Israel Rebuilds Open-Source Intelligence Unit After Oct. 7 Failures

Hamas's October 7th attack, including its timing and scale, surprised Israel, despite Hamas's openly declared intentions and extensive military exercises documented in videos released from Gaza since late 2020. These exercises, named "Solid Support," simulated breaching the border fence, attacking settlements, rocket fire, capturing outposts, and abducting soldiers. Hamas leader Yahya Sinwar himself warned in December 2022 of an "uncontrollable flood" of rockets and soldiers. Television series aired in Gaza also depicted invasions of Israel and soldier abductions.

Amid this wealth of publicly available information, the decision to dismantle the "Hatzav" unit, responsible for analyzing open-source intelligence (OSINT), was questioned. The unit, which operated for 72 years, was gradually reduced in scope and eventually disbanded in 2021, a process that began under former Military Intelligence Directorate (MID) head Tamir Heyman and continued under Aharon Haliva. Established shortly after Israel's founding, "Hatzav" initially monitored Arab newspapers and radio. However, with the rise of social media, its relevance diminished, and its resources and status within Unit 8200 were reduced.

Instead of maintaining a distinct OSINT unit, the MID decided to distribute its functions among research divisions to aid analysts in various theaters, while retaining some capabilities in a smaller, central unit within 8200. This approach proved ineffective, as the specialized OSINT expertise developed over years was not adequately utilized by the researchers. In early 2023, then-MID head Aharon Haliva initiated "Netivot," a training program and information system to equip researchers with OSINT skills, but the program was incomplete by the October 7th attack.

Despite the perceived intelligence failures, some within the MID maintain that even a fully functional "Hatzav" unit or its successors would not have altered the outcome, citing deeply ingrained assumptions, such as the belief that Sinwar was not interested in war. They argue that open-source information did not provide specific timing for the attack. However, the events of October 8th transformed the OSINT unit's role overnight. It became central to collecting and analyzing all available images, tweets, and videos related to the hostages, mobilizing reservists and tech professionals.

Under current MID head Shlomi Binder, appointed after the October 7th failures, the OSINT capabilities have been significantly rebuilt. Binder, who faced criticism for his role as head of operations on October 7th, has prioritized early warning as the MID's primary mission. The new OSINT array, established in January, operates independently with significant logistical and technological support, holding a status equal to Unit 8200 and the Research Division. It is three times larger than the previous unit and equipped with advanced technology, though intelligence officials emphasize the need to balance human expertise with artificial intelligence.

The rebuilt OSINT array has already contributed to intelligence gathering, including identifying targets in Iran during Operation "Lion's Roar" and analyzing public sentiment. It has also provided intelligence from Turkish sources regarding Gaza and aided in identifying individuals involved in the recent Gold Market attack. Officials acknowledge that the new unit is still in its early stages, with much more to learn and develop.