Hamas terrorists used emojis they sent via WhatsApp to communicate with each other in encrypted form during the night between October 6 and 7, 2023. The emojis – primarily hearts and stars – were designed to signal to the terrorists that the time had come to launch the attack on the Gaza Division (IDF unit defending the Gaza border), and that they needed to report to specific assembly points.
The practice was discovered by Military Intelligence only in hindsight, after analysts examined thousands of captured phones containing WhatsApp messages sent in Gaza during the critical night preceding the surprise attack.
In an investigation conducted by Military Intelligence in the weeks following October 7, it emerged that during the night before the attack, Hamas operatives, including Nukhba terrorists, sent numerous messages to each other featuring various emojis such as hearts, stars, and flowers. The emojis were embedded in seemingly innocent text messages and, on the surface, did not raise suspicion and were therefore not scanned in real time. Only after the surprise attack, when the phones were seized and hundreds of WhatsApp messages sent during the night of October 7 were examined, did it become clear that many of them contained the same emojis.
After this vast amount of information was deciphered, Military Intelligence reached the conclusion that the emojis actually constituted a pre-established encrypted code, designed to convey a message to Nukhba terrorists that the attack on the Gaza Division was launching that night. For example, sending a heart may have conveyed to the recipient that they needed to report to a specific mosque, and so forth.
According to a former senior Military Intelligence official, the increased use of these emojis could not have been detected in real-time. "It depends on what the intelligence picture was that night, but basically WhatsApp is not something like SMS messages, because it's an application with encryption," the official explained. "This is information that's difficult to bring in real-time."
Additional information deciphered only in hindsight, related to what Military Intelligence calls "intelligence without content". The reference is to the volume of communications traffic conducted within a specific organization or territorial cell, without examining the content of the information itself. "You admittedly don't see content, meaning what Hamas operatives are talking about among themselves, but you do see the volume at which they're communicating," explained a source familiar with the details. "This is a basic indicator that if you just check it, you see that relative to an average night, on October 7, something suspicious is happening. This is exactly the additional suspicious sign that the entire Shin Bet and Southern Command are waiting to hear from Military Intelligence during the night."
In this case, too, only in hindsight did Military Intelligence discover that the volume of communications traffic within the Gaza Strip, and especially among Nukhba operatives, was elevated on the night of October 7. Although Military Intelligence did not sound alarm bells, the Shin Bet and the command would not relent. "The command throughout the entire night is the most active body in the security system, together with the Shin Bet," said a source involved in the details. According to another source, Southern Command is also pushing to wake the Chief of Staff, Lt. Gen. Herzi Halevi, from his sleep.
Halevi's liaison, in routine and in emergencies, is the Chief of Staff's bureau chief, Lt. Col. Matan Feldman. Feldman received an initial update on the night's events around 1:00 a.m., and spoke with the Shin Bet and Southern Command chief Yaron Finkelman. Only around 3:30 a.m. did Feldman decide to wake Halevi.
