What is Unit 8200, Israel’s cyber warfare cell linked to Lebanon attacks?

A notorious Israeli intelligence outfit named Unit 8200 has come under the spotlight after a string of attacks that targeted wireless devices reportedly used by Hezbollah members in Lebanon, killing at least 37 people, including children.

The number of injured was over 3,500 in the attacks that saw near-simultaneous explosions of paging devices and walkie-talkies over two days.

In line with its policy of not commenting on operations by its dirty tricks department, Israel has maintained total silence on the Lebanon attacks, though the needle of suspicion has swung towards the shadowy 8200, the largest single unit in the Israeli military.

Unit 8200 is the main signal intelligence-gathering unit of the Israeli military, responsible for developing, using, and analysing information-gathering tools and sharing the intelligence with relevant officials, according to the website of the Israeli military.

In addition to its spying activities targeting Palestinians in the occupied West Bank and Gaza, the mission of Unit 8200 also involves “incorporating offensive cyber tools” alongside cyber “defence”, according to a senior officer from the division quoted in a 2018 Ynet report.

The unit’s culture is characterised by an “unusual degree of freedom”, with recruits typically drawn from young individuals in their late teens and early 20s, often identified through highly competitive high school programs.

Close collaboration with Mossad

Some sources, including a senior Lebanese security official, suggest that Israel's Mossad was behind the operation, which involved planting explosives inside 5,000 pagers ordered by Hezbollah.

A Western security source added that Unit 8200 played a crucial role in the development stage of the operation.

This involvement seems likely, as intelligence gathered by Unit 8200 is frequently shared across the Israeli armed forces and with Mossad, according to a Forbes report, which quotes Yair Cohen, a former commander who spent 33 years with the unit, as saying: “There isn’t a major operation, from the Mossad or any intelligence agency, that 8200 is not involved in.”

Unit 8200 traces its origins to Israel's early phone eavesdropping, codebreaking and other intelligence efforts during the British mandate until the creation of the Zionist state.

Over the years, the unit transformed into a technological powerhouse at the heart of Israeli intelligence, undergoing several name changes in the process.

The cyber warfare unit is reportedly capable of spying on communications, including phone calls and emails from most countries, including the Middle East, Europe, Asia, and Africa.

The division is also known for its advanced cyber operations, which are capable of disrupting enemy infrastructure—most recently seen in the pager attack in Lebanon.

Unit 8200's largest signal intelligence hub, the Urim base, is situated in Israel's Negev desert, located in the southern part of Israel, according to a report by Le Monde Diplomatique.

In 2010, the French monthly revealed that the Israeli base possesses rows of satellite dishes, barracks, and over 30 listening antennas —making it one of the largest signal intelligence facilities in the world that is capable of intercepting communications across the globe.

In that way, Unit 8200 works similarly to the US’s National Security Agency (NSA) and Britain’s Government Communications Headquarters (GCHQ).

Intelligence leaked to Israel’s allies

Much of the data collected by Unit 8200 is shared not only within the Israeli military but also with external allies, which usually include the US, Britain, and Canada, according to a 2019 study published by ETH Zurich Center for Security Studies (CSS).

In 2009, the two agencies signed an intelligence-sharing agreement in which the National Security Agency (NSA) of the US agreed to provide unevaluated transcripts, voice recordings, and metadata to Israel’s Unit 8200.

This is based on leaked documents provided by Edward Snowden, a former NSA employee turned whistleblower to the Guardian.

The latest explosions in Lebanon have also prompted questions about possible US involvement in the pager explosions targeting Hezbollah.

However, when pressed by reporters during a press conference on September 19, US National Security Spokesperson John Kirby dismissed any US involvement.

Responding to a question about whether the US supports such tactics of warfare, Kirby said: “I'm simply not going to be able to address these incidents.”

In the context of Israel’s war on occupied Palestinian territories, Unit 8200 has been a centre of controversy for way longer, especially over its surveillance of Palestinians in Gaza.

Several of Israel’s controversial AI-powered target creation tools, including Gospel and Lavender, which facilitated civilian casualties of catastrophic proportions in Gaza, were developed and refined with the involvement of Unit 8200, according to a Guardian report.

In 2014, at least 43 Israeli reservists openly criticised Unit 8200 for targeting civilians with no involvement in violence.

Some of the previous operations allegedly involving Unit 8200 include the Stuxnet virus attack that disabled Iranian nuclear centrifuges between 2005 and 2010, a 2017 cyberattack on Lebanon's state telecoms company Ogero, and the thwarting of an ISIS attack on a civilian airliner travelling from Australia to the United Arab Emirates in 2018.

Despite its prestige, Unit 8200 has not been immune to Israel’s broader intelligence failures during the October 7 Hamas attacks, leading to the resignation of its commander.

The unit, however, remains a cornerstone of Israel’s national security strategy.