The Israel Defense Forces identified five signs of unusual Hamas activity the night before the terror group’s October 7 onslaught, but believed they did not indicate an imminent attack, according to a military investigation into the decision-making process made by top officials on the eve of the attack.

The investigation found that the IDF’s conduct, decision-making and the intelligence it possessed on the night between October 6 and 7 were based on the result of years of false assessments about Hamas.

As a result, intelligence officials on all levels failed to provide a warning for what would come. Hamas’s October 7 attack claimed the lives of more than 1,200 people in Israel, mostly civilians, with another 251 people kidnapped and much of the area devastated.

During the night between October 6 and 7, the military identified at least five indicative signs that pointed to unusual activity by Hamas.

Some of the anomalies also had alternative explanations or were not considered strong enough.

Alongside the anomalies, several other signs were received that indicated Hamas was maintaining its expected routine activity.

The anomalous signs included Israeli SIM cards in the hands of Hamas Nukhba terrorists being activated and four other signs of Hamas activity, which remain classified.

Each of the signs alone did not indicate anything significant in the IDF, and some had occurred several times in the past. However, the accumulation of the signs was unusual, and as a result, during the night, numerous checks were made by intelligence officers to confirm or refute plans by Hamas to attack Israel. Senior officers also held assessments on the matter.

Some of the checks led to the signs being dismissed, while others remained open. Regardless, not one officer interpreted the signs as something that could happen imminently.

The investigation also found that additional intelligence could have been used that night to enrich the known information and intelligence picture. The investigation also found that some information had reached senior officers while some did not.

Still, the investigation found that if a full intelligence picture had been seen by top officers, it is possible that they would have decided to raise the level of alert for a pinpoint Hamas attack, but not for an all-out war.

The investigation found several reasons why the alert level was not raised, despite the signs:

The investigation also found that the Intelligence Directorate’s method of operating concerning surveillance on Hamas was based on Israel’s perceptions that the terror group would act in a pinpoint manner and not a wide-scale attack. Therefore, there was a focus on specific areas in Hamas rather than a wide-ranging surveillance campaign. This resulted in Hamas’s wide-scale attack plans not being identified correctly.

The actions taken by the IDF during the night, including shortening the dispatch time of drones and a helicopter and deploying a small counterterrorism team, were based on the military’s understanding of the potential threat at the time.

Still, the investigation found that the Gaza Division did not prepare adequately for the most extreme potential scenario, which still far underestimated the attack that was ultimately carried out.

Additionally, officials did not perform proper checks before deciding not to adjust the troop deployment on the border for fear of burning sources, though it did do so when it came to the dispatch of surveillance drones, the investigation said.

At 9 p.m. on October 6, 2023, the Shin Bet security agency identified a handful of Israeli SIM cards in the hands of Hamas Nukhba terrorists being activated. The SIM cards are a Shin Bet source in Gaza, and the IDF does not have access to them. A Shin Bet representative updated the intelligence officers at the Gaza Division and Southern Command on the development via WhatsApp. Later in the night, more SIM cards would be activated, reaching several dozen in total.

According to the investigation, the SIM cards are activated relatively frequently in Gaza, at least 10 times a year, though usually not dozens at a time. Several SIM cards were also turned on on October 5, as well as another day in the weeks before the onslaught. (Additionally, dozens of SIM cards were activated exactly a year prior, when Hamas had initially planned to launch its attack on Israel.)

The two intelligence officers updated their respective superiors, Gaza Division chief Brig. Gen. Avi Rosenfeld and Southern Command chief Maj. Gen. Yaron Finkelman, at 9:30 p.m., about the SIM cards. Finkelman was in Israel’s north for a family weekend vacation during the Jewish holidays.

At 11:30 p.m., certain Hamas activity was detected. However, after checks, the sign was dismissed. At midnight, another indicative sign was received, though it was also dismissed after looking into it.

At that point, the Southern Command intelligence officer held another call with Finkelman, during which they discussed possible actions by Hamas. Meanwhile, intelligence officials continued to look into the signs, and nothing unusual was found.

Between 2:30 and 3 a.m., another piece of intelligence was received about Hamas activity. Checks were made, and intelligence officials concluded it was likely a drill.

At the same time, between 2 and 3 a.m., the office of IDF Chief of Staff Lt. Gen. Herzi Halevi spoke with the Shin Bet about the developments.

At 3:10 a.m., the then-chief of the Military Intelligence Directorate, Maj. Gen. Aharon Haliva, then-head of Unit 8200, Brig. Gen. Yossi Sariel, and then-head of the Research Division, Brig. Gen. Amit Saar, were updated for the first time on the developments.

At 3:20 a.m., Halevi, who was at home at the time, was updated by his office manager, and the chief of staff requested to speak with Finkelman, who was mid-assessment with his intelligence officer. They would hold a call at around 4 a.m. While he was waiting, Halevi wrote on a paper: “Don’t convince ourselves that this is nothing.”

Between 3:15 and 3:50 a.m., Finkelman held an assessment with the intelligence officers of the Southern Command and Gaza Division, as well as two senior Shin Bet intelligence officials. Normally, Finkelman would not interact with the Gaza Division intelligence officer but decided to bring him on the call to hear different opinions. For the same reason, the two Shin Bet officers were on the call.

The Southern Command intelligence officer in the call described the current situation, and the Gaza Division intelligence officer agreed with him, as did the two Shin Bet officers.

All four intel officers stated that whatever could be developing was not imminent, and Hamas’s Nukhba terrorists were in their normal routine.

Three potential actions by Hamas were discussed in the call:

Following the call, Finkelman, in agreement with the Shin Bet, dispatched to the Gaza border an elite counterterror force, known as a Tequila team — made up of Shin Bet fighters and members of the police’s elite Yamam unit — to be on alert.

He also instructed the commander of the Gaza Division’s Northern Brigade at 4 a.m. to return home from his weekend vacation.

Meanwhile, the Operations Directorate requested to carry out a surveillance mission over Gaza in the morning hours and updated the Israeli Air Force on the developments to scramble drones for this purpose. Before the war, only one drone was normally over Gaza. An additional drone was dispatched in the morning hours, just before the onslaught, while a third, which was flying over another area in Israel, would also join the effort later.

Further actions were not taken over fears that Hamas would identify the IDF’s actions, and thereby would “burn” the military’s intelligence sources in Gaza.

Meanwhile, the Shin Bet at 3:30 a.m. wrote up a report on the developments, stating that Hamas was acting according to its routine and was not interested in an escalation.

Between 4 and 5 a.m., numerous calls were held between the Southern Command and Israeli Air Force on moving up the deployment of drones, as well as moving a helicopter to the Ramon Airbase in southern Israel, to shorten the distance it needs to fly to the Gaza Strip.

Between 4 and 4:30 a.m., Halevi held a call with Finkelman, which Operations Directorate chief Maj. Gen. Oded Basiuk also joined.

In the call, Finkelman described the situation to Halevi, including all the indicative signs and their explanations, and stated that according to the intelligence officials, the potential threat was not something imminent. Halevi brought up potential actions by Hamas in the call, including infiltrations from the sea, from the air, or using tunnels.

Halevi also instructed to increase surveillance on Hamas, and hold a new assessment at 8:30 a.m. or earlier if new information is received. (From 3:30 a.m., there was no new information coming from the Gaza Strip.)

Intelligence chief Haliva was not on the call with Halevi, though he would later tell the IDF chief that: “If I was on the call, I would have only strengthened what the others told you.”

Between 4:30 and 5:20 a.m., Basiuk held calls with Research Division chief Saar and other officials and worked to shorten the dispatch time for the Tequila team and IAF drones. Following the calls, Basiuk’s office manager sent a WhatsApp message to a group with all the other General Staff office managers on the developments.

By 5:30 a.m., IAF chief Maj. Gen. Tomer Bar was updated. Navy chief Vice Adm. David Saar Salama, was not updated that night.

Calls and assessments continued in the IDF up until 6:29 a.m., when Hamas launched thousands of rockets at Israel and thousands of terrorists infiltrated the country.