From hacking civilian cameras to ‘honeypot’ tactics, the extent of Hamas intelligence gathering is beginning to surface.
By Itay Ilnai, JNS
In recent years, the Israel Defense Forces, Mossad and Israel Security Agency began to notice an increased awareness on the part of Hamas regarding everything related to the field of intelligence gathering.
It seemed that the terror organization, which has always sought to obtain as much information as possible about Israel, was shifting into higher gear in this area in a dramatic way.
The Israeli intelligence community has been closely monitoring elements in Hamas’s central intelligence body, the “Military Intelligence Department”—Modatz, as it is referred to in Israel—who went abroad for meetings, including in Turkey, where they linked up with contacts from Iran and Hezbollah.
These provided them with knowledge, equipment and training in the areas of surveillance, eavesdropping and cyber, in what was supposed to significantly upgrade Hamas’s relatively outdated intelligence-gathering capabilities.
It seemed that the terrorist organization’s small and not very sophisticated intelligence department was trying to imitate the large and advanced IDF Intelligence Directorate.
The entity in the IDF responsible for studying the enemy’s intelligence capabilities is the Information Security Unit, operating within the Military Intelligence Directorate.
The unit’s personnel, led by Lt. Col. G., felt they had a relatively good grip on Hamas’s intelligence buildup. In intelligence lingo, this is called “holding”—identifying the other side’s movements, cells and intentions, and closely monitoring them.
Over the past two years, Israel has also carried out several operational activities, some abroad, to disrupt Hamas’s intelligence efforts. Most of these operations are still classified, and will likely remain so.
However, these thwarting maneuvers at most only delayed Hamas’s intelligence personnel in Gaza; they certainly did not stop them completely.
Only after IDF forces invaded the Gaza Strip and got access to Hamas’s intelligence offices, its underground server farms and the computers connected to them would the true extent of Hamas’ intelligence gathering capabilities be revealed.
What was uncovered left Israeli intelligence personnel aghast.
In recent weeks, then, the intelligence community in Israel is beginning to understand that they “held” only the tip of the iceberg when it came to Hamas.
Only in retrospect has it become clear that for over two years, Hamas’s Modatz, with chilling efficiency and with an Iranian tailwind, had written the intelligence chapter of Hamas’s grand operational plan for the Oct. 7 offensive.
Only the tip of the iceberg
One of the most alarming examples of Israeli intelligence’s underestimation of Hamas relates to the organization’s ability to hack into internet-connected cameras inside Israel.
The Information Security Unit had known for some time that Hamas personnel in Gaza were searching the internet in Israel for IP addresses associated with cameras.
Hamas hackers would connect to these IP addresses, hoping that whoever installed the camera had not changed the manufacturer’s original password.
In other cases, the hackers managed to circumvent the cameras’ security mechanisms and take them over. Hamas personnel could then view uninterrupted footage from the cameras, mostly civilian and private ones, broadcasting directly from towns, roads and even homes within Israel.
The terror group focused primarily on the Gaza border towns. After Oct. 7 it was revealed, in the most horrific way, just how densely riddled the kibbutzim near the Gaza border were with cameras monitoring, among other things, the Seam Zone area, the perimeter fence, security facilities and sensitive areas within the kibbutzim.
It now turns out that prior to Oct. 7, Hamas had access to dozens of these cameras, some of which even served its personnel during the fighting in these communities in the days that followed.
In Israel, as mentioned, they knew that Hamas had the ability to hack into internet cameras, but only after entering Gaza were the immense proportions of this intelligence project exposed.
The military now admits that while the camera issue was identified in advance, it was not addressed properly.
Another area where Hamas’s capabilities were only revealed in hindsight is cyber warfare.
In recent years, the IDF has identified numerous attempts by Modatz elements to hack into soldiers’ cell phones via “honeytrap” operations.
The modus operandi is well known: An attractive “girl” makes contact with a soldier on social media, and as their relationship progresses, her requests intensify.
For example, she might ask the soldier to film himself, extract details about his military role, or request that he download a particular chat app that later turns out to be malware.
As stated, the Information Security Unit identified extensive Hamas efforts to hack Israelis’ phones and even exposed this to the public from time to time via media campaigns aimed at raising awareness among soldiers.
Recently, the corps even produced a polished three-minute video starring actor Tzachi Halevi, which was sent to all IDF reserve personnel.
The video, which presents a “honeytrap” operation in a Hollywood-esque manner, ends with the words: “Remember, the enemy is always watching.”
The IDF not only identified Hamas’s attempts to hack soldiers’ phones but also some of the means that enabled them.
One was an extensive cyber team that built malicious code implanted in fake apps, enabling phone intrusion.
The military worked to eliminate this team’s capabilities, and succeeded.
However, here too, it was only after entering Gaza and seizing Hamas’s servers in the tunnels that it became clear that this was merely the tip of the iceberg.
The military now understands that there were Hamas attempts that went undetected in real time and that despite the organization’s relatively limited cyber capabilities, the intelligence information Hamas extracted from the phones it did manage to breach served it well on Oct. 7.
Seizing Hamas’s servers does much more than that. It provides Israeli intelligence personnel with an intimate glimpse into the operating methods, training processes, force buildup and correspondence between senior officials not just in Modatz but in all of Hamas’s units.
This glimpse also illustrates how the IDF was caught off guard when it came to Hamas’s intelligence and how it misinterpreted the group’s intentions.
A senior employee at a civilian cyber security company that has been monitoring Hamas for years claims that a close examination of the videos the IDF released from Hamas’s server farms in Gaza shows that some of the equipment in these farms came from Israel, where a large second-hand server equipment market has been flourishing for years.
According to the source, “Hamas’s cyber capabilities are limited. It was relatively easy for them to take over soldiers’ cell phones and obtain tactical, rather than strategic, information, as well as to infiltrate internet cameras like those in the kibbutzim around the Gaza periphery. You don’t need to be a skilled hacker to achieve these feats. However, Hamas failed to carry out significant cyber breaches of critical civilian infrastructure in Israel. In this respect, they don’t have a game-changing weapon. It seems the Gazans’ cyber capabilities are limited, especially compared to Iran.”
“Not Russia or China”
And this, it seems, is precisely the point. While most of Modatz’s collection methods may be relatively primitive or rely on open-source information, this does not make them any less effective.
Thus, while Israeli intelligence focused on Iran and Hezbollah, Hamas managed to collect vast amounts of valuable intelligence almost unimpeded.
“The perception in Israel was that terror organizations are not Russia or China,” argues Netanel Flamer, a senior lecturer in the Department of Middle Eastern Studies at Bar-Ilan University, whose book on Hamas’s intelligence war against Israel is set to be published soon by Cambridge University Press.
“The view was that they didn’t have serious intelligence bodies and could at most ‘raise binoculars’ and observe from afar.
“This was a huge mistake, which I’ve been trying to explain in my research over the years. Hamas has high-quality intelligence entities, but the intelligence threat was not sufficiently internalized in Israel’s security apparatuses. Oct. 7 put these things on the table.”
Hamas’s intelligence success on that terrible day stands in stark contrast to the blindness that plagued Israel’s intelligence community.
“It’s not easy to say this, but they did a much better job than us,” said Lt. Col. (res.) Eyal Pinko, an expert on intelligence, cyber and national security.
The one responsible for this intelligence checkmate was, as mentioned, Hamas’s Military Intelligence Department (Modatz), a body that included 2,100 operatives (very small compared to Israel’s intelligence apparatus) on the eve of the war.
They were engaged in five main areas: observation, cyber, signals (SIGINT), open source (OSINT) and agent handling (HUMINT).
The department’s expertise lies in collecting a vast number of seemingly peripheral pieces of information, assembling them layer upon layer, and thus building a broad and in-depth intelligence picture.
Modatz even “dressed” this intelligence picture onto intelligence aids—maps, aerial photographs, manuals and operational orders—that reached Hamas forces on the ground. Such intelligence aids have been found in abundance since Oct. 7.
These days, the IDF Military Intelligence is working to reverse-engineer all these aids and understand the source of each piece of information Hamas collected.
The emerging understanding is that most of the aids are based on about 10 layers of information, most of which came from open sources.
The IDF also has come to terms with the fact that the ability to control the dissemination of this open information is nearly impossible.
“You take the aerial photograph of Re’im Base from Google Earth, send a Gaza worker employed in Israel to report on how many soldiers are there in the Seam Zone, and onto that you can add more information based on how social media posts shared by the IDF troops on TikTok,” explained Pinko.
“There is systematic, organized work here that also manages to fuse all the information into a single intelligence picture that is efficiently conveyed to the field. Hamas has an excellent intelligence gathering apparatus, unfortunately.”
“The intelligence of a terror organization works differently than a state’s intelligence,” added Flamer. “What may seem like trivial, unimportant information to you can be highly valuable to Hamas. Take, for example, the ‘See-Shoot’ system [remote-controlled weapon stations deployed on the Gaza border], a system that Israel has been showcasing since 2009, emphasizing its importance in our array. And then the first thing Hamas does on Oct. 7 is to drop explosive charges from drones on these systems and disable them.
“The problem is that information that is on the fringes of secrecy for us is valuable intelligence for the enemy. Hamas mostly does unintelligent, unsophisticated intelligence…but good enough for Hamas’s needs. That’s how a terror organization operates. They make ‘delicacies’ out of every tiny piece of information and draw micro-tactical lessons. When you put all these pieces together, you get Oct. 7.”
Collection of “positive” intelligence
One can go back all the way to the Hamas charter published in August 1988 to see a reference to the great importance the terrorist group attributes to understanding the Israeli enemy.
However, in its early days, Hamas invested less energy in collecting intelligence on Israel, focusing mainly on “negative intelligence”—preventing Israeli intelligence penetration.
“This was the core mission instilled by founder Sheikh Yassin,” says Michael Milshtein, a senior researcher at Tel Aviv and Reichman Universities and a former senior Military Intelligence official.
“Yassin argued that if there is anything that would bring down Hamas, it would be collaborators and information leaks.”
Faithful to their founder’s spirit, already in the 1980s, members of Hamas’s military wing established the “Al-Majd” apparatus, in which Yahya Sinwar, the current leader of Hamas in Gaza, was a prominent figure.
It was primarily intended to thwart Israeli espionage. Sinwar would eventually end up in an Israeli prison for his role in this organization, after being convicted of collaborator assassinations—a practice Al-Majd carried out extensively and brutally.
While Hamas’s negative intelligence remained centralized and controlled by the organization’s senior ranks, it initially left “positive intelligence”—gathering information on the enemy—solely to field operatives. “In Hamas’s early years, intelligence collection ahead of an attack was done on a cell-by-cell basis,” Flamer explained.
“Cell members would conduct observations themselves, collect open-source intelligence and then carry out the attack. There was no central body managing the intelligence,” he said.
However, Israel’s withdrawal from Gaza and Hamas’s takeover of the Strip in 2007 allowed Hamas to build up strength in various fields, including intelligence.
Thus, in addition to establishing territorial battalions and brigades, Hamas’s military wing also set up staff bodies, among them the Military Intelligence Department, which grew and developed over the years.
“Hamas’s military intelligence is a multi-dimensional body responsible for what several separate bodies do in Israel,” said Milstein. “In Hamas, everything is rolled into one—intelligence collection, agent recruitment, information security and deception and cognitive warfare.”
One of the founders of the Intelligence Department, and its head at least since 2010, is Mohammed Hamis Debabekh. Debabekh, who was involved in planning the attack on Israel’s “Etzion” military pre-military academy in 2002, is considered one of the central figures in Hamas’s military wing.
In 2010, he was arrested in Cairo on his way back from a meeting in Damascus, as Egyptian authorities suspected he was trying to smuggle sophisticated communications equipment into the Strip.
According to reports from that period, following Debabekh’s arrest, Israeli soldier Gilad Shalit, then held captive in Gaza, was moved to a new hiding place. Debabekh, it seems, was one of the few people in the world who knew exactly where the abducted soldier was hidden.
Debabekh was released shortly after his arrest, following heavy pressure exerted by Hamas on Egypt. He continued serving as head of Hamas’s Intelligence Department until 2022 when he was appointed to oversee international relations in the group’s political bureau.
Another senior figure in Hamas’s intelligence apparatus was Wael Issa, the brother of Marwan Issa, the deputy chief of the military wing, who headed the counter-espionage division.
Debabekh was assassinated in an airstrike during the current war, and Wael Issa was killed during “Operation Guardian of the Walls” in 2021. Israeli forces are still working to determine whether Marwan Issa was killed in a recent strike in Gaza.
Israel has not disclosed who replaced Debabekh as head of the Intelligence Department, but Israel Hayom has learned that the dominant figure in Hamas’s intelligence apparatus ahead of Oct. 7 was Ayman Nofal, who also enjoyed great prestige and appreciation within Hamas.
Nofal, considered close to Hamas military wing commander Mohammed Deif and who also served as commander of Hamas’s central Gaza brigade, was arrested in Egypt in 2008 after being accused of planning attacks inside Egyptian territory.
He became the most senior and famous Palestinian held in Egyptian prison. He escaped custody during the turmoil of the “Arab Spring” and made his way back to his home in the Strip, where he was greeted by thousands of cheering Gazans.
Nofal advanced to more senior positions in the military wing. In a rare interview he gave to Al Jazeera in May 2023, he spoke about his role in formulating Hamas’s “unity of fronts and theaters” strategy and the central part he took in the joint “operations room” of all terror groups in the Strip.
Nofal, it seems, was also a key figure in planning the Oct. 7 offensive: According to a report in the newspaper Al-Sharq Al-Awsat, he was one of only five people in Hamas’s leadership who made the decision to launch the attack (alongside Deif, Sinwar, his brother Mohammed Sinwar and Hamas political bureau member Rawhi Mushtaha).
Nofal, too, was assassinated a few days after the start of the current war, in an airstrike on the Al-Bureij refugee camp in central Gaza.
In an IDF Spokesperson’s statement describing his elimination, he was identified as the “commander of the Central Brigade in Hamas’s military wing,” with no mention of his intelligence role.
Shadi Barud, the deputy head of Hamas’s Intelligence Department, was eliminated a few days later.
In recent years, the Israeli Air Force has repeatedly struck buildings identified as “Hamas’s central Military Intelligence headquarters.”
This happened in November 2018 (just days after the botched operation of an IDF elite unit in Khan Yunis in which Lt. Col. Mahmoud Khair al-Din was killed), during “Operation Guardian of the Walls” in 2021 and again this November 2023, when Hamas’s “Military Intelligence Office” was bombed by a Paratroopers Brigade force.
As these and other examples prove, when given the approval and opportunity, Israel’s security establishment was perfectly capable of targeting Hamas’s intelligence personnel and infrastructure.
However, tragically, these moves were carried out with significant delay. The best example of this seems to be the extensive observation array Hamas set up along the Gaza border.
“Around the contact line”
Also eliminated by Israel during the current war was Abd al-Aziz Rantisi, who was in charge of Modatz’s observation array. He was killed in an airstrike on the command center where Hamas collected field observation data from Israel.
The observation array is undoubtedly one of the most developed capabilities within Hamas’s Military Intelligence Department.
“Most of Hamas’s visual collection is done around the contact line,” said Guy Aviad, a researcher of the organization and author of the book “Lexicon of Hamas Movement.”
“After the 2014 ‘Protective Edge’ operation, they [Hamas] paved a road parallel to the border axis. They set up quite a few positions and observation towers along it that can observe beyond the fence. The best example of this is in the Jewish community of Netiv Ha’Asara. Towers were built there right next to the border wall,” he said.
Hamas also deployed observation posts on tall buildings in the Strip with direct lines of sight into Israeli territory.
Sources in Netiv Ha’Asara say that they alerted the IDF that the observation towers adjacent to the moshav were intended for intelligence gathering, but nothing was done.
The position was eventually destroyed by the IDF only after many long weeks, and was immediately rebuilt. It is reasonable to assume that observations conducted from it assisted Hamas in infiltrating Netiv Ha’Asara on Oct. 7, including by means of paragliding.
“When you are on 24/7 alert, with a good enough observation array, with advanced binoculars, observation towers and camouflaged positions, and you’re constantly watching the fence—you know very well when a battalion is being replaced and what the routine of the security force is,” said Aviad.
“In the drills Hamas conducted ahead of the attack, you can see the terrain analysis they did on the Israeli side, including the yellow gates in the kibbutzim, and so on.”
Hamas’s observation array also managed to capture quite a few senior Israeli officials on camera. One of them was then-IDF Chief of Staff Benny Gantz, who was filmed touring the border fence in 2014.
The IDF was well aware of Hamas’s observation capabilities. In fact, the army was so familiar with this array that it was very wary of it.
For instance, when information about Hamas terrorists in the Gaza Strip activating Israeli SIM cards reached Chief of Staff Herzi Halevi on the night of Oct. 7, he ordered them to act in a way that would not to tip off the terrorist group, so as not to burn intelligence sources.
“The perception in the military is that the level of infiltration of the IDF is so high that Hamas can identify any unusual movement in the area,” a military source explained then. “Even a tank standing in the wrong place arouses suspicion.”
The IDF, as mentioned, had information on the locations of many of Hamas’s cameras observing the border, cameras that could identify any movement of IDF forces along the contact line.
The IDF even had contingency plans to destroy these cameras, which sat in a drawer awaiting the right time.
According to a military source, these orders would have been executed the moment a decision was made in Israel to have the IDF enter Gaza or undertake any other significant proactive move. Of course, no such decision was made, and the cameras were only destroyed after Oct. 7.
Hamas’s observation array was not limited to binoculars or cameras, however.
In recent years, the organization has developed its own drone industry, producing UAV’s capable of hovering over the Strip and providing oblique footage of Israeli territory.
It soon started developing these aerial photographs and printing them, just as the IDF did.
The body that assisted in developing these UAVs is the “Engineering Bureau,” a project headed by Saleh al-Arouri, deputy head of Hamas’s political bureau, who was also assassinated during the war, in Beirut, Lebanon.
From his base in Lebanon, and previously in Istanbul and Qatar, al-Arouri ran the apparatus responsible for developing Hamas’s technological capabilities, with assistance from the Iranian regime.
“The Engineering Bureau received aid from Iran over the years,” said a former senior security official, “procuring equipment, information, training grounds, ammunition and more.”
One of the Authority’s goals was to recruit Muslim scientists from around the world to work on improving Hamas’s technologies.
One of these scientists, said was Mohammed az-Zawari, who operated from Tunisia, where he spearheaded Hamas’s effort to produce a “UAV corps primarily intended for intelligence gathering. Az-Zawari, by the way, also developed unmanned sea drones meant to attack Israel’s gas infrastructure,” said the security official.
He was assassinated in 2016, according to foreign reports by the Mossad.
Another capability Hamas had ahead of Oct. 7 relates to signals intelligence, or “SIGINT.” The IDF and ISA were well aware that Modatz regularly listened in on open IDF communications networks, especially in the training and instruction areas of the Western Negev, just a few kilometers from the Strip.
It is reasonable to assume that one of the places Hamas listened closely to was Tze’elim Base, given its status as the largest training center for IDF ground forces and where, among other things, the ground maneuver currently underway in Gaza was rehearsed.
Once again, the technology at Hamas’s disposal was not overly sophisticated—essentially frequency scanners effective for a few dozen kilometers that could pick up IDF communications channels.
In training and exercises, the IDF mostly uses unencrypted communications. In the Gaza Division, on the other hand, the forces used encrypted communications and landline phones, which presumably prevented Hamas from listening in.
Hamas also attempted to acquire additional SIGINT capabilities to monitor the aerial picture over Gaza and identify the locations of IAF planes in the vicinity.
“Deep technological understanding”
In 2021, after “Operatoin Guardian of the Walls,” Hamas published a video that was described as a tribute to Juma’a al-Tahla, who headed Hamas’s cyber apparatus and was assassinated in an operation that eliminated all of Hamas’s senior technological operatives.
The video shows a Hamas cell, equipped with computers, positioning themselves in the Gaza Strip area facing Kibbutz Mefalsim.
They appeared to remotely infiltrate the kibbutz’s power grid and shut it down.
The video shows the lights seemingly going out in Mefalsim as a result. According to Moshe Kaplan, the security chief of Mefalsim, the electricity in the kibbutz never went out, and the video was merely psychological warfare.
Hamas may not have actually succeeded in hacking Mefalsim’s power grid, but the video does display a slide showing the names of the kibbutz’s main power distribution hubs.
Two sources familiar with the kibbutz’s power grid say that the information on the slide is accurate and could not have come to Hamas from open sources.
In other words—while Hamas failed to disrupt the kibbutz’s power supply, it did manage to obtain sensitive information on it.
According to a source at the Israel Electric Company, the slide could have been obtained through a cyber breach or an “inside job,” meaning individuals within the company or one of its subcontractors leaked materials to Hamas.
Indeed, Hamas also has agent-handling capabilities. In recent years, several cases have been reported in which the ISA arrested Israeli citizens handled by Hamas, some exploiting the opportunity to enter and exit the Gaza Strip, where they have family members.
These individuals were sometimes equipped with SIM cards and photography equipment and were asked to pass intelligence information about IDF facilities from within Israel to Hamas.
The prevailing assumption is that some of the thousands of Gazan workers who entered Israel daily before Oct. 7 were also engaged in gathering intelligence from the Israeli communities where they were employed.
Hamas’s intelligence gathering also serves it now, in its battle against IDF forces maneuvering in Gaza: One area in which Hamas excels is gathering technological intelligence, studying Israeli combat means and trying to identify weaknesses.
For example, instruction manuals have been found in Gaza explaining how to fire an RPG missile at vehicles protected by Israel’s “Trophy” active defense system, and in 2017, an instruction manual detailing the technical capabilities of the Namer, the main armored vehicle used by IDF forces, was printed in Gaza.
“There is a very deep technological understanding here of how our defense systems work, and how the other side makes them ineffective,” said Pinko.
“We see long-term collection efforts involving IDF ammunition that was forgotten, stolen and more. Some of these things go to Iran, where they do reverse engineering.”
“A culture of secrecy”
Another area in which Hamas’s military intelligence shows impressive capabilities is “OSINT,” intelligence from open sources.
Flamer, for example, presents a booklet seized in Gaza as early as 2007, with the emblem of Hamas’ “Military Intelligence Department” embossed on the cover.
The booklet, revealed here for the first time, contains a weekly intelligence report that translates and summarizes hundreds of articles published that week in the Israeli media.
The report refers to military information, such as the pace of equipping IDF brigades with defense systems and delays in building the fence on the Egyptian border, as well as extensive information on the political system in Israel, high-school military recruitment data, information on the public mood surrounding the struggle to return Gilad Shalit (who was then in captivity) and even a sexual harassment case involving a well-known rabbi.
“Hamas invests a lot of resources in reading articles,” said Flamer. “From morning to night, they sit on every bit that moves in the open media, from mainstream channels to esoteric websites. They spend all day translating what we publish, making situation assessments and issuing organized reports.”
But the truth is, you don’t have to go too far to get open information about the IDF. It’s enough to go to TikTok.
A prime example of this was obtained when IDF forces raided the Shifa Hospital in the center of Gaza City, where they found on one of the computers a video of the soldier Ori Megidish, who was abducted to Gaza from the Nahal Oz outpost and has since been rescued.
The video, it appears, reached Hamas through social media, and it wasn’t the only one.
Uploading videos to TikTok from within army bases, and even from the command posts of the bases in the Gaza Strip area, seems to have become a trend that the IDF has stopped trying to fight.
In fact, until Oct. 7, the Nahal Oz command post had an official TikTok account, and it wasn’t the only command post in the area to have one.
In the IDF, there are those who admit that the army’s ability to keep its secrets has become much more complex in recent years.
“The issue of secrecy and the culture of secrecy in the IDF has seen better days,” said a source familiar with the matter. The issue of the culture of secrecy and its preservation was also included in the series of investigations that the IDF began a few weeks ago, on the orders of Chief of Staff Halevi.
The systematic study of Israeli society and politics, as well as Hamas’s deep insight into the military, undoubtedly made it easier for Hamas to carry out the brilliant deception maneuver that “lulled” the IDF and the political echelon in the lead-up to Oct. 7—a maneuver in which Hamas’s military intelligence personnel were undoubtedly involved.
“For the weaker player in an asymmetric conflict, deception is a very important tool,” explained Flamer. “Hamas, as the militarily weaker force in the conflict with Israel, understood this from relatively early stages of its operations.”
According to Flamer, despite its weakness compared to Israel’s intelligence superiority, on Oct. 7, Hamas managed to bridge the gap through a calculated and meticulously planned operation.
“The attack clearly demonstrates the importance of awareness among intelligence agencies and decision-makers of the fact that on the other side, there are thinking people acting with cunning, and that the possibility that they are misleading us is a reasonable possibility that must be taken into account in intelligence assessments and decisions made as a result,” he said. “All the more so when history shows that the other player uses it well for its purposes.”