Unit 8200: Israel’s Stealthy Sentinel 

1.0 Introduction

Unit 8200 is a Signals Intelligence (SIGINT) unit in the Israeli Defense Forces (IDF). It was originally established as Shin Mim 2 during the 1930s under the British Mandate. Unit 8200 evolved from its modest beginnings into an intelligence and technological powerhouse within the Israeli Defense Forces (IDF). Initially tasked with phone eavesdropping in neighbouring regions, the unit underwent several name changes over the years. These changes reflect its evolving role and expanding capabilities. [source, source]

Unit 8200 is the Israeli equivalent of the US National Security Agency (NSA). Its identity adapted to the shifting landscape of military intelligence. The unit changed named several times from Intelligence Service 2 (S.M.2) to the Central Collection Unit, Unit 515 (“Five and a Quarter”), and later Unit 848 (“Eight Four Eight”). The unit’s strength is estimated at 5,000 individuals [source]. 

2.0 History

2.1 Establishment and Early Years:

Upon its formation in 1952, the Unit embarked on a mission to gather intelligence by intercepting broadcasts, conversations, and deciphering codes. It has achieved notable feats such as decoding the Egyptian army’s cypher during the War of Independence and monitoring discussions regarding armistice agreements. By the end of 1948, a merger between various decryption entities laid the groundwork for Unit 8200. Post-establishment, the unit’s headquarters shifted from Tel Aviv to Jaffa, with strategic listening squads and mobile units contributing to its operations under leaders like Mordechai Almog and Avraham Iloni.

During the War of Independence, the unit relocated to a larger facility in Jaffa. Its size increased to overcome challenges posed by new encryption technologies. In 1953, the unit moved to Glilot Camp and underwent name changes, eventually becoming Unit 515. The acquisition of computational resources like the WEIZAK computer and the establishment of a Mamram unit further bolstered its capabilities. By 1966, reporting and warning centres like “Shofar” were established to enhance preparedness, with similar initiatives like MDAT following in 1967. In the lead-up to the Six-Day War, intelligence collected under Col. Eli Zeira led to significant breakthroughs and contributed to Operation Moked’s success at the war’s onset.

2.2 The Six-Day War:

During the second day of the Six-Day War on June 6, 1967, Unit 515 intercepted a crucial call between Gamal Abdel Nasser and King Hussein of Jordan. In the conversation, Nasser deliberately misled Hussein by claiming that the Egyptian air force had been bombarding Israeli airports continuously. Nasser knew about significant losses his forces suffered the previous day. Nasser aimed to encourage Jordan’s escalation in the conflict, potentially easing Egypt’s situation. At this point, the public were unaware of Israel’s success due to Defense Minister Moshe Dayan’s directive to maintain secrecy.

Nasser proposed a joint statement asserting that the attack involved American and British planes from aircraft carriers in the Mediterranean. Despite objections from Military Intelligence head Maj. Gen. Aharon Yariv, the recorded conversation was broadcasted on Army Radio. The release marked Israel’s first public disclosure of an intercepted conversation. This decision arose from concerns that Egypt aimed to draw the Soviet Union into the conflict and create discord between Nasser and Hussein once their deceit was exposed. Subsequently, interception activities declined as soldiers noted. Post-Six-Day War, the unit assisted Shin Bet in tracking agents transmitting information from Sinai to Egyptian intelligence.

2.3 The Yom Kippur War

The Yom Kippur war is a classic example of intelligence failure. Leading up to the Yom Kippur War, Unit 848 possessed IDF signal intelligence gathering devices in Egypt. These were intended to provide crucial insights into Egyptian intentions regarding war. Major General Zeira, head of Military Intelligence, initially rejected requests from Unit 848’s leadership to activate the devices. Approval was only granted on the morning of October 6, just hours before hostilities began. Decision-makers like IDF Chief of Staff David Elazar and Defense Minister Dayan relied heavily on Zeira’s assessment that war was not imminent, unaware that the devices were not active. Brigadier General Arieh Shalev later claimed that warnings collected on October 4, 1973, didn’t reach the Research Department until three months later.

A telegram decrypted on October 5, just 21 hours before the war, detailed the evacuation of Soviet nationals from Syria and Egypt. The telegram was an unequivocal signal that conflict was coming. However, delays in relaying this warning information hindered its impact. Despite unsuccessful efforts by Unit 848’s commander to convey the imminent threat of war, top military officials were too confident in Military Intelligence. During the war’s initial phase, Syrian forces siezed a unit facility at Mount Hermon. Captured soldiers, including Amos Levinberg, provided sensitive information about the unit to his captors. Following the war, the unit underwent a name change to its current designation, Unit 8200.

2.4 21st Century Developments:

The history of Unit 8200, Israel’s elite intelligence unit, spans several significant events and transformations. In March 2004, post-Iraq war, discussions arose about reorganizing Unit 8200 into a civilian-managed national signals intelligence agency. During the Second Lebanon War, the unit’s involvement in seeking information from the National Security Agency regarding key Hezbollah figures became apparent. Under the leadership of Amos Yadlin, Unit 8200 transitioned to a leading force in offensive cyber warfare. Over the years, it garnered commendations from IDF Chiefs of Staff for its exceptional contributions to security and operational activities. Notably, in February 2018, Unit 8200 played a critical role in thwarting a potential ISIS attack in Australia.

Unit 8200 also demonstrated versatility beyond traditional intelligence tasks. Amid the COVID-19 pandemic, Unit 8200 members helped establish the National Information and Knowledge Center for the Coronavirus Campaign. The unit’s innovative prowess was recognized in February 2021 with the Col. Uzi Yairi Prize for Creative Thinking. In June 2022, revelations surfaced about Unit 8200’s involvement in preventing attacks on Israel’s water systems. However, during the Iron Sword War in 2023, reports emerged of lapses in monitoring Hamas’ communications. In an unfortunate parallel to the Yom Kippur War, assumptions by leadership led to unanticipated attacks despite warnings. [source]

3.0 Organisation

3.1 Structure

Israeli military publications include references to “Unit 8200” as the central assembly unit of the Intelligence Corps, sometimes referred to as the Israeli National SIGINT Unit (ISNU). It is subordinate to the Military Intelligence Directorate AMAN [source].
The unit consists mainly of young men and women between the ages of 18-21 years. Many consider it a prestigious institution whose graduates, upon leaving the service, can leverage their skills for employment in Israel or tech companies in the United States.

3.2 Leadership

Unit 8200 is under the leadership of a brigadier general, whose identity remains concealed during their tenure. Their deputy is usually a lieutenant colonel. They are usually referred to by their rank and a single letter in public statements.

Unit 8200 is one of three parts of the military intelligence directorate. The Units 8200, 9900, and 504 are the three primary units that comprise the directorate. Unit 8200 is the largest of these and serves as the principal information collection unit for the Military Intelligence Directorate. 

Commander:
Name: Brigadier General “Y”

Professional Experience:

Intelligence Directorate, Israeli Defense Forces (IDF) (1997 – Present)

• Served in various capacities, demonstrating expertise in intelligence, cybersecurity, and operations.
• Held positions including Intelligence and Cyber Officer in Unit 8200, Head of Research Division’s Northern Theater. Intelligence Officer in Central Command, and Head of Intelligence Division’s Operations Division.

Education:

• Master’s Degree in Strategy, Security, and Economics, National Defense University, Washington, D.C.
• Bachelor’s Degree in Psychology and Sociology, Bar-Ilan University
• Bachelor’s Degree in Middle Eastern Studies, Bar-Ilan University

[source]

Unit 8200’s legacy extends far beyond its military engagements. Many of its alumni go on to shape the landscape of the global technology industry. Notably, companies like NSO Group, founded by former Unit 8200 members, have gained notoriety for their development of sophisticated software used in cyber espionage, including the controversial Pegasus tool alleged to have been used for surveillance and hacking activities [source].

3.3 Recruitment

While service in the Israeli occupation army is mandatory for most Israelis at the age of 18, everyone is vetted by the IDF as they near high school graduation and Unit 8200 has the right to choose whomever it wants.

Sometimes, the unit begins tracking potential recruits when they are younger, using a school-related program called Magshimim, according to Forbes [source].

“I was very lucky to be in a very unique process and programme …they take young people, they teach them like in university. from morning till very late at night. I learned a lot about where is the best place that I can have the impact I was looking for since I was 13. So I asked to join Unit 8200” 

Yoav Regev, former Unit 8200 member [source]

Recruitment is confidential and there are rigorous interviews, tests and classes – covering everything from communications to electrical engineering to Arabic – which can take more than six months.

Math, computer, and foreign language skills are big pluses, of course, but what the 8200 really strives for is potential measured by the ability to learn quickly, adapt to change, succeed in a team, and tackle what others find impossible[source].

3.4 Training

3.4.1 Popular trainings

Unit 8200 is known, among other things, for the diverse routes that can be found there. Unlike other units in the army, here you can find countless routes. Below are the most sought-after routes:

• Talpiot track – One of the Army’s top programs is this one. Approximately 70 students are accepted annually for this specific course out of thousands of applicants. A double bachelor’s degree in two fields of applicant selection is offered by the program. The following three subjects are your options: computers, physics, and mathematics. The type of service a candidate provides to the unit is up to them if they are accepted into the track [source].

• “Erezim” track – another popular Unit 8200 track that hundreds of young people aspire to each year. Those who are accepted into the program can also obtain a degree here at no cost to the army. Mathematics and computers are the subjects of the dual degree. You have two years to finish the degree. You must be an exceptional math student to be admitted to this unit
  
• The Gama Cyber training track – the primary track of the unit, which most applicants take. Only the chosen elite can access the other ways. The person who visits this route will be sent to several additional internal routes. However, the majority of the positions will be in various sectors collecting intelligence. Each route will use a slightly different methodology to gather intelligence. Seems intriguing? To find out a bit more information about the routes, you will have to visit the unit [source].

3.4.1 Students programs

The Bridges program – initiated by Unit 8200 in collaboration with the IDF, Acre Municipality, and the Ministry of Education, aims to introduce middle school students in Acre to the realms of high-tech and technology. Designed to provide an experiential learning environment, Bridges offers courses covering various technological domains such as web and application development, cyber defense, artificial intelligence fundamentals, and programming basics. Beyond imparting technical knowledge, the program focuses on nurturing essential skills like computational thinking and problem-solving, while bolstering students’ confidence and self-belief. Led by trained NCOs from the Education and Youth Corps, the program emphasizes inclusivity by operating within regular classroom hours, catering to small groups of up to 20 students to ensure personalized attention and effective learning.

4.0 Operations

4.1 Operations Overview

Because of the extreme secrecy surrounding Unit 8200’s operations, neither its political activity nor any associated intelligence operations are formally acknowledged. Reputable sources have, however, mentioned a few operations and activities in passing: 

• One of the largest eavesdropping facilities in the world, “Unit 8200” runs a sizable SIGINT base in the Negev Desert and is able to monitor phone conversations, emails, and other communications throughout the Middle East and Europe, according to a 2010 article in the French journal Le Monde Diplomatique. ship tracking, as well as Asia and Africa.
  
• Unit 8200 also has covert listening posts in Israeli embassies overseas, intercepts undersea cables, keeps covert listening posts in Palestinian territory, and operates Gulfstream jets fitted with electronic espionage gear [source]. 

The interception of a phone call between late leader Gamal Abdel Nasser and late Jordanian King Hussein bin Talal during the early days of the 1967 war, as well as the interception of a phone call between Yasser Arafat and militants associated with the Palestine Liberation Front who were abducted in 1985 while sailing in the Mediterranean waters on the Italian passenger ship Achello Lauro, were two of Unit 8200’s most noteworthy accomplishments, which garnered considerable media attention [source].

4.2 International Operations

The unit participated in international operations, the most famous of which are:

– Informational preparation for the attack on the Iraqi nuclear reactor in 1981:
Unit 8200 played a role in identifying potential sources with access to the reactor construction site and gathering crucial information about the reactor’s plans and layout. Mossad’s “Tsomit” division, which included members from Unit 8200, was tasked with recruiting agents who could provide valuable intelligence. They targeted individuals like an Arab officer studying in Paris and an Italian engineer, exploiting their vulnerabilities and persuading them to provide information about the Iraqi reactor [source].

– Information preparation for attacking the Syrian nuclear reactor project in 2007:
Meir Dagan, the late director of the Mossad from 2002 to 2011, requested more funding from Israeli Prime Minister Ariel Sharon at the same time Ashkenazi did. The request was made specifically for research into the Syrian nuclear project, since Unit 8200 was increasing its surveillance for Communications in Syria [source].

– It is likely that the unit participated in the manufacture of the “Stux-Net” virus.
The famous aim of destroying the centrifuges of the Iranian nuclear program. In a joint operation with the CIA and Mossad [source]. 

4.3 Social media propaganda

After the October 7 war, investigations dug deeper into the activities of this unit and claimed that, by using Israeli names and accounts connected to the Israeli intelligence community, which identify with Arab tweeters, electronic fly committees were established.

The unit is targeting Hamas; some have claimed this is because of Saudi accounts; yet, Israeli leaders are the ones who are denouncing Hamas and agitating public sentiment against it.

Conversely, there are Saudi voices who seem to be advocating for an end to identification with mass media campaigns, rejecting any attempts to incite conflict, particularly between Saudis and Palestinians, and cooperating to expose false reports.

The accounts initiated a methodical campaign against the Hamas movement and the Palestinian resistance in general. While some of these accounts concentrated on denouncing what they dubbed “targeting Israeli civilians,” others offered the same Israeli narrative and replicated Zionist language and sentiments. They also referred to some of these accounts as “Zionist Saudi Arabia.”

Additionally, they tweet in a terrible Saudi accent that is inconsistent with their purported Saudi identity, all the while perpetuating the same story that sows division among the Arab world’s peoples.

Two of the most well-known accounts that propagate conflict are “The Palestinians No Context” and “My Blood is Palestinian.” Both of these accounts post content that is similar to this and implies that the Palestinians despise the Gulf and refuse to assist it.

Investigations claim that the two accounts connected to the account of journalist Eddie Cohen. Within a 100-day period, “Cohen” retweeted ten times from the “Palestinians no context” account [source].

4.4 After the 7th of October

4.4.1 Initial Responses and Factional Disagreements

Four past unit commanders met early on October 8 at the current commander’s request. The discussion lasted for several hours and ended with a noticeable rift amongst the participants.

“[October 7 was] An egregious failure that transcends mere oversight, a catastrophic lapse in judgement and responsibility, indicative of personal, even criminal negligence on the part of ‘Y’ and senior officers”

Unnamed Official [source]

The opposing faction cautioned against jumping to conclusions and provided an alternative viewpoint. “To single out ‘Y’ for blame is to misunderstand the nature of the failure they’re confronting,” the argument went.

4.4.2 Launch of Internal Investigations

Soon after the events of October 7, ‘Y’ moved swiftly, selecting Dani Harari to head an extensive investigation into the events leading up to that day. The investigation produced a report that attempted to absolve ‘Y’ of direct responsibility while bringing to light important systemic problems. [source].

After the meeting on the morning of October 8, Y. the commander decided to set up an inspection team immediately. He chose one of those present, Danny Harari, to head it. Harari was commander of 8200 from 2004 to 2009. He was the oldest commander in the room [source].

The internal investigations into the events of last October 7, when Hamas launched a surprise attack on Israel, have been committed to Unit 8200 in Intelligence, according to Israeli Army Chief of Staff Herzi Halevy. These investigations will encompass all military leadership. Approved is the internal inquiry. by the military intelligence chief.

Even though the army was still in combat, Halevy informed army leaders in a letter that inquiries would soon start.

4.4.3 Comprehensive Investigation Initiatives

Halevy addressed the leadership problems in the midst of a protracted conflict in a summary document he released on Tuesday. He praised the army’s change from losses to attacks and surprise, eventually reaching achievements.

Actually, the Israeli Military Intelligence Division’s Unit 8200 started gathering information regarding the series of events leading up to the Hamas strike. Unlike earlier plans, the investigation will be led by existing army officers rather than a group from outside the organisation.

Brigadier General Y., the Commander of Battalion 8200, started the investigation, which focuses on the biggest intelligence failure in the State of Israel’s history since its founding. By some metrics, the failure is more serious than the intelligence failure during the Yom Kippur War in 1973. [source]

Leading the inquiry team of the General Staff is Yoav Har-Even, a major general reserve officer, who will collaborate with the Military Advocate General throughout the process.

As part of his inquiries into the conflict and the events leading up to October 7, State Comptroller Netanyahu Engelman also plans to look into officials in the police, army, and Shin Bet.

Documents showing the handling of the incident by the army, police, and Shin Bet— including the mobilization of reserve personnel, deployment of forces, and media engagement—were to be collected and submitted to the State Comptroller’s Office[source].

4.5 Investigation into Intelligence Failure

On September 2023, a subordinate Israeli officer in the 8200 intelligence unit alerted her superiors about Hamas’s planned mass infiltration event. Leadership disregarded her warning. The officer said that during the previous 12 months, they have been warning about a scenario that they believed involves a large incursion event by Hamas, which is similar to what happened on October 7. Her commanders turned to face her, but they made no move. Her leaders told her that, “you are imagining it,” according to N12. [source].

On October 16, 2023, Channel 12’s Weekend News segment presented recent testimonies from female observers stationed near the Gaza border. According to the observers, they cautioned for months about developments they saw in the field that raised red flags. [source].

High officials did not receive a large amount of intelligence data in real time on the day the war started. To expedite the process of entering and transferring information to individuals who submit the material to top authorities after reviewing it, the cyber and intelligence units, specifically 8200, have been working on updating the information systems in recent months.

Due to a two-year-old decision to cut staff and suspend activities overnight and on weekends, the military’s renowned 8200 signals intelligence unit was not active near the Gaza border on the morning of 7 October  [source].

4.6 Artificial Intelligence

4.6.1 Unit 8200’s AI Utilization

Unit 8200 uses an advanced AI system, known as the Gospel, to scrutinize “communications, visuals, and information from the internet and mobile networks to ascertain individuals’ whereabouts,” according to Reiter, a former Unit 8200 operative. He explained that Unit 8200 assesses the confidence level regarding targets, gauging the likelihood of civilian presence. Although Reiter refrained from commenting on potential errors with the Gospel, he emphasized the accuracy of Israeli targeting systems, aiming solely to minimize civilian casualties.

However, experts caution against the employment of AI targeting systems due to the historically high error rates associated with AI. Heidy Khlaaf, an engineering director specializing in machine learning at the UK-based cybersecurity firm Trail of Bits, argues that automated targeting, prone to imprecision and bias, closely resembles indiscriminate targeting.

4.6.2 AI in Military Strategy

The Israeli military’s strategy revolves around numerous data and artificial intelligence programs, crucial for achieving success on the battlefield. These programs process vast amounts of sensor data, transforming it into actionable intelligence. Spearheaded by former Chief of Staff Aviv Kochavi, the IDF’s comprehensive digital transformation includes a centralized artificial intelligence department. This department oversees various scenarios, including data collection from diverse platforms, real-time threat assessment, and decision-making support, culminating in a unified depiction of the Israeli armed forces.

Central to this strategy is the use of artificial intelligence, particularly through the Gospel program, aimed at enhancing effectiveness and efficiency amidst multifaceted challenges and threats. By harnessing AI, the Israeli military aims to:

• streamline intelligence collection
• bolster autonomous operations
• minimize human casualties, particularly in ground operations

One notable AI tool utilized is the “Fire Factory” model, which processes vast amounts of data to identify targets for airstrikes and suggests schedules, ammunition loads, and target priorities for thousands of aircraft and drones.

Since the military escalation in October 2023, the Israeli military has leveraged AI in bombing operations. The IDF claims it conducted over 15,000 targets affiliated with Palestinian organizations in the Gaza Strip. The process involves automated systems analyzing intelligence data in collaboration with various branches of the military [source].

Conclusion

As Unit 8200 stands at the nexus of technological advancement and military intelligence. However, its trajectory into the future embodies both promise and challenge. The evolution of Unit 8200, from its humble origins to its current status as a global powerhouse, underscores the pivotal role of cyber operations in shaping modern warfare and national security. With a focus on signals intelligence (SIGINT), cyber warfare, and clandestine operations, Unit 8200 exemplifies the fusion of human expertise and AI capabilities, demonstrating the potential for AI to revolutionize intelligence gathering and defense tactics.

However, recent events, such as the intelligence failure preceding the Hamas attack, highlight the complexities and risks of AI-dependent systems. The case underscores the imperative for ongoing vigilance and adaptation in the face of evolving threats. As Unit 8200 navigates the intersection of AI and national security, its legacy serves as both a testament to the transformative power of technology and a cautionary tale of the need for responsible stewardship in an increasingly AI-driven world.

Frequently Asked Questions (FAQ) 

1. What does Unit 8200 do?

Yehida shmone matayim, or “Unit eight two-hundred,” is the Hebrew name for Unit 8200. The unit is an Israeli Intelligence Corps unit of the Israel Defense Forces that is in charge of:

• carrying out covert operations,
• gathering signal intelligence (SIGINT)
• deciphering codes.

They also conduct counterintelligence, cyberwarfare, and otherwise support military intelligence [source].

2. IS there a unit 8200 installation near Urim?

The Israeli information collection facility known as Urim SIGINT Base is purportedly a component of Unit 8200. The facility is in the Negev desert, approximately 30 kilometers north of Beersheba. The facility received attention after press coverage in 2011 [source, source].

3. What companies did Unit 8200 veterans found?

Former members of Israel’s renowned Unit 8200 Intelligence unit founded highly successful cybersecurity businesses. These include Check Point, Forte, Armis Security, Guardicore, and Wiz. Unit 8200 alumni also founded NSO group, who created the controversial Pegasus spyware [source].

4. Who was the director of Infosys from Unit 8200?

Uri Levine

The Israeli businessman Uri Levine was on the Infosys board of directors. Levine served in the elite Israeli army cyberwarfare division Unit 8200, which eavesdrops on the nation’s enemies  [source].