What happened to the Shin Bet on Oct. 7?

Itay Ilnai

---

Shin Bet Director Ronen Bar (right) attends a state ceremony at the Mount Herzl Military Cemetery in Jerusalem marking the Hebrew calendar anniversary of last year’s Hamas-led terrorist invasion, Oct. 27, 2024. Photo by Chaim Goldberg/Flash90.

At around 5 a.m. on Saturday, Oct. 7, 2023, the operational phone of Ch. Insp. Arnon Zamora, rang. On the other end was a senior officer from the Border Police’s Yamam National Counter-Terrorism Unit. “The Shin Bet has detected something in Gaza,” he said. “Get ready.”

Zamora, who was at the unit’s base not far from Jerusalem, where he was commanding an alert team, wasn’t told to hurry. The only information he received was to head to the Gaza periphery and take up an alert position. “We’re going to the south for the weekend,” he told his team. “Take sleeping bags with you.”

According to a testimony obtained by Israel Hayom, Zamora’s team set out after 6 a.m. and headed to Kibbutz Yad Mordechai, where they were supposed to meet representatives from the Shin Bet’s operational unit. Such an alert, known as a “tequila,” is common between the Shin Bet and Yamam and is used when intelligence is received about a possible terrorist attack in the near future.

However, Zamora, experienced in such missions, quickly understood that there was only a vague suspicion that Hamas was planning a limited infiltration attack into Israel. The Shin Bet had no further details.

Israel Border Police Chief Inspector Arnon Zmora. Credit: Courtesy.

‘We failed to provide sufficient warning’

The rocket barrage caught the Yamam team on their way. Even when they arrived at Moshav Mavki’im, a five-minute drive from Yad Mordechai, more precise intelligence failed to arrive. It was only when a panicked civilian, driving a bullet-riddled car, passed them and reported a confrontation near the city of Sderot, that Zamora understood for the first time that terrorists had crossed the border.

The small and elite “tequila” team—about 15 fighters—began racing south on Route 4 toward Sderot. Zamora’s vehicle, which was towing an equipment-laden trailer, was relatively slow and brought up the rear of the convoy.

When they reached the Yad Mordechai Junction, intending to turn left to Sderot, Zamora noticed several motorcycles parked on the side of the road. He assumed they were Israeli riders seeking shelter from the ongoing rocket fire. Only after a rocket-propelled grenade hit his vehicle did he realize that these were terrorists. It was 7:10 a.m.

In the battle that ensued at the Yad Mordechai Junction, Zamora’s team killed more than 10 Hamas terrorists. They then proceeded south toward the Erez Crossing to the northern Gaza Strip, where they encountered two trucks full of terrorists, whom they also neutralized.

In hindsight, it became clear that Hamas had planned to seize the Yad Mordechai Junction, and from there, move forces north toward the cities of Ashkelon and Kiryat Malakhi. The defense mounted by Zamora’s team completely disrupted this plan.

From Yad Mordechai, the team continued in a jeep riding on its rims because of flat tires to the IDF’s Nahal Oz outpost, where they participated in its clearing. The team kept moving south, still on the rims, and was among the first to enter the terrorist-occupied Kibbutz Be’eri. During the long day of combat, several of the team members were wounded.

Zamora would be killed seven months later in an operation to rescue four Israelis taken hostage into Gaza.

The story of Zamora’s team’s battle on Oct. 7, 2023, is not only a testament to extraordinary bravery but also to the complete intelligence failure of the Shin Bet that day. It turns out that even after the surprise attack began, the Shin Bet had no clue what Hamas was planning or what was happening on the ground. The intelligence body responsible for preventing terrorism from Gaza (alongside the Military Intelligence Directorate), which has been in a fierce struggle with Hamas for nearly 40 years, suffered a crushing defeat.

“We failed to provide sufficient warning to prevent the attack,” Shin Bet director Ronen Bar wrote in a letter to service personnel and their families shortly after the failure. Several months later, A., the Shin Bet’s southern district head, resigned from his position.

Firefight with Hamas. Photo by Oren Ben Hakoon.

‘How could he not see what was happening?’

Currently, the Shin Bet is conducting internal investigations to determine the causes behind the success of the Oct. 7 terrorist attacks and the difficulty in detecting them in advance. This comprehensive investigation is in the process of examining all relevant units and includes a review of long-standing operations against terrorists in Gaza, research approaches, and decision-making processes in the days and nights leading up to the massacre.

The investigations point to several key issues. For example, Hamas’s “Al-Aqsa Flood” plan, which was well-known within the Shin Bet, did not receive proper attention. Additionally, agents working for the agency in the Strip communicated with their handlers during the night of Oct. 7 but either misled them or simply did not know about Hamas’s attack plans. Investigations also reveal that the Shin Bet’s Southern District was unaware of the Supernova music festival, which took place right along the Gaza border.

Another interesting finding in the investigations concerns the timing of Hamas’s decision to launch the surprise attack. It is believed that Yahya Sinwar and a small circle of associates made the fateful decision in the days leading up to the attack. This alone made it especially difficult for the Shin Bet to detect Hamas’s plans early.

More than a year after the war began, the Shin Bet’s investigations—while the agency works tirelessly in Gaza, Judea and Samara, and other theaters, this time with impressive success—are still ongoing. Even now, the agency does not fully understand what went wrong, and it is not alone.

“I can’t understand why Ronen Bar decided what he decided that night. I just don’t get it!” said a very senior former Shin Bet official angrily. “I just can’t wrap my head around it; how could he not see what was happening right in front of him?”

In recent months, this writer has spoken with current and former Shin Bet officials and intelligence community sources in an attempt to answer this very question. This investigation reveals the Shin Bet’s long-standing difficulty in gathering intelligence from Gaza, the dynamics of the months leading up to the surprise attack that left the agency in the dark, and the chronology of that fateful night, when the agency faced an adversary who outwitted it and left it exposed.

“The Shin Bet bears significant responsibility for the failure,” said a former agency official with sorrow. “I don’t know how they manage to sleep at night.”

Parallel tracks

In September 2023, the tango between the Shin Bet and Hamas reached a boiling point. During this period, the two organizations operated against each other on parallel tracks that were clearly never meant to meet.

Since the beginning of 2023, the Shin Bet and Hamas have engaged in persistent negotiations. Hamas, which had restrained itself for two years in the face of Israeli military operations in the Gaza Strip, seemed at that time to be making genuine efforts to reach agreements with Israel regarding the release of two soldiers’ bodies and two Israeli civilians held captive.

After Yaron Blum, the government’s coordinator for the talks, finished his term in October 2022, the Shin Bet took control of the negotiations with Hamas, which were conducted well under the public radar. The agency even compiled a list of Hamas prisoners who could be released as part of a prisoner exchange deal that seemed within reach.

However, at the same time, the Shin Bet and Hamas were also operating against each other in more familiar areas—terrorist attacks and their prevention. In the two years leading up to the surprise invasion, and in parallel with the talks, Hamas’s “West Bank headquarters,” which operated out of the Gaza Strip and was made up of former prisoners released in the 2011 Shalit deal, managed to carry out an increasing number of deadly terrorist attacks.

These attacks, though directed from Gaza, struck at the soft underbelly of Israel. In June 2023, the “West Bank headquarters” carried out a shooting attack at the gas station in Be’eri, where four Israelis were murdered. Shortly thereafter, another shooting attack took place, in which kindergarten teacher Batsheva Nigri was killed. Other attacks directed by the “West Bank headquarters” also claimed Israeli lives. Bar was determined to put an end to this.

Israeli forces in the Gaza Strip. Credit: IDF Spokesperson’s Unit.

In early October 2023, during a security meeting attended by Prime Minister Benjamin Netanyahu, Bar presented a detailed plan for a preemptive strike in Gaza, aimed at the leaders of the “West Bank headquarters.” The goal was not only to disrupt the capabilities of the group but also to send a message to Hamas that Israel’s restraint regarding terrorist attacks in Judea and Samaria had ended. Bar also presented the Shin Bet’s operational readiness for targeted killings of “the ace and the king,” code names for Sinwar and Mohammed Deif.

Netanyahu listened attentively but did not approve the strikes. Less than a week later, the heavens fell.

Deceptive calm

The Shin Bet’s insistence on initiating action against Hamas in Gaza did not originate in that meeting. Already during Nadav Argaman’s tenure (2016–2021) as head of the agency, he repeatedly raised in Cabinet discussions his desire to strike Hamas in Gaza with a preemptive blow. Argaman even prepared an operational plan aimed at killing Hamas leaders in Gaza and replacing the rule in the Strip with the Palestinian Authority.

Argaman’s plan received backing from several Cabinet ministers, including Ze’ev Elkin and Avigdor Liberman, but it apparently did not fit Netanyahu’s agenda. Argaman concluded that the prime minister preferred to weaken the Palestinian Authority for political reasons while buying time in the face of Hamas’s growing power in Gaza through Qatari money and endless discussions on a ceasefire.

Netanyahu’s successor as premier, Naftali Bennett, also disagreed with Argaman and continued down the path of de-escalation. Bennett even increased the quota of workers allowed to enter Israel from Gaza, contrary to the Shin Bet’s strong stance.

Argaman’s plan for an early strike in Gaza was also rejected by the then-IDF Chief of Staff Lt. Gen. Aviv Kochavi, who preferred to maintain relative calm in the Strip and focus on other fronts.

Meanwhile, according to Shin Bet sources, the IDF drastically reduced intelligence gathering in Gaza and redirected its collection means, mainly drones, to the northern front. Hamas managed to create a deceptive calm in Gaza, which suited the interests of the Israeli political leadership and all security bodies, except for the Shin Bet.

The Shin Bet’s offensive approach towards Gaza did not change during Bar’s tenure. In a strategic assessment Bar conducted upon taking office in October 2021, he wrote, “Israel cannot afford to live with an enemy like Hamas near its border with military capabilities.”

But Bar had to yield to Israel’s policy of maintaining quiet and containing the threat. During his tenure, he presented several plans for killing Hamas leaders in Gaza, all of which were rejected by Netanyahu and Bennett. “Your ability to preemptively thwart the threat in Gaza was very limited because it was subject to approval, which never came,” said a security source. “Once you can’t preemptively thwart, you wait for the terrorists at the fence and lose all your advantage.”

However, Bar, according to sources familiar with the details, did not confront the IDF and the political echelon as forcefully as his predecessor Argaman. For example, Bar supported increasing the number of permits for Gazan workers, a position he expressed in the political and security discussions leading up to Oct. 7, which aligned with the positions of the Military Intelligence Directorate and the Defense Ministry’s Coordinator of Government Activities in the Territories unit. “Ronen preferred to align with the IDF,” claimed a former senior Shin Bet official.

‘Sinwar decided on a change’

Despite the policy of containment, the political and intelligence communities were fully aware that Hamas was building its strength for a comprehensive attack on Israel, to be carried out by its elite Nukhba Force.

The plan for “Al-Aqsa Flood,” uncovered by the Israeli Intelligence Corps’ Unit 8200 and referred to by Military Intelligence as “Walls of Jericho,” was first shared with the Shin Bet in 2018 and again, in greater detail, in 2022. In hindsight, the Shin Bet now acknowledges that the plan was not properly internalized or integrated into its thinking. The prevailing assessment was that the plan would only materialize sometime around 2025 and that until then, the likelihood of it being implemented was low.

“The narrative was that Hamas was acting based on considerations of feasibility and that for now, the calm served its interest, as it wanted to continue building its strength and save the attack for the future,” explained a security source.

Current Shin Bet investigations suggest that even within the Hamas organization, the “Al-Aqsa Flood” was not initially considered a feasible plan. Documents seized during the war support the assumption that Sinwar was genuinely advancing negotiations with Israel and that his main focus was releasing hundreds of his operatives from Israeli prisons through an agreement rather than a military operation.

“The intelligence picture we had indicated that Hamas was not gearing up for war,” said a military source. “But at some point, Sinwar decided on a change.”

The Shin Bet believes this happened at the very last moment. Progress in normalization talks with Saudi Arabia, advancements in Israel’s laser missile defense system, and actions by National Security Minister Itamar Ben-Gvir to harden the conditions of Hamas prisoners in Israeli prisons and disrupt the status quo on the Temple Mount—all led the Hamas leader in Gaza to consider a grand move that could fundamentally alter the balance with Israel. Sinwar, with his sharp instincts, also sensed that Israel was preparing for a preemptive strike in Gaza, an attack the Shin Bet had indeed been advocating for in early October. He chose to strike first.

Another factor that significantly influenced Sinwar’s decision-making, according to updated Shin Bet assessments, was the political and social upheaval in Israel surrounding the judicial reform effort. Sinwar, a deeply religious man, genuinely believed that God was sending him messages through the crisis unfolding in Israel. Israel’s internal weakness, which reached the point of threatening the readiness of the Middle East’s most formidable air force, was interpreted by Sinwar not just as an opportunity, but as a divine decree.

According to one Shin Bet assessment, Sinwar made the final decision to abandon the talks and proceed with the mass attack just a week before Oct. 7, in consultation with a small group of close associates.

‘Just a drill’

To the Shin Bet’s credit, it was the first agency to pick up on the preparations for the attack and alerted the entire security establishment. “Without the Shin Bet, the system would have woken up to sirens at 6:30 a.m. The Shin Bet saw the intelligence as a real threat,” said a security source.

The intelligence that alerted the Shin Bet, which brought Bar to the organization’s headquarters in Tel Aviv, were Israeli SIM cards, linked to Hamas’s Nukhba Force, which began to activate one by one on Oct. 6. The tracking of these SIM cards was possible thanks to an outstanding intelligence operation, entirely under the responsibility and initiative of the Shin Bet. Unfortunately, this was not enough.

Until recently, according to senior former officials in the Shin Bet’s Southern Division, the activation of the SIM cards was “a clear sign of war, even without any additional suspicious signs.” One of them explained, “The reason for this, as Nukhba members told us during their interrogations, is that when there’s a drill that includes the activation of SIM cards, they receive instructions to go to a mosque. They go to the mosque without their personal phones, then descend into the tunnel to stock up, so they have no signal for several hours or even days. From that moment, they can’t report what’s happening—whether it’s a drill or a real attack—and therefore, our working assumption was that once the SIM cards are activated, we must be on high alert.”

As for the SIM cards, this was not the first time they had been activated. In previous instances, it had been for drills. This was also the main assumption in the Shin Bet that night—a Hamas drill, nothing more.

In the hours that followed, the Shin Bet tried to decipher the intelligence picture. One possibility that arose was that the activation of the cards meant Hamas was preparing for defense, not for an attack, fearing that Israel was preparing for a preemptive strike in Gaza. That this was preparation for an invasion across the entire front was not considered by the Shin Bet. The more cautious figures in the agency claimed at the time that, at most, this was preparation for a limited infiltration attack. No one, throughout the entire night, talked about “Al-Aqsa Flood.”

Following the activation of the SIM cards, the Shin Bet held discussions with its counterparts in the IDF. Among them, the head of the IDF Southern Command, Maj. Gen. Yaron Finkelman, conducted a joint situation assessment with the Shin Bet during the night. “The discussions with the IDF were continuous, and the picture was presented clearly,” said a security source. However, Bar and IDF Chief of Staff Lt. Gen. Herzi Halevi did not speak to each other that night.

At 2:58 a.m., the Shin Bet sent an alert to the Military Intelligence Directorate, the Mossad and the police, noting the activation of the Nukhba SIM cards, which could suggest offensive intentions. However, this message was not framed as a war warning. Far from it. “So far, we have no information on the nature of the activity,” the Shin Bet reported. “However, it should be noted that these are unusual activities, and given other suspicious signs, it could indicate an offensive action by Hamas.”

Yet, such suspicious signs did not come to the Shin Bet in any significant manner. Throughout the night, Shin Bet field officers in Gaza spoke with their agents in the Strip, but these agents did not provide any intelligence about an impending attack, and in fact, they reassured the system. The agency is now investigating whether these agents lied or if they genuinely were unaware of the attack.

According to Shin Bet officials, “On Oct. 7, we had human sources, some within Hamas. Against the small group of people planning the attack, we were looking for a human intelligence network that could provide early warning signs. That asset was supposed to give us much more than we got. This issue is at the heart of the investigation, and there’s no doubt we should have done better. Although we did receive human intelligence reports, for every suspicious sign, we received a contradictory one.”

At 4:30 a.m., Bar held a situation assessment at the Shin Bet’s headquarters in Tel Aviv, attended by the heads of the various divisions. At this stage, the assumption was that Hamas’s activities in Gaza could indicate coordination with other parties outside the Strip, with an operation expected to take place in the near future, but not in the coming hours.

One of the decisions made at the end of the discussion was to declare “tequila” orders. “The assumption was that if we were wrong in our assessment, they would provide an initial response,” said a security source. There are no words to describe the gap between the Shin Bet’s intelligence assessment during the discussion at 4:30 a.m. and the reality that came crashing into their lives two hours later.

‘The grocer in the grocery store’

To fully understand the gap and the challenges faced by the Shin Bet in its intelligence work against Hamas in Gaza, it’s necessary to look at history. “The failure didn’t begin and end on Oct. 7,” said a former Shin Bet officer who spent many years in the Gaza Strip. “It’s an ongoing failure.”

The primary strength of the Shin Bet as a counterterrorism agency has always been its reliance on human intelligence, a resource operated by its regional counter-terrorism divisions. Officers in these divisions were assigned responsibility for specific areas, and through human sources they recruited and operated, they could know exactly what was happening within those areas. “The Shin Bet’s approach has always been geographical,” explains a former officer. “The officer knows the area like the back of their hand—who lives where, the history of families, dominant families, problematic figures to keep an eye on, etc.”

“Traditionally, the Shin Bet’s HUMINT relied on what we called ‘basic cover,’” said a former regional officer in Gaza. “Basic cover sources were the barber in the salon, the grocer in the store, and the street cleaner, who would tell you what was happening in their neighborhood. Of course, there was always the goal of recruiting sources directly from the target groups, i.e., within terrorist organizations, but the prevailing philosophy of the Shin Bet was based on basic cover, especially when dealing with fundamentalist Islamic groups, which are very hard to infiltrate.”

However, since the Gaza disengagement in the summer of 2005, and especially after Hamas took control of the Gaza Strip in late 2006, the Shin Bet has had to fundamentally change its methods of operation in Gaza. “Until 2005, the Shin Bet operated in Gaza as it was accustomed to, with the ability to meet sources and communicate with them,” said a Shin Bet HUMINT officer. “After the disengagement, that was a completely different ballgame.”

Speaking of Tehran

In the early years, Shin Bet officers still managed to sneak some of their sources into and out of Gaza, but over time this became increasingly difficult, nearly impossible. A senior former Shin Bet officer said that in 2019, Hamas completed the establishment of a surveillance network that completely surrounded Gaza’s borders, both by land and sea. “From that moment, there is almost no way to infiltrate Gaza without being seen,” he said. “That’s why it’s so difficult to recruit and operate agents there.”

Moreover, Hamas became highly skilled in detecting Israeli intelligence sources and capturing them. In many cases, they also executed them. The Shin Bet is now investigating whether some of the sources it operated in Gaza were actually agents captured by Hamas and turned against the agency.

As a result, the Shin Bet began to devote more and more technological resources to Gaza, some of which were used to communicate with its agents in the Strip. But Hamas didn’t stand still either. Iranian knowledge and funding, which began flowing into Gaza in recent years, significantly boosted Hamas’s ability to detect sources using technological means, said a former senior officer in the Shin Bet.

“Hamas did a good job: It both sealed off the border and located our HUMINT sources, struck them, and created deterrence for others. Essentially, Gaza became a closed area—there is no entry or exit—a very small, intimate place where everyone knows everyone. This created a huge challenge for Israel in dealing with terrorism. Hamas is very insular and knows how to keep secrets, unlike Hezbollah, which we saw was deeply infiltrated. In recent years, there is no place on the globe where it’s harder for Israel to carry out operational and intelligence activities than the Gaza Strip. This includes Tehran.”

‘They fired everyone’

The Shin Bet’s attempts to bridge the “HUMINT gap” in Gaza through technological means significantly increased under the leadership of Argaman and Bar, both operational officers who did not come from HUMINT backgrounds. “The service began to look more and more like Military Intelligence,” said a former Shin Bet officer.

In 2018, the number of Shin Bet geographical divisions in Gaza was reduced to only two—South and North. In place of the canceled divisions, “dedicated” divisions were established, meaning those based on a specific issue (e.g., armament, rocket systems), not geographic division. For former field officers, this change was catastrophic.

“By reducing the divisions to two, you overload each officer so that they cannot learn the area,” said a former officer in the Gaza Division. “When you take the officers out of the field itself and leave them with only two divisions, it’s like playing soccer with five basketball players. Don’t expect to get the intelligence you need.”

A senior former officer added, “The moment the assumption was that we could ease off on HUMINT, I think we lost.”

One of the areas neglected due to the reduction of divisions, according to former Shin Bet officers, was the Gaza-Israel barrier. “We had many basic cover sources there,” said a former officer who served in the Gaza Division until about six years ago. “We called them ‘ground drones’ because they covered the entire border line. They were like a human fence, alerting us to any unusual activity before the IDF’s observers could spot it. They could detect preparations or gatherings of operatives beyond the first line of homes, which was covered by IDF observers. Their role was to alert us to any unusual movement or event.”

Q: What happened to the Shin Bet sources?

“To the best of my knowledge, they fired everyone. They shifted toward more complex recruitment operations, from which you get a source maybe once a year. That’s not something that works with the masses and the constant friction of Gaza.”

A coordinator who served in the Gaza Division and returned to reserve service in the Shin Bet during the war said, “In my time, we defined the border as a recruitment target. There was an understanding that this is an area that needs to be not just covered but covered excellently. Now I was surprised to discover that this doesn’t exist anymore.”

According to that coordinator, between 2012 and 2023, the number of Shin Bet sources—not only in the border region but in Gaza in general—was reduced by about 50%.

The Shin Bet, however, counters this by claiming that during the terms of Argaman and Bar, the counter-terrorism divisions in Gaza were strengthened and received significant budgets, especially in the human intelligence field. Bar set goals for recruiting agents in Gaza, and since 2021, the Shin Bet has recruited many agents there. As for the reduction of operations, after the war and the IDF ground operation began, the number of operations returned to its previous level.

A former senior official in the Shin Bet claims that even during Argaman’s tenure, “we invested in technology designed to serve HUMINT, not replace it, to bridge the gaps created in Gaza. The interest of the Shin Bet director is maximum intelligence. The tools through which you extract this intelligence are the tools you invest in. The Shin Bet never harmed HUMINT in any way, only added technology to it.”

Not everyone is convinced. A former member of the IDF Southern Command Intelligence said, “For many years, the backbone of the Shin Bet was the operation of HUMINT sources. That was its tremendous relative advantage. The constant message was ‘leave HUMINT to us.’ But what happened to the Shin Bet is similar to what happened to the Military Intelligence Directorate. The management of the Shin Bet became much more dominated by operational officers, like Argaman and Bar, rather than HUMINT officers. I think the Shin Bet raced into an era where operations and cyber became much more dominant compared to the outdated profession of HUMINT operations. Don’t get me wrong—the Shin Bet did some great things in Gaza, but the question is what was the price.”

Further breakdown of the geographic structure

The geographical breakdown in the Shin Bet was also evident in Bar’s decision to transfer full responsibility for Hamas operations, not only in Gaza but also in Lebanon and other countries, to the Southern Region, contrary to past divisions.

A former senior Shin Bet official explained: “The advantage of the Shin Bet is that it works geographically. Abolishing the geographic division and shifting to a thematic division is essentially eliminating the Shin Bet’s relative advantage as a counterterrorism organization. When you take a geographical unit and sever it from its region, you create failures.”

The Shin Bet counters this by claiming that the transfer of full responsibility for Hamas to the Southern Region proved itself in the organization’s successful operations in Lebanon during the war.

The Shin Bet also deserves credit for its rapid recovery, which began on the morning of Oct. 7, when dozens of its agents went to fight in dozens of areas, suffering painful losses: Ten Shin Bet operatives were killed that day. Afterward, the Shin Bet went into war mode across all areas: Gaza, Judea and Samaria, Green Line Israel, Lebanon and foreign security.

---

Originally published by Israel Hayom.

---

---