestinian resistance in particular, as well as the enormous investment made by the Israeli military industry in their development. The issue then furnishes a great deal of information about a model known as Skylite, a tactical UAV for intelligence gathering manufactured by RAFAEL, including its important function on the battlefield, special features, and technical specs (weight, wingspan, speed, duration in the air, maximal range, etc.). Lastly, the issue details the means of observation installed on the drone, including its range, its resolution, its mechanism for retransmission, the range of its frequencies, and so on.Footnote 111
After the descriptive component, the issue features a piece delineating the UAVs’ weaknesses and possible strategies to combat them. According to the text, the UAVs’ main weaknesses are difficulty in functioning under extreme weather conditions; difficulty in observation through thick smoke; inability to penetrate through both artificial and natural shelters; and difficulty distinguishing between objects/buildings and their shadows. The analysis recommends that, when operatives see a UAV of the type under review, they should hide under a shelter that blocks the vehicle’s field of vision, run towards a heavily built-up area where identification of individuals is difficult, avoid using wireless devices, move by motorized transport when the drone/UAV is overhead, and maintain prearranged shelters for operatives in potentially fraught areas or areas where IDF surveillance is likely.Footnote 112
Another issue in the series is devoted to Israel’s intelligence gathering by means of thermal systems. Learning from its own past failures, as well as those of Hizballah in southern Lebanon, Hamas realized that a key feature of Israel’s ability to uncover planned operations is the use of cameras that detect activity from body heat. Neither hiding nor camouflage were of use to operatives, because they were not aware of the threat from thermal devices nor of ways to combat them. The issue contains a scholarly explanation of the scientific principles at the heart of thermal device technology. The organization’s operatives, who are the target audience for the publication, are asked to be patient and keep reading despite the scientific nature of the text because of the importance of understanding the threat. The text breaks down the operational rationale of thermal systems, based on the heat given off by the human body compared to its environment, with diagrams and charts to aid the explanation.Footnote 113
The publication goes on to describe in detail several thermal systems used by Israel and other armies, and breaks down the capabilities of each, so that operatives may get a sense of the nature of the threat to them from these systems. The text includes, among other details, the options for the systems’ placement in the battlefield, their common uses and range of detection, and a photo of the systems so that operatives can see what they actually look like. This is followed by a section that discusses ways to confound the systems. In terms of passive defense, Hamas recommends that operatives make sure they have thermal insulation, using animal- or plant-based materials as well as synthetics. The text also provides tips on the use of thermal insulation in various situations. Other recommendations on dealing with the threat are also provided; these are divided into simple versus more advanced methods. The most basic is burning tires to confuse the thermal systems’ sensors. Among the more advanced tactics are the use of wet netting that absorbs a significant amount of body heat, the use of ceramic insulation materials that trap heat inside buildings, painting houses with heat-insulating paint, and more. In conclusion, the text provides several examples of photographs produced by thermal systems in different environments, including a demonstration of how a thermal camera perceives a tank with and without damp netting, meant to show the effectiveness of insulation.Footnote 114 This modus operandi was realized in a drill held by Hamas’s Burij regiment in 2007. The drill practiced the burning of tires to create a smoke screen, designed, according to the participants of the drill, to make it difficult for IDF patrol and observation planes to gather the necessary intelligence before an attack. This action was defined as a responsibility of Hamas’s aerial defense unit.Footnote 115
Another way that Hamas combats Israel’s GEOINT threat is camouflage. In a survey of the anti-aerial capabilities developed in the Gaza Strip after Hamas seized control in 2007, the publication shows Hamas operatives disrupting Israel’s ability to conduct visual surveillance of anti-aircraft cannons. The weapons are stationed on farmland and blend into the natural surroundings, concealed by green camouflage covers or green paint on the weapons themselves.Footnote 116
A 2007 feature about Hamas on the al-Aqsa channel showed the aerial threat posed by Israel to Hamas. In addition to helicopters and airplanes, the reportage also highlighted UAVs: “The weapon that has recently entered the line of confrontation with the Palestinians and has of late been upgraded even to carry missiles – that is, the drone the Palestinians calls the zʿnana – is now enemy no. 1 of the resistance. It has been used to eliminate dozens of resistance fighters by bombing their cars or posts.”Footnote 117 Likewise in 2007, in footage of a drill by Hamas’s military wing to prepare for a large-scale Israeli incursion into the Gaza Strip, aircraft can suddenly be heard in the background. The cameras of the foreign reporter covering the drill caught operatives taking cover underneath camouflage out in the open.Footnote 118
The importance of camouflage was repeatedly emphasized for operatives on the ground. An instruction booklet for Hamas snipers stresses the need to place the sniper’s nest in a location for which camouflage has previously been planned. The quality of the camouflage is described as critical to the operation’s success. Among the camouflage tools presented to sniper fireteams are camouflage creams to rub onto one’s face and arms, camouflage nets (noted as a drawback is the fact that these nets decrease one’s field of vision), and a white cloth for the window that allows one to look out without being seen from the outside.Footnote 119
Another way to combat the Israeli GEOINT threat is the use of the subterranean level, hidden from the eyes of Israeli observation. We know of basic, undeveloped use of tunnels in the Palestinian theater, especially in the Gaza Strip along the Philadelphi Corridor (the border between the Gaza Strip and Egypt), as early as the 1990s.Footnote 120 In the 2000s, however, a significant development took place with regards to certain features of Hamas’s activity. In a 2006 interview, Muhammad Daif described tunnels as the next phase of warfare against Israel. According to Daif, Hamas had first concentrated on attacking collaborators; next, it turned its weapons to fire on Israeli army forces. Then came the IED stage, led in the 1990s by Yahiya ʿAiyyash, which continued into the early 2000s. The present, as Daif would have it, was the stage of the so-called tunnel war: an attempt to successfully penetrate Israeli settlements and harm residents, Border Patrol forces, IDF forces, and surveillance mechanisms along the border. In his opinion, this stage would be “high-quality war” that would result in significant damage to Israel.Footnote 121
Extensive use of tunnels for a variety of Hamas activities began in the early 2000s. In self-published documentation of subterranean activity from 2005, Hamas describes at length the transition that led to tunnel use. Hamas had identified the increased fortification of IDF posts, a phenomenon that was partly the result of the Second Intifada. In addition to physical defenses, such as electronic fences and concrete walls, Hamas was also aware of the intelligence-gathering tools used by Israel, including surveillance cameras and aerial patrols, as an integral part of the protocol for guarding the posts. All these defensive means made it difficult for Hamas to attack the posts using aboveground means of approach. This led to the idea that, in order to thwart Israel’s ability to identify Hamas activity, the organization would have to take up subterranean premises.Footnote 122 Interestingly, one reason for the expansion of the tunnels is the sandy soil of the Gaza Strip, which makes digging relatively easy.Footnote 123
The first subterranean attack occurred on September 26, 2001, aimed at the Tarmit army post located on the Philadelphi Corridor. Hamas operatives had tried to attack the post several times using different means, all aboveground. All of these attempted attacks failed, and the organization attributed the repeated failures to the defenses described above.Footnote 124 Therefore, on the initiative of prominent operatives in Rafah such as Raʿid al-ʿAtar, who would later become the commander of Hamas’s military wing in the southern part of the Gaza Strip, Hamas began to dig a tunnel underneath the post. To avoid detection, the starting point of the work was an abandoned house nearby. There, too, activity was performed as clandestinely as possible, out of concern about potential collaborators in the area. According to Hamas, the successful detonation, which caused significant damage to the post and injured four soldiers, was the formative event that jump-started the tunnel war (harb al-anfaq) between the organization and Israel.Footnote 125
The success of the operation against the Tarmit post spurred further underground activity. In December 2003, the Chardon post, also on the Philadelphi Corridor, was attacked. Hamas operatives had dug 10 meters (approximately 33 feet), apparently to bypass the fortification wall erected around the structure to protect it from a tunnel attack. The resulting explosion caused considerable damage to the post.Footnote 126 Before the next attack in which Hamas used tunneling – against the Orhan post at the Gush Katif junction in the Gaza Strip – Hamas realized that Israel had responded by adding further layers of defense: erecting guard towers, setting out barbed wire coils, using surveillance and observation measures, and leveling the ground around the posts so that approaching operatives would have nowhere to hide. Therefore, Hamas decided to act against the post from underground and began to dig. On June 28, 2004, a tunnel under the post was blown up, killing one soldier and injuring five.Footnote 127
In 2003, Raʿid al-ʿAtar and Muhammad Abu Shimallah, two senior Hamas operatives in the Gaza Strip, began to conceive an attack by means of a tunnel that would be dug from the Gaza Strip, under the fence, and into Israeli territory. Through another Hamas operative, ʿAtwa ʿAmur, they found a suitable piece of land owned by Usama al-Fara; when Abu Shimallah came to inspect the location, however, he rejected it because he deemed it was too close to the fence and thus liable to be observed from the Israeli side.Footnote 128 In total, between 2001 and 2004, there were five tunnel attacks resulting in seven Israeli deaths, almost all perpetrated by Hamas.Footnote 129
A tour given by Hamas operatives to an Al Jazeera journalist also included a visit to one of the organization’s tunnels. The entrance to the tunnel was hidden inside the floor of an ordinary house. The tunnel appears to be spacious; several people can be seen moving relatively freely, bending down only slightly. The Hamas operatives define it as “a five-star tunnel,” reflecting its quality in the organization’s estimation. The journalist notes that the tunnel was constructed as part of Hamas’s war of intelligence with Israel, as a result of which the organization had opted to move its operations underground. According to Hamas spokesman Abu ʿAbeidah, at that time Hamas dug 400-meter-long tunnels, spending approximately four months on each.Footnote 130 In October 2007, Hamas operatives started to dig a tunnel from the home of Talʿat Maʿruf in Bait Lahiya to avoid detection by the IDF, and particularly by the drones used to observe terrorists.Footnote 131
During Operation Cast Lead, Israel discovered a tunnel network Hamas had prepared to use in a military confrontation. At least one was in Israeli territory, part of what the commander of the Southern Command described as “a multi-branched underground network.” According to an official Israeli state commission of inquiry, the successful subterranean preparations meant that Hamas’s “political leadership and senior military command structure had barely been touched, and the rate of fire had not stopped thanks to the distribution of weapons stores hidden in the ground.” Hamas learned from this operation and upgraded its underground systems. Starting in 2010, the organization managed to dig a variety of tunnels: smuggling tunnels, defense tunnels inside the Gaza Strip, tunnels for future fighting against Israel, and attack tunnels under the border fence that would serve operatives entering Israeli territory to carry out high-profile attacks.Footnote 132 The underground dimension was used not only to plan attacks against Israeli territory but to conceal rocket launches. Thus, for example, during Operation Cast Lead, Hamas operatives were documented in the Khuzaʿah area inside a tunnel that served as an underground pit from which to fire 120 mm rockets. According to Hamas, many rockets were launched from this position; although Israeli army personnel came very close to the site, they did not succeed in locating the operatives.Footnote 133
Hamas’s tunnel system reached its apex in the years leading up to Operation Guardian of the Walls in May 2021. In those years, while Hamas continued to dig attack tunnels aimed against Israel, its core effort was aimed at developing a subterranean city in the Gaza Strip underneath the homes of Gaza residents. This system earned the moniker “the Gaza metro.” Many years’ hard labor went into the creation of this underground system of dozens of kilometers, completely hidden from the naked eye. The tunnel network included headquarters, storage spaces, rocket launch positions, and much more. The cost per kilometer of tunnel has been estimated at $500,000, meaning that the expenditure for the entire network amounts to tens of millions of dollars.Footnote 134
It is worth noting that Israel has rendered a severe blow to the tunnel system. From a defensive standpoint, in the years preceding the operation, Israel built an underground barrier with advanced technologies along the border fence with the Gaza Strip to keep Hamas operatives in Gaza from penetrating Israel through tunnels. After Operation Protective Edge, and in the context of the lessons learned from the State Comptroller’s report on the topic, Israel embarked on an orderly process of constructing the barrier while ensuring cooperation among the relevant project partners.Footnote 135 The final decision on the route best suited for the construction of the barrier was made in June 2016, with Israel willing to invest nearly NIS 3 billion in the effort. The plan was to construct a barrier to be dug dozens of meters into the ground and about 6 meters aboveground along more than 60 kilometers of border.Footnote 136 Dozens of engineers and laborers worked around the clock for some three years; the project reached its completion in October 2020.Footnote 137
The barrier proved its effectiveness during the clash. Throughout Operation Guardian of the Walls, Hamas did not succeed in reaching Israeli territory by a subterranean tunnel even once, unlike many cases in the past, such as the abduction of soldier Gilad Shalit and during high-value actions during Operation Protective Edge. According to IDF data, during the military operation, the IDF thwarted attempts to attack Israel within the tunnels, as well as dozens of kilometers of the tunnels themselves.Footnote 138
From an offensive standpoint, during Operation Guardian of the Walls, starting the night between May 13 and 14, 2021, Israel attacked the “metro” dug by Hamas at massive cost in time, manpower, and money. Every night, systematically, Israel bombed the underground system, each time focusing on a different Gaza Strip sector, to disable more than 100 kilometers of tunnels.Footnote 139 Beyond the fact that Hamas’s entire investment was turned to dust, it is obvious that Israel had fairly accurate preliminary information about the “metro” routes, information that Hamas had tried – and apparently failed – to keep secret. This demonstrates that despite Hamas’s efforts at counterintelligence, Israel’s intelligence superiority is evident in clashes between the two actors, resulting in the disclosure of some of the organization’s secrets.
Hamas’s Battle against the OSINT Threat
From its inception, Hamas faced a tension between two imperatives: the need to publicize its actions as part of the battle over hearts and minds, both among Palestinians and in Israel, and the need to remain clandestine. This awareness created dilemmas and difficulties in decision-making, especially when assuming responsibility for attacks and publicizing details about the organization’s actions. On the one hand, Hamas saw the importance of claiming responsibility for operations so as to raise operatives’ morale, win over Palestinian public opinion, and heighten Israeli fears about the organization’s strength. Hamas also had to contend with the phenomenon in Palestinian society in which organizations falsely claimed responsibility for their rivals’ actions in an attempt to raise their standing. Moreover, Hamas suspected that Israel was a partner to disinformation campaigns in Palestinian society aiming to stimulate discourse that would help Israel discover the real attackers. On the other hand, Hamas was reluctant to publicize the details of the operations or identify the organization as the entity responsible.
Until 1987, the armed entities that predated Hamas, such as al-Majd, had largely conducted its operations against Israel in a non-public manner. While the start of the intifada and the continuing nature of operations gradually forced the organization to enter the limelight, Hamas did so with a constant eye to the political and security situation. The desire for secrecy stemmed from the notion that secrecy would make it harder for Israel to discover the identity of the operatives. Thus, it would lead Israel to waste time and effort in an attempt to find the actors and gain time for the operatives responsible. Also, Hamas was concerned that even a fragment of information provided when claiming responsibility would give Israel a lead that would ultimately reveal much more about the organization.Footnote 140
Therefore, Hamas called on operatives to display moderation and overcome their natural inclination to claim responsibility, reassuring them that real recognition would come from Allah, not from other human beings. The organization also tried to strike the appropriate balance between considerations for and against going public. One strategy was to claim responsibility in a way that would make it difficult to identify the perpetrators, such as leaving a note devoid of identifying markers other than the fact that those involved were ʿIzz al-Din al-Qassam Brigades, or calling news agencies anonymously to report that Hamas was responsible for a certain action. An example may be found in Hamas operative Jamil Wadi’s aforementioned book, which was published by the organization and described a number of its operations in the early 1990s. At the beginning of the book, Wadi explains that while his intention is to share the details of operations for several reasons (which he goes into at great length), he does so with the requisite measure of caution. According to Wadi, one possible method is to rely extensively not only on his own knowledge, but also on what has been published in the Israeli media and is therefore no longer a secret.Footnote 141
The race to claim credit, resulting in the exposure of information in the open media, continued into the 2000s. In March 2008, the military wing of Hamas presented the differences of opinion and competition among the various factions of Palestinian society as a danger – the organizations hurry to publicize their actions, which allows Israel to focus its research and surveillance efforts on the correct entity. According to Hamas, competition of this kind forcibly erodes many of the organization’s capabilities vis-à-vis the media and exposes its secrets to one and all.Footnote 142 Another consideration that received practical expression in Hamas’s policy on publicity was the need to demonstrate a consistent position to Israel. An example is evident in the case of the assassination of Hamas’s UAV engineer Muhammad al-Zuari in Tunisia in December 2016. After the assassination, which Hamas attributed to Israel, Hamas decided to publicize the fact that al-Zuari was a member of its military wing – an unprecedented decision, as Hamas customarily avoids taking responsibility and admitting its involvement in foreign countries. When a Hamas operative was asked about this choice, he responded that Hamas was aware that Israel saw – and had broadcast – the attack on al-Zuari as a severe blow to the organization. To refute the Israeli claim, Hamas had to prove its might; therefore, it decided to “out” al-Zuari’s identity and his connection with Hamas. Thus, the Hamas operative explained, Israel again lost the propaganda war, while Hamas was once more cast in a heroic light, inspiring its members and generating publicity, and leading other professionals to collaborate with the organization.Footnote 143
Hamas was also worried about media coverage that might endanger organizational assets. In 2006, a journalist for Al Jazeera came to cover the work and members of Hamas’s military wing. In this context, he met senior figures such as Ahmad al-Jaʿbari and Muhammad Daif, who was introduced and filmed as a masked figure. The journalist was blindfolded, transported along an unknown route in a Hamas vehicle, and brought to the particular places selected by the organization for coverage. Only then was the blindfold removed. Moreover, at the beginning of his itinerary, his mobile phone and that of his cameraman were taken away in order to prevent the potential use of the phones for espionage. Throughout the coverage, all operatives except for al-Jaʿbari were masked to conceal their identities from the media.Footnote 144
One well-known Hamas strategy is to carry out its activities under civilian disguise or by locating areas of conflict in civilian centers. This was evident in the May 2021 Operation Guardian of the Walls, in which Hamas worried that media coverage might contradict the organization’s interests. Yahiya Sinwar admitted that some of the organization’s command centers were still in civilian areas.Footnote 145 In order to preempt potential damage to its reputation, Hamas issued a letter to civilians and journalists in the Gaza Strip that forbade photography of rocket launches from the roofs of homes and apartment buildings. In this way, it attempted to project an image in which rockets were being launched only from open areas far from civilians.Footnote 146
Conclusion
Hamas’s counterintelligence is undoubtedly a significant component of the organization’s activities, in which it invests important resources, as is the case for other VNSAs. Hamas views Israeli intelligence as one of the nation’s primary strengths, and maintains that it must be offset in order to successfully confront Israel and thwart its actions. Over the years, the organization has scored some significant counterintelligence achievements. As described above, during the 1990s, Hamas managed to reorient itself and return to its usual activity every time Israel carried out a wave of arrests, evidence that although many of its secrets have been exposed by Israel, some remain concealed by the organization. In addition, operatives have eluded manhunts for several months at a time, and senior operatives, such as Muhammad Daif, remain alive despite Israel’s repeated assassination attempts. The starkest example of this success was the ability to keep Gilad Shalit hidden for so long without Israel being able to ascertain his whereabouts and free him from captivity.Footnote 147
Over the years, Hamas has studied how the Israeli intelligence services operate using diverse methods of intelligence gathering. It bases this investigation on its experience and on the previous knowledge it has gleaned throughout the clashes between the sides, as well as on extensive data collection. Much of that data is clearly the result of OSINT collection, but some is obtained by other means, such as double sources. All of this has proved useful for its operations and to raise awareness of Israel’s capabilities within the organization. In terms of operations, the knowledge accrued has been translated into a series of precautions, new methods, and the use of various means to minimize detection by Israel. These also include defensive counterintelligence measures such as physical security, personnel security, information security, and communications security, as well as offensive counterintelligence measures such as deception and neutralization.Footnote 148
When it comes to awareness, Hamas has done everything it can to raise its operatives’ awareness of Israel’s intelligence capabilities; the potential damage to the organization should information about it, its personnel, and its activities fall into the wrong hands; and what can be done to reduce this threat. The organization has developed materials explaining the Israeli intelligence services’ tactics, including highly detailed descriptions designed to convincingly demonstrate to its members the scope and significance of the threat.Footnote 149 Interestingly, Hamas, an Islamic movement, uses the religious beliefs of its operatives to motivate them to better safeguard information in the name of Allah, both during questioning by Israeli security services and in the general public.
Hamas has had some triumphs over the years, despite the clear inferiority of its intelligence compared to that of Israel. Nonetheless, in many cases, Israel’s advantage in terms of intelligence has been painfully obvious, as evidenced by the targeted assassinations of dozens of Hamas operatives even when the organization has gone to great lengths to keep information covert. Furthermore, Israel’s discovery of the tunnels dug by Hamas in recent years from the Gaza Strip into Israel, and the disabling of these tunnels before they could be used in attacks, including the destruction of the Gaza “metro” during Operation Guardian of the Walls, was a resounding counterintelligence failure on the part of Hamas.
