In the late hours of Oct. 6, signals intelligence (SIGINT) systems at the Israel Security Agency started to go live. Dozens of SIM cards operating on Israeli networks had switched on inside the Gaza Strip at practically the same time.
It wasn’t the first time something like this had happened. The ISA had seen this before on more than one occasion, including during Passover 2022. These events were interpreted by the agency and the Israel Defense Forces as a Hamas drill; on none of these previous occasions had an attempt been made to infiltrate Israel after the SIM cards were switched on. “Hamas drilled, the IDF drilled,” was how one senior officer put it.
Hamas’ Israeli SIM cards didn’t get to Gaza by chance. The terror group’s use of the cards was part of the invasion plan it put together over the past two years.
Hamas worked under the assumption that during a raid deep into Israeli territory, local SIM cards would be the best means of communication between its forces. Using local SIMs not only enabled the Hamas terrorists to make calls and send WhatsApp messages, it also let them hook up to the Internet and broadcast live from their phones to the entire Muslim world the atrocities they carried out against Israeli civilians and soldiers.
The ISA monitored these SIM cards, viewing them as a high-value source of intelligence. So long as they were kept wrapped up, the SIMs couldn’t be traced, but once they were switched on they instantly appeared on the agency’s radar. As Israel’s equivalent to the FBI, it is the ISA that monitors Israeli cellular networks; Military Intelligence is prevented from doing so as the IDF does not collect intelligence on Israeli citizens.
But the ISA did not necessarily link the SIMs to Hamas’ real plan, the “Great Campaign,” as Yahya Sinwar, the terror group’s leader in Gaza and the architect of “Bloody Saturday” called it. The working assumption that took root in Israel was that the SIMs were intended for a much more limited scenario: A few small squads, maybe 10-20 terrorists, who would try to infiltrate Israel at two or three points along the fence. Then came the morning of Oct. 7.
Conversations with current and former officials in the ISA, the IDF General Staff, Military Intelligence and IDF Southern Command—the four agencies involved in trying to understand the intelligence picture of Oct. 7—uncover the main points of that night, for which the word “fateful” is an understatement. These conversations reveal fundamental differences and conflicting narratives in the versions presented by the various sides. The contradictory descriptions underscore that the IDF has not yet investigated the events of Oct. 7, and thus the events of that night have become a “Rashomon,” parts of which have found their way to the media. The IDF and ISA are both aware of the problematic nature of the matter.
There is one thing however that all sides see the same: During the night of Oct. 6, the IDF and the ISA were blinded. The most stringent intelligence assessments during those critical hours did not come close to assessing a fraction of what Hamas planned and executed.
“If we had only known five percent of their true intentions,” said one senior military official, “we would have scrambled everyone.”
Below, we describe the anatomy of a catastrophe.
The primary assumption
Without a doubt, it was the activation of Israeli SIM cards in Gaza that led ISA chief Ronen Bar to rush to the organization’s headquarters in Tel Aviv, where he would spend the entire night.
“The fact that the head of the ISA leaves everything and comes down at night shows that there was an urgent piece of intelligence,” said former ISA chief Jacob Peri. “That isn’t something that the head of the service usually does, so there must have been some urgency.”
Bar consulted during the night with the head of the ISA’s southern division and also updated Southern Command, which in turn notified the Gaza division. “There was some commotion,” said a source familiar with the matter. “Both in the ISA and the [military] command.”
The alerts coming from the ISA were taken seriously. The head of Southern Command, Maj. Gen. Yaron Finkelman, who was on a family vacation in Yesod HaMa’ala, headed straight from the village in the Hula Valley in northern Israel down to Southern Command HQ in Beersheva. Most of the command’s staff officers would also turn up throughout the night. In the early stages of the night, several conversations were held between various elements in Military Intelligence, the ISA and Southern Command to try to decipher the intelligence picture. IDF Chief of Staff Herzi Halevi also received an initial update. Nonetheless, at the field level, forces were not briefed and the sector was not put on high alert. At this point, everyone was still watching and waiting.
As the hours passed, intelligence officials in the ISA and the IDF tried to gain a better understanding of what Hamas was up to. However, apart from the SIM cards that had been activated, there were no other significant signs that an offensive was about to be launched. Spotters from the Gaza Division were not detecting any suspicious movements beyond the fence. The initial premise thus was that this was just a drill—as had been the case on previous occasions.
Nevertheless, the ISA was quite excited by the intelligence. Perhaps because it after all had been behind the planting of the SIM cards, and for what still seemed at that time to be a slim possibility of striking intelligence “gold.” But when the warning was delivered through the usual channels by the ISA to Military Intelligence, the latter did not seem unusually concerned. Sources in Southern Command said that Military Intelligence’s response to the warning was pretty nonchalant and that the Intelligence Directorate did little with the warning.
“Military intelligence was not present at the event,” said an army source. “The ISA director rushes down, the head of the Southern Command travels all the way from the north—and Military Intelligence doesn’t wake up. They say it’s an exercise and we can go back to normal.”
According to the source, if Military Intelligence had conducted a proper assessment of the situation that night, things might have looked different.
“Assessing a situation is not just a meeting and a conversation between different parties,” he explains. “It’s a process where, in preparation for assessing the situation, people talk, gather information, pick up phones and try to connect the dots. But throughout the night Military Intelligence did not conduct an assessment of the situation.”
Even at the central listening post of Military Intelligence’s prestigious SIGINT division, Unit 8200, located not far from the Gaza Strip, no one seemed to be taking any dramatic measures during those critical hours. Overnight Friday, on the eve of a holiday, the night shift was lightly staffed, but no additional manpower was brought in. A former Unit 8200 official recently briefed on the night’s events claims that “people in the unit picked up phones and exchanged information among themselves during those hours, but to the best of my understanding they did not raise alert levels.”
An IDF source however said that Military Intelligence, including the Research Division and Unit 8200, did conduct mid-level assessments of the situation. A source in Military Intelligence confirmed this and rejected claims that the reaction was “nonchalant.” He said that Unit 8200 had “tried to figure out what was going on” and had spotted some suspicious signs. What did not happen that night however was an integral assessment led by the head of Military Intelligence, Maj. Gen. Aharon Haliva, who was on vacation in Eilat that night.
Even if Unit 8200 did raise alert levels and detect some suspicious signs, they—and the entire Intelligence Directorate—were unable to provide intelligence indicating actual and imminent offensive intentions on the part of Hamas. The ISA also tried to detect such intelligence but was unable to do so. During the early stages of the night, Military Intelligence, Southern Command and the ISA still believed this was an exercise. Some officers argued that there was a possibility Hamas was planning to carry out a limited infiltration into Israeli territory “along one or two routes.” According to one military source, the ISA even put this down in writing.
The working assumption however was that if any infiltration was planned, it would not be that night, but at the earliest in the morning or sometime the next day. A senior military official said: “The understanding was that it was a drill, with a stricter interpretation saying an infiltration.” One of the ISA’s working assumptions that night was that it was a drill, but its “leading assumption” was that a “limited incursion” was planned.
According to an IDF source, “there was something in the air” throughout the night. “At first everyone was talking about a drill, then about an infiltration but not immediately, and even if that were the case the scenario they were talking about was a limited infiltration. Even in our wildest imagination, no one imagined 3,000 terrorists, breaking through at 30 different points that night.”
Throughout the night, Southern Command waited for an update from Military Intelligence, and more specifically from Unit 8200. What would 8200 have discovered if it had raised alert levels that night? While the army decided to wait until after the war before investigating the failures of Oct. 7, the chief of staff did allow certain checks to take place in some units. The purpose of these tests is to detect malfunctions, especially in technological systems, so that they do not recur and harm the war effort, especially when it comes to the northern arena.
Unit 8200 was one of the units allowed to conduct an investigation, which the army has defined as a process of “learning and auditing.” Unit 8200 commander Brig. Gen. Y. appointed the unit’s former commander, Brig. Gen. (res.) Danny Harari, as head of the investigation team. Not all senior officers at Unit 8200 were notified of the establishment of an investigative team, and only found out about it after it had already been set up, causing some resentment in the unit. Military sources say that the investigation did reveal several indications which, had they been deciphered in real time, could have changed the intelligence picture. The results of the investigation have yet to be presented to the head of Military Intelligence or the chief of staff.
An attack or an attempted kidnapping
It seems that of all the three agencies involved in the event, Military Intelligence was the quietest. It was only at 3:21 a.m. that the deputy head of MI called up Haliva and informed him of the alert. Sources close to Haliva said that he received updates on suspicious signs in the south, but also “signs that pointed in the other direction” and that he asked to receive further updates in the morning.
The ISA, it appears, acted decisively. There, more and more voices began to talk at one point about the possibility that Hamas was not carrying out a drill but preparing for an infiltration to execute an attack or attempt to take hostages. Shortly after 3 a.m. on Oct. 7, the upper echelons of the agency decided to call in from home a large number of officers from its southern division, and at the same time to send into the field a “Tequila” team, a codename for the ISA’s operations unit, that has become famous in recent months.
According to three different sources, the Tequila team called up in the early hours of Oct. 7 was tasked with gathering further intelligence. The goal, according to these sources, was not to intercept specific terrorist cells, but to gain a deeper intelligence picture.
The ISA however says that the team was composed of operatives from the agency’s operations unit and the police counterterrorism unit, Yamam, and that it had the ability to intercept terrorists. The agency presents the decision to call up the “Tequila” team as proof it was preparing for the very real possibility of a cross-border infiltration.
The team was called up at around 4:00 a.m. and arrived in the Gaza envelope just before the attack commenced. It took part in the fighting and several members of the team were killed.
According to Maj. Gen. (res.) Uri Sagi, a former head of Military Intelligence, discrepancies between the ISA and Military Intelligence in the way events were seen and handled that night are a symptom of the intelligence chaos surrounding the Gaza Strip.
“In recent years, Military Intelligence has slowly moved out of Gaza and the ISA has taken over there,” he said. “When you have a situation where it is not clear who is in charge, who’s supposed to make the system work, things fall between the cracks. The fact is that Haliva didn’t think it was important enough to return from Eilat to the ‘pit’ [the IDF’s underground command and control center] in the Kirya [IDF headquarters in Tel Aviv], while the head of the ISA headed for HQ. But the head of the ISA can’t tell Haliva what to do, so everyone reacts differently.”
According to Sagi, transferring responsibility for the Gaza Strip to the ISA has also changed the language spoken by intelligence personnel responsible for the sector.
“The ISA is an organization focused on terrorism,” Sagi explained. “It speaks about ‘infiltrations,’ about ‘terrorist attacks,’ not about war, which is the language Military Intelligence speaks.”
“You don’t wake up the chief of staff for nothing”
As already noted, at around 3:30 a.m. when the ISA began to seriously indicate that there might be a genuine intention to infiltrate the border, Feldman woke Halevi with a phone call.
“If the chief of staff gets up at night, it’s because we’re on the brink of an abyss,” said Brig. Gen. (res.) Amir Avivi, who served as head of bureau for former IDF Chief of Staff Moshe Ya’alon. “You don’t wake the chief of staff for nothing.”
Before Feldman could begin his update, Halevi, who straight away understood that he was about to receive intelligence that required his attention, asked Feldman to stop and arrange a conference call in a few minutes. Halevi did not name who he wanted in the conversation. This kind of urgent consultation, with the participation of the army’s top general, is known in the IDF as a “chief of staff situational assessment.”
“When an intelligence report that requires the input of the chief of staff is received, his bureau invites the participants to take part in the assessment,” explained a former senior officer who participated in dozens of such conference calls. “Each participant receives a number to call, along with a code. A few minutes before the designated time, they call in on an encrypted phone, punch in the code, and give their name,” the officer said.
“When the chief of staff gets on the call, the head of the bureau presents the participants, and the assessment commences. Each participant talks in turn and at the end, the chief of staff gives his summary. These kinds of calls can last an hour or just 15 minutes, depending on the situation.”
The conversation takes place using encrypted military cell phones. According to people who have experience using these phones, they do not always work well and can take time to activate and unlock.
The army has a protocol for who takes part in a situational assessment with the chief of staff. As already noted, in line with this protocol, Halevi did not name the officers he wanted to participate in the conversation and left it to his head of bureau to make the call. For an unknown reason, he did not invite Haliva; senior IDF officials say this will be investigated in the future.
In the end, besides Chief of Staff Halevi, the other participants in the situational assessment were OC Southern Command Maj. Gen. Finkelman and the head of the Operations Directorate, Maj. Gen. Oded Basiuk. Halevi, according to a source familiar with the details, asked during the conversation why there was no Military Intelligence official on the line, but did not insist on an MI representative being present. In Halevi’s understanding, the speakers on the call were expressing the position of Military Intelligence following consultations with it.
Finkelman did most of the talking during the call. He told Halevi and Basiuk the details and emphasized the dilemmas—namely that the intelligence establishment believed Hamas was conducting a drill, but the stricter interpretation was that there was a real intention to carry out a pinpoint infiltration, although not in an immediate time frame.
The conference call took place sometime between 3:30 and 4:00 in the morning and is not believed to have lasted more than 15 minutes. It is reasonable to assume that the call was registered in the ledger of the chief of staff’s office. When a commission of inquiry into the war is established, this will be one of the main items it seeks to investigate.
So far, there has been no debriefing of the call. According to a military source, the chief of staff and the other officers on the call expressed “concern” and instructions and emphases were given for actions at sea, in the air and on land, and further instruction was given to make sure there “both military and intelligence preparedness” was in place for the possibility of an infiltration. According to this source, Maj. Gen. Finkelman, who, as mentioned, updated the chief of staff with the primary facts, “did not call for ‘helicopters in the air.’ There was no devil’s advocate on the call.”
There is a broad consensus that during the situational assessment, the three participants on the call could not have imagined that Hamas was about to launch an invasion with thousands of terrorists. According to a source familiar with the details of the conversation, none of the participants—the chief of staff, the head of the operations directorate and the head of Southern Command—were familiar with the “Walls of Jericho” presentation prepared by the Gaza Division, nor were they familiar with the warnings of V., an NCO from Unit 8200. Both these documents warned of the possibility of a full-scale invasion.
“I can understand how in this situation, an incident without context and with only vague indications did not arouse major suspicions,” said a former senior officer with Military Intelligence. “Let me give you an example: No one assumes that two weeks from now a Russian submarine flotilla will position itself off Tel Aviv and launch a nuclear barrage. So even if I were to show you now two Russian submarines off the coast of Tel Aviv, you would not evacuate the city. On the other hand, if you were familiar with such a plan, then every submarine spotted would trigger a major alert. The problem began long before this tragic night; namely, senior military officials were unfamiliar with Hamas’s plans and could not even imagine them.”
The heads of the bureau made the call
One person who may well have been familiar with the intelligence materials indicating Hamas’s intentions to launch an invasion and carry out a massacre is Haliva, the head of Military Intelligence. According to media reports, he was familiar with both the “Walls of Jericho” file and the emails sent by V. from Unit 8200. Other sources, who have spoken with Haliva, claim that he was not familiar with V.’s emails. Either way, Haliva was not on the call.
Despite the obvious urgency that night in the chief of staff’s bureau, for some reason, two officials were not invited to the situational assessment—Haliva and Israel Air Force Commander Maj. Gen. Tomer Bar. There were no officers from Military Intelligence or the Air Force on the call. According to a senior military official, the decision not to insist on the presence of the MI and IAF chiefs was taken by the relevant bureau chiefs.
According to Brig. Gen. (res.) Avivi, the former bureau head for Ya’alon, the decision was unusual.
“If the axis of the conversation is the intelligence axis, two people that must be on the call are the head of Military Intelligence and the head of the Research Division,” he said. A former senior officer at Unit 8200 said: “If no one from Military Intelligence was part of the process throughout the night and if no one from the bureau of the chief staff spoke to them, that is scandalous.”
Haliva’s confidantes say that even if he had been on the call, it wouldn’t have made any difference.
“If he had been on the call, he would have said there that in his assessment it was a Hamas drill,” one of them said. As for the IAF commander, according to IDF protocol he is not obligated to participate in situational assessments relating to intelligence matters, but only in those relating to attacks.
Prime Minister Benjamin Netanyahu was also not updated on the call. His military secretary, Maj. Gen. Avi Gil, was updated only at around 6:15 a.m. He didn’t have time to wake Netanyahu up and called him only at 6:29 a.m., when the attack had already commenced.
“The Revolutionary Youth”
Netanyahu did not know about the situation assessment call, but his previous decisions certainly influenced the final decision reached following it.
To understand Halevi’s considerations that night, one has to go back to the violent protests that developed on the border fence with Gaza in the months before the war, and which peaked during the Jewish High Holidays. These protests were initiated by an organization previously unknown to Israel, the “Revolutionary Youth.”
“We couldn’t figure out what this organization wanted,” said a defense official. “At first they spoke about security prisoners, then about work permits. It was out of context.” It is only in retrospect that the connection of the “Revolutionary Youth” to the Hamas leadership was revealed, and it became clear that the fence protests were part of a ruse designed to put the IDF to sleep ahead of the Oct. 7 attack and prepare moves to bring down parts of the border barrier.
Senior security officials were troubled by the Gaza protests during the High Holidays, as was the political leadership. However, both preferred to direct resources to the struggle against the Iranian nuclear program, to the “campaign between wars” in Syria and Lebanon and to the growing terror infrastructure on the West Bank. They both agreed on how to end the border protests and restore quiet to Gaza: increase the number of permits issued allowing Gazans to work in Israel, expand off-shore fishing zones, and a lot of Qatari money.
It seemed to be working. During Rosh Hashanah, the army decided to significantly reinforce IDF forces around Gaza, fearing that the protests would spill over into Israeli territory. Indeed, the border protests did turn violent. But after Rosh Hashanah, Israel began to signal that it would take steps to appease the protesters. The protests came to an abrupt halt after Yom Kippur. A few days before Oct. 7, on Sept. 29, the Revolutionary Youth suddenly announced that it had achieved its goals. “Since then, they haven’t come to the fence anymore,” a defense establishment source said at the time.
The cessation of the protests led to a dramatic decline in security tensions in the Gaza sector. The reinforcements that had arrived in Gaza on Rosh Hashanah were released, with some directed to Judea and Samaria. After the outbreak of the war, there was talk that the IDF had diluted forces in the Gaza sector ahead of Sukkot, but according to an IDF source, this was simply a return to the routine order of battle.
In any event, at the weekly assessment held every Thursday morning at the chief of staff’s bureau, with the participation of senior IDF officers, no concrete warnings were raised that Hamas intended to make a play in Gaza. At the weekly assessment held on Oct. 5, the concerns raised were of an escalation in Judea and Samaria.
The IDF breathed a collective sigh of relief. The sudden reduction in tensions in Gaza may explain the fact that several senior IDF officials—Finkelman, Haliva and IDF Spokesperson Brig. Gen. Daniel Hagari among them—felt comfortable going on vacation during Simchat Torah. The deputy commander of the Gaza Division’s northern brigade, who lives in Kibbutz Nir Yitzhak near the Gaza border, went home without his rifle.
Defense establishment sources say that the quiet in Gaza at the time was not only a matter of a reduction in operational tensions but also of political directives. Netanyahu demanded that the defense establishment keep Gaza quiet, at almost any price. This directive no doubt would have crossed Halevi’s mind in the early hours of Oct. 7.
Three UAVs and a chopper
After the situational assessment, Halevi instructed that intelligence gathering be stepped up and that he be updated later. He also told Finkelman and Basiuk to question the assumption that Hamas was just conducting a drill and to “think smart” to try and understand where an infiltration might take place and how it would be executed.
That said, the spirit of the order given by Halevi, who, based on the intelligence he had received, did not get the impression that an infiltration was imminent, was to act quietly so as not to tip off Hamas. The rationale behind this decision was the desire not to reveal intelligence sources.
This is the crux of the story, according to a source knowledgeable of the conversation.
“When you have intelligence, you say to yourself, ‘What do I do, and what do I do to make sure the other side doesn’t understand that I know. That was what was at the heart of the conversation,” said the source.
In other words, Halevi was anxious about the SIM cards; the chief of staff feared that Hamas would recognize that the IDF had raised its alert level and deduce that someone in Israel knew about its plan. “Given the intelligence he had, he took all the necessary margins of security,” said an IDF source. Indeed, given the intelligence picture presented to the chief of staff, his instructions sound logical.
It is only in hindsight that we can see that it was too little, too late. At that point there may have been a last chance to prevent, or at least reduce, the force of the blow that Hamas would inflict on the Gaza border communities only two and a half hours later.
During these critical hours,, the IDF moved cautiously. After the situational assessment with the chief of staff, another meeting was held at 4:30 a.m. chaired by the head of the Operations Directorate Basiuk. The directorate, responsible for mobilizing and reinforcing IDF forces, went ahead with measures corresponding to the orders given by the chief of staff. Basiuk reinforced aerial reconnaissance with a combat helicopter and three UAVs with reconnaissance, but not offensive, capabilities. The UAVs would later look down from above at Israeli civilians being abducted into Gaza, unable to respond.
The directives also trickled down to the Gaza Division. According to one report, the division commander, Brig. Gen. Avi Rosenfeld, updated the commander of the nearby Ashdod naval base, Col. Eitan Paz, with the unusual intelligence information. Paz raised the alert level and ordered a force from the Snapir Unit to be sent out to sea on a small Hornet-class vessel. Paz, like the rest of the army, was not thinking of a scenario in which 10 ships carrying Hamas naval commandos armed to the teeth simultaneously head out of Gaza toward Zikim Beach Israel, as indeed happened.
Raising the alert level in the air and at sea was in line with the decision not to rouse the area around the Gaza Strip and not to burn intelligence sources. Hamas does not have radars that can detect drone activity, and probably can’t detect a Hornet going out to sea from Ashdod.
On land, however, the military was more restrained. It did not reinforce forces in the area and didn’t even issue an order for soldiers stationed on the border to wake up and get dressed.
“The decision was made not to send intelligence to the troops on the ground so that some battalion commander who knows what is going on didn’t give the order to reinforce a patrol or put a tank in a position and thus reveal everything,” said an IDF source.
According to another source familiar with the details of the night’s events, “Hamas knows how to identify any unusual movement in the area. Even a tank that is positioned out of place arouses suspicion.” As a result, Halevi gave instructions to guard intelligence sources more stringently than he gave instructions to guard the fence.
“The only indication the security establishment had was the SIM cards and as far as it was concerned, that did not justify taking risks. In the end, they didn’t do anything,” said the source.
While Halevi held his situational assessment, Hamas was already beginning to gather its forces. At around 4:00 a.m., some of the Nukhba terrorists who had participated in exercises simulating a raid into Israel —exercises that the IDF was very familiar with—were told to go to mosques for morning prayers. There they received more precise orders, mostly by word of mouth, to report at certain points along the border fence at around six o’clock in the morning.
At the staging points, the terrorists received weapons, ammunition, maps and written orders. It is only then that most of them realized, for the first time, that they were headed to war. At 6:29 a.m., probably a minute ahead of schedule, a massive rocket and missile barrage was fired into Israeli territory from Gaza. At exactly the same time, Hamas began storming the fence. Standing between the 3,000 Gazan terrorists and the residents of the western Negev, Sderot and Ofakim, and the partygoers at the Nova festival next to Kibbutz Re’im, were just 600 IDF soldiers and 12 tanks.
Originally published by Israel Hayom.