Nipp
Nipp
Dr. Shmuel Bar
Dr. Shmuel Bar heads Shmuel Bar Research and Analysis, an independent boutique analytic group that specializes in the Middle East and Russia and is CEO of IntuView Ltd. He is a former senior officer in the Israeli Intelligence.
“Son of Man, speak to your people and say to them: ‘When I bring the sword against a land, and the people of the land choose one of them and appoint him their watchman, and he sees the sword coming against the land and blows the trumpet to warn the people, then if anyone hears the trumpet but does not heed the warning and the sword comes and takes their life, his blood will be on his own head.. But if the watchman sees the sword coming and does not blow the trumpet to warn the people and the sword comes and takes someone’s life … I will hold the watchman accountable for that person’s blood. And you, Son of Man, I have appointed you a watchman for the people of Israel.” (Ezekiel 33:2-7)
Introduction
The late 20th and early 21st Centuries have witnessed numerous instances of strategic intelligence failures: the Iraqi invasion of Kuwait; the Iraqi failure to assess the U.S. commitment to liberating Kuwait; the under-estimate of the Iraqi nuclear program before “Desert Storm” and then the over-estimate of the program in 2003; 9/11; the Russian invasion of Ukraine; the misreading of the Iranian nuclear weaponization program; and, recently the Hamas attack on Israel of 7 October and the subsequent multi-theater war in the Middle East.
Each of these instances of intelligence failures differed in the structure and organizational culture of the intelligence agencies that failed, the political systems they served, the source of the surprise, and the outcome. Notwithstanding these differences, they also had much in common. In some cases, the strategic implications of tactical (terrorist) attacks and asymmetric warfare were not fully appreciated. In others, the lack of collaboration among services and a culture requiring consensus–along with disrespect for dissenting assessments–were also causes. Political hubris, mirror imaging, and condescension towards the enemy have also been common sources of intelligence failure. The confidence that the enemy is effectively deterred frequently stemmed from a misunderstanding of the enemy’s “Grand Strategy” and its goals/values: how much it is willing to sacrifice; cultural/religious and even personal motivations. Finally, there exists the relationship between the collection of intelligence and its analysis: the worldview of the analyst determines the intelligence requirements, resulting in further input which confirms the worldview, leaving out relevant information outside of the “streetlight effect”—proverbial “Black Swans.”
This article will focus on one of these cases—the Israeli intelligence failure of 7 October. However, this case holds lessons beyond Israel and the Middle East.
The Forgotten Lessons of 1973
The 50th anniversary of the Yom Kippur War (6 October 1973) was observed during the weeks prior to the 7 October attack. Israeli media abounded with discussions of the intelligence failure[1] of 1973, the “conception”[2] that led to it, and the question whether such a failure could recur. Two weeks before 7 October, the commander of the Israeli signals intelligence (SIGINT) unit (Unit 8200) circulated a letter in which he warned the unit that the error could recur and asked them to redouble their vigilance.[3]
Some of the motifs that came up in the discussion of the Yom Kippur War are relevant for this discussion. In 1973, the Israeli Intelligence Community (IC) was aware of the scenario of an attack, attempted to verify information, and failed in analysis of the situation. Leading up to 14:00 on 6 October 1973, the Israeli government and the Israel Defense Forces (IDF) were aware—albeit too late—that the war was imminent. On the morning of 7 October, the scenario that ultimately transpired was not even remotely expected by the Israeli Intelligence Community or leadership.
In 1973, a key factor was the hubris of political and military decision makers, who shared the unshakeable belief in Israeli deterrence and disregard of any information that implied that the enemy would dare launch an attack and risk immediate defeat. Based on mirror imaging of Israeli military logic to the enemy, Israeli intelligence believed that Egypt would not attack without mobile air defenses that would enable it to occupy most of Sinai. This assessment ignored information[4] that the goal of the war was “merely” to erase the humiliation of the defeat of 1967, to hold on to the banks of the Suez Canal and to wait for a ceasefire. After the war, one lesson was to accord more weight to “capability intelligence” along with “intention intelligence” and a “Warning Model” based on a complex system of “war indicators” that are ticked off and determine the probability of war, regardless of the logic of such “intention.” This lesson eroded over the years and by 2023, was “more honoured in the breach than the observance.”
Another perceived cause of the failure of 1973 was the predominance of Military Intelligence (AMAN) and the lack of intelligence pluralism. The remedy then was the formation of analytic departments in the Mossad and in the Shin-Bet with authority to provide their own intelligence estimate and raw intelligence directly to political leaders. A new function was created in AMAN—the “Other Opinion,”[5] which was mandated to challenge the assessments and conventional wisdom of the mainstream of AMAN. This pluralism had eroded over the years giving way to consensus again. The “Other Opinion” unit was downgraded in terms of numbers of officers and the rank of its commander and had lost its relevance by October 2023.
Israeli lesson learning after the Yom Kippur War frequently pointed out that had the war broken out on Sukkot, the moving of forces to the front would have been far more difficult due to the traffic jams that are common all over the country on that holiday. It is highly probable that Hamas was aware of this discussion and therefore planned the attack for Sukkot. Israel, on the other hand, had “forgotten” that lesson and had thinned out its forces on the border for the holiday.
The Shape and Scale of the Failure of 7 October
The intelligence failure of 7 October and its consequences were far greater than that of 1973. In the Yom Kippur War, no civilians were harmed. On 7 October over 1,300 civilians—men, women and children—were massacred, raped, burned and beheaded. 7 October went down in infamy as the largest massacre of Jews since the Holocaust.
The Intelligence failure of 7 October may be divided into two parts: strategic warning that such an event could occur; and tactical early warning regarding the specific event. Strategic warning of the outbreak of war in 2023 was provided in two AMAN documents and two Shin-Bet documents before 7 October. A third strategic warning document was prepared and planned to be disseminated on 8 October. These documents warned against “a clear, imminent and concrete danger to the security of Israel” and that the “danger of war has increased” and that the chances of a multi-theatre (or “convergence of theatres”) attack on Israel coordinated by Iran—from Lebanon, Palestinians, and Iran – had grown significantly.[6] On 25 March, the Minister of Defense issued such a warning publicly. For the first time in its history, AMAN issued an update in March 2023 to its “Annual Intelligence Assessment” of January 2023 that warned of the imminence of war. The heads of AMAN requested permission to brief the security and defense cabinet and the Knesset Defense Committee on the new assessment but were blocked by the political level.
Naturally, as in every failure of this magnitude, after 7 October the personal and professional backgrounds of the leaders of the Intelligence Community came under fire. The Director was a military officer with no intelligence background. He has since submitted his resignation.[7] Most of the senior officers no longer had a background in cultural intelligence and language (Arabic and Persian) and were experts in “cyber” and AI. It is true that the Assessment Division in AMAN passes on its assessments directly to the political level without the intervention of the Director, who has the right to add his own insights or even to disagree.[8] However, the Assessment Division itself was dependent on cyber-oriented intelligence and lacked senior officers with linguistic and cultural backgrounds.
This failure was not personal but systematic. A key source of the failure of 7 October may be seen in the Israeli government’s policy towards Hamas. The Netanyahu government’s policy of funding Hamas ($30 million each month through Qatar) was based on the logic that the weaker the Palestinian Authority would be, the less pressure could be put on the Israeli government to hold substantial negotiations with it that would endanger the cohesion of the coalition. The Qatari “carrots” along with “sticks” of Israeli deterrence—military superiority and threat of massive reprisal—were supposed to disincentivize Hamas from any action that would disrupt the quiet and stability in Gaza.
This policy affected the ability of the Intelligence Community to provide objective and independent warning. Israeli political leaders (particularly those who were senior military leaders) tend to see themselves as “experts” on military issues and on strategic intelligence.[9] Most of these leaders, nevertheless, were willing to listen to the Intelligence Community.[10] However, some have been reluctant to heed assessments of younger officers who have a fraction of their experience, particularly if such assessments contradict their own policies. This was particularly evident in the case of the Netanyahu government which was formed in September 2022—a year before the 7 October attack. This government was the most “ideological” and homogenous in the history of Israel. Political ideological considerations took precedence over pure military needs. In contrast to the past, when cabinet meetings were held with presentations of the Director of AMAN almost every week, AMAN presented to the cabinet only once since September 2022. Meetings between the Director of AMAN and the Prime Minister, which used to take place at least every three weeks, were reduced to one during the entire year of the current government.
The assumptions that Hamas could be “bought” with Qatari money and that Israeli defenses would doom to failure any military initiative by Hamas proved erroneous. A major error was the Israeli reliance on “deterrence by denial”: the “Iron Dome” that could effectively intercept most Hamas rockets and a $1 billion barrier based on a six meter high “smart fence,” cameras with night vision capability, seismic sensors, guard posts with remote-controlled machine guns, and sophisticated observation balloons that were monitored by the VISINT (Visual Intelligence) units on the ground and were supposed to block any Hamas attempts to infiltrate Israel. The possibility that Hamas would perceive the very attempt to breach the Israeli lines as an achievable goal—like the crossing of the Suez Canal in 1973—was not imagined. Hamas also assessed, on the basis of previous rounds, that an Israeli reprisal would not extend to total war and occupation of Gaza. Therefore, the “cost” of war was seen as lower than in the past. Furthermore, all the IC warnings emphasized the interest of Iran to prevent a U.S.-Israeli-Saudi defense alliance that the Biden administration was attempting to build. The option of encouraging Hamas to launch an attack was not integrated into the strategic picture. Nevertheless, few—if any—senior intelligence officers challenged this assumption on the eve of 7 October.[11]
The assumption that Hamas was deterred led the Israeli IC to neglect critical “Capability Intelligence.” Israel was aware of the existence of the extensive system of more than 500 km. of tunnels (dubbed the “Gaza Metro” by IDF intelligence) but severely underestimated their extent and purpose. The existence, extent, and structure of the “Metro” did not lead to an assessment regarding the intentions of Hamas in building it. Another “capability” that served traditionally as an indication of “intentions” has been the enemy’s intelligence requirements. Shin-Bet, 8200, and the human intelligence (HUMINT) unit of AMAN—Unit 504—all acquired information on detailed collection by Hamas on the bases and towns close to the border. The numbers and names of soldiers and civilians were documented. This was not integrated into the end assessment of intentions.
Structural changes in the organization and flow of raw intelligence also played a role in the failure of 7 October. The “love affair” of the Israeli IC with “cyber intelligence” and AI, the reliance on automated processing of information with little or no human intervention, and neglect of open source intelligence (OSINT), HUMINT, and linguistic and “cultural intelligence,”[12] are pointed out as structural causes of the failure. The ever-increasing flood of raw information dictated new methodologies for dealing with such quantities. The intelligence analyst no longer had the ability to read all the pieces of information and needed solutions for triage. The solution of the Israeli Intelligence Community was to shift from the human “push” of relevant data to the analytic bodies to creating an “intelligence pool” into which the information would flow, and then be “pulled” according to the intelligence requirements of the user. This risked the loss of large amounts of critical intelligence that could challenge the “conception” and the loss of nuances of “cultural intelligence” that AI systems are not able to detect or interpret. Analysts were not likely to “pull” from the pool information that did not correspond to their “conception.”
The changes in SIGINT methodology also artificially separated “tactical SIGINT” that was supposed to serve the fighting units in time of war from “strategic SIGINT.” The traditional methodology of covering the routine activity of the tactical communications of an enemy and generating alerts on the basis of changes in the volume and interaction of the enemy’s networks[13] as a possible indication to provide strategic alert fell into disuse. The coverage of tactical communications seemed superfluous in light of the plethora of strategic SIGINT. In retrospect, it probably would have provided clear early warning.
Another important factor was the downgrading of the role of OSINT and dismantling in 2021 of the AMAN OSINT unit “Hatzav,” which had been part of 8200. The justification for this change was the availability of automatic translation and AI. The OSINT functions were dispersed among other units in 8200 and to the theater analytic departments. The DOCEX (Document Exploitation) unit—AMSHAT—was also dismantled and had to be reconstituted upon the outbreak of the war. These decisions ignored warnings that automatic translation does not yet integrate domain expertise and cultural and religious allusions and that the structural change meant that OSINT was no longer actively “pushed” directly to the end user but “pulled” by the analyst as an “add-on” to the information collected from more classified and “prestigious” sources.[14]
The downgrading of OSINT and tactical VISINT and SIGINT as sources was exemplified by the fact that the Israeli IC all but ignored publications by Hamas on social media during 2023 showing videos of exercises in mock “Israeli settlements.” The videos showed terrorists breaking through replicas of the Israeli security fence and observation towers, rushing forward in vans, and then moving from building to building in replicas of an Israeli village and IDF base, while firing automatic weapons at cardboard targets of Israelis, just as they did during the 7 October attack.[15] Observation units of mainly female soldiers (most of whom were murdered on 7 October) reported for months before 7 October on these exercises. Some were monitored by private OSINT monitoring companies in Israel.[16] Some of these exercises were covered by tactical SIGINT which was reported to the regional Division and contained references to specific towns and the massacre of “all the Jews” in the town. These reports did not filter up to AMAN and were not integrated into the Intelligence Assessment. Another “indicator” of a possible attack in the classic IDF list of “war indicators” was that Hamas took out cameras in observation towers and three observation balloons stopped functioning. This was known to the division in charge of the border, but no alert resulted from it and repairs were postponed until after the holiday[17].
The explicit information on the Hamas plan “Flood of Al-Aqsa”[18] was intercepted in the beginning of 2022[19] and put in the “pool” under the code name “Wall of Jericho,”[20] but was not “pulled” by the right persons. Even the commander of the unit was not aware of it.[21] The code name was the same name that Hamas used in preparations for the attack of 7 October and for the attack itself. The sergeant major (a 25-year-old woman), who was an expert on Hamas and Islam and translated the plan, extracted “indicators” that should have generated alerts if it were about to be executed. In fact, she had attempted to “ring the bells” by demanding to hold a discussion of the plan but was constantly turned down.[22] Some would later claim that the lack of attention to her work was due to her junior rank and the fact that she was female. She continued to pester her superiors, who finally agreed on 28 September to hold a meeting on her findings “after the holidays.” The attack took place before the meeting could be convened.
The deployment of forces also contributed to the intelligence failure. Since the current Netanyahu government entered office (September 2022), more and more forces were shifted from the Gaza border to the West Bank for the protection of settlers who are the main constituency of the extreme right wing of Netanyahu’s coalition. By 7 October, more than 40 percent of the ground forces of the IDF were deployed in the West Bank, another 40 percent along Israel’s borders, and only about two reduced infantry brigades and one armored battalion were stationed on the border of Gaza. The weapons of the security squads of the towns on the Gaza border had been stored or transferred to the West Bank. Consequently, there were limited forces to meet the unexpected attack.
Unlike 1973, when AMAN produced a daily assessment of the situation and up to the day of the war itself assessed that a military offensive by Egypt and Syria was a “low probability,” the “probability” of a massive Hamas attack along the lines of the intercepted “Flood of Al-Aqsa” plan was not even a subject for discussion. The theater analysts focused on lesser threats such as incendiary balloons and kites, possible local border infiltration, and “marches” to the border instigated by Hamas.
The intelligence failure continued up to the morning of the attack. On the night of 6-7 October, the Shin Bet and AMAN received reports of unusual movements near the border around 2:00 AM and 4:00 AM. The Shin-Bet and AMAN held consultations but did not sound the alert. About two hours before the attack, a large number of previously unused Israeli SIM cards were activated and geo-located inside Gaza by Shin-Bet. This information precipitated a flurry of meetings; however, a scenario of a large-scale attack was not considered.[23] Additional indicators were identified by 8200, however, these were not reported to the top levels of 8200 or AMAN.[24] The Director of AMAN was on a private vacation in Eilat and attempts to reach him failed.
Afterthoughts
It is said that success has many fathers and failure is an orphan. The failure of 7 October had many “fathers.” First and foremost was a politicized “conception” that served as the acid test for the validity of all signals and not as a hypothesis to be tested by those signals. The political leader (Netanyahu in this case) did not have to actively dictate intelligence assessments or ignore those that contradicted his policy. The intelligence community tended to perform unconscious self-censorship in order to maintain its relevance and utility and/or avoid the ire of policymakers.[25] By couching its messages in ambiguous terminology, it allowed political leaders to avoid coming to grips with the potential consequences of their policies.
Other contributing factors were: the absence of a “Warning Model” based on war indicators; hubris and disdain of the enemy; the ignoring of “Capability” intelligence as an indication of intentions; over-reliance on deterrence—particularly deterrence by denial; substitution of the classic “push” model of intelligence with a problematic “pull” model; sidelining of OSINT and tactical VISINT as input to strategic analysis; over-reliance on automated systems; and downgrading of linguistic and cultural intelligence. Consequently, many indicators that were not in the “Streetlight” were seen, but not interpreted. [26] Nevertheless, the strategic warning that the IC had issued should have yielded directives by the political and operational levels to raise the level of alert, including on the Gaza border. This did not happen.
The Israeli Intelligence Agencies have been thrust into a protracted war since 7 October and have not had the time, resources, or focus to objectively investigate the worst intelligence failure that befell the country since 1973. Israeli political culture tends to personalize failures; indeed, the head of AMAN has resigned, the head of Shin-Bet and Chief of Staff will also do so. This will be followed by a cascade of lower-level resignations or dismissals. However, true lesson-learning will have to wait for political change—the end of the wars in Gaza and Lebanon and elections in Israel. Only then will the Israeli intelligence community be able to implement the paradigm shift it requires in order not to be surprised again.
[1] In Hebrew—the “mehdal” – מחדל
[2] In Hebrew—“contseptsia” – קונצפציה
[3] Ben Kaspit, “IDF official warned of fatal intel. failures right before Oct. 7 massacre,” Jerusalem Post, February 26, 2024, available at https://www.jpost.com/israel-hamas-war/article-788712.
[4] After 1973, the former head of Unit 8200, Brig. Gen. Yoel Ben Porat, tried to uncover the tracks of pieces of raw intelligence that could have belied the “conception.” Ben Porat discovered that most of the information that contradicted the “conception” was found to be not reliable and therefore was not filed and, therefore, not reflected in the analytic files. Personal communication from Brig. Gen Yoel Ben Porat to the author in 1980.
[5] In Hebrew—אפכא מסתברא—or “the opposite is true.”
[6] Amir Bohbot, “The Warning of AMAN to the Political Level: War is more likely than Calm,” Walla News, April 12, 2023, available at https://news.walla.co.il/item/3571684.
[7] In his letter of resignation, he stated that “AMAN under my command did not live up to the task we were entrusted with. I carry that black day with me ever since day after day, night after night. I will forever carry with me the terrible pain of the war.”
[8] This was a prerogative that a number of directors of AMAN took advantage of. See a lecture by Gen (res.) Amos Malka (2 April), available at https://www.facebook.com/CYBERWEEKTLV/videos/1067678290977247.
[9] One PM I knew told a senior analyst “When was the last time you had to run a country? I can tell you what (the target leader) is concerned about.”
[10] Prime Minister Yitzhak Rabin used to tell the intelligence officers who briefed him: “Don’t tell me my logic or your logic, tell me the enemy’s logic.” Personal knowledge.
[11] Though independent analysts did point out the possibility of war as result of miscalculation. Yigal Karmon, “Signs Of Possible War In September-October,” MEMRI, August 31, 2023, available at https://www.memri.org/reports/signs-possible-war-september-october.
[12] Ben Kaspit, Maariv, “Exposure: the shelved report of 8200 on the omissions that led to the massacre in the south,” February 24, 2024, available at https://www.maariv.co.il/journalists/Article-1078519.
[13] Known in the jargon of 8200 as MADLAT (מדל״ת)—or “Intelligence without Content.”
[14] Amir Bohbot, “The blindness that led to the failure was revealed: “Why did they close the open intelligence unit?” Walla, November 27, 2023, available at https://news.walla.co.il/item/3623306.
[15] Yaron Schneider, “The telltale signs in the days before the surprise attack: secret exercises and training,” N12, October 9, 2023, available at https://www.mako.co.il/news-military/6361323ddea5a810/Article-f08b74f28c21b81027.htm.
[16] Video, December 19, 2021, “Hamas’s Al-Qassam Brigades Military Drill Simulates Invasion Of IDF Gaza Division Base, Capture Of IDF Soldiers,” MEMRI, available at https://www.memri.org/tv/hamas-al-qassam-brigades-military-drill-invade-idf-gaza-division-base-capture-soldier; Avner Hofstein, Interview with Menahem Gida, “I saw Yom Kippur coming again – and the army didn’t listen,” Zman, October 17, 2023, available at https://www.zman.co.il/429903/.
[17] Revital Tuval, “Too Open Intelligence: this is how Hamas knew where to attack on October 7,” The Hottest Place in Hell, January 11, 2024, available at https://www.ha-makom.co.il/open-int.
[18] In Arabic – “Tufan al-Aqsa” – طوفان الأقصى
[19] Amos Harel, “More than a year before it began, the army had information about the Hamas attack plan on the kibbutzim and bases,” Haaretz, November 24, 2023, available at https://www.haaretz.co.il/news/politics/2023-11-24/ty-article-magazine/.highlight/0000018c-0021-d4d0-addf-47ff72980000; Ronen Bergman, “New revelations about the intelligence failure: this is how the imaginary scenario became a reality,” Ynet, December 1, 2023, available at https://www.ynet.co.il/news/article/yokra13696157.
[20] In Hebrew = “Homat Yericho”—חומר יריחו
[21] Kaspit, op. cit.
[22]Ben Kaspit, Facebook Post, November 27, 2023, available at https://www.facebook.com/caspitben/posts/893645865461538/?paipv=0&eav=AfY8MOVvq-fBbQNcFOdZujWdNj57gFithCw2331QvdfmTf8hH7pMYFpZfx8qVbxT8mU&_rdr.
[23] Nadav Ayal, “The SIM card Alert in Gaza: part of a Shin Bet operation designed to warn of an attack,” Ynet, February 27, 2024, available at ahttps://www.ynet.co.il/news/article/yokra13818356.
[24] Amir Bohbot, October 30, 2023, “Investigation of the Failure: The Shin Bet detected unusual activity on the night of the attack, 8200 stopped listening,” available at https://news.walla.co.il/item/3619408.
[25] The danger of this phenomenon was evident in 1973, when senior officers such as the commander of 8200 (Brig. Gen. Yoel Ben Porat) refrained from breaking the line of command to directly warn the political level. The head of AMAN in the first Lebanon War (1982), Gen. Yehoshua Sagi, told the inquiry on the war that he had identified the risks of allowing the Christian “Lebanese Forces” into the Palestinian refugee camps of Sabra and Shatila after the murder of their leader, Bashir Gemayel, but did not want to get into conflict with the political level so he “moved aside.”
[26 The tendency to look for information where it is easily accessible (e.g. looking for lost keys under the streetlight). This creates the fallacy that the absence of information on a phenomenon is proof of its non-existence. If this is added to the tendency to “not see” information that contradicts the conventional wisdom (or information that is not under the streetlight), much can be explained.
The National Institute for Public Policy’s Information Series is a periodic publication focusing on contemporary strategic issues affecting U.S. foreign and defense policy. It is a forum for promoting critical thinking on the evolving international security environment and how the dynamic geostrategic landscape affects U.S. national security. Contributors are recognized experts in the field of national security. National Institute for Public Policy would like to thank the Sarah Scaife Foundation for the generous support that made this Information Series possible.
The views in this Information Series are those of the author(s) and should not be construed as official U.S. Government policy, the official policy of the National Institute for Public Policy or any of its sponsors. For additional information about this publication or other publications by the National Institute Press, contact: Editor, National Institute Press, 9302 Lee Highway, Suite 750 |Fairfax, VA 22031 | (703) 293- 9181 |www.nipp.org. For access to previous issues of the National Institute Press Information Series, please visit http://www.nipp.org/national-institutepress/informationseries/.
© National Institute Press, 2024