Unit 910: Hezbollah´s Covert Action Unit


    1.0  Introduction

    The External Security Organisation (ESO), most known as Unit 910, and sometimes referred to as the Islamic Jihad Organization (IJO), is Hezbollah´s clandestine black-ops branch and intelligence wing (source). Unit 910 is an elite and highly compartmentalised unit responsible for overseas terrorism operations, mainly against Western targets and Israel. The unit therefore acts as a long-range strategic arm of Hezbollah and Iran.

    Unit 910 operates throughout Lebanon with relative impunity and has also worked with Iranian officials to provide training and other military support to Shia militants in Iraq, Syria, and Yemen. The ESO reports directly to Hezbollah’s leader, Hassan Nasrallah, which Iran controls to a significant extent. 

    Unit 910 has conducted operations worldwide and operates in many Western countries, including the United States and Canada. The US State Department and more than 60 other countries and organizations, including the EU, the Arab League, and the Gulf Cooperation Council, have designated the group as a foreign terrorist organization.

    This article analyses this organisation, paying particular attention to its history, structure, recruitment, capabilities and tactics.

    2.0 History

    The ESO dates back to the summer of 1982, when Hussein al-Khalil, now ‘one of Nasrallah’s top political advisors’, created Hezbollah’s Special Security Apparatus. He also acted as the operational coordinator of its military units in cooperation with Islamic Amal. Iran’s Quds Force, one of five branches of Iran’s Islamic Revolutionary Guard Corps (IRGC) specializing in unconventional warfare and military intelligence operations, initially managed Hezbollah’s counter-intelligence. The Special Security Apparatus continued to grow throughout the 1990s. By 2008 Hezbollah had gained complete dominance over the official Lebanese state counter-intelligence apparatus, which now constituted a Hezbollah asset for counter-intelligence purposes. This close connection with Lebanese intelligence helped strengthen Hezbollah’s financial counter-intelligence unit.

    According to Ahmad Hamzeh, Hezbollah’s counterintelligence service is divided into two branches. The first is Amn al-Muddad, responsible for ‘external’ or ‘encounter’ security. The second is Amn al-Hizb, which protects the integrity of the organisation and its leadership. According to Wege, Amn al-Muddad may have received specialised intelligence training in Iran and possibly North Korea. The organisation also includes a military security component, as well as an External Security Organisation (al-Amn al-Khariji or Unit 910) that operates covertly outside Lebanon.

    (Source), (source)

    3.0 Organisation

    Due to its secretive nature, not much information is available on the organisational structure of Unit 910. What is known is that it is composed of specialised units, operating jointly from administrative and operative aspects, and is strictly compartmentalised from all other units within the organisation. The ESO is part of the Military and Security Apparatus of Hezbollah and, therefore dependant on the Security Organ of the party. However, it is likely that Unit 910 acts independently, and often works with different sections of the organisation (source).

    Organisational chart of Hezbollah.

    A small group of operatives, mainly Lebanese Shiites, make up Unit 910. Some of them hold authentic foreign identity documents, enabling them to travel across the world under false identities and cover stories. Unit 910 establishes ties with elements who support Hezbollah and uses these elements for logistic and operational purposes. Hezbollah’s leader, Hassan Nasrallah, directly controls the unit, which reports to him and operates under Iranian control.

    (Source), (source), (source)

    3.1 Place within Hezbollah

    Since it entered the Lebanese parliament in 1992 and into government in 1995, Hezbollah has sought to reinforce its public image as a respected resistance movement and change its reputation as a terrorist group. This has resulted in the ESO operating independently from its parent body. This also reinforced Hezbollah’s need to distance the organisation from any activity that could be construed as terrorism. Consequently, Hezbollah is unlikely to claim responsibility for a terrorist attack or acknowledge ESO activities.

    Traditional activities demonstrate that ESO maintains its separate terrorist function within Hizbollah’s overall organisational structure. However, the ESO’s role appears to have shifted in recent times to a more intelligence-focused role.

    (Source), (source)

    3.2 Financing

    Due to its highly secretive nature, little is known about the funding of the ESO, as it is distinct from the recruitment and funding for Hezbollah in general. However, much of its budget likely comes from Hezbollah. Hezbollah in turn obtains its funds in two main ways. The first is through illicit activities in various regions, such as the Tri-Border Area in South America, and the second through Iran (source).

    3.3 Key Figures

    Given the nature of the organisation, it is difficult to know its membership and its responsibilities. Nonetheless, several key Unit 910 officials are known to the public:

    • Hashim Safi al-Din: Head of the Executive Council, which oversees Hezbollah’s foreign relations department, media, social services, and other programs to garner Shia support. It is Nasrallah’s designated successor.
    • Talal Hamiyah: Commander and head of Unit 910. Responsible for planning and executing Hezbollah’s terrorist activities outside of Lebanon. Connected to Hezbollah’s biggest terror attacks.
    • Khaled Qassem: Deputy commander of Unit 910. Responsible for all the logistics and operational spheres concerning the ESO, including spotting, running security checks, recruiting operatives, basic training, and appointment to functions in the ESO. Because of his high rank and sensitive position, it is known that he oversees the strategic ties with Iran, particularly with the Quds Force, and he frequently travels to Iran.
    Talal Hamiyah
    Talal Hamiyah: Commander and head of Unit 910.

    (Source), (source), (source), (source)

    3.4 Recruitment

    Unit 910 has collaborators or facilitators abroad. Most of these local facilitators, or agents, come from Lebanese families who emigrated from Lebanon years ago. Others are natives who have converted to Islam or Shia Islam and are eager to contribute to the ‘fight’, although they accept the risks involved in supporting a terrorist organisation. It is believed that the ESO values recruits with dual citizenship, and who have access to passports from Western countries (source).

    Recruits are taken to training in vans with tinted windows and their heads are covered to prevent any leakage of information about ESO methodology. The idea is “the less you know, the better”.

    The Kourani Case

    One case that illustrates Unit 910’s recruitment method is the case of Ali Kourani. Kourani was born into a Lebanese family clan that he once described to FBI agents as “the Bin Ladens of Hezbollah”. In unclear circumstances, he entered the US legally from Cyprus in 2003, probably applying for refugee status to obtain permanent residency. Hezbollah Unit 910 recruited Kourani in 2008, the first year he could apply for US citizenship, through a well-placed relative, Sheikh Hussein Kourani, during a trip to Lebanon. One of Kourani’s first tasks was to submit a citizenship application required to travel freely abroad on behalf of Unit 910. According to Kourani, he also received initial training in camouflage and espionage techniques. In July 2011, Fadi summoned Kourani to his country for more and better weapons training.

    Kourani was taught to communicate with his handler (Fadi) using an old pager system and seven disposable email and Facebook accounts. Kourani’s father, Muhammed Kourani, and brother, Moustafa Kourani, were connected. When Kourani arrived in Lebanon to learn about his activities in the United States, he would send pager codes to Fadi, who would contact his brother’s or his father’s mobile phone within 48 hours to arrange a meeting. Support for Hezbollah was a family affair, with Kourani identifying his brother as a ‘member’ of Hezbollah, and his father as ‘close’ to known Hezbollah associates.

    (Source), (source), (source)

    3.5 Training

    Until formally authorized as operatives, the members of this unit undergo a lengthy and intricate process of security training. The training is divided into military, intelligence, and ideological categories and takes place in camps in Lebanon, lasting an average of 6 years. Ideological training lasts 6 days, while the remaining training period is dedicated to weapon and explosive handling and intelligence tradecraft. Training camps have the capability of holding field exercises. This makes Hezbollah’s black ops capable of carrying out simultaneous training of multiple operatives. 

    Military training includes extensive experience in explosives as well as weapons handling, with drills completing the period. Operatives are taught how to produce and handle explosives like Ammonium Nitrate, as well as training to avoid law-enforcement attraction in gathering needed supplies. Weapons handled include small arms, submachine guns and shoulder-fired rocket-propelled grenade launchers in military drills. Altogether this makes Hezbollah’s black ops operatives experienced in sabotage operations.

    Intelligence tradecraft is taught through:

    • Surveillance
    • Counter-surveillance 
    • Communication. 

    Training also includes enduring interviews with “foreign intelligence agents”. Agents learn to take photographs and videos without drawing public attention. Operatives gain experience by conducting surveillance on Israeli troop movements in Southern Lebanon and providing intelligence on patterns, behaviours, and vulnerabilities. Additionally, instructors teach operatives communication methodologies through email, using coded messages sometimes labelled as ‘spam’ to convey instructions.

    (Source), (source), (source), (source), (source), (source)

    3.6 Connections to other important organisations

    Its links to other terrorist organizations, distinct from Hezbollah, are little known due to the highly secretive nature of the ESO. Elements of the organization, through Hezbollah, have known links to Iran through the Iranian Quds Force. The Quds is one of five branches of Iran’s Islamic Revolutionary Guard Corps (IRGC) (source). They are known for training and providing material to Hezbollah. Other state allies include Syria, Iraq (formerly: in the war against IS), Lebanon (partially) and Russia (in the Syrian civil war). The unit may also have had contacts with the PMC Wagner Group in Syria (source).

    Hezbollah elements have also provided training, operational support and material to Palestinian extremist groups, including the Palestinian Islamic Jihad and Hamas’s Izz al-Din al-Qassam Brigades, as well as to Shia militia elements in Iraq (source). While Hezbollah denies it, the unit may have had involvement in the Yemen war, providing aid to the Houthis (source).

    (Source), (source), (source), (source)


Descripción generada automáticamente
    Iranian Partners, Proxies, and Affiliates in the Middle East. Source: Iran Military Power, Defense Intelligence Agency. 2019.

    4.0  Tactical-Operational Information

    4.1  Operations

     Terrorist Attacks

    The ESO is connected to numerous terrorist attacks in various parts of the world. Some of the best-known are (from most to least recent):

    18 JULY 2012 

    Burgas, Bulgaria

    • Bombed a bus carrying Israeli tourists, killing six people and injuring 33.

    14 FEBRUARY 2005

    Beirut, Lebanon

    • Conducted a VBIED attack, killing a former Lebanese prime minister and 21 others and injuring 226 people.

    18 JULY 1994

    Buenos Aires, Argentina

    • Bombed the Jewish community centre AMIA with a van carrying explosives, killing 95 people and injuring more than 300 others (source).

    17 MARCH 1992

    Buenos Aires, Argentina

    • Attack on the Israeli Embassy with a truck laden with explosives. The Embassy was destroyed resulting in 29 people dead and 242 injured (source).

    14 JUNE 1985

    Athens, Greece

    • Hijacked Trans World Airlines (TWA) flight 847, held dozens of US passengers hostage and killed one, a US Navy diver.

    20 SEPTEMBER 1984

    Beirut, Lebanon

    • Bombed the US Embassy Annex, killing 23 people, including 2 Americans.

    23 OCTOBER 1983

    Beirut, Lebanon

    • Bombed the US Marine Corps barracks, killing 241 Americans and injuring 70.

    18 APRIL 1983

    Beirut, Lebanon

    • Bombed the US Embassy, killing 78 Americans and injuring 120.

    (Source), (source)

    Overview of the AMIA bombing, Buenos Aires, July 18, 1994.

    Other Activity

    Other activities related to the preparation and planning of terrorist acts attributed to the ESO include:

    • In June 2017, two men were arrested in the US for undertaking terrorist activities on behalf of the ESO. The men were allegedly involved in planning and supplying material support on behalf of the ESO for attacks against Israeli and US targets. Both men had also allegedly received training from ESO. 
    • In August 2015, the Kuwait Security Service arrested up to 26 members of the Al-Abdali terror cell for stockpiling munitions and armaments on behalf of Hezbollah. 
    • In January 2016, twenty-three members of the cell were found guilty of intent to carry out hostile acts against Kuwait. The methodology, including stockpiling of explosive components in preparation for hostile acts outside of Lebanon, is consistent with ESO operational methods. 
    • In July 2015, Cyprus jailed an ESO operative, after he pleaded guilty to stockpiling explosive materials. 
    • In May 2015, Cypriot authorities uncovered an ammonium nitrate cache partially in the form of first aid cold packs maintained under ESO direction. The cold packs in Cyprus were similar to those previously used in suspected ESO operations.


     4.2 Core Purpose

    The ESO is a discrete branch or entity within Hezbollah, responsible for procurement, intelligence, counterintelligence, surveillance, planning, coordination and the execution of terrorist attacks against Hezbollah’s enemies outside of Lebanon. Unit 910 therefore functions as Hezbollah’s covert foreign intelligence and operational branch. In addition, it has transcontinental and penetration capabilities in both licit and illicit environments. Unit´s 910 purpose is also to serve as a deterrent against the West and Israel in particular.

    (Source), (source)

    4.3 Tactics

    ESO tactics in operational, intelligence and counter-intelligence capabilities focus on areas outside Lebanon and the Middle East. Unit 910 deploys operatives who blend into communities and maintain covert histories while being managed by a controller. Their frequent travels abroad are explained away to their family members, neighbours, and friends as regular business trips. 

    Historically, a classic Hezbollah modus operandi is to recruit, train and dispatch dual nationals to carry out missions outside Lebanon. Having operatives who can travel on their legitimate non-Lebanese passports provides them with excellent cover and usually means that the operatives also have a legitimate passport and speak foreign languages (source). As opposed to other religious Lebanese Shiites, the operatives who travel abroad shave their beards, do not visit mosques, and consort with local women in the areas where they carry out their missions.

    The ESO´s mission has traditionally been identifying human and physical targets and hitting them. However, in recent years there has been an operational shift, with the group’s covert operations towards gathering intelligence, rather than strictly carrying out attacks. To avoid law enforcement, the unit favours compartmentalisation of its black operations. Both recruits and trainers are given false identities and nicknames. 

    (Source), (source), (source), (source)

    5.0 Equipment

    According to former agents’ testaments, some of the weapons used in training included:

    • Glock pistols.
    • Semi-automatic rifles, such as an MP-5.
    • AK-47 and M16 assault rifles.
    • Russian-made PKS belt-fed machine gun.
    • RPG-7 shoulder-fired grenade launchers.
    • Explosives, including C4.

    (Source), (source)

    6.0 Future

    We are confident that the future of Unit 910 includes:

    1. ESO will likely focus on intelligence collection and irregular warfare.
    2. ESO will likely continue to operate as a strategic arm of Iran.
    3. ESO will likely focus on assisting other Shia militias in the region.

    Unit 910, or ESO, is and will remain Hezbollah’s elite. Therefore, Unit 910 is likely to continue to use the same tactics as they have proven to be highly efficient. Its highly compartmentalised organisation is likely to be maintained and reinforced to avoid capture and continue its activities with impunity.

    However, as has been observed in recent years, the unit seems to have shifted its strategic focus from terrorist activity to intelligence gathering. This change in strategy may be due to Iran’s intention to gather intelligence to destabilise its enemies, as terrorism against Western targets is often counterproductive. The unit is therefore likely to continue to act as a long-range strategic arm of Hezbollah and, more importantly, Iran. This way, Iran has plausible deniability and is spared the need to intervene directly in foreign conflicts. It is also likely that Unit 910 will focus on collaborating with other Shia militias in the region to advance its cause in the region and take control of other local and national actors.

    7.0  Conclusion

    Unit 910, or ESO, is Hezbollah’s elite. Its covert operations and intelligence capabilities have made it a formidable enemy for intelligence and law enforcement services worldwide. Unit 910 has proven itself capable of standing up to stronger and more prepared opponents. It also appears to be becoming a ready and astute source of intelligence. While its terrorist activity has been considerably reduced recently, its new focus on acquiring intelligence appears to pose an even greater challenge to Western forces. Through the unit, Iran is gaining strength in the region and leverage over several countries, especially Lebanon. It is therefore logical that the unit will continue to pursue its tactics and objectives, which means that the US, Israel and their allies must work harder to prevent its progress.

    Javier Sutil Toledano
    Javier Sutil Toledano
    Javier is an Intelligence Analyst specialising in South America, Central America and the Caribbean. He graduated in Philosophy, Politics and Economics, with a minor in Peace and Conflict Studies. He recently graduated from an International Master's Degree in Security, Intelligence and Strategic Studies.

    Table of contents


    Get the weekly email from Grey Dynamics that makes reading intel articles and reports actually enjoyable. Join our mailing list to stay in the loop for free!

    Related contents

    Subscribe to our Newsletter!
    I agree to receive the latest emails
    and offers from Grey Dynamics.
    not Information
    Subscribe Now
    Subscribe to our Newsletter!
    I agree to receive the latest emails
    and offers from Grey Dynamics.
    not Information
    Subscribe Now
    Learn to create professional videos and have fun in the process of creating videos.
    Video Review And Collaboration.
    Get Started