Analysis

How Israel Stopped a Third Palestinian Intifada

Ex-Shin Bet cyber chief describes how the 2015 wave of 'lone wolf' attacks required Israel to think out of the box

A Palestinian demonstrator in Jerusalem’s Shoafat refugee camp raises a knife, in October 2015.
AP

It started four years ago this week: a succession of brutal terrorist attacks in the West Bank and Jerusalem that quickly spread across the Green Line. After a period of relative quiet – in terms for this region – the Israeli security forces encountered a completely new phenomenon. For weapons, dozens of young Palestinians, most of them with no terrorist background, were using whatever was handy – from kitchen knives to cars – to stoke an unusual wave of terror attacks.

By the end of 2015 there had been nearly a hundred attacks and attempted attacks. Before the violence abated, more or less, a year later, about 50 Israelis and more than 200 Palestinians had been killed. Most of the dead on the Palestinian side were the assailants themselves; they were shot dead while carrying out an attack or immediately thereafter.

For months, the Israeli media wrestled with the question of what to call the phenomenon. The Israel Defense Forces and the Shin Bet security service used the phrase “events of the enormity of the hour.” Journalists chose names like “the knife intifada” and “the lone-wolf intifada.” In retrospect, the latter moniker was perhaps most appropriate, even if the word “intifada” exaggerated the intensity of the wave and its ramifications. For a few weeks Haaretz called it “the third intifada,” but it turned out we were wrong because the phenomenon was quickly contained.

How was a third intifada averted even before the events justified that name? Probably the person best suited to answer that question is Arik Brabbing, who headed the Shin Bet’s Cyber Directorate before the events began. As the events unfolded, he was named the organization’s commander for Jerusalem and the West Bank. An article he published recently with Capt. Or Glick in the IDF journal Bein Haktavim offers an extensive analysis of that tense period, which probably also sheds light on future escalations in the territories. It’s the first comprehensive and declassified publication by an official who had a close-up view of the events.

Brabbing says the attacks by unaffiliated individuals didn’t begin with the lone-wolf intifada and didn’t end with it. Initial indications of significant local initiatives without links to organizations were the 2008 shooting attack at the Mercaz Harav Yeshiva in Jerusalem and the ramming attacks using earth-moving equipment in the city in 2007 and 2008. Another wave was linked to the tension on the Temple Mount in the fall of 2014. And in the summer of 2017, after the lone-wolf intifada had receded, three Israeli Arabs from Umm al-Fahm shot dead two police officers at the Mount.

Over the years, the Mount has been a recurring catalyst for radicalizing young Palestinians; concerns that Israel will harm the Al-Aqsa Mosque or change the prayer and visiting arrangements on the Mount whip them into a frenzy time after time.

Between the lines of Brabbing’s article, the Shin Bet’s opposition to steps taken at the Mount is discernible. Brabbing calls the decision by Prime Minister Benjamin Netanyahu to place metal detectors at the entrances to the site after the deaths of the officers (a decision Netanyahu retracted a week later under pressure from the defense chiefs) is like throwing a burning match into a haystack.

The lone-wolf terrorism, he writes, differs from the terrorism Israel knew in the first and second intifadas. “The means of combat are different,” Brabbing writes. “The modes of operation are not the usual type, and above all, the human profile of the perpetrators differs significantly – the terrorists are younger and lack an affiliation to an organization. That’s the gist of the problem that the Shin Bet faced in this campaign …. The service had to revise its traditional patterns of operation, which were suitable for coping with organized terrorism, and adopt working methods and intelligence gathering relating to individuals.”

The average age of the new terrorists was 16 to 20, compared with 23 to 27 in earlier periods. The participation of women, mostly young and from difficult family backgrounds, also increased substantially. Besides not being connected to terror groups, most of the new terrorists didn’t espouse extremist Islamic ideology, and some pursued a fairly secular way of life.

Even when they operated in cells, these were small. They obtained guns by themselves (usually a homemade Carl Gustav submachine gun, known colloquially as the Carlo). And they didn’t abide by any organizational hierarchy. In many cases, they carried out “inspiration attacks” – they tried to emulate previous attacks by other young people that were highly publicized.

Muslims praying in front of metal detectors outside the Temple Mount in Jerusalem, July 16, 2017.
Olivier Fitoussi

The agitation at the grassroots, Brabbing writes, began with the kidnapping and murder of the three Israeli teens in the West Bank in June 2014, the Gaza war over the following two months, and the tension around the Temple Mount that October. The wave of attacks that erupted a year later was also influenced by the confrontation on the Mount, which stemmed from the Palestinians’ feeling that Israel would change the status quo at the site.

Brabbing discerns “a total lack of trust concerning the intentions of the Israeli authorities in general and their actions on the Temple Mount in particular …. The Temple Mount is a common denominator that stokes identification among all the elements of the Palestinian street: young and older, secular and religious.”

Anger over the many Palestinian casualties, among them many civilians, in the Gaza war also spurred a desire for revenge. All this was compounded by friction with Israeli soldiers in the West Bank, the arrest operations, the situation at the checkpoints, the economic distress (though conditions are better than in the Gaza Strip), high youth unemployment, despair at the political deadlock and frustration with the Palestinian Authority, which is perceived as corrupt.

The mass uprisings of the Arab Spring also provided inspiration for the lone-wolf attacks. Many of the assailants, particularly the women, had personal problems; the prospect of dying a hero’s death validated what was effectively “suicide by the IDF.”

New ways of thinking

Brabbing stresses the role of technology, especially social media, in disseminating the messages of revolt, and by the same token the Israeli preventive and preemptive actions. In some cases, he notes, assailants hinted at their intentions on Facebook and elsewhere; in some cases they also posted a “last will.”

If the Temple Mount was the lit match, he writes, social media was the haystack from which the flames leaped. But he’s not particularly impressed by the role played by incitement in the Palestinian media and schools in the West Bank. He confirms that the phenomenon exists, but says it had little effect on the lone wolves.

The shift in the pattern of classic Palestinian terrorism, Brabbing suggests, forced the Shin Bet to develop new ways of thinking. “The service’s expertise was based almost entirely on [understanding] organized terrorist infrastructures …. In the terrorism of individuals, there was no clear target to be investigated. The service found itself confronting attacks by individuals that lacked distinctive operational signatures,” he writes.

“Moreover, there was no intelligence information about them, as most of them were very young and hadn’t previously taken part in violence. That made it difficult to identify attacks in advance and issue warnings. The service’s expertise was not appropriate for the terrorism of individuals.”

For advance warnings, a new model had to be developed based on the assailants’ character traits and the study of previous cases. “Instead of looking for a model of the adversary’s activity, we switched to locating signs reflecting a modification of behavior,” Brabbing writes.

Palestinians clash with Israeli border police at a checkpoint between Shoafat refugee camp and Jerusalem, October 9, 2015.
רויטרס

That modification of behavior was seen online. The Shin Bet, he notes, in a first detailed reference to the new methods of operation, “looks for signs indicating preparatory actions (a post on the web, a purchase of a weapon), an increase or decrease in the volume of activity, the creation of new contacts, the joining of a new virtual community and more. Monitoring the web and identifying unusual activity in the ocean of information produced warnings that had not been possible via traditional intelligence.”

The new digital signatures were cross-checked with more traditional sources of information. such as security camera footage and agents’ reports. The Shin Bet, Brabbing writes, “redirected its resources and sensors. The service planned and developed new technological, operational and intelligence tools of mining, extracting and fusing information from the internet. Immediately afterward, this was passed on for use by the end units.”

To fuse the information quickly – in some cases the security forces had only minutes to respond after the posting of a “Facebook last will” – cooperation with the other security branches was tightened, particularly with the IDF’s Central Command and the Unit 8200 signal intelligence corps.

“Military Intelligence’s knowledge infrastructure for covering the population in [the West Bank] forged multiple information layers that enabled cross-checking between many identifying details. The Shin Bet’s infrastructure was directed toward creating content files on entities (people, computers, houses) …. The service’s traditional expertise and knowledge of the field went hand in hand with the technological expertise of personnel in the information systems, analysis and Big Data people.”

He adds: “If in the past the conception was binary – [the suspect] belongs to a terror group or not – now the models include the ranking of the threat in accordance with activity on the web and other means. The challenge was to distinguish between a genuine potential lone terrorist and expressions of hatred that do not lead to action but are only words. A precondition for success in using information systems lies in access to intelligence reports by all users – without compartmentalization.”

An invasion of privacy

With this new knowledge base, the security branches moved to eliminate the threat, or at least reduce it to a tolerable level. “Indeed, when it came to the terror of individuals, we had to offer a more precise and surgical response than in coping with organized terror,” Brabbing writes. “Action against Hamas could be noisier than an operation aimed at a lone terrorist.”

Like many senior IDF officers, Brabbing also opposes using collective punishment to deter lone-wolf terrorists – a policy switch that senior ministers in Netanyahu governments have urged in recent years but which the prime minister has refused to adopt. “The essence of the decisions was to avoid collective punishment or aggressive action that is neither necessary nor effective; for example, placing checkpoints or imposing closure on villages that will affect the routine of life and heighten the social tension that leads people to become terrorists,” Brabbing writes.

He’s cautious in discussing security coordination with the Palestinian Authority. Not until several months into the wave of attacks did the PA’s security units go into action against the lone-wolf assailants.

“In the first stages, they refrained from taking action and to a certain degree supported the attacks,” Brabbing writes. “In later stages, the understanding developed that the attacks were harming not only Israel but also the PA and its resilience. They undermine the perception that the PA is in control on the ground. The Palestinian security agencies began to deploy to assist in stopping the attacks.”

The PA warned young people who were considered potential threats, and in some cases also brought in their parents. In some instances, if there was no choice, the PA arrested people suspected of planning a future attack. “These multiple efforts brought about a significant change in the tendency of the attacks by individuals,” Brabbing adds.

He also discusses the deterrence of such attacks in the future. For one thing, he’s against Israel’s practice of holding onto bodies of killed assailants, because it had proved to be ineffective.

“When the bodies were returned, mass funerals were held with the accompaniment of Palestinian police officers, but if we did not return bodies, the families were deeply offended,” he writes. “Instead of preventing attacks, we caused damage in terms of consciousness, and this measure does not appear to have had an effect on the attacks.”

On the other hand, Brabbing supports the demolishing of the home of an assailant – a controversial measure among defense officials for years. He says that in many cases family members have informed on young people planning an attack, out of fear that their home would be razed.

What Brabbing is describing here in almost academic language, at times implicitly, is basically a technological struggle against lone-wolf terrorism. Stepping up monitoring of the web and the integration of information with other intelligence sources has let Israel’s security branches, led by the Shin Bet, detect signs of unusual activity by young people about to carry out an attack on their own or with a few friends.

The need to address the phenomenon, which affected Israelis’ sense of personal security at the end of 2015 and threatened to trigger a third intifada, led to the authorization of technological efforts on an unusually large scale. The result was even greater Israeli intrusion into the private lives of hundreds of thousands of Palestinians in the West Bank.

Last month, the memoirs of Edward Snowden, the NSA whistleblower, came out. In Israel, where the assumption is that most online surveillance targets West Bank Palestinians and is aimed at preventing terrorism about to happen, there is hardly any public or media discussion of the subject.

The preventive efforts of the Shin Bet and IDF are generally perceived by the public as a success that lets Israelis live their day-to-day lives with little interference. Thus it’s likely that Israel’s monitoring of the Palestinians in the territories will only increase as part of the confrontation between the two peoples.