Five months after the IDF decided to implement profound changes to exposure procedures for soldiers and career service members as part of the lessons learned from October 7 and the war that followed, it appears the military is struggling to enforce its information security policy, especially on social media.
One of the Military Intelligence Directorate's lessons from investigations into October 7 and the events preceding the massacre concerns information security culture in the military. "This is an issue that urgently requires reform," said a senior official in the Military Intelligence Directorate. "Phones and social networks have dismantled the IDF. Hamas managed to understand many things without significant intelligence capabilities. We are on the verge of a necessary and inevitable revolution, and it will come at a cost."
Despite these statements and the decision to increase oversight on information exposure, the IDF has no real ability to enforce this policy on soldiers' private social media accounts, primarily relying on soldiers' responsibility and maturity. But the situation is even worse on an unexpected front – the official social media accounts of IDF units, managed by soldiers, typically education NCOs or IDF Spokesperson representatives in the unit, which have become sources of sensitive operational information leaks.
Monitoring dozens of Instagram pages of regular and reserve units – divisions, brigades, and battalions – revealed a concerning picture: operational information, including troop movements, locations, dates, and capabilities, is being freely published. Images expose the faces and names of soldiers, thereby endangering their security and the security of operations. These pages receive almost no criticism or supervision, and this phenomenon raises serious questions about the IDF's ability to deal with threats in the digital era.
The concern is that these publications not only serve as a basis for complaints and arrests of soldiers worldwide – a phenomenon the military tried to address with recent policy changes – but also assist terrorist organizations like Hamas in monitoring the IDF, as the organization did – according to IDF investigations – for years in preparation for the terror attack on October 7. Military sources say the issue is being addressed and that the army is working to increase awareness and training among soldiers. However, without strict enforcement and deep cultural change, it seems the battle for information security on social media is still far from being decided in our favor.
In a previous conversation, the IDF claimed these publications are not problematic because they are "private" accounts, meaning they personally approve each follower. This claim is questionable because many accounts aren't "private" but are managed voluntarily and unofficially by soldiers who change frequently and don't personally know each follower, who sometimes number in the thousands. Additionally, in the past year, the IDF and Shin Bet have published information about fictitious Hebrew-language profiles created by Iranians or Hamas operatives who tried to contact IDF soldiers, so it's reasonable to assume that when there are many approval requests, any user with a Hebrew name will be immediately approved without any verification, including, apparently, those Hamas profiles.
For an extended period, Makor Rishon monitored dozens of IDF unit accounts on social networks, mainly Instagram, and the emerging picture is very concerning. It can be definitively stated that they represent and testify to the general situation.
On Sunday, January 19, 2025, an invitation was published on the Nahal Brigade's Instagram account for a ceremony marking the exit of the Nahal Brigade Combat Team from the Gaza Strip, to be held the next day, Monday, at 10 a.m. at the Steel Monument in the Gaza border communities. Needless to say, providing an exact location and time on social networks for an event where hundreds of fighters will be present is a serious security violation that could endanger the event participants.
The Nahal Brigade excels in operations in the Gaza Strip. Its fighters were there continuously for a year and three months, and only last week returned to it after a brief break for missions in the West Bank. The brigade's fighters' activities have been documented and published quite extensively on social media. Here are several examples.
The 931st Battalion's account posted on May 11, "This week's achievements – initiated operational patrols in red areas, targeted arrests in hot sectors, prevention of illegal work, and preparation for maneuvering and transition from the line." On April 9, Saturday morning, a post announced the readiness of forces "just before departing for an operation in Nablus," which apparently took place Friday night, with extensive details about which force was involved in the operation, when it began, and possibly continued beyond that – and of course, this is a serious information security violation.
A post from January 19 stated that "the battalion took a central part in a complex rescue operation to free two hostages from the Gaza Strip. Battalion attacks to establish targets, continued ambushes and initiatives to blur the contact line, road clearing, detection detonations, and drone searches." Exposing code names of targets, and generally, specifying missions and emphases from which the enemy can deduce what the IDF is planning. The day before, on January 18, several posts announced that the 931st Battalion had left Gaza after a long period, "a year and three months of fighting in Gaza have come to an end," information that was published on the day the forces left, and before an official announcement from the IDF Spokesperson (which is usually published several days after the event to maintain a security buffer).
In the 932nd Battalion, the operational company's account posted a status last Friday about the "last Shabbat on the line," apparently before going back down to Gaza, with unblurred faces of the fighters. On March 21, they posted about "drone certification for the spearhead company by the 5th platoon of the support company." An update about the battalion commander change ceremony was also published, with the faces of the incoming and outgoing commanders indeed blurred according to guidelines, but their full names were published.
The 50th Battalion announced on April 9 that the first "Eitan" APC had been integrated into the battalion.
Moving to the Armored Corps. On the Instagram page of the 188th Brigade, photos were published from the brigade assembly, showing all the soldiers who participated and sat in the audience, as well as the battalion commanders who went on stage to receive awards; it showed their faces without any blurring.
The 53rd Sufa Battalion of the brigade updated on what awaits the fighters in the coming week: "Farewell evening for the battalion commander, battalion commander replacement ceremony, and Torah scroll dedication in memory of the battalion's fallen." On March 8, an evening for the replacement of Company C's commander was held with the full names of the officers.
The 74th Battalion in the brigade announced on Monday, May 5, "Entering the Gaza Strip." In another case, Company C of the 605th Battalion went for refreshment after fighting in Lebanon. In the documentation published by the brigade, the fighters' faces were blurred, but in the battalion's Instagram account, the same images remained uncensored.
Moving to infantry brigades, the Instagram account of the 13th Battalion in the Golani Brigade posted, "Gideon Battalion completed a month of fighting in the Rafah area." The 51st Battalion account posted on May 6 about a "battalion refreshment fair upon exiting a mission in Gaza," and in the next story, also about flower bouquets that fighters' families received before going home. In both cases, this involves exposing force arrangements, similar to what was known to Hamas before the October 7 attack, when half of the force on the Gaza border left for holiday leave and the weekend at home.
On the Instagram page of the Ground Forces Command, a story was posted on April 27, detailing the locations of the 12th Battalion in Rafah, 51st Battalion in the Morag Corridor, the 188th Brigade in Rafah, and the 282nd Brigade on the Gaza Strip border.
"Hollywood 162," the documentation and filming team of the162nd Division (under which the Golani and Nahal Brigades, the 401st Armored Brigade, the 215th Artillery Brigade, and the 5th Reserve Armored Brigade operate), published a post on its Instagram page on Wednesday, April 23, featuring an illustrated map of the Gaza Strip, using shared language and code names for places where the division operated. There seems to be no need to elaborate on the use Hamas operatives could make of such information.
The 401st Armored Brigade account features unblurred facial images of all soldiers and commanders, including battalion commanders, from the brigade assembly held on March 23.
The Rotem Battalion account in the Givati Brigade conducts introductory activities with the battalion units and reveals full names and positions.
On January 17, a post summarizing activities since the beginning of the month was published: "On January 4, an explosive charge detonated on a D9 during a sniper attack. The battalion performed a drainage operation during which one of three women who passed through reported there were terrorists in the area." On January 6, "a 'Kung Fu Panda' was performed with 4 tons of explosives led by the deputy battalion commander and the operational company framework." This is a classified term, and obviously the quantity and forces involved are classified. On January 7, "a closing of the circle was performed on a terrorist who was south of our forces, by an observation force and attack cell. Terrorist elimination by Zik." On January 9, the battalion destroyed terrorist infrastructure in the northern Gaza Strip area. On January 10, "an incident of explosive activation occurred when entering a house by the operational company. 8 fighters were wounded to varying degrees and evacuated by the 6th platoon." On January 15, "the operational company went out for refreshment." Here too – exposure of operational methods, force locations, and information about troop arrangements.
Even reserve units that maintain Instagram pages commit the error of unnecessarily publishing sensitive information. The Alexandroni Brigade regularly updates on new appointments in the brigade with full names.
One of the biggest problems on social networks, which has recently worsened, is the "commander's page" of all units. On these pages, the unit commander – division, brigade, battalion, company, or equivalents in various corps – publishes his remarks for a holiday, operation, or significant event, but in the current situation, where social media publications are completely visible, no control is exercised over the content published on them. First, all these commander pages go online with the full names of the commanders. In the case of the 51st Battalion's commander's page for Passover, the battalion commander revealed the operation code name "Red Sea," in which the battalion was in the midst of. In the Jerusalem Brigade commander's page, the brigade commander detailed the brigade's return to the Netzarim Corridor, the operation to attack and capture the Turkish Hospital where Hamas government headquarters were located, "now under our operational control after we destroyed dozens of Hamas terrorists operating in the area... We are preparing to continue the mission and are ready for any development," and there are many more examples.
Hundreds of thousands of information items leaked to Hamas
The entity responsible for all publications in the IDF, and should also supervise them, is the Information Security Department (Machbam), which numbers about 1,400 soldiers. The department leads the effort to protect the sensitive information of the military and operates as a system from headquarters in the Kirya to every brigade, division, and command, dealing with various areas – from security classifications, through defining means for network and physical conduct, to tracking the enemy's intelligence capabilities. "We investigate what the enemy knows about us and how it collects information," explains a source in Machbam, "and protect the IDF's secrets daily." The system excels in protecting "top secret" classified information but encounters significant challenges in the digital space, especially on social networks.
An in-depth investigation conducted after the October 7 massacre revealed that hundreds of thousands of information items reached terrorist organizations in Gaza through platforms like Instagram, Facebook, and TikTok. Information that soldiers published, sometimes inadvertently, damaged operational plans and even endangered soldiers, even if it wasn't classified as top secret. As a result, Machbam is focusing efforts on reducing these damages by reclassifying information whose publication could cause harm – from exposing soldiers' names, which could harm them in international law, through familiarity with commanders that allows disruption of their activities, to information about IDF activities that limits the military's freedom of action.
At Machbam, they say they supervise the official pages of brigades and battalions on social networks, managed with the assistance of the IDF Spokesperson. These pages, according to the Information Security Department, are subject to control by commanders, information security NCOs, and information security officers, and according to them, "most of the content on them complies with the guidelines." However, malfunctions and information leaks sometimes occur. "These platforms allow sharing soldiers' experiences and conveying unclassified messages, but they are not hermetic," the source notes.
Additionally, Machbam claims that the system monitors in real-time, both human and computerized, all content, words, and images, while constantly validating the policy – what is allowed to be published, at what timing, and which images and texts are approved. According to them, many information items that would have been published in the past are now blocked.
IDF soldiers upload 1.5 million photos daily
The main challenge lies in the private accounts of regular and reserve soldiers. Every day, approximately 350,000 soldiers upload over 1.5 million photos, each requiring supervision. Machbam works to implement guidelines, explain what is allowed and what is forbidden, and emphasize the consequences of violations. "We are developing capabilities to monitor open accounts, where the enemy can view the content," explains the source. "In case of a malfunction, we warn the soldier, and in serious cases, we deal with disciplinary measures." In classified locations, phones are prohibited, and in sensitive areas, daily briefings are given, but in combat zones, where the secret is less obvious, the challenge is greater.
Machbam also says the system identifies a decrease in the number of videos from combat zones, indicating an improvement in supervision. In cases of significant violations, such as publishing highly classified information, disciplinary measures are taken in collaboration with commanders. The system is in the process of redesigning its manpower, aiming to increase monitoring and enforcement, while using advanced technologies for more efficient monitoring.
"We work hard, even if it's not always visible," emphasizes the source. "The soldiers in Machbam and the commanders are committed to protecting information, and the exceptions, even if numerous, do not indicate a lack of motivation to maintain information security." The system says that "in an era where every post could become a weapon in the enemy's hands, Machbam continues to sharpen its tools to ensure the IDF's secrets remain protected."
IDF Spokesperson's response
"As part of the lessons learned from the investigations into the events of October 7 and the Swords of Iron War, the Information Security Department is currently undergoing a comprehensive overhaul. This includes the implementation of new protocols across all levels of the military and the establishment of stricter enforcement mechanisms. The aim is to drive a broad cultural shift, making information security a binding operational routine. Information Security personnel are dedicating significant resources to safeguarding the lives of IDF soldiers and the military's classified information, with particular attention to activity on social media platforms."
