How Israeli spies penetrated Hizbollah

In its 2006 war with Hizbollah, Israel tried to kill Hassan Nasrallah three times.

One air strike missed — the leader of Hizbollah had earlier left the spot. The others failed to penetrate the concrete reinforcements of his underground bunker, according to two people familiar with the attempted assassinations.

On Friday night, the Israeli military fixed those mistakes. It tracked Nasrallah to a bunker built deep below an apartment complex in south Beirut, and dropped as many as 80 bombs to make sure he was killed, according to Israeli media.

“We will reach everyone, everywhere,” bragged the pilot of the F-15i warplane that the Israeli army said dropped the lethal payload, destroying at least four residential buildings.

But the confident swagger of the Israeli military and security establishment, which has in the past few weeks delivered a steady drumbeat of devastating blows to one of its biggest regional rivals, belies an uncomfortable truth: in nearly four decades of battling Hizbollah, only recently has Israel truly turned the tide.

What changed, said current and former officials, is the depth and quality of the intelligence that Israel was able to lean on in the past two months, starting with the July 30 assassination of Fuad Shukr, one of Nasrallah’s right-hand men, as he visited a friend not far from Friday’s bombing site.

These officials described a large-scale reorientation of Israel’s intelligence-gathering efforts on Hizbollah after the surprising failure of its far more powerful military to deliver a knockout blow against the militant group in 2006, or even to eliminate its senior leadership, including Nasrallah.

For the next two decades, Israel’s sophisticated signals intelligence Unit 8200, and its military intelligence directorate, called Aman, mined vast amounts of data to map out the fast-growing militia in Israel’s “northern arena”.

Miri Eisin, a former senior intelligence officer, said that required a fundamental shift in how Israel viewed Hizbollah, a Lebanese guerrilla movement that had sapped Israel’s will and endurance in the quagmire of its 18 year-long occupation of south Lebanon. For Israel that ended in 2000 in an ignominious retreat, accompanied by a significant loss of intelligence gathering.

Instead, Eisin said, Israeli intelligence widened its aperture to view the entirety of Hizbollah, looking beyond just its military wing to its political ambitions and growing connections with Iran’s Revolutionary Guards and Nasrallah’s relationship with Syria’s President Bashar al-Assad.

“You have to define, in that sense, exactly what you’re looking for,” she said. “That’s the biggest challenge, and if done well, it allows you to look at this in all its complexity, to look at the whole picture.”

Israeli intelligence had for nearly a decade referred to Hizbollah as a “terror army”, rather than as a terrorist group “like Osama bin Laden in a cave”, she said. It was a conceptual shift that forced Israel to study Hizbollah as closely and broadly as it had the Syrian army, for instance.

As Hizbollah grew in strength, including in 2012 deploying to Syria to help Assad quell an armed uprising against his dictatorship, it gave Israel the opportunity to take its measure. What emerged was a dense “intelligence picture” — who was in charge of Hizbollah’s operations, who was getting promoted, who was corrupt, and who had just returned from an unexplained trip.

While Hizbollah’s fighters were battle hardened in Syria’s bloody war, the militant group’s forces had grown to keep pace with the drawn-out conflict. That recruitment also left them more vulnerable to Israeli spies placing agents or looking for would-be defectors. 

“Syria was the beginning of the expansion of Hizbollah,” said Randa Slim, a programme director at the Middle East Institute in Washington. “That weakened their internal control mechanisms and opened the door for infiltration on a big level.”

The war in Syria also created a fountain of data, much of it publicly available for Israel’s spies — and their algorithms — to digest. Obituaries, in the form of the “Martyr Posters” regularly used by Hizbollah, were one of them, peppered with little nuggets of information, including which town the fighter was from, where he was killed, and his circle of friends posting the news on social media. Funerals were even more revealing, sometimes drawing senior leaders out of the shadows, even if briefly.

A former high-ranking Lebanese politician in Beirut said the penetration of Hizbollah by Israeli or US intelligence was “the price of their support for Assad”.

“They had to reveal themselves in Syria,” he said, where the secretive group suddenly had to stay in touch and share information with the notoriously corrupt Syrian intelligence service, or with Russian intelligence services, who were regularly monitored by the Americans.

“They went from being highly disciplined and purists to someone who [when defending Assad] let in a lot more people than they should have,” said Yezid​​​​ Sayigh, a senior fellow at the Carnegie Middle East Center. “The complacency and arrogance was accompanied by a shift in its membership — they started to become flabby.”

That was a departure for a group that took pride in is ability to fend off Israel’s vaunted intelligence prowess in Lebanon. Hizbollah blew up Shin Bet’s headquarters in Tyre not once but twice in the early years of Israel’s occupation of southern Lebanon. At one point in the late 1990s, Israel realised that Hizbollah was hijacking its then-unencrypted drone broadcasts, learning about the Israel Defense Forces’ own targets and methods, according to two people familiar with the issue.

Israel’s broadened focus on Hizbollah in the region was accompanied by a growing, and eventually insurmountable technical advantage — spy satellites, sophisticated drones and cyber-hacking capabilities that turn mobile phones into listening devices.

It collects so much data that it has a dedicated group, Unit 9900, which writes algorithms that sift through terabytes of visual images to find the slightest changes, hoping to identify an improvised explosive device by a roadside, a vent over a tunnel or the sudden addition of a concrete reinforcement, hinting at a bunker.

Once a Hizbollah operative is identified, his daily patterns of movements are fed into a vast database of information, siphoned off from devices that could include his wife’s cell phone, his smart car’s odometer, or his location. These can be identified from sources as disparate as a drone flying overhead, from a hacked CCTV camera feed that he happens to pass by and even from his voice captured on the microphone of a modern TV’s remote control, according to several Israeli officials.

Any break from that routine becomes an alert for an intelligence officer to sift through, a technique that allowed Israel to identify the mid-level commanders of the anti-tank squads of two or three fighters that have harassed IDF troops from across the border. At one point, Israel monitored the schedules of individual commanders to see if they had suddenly been recalled in anticipation of an attack, one of the officials said.

But each one of these processes required time and patience to develop. Over years, Israeli intelligence was able to populate such a vast target bank that in the first three days of its air campaign, its warplanes tried to take out at least 3,000 suspected Hizbollah targets, according to the IDF’s public statements.

“Israel had a lot of capabilities, a lot of intelligence stored waiting to be used,” said a former official. “We could have used these capabilities way longer ago during this war, but we didn’t.”

That patience appears to have paid off for the military. For more than 10 months, Israel and Hizbollah traded cross-border fire, while Israel killed a few hundred of Hizbollah’s low-level operatives, the vast majority of them within a slowly expanding theatre of the conflict, stretching a few kilometres north of the border.

That appears to have lulled Nasrallah into thinking that the two arch-rivals were involved in a new sort of brinkmanship, with well-defined red lines that could be managed until Israel agreed a ceasefire in Gaza with Hamas, allowing Hizbollah an “off-ramp” that would allow it to agree a ceasefire with Israel.

The group had only started this round of fire with Israel on October 8, in solidarity with Iran-backed Hamas, in an attempt to keep at least some Israeli firepower pinned down on its northern border.

“Hizbollah felt obliged to take part in the fight, but at the same time limited itself severely — there was never really any intention of them taking an initiative where they might have some advantage,” said Sayigh of the Carnegie Middle East Center.

“They seem to have thrown off a few rockets here and there, and taken a few hits in return, and getting lulled into a notion that this was the limit of it — they kept one, if not both, hands tied behind their back and did nothing approaching their own full capability.”

But even the possibility that Hizbollah would attempt the same sort of cross-border raid that Hamas had successfully pulled off on October 7 — killing 1,200 people in southern Israel, and taking 250 hostages back into Gaza — was enough for Israel to evacuate the communities near its border with Lebanon. Some 60,000 Israelis were forced from their homes, turning the border into an active war zone with Hizbollah.

To create the conditions for their return, PM Benjamin Netanyahu appears to have unleashed Israel’s more advanced offensive capabilities, according to officials briefed on the operations.

That included the unprecedented detonation of thousands of booby-trapped pagers two weeks ago, wounding thousands of Hizbollah members with the very devices that they had thought would help them avoid Israel’s surveillance.

It culminated on Friday with Nasrallah’s assassination, a feat that Netanyahu’s predecessor, Ehud Olmert, had authorised in 2006 and the IDF had failed to deliver.

In recent months, if not years, Israeli intelligence had nearly perfected a technique that allowed it to, at least intermittently, locate Nasrallah, who had been suspected of mostly been living underground in a warren of tunnels and bunkers.

In the days after October 7, Israeli warplanes took off with instructions to bomb a location where Nasrallah had been located by Israel’s intelligence directorate Aman. The raid was called off after the White House demanded Netanyahu do so, according to one of the Israeli officials.

On Friday, Israeli intelligence appears to have pinpointed his location again — heading into what the IDF called “a command and control” bunker, apparently to a meeting that included several senior Hizbollah leaders and a senior Iranian commander of Revolutionary Guards operations.

In New York, Netanyahu was informed on the sidelines of his address at the UN General Assembly, where he rejected the notion of a ceasefire with Hizbollah and vowed to press on with Israel’s offensive. A person familiar with the events said that Netanyahu knew of the operation to kill Nasrallah before he delivered his speech.

Israel’s campaign is not over, says Netanyahu. It is still possible that Israel will send ground troops into southern Lebanon to help clear a buffer zone north of its border. Much of Hizbollah’s missile capabilities remain intact.

“Hizbollah did not disappear in the last 10 days — we’ve damaged and degraded them and they are in the stage of chaos and mourning,” said Eisin, the former senior intelligence officer. “But they still have lots of capabilities that are very threatening.”

Additional reporting by Chloe Cornish in Dubai