Israel-Hamas Cyberwar, when old warfare meets new

While strategies shift, Israel and Hamas continue to battle in both cyberspace and conventional space.

Israel struck 320 ground targets in the Gaza Strip last weekend targeting Hamas, the Islamist militia and governing political party of Palestine. The attack included a strike against the headquarters of Hamas’ cyber warfare division, a five-story building located in the upscale Rimal neighbourhood of Gaza City. Israel claims to have knocked out Hamas’ cyberwarfare capabilities in the attack.

According to the Israeli Defense Forces (IDF) and Israeli Air Force (IAF) the attack was in response to a series of recent cyber attacks carried out by Hamas against Israeli IT-infrastructure. Incidences of cyber attacks by Hamas and other similar groups have been nearly constant for some time, meaning the attack was likely planned long before last weekend’s strike. Israeli military spokespersons described the targeting as a last-minute defensive measure.

In recent months, the number of rockets fired from Hamas-controlled areas into Israel-controlled areas has increased, and there has been a predictable corresponding increase in counter-attacks from Israel. Rockets utilised by Hamas are primarily the Palestinian built J80, which is based on the Iranian Qassam-2 or Qassam-3 rocket designs, having an ideal operative range of about 16 kilometres.

During the first week of May, it was reported that up to 700 rockets were fired from the Hamas-controlled Gaza Strip against targets inside Israel. Local news outlets reported that 25 Palestinians and four Israelis died, in addition to over one hundred injured civilians. The majority of the rocket strikes were, however, prevented by Israel’s Iron Dome counter-air system.

A Cyber Dream Job

While Hamas has been outmatched by Israeli air power, it is also tangling with one of the true superpowers of the Internet. With well-funded and highly developed offensive and defensive cyber-capabilities, few cyber attacks manage to have any significant impact on Israeli systems and infrastructure.

Today, the dream duty-station for Israeli military conscripts is no longer the Air Force, despite its attractive living standards and snazzy uniforms, or the elite Paratrooper division, which sport red (reddish-brown) boots signifying “the best of the best”. Instead, conscripts want to be assigned to Unit 8200, the Israeli signal intelligence service. For graduates of Unit 8200, the cyber war (or the more generic term ‘electronic warfare’) world is their oyster.

Many of those assigned to Unit 8200 go on to land lucrative careers in various tech hubs around the world, or become well paid (according to the low wage standards of Israel) contractors to the intelligence services.

The Israeli technology firm NSO Group Technologies, headquartered in Herzliya, produces a commercial spyware software named Pegasus. That software is believed to have played an integral role in the surveillance efforts of the Kingdom of Saudi Arabia’s intelligence service, the General Intelligence Presidency (GIP). Pegasus was also reportedly employed to glean information from the phone and computers of the late Saudi journalist-in-exile Jamal Khashoggi. Information possibly key in implementing the decision to terminate his existence.

Hamas’ Cyber Eggs

While Hamas does not have the same resources available to Israeli intelligence services, its experts are trained by Iranian and Russian cyberwarfare specialists of merit.

One of the key lessons in any war, dating back even before the teachings of Sun Tzu, is to know your enemy. One of Hamas’ favourite attack methods is to send pictures of attractive, half-naked women to Israeli conscript soldiers, establish a social media contact, and then gain insight into the soldiers’ activities through their smartphones. This is referred to as a cuckoo’s egg in National Security Agency (NSA) phraseology, bringing the age-old ‘honeypot trap’ into the 21st century.

By injecting spyware into images, embedded in the very image codec, Hamas and other agencies can record calls and can even activate, or aggregate, the phone’s microphone under particular circumstances. As a result of the prevalence of these types of attacks across Israel, soldiers are constantly warned over radio and television of this type of lure.

One of Palestine’s pioneers of cyber-terrorism inside the Israeli-sphere is Amna Muna. Muna befriended an Israeli teenager online, and lured him to terrorists waiting to murder him in Ramallah, in the West Bank. She used a chat forum on the Israeli ‘ICQ’ instant messaging service back in 2001. In 2011, Muna was traded along with 10 other Palestinian prisoners in exchange for Gilad Shalit. Shalit was captured in 2006 by Hamas during a cross-border raid on an IDF checkpoint. Muna currently resides in Turkey, where she receives a small monthly stipend from the Palestinian state. She was recently hailed as a national hero by Palestinian president Mahmud Abbas.

Israel’s Strike – Was it effective?

Israel’s claim to have knocked out Hamas’ cyber warfare capabilities in this attack should be taken with a hefty amount of salt. The targeted building housing the cyber warfare division was destroyed after a so-called “door knock,” meaning that residents in and near the building received a phone call about fifteen to twenty minutes before the attack began. The call featured a pre-recorded message which stated that the building would be targeted by the Israeli Air Force. Since cyberwarfare is primarily a matter of individual expertise and access to specialised software, it is assumed that the Hamas division will return online within the week. Israel is likely aware of this fact, and has probably taken it into account in its strategy.

As a result, Israel has recently shifted its overall strategy. While in the past several years Israel generally carried out wide-spanning attacks against infrastructure rather than individuals, by 2018 it shifted back towards what is generally referred to as individual targeting of key High-Value Target (HVT) individuals.

An example is the killing of Hamed al-Khudry on the evening of May 5th. Al-Khudry was a member of Hamas’ financial unit, which is known to transfer Iranian funds to Hamas and affiliated Islamic Jihad groups. Al-Khudry’s vehicle, a light blue late-model Toyota Camry, was struck at 1945 ZULU+3 by a missile as he was travelling home from his office in Gaza City. No other casualties were reported in relation to the strike. In recent weeks, several other individuals, mostly second-level figures from within the Palestinian Jihad movements, have been similarly and successfully targeted by Israel.

In response, Hamas has increased its attacks. 700 rockets were launched from the Hamas-controlled Gaza Strip over a single week in May, in contrast to a total of 1,000 rockets in all of 2018, according to Israeli figures.

The unspoken message in Israel’s continued targeted bombing is fairly clear: Israel will continue to eliminate the various leadership members as long as the rocket attacks continue from the Hamas-controlled areas. These are the same tactics Israel deployed during the second Intifada in 2004. The IAF carried out a string of targeted attacks against HVTs, utilising helicopter gunships equipped with AGM-114 Hellfire missiles, with great tactical success. Among the HVTs terminated were both of the founders of Hamas, Ahmed Yassin and Sheikh Ahmed Ismail Hassan Yassin.

This approach is not without danger. Israel is not the only combatant that can turn up the heat. Hamas has proven proficient in producing more powerful and accurate variations of its rockets. The rockets are both able to destroy apartment buildings and appear to be increasingly capable of striking designated targets in Tel Aviv and Jerusalem.

Hamas’ more dangerous armaments are well hidden, likely stored in facilities even Israel is unaware of. Threatening the Palestinian leadership in Gaza, its home turf, might push Hamas to escalate matters even more rather than de-escalate.

A possible silver lining is that both parties are, for various reasons, anxious to return to the “normal” level of hostilities, rather than the current heightened level as soon as possible. Ramadan is ongoing, and Gaza doesn’t have an Iron Dome to defend it.

Israel is about to celebrate its Independence Day. From the 14th of May through the 18th of May, Israel will host the high profile Eurovision Song Contest at the Expo Tel Aviv.

Hopefully the winning song will be one of peace.

John Sjoholm, Lima Charlie News 

[Edits by Anthony A. LoPresti]

[Subscribe to our newsletter for free and be the first to get Lima Charlie World updates delivered right to your inbox.]

John Sjoholm is Lima Charlie’s Middle East Bureau Chief, Managing Editor, and founder of the consulting firm Erudite Group. A seasoned expert on Middle East and North Africa matters, he has a background in security contracting and has served as a geopolitical advisor to regional leaders. He was educated in religion and languages in Sana’a, Yemen, and Cairo, Egypt, and has lived in the region since 2005, contributing to numerous Western-supported stabilisation projects. He currently resides in Jordan. Follow John on Twitter @JohnSjoholmLC

Lima Charlie World provides global news, featuring insight & analysis by military veterans, intelligence professionals and foreign policy experts Worldwide.

For up-to-date news, please follow us on twitter at @LimaCharlieNews

In case you missed it: