Israel Bombing ‘Cyber Operatives’ Isn’t Cyber War, It’s Just War

On Sunday, amidst Israel’s deadly bombing campaign in Gaza, the Israeli Defense Forces announced it had taken out a building housing “Hamas cyber operatives” after thwarting a “cyber offensive” from the group.

The IDF announced the strike in a tweet that included a nerdy, macabre joke. The apparent novelty of targeting hackers with bombs, and the way the announcement was made set off a flurry of reactions on infosec Twitter.

For some, the strike heralded a new moment in cyberwarfare. Hackers had just been bombed, apparently for their hacking efforts. Mikko Hypponen, a well-known security researcher who’s tracked malware for more than 20 years, said in a Tweet that “we just crossed a line we haven’t crossed before.”

But according to other experts, the reality is that this may not be an escalation in so-called “cyberwar” but just a continuation of aerial bombing campaigns. And it’s not the first time that hackers have been targeted by a major military power.

At the heart of the controversy is the lack of details about what actually happened. Who were these “cyber operatives” exactly? Why did they get designed as online combatants worthy of an airstrike? Did the strike just take out the building and whatever equipment was inside, or did it kill anyone?

The fact is—the IDF hasn’t provided much information about any of these questions. It hasn’t provided evidence that it was actually targeted by hackers, that those hackers were affiliated with Hamas, or that they were actually working out of the building shown on IDF’s Twitter. All we know is that the IDF blew up another building in Gaza, which it claimed posed an unspecified cyber threat to Israel.

Do you have a tip? You can contact this reporter securely on Signal at +1 917 257 1382, OTR chat at lorenzofb@jabber.ccc.de, or email lorenzo@motherboard.tv

On Monday, the IDF did not respond to specific questions sent via email. In response to a request for comment, the Consulate General of Israel in New York City referred to the original IDF tweet.

Israeli officials did not provide many details to the press on Sunday either. The Times of Israel reported that an IDF Cyber Division General said Hamas’ cyberattack was launched Saturday and had the goal of “harming the quality of life of Israeli citizens,” but that it wasn’t that sophisticated.

“We were a step ahead of them the whole time,” the official said, according to the article.

Given what we know and what we don’t know right now, some say it’s too early to say this is really a precedent-setting strike and an escalation of how states respond to cyber operations.

“We don't know how much of this is PR and states messaging to each other and how much of it is real,” Robert Lee, a former Cyber Warfare Operations Officer at the US Air Force, told Motherboard in a phone call.

In 2014, when Israel and Hamas went to war in Gaza, social media became a prime place for the spread of propaganda, which took the form of an extensive Twitter tit-for-tat. At the time, parallel to the kinetic war on the ground, the IDF social media machine far outmatched Hamas’ online propagandists.

Lee admitted that, if we take the IDF’s tweet at face value, this is “a high profile example” of a military force striking hackers in the real world. “That’s a pretty big deal,” he added, and it deserves to be analyzed by the international community.

But it isn’t the first time something like this happened.

In 2015, the US government killed alleged ISIS hacker Junaid Hussain with a drone strike in Syria. Hussain, who was once known as ‘TriCk” during his teenage hacking days in the UK, did some low-level hacking for ISIS, and allegedly attempted to recruit terrorists via social media. Also, the U.S. military’s Central Command, which operates in the Middle East, has repeatedly targeted “internet cafes” in Syria during the campaign against ISIS.

Moreover, the strike against the alleged “HamasCyberHQ”—as the IDF jokingly called it—should be seen in the context of the local conflict, where Israel has been willing to unleash bombing campaigns at its own discretion. Over the last few days, according to The New York Times, Israel’s air strikes killed 23 Palestinians, and Hamas killed four Israeli civilians in the worst bout of violence since the 2014 war.

“There's a thirst to see precedence in the strike where I believe there was probably little intention to set it,” Daniel Moore, a cyberwarfare researcher at King’s College in London, told Motherboard. “Attacking intelligence and support assets during conflict doesn't need precedence, Israel and others have been doing this since always.”

Listen to CYBER, Motherboard’s new weekly podcast about hacking and cybersecurity.