We’re using Waze to figure out the route through the streets of Be’er Sheva, passing a small commercial center and a residential neighborhood before finding a parking spot. From the outside, it looks like any small school – a bit of grass, a few sheds and a basketball court. In fact, it is a school, but not for children or teenagers. This is a cyber school run by the Israel Defense Forces Military Intelligence Corps.
In this pleasant, kibbutz-like atmosphere, the IDF’s “cyber-warriors” undergo their training, before launching cyberattacks behind virtual enemy lines, obtaining data or disrupting systems by remote control. The school is called Ashalim, and its commander is Lt. Col. N.
“We train between 500 and 600 cadets a year here, in two main cycles,” she tells Haaretz. “We deal with all aspects of cyber, with most of our courses lasting 20 weeks.”
N. prefers not to go into detail regarding what offensive cyber means, but is willing to talk about “the development of systems that give the IDF freedom of action in cyberspace. It’s no secret,” she says, “that the army has offensive cyber capabilities.”
In order to understand the nature of this whole operation, it’s best to take one step back. In June 2015, it was reported that the chief of staff at the time, Gadi Eisenkot, was considering the establishment of an IDF cyber arm – a body that would incorporate all of the army’s cyber capabilities. To test the waters, he set up a cyber headquarters, but after much thought and consultation, concluded that this was not the best option since it was difficult to operate and would “tear up” existing units.
Instead, it was decided to divide up the work: Cyber defense would be subsumed under intelligence-gathering and cyber security, and soldiers in this unit would wear turquoise-colored berets. Troops dealing with offensive cyber activities, however, would remain under MI, wearing their green berets.
Intelligence-gathering training takes place at a separate school that focuses on computer-related fields, but the soldiers dealing in offensive cyber operations undergo training at Ashalim, a branch of the Intelligence Corps school in Glilot, in central Israel. Incidentally, Ashalim also trains people who later work in the Shin Bet security service and Mossad.
“The first stage includes an orientation, which lasts between two and five weeks,” says N, describing a typical course at Ashalim. “People come here with some prior knowledge, usually, but it needs to be sorted out. There are often conventions we don’t agree with, and we have to understand who we’re dealing with.”
The second phase, she adds, “usually lasts about 10 weeks and is intended to enhance the students’ knowledge and capabilities. They learn programming languages such as Python, C, C++, and others. The third phase, in the final 10 or so weeks of the course, involves assigning people to their future jobs. Our aim, throughout the course, is to understand the strengths and weaknesses of every student and to bolster their strong points. Some will become high-level developers, others will be low-level programmers, some will do white-box software testing and others black-box testing.”
The longest program at Ashalim lasts 25 weeks – the course for researchers. The term refers to “vulnerability researchers,” in IDF parlance: people who are trained to detect security-related weaknesses in technological systems, through which those systems can be penetrated and data can be stolen; this sometimes involves taking complete control of them by remote means. A low-level researcher deals with operating systems, whereas a high-level one deals with software or applications that use those systems. The white-box person can take control of a system by knowing something about its configuration in advance, while the black-box expert knows how to break into a system with no prior knowledge about its security capabilities.
“In most cases,” N. says, “we know which unit students will end up in, but in some cases, we make a recommendation for the next stage only during the course. The best researcher will not necessarily be the best cyber intelligence officer, and vice versa.”
What is a cyber intelligence officer?
N.: “In my previous role I set up a new branch in MI, of cyber intel officers. Like any other officer in intelligence, he has to create intel data, understand their significance and offer guidance, based on technological know-how. He needs to know how to analyze bits and bytes and integrate data, producing a clear picture, while taking responsibility for the whole process. I did this five years ago, using a collection of people performing different tasks throughout the army.”
Not everyone can get into Ashalim. Soldiers who are sent there have special skills, a familiarity with computers, or are identified as suitable for various reasons.
“All youths in Israel get a first call-up notice,” says N. “During the subsequent sorting-out process all possible data about them is collected. There are only a few army courses that are based solely on the individual’s potential, on what we call ‘psychotechnical’ qualifications. In most cases, prior knowledge is required [in our units], whether through math and computer studies in high school or university-level courses in such areas. There are also many who have participated in the Magshimim Leumit program.”
Magshimim is like a cyber “youth movement,” aimed at training and developing the cyber and computer skills of 16- to 18-year-olds in Israel’s peripheral locales – “so that not just students from affluent schools undergo cyber training,” as N. puts it. Along with a number of defense and security agencies, the Rashi Foundation is involved in this program.
It’s good to hear about the Magshimim program. There has been criticism of MI and its elite 8200 unit for being too homogenous. The argument is that it includes only people from affluent backgrounds.
“Magshimim really works and fulfills its mission. I estimate that 25 to 30 percent of students at Ashalim come from that program. There was a lot of criticism in the media about the homogenous nature of MI and its lack of diversity, but from what I know, a lot of effort is being made to change that. There are tough admission demands here, but they don’t relate to your area code – the selection process is unbiased.”
It wasn’t like that in my time. No one from my school in the Upper Galilee made it to MI.
“Some high schools talk about combat units only. There is no underlying strategy at play here but conscripts from such schools don’t ask to go to MI. The more the media discusses cyber and high-tech, the more things will change. At base, everyone is equal.”
Another “minority” group in the IDF’s technological programs are women. “I talked to our female soldiers just yesterday,” says N. “I don’t usually do that, but the present course has 6 females out of 55 students. I was happy to see that not one of them was from ritzy North Tel Aviv. Statistically, everything’s fine now. We have 12.5 percent women on average at Ashalim, and the numbers are rising. Since it’s a big course I wanted to hear how they feel among so many men.”
And what did they say?
“I took their words with a grain of salt, since they were talking to the course commander, but overall, they said they were happy – for several reasons. There are many cases [in the army] where the attitude to women is condescending, with people thinking they won’t make the grade. Sometimes there’s an opposite situation and they’re not challenged enough ... Here, the expectations are the same for everyone, and the style of learning is more in keeping with how women learn.”
The military “base” at Ashalim is arranged so that on one side are the dorms, the mess hall, the staff offices, etc., while the classrooms are on the other side. There is a path between the two, nicknamed “the River.” Cellphones do not cross the River to the classroom side, for reasons of information security.
Some of the keyboards of the computers there have white stickers on their keys, since “the soldiers have learn how to type blind,” says Staff Sgt. Y., the course commander. “They just got their mouses back.” Apparently, at some stage in the program, mouses are taken away so the students will learn how to use shortcuts on their keyboards. “It’s faster that way,” explains Y. For her part, confesses N., “I never got used to it.”
Ashalim officers monitor the personal progress of every soldier on computers, using an Excel sheet that is constantly updated.
“The main principle of learning here is not to compare. Students are not allowed to compare themselves to one another, only to themselves – their competition is with themselves,” says N. “Consider the situation we have – there are some people here who got a B.A. at the age of 18; some have already worked in high-tech (such as Y.); there was one student who sold a company; and there are some who have been glued to a keyboard since the age of 12. Each one is in a different room, otherwise there’s too much pressure. The idea is to avoid background noise such as competitiveness, which is not constructive at this point.
“When a student does exercise No. 7 on Python, he doesn’t know what exercise the student sitting beside him is doing. As the course progresses, we break the rule ourselves – people work in twos and threes, since there is value in working together. Ultimately, they don’t work alone in the units they are placed in, but we do not want competitiveness in the courses. I asked the female soldiers how they feel about it and they all said that they couldn’t have adapted without such an approach. Women relate less well to competitive learning styles.”
Another pedagogic principle at Ashalim is that no grades are given out. “There are no marks, only assessments,” explains N. “I will give back exercises that they have to do again without telling them what the mistakes were, so that they will find them on their own.”
A third principle is independent learning, done at an individual pace. Each soldier has his or her personal course of study, not just due to the desire to reduce competition, but because each person is slated to go to a different unit when the course ends.
“Each corps has its own teaching system, since they involve different professions. There is no single pattern of training: We prepare our students for practical jobs, so they can start working as quickly as possible after being stationed,” N. continues. “If I teach them programming, it’s not the best way of using my time. I very quickly integrate a practical dimension, so they can’t all study together. We end up with 30 percent frontal lectures, with all the rest based on independent learning or doing exercises. The units they end up in are closely involved in the creation of our lesson plans.”
The fourth principle at Ashalim is studying in small groups: “Our ratio is one commander to every five cadets at most, since we strive to have a training program that is as personal as possible. It’s not 100-percent personal, that’s impossible, but it’s as close as possible to everyone’s capabilities, based on their strengths and weaknesses.”
“Differential learning,” notes N. “is a sacred principle for us. The aim is to work with each student based on his or her point of departure. My aim is for each person to leave here greatly improved, to realize their potential, to reach their maximum.”
Civvies and signing on
When you walk around Ashalim you see lots of people in civvies. These are reservists, cybersecurity or high-tech people in their civilian lives, some of whom have been accompanying the school for years.
N.: “Many reservists walk around here with a profound sense of mission, some of them are people who live abroad, and when they to Israel for a visit offer to volunteer, in the spirit of, ‘We’ll come, we’ll spend a few days with you.’ Usually they come to lecture. Some of them are gifted and experienced lecturers. The reservists have another job: They provide a role model and something to aspire to. We want every generation to outdo the last one.”
Soldiers arrive at Ashalim after basic training, but that situation will soon be changing, and the course will become what the IDF calls pre-military training. That’s the army’s way of not “paying” soldiers in demand for the seniority they acquire – in effect, prolonging their army service and absorbing them after they’ve already been trained.
After their army service the vast majority of Ashalim graduates are obliged to serve in the regular army for a number of years. “There’s no course here that doesn’t require that,” says N. “Look at the extent of investment in training here. We take the best and brightest for a profession that is in demand, and invest a great deal in them. The taxpayer has to get his money’s worth. I also began my army service in a pre-military course, and signed on – and I’m not complaining.”
In market terms too, there is logic to this requirement: Ashalim graduates will easily find work in the cybersecurity industry, with a very generous starting salary – usually of about 30,000 shekels ($8,300) a month.
“I’m raising people so that they will be pursued by HR people,” laughs N., referring to high-tech human resources departments.
N. herself is actually a typical “pampered northerner” (a reference to well-to-do north Tel Aviv and its suburbs). She grew up in Ramat Hasharon and Herzliya (and in France), and enlisted in 1996, when “the expression ‘cyber’ didn’t exist, or was in its infancy.”
She enlisted in the elite pre-army course of the Intelligence Corps, called Shehakim, and was sent to the intelligence-gathering installation near Kibbutz Urim in the Negev, to be a SIGINT officer.
“Like every such officer, I studied Arabic, but from the beginning I preferred the technological aspect, and today I know programming languages far better than Arabic,” she says. “I went in the direction of technological intelligence; those were the jobs I did in 8200. At some point I left to study computer science at the Academic College of Tel Aviv-Yaffo, but returned to work as soon as possible – because like for most women, and this is supported by research – technology itself is of no significance if there’s no problem to solve. I need an objective before my eyes (for example, to hack an email address).”
N. also went on her “big trip” (which for most young Israelis is usually post-army) while still in the IDF: nine months in Kenya, Uganda, Rwanda, Thailand and New Zealand. For three years she served as a military attache in Washington, D.C.
Didn’t you get enticing offers from civilian companies?
“At every stage of my service I deliberated with myself, not because I wasn’t happy, but because I felt that it was right to ask myself whether I was doing my utmost and fulfilling my potential. At every stage I realized that the next stage in the army would allow me to continue to wield influence and to develop.”
N., 41, is the mother of an 8-year-old and lives in Tel Aviv, so a year from now she can retire on an IDF pension. Most probably, in the near future, we will hear about her getting some amazing job at one of the leading civilian cybersecurity firms.