In the late hours of October 6, SIGINT systems at the Israel Security Agency (Shin Bet) started to go live. Dozens of SIM cards operating on Israeli networks switched on inside the Gaza Strip at practically the same time.
Follow Israel Hayom on Facebook, Twitter, and Instagram
It wasn't the first time something like this had happened. Shin Bet had seen this before on more than one occasion, including during Passover 2022. These events were interpreted by the agency and the IDF as a Hamas drill. On none of these previous occasions had an attempt been made to infiltrate Israel after the SIM cards were switched on. "Hamas drilled, the IDF drilled," was how one senior officer put it.
Hamas' Israeli SIM cards didn't get to Gaza by chance. The terror group's use of the cards was part of the invasion plan it put together over the past two years.
Hamas worked under the assumption that during a raid deep into Israeli territory, local SIM cards would be the best means of communication between its forces. Using local SIMs not only enabled the Hamas terrorists to make calls and send WhatsApp messages, it also let them hook up to the internet and broadcast live from their phones to the entire Muslim world the atrocities they carried out against Israeli civilians and soldiers.
Shin Bet monitored these SIM cards and saw them as a high-value source of intelligence. So long as they were kept wrapped up, the SIMs couldn't be traced, but once they were switched on, they instantly appeared on the radar. Shin Bet was in charge of this as part of its role monitoring Israeli cellular networks. Military Intelligence is prevented from doing so as the IDF does not collect intelligence on Israeli citizens.
But even if the Shin Bet was aware of the SIMs, it did not necessarily link them to Hamas' real plan, the "Great Campaign," as Yahya Sinwar, the architect of "Bloody Saturday" called it. The working assumption that took root in Israel was that the SIMs were intended for a much more limited scenario: a few small squads, only 10-20 terrorists, who would try to infiltrate Israel at two or three points along the fence. Then came the morning of October 7.
Conversations with current and former officials in the Shin Bet, the General Staff, Military Intelligence, and Southern Command – the four agencies involved in trying to understand the intelligence picture of October 7 – recount the main points of that night, for which the word "fateful" is an understatement. These conversations reveal fundamental differences and conflicting narratives in the versions presented by the sides. The contradictory descriptions underscore that the IDF has not yet investigated the events of October 7, and thus the events of that night have become a "Rashomon," parts of which have found their way to the media. The IDF and Shin Bet are both aware of the problematic nature of the matter.
There is one thing however that all sides see the same: During the night of October 7, the IDF and the Shin Bet were blinded. The most stringent intelligence assessments at those critical hours did not come close to assessing a fraction of what Hamas planned and executed. "If we had only known five percent of their true intentions," says a senior military official, "we would have scrambled everyone."
Below, we describe what the anatomy of a catastrophe looks like.
The lead assumption
Without a doubt, it was the activation of Israeli SIM cards in Gaza that led Shin Bet chief Ronen Bar to rush to the organization's headquarters in Tel Aviv, where he would spend the entire night. "The fact that the head of the Shin Bet leaves everything and comes down at night shows that there was an urgent piece of intelligence," says former Shin Bet chief Jacob Peri. "That isn't something that the head of the service usually does, so there must have been some urgency."
Bar consulted during the night with the head of the Shin Bet's southern division and also updated the IDF's Southern Command, which in turn notified the Gaza division. "There was some commotion," a source familiar with the matter says, "both in the Shin Bet and the [military] command."
The alerts coming from the Shin Bet were taken seriously. The head of Southern Command, Maj. Gen. Yaron Finkelman, who was on a family vacation in Yesud HaMa'ala, headed straight from the village in the Hula Valley in northern Israel down to Southern Command HQ in Beersheba. Most of the Command's staff officers would also turn up throughout the night. In the early stages of the night, several conversations were held between various elements in Military Intelligence, Shin Bet, and Southern Command, to try to decipher the intelligence picture. IDF Chief of Staff Herzi Halevi also received an initial update. Nonetheless, at the field level, the forces were not briefed, and the sector was not put on high alert. At this point, everyone was still watching and waiting.
As the hours passed, intelligence officials in the Shin Bet and the IDF tried to gain a better understanding of what Hamas was up to. However, apart from the SIM cards that had been activated, there were no other significant suspicious signs that an offense was about to be launched. Spotters from the Gaza Division were not detecting any suspicious movements beyond the fence. The initial premise thus was that this was just a drill – as had been the case on previous occasions.
Nevertheless, the Shin Bet was quite excited by the intelligence. Perhaps because it after all had been behind planting the SIM cards, and for what still seemed at that time to be a slim possibility of striking intelligence "gold." But when the warning was delivered through the usual channels by the Shin Bet to Military Intelligence, the latter did not seem unusually concerned. Sources in Southern Command said that Military Intelligence's response to the warning was pretty nonchalant and that the Intelligence Directorate did little with the warning. "Military intelligence was not present at the event," an army source says. "The Shin Bet director rushes down, the head of the Southern Command travels all the way from the north – and Military Intelligence doesn't wake up. They say it's an exercise and we can go back to normal."
The source says that if Military Intelligence had conducted a proper assessment of the situation that night, things might have looked different. "Assessing a situation is not just a meeting and a conversation between different parties," he explains. "It's a process where, in preparation for assessing the situation, people talk, gather information, pick up phones, and try to connect the dots. But throughout the night Military Intelligence did not conduct an assessment of the situation."
Even at the central listening post of Military Intelligence's prestigious signal intelligence division, Unit 8200, located not far from the Gaza Strip, no one seemed to be taking any dramatic measures during those critical hours. Overnight between Friday and Saturday on the eve of a holiday, the night shift was lightly staffed, but no additional manpower was brought in. A former Unit 8200 official recently briefed on the night's events, claims that "people in the unit picked up phones and exchanged information among themselves during those hours, but to the best of my understanding they did not raise alert levels."
An IDF source however said that Military Intelligence did conduct mid-level assessments of the situation, including by the Research Division and Unit 8200. A source in Military Intelligence confirmed that and rejected the claims that the reaction had been "nonchalant." He said that Unit 8200 had "tried to figure out what was going on" and had spotted some suspicious signs. What did not happen that night however was an integral assessment led by the head of Military Intelligence, Maj. Gen. Aharon Haliva, who was on vacation in Eilat that night.
Even if Unit 8200 did raise alert levels and detect some suspicious signs, they – and the entire Intelligence Directorate – were unable to provide valuable intelligence indicating actual and imminent offensive intentions by Hamas. The Shin Bet also tried to detect such intelligence but was unable to do so. During the early stages of the night, Military Intelligence, Southern Command, and the Shin Bet still believed this was an exercise. Some officers argued that there was a possibility that Hamas was planning to carry out a limited infiltration into Israeli territory "along one or two routes." One military source says that the Shin Bet even put this down in writing.
The working assumption was however that if any infiltration was planned, it would not be that night, but at the earliest in the morning or sometime the next day. A senior military official said: "The understanding was that it was a drill, with a stricter interpretation saying an infiltration," a senior military official puts it. One of the Shin Bet's working assumptions that night was that it was a drill, but its "leading assumption" was that a "limited incursion" was planned.
An IDF source says that "there was something in the air" throughout the night. "At first everyone was talking about a drill, then about an infiltration but not immediately, and even if that were the case, the scenario they were talking about was a limited infiltration. Even in our wildest imagination, no one imagined 3,000 terrorists, breaking through at thirty different points that night."
Throughout the night, Southern Command waited for an update from Military Intelligence, and more specifically from Unit 8200. What would 8200 have discovered if it had raised alert levels that night? While the army decided to wait with investigations into the failures of October 7, the chief of staff did allow certain checks in some units to prevent a "diversion" of the system during the war. The purpose of these tests is to detect malfunctions, especially in technological systems, so that they do not recur and harm the war effort, especially when it comes to the northern arena.
Unit 8200 was one of the units allowed to conduct an investigation, which the army has defined as a process of "learning and auditing." Unit 8200 commander, Brig. Gen. Y., appointed the unit's former commander, Brig. Gen. (res.) Danny Harari, as head of the investigation team. Not all senior officers at Unit 8200 were notified of the establishment of an investigative team and only found out about it after it had already been set up. This caused some resentment in the unit toward Commander A. Military sources say that the investigation at Unit 8200 did reveal several indications, which, had they been deciphered in real-time, could have changed the intelligence picture. The results of the investigation have yet to be presented to the head of Military Intelligence or the chief of staff.
An attack or an attempted kidnapping
It seems that of all the three agencies involved in the event, Military Intelligence was the quietest. It was only at 3:21 a.m. that the deputy head of MI called up Haliva and informed him of the alert. Sources close to Haliva said that he received updates on suspicious signs in the south, but also "signs that pointed in the other direction" and that he asked to receive further updates in the morning.
The Shin Bet, it appears, acted decisively. There, more and more voices began to talk at one point about the possibility that Hamas was not carrying out a drill but preparing for an infiltration to execute an attack or attempt to take hostages. Shortly after 3 a.m. on October 7, the upper echelons of the Shin Bet decided to call in from home a large number of officers from its southern division, and at the same time to send into the field a "Tequila" team, a code name for the Shin Bet's operations unit that has become famous in recent months.
According to three different sources, the Tequila team called up in the early hours of October 7 was supposed to gather further intelligence. The goal, according to these sources, was not to intercept specific terrorist cells, but to gain a deeper intelligence picture.
The Shin Bet however says that the team was composed of operatives from the Shin Bet operations unit and the police counterterrorism unit, the Yamam, and that it had the ability to intercept terrorists. The agency presents the decision to call up the "Tequila" team as proof that it was preparing for the very real possibility of a cross-border infiltration.
The team was called up at around 4:00 a.m. and arrived in the Gaza envelope just before the attack commenced. It took part in the fighting and several members of the team were killed.
Maj. Gen. (res.) Uri Sagi, a former head of Military Intelligence, says that discrepancies between the Shin Bet and Military Intelligence in the way events were seen and handled that night are a symptom of the intelligence chaos surrounding the Gaza Strip. "In recent years, Military Intelligence has slowly moved out of Gaza and the Shin Bet has taken over there," he says. "When you have a situation where it is not clear who is in charge, who's supposed to make the system work, things fall between the cracks. The fact is that Haliva didn't think it was important enough to return from Eilat to the "pit" [the IDF's underground command and control center] in the Kirya [IDF headquarters in Tel Aviv], while the head of the Shin Bet headed for HQ. But the head of the Shin Bet can't tell Haliva what to do, so everyone reacts differently."
According to Sagi, transferring responsibility for the Gaza Strip to the Shin Bet has also changed the language spoken by intelligence personnel responsible for the sector. "The Shin Bet is an organization focused on terrorism," Sagi explains. "It speaks about 'infiltrations,' about 'terrorist attacks,' not about war, which is the language Military Intelligence speaks."
"You don't wake up the chief of staff for nothing"
As already noted, at around 3:30 a.m. when the Shin Bet began to seriously indicate that there may be a genuine intention to infiltrate the border, Feldman woke Halevi with a phone call. "If the chief of staff gets up at night, it's because we're on the brink of an abyss," says Brig. Gen. (res.) Amir Avivi, who served as head of bureau for former IDF Chief of Staff Moshe Ya'alon. "You don't wake the chief of staff for nothing."
A former IDF chief of staff said that it is likely that the person who picked up the phone that night at the Halevi residence was the chief of staff's wife. "I can assure you that the chief of staff does not wake when the phone rings, he sleeps too deeply," the former Lieutenant General said. Regardless of who woke Halevi, before Feldman could begin his update, Halevi, who straight away understood that he was about to receive intelligence that required his attention, asked Feldman to stop and arrange a conference call in a few minutes. Halevi did not name who he wanted in the conversation. This kind of urgent consultation, with the participation of the army's top general, is known in the IDF as a "Chief of Staff situational assessment."
"When an intelligence report that requires the input of the chief of staff is received, his bureau invites the participants to take part in the assessment," says a former senior officer who participated in dozens of such conference calls. Each participant receives a number to call into along with a code. A few minutes before the designated time, they call in on an encrypted phone, punch in the code, and give their name.
"When the chief of staff gets on the call, the head of the bureau presents the participants, and the assessment commences. Each participant talks in turn and at the end, the chief of staff gives his summary. These kinds of calls can last an hour or just 15 minutes, depending on the situation.
The conversation takes place using encrypted military cell phones. According to people who have experience using these phones, they do not always work well and can take time to activate and unlock.
The army has a protocol for who takes part in a situational assessment with the chief of staff. As already noted, in line with this protocol, Halevi did not name the officers he wanted to participate in the conversation and left it to his head of bureau to make the call. For an unknown reason, he did not invite Haliva, the Military Intelligence Haliva; senior IDF officials say this will be investigated in the future.
In the end, besides Chief of Staff Halevi, the other participants in the situational assessment were OC Southern Command, Maj. Gen. Finkelman, and the head of the Operations Directorate, Maj. Gen. Oded Basiuk. Halevi, according to a source familiar with the details, asked during the conversation why there was no Military Intelligence official on the line, but did not insist on an MI representative being present. In Halevi's understanding, the speakers on the call were expressing the position of Military Intelligence following consultations with it. Finkelman did most of the talking during the call. He told Halevi and Basiuk the details and emphasized the dilemmas – namely that the intelligence establishment believed Hamas was conducting a drill, but the stricter interpretation argues that there is a real intention to carry out a pin-point infiltration, although not in an immediate timeframe.
The conference call with Halevi took place sometime between 3:30 and 4:00 and is not believed to have lasted more than fifteen minutes. It is reasonable to assume that the brief call was registered in the ledger of the chief of staff's office. When a commission of inquiry into the war is established, this will be one of the main items it seeks to investigate.
So far, there has been no debriefing of the call. According to a military source, the chief of staff and the other officers on the call expressed "concern" and instructions and emphases were given for actions at sea, in the air, and on land, and further instruction was given to make sure there "both military and intelligence preparedness" was in place for the possibility of an infiltration. According to this source, Maj. Gen. Finkelman, who, as mentioned, updated the chief of staff with the primary facts, "did not call for 'helicopters in the air.' There was no devil's advocate on the call."
Video: Israel army conducting high-precision operation inside Gaza's Shifa hospital, says spokesman / Credit: Reuters
There is a broad consensus that during the situational assessment, the three participants on the call could not have imagined that Hamas was about to launch an invasion with thousands of terrorists. According to a source familiar with the details of the conversation, all the participants – the chief of staff, the head of the operations directorate, and the head of Southern Command – were not familiar with the "Walls of Jericho" presentation prepared by the Gaza Division and neither were they familiar with the warnings of V. and NCO from Unit 8200. Both these documents warned of a full-scale invasion.
"I can understand how in this situation, an incident without context and with only vague indications did not arouse major suspicions," says a former senior officer with Military Intelligence. "Let me give you an example: No one assumes that two weeks from now a Russian submarine flotilla will position itself off Tel Aviv and launch a nuclear barrage. So even if I were to show you now two Russian submarines off the coast of Tel Aviv, you would not evacuate the city. On the other hand, if you were familiar with such a plan, then every submarine spotted would trigger a major alert. The problem began long before this tragic night; namely, senior military officials were unfamiliar with Hamas' plans and could not even imagine them."
The heads of the bureau made the decision
One person who may well have been familiar with the intelligence materials indicating Hamas' intentions to launch an invasion and carry out a massacre is Haliva, the head of Military Intelligence. According to media reports, he was familiar with both the "Walls of Jericho" file and the emails sent by V. the NCO from Unit 8200. Other sources who have spoken with Haliva claim that he was not familiar with V.'s emails. Either way, Haliva was not on the call.
Despite the obvious urgency that night in the chief of staff's bureau, for some reason, two officials were not invited to the situational assessment - Haliva and Air Force Commander, Maj. Gen. Tomer Bar. There were no officers from Military Intelligence or the Air Force on the call. According to a senior military official, the decision not to insist on the presence of the military intelligence and air force chiefs was taken by the relevant bureau chiefs.
According to Brig. Gen. (res.) Avivi, the former head of the bureau for Ya'alon, the decision was unusual. "If the axis of the conversation is the intelligence axis, two people that must be on the call are the head of Military Intelligence and the head of the Research Division.," he says. A former senior officer at Unit 8200 said: If no one from Military Intelligence was part of the process throughout the night and if no one from the bureau of the chief staff spoke to them, that is scandalous."
Haliva's confidantes say that even if he had been on the call, it wouldn't have made any difference. "If he had been on the call, he would have said there that in his assessment it was a Hamas drill," one of them said. As for the air force commander, according to IDF protocol, he is not obligated to participate in situational assessments relating to intelligence matters, but only in those relating to attacks.
Prime Minister Benjamin Netanyahu was also not updated on the call. His military secretary, Maj. Gen. Avi Gil was updated only at around 6:15 a.m. He didn't have time to wake Netanyahu up and called him only at 6:29 a.m. when the attack had already commenced.
"The Revolutionary Youth"
Netanyahu did not know about the call, but his previous decisions certainly influenced the final call following the situational assessment held by Chief of Staff Halevi at 4 a.m.
To understand Halevi's considerations that night, one has to go back to the violent protests that developed on the border fence with Gaza in the months before the current war, and which peaked during the Jewish High Holidays. These protests were initiated by an organization previously unknown to Israel, "the Revolutionary Youth."
"We couldn't figure out what this organization wanted," says a defense official. "At first they spoke about security prisoners, then about work permits. It was out of context." It is only in retrospect that the "Revolutionary Youth's" connection to the Hamas leadership was revealed, and it became clear that the fence protests were part of a ruse designed to put the IDF to sleep ahead of the October 7 attack and prepare moves to bring down parts of the border barrier.
Senior security officials were troubled by the Gaza protests during the Tishrei holidays, as was the political leadership. However, both preferred to direct resources to the struggle against the Iranian nuclear program, to the campaign between wars in Syria and Lebanon, and to the growing terror infrastructure on the West Bank. They both agreed on how to end the border protests and restore quiet to Gaza: increasing the number of permits allowing Gazans to work in Israel, expanding off-shore fishing zones, and a lot of Qatari money.
It seemed to be working. During Rosh Hashanah, the army decided to significantly reinforce IDF forces around Gaza, fearing that the protests would spill over into Israeli territory. Indeed, the border protests did turn violent. But after Rosh Hashanah, Israel began to signal that it would take steps to appease the protesters. The protests came to an abrupt halt after Yom Kippur. A few days before 7 October, on 29 September, the Revolutionary Youth suddenly announced that it had achieved its goals. "Since then, they haven't come to the fence anymore," a defense establishment source said at the time.
The cessation of the protests led to a dramatic decline in security tensions in the Gaza sector. The reinforcements that arrived in Gaza on Rosh Hashanah were released, with some directed to Judea and Samaria, where Hamas may have created alerts about terrorist attacks to get IDF forces directed there. After the outbreak of the war, there was talk that the IDF had diluted forces in the Gaza sector ahead of Sukkot, but according to an IDF source, this was simply a return to the routine order of battle.
In any event, at the weekly assessment held every Thursday morning at the chief of staff's bureau, with the participation of senior IDF officers, no concrete warnings were raised that Hamas intended to make a play in Gaza. At the weekly assessment held on October 5, the concerns raised were of an escalation in Judea and Samaria.
The IDF breathed a collective sigh of relief. The sudden reduction in tensions in Gaza may explain the fact that several senior IDF officials – Finkelman, Haliva, and IDF Spokesperson Brigadier General Daniel Hagari among them– felt comfortable going on vacation during Simchat Torah. The deputy commander of the Gaza Division's northern brigade, who lives in Kibbutz Nir Yitzhak near the Gaza border, went home without his rifle.
Defense establishment sources say that the quiet in Gaza at the time was not only a matter of a reduction in operational tensions but also of political directives. Netanyahu demanded that the defense establishment keep Gaza quiet, at almost any price. This directive no doubt would have crossed Halevi's mind in the early hours of October 7.
Three UAVs and a chopper
After the situational assessment, Halevi instructed that intelligence gathering be stepped up and that he receive an update later. He also told Finkelman and Basiuk to question the assumption that Hamas was just conducting a drill and to "think smart" to try and understand where an infiltration might take place and how it would be executed.
That said, the spirit of the order given by Halevi, who, in light of the intelligence he received, does not get the impression that an infiltration is imminent, is to act quietly at this stage so that Hamas doesn't suspect unusual movements carried out by the IDF. The rationale behind this decision is the desire not to reveal intelligence sources.
This is what was at the crux of the story, says a source knowledgeable of the conversation. "When you have intelligence, you say to yourself, 'What do I do, and what do I do to make sure the other side doesn't understand that I know. That was what was at the heart of the conversation."
"It is this tension that is the big story," says a source familiar with the details of the conversation. "When you have certain intelligence and you say, 'What am I doing, and what am I doing so that the other side doesn't understand what I know,' that's the heart of that conversation."
In other words, Halevi was anxious about the SIM cards: the chief of staff feared that Hamas would recognize that the IDF had raised its alert and deduce that someone in Israel knew about its plan."Given the intelligence he had, he took all the necessary margins of security," says an army source. Indeed, given the intelligence picture presentedtothechiefofstaff, his instructions sound logical.
It is only with hindsight that we can see that it was too little, too late it was. At that point, there may have been a last chance to prevent, or at least reduce, the force of the blow that Hamas would inflict on the Gaza border communities only two and a half hours later
A senior military official told Israel Hayom that in any situational assessment, the issue of protecting intelligence sources is part of the operational decision-making process. "If we had understood there was going to be a large-scale raid, protecting sources would not have been a consideration," he says. "In every situational assessment, there is a tension and discourse between understanding how to use force without jeopardizing your sources," he said.
During the critical hours that followed, the IDF moved cautiously. After the initial situational assessment with the chief of staff, another meeting was held at 4:30 a.m. chaired by the head of the operations directorate Basiuk. The directorate, responsible for mobilizing and reinforcing IDF forces, went ahead with measures corresponding to the orders given by the chief of staff. Basiuk reinforced aerial reconnaissance with a combat helicopter and three UAVs with reconnaissance, but not offensive, capabilities. The UAVs would later look down from above at Israeli civilians being abducted into Gaza, unable to respond.
The directives also trickled down to the Gaza Division. According to one report, the Gaza division commander, Brig. Gen. Avi Rosenfeld, updated the commander of the nearby Ashdod naval base, Col. Eitan Paz, with the unusual intelligence information. Paz raised the alert level and ordered a force from the Snapir unit to be sent out to sea on a small Hornet-class vessel. Paz, like the rest of the army, was not thinking of a scenario in which ten ships carrying Hamas naval commandos armed to the teeth, simultaneously head out of Gaza toward Zikim Beach Israel, as indeed happened.
Raising the alert level in the air and at sea was in line with the decision not to rouse the area around the Gaza Strip and not to burn intelligence sources. Hamas does not have radars that can detect drone activity, and probably can't detect a Hornet going out to sea from Ashdod.
On land, however, the military was more restrained. It did not reinforce forces in the area and didn't even issue an order for soldiers stationed on the border to wake up and get dressed. "The decision was made not to send intelligence to the troops on the ground so that some battalion commander who knows what is going on doesn't give the order to reinforce a patrol or put a tank in a position, and thus reveal everything," says an IDF source.
Another source familiar with the details of the night's events says that "Hamas knows how to identify any unusual movement in the area. Even a tank that is positioned out of place arouses suspicion." As a result, Halevi gives instructions to guard intelligence sources more stringently than he gives instructions to guard the fence. "The only indication the security establishment had was the SIM cards and as far as it was concerned, that did not justify taking risks. In the end, they didn't do anything."
While Halevi held his situational assessment, Hamas was already beginning to gather its forces. At around 4:00 a.m., some of the Nukhba terrorists who had participated in exercises simulating a raid into Israel –exercises that the IDF was very familiar with – were told to go to mosques for morning prayers. There they received more precise orders, mostly passed on by word of mouth, to report at certain points along the border fence at around six o'clock in the morning.
At the staging points, the terrorists received weapons, ammunition, maps, and written orders. It is only then that most of them realize, for the first time, that they are headed to war. At 6:29 a.m., probably a minute ahead of schedule, the largest rocket and missile barrage ever is fired into Israeli territory from Gaza. At exactly the same time, Hamas begins its storming of the fence. Standing between the 3,000 Gazan terrorists and the residents of the western Negev, Sderot, and Ofakim, and the partygoers at the Nova festival next to Reim are just 600 IDF soldiers and 12 tanks.
An IDF spokesperson said: "The IDF is currently engaged in combat and has not yet begun investigating the events of October 7, including the events of the previous night. The investigations will commence in the coming days, and once completed, the findings will be presented transparently to the public."
Subscribe to Israel Hayom's daily newsletter and never miss our top stories!